Pakistan's NCCIA struggles with cybercrime investigations as platform cooperation proves critical

Pakistan's National Cyber Crime Investigation Agency faced tough questions from lawmakers Wednesday over its handling of cases against journalists and its ability to investigate cybercrime.

Officials told a Senate subcommittee reviewing cases under the Prevention of Electronic Crimes Act that social media platform cooperation is critical to the agency's operations.

What is Pakistan's NCCIA and why is it struggling with cybercrime cases?

The NCCIA is Pakistan's lead agency for investigating online crimes, but it faces significant operational hurdles.

Suspects operate behind layers of anonymity that the agency cannot penetrate without help from social media platforms.

Officials told the committee that even advanced equipment can only take investigators so far without platform data.

How many cybercrime cases has NCCIA registered under PECA?

NCCIA has registered 41 cases against journalists and digital content creators since the 2025 amendment to PECA.

Across Pakistan, 689 cases against ordinary citizens have been filed under PECA since 2022 through September 2025.

Lahore and Multan each recorded 129 cases, followed by Faisalabad with 127, Rawalpindi with 72, Gujranwala with 90 and Peshawar with 52, among other cities.

Against journalists specifically, 5 cases were registered in Islamabad, 2 in Rawalpindi, 1 in Gujranwala and 1 in Karachi.

Out of 13 FIRs lodged against journalists, 11 were cancelled after initial investigation. Sindh Police told the committee that 55 FIRs had been registered in the province related to cybercrime, including one involving a journalist, and 33 of those cases had been transferred to the NCCIA.

Why are NCCIA investigations taking so long to resolve?

Senator Waqar Mehdi presented his own pending case as evidence of the agency's difficulties.

His complaint has been with NCCIA since July 2025, with three investigation officers changed and no resolution. An individual has been using his photograph and making calls from fake numbers and WhatsApp, but the agency says it cannot locate the suspect, who is based in Karachi.

"If they had expertise, the person would be caught within one or two months," Mehdi told the committee. "NCCIA says they cannot get the location. This is how cyber crimes are committed, through fake numbers, not real ones. Sindh Police's CIA could do better work."

Committee chairman Senator Sarmad Ali added that one of his own cases has been pending with NCCIA since 2022 with no progress.

How does PECA 2025 change how cybercrime FIRs are registered?

Under the 2025 PECA amendments, no police station is authorized to register FIRs for cybercrimes. All complaints are now forwarded to the NCCIA for investigation.

Where online activity leads to a physical or conventional crime, two FIRs can be registered, one with NCCIA for the cyber aspect and another with the relevant provincial police.

The Additional Inspector General of Punjab Police told the committee that approximately 500 cases of online crimes are currently under process in the province.

A proposal is under consideration to create a provincial body to share the workload with NCCIA. Sindh Police indicated it is considering a similar entity.

What role does social media platform cooperation play in NCCIA investigations?

NCCIA Director Aarif Shehbaz Khan Wazir told the committee that cybercrime differs from conventional crime because perpetrators operate behind multiple layers of anonymity.

He said the agency's own expertise provides a 60% advantage in investigations, but the remaining 40% depends on cooperation from social media platforms.

"When platforms cooperate with us, we obtain the suspect's devices such as laptops or mobile phones and analyze them, then everything becomes clear," Wazir said. "But if I do not have access to the suspect, how can I reach the devices he used to commit cyber crimes?"

Wazir said India receives a 74.78% response rate from social media platforms, compared to Pakistan's 83% response rate. He added that NCCIA received approximately 154,000 complaints last year and treated all equally, though platform response times vary significantly.

How widespread is cybercrime across Pakistan's digital population?

The committee was told that approximately 140 million people across Pakistan are active in cyberspace, with around 20% of social media accounts estimated to be fake.

Those accounts are often used for fraud, harassment and blackmail. Identifying individuals behind fake accounts is complex and frequently requires international cooperation with social media platforms.

Wazir also told the committee that NCCIA is willing to transfer nominated cases where the accused is already known, particularly cases involving women, to Punjab and Khyber Pakhtunkhwa governments.

He said provincial governments would need to legislate to accept those cases. For the first time since its establishment, NCCIA has submitted five sets of rules to the Establishment Division, with two forwarded to the Establishment Division and Ministry of Finance and three still under process.