A Boundary the Law Already Drew — and an Agency Kept Ignoring
On July 23, 2026, the Senate Standing Committee on Information & Broadcasting, chaired by Senator Sarmad Ali, directed the National Cyber Crime Investigation Agency (NCCIA) that the Prevention of Electronic Crimes Act (PECA) cannot be invoked against newspapers, their digital editions, news websites, or television channels. The trigger was concrete: NCCIA had opened action against a newspaper columnist, and the committee ordered the complaint referred instead to the Press Council of Pakistan, the statutory body for print grievances, while affirming that broadcast content answers to the Pakistan Electronic Media Regulatory Authority (PEMRA) (The News, July 24, 2026). The committee's stated basis wasn't a new policy — it was Parliament's own earlier assurance, given when PECA was amended, that the law would never reach newspapers or the digital platforms of television. NCCIA's practice had simply drifted from that promise.
An Amendment Built for This Kind of Drift
The agency at the center of this dispute is young. The Prevention of Electronic Crimes (Amendment) Act 2025, passed by the Senate on January 28, 2025 and signed into law days later, restructured Pakistan's cybercrime enforcement wholesale: it stripped the Federal Investigation Agency of its cybercrime mandate and created NCCIA as the sole investigating authority, stood up a new Digital Rights Protection Authority, and added Section 26-A, a standalone offense for "intentionally" spreading information likely to cause fear or unrest — punishable by up to three years in prison and a fine of Rs 2 million (Committee to Protect Journalists, Jan. 2025). CPJ warned at the time that the vague drafting would let authorities reach far beyond genuine cybercrime. Pakistan's National Commission for Human Rights has since opened its own review of the amendment's effect on freedom of expression and access to justice — evidence this is not merely an activist complaint but a live concern inside the state's own human-rights apparatus (NCHR, 2026).
The Case for a Muscular Cyber Agency
Before dismissing NCCIA's overreach as pure bad faith, it's worth stating the strongest version of the counter-argument. Pakistan's cybercrime problem is real and large: NCCIA logged 77,023 complaints in just the first five months of 2026, evidence of genuine public demand for a functioning digital-harms mechanism — fraud, harassment, extortion, and coordinated disinformation campaigns that the old, fragmented FIA-and-police model handled poorly (Journalism Pakistan). Consolidating investigative authority in one specialized agency, with its own forensic capacity, is a defensible institutional design choice, and regulators everywhere face a genuine line-drawing problem when "crime" and "published journalism" occur on the same platforms. A columnist's piece and a coordinated bot-driven fraud campaign can both arrive as a text file on a server; distinguishing them at intake is not trivial.
Why the Correction Was Necessary Anyway
But NCCIA's own track record undercuts the case for letting it self-police that boundary. Of 520 cybercrime arrests reported in the same five-month window, only eight resulted in conviction — a funnel so narrow that the arrest itself, not any eventual verdict, functions as the practical penalty (Journalism Pakistan). Applied to journalists, that dynamic is especially corrosive: a Senate subcommittee reviewing NCCIA's own caseload found that of 13 FIRs filed against journalists, 11 were later cancelled — meaning the agency's initial judgment about what counted as a prosecutable cyber offense was wrong more than 80% of the time (Journalism Pakistan). The Digital Rights Foundation's post-amendment case tracker documents the pattern in more granular detail: journalists arrested over disputed "fake news" characterizations, YouTube channels blocked, and FIRs filed against reporters covering municipal corruption — cases the foundation says used PECA's vague provisions to chill accountability journalism rather than to fight cybercrime (Digital Rights Foundation, Sept. 2025).
That combination — a criminal-law agency with a poor conviction record, empowered by a statute with an undefined "fake news" clause, operating in a space where the Press Council and PEMRA already exist precisely to adjudicate media disputes with proportionate remedies — is what made this Senate intervention overdue rather than symbolic. Press Council findings and PEMRA sanctions can mean corrections, fines, or license conditions. An NCCIA FIR means a device seizure, an arrest, and a criminal record risk, often resolved only after the reporting itself has been chilled.
What the Ruling Does and Doesn't Fix
The committee's directive is a jurisdictional correction, not a repeal. Section 26-A's fake-news offense remains on the books, still vaguely defined, and NCCIA retains full authority over everything that isn't published journalism — a boundary that will require continuous policing given how easily "columnist criticized an official" can be recast as "cyber harassment" in a complaint filing. Pakistan does not need a weaker cybercrime agency; genuine fraud and platform abuse deserve serious investigative capacity. It needs one that respects the jurisdictional lines Parliament already drew, and a legislature willing to revisit Section 26-A's language before the next columnist becomes the next test case.