When Pakistan’s politicians and state officials talk about problems online, it often has to do with policing online content and figuring out ways to counter things like fake news and misinformation. Far less attention seems to be paid to cyberattacks and online data breaches or leaks, where individuals and organisations hack and steal the sensitive data and/or identities of Pakistanis. This is despite the fact that these kinds of threats are just as serious and even more prevalent than fake news or misinformation. According to global cybersecurity firm Kaspersky, the country faces around one million such attacks every month and the targets include Pakistan’s government, intelligence agencies, oil and gas industry and corporate sector. Last week, it was reported that the government had prepared the initial draft of the Cybersecurity Act 2025 and sent it to stakeholders for consultation and had decided to establish a Cybersecurity Authority. The authority will propose cybersecurity measures for critical national infrastructure, including NADRA, FBR and the telecom sector, and will implement cybersecurity initiatives across the country. Immigration and passport systems are also expected to be declared as critical infrastructure. These steps are long overdue, given the scale of the cybersecurity problem and its implications for the country’s security, economy and citizens’ privacy.
Back in May, the National Cyber Emergency Response Team (PKCERT) issued an advisory warning that the login credentials and passwords of more than 180 million internet users in Pakistan had been stolen in a global data breach. More recently, in September, the PTA blocked over 1300 websites, social media pages and applications selling the leaked data of Pakistani citizens. Incidents like this make it clear that the country’s digital sphere needs stronger protections. While addressing a gathering at a university in Islamabad last week, the IT minister said the country is moving towards AI-driven cybersecurity, cloud security under the Cloud-First Policy and secure digital identity frameworks. One hopes the new cybersecurity act and authority will help boost the adoption and integration of such sophisticated tools, given that online hackers now have more powerful technology readily available than ever before. However, while it is encouraging to see the country try and do what it can to address cybersecurity threats, this is a global problem. The leak in May demonstrated that malicious actors online operate on an international scale and they are often highly decentralised and hard to identify.
While stronger cybersecurity protections are important, they are mainly defensive tools; proactive measures like actually going after and punishing the perpetrators of such attacks are much more difficult. This is only more so the case when hacker groups are backed by hostile intelligence agencies and governments, a threat Pakistan will likely have to account for, given the recent tensions with India. The fact that discussions of cybersecurity parallel increasing restrictions on the online sphere and threats to Pakistanis’ civil liberties under laws like Peca only complicates the issue. Without the ability to go on the offensive, the country is essentially in a race against hackers to see who can develop the more sophisticated and efficient digital tools and methods and it is mostly on its own. The thing about the hackers is that they do not really suffer when they lose and can always adapt their methods to try again. Pakistan’s cybersecurity authority will have to find ways to stay ahead without further compromising people’s rights, while ensuring that the online sphere remains free and accessible. For ordinary Pakistanis, what people can do, say and access is increasingly policed without making people any safer from real crimes like data theft. This parallels how authorities in the real world will not hesitate to give you an e-challan for a minor infraction, but will fail when it comes to stopping your car from being stolen. If more digital policing is inevitable, Pakistanis should at least be safer for it.
