The Flaw in The Prevention of Electronic Crimes Ordinance 2007 and The Terror of Section 17

THE FLAW IN THE PREVENTION OF ELECTRONIC CRIMES ORDINANCE 2007 AND THE TERROR OF SECTION 17 <!--[if gte mso 10]> THE FLAW IN THE PREVENTION OF ELECTRONIC CRIMES ORDINANCE 2007 AND THE TERROR OF SECTION 17 By Mr. Yousaf Khan, Associate Khan & Piracha, Advocate, Islamabad 1. Introduction The Government has come up with a legislation which has created a stir amongst the young generation, Internet Service Providers and businessmen engaged in the software business. The "Prevention of Electronic Crimes Ordinance, 2007" (Ordinance) has been promulgated by the President. The Ordinance has been promulgated to combat electronic crimes.1 There had been no news of such an Ordinance in the offing and thus Internet Service Providers and businessmen involved in the software business were caught totally off guard when this Ordinance was suddenly promulgated. An ideal situation would have been where input from Internet Service Providers, software houses and students could particularly have been taken. The lack of confidence shown by the government by not creating a forum for discussion on the Ordinance has resulted in the Ordinance coming under criticism from all quarters in Pakistan engaged in the daily use of the internet for purposes of gathering information and communication. 1. The dictionary does not provide a definition for this phrase. Electronic crimes are usually associated with the term "cyber crimes" which are said to be committed when any criminal act dealing with computers and networks takes place, however cyber crimes are associated nowadays with the misuse of the internet to commit crimes of defamation, misappropriation of funds and obtaining sensitive information using the internet. Pakistan is a developing country and cyber crimes are or should be by far the least of our problems. However having said that this author does recognize the importance of staying in sync with the West and the rest of the developed world and thus the importance attached with devising legislation and procedure for policing e-commerce and data protection cannot be ignored. Section 17 of this Ordinance has in particular created quite a stir amongst the young generation of Pakistan in particular. Where the Ordinance has addressed the importance of combating issues related to cyber crimes, the stir which it has created relates to the insertion of a section which effectively might label as a terrorist a user of the internet whose actions fall under the provisions of those given under section 17. It is particularly this section that I would like to focus on. Where as this Ordinance might bear positive results in encouraging foreign investment into the country however its enforcement is totally flawed. The method used by the government in detection of cyber crimes depicts the government's ignorance of the use of technology. This article shall in three parts shed light on (i) the various cyber crimes addressed by the Ordinance, (ii) the flawed system of detection (iii) the controversy and the ramifications which section 17 of this Ordinance might have. 2. A look at the Ordinance Although on the onset Pakistan presently has bigger issues to combat however having in place an effective legislation to combat cyber crimes on the one hand enhances investor confidence and aids those businessmen in Pakistan who might have been affected by the growing world wide menace of cyber crimes and on the other hand protects the privacy of individuals using the internet. The applicability of this Ordinance extends to all those who might be engaged in cyber crimes in respect of Pakistan irrespective of their nationality and citizenship and whether they are in Pakistan or outside its borders. The Ordinance by dealing with terms such as Cyber stalking, spamming and spoofing (Sections 13, 14 and 15 respectively) brings Pakistan in sync with the rest of the developed world. The Ordinance explains these various terms and provides for the penalty to combat them. 2.1 Cyber stalking and pornography on the Internet With the presence of various chat rooms, blogs and social forums such as "Orkuts2 our privacy is being invaded more and more everyday. Profiles and addresses are accessed easily and in turn these are then used to black mail people, it is thus how cyber stalking which is a menace in the West is fast developing into one in Pakistan. It is encouraging to see that the Ordinance defines this menace and tries to comprehensively cover and address all aspects of this crime such as the penalty for capturing a would be victim's image, distribution of the victim's images, communicating with the victim in an obscene manner which depicts the aggressors nefarious intent. The crime of cyber stalking has been made punishable with imprisonment of 7 years and a fine which extends to Rs.3,00,000 or with both. Further taking measures against child pornography the Ordinance provides that should the victim be a child the penalty for cyber stalking shall then be 10 years. One feels that the government falls short by way of this Ordinance to effectively combat child pornography on internet however the inclusion of a stricter penalty in respect of the victim being a minor addresses the issue to an extent. 2. These forums do try and provide for the privacy of individuals, however their wall of security may be bleached. 2.2 Protection of Businessmen and Consumers Another feature of this Ordinance which should be particularly encouraging for businessmen is the punishment3 accorded to any one found guilty of gaining access with intent to damage data,4 damaging data or an electronic system, inducing a person to enter into a relationship to deceive such person5 and electronic forgery (sections 5, 6, 7 and 8 respectively). These sections will protect consumers, financial institutions and businessmen against persons hacking into their data and using it for their-own purposes. Similarly punishment has been accorded to those who create, possess, buy and sell software or hardware used for entering, damaging, gaining and altering data or electronic systems (section 9).6 All offences punishable with seven years or more have been made non-bailable thus the offences related to cyber stalking, forgery and fraud are non-bailable offences. Corporations found guilty of crimes such as those listed above shall be punished with a fine of Rs.1,00,000. The corporate veil shall be lifted and the natural person in the corporation found guilty of such a crime shall be liable to punishment too. (section 21) 3. Punishment includes imprisonment for terms of 3 to7 years as well as fines up to Rs.300,000 4. The term "data damage" has been explained as altering, deleting, modify, changing the location of the data, making the data temporarily or permanently unavailable thereby effecting the reliability and usefulness of the data. 5. The presence of a sentence which would imply the use of electronic means in inducing another into entering into a relationship would have further strengthened the intention of the lawmaker. 6. The section also provides a punishment for those who create, possess and distribute passwords to access electronic systems and data with an intention of damaging them. 2.3 International Cooperation Realizing that the menace of cyber crimes is a global issue the Ordinance provides for the sharing of information between Pakistan and countries with which it has reciprocal terms for assistance. (Section 30) 2.4 Enforcement The Federal Government is to provide for a specialized unit under the FIA for the investigation of crimes committed under this Ordinance. All investigation shall be conducted in accordance with the Code of Criminal Procedure, 1898. Complaints filed under this Ordinance shall be tried by Information and Communication Technologies Tribunals. These tribunals shall have the powers vested with courts under the Civil Procedure Code, 1908 and the Criminal Procedure Code of 1898. 3. The Flaw in the detection of Cyber Crimes The question which has been on every body's lips pertains to how the investigation agencies shall detect the commission of a crime. For the detection of cyber crimes the Ordinance directs Internet Service Providers (ISP) to provide to the investigation officer data as and when the investigation officer requires it and for this purpose ISPs shall have to retain internet traffic data for at least 90 days and make it available to the investigation officer as and when he so requires it. The Ordinance however fails to provide as to who shall remunerate the ISP for this extra cost regarding retention of traffic for which it is my understanding the ISP would require additional storage devices and back up to store data regarding internet traffic. The Ordinance also does not provide for how the government shall proceed further for the detection of cyber crimes in the event of such a storage device crashing and the back up getting corrupted. Further as per my understanding IPs are assigned to users dynamically i.e. these IPs are not "static" or "dedicated" save as in the case of corporations where these corporations pay handsomely to ISPs for these static IPs. How in such a case with dynamically changing IPs will the ISPs be able to finger a particular user? Also in a related. case scenario how will the ISP be able to pin-point the alleged criminal should a user be using an IP assigned to a cyber cafe (which too will change dynamically) where multiple users have been using the same computer system. Detection by virtue of caller user IDs on telephone will also serve merely in pin-pointing the organization from where the computer has been used and cannot again pin point which individual has used the computer system. Further with today's technology altering caller user ID is not all that complex. The system of detection thus becomes rather silly. It is felt thus that a more viable solution regarding detection of cyber crimes could have been put into place if ISPs had been taken into confidence prior to the promulgation of this Ordinance. The government should in this regard consult technical personnel and review its detection mechanism. 4. The controversy that is Section 17 When the .startling news regarding the promulgation of this Ordinance surfaced in the newspapers, the sole concern for most of the users of the internet was the adverse implication of section 17 of the Ordinance. Section 17 provides for certain acts the commission of which may label a person as a terrorist and for which the punishment includes death, imprisonment for life and fine. 4.1 The Section Section 17 of the Ordinance provides that "Any person, group or organization who, with terroristic intent utilizes, intent accesses or causes to be accessed a computer or computer network or electronic system or electronic device or by any available means, and thereby knowingly engages in or attempts to engage in a terroristic act commits the offence of cyber terrorism". The phrase "terroristic intent" which has been invented by the government has been further explained as meaning to act with the purpose to alarm, frighten, disrupt, harm, damage; or carry out an act of violence against any segment of the population, the Government or entity associated therewith. The phrase "terroristic act" has been explained as including (i) alteration of information by deletion or addition which may result in sickness or death to any segment of the population, (ii) transmission or attempted transmission of a harmful programme with the intent of disrupting a government operated computer network, (iii) aiding or attempting to aid the commission of an act of violence against the sovereignty of Pakistan, whether or not the commission of such an act is completed or not, (iv) stealing or attempting to steal or copy classified information or data necessary to manufacture biological, chemical and nuclear weapons of mass destruction. 4.2 Implications of Section 17 Internet is used extensively in Pakistan for the gathering of information and as an easy and efficient mode of communication. It is easier for the younger generation in particular to use search engines such as google. com to search for information rather than picking a book and going through its contents. Given the change which has engulfed Pakistan since the occurrence of 9/11 every Pakistani takes an avid interest in the changes occurring around the world with regard to Pakistan and Islam in particular. Osama Bin Laden thanks to the West's over blown imagination has taken the shape of a mythical figure and any and all information regarding his exploits or those of his organization are readily sought after. All updated news regarding Osama Bin Laden or his organization is usually posted on various web sites said to belong to the organization. Will accessing such information label a person to be a terrorist? The interests of the internet users ranges from articles and materials on gardening to those related to weapons of mass destruction. Will a person accessing a web site carrying information regarding nuclear weapons and a copying information from the same be classified as a terrorist? Will the presence of "classified" information on the internet regarding say for example Pakistan's nuclear weapons be the fault of the person who has posted such information or the fault of the person who is accessing such information. What may be categorized as "classified information"? Will an article written by a journalist and posted on the internet, inciting people to rise against the government be classified as a "terroristic act"? These are the questions which are on the lips of many and these are the questions which the government needs to address. Alarms bells should ring too for foreign journalists looking to access matter related to terrorist activities in Pakistan as this Ordinance extends to persons whether inside or outside Pakistan regardless of their citizenship. 5. The way forward The government needs to review the procedure it has set out for the detection of cyber crimes and it needs to clarify issues related to section 17. These questions should be reviewed before the government progresses any further with this Ordinance, otherwise the initiative which the government has taken will serve no purpose. A developing country needs to encourage people to use the internet rather than scare them away from using it.