Saadia Mazhar

A 22-year-old woman, Muzammil Shahzadi, allegedly committed suicide in Kasur due to severe mental pressure and blackmail by a neighbour who recorded obscene videos on the pretext of marriage and used them to threaten her. According to the FIR, the woman was put under so much distress that she was forced to take her life, highlighting the psychological trauma, blackmail and harassment that can be inflicted on young women. Police have registered a case and launched raids to arrest the accused, and evidence is being collected from mobiles and other sources for legal action.While authorities registered a case and launched an investigation, the tragedy raises a deeper question: when online harassment escalates to life-threatening abuse, do victims trust state institutions enough to seek help before it is too late?

 

Technology-facilitated blackmail and online abuse disproportionately affect women in Pakistan, reflecting broader patterns of digital gender-based violence that extend far beyond the screens where they originate. According to a comprehensive report by the Digital Rights Foundation (DRF), women filed the majority of the 3,171 complaints of tech-facilitated gender-based violence in 2024, including coercive non-consensual intimate image (NCII) and image-based abuse cases that targeted women in 85 % of NCII complaints and 81 % of image-based abuse incidents. These abuses are often used deliberately to exert reputational harm and pressure victims into silence. Many survivors face significant logistical, financial and cultural barriers when seeking redress, which discourages reporting and reinforces social stigma around these violations. Studies show that a large proportion of women do not report online harassment because they fear family backlash, shame, or a lack of trust in institutions to handle their cases sensitively. Research also links online psychological and digital violence with debilitating emotional effects, such as anxiety, depression and suicidal thoughts, especially in conservative social contexts where personal reputation and family honour shape women’s participation in public and private life. Together, these findings indicate that the harms of digital abuse, from coercive blackmail to doxxing and trolling, can lead to profound psychological distress, social isolation, and barriers to women’s civic, professional and personal freedoms in Pakistan’s digital spaces.

 

That question becomes even more pressing in light of the recent restructuring of Pakistan’s cybercrime enforcement system. The National Cyber Crime Investigation Agency (NCCIA), carved out of the FIA’s Cyber Crime Wing and presented as a reform to improve efficiency and technical capacity, was meant to strengthen the state’s response to online abuse. Shortly after its formation, the agency faced internal credibility concerns after investigations into alleged officer misconduct, raising questions about transparency and internal accountability. More recently, over 100 contractual employees of the NCCIA reportedly saw their contracts expire without renewal, despite the agency already facing staff shortages and an increasing volume of complaints.

 

An official within the NCCIA, on condition of anonymity, acknowledged that limited human resources and technical capacity remain major challenges, affecting the agency’s ability to effectively process and investigate the growing number of cybercrime cases across the country.

 

Moreover, there is no comprehensive data protection framework in place to adequately safeguard survivors’ sensitive digital information during investigations, and there has been no consistent professional training or strict internal protocols within investigative authorities aimed at preventing data leaks. Shah Fahad, a lawyer, tells that in cases where sensitive information is mishandled or disclosed, the available remedies are limited and largely reactive, such as filing departmental complaints, initiating constitutional petitions for violation of fundamental rights, or seeking criminal action under relevant cybercrime provisions, while the absence of a dedicated data protection regime significantly weakens accountability and effective redress mechanisms. He also noted that current investigative practices can sometimes re-traumatise women complainants. In several cases, survivors are initially discouraged when they are told that their complaint may not fall within the legal definition of an offence, or are questioned in ways that appear to shift responsibility onto them — for example, being asked why private material was shared in the first place or whether they themselves circulated the content. Such questioning, he said, risks diverting attention away from the accused and onto the victim. According to him, procedural and structural gaps within the cybercrime response system further complicate access to justice. Investigative limitations, heavy caseloads and repeated procedural delays can prolong cases for years, creating additional social and financial pressures that discourage many complainants from pursuing their cases to completion.

Yasal Munir, Senior Manager Programs at the Media Matters for Democracy, says the reporting process itself can be deeply discouraging for many women facing online abuse. “Cybercrime has serious consequences for women’s mental well-being, yet the dominant social response often dismisses their experiences,” she explains, noting that victims are frequently told to simply ignore online harassment or leave digital platforms altogether. Such attitudes, she argues, effectively push women out of online spaces rather than addressing the abuse.

Munir also highlights structural flaws in the reporting process. “Survivors are often asked to collect and submit evidence of abuse themselves. In cases involving non-consensual intimate imagery or targeted harassment, this means repeatedly reviewing and organising the very material that caused them trauma,” she says. According to her, the evidentiary process lacks trauma-informed protocols and places a heavy emotional burden on survivors who are already dealing with the psychological impact of online abuse.

 

In the past, there have been cases in which court files of survivors (including their personal details, containing their graphic images) have gone missing. Even if a complainant files an FIR, then their phone number is written on it and if shared online, it compromises their safety. There is a threat of doxxing, hacking of their social media accounts, and other privacy concerns which arise when women go to report crimes against them. The process itself discourages women from going forward with their complaint.

 

While investigating agencies can access communication records and preserve digital evidence, the law does not offer any insight into what happens to the data once it has been collected. There are mandatory timelines for data deletion, no enforceable access controls for sensitive data, a prohibition on the use of data collected in one investigation for unrelated purposes, and even an independent oversight mechanism to audit data use within NCCIA. The absence of this framework means that the data profile created in the course of a cybercrime complaint is structurally unprotected, she further added.

 

A journalist from Peshawar, Mahreen Khalid spoke to me about an incident where she was let down by the NCCIA’s response to her case of online harassment. She shared a video, expressing her view that Valentine’s Day should be celebrated with parents and siblings as a way of promoting family values, which unexpectedly went viral, reaching millions of views. However, soon after, a male social media user reposted the video and launched a personal attack against her, questioning her family background and attempting to malign her character. Speaking to me, she said that the incident amounted to clear character assassination and online harassment. “Following the incident, I approached the NCCIA office in Peshawar, accompanied by my father, to formally lodge a complaint. What shocked me most was the response from the authorities.” According to her, the female officer registering the complaint stated that the department does not have the technical capacity to trace IP addresses in such cases and that complaints of this nature are often dismissed at the initial stage. “This kind of response is deeply concerning,” Mahreen added. “Such attacks severely damage a woman’s reputation and mental well-being, yet our institutions appear least sensitive to the seriousness and impact of these issues.”

 

Senior journalist Riaz ul Haq, who covers the National Cyber Crime Investigation Agency, said the shift from the Federal Investigation Agency (FIA) to the new body has brought little real change. He described the institution as “a new authority with old duties,” adding that contractual staffing, chaos, and external influence have weakened its functioning. According to him, the online complaint system is disorganised and often unresponsive, forcing victims to visit offices repeatedly to resolve basic issues. He also raised privacy concerns, saying authorities rarely explain how collected data is used and that phones are sometimes taken under pressure during investigations. Haq further noted that with limited investigators and no dedicated mechanisms for sensitive cases, many women may not feel secure or supported when approaching the agency.

 

Reports over the past year indicate a growing pattern in which journalists and human rights activists have received notices and summonses from NCCIA over their online reporting and commentary. Press freedom organisations warn that investigations requiring journalists to hand over their phones or provide access to digital accounts can raise serious privacy and source-protection concerns. The Committee to Protect Journalists (CPJ) and UNESCO have repeatedly highlighted that journalists’ digital devices often contain sensitive information, including confidential communications with sources, unpublished reporting material, and personal data. UNESCO’s global research on the safety of journalists notes that compelled access to reporters’ phones, computers, or messaging accounts during investigations can expose source identities and undermine the confidentiality that investigative journalism relies upon. Similarly, CPJ guidelines on digital safety warn that device seizures or forced access to communications may compromise not only a journalist’s personal privacy but also the security of whistleblowers and vulnerable sources who share information in confidence. For journalists covering governance, corruption, or human rights issues, such access can therefore create significant concerns about the protection of sensitive information stored on their devices.

 

Journalist Nadir Baloch, who has himself received notices from the cybercrime agency over his reporting, says the complaint process itself often discourages victims.“The online complaints mechanism is messy and often non-responsive. Victims are mostly seen roaming around the NCCIA offices and manually meeting the requirements to address basic issues in their complaints,” he said, describing what he believes are structural inefficiencies in the reporting process. Concerns about privacy also arise during investigations, particularly when journalists or activists are asked to hand over their digital devices. Baloch described his own experience with the agency after being summoned over a social media post.“They hardly tell you about the use of data, except that it is just for investigation purposes. Phones are collected often under duress… I was invited to the office and my phone was collected by force, on the threat of dire consequences,” he said.

Yasal Munir endorsed Nadir's point: “We know that the phone numbers of survivors are available in public records. I remember when we were reporting on Samiya Hijab’s attempted kidnapping case, we used the phone number mentioned in the FIR to contact her for a quote. But…many others would have access to her phone number because that FIR was circulated in so many groups. Then, there are issues of the security of other pictures on their devices when a device goes for a forensic. We know all data is accessed, even the deleted images.”

 

Official data obtained through a Right to Information (RTI) request further illustrates the structural gap between public complaints and judicial outcomes. According to the official response, 94,552 complaints were received nationwide during the nine-month period under review. However, only 21,260 of these complaints were converted into formal enquiries — meaning just 22.49 per cent progressed beyond the initial screening stage, while nearly 77.5 per cent did not proceed further. The data indicates that the majority of complainants never see their cases formally examined beyond preliminary review.

 

The filtering becomes even more pronounced at the stage of criminal registration. Out of the enquiries initiated, only 1,440 FIRs were registered across the country. This represents just 1.52 per cent of total complaints received and 6.77 per cent of enquiries conducted. In practical terms, fewer than two out of every hundred complainants saw their cases converted into a formally registered criminal case.

 

Further down the prosecution chain, 651 challans were submitted before courts. While this accounts for 45.2 per cent of the FIRs registered, it represents only 0.69 per cent of total complaints received. The most striking figure emerges at the final stage of conviction. Only 20 convictions were secured nationwide during the period under review — translating to 0.021 per cent of total complaints, 1.39 per cent of FIRs registered, and 3.07 per cent of challans submitted in courts.

 

The steep decline at every procedural stage, from complaint to enquiry, enquiry to FIR, FIR to challan, and finally conviction, highlights systemic challenges in converting citizen complaints into successful prosecutions. For survivors of digital blackmail and harassment, particularly women who already face social stigma and reputational risk, such attrition can deepen mistrust in institutional remedies and discourage reporting altogether.

 

 

Advocate Shah Fahad stated that in his professional experience, he has not observed any meaningful or structural changes in the handling of harassment complaints involving women after the transition from the FIA to the NCCIA, with no significant improvement in procedures, victim handling, or investigative standards that would reflect substantive institutional reform. He explained that while personal devices are often required for forensic examination to preserve and analyze digital evidence, serious concerns arise regarding the handling and return of such devices. In many cases, once a complainant submits their device to the NCCIA (formerly FIA), it is not returned in a timely manner, and the complainant must approach the court and obtain formal orders for its release. This practice discourages victims from filing complaints, as they fear losing access to essential personal devices for an indefinite period. He emphasised that although forensic requirements are legally justified, there must be clear protocols ensuring prompt return of devices and safeguarding the complainant’s privacy and dignity.

Lawyer Shah Fahad further states that while forensic evidence and device analysis are often necessary for cybercrime investigations, clearer safeguards are needed to ensure that complainants’ privacy is protected. “Victims come forward expecting protection. But if the process itself makes them feel vulnerable, whether through loss of control over their devices or exposure of personal information, it discourages others from reporting similar crimes.”

The long and uncertain legal process, combined with concerns about privacy and institutional handling of sensitive evidence, continues to shape how survivors weigh the decision to report cyber harassment.

For many women, the choice is not simply about whether abuse occurred online, but about what might happen to their personal data once they seek help. Women are already dealing with the fear of social stigma and reputational damage. When they report a case, they are often required to hand over their phones, screenshots, personal messages, and sometimes their entire digital history. The question many survivors ask is: once this information enters the system, who is responsible for protecting it?. Until clearer safeguards exist around how digital evidence is collected, stored and accessed during investigations, many survivors will continue to hesitate before approaching authorities, even when the abuse they face online becomes unbearable.