On 18 May 2026, Pakistan's Interior Minister Mohsin Naqvi gave the National Assembly a set of numbers that, read together, indict the very framework they were meant to defend. In the first five months of 2026, the National Cyber Crime Investigation Agency (NCCIA) logged 77,023 cybercrime complaints, verified 58,286 of them, opened 8,048 inquiries, registered 457 cases, and made 520 arrests. Convictions: eight. Acquittals: twenty-five. The agency deprived hundreds of people of their liberty and secured a guilty verdict in roughly one case out of every fifty-seven it registered.
The strongest case for the regime
The government's position is not frivolous, and it deserves to be stated fairly. Online fraud, deepfake abuse, financial scams, and coordinated harassment are real and growing harms that fall hardest on women and the financially vulnerable. A specialised agency with digital forensic labs capable of handling encrypted communications is a reasonable institutional response, and Naqvi can point to a genuine demand signal: tens of thousands of citizens filed complaints. A low conviction rate, on this view, reflects a young agency — NCCIA was stood up in May 2024 — still building prosecutorial muscle, not a system run amok.
That steelman holds for fraud and non-consensual imagery. It collapses the moment the same machinery is pointed at speech.
What the 2025 amendment actually did
The Prevention of Electronic Crimes (Amendment) Act, 2025 was gazetted on 29 January 2025 after clearing the National Assembly in roughly fifteen minutes of debate. Its centrepiece is a new Section 26-A. The statutory text, published in the Gazette of Pakistan, punishes anyone who "intentionally disseminates, publicly exhibits, or transmits any information... that he knows or has reason to believe to be false or fake and likely to cause or create a sense of fear, panic or disorder or unrest" with up to three years' imprisonment, a fine of up to two million rupees, or both.
The amendment also built an enforcement architecture that sits almost entirely inside the executive. It created a Social Media Protection and Regulatory Authority empowered to block or remove content it deems "unlawful" or "offensive" and to suspend non-compliant platforms; a Social Media Protection Tribunal whose members are appointed — and can be removed — by the federal government; and it converted the Federal Investigation Agency's Cyber Crime Wing into NCCIA, with expanded powers to investigate, prosecute, and arrest for online speech offences. As the Lahore University of Management Sciences' Shaikh Ahmad Hassan School of Law noted in its November 2025 analysis, the Tribunal "functions entirely within the executive branch" with no independent judicial check.
The arrest-conviction gap is the policy, not a bug
Here is why the eight-conviction figure matters more than the government wants it to. Section 26-A criminalises information that is "false" and "likely to cause" fear or unrest — but the statute defines neither term. When the elements of an offence are this elastic, prosecutors can register a case and obtain an arrest against almost any inconvenient post, then watch it dissolve in court because no judge can find a provable falsehood that provably caused unrest. The 25 acquittals against 8 convictions — courts rejecting cases at a 3:1 rate among those actually decided — are not a forensics problem. They are the predictable output of a vague law meeting an evidentiary standard.
When the punishment is the process, conviction becomes optional. An arrest under Section 26-A means pre-trial detention, device seizure, legal costs, and reputational damage regardless of whether a conviction ever follows. For a journalist or critic, that is a fully sufficient deterrent. By April 2026, Naqvi had told the Assembly that 187 cases were already registered under Section 26-A alone; press-freedom groups have documented working journalists — among them Waheed Murad and Farhan Mallick — booked under the provision. The International Federation of Journalists warned in 2025 that the amendments "further tighten government grip on digital expression."
A proportionality test the regime fails
Good internet regulation is judged by whether it reaches genuine harm with the least restrictive means. Pakistan's own data shows the opposite trajectory: the dragnet is wide, the burden on the accused is immediate, and the legal vindication of the state's claims is vanishingly rare. A framework that needs 520 arrests to produce 8 convictions is not under-resourced; it is mis-aimed. It is sweeping up speech that courts will not punish, which means it is functioning as an extrajudicial penalty on expression.
The fix is not to abandon cybercrime enforcement. Fraud, child sexual abuse material, and non-consensual imagery are exactly the cases where forensic investment pays off, and those prosecutions should be ring-fenced and resourced. The reform that the May 2026 numbers demand is narrower offences and tighter procedure: strike or precisely define the "false information" offence so that truth and intent must be proven; require judicial authorisation before arrest in speech cases; move the Social Media Protection Tribunal out of executive control; and publish disaggregated conviction data so Parliament can see which categories of case actually stand up.
The lesson beyond Pakistan
Naqvi presented these figures as evidence of vigour. They are better read as an audit. Across jurisdictions, "online safety" and "misinformation" statutes are increasingly measured by arrests and takedowns rather than by convictions that survive judicial scrutiny — the same inversion EFF has flagged in the United States' youth social-media bans, where enforcement outruns evidence. A law that punishes overwhelmingly by arrest and almost never by verdict has stopped being a criminal-justice tool and become a speech-suppression one. Pakistan has now published the receipts.