Internet penetration increased at a steady rate over the reporting period. As of June 2021, 103 million people subscribed to broadband internet, a 25 million increase from December 2019, and 46.9 percent of the population had access to broadband internet. The number of individual subscribers increased by 25 million between December 2019 and June 2021.1 The number of individual subscribers to third-generation (3G) or fourth-generation (4G) technology for mobile networks also increased from 76 million in December 2019 to 98 million in March 2019. Mobile internet penetration rates stood at 45.6 percent as of June 2021.2 According to the Ministry of Information Technology and Telecommunication (MOITT), internet subscription numbers are growing at an annual rate of 9.12 percent and, on average, each subscriber used 1.91 gigabytes (GB) per month as of November 2020.3

Internet speeds and availability in Pakistan remained largely unchanged during the coverage period. The Inclusive Internet Index 2021—a project of the Economist that scores 120 countries’ online environments by availability, affordability, relevance, and readiness criteria—ranked Pakistan 97th for internet availability, up from 98th in 2020.4 Speed-testing company Ookla ranked Pakistan’s mobile-internet download speed, which was 19.61 megabits per second (Mbps) in June 2021, at 114 of 138 countries surveyed, and its fixed-broadband download speed—12.77 Mbps in June 2021—at 164 out of 174 countries surveyed.5 Infrastructural limitations are acute in rural localities, limiting broadband access. Lack of high-speed internet is a perennial problem in Azad Kashmir and Gilgit-Baltistan, regions that have special status due to border disputes with India and are not covered in this report.6

Pakistan relies on a few submarine cables for internet access. Damaged or inadequate infrastructure also periodically disrupts access. In February 2021, internet services were disrupted nationwide due to irregularities in an international submarine cable, SMW-5, that caters to 40 percent of internet traffic in Pakistan.7 Experts have pointed out the need for Pakistan to diversify its internet infrastructure and increase internet capacity to handle increasing demand, especially in light of the COVID-19 pandemic.8

Power outages are a serious problem in Pakistan, especially during the summer,9 and prevent individuals from accessing routers and charging their devices.10 In January 2021, an engineering fault in one part of the national power grid led to a nationwide power outage for a several hours.11 Flooding in July and August 2020 also caused power outages. In August 2020, Karachi experienced an outage that lasted 72 hours after four days of heavy rains.12 The government also uses load-shedding—planned blackouts—to cope with electricity shortages: in Karachi, load-shedding power outages left residents without power for up to eight hours in June 2020.13 In rural areas, load-shedding can last for days, and the practice caused major disruptions for students who shifted to online learning during the coverage period.14

There are serious geographic, gender, and socioeconomic inequalities in access to information and communications technology (ICTs). While the cost of internet has fallen considerably in the last few years,15 access remains out of reach for the majority of the population, and high taxes on internet service push prices higher. According to the MOITT, the average price for 1 GB of internet was 110 rupees ($0.69) in 2020.16 Pakistan dropped to 67 out of 100 countries ranked in the Inclusive Internet Index 2021 report’s affordability indicator, which examines cost of access relative to income and the level of competition in the internet marketplace17 and 78 out of 100 for internet pricing alone. In 2020, the country ranked 57th in affordability and 67th based on price alone.

The price of smartphones has steadily increased, given the devaluation of the Rupee in 2019 and the hike in registration taxes imposed in the 2019–20 federal budget.18 Tax exemptions for mobile phones selling for less than 16,600 rupees ($100) were eventually implemented in September 2019,19 and in January 2020, import duties were reduced by 86 percent.20 The import duty on “luxury phones,” however, is still intact. In May 2020, the government’s Economic Coordination Committee (ECC) approved the Mobile Device Manufacturing Policy to promote local manufacturing and assembly of mobile handsets. This policy will exempt mobile phones that cost up to $350 from the fixed income tax, remove the fixed sales tax for mobile phone manufacturing, and exempt domestic phones from a 4 percent withholding tax on domestic sales.21 Additionally, the government reduced the withholding tax imposed on mobile phone users from 12.5 percent to 10 percent in the 2021–22 fiscal year22 and plans to gradually decrease it to 8 percent in the 2022–23 fiscal year.23 The Minister of Finance, in a 2021–22 budget speech, announced a new plan to tax customers one rupee per call that exceeded three minutes, 5 rupees per gigabyte of internet used, and 10 paisa per SMS.24 After facing online criticism for increasing taxes on consumers, the government announced the tax would not be included in the final draft of the budget.25

Disparities in internet access and infrastructure are severe between different regions of the country. At the end of the coverage period, 60 percent of Balochistan still does not have internet connectivity, and in areas where there is coverage, mobile internet speeds are “lower than the national average” of 6.2 Mbps.26 In March 2021, the government announced the launch of 4G broadband services in Gilgit-Baltistan, Azad Jammu, and Kashmir,27 however no official timeline has been set for the rollout.28

Barriers to accessing the internet significantly impacted students’ lives during the COVID-19 pandemic. Student activists from the former Federally Administered Tribal Areas (FATA), the province of Balochistan,29 and territories of Gilgit-Baltistan30 protested the government’s decision to move classes online, as they were unable to attend online classes due to their lack of connectivity. Students in Gilgit Baltistan had to trek vast distances to access the internet.31 In addition to the protests, several petitions were filed at the Balochistan and Islamabad high courts.32 In January 2021, the Islamabad High Court forwarded student petitions asking for the restoration of internet services in tribal areas to the federal cabinet for review.33

There have been some government initiatives to provide internet access to remote areas. A 2006 amendment to the Pakistan Telecommunication (Reorganization) Act established the Universal Service Fund (USF), created to provide access to telecommunication services for people in unserved, underserved, rural, and remote areas. Recently, the government announced plans for USF resources to provide high-speed mobile broadband services in various districts of Balochistan, including Kech, Chagai, Noshki, Bolan, Mastung, Panjgur, Gwadar, Ziarat, Jaffarabad, and Pishin.34 According to its website, the USF has launched projects to install high-speed internet in underserved areas of Punjab, Sindh, Balochistan, and Khyber Pakhtunkhwa, and has completed infrastructure construction in Southern Punjab, Sindh, parts of Baluchistan and Northern Khyber Pakhtunkhwa.35

Public access to Wi-Fi and internet decreased in January 2021 after the Punjab government permanently shut down free Wi-Fi facilities, originally built in December 2016,36 due to significant annual financial losses.37 However, the Higher Education Commission (HEC) continues to install Wi-Fi facilities in universities as part of its Smart University Project, launched in 2015. The HEC had installed Wi-Fi facilities in 63 universities across the country as of 2019.38

Facebook’s free-basics program has been available for several years on multiple telecommunications networks in the country,39 including Zong and Telenor.40 However, these programs run contrary to the principles of net neutrality by creating differential access to content based on income levels. Currently, the Pakistani government has implemented no policies or laws to regulate net neutrality.41

Low literacy, difficult economic conditions, and conservative cultural norms have also created inequalities in how Pakistanis access the internet.42 The digital divide between men and women in Pakistan is among the highest in the world; religious, social, and cultural norms discourage women from owning devices.43 As per one study, women are 38 percent less likely than men to own a mobile device and 49 percent less likely to use the internet.44 A January 2021 report by Media Matters for Democracy found that 6 of every 10 Pakistani women are likely to have their internet usage restricted, monitored, or controlled by family members.45 Women who are active online report high levels of harassment that discourages greater use of ICTs (see C7).

Authorities frequently disrupt telecommunication services during protests,46 elections,47 and religious and national holidays, often citing security concerns.

Frequent shutdowns continued throughout the coverage period. Internet services in parts of Lahore were suspended in response to clashes between police and opposition party Tehreek-e-Labaik Pakistan (TLP) protestors in April 2021.48 The protests, which called for the expulsion of the French Ambassador to Pakistan, turned violent after the arrest of TLP leader Saad Rizvi.49 The following day, access to major social media platforms—specifically, Twitter, Facebook, YouTube, WhatsApp, TikTok, and Telegram—was restricted for four hours across the country as directed by the Ministry of Interior,50 allegedly to maintain public order and protect public safety.51 Mobile internet services were suspended52 in Islamabad and Rawalpindi in March 2021 for a few hours as part of security measures implemented for the Pakistan Day parade.53 Similarly, in November 2020, cellular services in the Rawalpindi Region were suspended for two days due to a sit-in by the TLP protesting alleged blasphemy by the French government.54 In August 2020, mobile phone services were suspended for security reasons on the ninth and tenth days of the month of Muharram55—a holiday of particular importance to Shia Muslims, a minority group in Pakistan that are more vulnerable to internet shutdowns—in Sindh,56 Punjab,57 and other cities.58 In July 2020, the Ministry of Interior ordered a network shutdown in Chaman, Balochistan, during protests in the region due to concerns that “antistate” materials were being uploaded online.59 Mobile internet services were shut down for over 48 hours in late May 2020 in Quetta as part of the government’s efforts to quell the spread of violence after a violent mob killed a young man in Hazara Town.60 Furthermore, cellular phone signals were suspended in Peshawar during a rally led by the joint opposition Pakistan Democratic Movement (PDM).61

During the coverage period, mobile internet services with 3G, 4G, and “long-term evolution” (LTE) technology were also shut down in areas that receive comparatively little media attention, such as the less developed regions of Balochistan,62 where several districts have had no mobile internet service since February 2017. In 2019, a citizen challenged a shutdown in the Kech District of Balochistan at the Turbat High Court, but withdrew the case reportedly after security officials pressured their lawyer to drop the matter.63 Long-term shutdowns have also been implemented in restive border regions, including one lasting more than four years in the former FATA.64 During the COVID-19 pandemic, the shutdowns have stymied access to information and hindered news about the public health crisis in these areas (see A2).65

Previously, mobile services were periodically suspended in parts of the former FATA66 allegedly for national security reasons.67 The government has made some progress in heeding resolutions by the provincial assembly and court orders that compel them to restore internet access.68 In response to a student-filed petition for the resumption of mobile internet services in the former FATA region, the Islamabad High Court requested the federal cabinet review its decision to suspend internet services in tribal areas in Khyber Pakhtunkhwa.69 In June 2021, the PTA instructed telecommunications operators to restore internet services in parts of Balochistan and Khyber district assessing that the security situation had improved.70 In January 2021, the government announced it would launch 3G and 4G services in Waziristan. In March 2019, the government restored mobile internet services in Bajour.71 Despite some progress, the rest of the region continues to be deprived of mobile internet access.

Section 54 of the 1996 Pakistan Telecommunications Act grants authorities the power to suspend internet services. While the law as written may only be invoked during a state of emergency, in practice it has been used to justify routine shutdowns, prompting several court cases in which the courts have reaffirmed the PTA’s72 authority to suspend services. In February 2018, the Islamabad High Court (IHC) held that mobile-network shutdowns on the pretext of public safety under Section 54(3) of the PTA, including mobile-based internet suspension, infringed upon the fundamental rights of citizens and were thus illegal.73 However, in March 2018, the IHC suspended the judgment temporarily to allow internet suspensions during the Pakistan Day parade.74 In April 2020 the Supreme Court overruled the IHC’s original verdict and upheld the government’s right to suspend mobile networks.75

The state exerts considerable influence over the internet backbone. The predominantly state-owned Pakistan Telecommunication Company Limited (PTCL) controls the country’s largest internet exchange point, Pakistan Internet Exchange (PIE), which has three main nodes—in Karachi, Islamabad, and Lahore—and 42 smaller nodes nationwide. PIE operated the nation’s sole internet backbone until 2009, when additional bandwidth was offered by TransWorld Associates on its private fiber-optic cable, TW1.76

PTCL also controls access to three international undersea fiber-optic cables: the Southeast Asia–Middle East–Western Europe (SEA-ME-WE) 3 and SEA-ME-WE 4, which connect Southeast Asia, the Middle East, and Western Europe; and the India-Middle East–Western Europe (I-ME-WE) which links India, the Middle East, and Western Europe.77 In July 2017, PTCL joined the Asia-Africa-Europe-1 (AAE-1) cable system. The cable, which is 25,000 km (15,500 miles) long, was built as part of China’s One Belt, One Road initiative and provides the lowest latency route to several countries across three continents.78 In July 2020, the Pak-China fiber-optic cable, running from Rawalpindi to Khunjerab, became active;79 plans are underway extend the project to other parts of the country.80 In December 2020, the Central Development Working Party (CDWP) cleared 38 billion rupees ($237.87 million) for the second phase of laying a cross-border fiber-optic cable with China.81 The project is owned by the military-run Special Communications Organization (SCO) and the contractor is Huawei. Internet rights groups have raised concerns regarding the dangers of a proposed terrestrial cable between Pakistan and China, given China’s highly restrictive internet model.82

Pakistan has a combination of private and publicly run service providers. The PTA, the government regulator, exerts significant control over internet and mobile providers through hefty licensing fees and various bureaucratic processes,83 powers they have over service providers as stipulated under section 5(2)(a) of the Pakistan Telecommunication (Re-organization) Act, 1996. 84

According to licensing information published by the PTA, in 2021, there are four cellular mobile operators in Pakistan. Telenor Pakistan, Pakistan Mobile Communication Limited (PMCL, or Jazz), Pak Telecom Mobile Limited (PTML, or Ufone), and China Mobile Pakistan (CMPak, or Zong) all provide services using GSM (global system for mobile communications), Wideband Code Division Multiple Access (WCDMA) and LTE.85 The market in Azad Jammu and Kashmir and Gilgit Baltistan is slightly different as there are six cellular mobile service operators and providers: Jazz, Telenor, Ufone, CMPak, Warid, and SCO.86

Pakistan Mobile Communications Limited had a majority market share of 37.94 percent as of June 2021; their main competitors are PTML, which is a PTCL subsidiary operating as Ufone, with a 13 percent market share; Telenor Pakistan, part of a Norwegian multinational company, with a 26.98 percent market share; and CMPak, with a market share of 22.06 percent.87

Further, there were 10 licensed wireless local loop (WLL) operators and88 12 long-distance and international (LDI) operators.89 Several dozen licenses had also been issued for companies, providing value-added services in the telecommunications sector.90 As of May 2021, the PTA was not processing applications for LDI licenses.91

The predominantly state-owned PTCL has long dominated the broadband market.92 Telecommunications policies from 2015 aimed to instill competitive practices in the telecommunications sector, though it led to overlapping regulatory powers for the MoITT and the Competition Commission of Pakistan (CCP).

The PTA is the regulatory body for the internet and mobile industry. Internet freedom advocates and human rights groups have expressed concerns about its lack of transparency and independence,93 as well as its broad powers over online content and licensing of service providers. The prime minister appoints the chair and members of the three-person authority, which reports to the MoITT.94 The current chairperson of the PTA is retired Major General Amir Azeem Bajwa. Common government practice is to appoint retired military personnel as the heads of government departments, part of the military’s efforts to expand its regulatory capacity in most spheres of Pakistani governance.

The PTA plays an active role in implementing the various policies that undermine internet freedom. In March 2015, the PTA formally took responsibility for internet content management. This power was also consolidated in the Prevention of Electronic Crimes Act 2016 (PECA). However, there has been a lack of transparency and oversight of the PTA in terms of its decisions under section 37 of PECA to block and remove content on the internet (see B3).

Authorities frequently block content that is critical of Islam or the military, content that is deemed a threat to national security, sites that host pornography or nudity, and sites related to or offering circumvention and privacy tools, among other political and social content.95 The PTA reported in January 2021 that 980,000 URLs containing hate speech or controversial and objectionable content were blocked. Out of them 865,187 links were pornographic websites, 16,000 links contained hateful material against defense forces and national security, and 22,000 links had content related to sectarianism.96 In 2019–20, the PTA blocked 27,986 URLs that contained hate speech, insulted the glory of Islam, were considered indecent or immoral, or threatened Pakistan’s national security.97 Since there is no publicly available list of blocked websites published by the PTA, information about blocks is often anecdotal and on a case-by-case basis.

During the coverage period, the PTA blocked social media platforms until company leadership agreed to moderate content deemed obscene or immoral. In October 2020, the PTA banned the popular application TikTok after allegedly receiving complaints about immoral content hosted on the platform.98 PTA claimed that the ban came after the platform failed to comply with a July 2020 warning to moderate immoral content. The ban was lifted after 10 days,99 on the condition that TikTok would moderate immoral content.100 The platform was blocked again in March 2021 by order of the Peshawar High Court for similar reasons.101 The app was unblocked on April 2021.102 Using its powers under section 37 of PECA, the PTA issued an order to temporarily block the multi-player online game PlayerUnknown’s Battle Ground (PUBG) in July 2020 after allegedly receiving reports that the game was addictive, a waste of time, and dangerous for children's physical and psychological health.103 The Islamabad High Court, hearing a petition challenging the ban, held that the PTA’s temporary suspension was void and directed the authority to immediately remove the ban.104 However, the PTA did not immediately implement the court’s decision,105 instead lifting the ban a month later after meeting with representatives from the company to confirm control mechanisms the company implemented.106 Additionally in July 2020, the PTA banned the livestreaming application Bigo after107 allegedly receiving complaints that the application contained obscene and vulgar content.108 The ban on Bigo was lifted nine days later,109 after PTA members received confirmation from one of the company’s vice presidents that vulgar content would be moderated in line with Pakistani laws.110 In September 2020, the PTA banned and blocked111 five dating apps—Tinder, Grindr, Tagged, Skout, and SayHi—for disseminating immoral content.112 These applications remained banned at the end of the coverage period.

The Pakistani government has blocked websites for immoral content in the past. In 2019, the online news websites Naya Daur, alibaba.com, bloomberg.com, buzzfeed.com, gsmarena.com 113 were temporarily blocked. Slate.com, a US-based online magazine, was blocked in November 2019 but available at the end of the coverage period .114

Pakistani authorities pursue legal action against social media platforms and apps in order to control the online information space. In December 2020, during a case regarding online blasphemous material,115 the Lahore High Court Chief urged the Federal Investigation Agency to more proactively address blasphemous content.116 Cases pending before the Lahore High Court would ban apps such as TikTok, Bigo Live, Likee, and others, as they allegedly spread obscene content that posed a risk to Pakistani youths.117

In June 2018, in the lead-up to the following month’s general elections, the website of the leftist Awami Workers Party (AWP) was blocked.118 After the AWP lodged objections with the Election Commission of Pakistan (ECP), the website was restored, though the PTA provided no explanation for the block. The Islamabad High Court (IHC) ruled in September 2019 that the PTA may only block websites if affected parties are permitted to lodge objections and if other due process rights are respected (see B3).119

Political dissent and secessionist movements in areas including Balochistan and Sindh Provinces have been subject to systematic censorship for several years.120 In August 2016, the government banned websites operated by the Muttahida Qaumi Movement (MQM), a political party based in Sindh Province, and said it would take steps to remove affiliated social media accounts after the party’s exiled leader delivered what officials and news reports characterized as an “anti-Pakistan” speech.121 The party’s official website remained blocked as of June 2021.

The government also allegedly has access to censorship equipment. Pakistan is one of several countries reported to have purchased website blocking and filtering equipment from Sandvine, a Canadian-based network equipment company. This equipment enables the government to filter news, social media websites, and messaging apps.122

Score Change: The score declined from 2 to 1 due to the PTA’s use of short-term blocks on social media platforms and communications apps to compel them to moderate content deemed immoral and obscene.

State and other actors are known to exert extralegal pressure on publishers and content producers to remove content, and these instances frequently go unreported. The PTA also directs social media platforms and content hosts to remove content it deems illegal. During the coverage period, the PTA actively issued notices and warnings to platforms such as YouTube123 and Twitter to take down124 content and accounts allegedly spreading false information.125 Social media companies seemed more willing to engage with the government on content moderation. In February 2021, Twitter's regional head attended a hearing of the Parliamentary Committee on Kashmir to discuss Twitter’s policies on Kashmir-related tweets uploaded by Pakistani and Kashmiri activists.126

From July to December 2020, Facebook reported removing 1,531 pieces of content that the PTA alleged had violated local laws. Facebook removed content that ostensibly contained blasphemy, sentiments that impugned the judiciary, condemnation of the country’s independence, and sectarian enmity, as well as content that violated the Prevention of Electronic Crimes Act. Facebook also determined that 22 items were removed in error.127 The number of content restrictions have declined compared to the period between July and December 2019, when 2,300 pieces of content were restricted.128

Also between July and December 2020, the Pakistani authorities reported 6,516 profiles to Twitter, a significant increase compared to 1,476 between July and December 2019. Pakistani authorities also requested that the platform remove 417 pieces of content, an increase from 241 in the previous six months. Twitter reported a 40 percent compliance rate with content removal requests.129

In January 2019, Twitter sent a number of journalists,130 activists, and lawyers131 notices that they published content in violation of Pakistani law. The notices were allegedly based on “official correspondence,” seemingly from the government or security forces. However, Minister of Information Fawad Chaudhry denied that the government reported the posts.132 In August 2019, President Arif Alvi also received a notice from Twitter, though it was a response to user reports rather than violations of any local law.133

The government sent 725 requests to Google to remove 9,720 pieces of content between July and December 2020, an increase compared to 154 requests and 903 pieces of content from the previous six months. The compliance rate for content removal was 65 percent. A third of the removal requests were related to religious offenses, a third to obscenity and nudity, and 28 percent related to hate speech. Removal requests for content that ostensibly threatened national security and that was allegedly defamatory amounted to 5 and 4 percent of total requests, respectively. During the coverage period, Google did not comply with the government’s request to remove content in several instances. Google did not remove a of a YouTube channel run by an unspecified TikTok star that the PTA claimed contained content that defamed members of the Pakistan government. Google refused because the PTA did not provide a court order that held that the channel contained defamatory speech.134

TikTok, one of the most popular and fastest growing platforms in Pakistan, revealed that Pakistan is one of the countries with the largest volume of videos removed for community guidelines or terms of service violations.135 Between January and March 2021 6,495,992 pieces of content originating in Pakistan were removed; between January and June 2020, 6,454,384 pieces of content were removed. Between January and June 2020, the government made four requests for content restrictions; two accounts were removed or restricted, and 129 pieces of content were removed or restricted based on their requests.136

The Pakistani government particularly tries to censor content related to or created by members of the Ahmadi community, a religious group the government has denounced as heretics. A Buzzfeed report revealed that the Pakistani government issued notices to Google and Apple to take down religious apps created by the Ahmadi community in the United States, published under the name “Ahmadiyya Muslim Community.” Following a December 2020 request, Google took down a Quran app created by Ahmadi developers. The PTA also issued notices to Wikipedia in December 2020 to remove Ahmadi content.137 According to a Stanford Internet Observatory report, a Facebook group has also engaged in mass, coordinated reporting of accounts which criticized Islam and the Pakistani government, as well as accounts that were part of the Ahmadi religious community.138 The group claimed to be successful in getting 200 accounts removed.

Section 38 of PECA limits civil or criminal liability for service providers for content posted by users, unless it is proven that the service provider had “specific actual knowledge and willful intent to proactively and positively participate” in cybercrimes committed under the act. The controversial Removal and Blocking of Unlawful Online Content (Procedure, Oversight and Safeguards) Rules 2020 also includes financial liability for social media platforms that do not comply with takedown requests (see B3).139

The Removal and Blocking of Unlawful Online Content (Procedure, Oversight and Safeguards) Rules 2020, introduced in Parliament in October 2020, expand the PTA’s powers under section 37 of PECA to block and remove content on the internet by giving it vast powers to censor content considered offensive under the Pakistan Penal Code, including content containing indecency, blasphemy, or false information, without providing any definitions. Under the rules, social media companies must comply with content moderation decisions of the PTA within 24 hours normally and within six hours in emergency situations. If social media companies fail to comply within the time limits the government may block their entire platform. 140 Critics contend that such a wide mandate to restrict online speech violates Pakistan’s commitments under the International Covenant on Civil and Political Rights (ICCPR).141

The Rules raise human rights concerns142 and have been condemned by local civil society organizations143 as well as social media companies,144 which have warned that the Rules could pose additional burdens that impact their ability to operate in the country (see B6).145 However, the status of the Rules was unclear at the end of the coverage period: they were published in the Extraordinary Gazette in October 2020 but were changed the following month without formal notification. The new version removed language that allowed the government to censor content harmful to its reputation or any person holding public office. The Rules were also challenged in the Islamabad High Court,146 which directed the attorney general to form a council to review its provisions.147 Following the court directive, the prime minister formed an inter-ministerial committee to review the legislation in March 2021.148 A modified draft was made public for comment in June 2021; however, it lacked any significant changes.149

The PTA, the regulatory authority for online censorship, routinely restricts content in a nontransparent and arbitrary fashion. While PECA legally mandates that the PTA issue notices when restricting content, in practice the agency rarely does. This lack of written notice impedes the ability of those impacted to appeal orders or undertake judicial review. Furthermore, new proposals during the coverage period would further grant the government power to regulate social media and communications platforms.150 In May 2021, the government circulated a draft of the Pakistan Media Development Authority Ordinance, which proposed centralizing regulatory control over electronic, print, and social media.151 The draft was unanimously denounced by media152 and civil society groups and153 was walked back by the government in June 2021, though the Ministry of Information and Broadcasting formed a committee to further discuss the proposal.154

Apart from PECA and new social media rules, other regulatory provisions have long enabled politically motivated censorship of dissenting voices and information perceived as damaging to the military or political elites. Broad provisions in the 1996 Pakistan Telecommunications Act support censorship for the protection of national security or religious reasons.155 A telecommunications policy approved in 2015 utilized similar language; section 9.8.3 enabled the PTA to “monitor and manage content including any blasphemous and pornographic material in conflict with the principles of Islamic way of life as reflected in the Objectives Resolution and Article 31 of the Constitution,” as well as material that is considered to be “detrimental to national security, or any other category stipulated in any other law.”28 Section 99 of the penal code separately allows the government to restrict information that might be prejudicial to the national interest.156

As a condition of their licenses, internet service providers (ISPs) and backbone providers must restrict access to individual URLs or internet protocol (IP) addresses upon receipt of a blocking order.157 Since 2012, successive administrations have sought to move from less sophisticated manual blocking toward technical filtering,158 despite widespread civil society protests.159 In 2013, the University of Toronto based research group Citizen Lab reported that technology developed by the Canadian company Netsweeper, as well as domain name system (DNS) tampering,160 filtered political and social content at the national level on the PTCL network.161

Social media platforms have also removed content on their own accord.162 In September 2020, Facebook reportedly removed 453 Facebook accounts, 103 Pages, 78 groups, and 107 Instagram accounts originating in Pakistan because of “coordinated inauthentic behavior.”163 In April 2019, Facebook removed 103 Pakistan-based pages, groups, and accounts from Facebook and Instagram for “inauthentic behavior” and spamming (see B5).164

Most online commentators exercise a degree of self-censorship when writing on topics such as religion, blasphemy, the military, separatist movements, women’s rights, and the rights of marginalized communities.165 In March 2021, a UN human rights panel raised concerns that the government was stifling journalism in Pakistan by filing false charges against online journalists and human rights defenders.166 In a 2018 survey of Pakistani journalists, 46 percent of those questioned reported self-censoring due to fears for their safety; 18 percent of respondents reported restricting their reporting to noncontroversial subjects.167 A number of journalists, activists, and other content creators have reported a “climate of extreme fear and self-censorship” in Pakistan.168

In a January 2021 report by Media Matters for Democracy, 9 out of every 10 women journalists surveyed stated that “they were more likely to face online violence if they did not self-censor their expression,” and 80 percent felt that it was not possible to practice journalism online without self-censorship.169

Self-censorship is also exacerbated by government surveillance and legal repercussions for online speech.

Increasingly, coordinated and inauthentic accounts are manipulating online content and spreading disinformation. Online journalists and activists, especially those scrutinizing the military or intelligence agencies, have also testified to the existence of state-sponsored “troll armies” being employed to silence dissent.170 In July 2019, #ArrestAntiPakJournalists trended across Twitter, accompanying posts with manipulated information about prominent journalists critical of the ruling party. Many accounts and posts with the hashtag contained indications that they came from automated accounts.171

A 2020 report from the Oxford Internet Institute identified Pakistan as having coordinated teams with full-time staff members employed to manipulate the online information space.172 The report found that the teams work to support preferred messaging of their clients, attack the opposition, and suppress critical content; they are employed by most Pakistani political parties.173 The government allegedly has fake accounts run by both hired workers and bots that manipulate content on Facebook, Instagram, and Twitter, as well as use mass reporting techniques to silence critics.

In May 2021, Facebook removed 40 Facebook accounts, 25 pages, 6 groups, and 28 Instagram accounts originating in Pakistan for coordinated and inauthentic behavior. Many of these account holders posed as independent media and posted political commentary about news stories, targeting domestic and international audiences.174 Facebook found that some of the accounts were operated by individuals associated with Pakistan-based public relations firm AlphaPro. The network behind these attacks also had links to one Facebook previously removed in April 2019,175 which Facebook said “was linked to employees of the ISPR (Inter-Service Public Relations) of the Pakistani military.” The company removed a number of pages, groups, and accounts that had posted content on or operated promilitary pages, pages related to Kashmir, and more general informational and community pages.176

Individuals and political movements have been the targets of apparently coordinated campaigns seeking to discredit them with accusations of blasphemy—a criminal offense which carries a death penalty (see C2). In March 2021, women’s rights campaigners were the target of a coordinated campaign in which doctored photos showing protestors carrying blasphemous slogans were uploaded and shared online.177 In the past, hashtags about missing bloggers have been “poisoned” and used to accuse the bloggers of blasphemy (see B8).

While some digital media outlets struggle to stay financially viable, the online landscape is generally free of major economic or regulatory constraints intended to prevent users from publishing independent political news and opinions.

Government advertisement revenue is disbursed selectively based on outlets’ editorial positions. 178 In January 2019, the central government and the provincial governments of Khyber Pakhtunkhwa and Punjab suspended advertisements with the independent Dawn and Jang media groups, both of which have been critical of the government. The suspension led to layoffs and downsizing, and the Dawn Media Group filed a petition challenging the ban with the Sindh High Court.

Currently there are no specific legal mechanisms regulating digital content creators, outside of obligations imposed under Section 38 of PECA (see B2). Several proposed regulatory changes would give authorities greater control over digital media and the ability to publish content. In January 2020, the Pakistan Electronic Media Regulatory Authority (PEMRA) announced plans to regulate website television (Web TV) and over-the-top (OTT) content services through an expensive licensing and fee system.179 The proposal was criticized for placing onerous barriers on content creation.180 The draft was quickly taken back by PEMRA,181 and the Senate Standing Committee on Human Rights claimed that PEMRA lacked jurisdiction to implement these rules.182 The Removal and Blocking of Unlawful Online Content (Procedure, Oversight and Safeguards) Rules 2020 would also impose additional obligations on social media companies and service providers operating in the country. Under the rules, social media companies would be required to develop and deploy mechanisms to moderate livestreams and ensure uploads or livestreams do not contain content related to terrorism, extremism, hate speech, pornography, incitement to violence, or any subject detrimental to national security. 183 These measures will create additional hurdles to publishing content with preemptive, real-time moderation taking place based on vague legal criteria.

Despite content restrictions, most Pakistanis have access to international news outlets and other independent media, as well as a range of websites representing political parties, local civil society groups, and international human rights organizations.184 Over the years, many digital, nonlegacy news outlets185 and content creators have emerged on applications like YouTube and TikTok. Encouragingly, video-based social media platforms have enabled content creation in regional languages and by creators regardless of literacy levels.186

However, content online is largely dominated by users with the greatest access—generally those in urban areas with the means to afford service. While there are several outlets producing content in regional languages, there is still a disproportionate amount of Urdu- and English-language content. Social taboos and the criminalization of same-sex relations means that local content addressing the interests of LGBT+ people is limited. Furthermore, disinformation, often coordinated and targeted, is increasingly impacting the reliability of content on the internet.187

Social networking, blogging, and voice-over-IP (VoIP) applications are available and widely used. However, the Securities and Exchange Commission of Pakistan said in March 2017 that “crowdfunding is not allowed in Pakistan,” removing a potential avenue for digital activism.188 The decision was issued in response to activity by a single fraudulent website and stated that “no company can raise funds” through crowdfunding. Further, internet and mobile connectivity are often restricted to limit mobilization and protests (see A3).

The internet has nevertheless provided a space for individuals to mobilize on political and social issues. During the COVID-19 lockdowns, students used a combination of physical gatherings and online hashtags to protest government policies on remote learning. Students, for example, protested shifting to online classes because some students lacked sufficient internet access.189 Other students demonstrated against a private university’s decision to host in-person exams instead of online exams.190

More importantly, the internet has provided space of individuals to discuss issues censored on mainstream media. For example, despite facing a complete blackout in print and electronic media, and though its activists have been arrested,191 the Pashtun Tahafuz Movement (PTM) has mobilized rallies across the country through its presence online.192 Feminists and women’s rights activists have also used the global #MeToo movement to expose the sexual misconduct of powerful men in Pakistan. However, engaging in controversial or prohibited activism online has grown increasingly dangerous. Criminal reports filed against activists for their online activity have limited the PTM’s reach.193 Similarly, online accusations against women’s rights activists have also resulted in defamation lawsuits and online attacks (see C7).194

Online conversations around police brutality and unlawful detentions became more prevalent in Pakistan during the coverage period. A colonial-era sedition law was used to arrest a number of activists, including some in Lahore who took part in the Student Solidarity March held on November 29, 2019. The link between right to assembly and online spaces was made clear when petitions were filed at the Lahore and Islamabad High Courts, separately, to ban the Aurat March (Women’s March) held across the country on International Women’s Day, March 8, 2020. The petitions cited “immoral” and “obscene” content on social media as the grounds to either stop or regulate the event.195 Organizers of the Aurat March were targeted in coordinated misinformation campaigns (see B5) and accused of blasphemy (see C3),196 forcing some to go underground.197

Article 19 of Pakistan’s constitution establishes freedom of speech and freedom of the press as fundamental rights, and Article 19A guarantees access to information. However, these rights are subject to several broad restrictions, including for “the interest of the glory of Islam or the integrity, security or defense of Pakistan or any part thereof, friendly relations with foreign States, public order, decency or morality, or in relation to contempt of court, commission of or incitement to an offence.”198 Exceptions for online spaces are codified under section 37 of PECA.199 Pakistani courts have not clearly interpreted terms such as “national interest,” “decency,” and “morality,” and parameters of the constitutional articles are largely seen as inapplicable to the most powerful institutions in the country. For example, the military may generally interpret “national interest” as it sees fit.

In a positive development, the Supreme Court reaffirmed the constitutional right to free expression and press freedom in its ruling on the 2017 Faizabad sit-in, when right-wing religious party Tehreek-e-Labaik (TLP) demanded the resignation of the Minister for Law and Justice at the time, Zahid Hamid. Justice Qazi Faez Isa stated in February 2019 that the government could not restrict the fundamental rights of freedom of speech, expression, and press beyond the limitations defined in Article 19.200 Although the judgment did not mention these rights in cases of online expression specifically, the sit-in had prompted the blocking of major social media platforms, including Twitter, Facebook, YouTube, and Instagram.201 In another case, the IHC ruled in September 2019 that the PTA violated constitutional due process protections when blocking a political website (see B1 and B3).

Pakistan became a signatory to the International Convention on Civil and Political Rights (ICCPR)—which protects freedom of expression among other rights—in 2010 but does not consistently uphold it in practice.202 The applicability of international law in local courts is a contentious issue. Pakistan is a dualist country, making international treaties only legally binding once they are specifically incorporated into local law.

Several laws restrict the rights of internet users. In August 2016, PECA became law, despite concerns from civil society organizations regarding the lack of transparency involved in the drafting process. Though it contains some procedural safeguards for cybercrime investigations by law enforcement agencies, including through the 2018 Prevention of Electronic Crimes Investigation Rules,203 international and local human rights groups have condemned the law’s broad language and disproportionate penalties, including a 14-year prison term for acts of cyberterrorism that it fails to adequately define.204

The law also punishes preparing or disseminating electronic communication to glorify terrorism; and preparing or disseminating information that is likely to advance religious, ethnic or sectarian hatred; both crimes are punishable with up to seven years in prison. Section 20 criminalizes online defamation with a maximum three-year prison term, a fine of 1 million rupees ($6,260), or both.205 The criminal defamation section has been criticized by human rights groups, particularly women’s rights activists who have pointed out an increase in defamation cases filed against people who report harassment and sexual abuse.206 The law also grants the PTA broad censorship powers—which were expanded by the Removal and Blocking of Unlawful Online Content (Procedure, Oversight and Safeguards) Rules issued in 2020 (see B3, B6, and C6)—and provides other agencies with the ability to conduct wide-ranging surveillance (see C5).

PECA’s harsh penalties were cause for particular concern in light of recent sentences passed by antiterrorism courts for online speech. Furthermore, secret military courts were established in 2015 through the 21st amendment to the constitution.207 The courts’ jurisdiction lapsed in March 2019 after extensions in 2017,208 though appeals against the convictions of military courts are still pending within the higher judiciary.209

In the past, the IHC has issued directions to add the offences of pornography and blasphemy to PECA.210 In January 2018, the Federal Investigation Agency (FIA) requested that Parliament incorporate offenses including electronic forgery and fraud, cyberstalking, and tampering with information systems or data into the law’s scope, and stipulate them as nonbailable offenses.211 The resulting draft amendment proposed in October 2018 was met with opposition in the National Assembly, and the bill was returned to the Senate.212

Sections of the penal code that cover blasphemy—including 295(c), which imposes a mandatory death sentence—are frequently invoked to limit freedom of expression online (see C3). In March 2017, the IHC ruled that those accused of posting blasphemous content on social media should be barred from leaving the country until their name is cleared.213 Any citizen can file a blasphemy complaint against any other, leaving the accused vulnerable to violent reprisals regardless of whether the complaint has merit. Human rights groups report that the law lacks safeguards to prevent abuse to settle personal vendettas.214

The 2002 Defamation Ordinance can impose prison sentences of up to five years. PECA effectively replaced the ordinances, but they were still invoked during the reporting period, and some older cases were also ongoing. Section 124 of the Pakistan Penal Code (PPC) on sedition is broadly worded and covers acts of sedition “by words” or “visible representation,” which could include digital speech, though it has not yet been applied to an online context.215 The Surveying and Mapping Act 2014 limits digital mapping activity to organizations registered with Survey of Pakistan, a government authority, with federal permission required for collaborating with foreign companies.216

In September 2020, the Criminal Law (Amendment) Bill 2020 was introduced in the National Assembly. The purpose of the law is to criminalize intentional defamation and ridiculing of the armed forces by amending section 500 of the PPC. 217 A person found guilty under this law could face up to two years in prison or a fine of up to 500,000 rupees ($3,129.81). The law was not passed by the end of the coverage period, though it was approved by the National Assembly Standing Committee on Interior in April 2021.218

People are frequently prosecuted for their online activities, often receiving harsh sentences. The death penalty was imposed in a case of online blasphemy during this report’s coverage period, and previous cases in which the death penalty was imposed are under appeal.

There have been a number of blasphemy cases against users for allegedly criticizing Islam online.219 In January 2021, an antiterrorism court (ATC), which is not open to the public or observers, sentenced three men to death and fourth man to 10-year imprisonment in a case of online blasphemy. Two of the accused allegedly operated fake profiles and disseminated ostensibly blasphemous content online. The third uploaded allegedly blasphemous videos on YouTube.220 In August 2020, a First Information Report (FIR) for blasphemy was registered against a young man for posts on his Facebook account. The accused was arrested and sent to jail on a 14-day judicial remand.221 A Christian man convicted while still a teenager in 2018 for posting a picture of a holy site on social media and allegedly insulting Islam was granted bail by the Lahore High Court in March 2021.222 In October 2019, a special cybercrime court in Lahore sentenced a man to five years’ rigorous imprisonment, which includes hard labor, for allegedly posting “sacrilegious, blasphemous, and derogatory material against Hazrat Umar (R.A)” on Facebook in 2017 under section 11 of PECA and 298-A of the Pakistan Penal Code.223 Separately, a lawyer in Sahiwal was arrested and held in detention for social media posts deemed “blasphemous and hate[ful] content.”224

In addition, death penalty convictions from the previous coverage period are still on appeal. In September 2020, another man, Asif Parvaiz, was sentenced to death on blasphemy charges after being convicted of sending derogatory remarks about the prophet Muhammad to his work supervisor.225 Parvaiz’s lawyer stated they would appeal the sentence. In December 2019, academic and former Fulbright scholar Junaid Hafeez was sentenced to death by a court in Multan for allegedly committing blasphemy verbally and on Facebook.226 Junaid’s case was under appeal as of June 2021, and he has been held in solitary confinement since 2014; his previous lawyer Rashid Rehman was killed in 2014 for taking the case on. In December 2018, two Christian brothers were sentenced to death for blasphemy for allegedly sharing “disrespectful material” about the prophet Mohammad on their website in 2011.227 In June 2017, a man was sentenced to death for blasphemy on the basis of Facebook comments,228 as well as another man in September 2017 for sending a poem on WhatsApp to a Muslim friend that was allegedly critical of Islam.229 In another blasphemy case, Patras Masih was arrested in February 2018 for allegedly posting blasphemous content on social media.230 The FIA detained the accused and his cousin, Sajid Masih, and reportedly tortured them (see C7).

Political speech, such as criticism of the government, judiciary, or the armed forces, has been subject to legal action, including during the coverage period.231 In September 2020, a journalist, Asad Ali Toor, was arrested on the vague grounds of spreading “negative propaganda” and using “derogatory language” against government institutions and the Pakistan Army. Toor was charged under the penal code and PECA.232 In November 2020, he was released after the Lahore High Court dismissed the FIR against him, ruling it was insufficient.233 Toor has since been attacked inside of his home by suspected Inter-Services Intelligence (ISI) agency members (see C7). 234 In the September 2020, journalist Bilal Farooqi was arrested and charged under PECA for social media posts that allegedly defamed the military.235 Two of the charges against him were dropped a day later and he was subsequently released.236 Also in September, an FIR for sedition was filed against Absar Alam, senior journalist and former chairperson of the regulatory authority for electronic media, for Twitter posts that allegedly used derogatory language against state institutions and personalities.237 In March 2021, Alam challenged a summons issued to him by the FIA at the Islamabad High Court.238 He was later shot by unknown assailants outside his home (See C7).239 Apart from journalists, FIRs have been registered for online criminal defamation against several women and men in September 2019 for speaking against an alleged harasser in a high-profile case that was part of the #MeToo movement.240 In June 2019, the youth wing leader of the opposition Pakistani Muslim League-Nawaz (PML-N) party was arrested for posting content deemed defamatory against Prime Minister Imran Khan, army officials, and the judiciary.241

In early 2020, a journalist in Lahore was remanded under Sections 11 and 20 of PECA and Section 505 of the Pakistan Penal Code, for allegedly sharing antistate material to Facebook.242 He was granted bail in March 2020, but the case was pending as of June 2021.243 In August 2019, a man was charged under sections 123A of the Pakistan Penal Code and the Maintenance of Public Order (MPO) law for allegedly sharing content “against state institutions” on social media.244

In October 2019, Professor Muhammad Ismail, the father of exiled human rights activist Gulalai Ismail, was arrested and charged under Sections 10 and 11 of PECA for allegedly spreading hate speech and posting false information.245 He was acquitted in July 2020.246 Similarly in August 2019, a man in Kot Addu was arrested under section 25-D Telegraph Act 1885, and section 16 MPO for allegedly antistate social media posts; it was reported that some of his posts also supported the PTM.247

Several users were arrested and charged for sharing unverified information on social media during the COVID-19 pandemic.248 For example, one man was reportedly arrested in Lahore in March 2020, after he stated on social media that someone in his family had contracted the virus.249

In April 2019, journalist Shahzeb Ali Shah Jillani was charged under sections 500 (punishment for defamation), 109 (abatement), and 34 (common intention) of the Pakistan Penal Code, as well as the Sections 10(a) (cyberterrorism), 11 (hate speech) and 20 (offences against dignity of a natural person) of PECA, for allegedly making defamatory remarks against state institutions.250 However, in May 2019 the FIR filed against the journalist was nullified.251 In light of this case, the National Assembly’s Standing Committee on Human Rights requested the National Commission on Human Rights (NCHR) look into amending PECA to preempt any misuse of the law.252 Though civil society organizations have continued to work on the issue, there has been little headway on the part of the government.

Requirements that users link their internet and mobile connections to their national identity card limit anonymous use of the internet.253 Increasingly stringent security measures mean that users must register fingerprints along with other identifying information when applying for broadband internet packages and mobile service.254 This has worrying implications for human rights activists and others who rely on anonymous internet access and may discourage some from seeking home service. Mobile phones must be linked to national identification card number through the PTA’s Device Identification, Registration and Blocking System (DIRBS), and unregistered phones have been subject to disconnection.255

The government has previously moved to restrict encrypted communication. In 2011, the PTA mandated that ISPs inform them about customers using encrypted tools, including virtual private networks (VPNs).256 However, the mandate was never properly implemented. In June 2020, the PTA announced that it would instruct internet users to register their VPNs or face legal action.257 The deadline to do so was extended from the end of June to September.258 In October 2020, the PTA introduced an online portal for IP allow-listing and VPN registration.259 Although there have been no crackdowns on unregistered VPNs, users have reported intermittent throttling of registered VPNs. The PTA, however, denies that it has been throttling VPN connections.260

The Removal and Blocking of Unlawful Online Content (Procedure, Oversight and Safeguards) Rules 2020 contains provisions making it mandatory for social media companies to provide decrypted information to the designated investigation agency. If implemented, the rules could lead to an unprecedented clampdown on encrypted communications.261

Government surveillance is a serious concern for activists, bloggers, and media representatives, as well as ordinary internet users. PECA grants broad surveillance powers both to agencies within Pakistan and potentially to foreign governments, since it includes provisions that permit the sharing of data with international agencies without adequate oversight.262

The government has deployed several tech-related measures amid the COVID-19 pandemic that threaten the right to privacy and could exacerbate surveillance. The government adopted a track-and-trace system in May 2021 originally developed by the ISI to address terrorism. The program, which is largely nontransparent and lacks judicial oversight, reportedly combines personal call-monitoring mechanisms and geofence tracking that identifies when a person leaves a given geographic location.263 Information collected through these efforts has reportedly been shared with other government agencies such as the health department, local police, and provincial governments.

Separately, in March 2021, the PTA confirmed that it uses mobile-tower tracking in order to identify phones of people who could have been exposed to the virus, and to send them a “CoronaAlert” text message.264 Further, the government’s contact-tracing application, Covid-19 Gov PK, employs geolocation technology and has prompted alarm from civil society groups due privacy and surveillance concerns.265 Since major security gaps were exposed in the app, the government has stopped relying on it for contact tracing.266 Instead, the National Information Technology Board (NITB) launched a new Pass Track App in May 2021 to facilitate contact tracing of international travelers to Pakistan. The NITB mandates inbound passengers on international flights install and submit the requisite information upon arrival in Pakistan.267

In October 2019, the news outlet Coda Story reported on a 2.5 billion rupee ($18.5 million) government contract from December 2018 with Canada-headquartered surveillance technologies firm Sandvine, for a national “web-monitoring system.”268 Greatly enhancing the PTA’s ability to monitor online traffic, the system employs Deep Packet Inspection (DPI) to monitor communications and measure and record traffic and call data. Further details of the system are shrouded in secrecy, and whether it has been or will be implemented is unclear.

Concerns around social media monitoring spiked in March 2019, after the Ministry of Interior ordered an investigation into what it defined as a “targeted social media campaign” against Saudi Arabia while Crown Prince Mohammed bin Salman was visiting Pakistan.269 The ministry’s letter identified journalists and activists who allegedly shared messages that were “very disrespectful” to the crown prince because they included images of murdered journalist Jamal Khashoggi.

Pakistani law enforcement and intelligence agencies appear to have expanded their monitoring activities, including at the local level, ostensibly to curb terrorism and violent crime.270 In 2015, the UK-based nongovernmental organization (NGO) Privacy International reported that the Pakistani government’s surveillance capabilities, particularly those of the ISI, outstrip domestic and international legal regulations.271 According to their report, “Mass network surveillance has been in place in Pakistan since at least 2005” using technology obtained “from both domestic and foreign surveillance companies, including Alcatel, Ericsson, Huawei, SS8 and Utimaco.” A 2013 report by Citizen Lab indicated that Pakistani citizens may be vulnerable to FinFisher spyware, which collects data such as Skype audio, key logs, and screenshots, though the extent of its use and who may be using it remains unclear.272

The Fair Trial Act, passed in 2013,273 allows security agencies to seek a judicial warrant to monitor private communications “to neutralize and prevent (a) threat or any attempt to carry out scheduled offences.” It covers information sent from or received in Pakistan, or between Pakistani citizens, whether they are resident in the country or not. Warrants can be issued if a law enforcement official has “reason to believe” there is a risk of terrorism; warrants can also be temporarily waived by intelligence agencies. A 2014 white paper issued by Digital Rights Group, an internet freedom NGO, said that provisions of the Fair Trial Act contravene the constitution and international treaties that the Pakistani government has signed.274

Data collected by the state’s National Database Registration Authority (NADRA), which maintains a centralized repository of information about citizens, is not subject to any privacy rules.275 Data from NADRA and telecommunications companies, as well as police records, are reportedly sold online, including on Facebook and WhatsApp,276 as was reported in June 2020.277 Given the centralized and interconnected nature of Pakistan’s national database, data is vulnerable when it moves from one department to another.278 The database was used by the health department during the COVID-19 pandemic to look for family information of infected patients, without much transparency around how this information was used and shared.279

Pakistanis are also vulnerable to surveillance from overseas intelligence agencies. In June 2015, the online outlet the Intercept found that the United Kingdom’s Government Communications Headquarters (GCHQ) intelligence agency had hacked the PIE prior to 2008. According to the Intercept, this gave GCHQ “access to almost any user of the internet inside Pakistan” and the ability to “re-route selected traffic across international links towards GCHQ's passive collection systems.”280

International cooperation on surveillance has also increased since the establishment of the China-Pakistan Economic Corridor (CPEC). Technology such as surveillance cameras and facial-recognition technology has been shared as part of various “safe cities” initiatives.281 While these initiatives are framed by the government as measures to ensure public safety, the increase in surveillance infrastructure without meaningful safeguards concerns human rights activists.

Companies are required to aid the government in monitoring internet users. There is currently no data protection law in Pakistan. As a result of this lack of oversight, ISPs, mobile service providers, and private enterprises are not obliged to maintain or comply with any data protection policies that are in place.282

Under the Fair Trial Act, service providers face a one-year jail term or a fine of up to 10 million rupees ($62,596) for failing to cooperate with warrants (see C5). Section 32 of PECA requires service providers to retain traffic data for a minimum of one year and allows for that period to be extended with a warrant issued by a court. Furthermore, regulations introduced in March 2018 require all Wi-Fi hotspot service providers to retain user data, including users’ names, national identity card or passport number, mobile phone number, time of login and log-off, IP address, media access control (MAC) address, and internet access log.283

Telecommunications companies, ISPs, and SIM card vendors are required to authenticate the Computerized National Identity Card details of prospective customers with NADRA before providing service.284 A reregistration drive was launched following a 2014 terrorist attack on a school that was reportedly facilitated by mobile phones with unregistered SIM cards.285 Thereafter, the government added a biometric thumb impression to the registration requirements for SIM cards.286 In 2015, those who failed to meet the new requirement were warned of automatic disconnection, and 26 million SIM cards were subsequently blocked.287

The new Removal and Blocking of Unlawful Online Content (Procedure, Oversight and Safeguards) Rules 2020 requires social media companies with over 500,000 users to register with the PTA, establish a permanent registered office in Pakistan, and appoint an in-country representative. Companies are also required to establish a database server in Pakistan and store data in the country. 288 In August 2020 the National Assembly passed the Mutual Legal Assistance (Criminal Matters) Act, 2020,289 which details a procedure for the government to acquire data from a foreign authority to prosecute an individual charged with a criminal offense, including those under the Penal Code.290

Technology companies have previously complied with government requests for user data. Between July and December 2020, Facebook complied with 21 percent of the government’s 1,816 requests for user data.291 This was a decline from a 52 percent compliance rate between July and December 2019.

There is no data privacy law in Pakistan, though the Ministry for Information Technology and Telecommunication (MOITT) released a draft bill in April 2020 and solicited comments from the public.292 While the new draft improves on a previous, highly criticized draft bill, the proposal contains vague language, requires onerous data localization, and gives the federal government wide powers to make exceptions. Several civil society organizations have heavily criticized the draft legislation.293

Users continue to face intimidation, blackmail, and at times violence, in response to online activism, reporting, and debate, as well as apolitical activity online such as socializing. The military routinely abducts individuals for their reporting or activism, and in recent years they have used this practice on social media activists. In April 2021, social media activist Sarmad Sultan went missing for nearly 24 hours. While he was missing, his Twitter account was also taken down temporarily.294 He was “returned” after the public expressed outrage on social media and political figures, including the Minister for Human Rights, intervened.295 In November 2020, columnist and social media activist Bayazid Kharoti went missing a day before he was arrested in Quetta on charges of “meddling in the work of police.”296 Senior journalist Matiullah Jan, host of a prominent YouTube channel, was abducted in July 2020 in broad daylight in Islamabad. He was “returned” hours later after CCTV footage of his abduction caused widespread outcry on social media.297298

Examples from previous years further show the extent of the military’s repression of free speech. In June 2019, blogger and social media activist Muhammad Bilal Khan was killed in a knife attack; he had an active presence on social media, where he promoted causes like interfaith harmony, and had called for investigations of enforced disappearances conducted by the military and intelligence agencies.299 Prior to this, in January 2017, five bloggers critical of the establishment, military, or religious militancy, separately went missing from different parts of the country.300 Four of them were released around the end of January 2017,301 and the fifth returned home in March 2018.302 The government denied any involvement in the abductions, but one of the recovered activists told the British Broadcasting Corporation (BBC) in March 2017 that he had been held by a “government institution” linked to the military, and was tortured while he was missing.303

Free expression activists, bloggers, and online journalists have reported being attacked and receiving death threats online and offline, and Pakistan is one of the world’s most dangerous countries for traditional journalists.304 Journalists who critique the ruling party or state institutions have been subject to smear campaigns, including the #ArrestAntiPakJournalists campaign in July 2019 that was found to be coordinated and boosted artificially (see B5).305

In May 2021, journalist Asad Ali Toor was assaulted by three men who broke into his apartment. Toor stated that his attackers identified themselves as part of the Inter-Service Intelligence agency, which is Pakistan’s military intelligence service. Toor had started a prominent YouTube channel in December 2020 and quickly gained 24,000 followers. In April 2021, a journalist, Absar Alam, was shot outside of his home in Islamabad. Prior to being shot, Alam received a summons from the Federal Investigation Agency because he posted statements criticizing the Pakistani military’s interference in politics on his social media account, which has around 90,000 followers. The summons was eventually dropped because the FIA did not provide evidence or a copy of the complaint to the Islamabad High Court.

Online gender-based violence is emerging as a major issue in the country. According to the Digital Rights Foundation, there has been an exponential rise in online gender-based violence in Pakistan, particularly during the COVID-19 pandemic.306 Organizers and participants of the 2020 Aurat March, which celebrated International Women’s Day, were subjected to intense online attacks, including death and rape threats.307 The Aurat March was also subject to online opposition campaigns, some of them reported to be coordinated by inauthentic accounts (see B5).308 In September 2020, women in journalism across Pakistan released a joint statement with over 150 signatures in which they shared that the online harassment they faced—often initiated by the ruling party—had a significant mental toll and impeded their ability to complete their professional duties.309310 Women who are victims of online harassment, in the absence of other resources, sometimes consider suicide. In September 2020, a girl took her own life after receiving threats from a man who was jailed for posting her private photos on social media.311

Academic campuses have also been sites of gendered harassment and surveillance, mostly directed at women. In early 2019, the personal information of women enrolled at the University of Punjab, such as phone numbers and images, was leaked and sold on the “dark web.”312 Later in the year, reports revealed that the University of Balochistan had illegally installed CCTV cameras to record, harass, and blackmail students.313 There were no arrests during the coverage period, and whether any legal action was taken against the university’s former vice-chancellor Jawed Iqbal is unclear.314 315

Women’s use of digital tools is heavily controlled by families (see A2), and some have been murdered for their online activities in so-called honor killings. In May 2020, two women were killed in North Waziristan after a video of them with a man was circulated online.316 In July 2018, a woman in Taxila was killed by her husband for exchanging text messages.317 In one of Pakistan’s most high-profile cases, Qandeel Baloch, a social media celebrity known for openly expressing her sexuality, was killed by her brother in 2016.318 Baloch had sought police protection following threats she received after her real identity was published online.319 Her brother acknowledged killing her because “she was doing videos on Facebook and dishonoring the family name.” In September 2019, her brother was sentenced to life in prison for her murder.320321

Separately, in February 2018, Patras Masih and his cousin Sajid Masih were allegedly tortured and ordered to sexually assault each other while in detention in connection with Patras’ social media posts (see C3). To avoid having to carry out the order, Sajid jumped from the fourth floor of the FIA building and was critically injured.322

Technical attacks against the websites of nongovernmental organizations (NGOs), opposition groups, and activists are common in Pakistan, though many go unreported.

Women activists and journalists frequently reach out to Pakistan’s Digital Rights Foundation after being targeted by sophisticated email-based phishing attacks aimed at obtaining their private information.323 In 2018, Amnesty International reported digital attacks on human rights defenders, such as hacked accounts and devices, and the installation of spyware. The attackers allegedly employed fake online identities and social media profiles to target activists.324 The software used in these attacks, Crimson, has previously been used against Indian military and diplomatic figures.325

There were also reported breaches of data originally collected for government initiatives and hacks of state websites and databases. Private pictures of citizens from CCTV cameras, collected by the Punjab Safe Cities Authority (PSCA), were leaked, according to January 2019 news reports.326 In the absence of a data-protection law, those affected have limited opportunities for remedy (see C6). In July 2018, NADRA denied reports of a data breach the previous month, allegedly in which voter demographics were released.327 The Punjab Information Technology Board (PITB) has claimed to have combated over 321,500 serious cyber-attacks directed toward confidential user information.328

Cross-border cyberattacks between Pakistan and India continue.329 In August 2020, the Inter-Service Public Relations revealed that there had been a cyberattack targeting military and government officials allegedly conducted by Indian spy networks.330 After tensions between the two nations escalated in early 2019 following a deadly suicide attack in Pulwama, a city in Indian-controlled Kashmir, a number of Pakistani sites were allegedly targeted by Indian hackers,331 including the website of Ministry of Foreign Affairs.332 In the past, hackers on both sides have claimed to target state websites. Among the most serious were reports in 2017 that Indian hackers had targeted Pakistani airports in Islamabad, Peshawar, Multan, and Karachi.333

Critical infrastructure also lacks essential digital security protections. In November 2020, Israeli cybercrime researchers revealed that Russian hackers were selling access to the Pakistan International Airlines’ (PIA) network and database on the dark web.334 The PTA has claimed to be developing a Critical Telecom Data and Infrastructure Security Regulations (CTDISR), which would have provisions on issues including cybersecurity incident management, monitoring, malware protection, data protection, and confidentiality of information. 335 However a draft of the regulations has yet to be shared publicly.

State officials have also come under malware attacks through fake smartphone apps, according to a report by Blackberry Researchers.336 In December 2019, malware from the Israel-based NSO Group was reported to be used against at least two dozen Pakistani government officials via WhatsApp.337 In a possible response to this attack, the Ministry of Information Technology issued a notification in which it advised government officials against using WhatsApp for official correspondence.338

Data breaches on private companies are becoming increasingly common. In July 2020, Swvl, a bus sharing service, suffered from a security breach in which customer data, including names, emails, and phone numbers, was leaked.339 An estimated 4.2 million data records were compromised in the Swvl breach.”340 Given that there is no legal obligation on companies to disclose breaches, many similar breaches go unreported.