by Sanam Maher
In 2012 Nighat began working as a consultant for UN Women. She frequently conducted digital security training for organizations and media groups, and a friend suggested that she set up an outfit devoted to this work. In October of that year, the friend purchased a domain for her. The Digital Rights Foundation (DRF) came into being, and Nighat would work at UN Women during the day and then spend her evenings working on her own organization’s website. She wrote blogs and slowly spread the word about her work. It would be two years before she received any funding for this work.
DRF’s first campaign was called Hamara Internet (Our Internet). The project was very close to Nighat’s heart. In a country like Pakistan, where male users dominate online space, often outnumbering female users one and a half times, she observed how misogynistic tendencies slowly crept from the offline arena into online space. “It wasn’t just about women facing harassment or threats online,” she explains; many women were afraid to be vocal or to express themselves online, just as they were in the offline world. “Women were facing behaviour online that had a very deep connection to the offline space.”
The Federal Investigation Agency (FIA), tasked with handling cybercrime in the country, reported that it received more than 3,000 cases between 2014 and 2015—with 45 percent of the cases related to harassment of women on social media platforms like Facebook.8 In Punjab alone, where DRF is based, there were 170 complaints of cybercrimes against women in 2014.9 However, not a single case was successfully prosecuted, and many women ended up reaching a compromise with the person they had lodged a complaint against. With little faith in the government agency’s ability to handle a case, many women either choose to stop using the Internet or just keep quiet.
“[We want to] open up a new chapter in the struggle for women’s rights in Pakistan by addressing the one element that many campaigns previously ignored,” stated Hamara Internet’s manifesto. “The Internet.” The DRF team travelled to seventeen universities and colleges across Pakistan and trained more than 1,800 female students and teachers to protect themselves online. They taught girls how to lock their phones and create secure passwords. Girls told stories of being shamed off the Internet when fake profiles with their names or faces were created and used to send friends and family members explicit messages or vulgar photos; they received threats of rape and murder; they were stalked; their photos were copied without their consent, and their faces Photoshopped onto the naked bodies of other women.
In the first ever comprehensive survey of Pakistani women’s experiences online, the DRF team learned that only 28 percent of the women they met as part of the Hamara Internet campaign knew about laws against cyber harassment. 70 percent of these women were afraid to post pictures of themselves online because they feared they could be misused. They were afraid to report harassment because it could tarnish their names or reputation or put them in danger. Many were forced to hand over passwords to phones, email accounts, messaging services and social media accounts to their partners or the male members of their families so that they could be routinely checked on.
As the DRF training sessions continued, Nighat started to hear from girls who had attended them. The messages would arrive late at night on her personal Facebook account and the Hamara Internet account. They were desperate. “If you don’t reply to me in an hour, I’m going to kill myself,” one girl said. These girls were being blackmailed, harassed or threatened online, and they did not know who to turn to. Often Nighat used her contacts in the tech world or within social media companies to try to resolve problems. She would also speak to the girls for days, counselling them or providing emotional support.
Other times, however, she had to be inventive with solutions. “Once I received a message from a woman in Ireland who told me that a man in Pakistan, whom she had had a relationship with, was harassing and blackmailing her,” she recalls. The two had been in a relationship for two or three years, and had exchanged photographs and videos. When the woman ended the affair, the man threatened to send her pictures to her parents and the priest at her church. Nighat contacted the FIA and explained what was happening, but they said they could not deal with an international complaint. The woman’s only hope was to contact the Pakistani embassy in Ireland and ask them for help. When Nighat told her this, the woman threatened to kill herself. She was from a conservative Catholic family, and her family had no idea she had been in a relationship.
Nighat asked for the man’s phone number. He lived in Rawalpindi. She took a deep breath and called him. “I spoke in English, with an accent,” Nighat recalls. “I knew Pakistanis get impressed by that sort of stuff. I told him I was his ex-girlfriend’s lawyer. I gave him details about where he lived, his job and so on, and said he was being observed. The next time he contacted the woman, the FIA would initiate a case against him. I knew all the relevant laws against this sort of thing and quoted them to scare him.”
The man was terrified. He said he did not know there was a law against what he was doing.
“You might not have known about the law, but didn’t you realise you were harassing this woman?” Nighat asked him angrily. He never contacted his ex-girlfriend again.
By 2016 she was feeling overwhelmed by requests for help from strangers. In many instances she was battling a legal system that did not support the women who approached her or understand the trauma caused by the harassment.
“I was contacted by a young woman a year ago who had received an offer of marriage from her brother-in-law,” Nighat recalls. “He wanted her to be his second wife. The girl refused, and the man threw acid on her face. She fought a case against him, and he was jailed, but his cousins then began to blackmail her. They stole photographs of her and threatened to release doctored images online and among her family. She needed me to help stop them from doing so.”
Nighat approached the police, but was rebuffed. “This woman was attacked with acid and you want us to focus on the theft of pictures?”
* * *
—
I meet the deputy director of the Federal Investigation Agency’s cybercrime wing, Noman Bodla, on a bitterly cold morning at the Islamabad office of the National Response Center for Cyber Crime (NR3C), which was established by the federal government in 2007 to curb “technological abuse.” There are five such cybercrime units across the country and that headed by Bodla has jurisdiction over Jhelum (at the northern edge of the Punjab province), Islamabad, Rawalpindi, parts of Kashmir, and Gilgit Baltistan. It is raining, and the unpaved road leading to the building has turned to mud. After visitors squelch past the concrete barricades, they must provide their names and national identity card numbers to a guard sitting in a small cabin, who notes down the details in a register. The black-tiled NR3C building has sand-coloured arches and small curved balconies. All the windows have been treated to mirror the world back on itself—today, shining slices of the grey sky. A guard stands at the entrance under an awning painted with a verse from the Quran: “Allah gives to those whom He wants.”
The building is old and there are no elevators. Inside it is dark, with the only light coming from windows on each stairwell and bare bulbs in the narrow corridors. The ninety-nine names of Allah shadow all who walk through the corridors here, painted in blue as close to the ceiling as possible: the Omnipotent One, the Guarding One, the Dominant One, the Creator, the Reckoning One, the Watchful One. In Bodla’s small office space, mostly taken up by a desk, a whiteboard the size of half a newspaper page has been mounted on the wall. On it a reminder is written in neat capital letters: HARD WORK BEATS TALENT WHEN TALENT DOESN’T WORK HARD.
Bodla had been in his position for a month when he realised that he was battling a force that he had never expected to go up against: Hollywood. “The movies have ruined things for us,” he explains. “Everyone thinks we are macho men and we can do anything. They watch films where someone sits at a computer and with the press of a button, suddenly has access to all informatio
n. It’s nothing like that.” Bodla has received requests to recover stolen mobile phones and laptops, trace phone numbers and find children who have run away from home. “The complainant said that his daughter, who had run away, was on Facebook, and so he needed the cybercrime wing to locate her. Something could happen to them in a dream and they think they need to call us,” he grumbles.
When the complaints are more suited to his job description—for instance, in cases of cyberstalking, online threats or abuse, or the misuse or theft of personal information online—most people expect a few quick taps on a keyboard will solve their problem. Bodla, who is in his late thirties, says that he was one of the country’s first experts in the field of cybercrime. “I was studying all of this back in 2005 or 2006, when no one even knew about cybercrimes,” he brags. As a digital forensics expert, his opinion is admissible in court, and he lectures law enforcement trainees and members of the judiciary about cybercrime.
Once a complaint is received at the NR3C in Islamabad—either through an online form, an email, a handwritten note or a call to head-quarters—the complainant is asked to visit one of the five units with proof of any harassment or cybercrime. If the complainant does not live in a city with an NR3C office (located in Islamabad, Peshawar, Lahore, Karachi, and Quetta), they must travel to one of these cities.
Here their complaint is recorded and their name noted—there is no anonymity. All evidence of the crime, including screenshots, messages, photographs, or videos, must be provided to the officer dealing with the complaint. The material is not returned to the complainant but is filed away, along with thousands of other photographs and printouts, at the NR3C offices.
Once a formal inquiry is launched and the FIA has a warrant, officials can search and seize items such as laptops or mobile phones from the suspect’s home. Sometimes a court order is sent to social media companies such as Facebook to request details about the suspect. “If we get those details—and that’s a big if—then we are able to get an IP address and the suspect’s name and location,” Bodla explains.
Any evidence gathered in searches is sent to a forensic lab so that incriminating data may be extracted from it. Once the FIA believes it has sufficient evidence, it creates a report for its legal team, who see if there are grounds to prosecute. The legal team then recommends whether an FIR (First Information Report), the first step for a police investigation, can be registered. With the approval of the court and the director of the cybercrime wing—unless the complaint concerns nudity, child pornography or cyber terrorism, in which case the NR3C does not need to wait for the court’s approval—an FIR is registered and the suspect may be arrested. “Normally, this process doesn’t take too long,” Bodla explains. “The complaint should be converted into an inquiry or the case closed within one month.”
But there are exceptions. The suspect can be in another country. Don’t forget that even “someone in Panama can cause so many problems for people here in Islamabad,” Bodla says with a giggle, referring to a corruption probe against the prime minister after the Panama Papers were leaked, in which case the complaint is out of the FIA’s jurisdiction. “In those cases the complainant has two options. Either live with it or wait for somebody to do the same thing from within the country.” Even if the suspect is in another city, the complainant may have to wait while their case is turned over to the relevant NR3C office or until the local officials travel to the city the suspect resides in to further investigate.
As companies like Google or Facebook are not legally compelled to provide information to the Pakistani government, many complainants can only hope that they will cooperate by providing information about a suspect’s IP address or by taking down photographs or messages that could put lives at risk, reveal hidden identities to the public, or cause distress.
In April 2017 Facebook revealed that the Pakistani government made 1,002 requests for data on the social media platform’s Pakistani users in the second half of 2016—a steady increase since 2013, when the social media platform received only thirty-five requests for user data. According to the company’s published policies, Facebook may “access, preserve and share your information in response to a legal request (like a search warrant, court order or subpoena)” if there is “belief that the law requires us to do so.” Since 2015, Facebook has complied with 64 percent to 68 percent of these requests.10
In 2017, the Pakistani government appeared to be primarily concerned with the data of social media accounts that shared material deemed to be blasphemous, and it lobbied Facebook and Twitter to make it easier to track and locate users who had allegedly committed blasphemy online. In June an anti-terrorism court sentenced a man to death for reportedly making derogatory remarks about the Prophet Muhammad and his wives on Facebook—the first case of digitally perpetrated blasphemy in the country.11
While Bodla insists that the NR3C does not deviate from procedure when it comes to tracking suspects, a report in June 2017 by the Guardian revealed that the FIA detained social media users, including activists, journalists and a political party worker, for posting “anti-military” content online.12 An FIA official who chose to remain anonymous told the reporter his agency could “interrogate and seize laptops and phones without warrant” and added, “We are authorized to detain anyone, just on suspicion.”13
In other cases, however, the FIA has reportedly been unable to help complainants with relatively simple requests. In March 2017 a senator revealed that two fake accounts under his name were being run on Twitter, and despite letters to the FIA, the Pakistan Telecommunication Authority and the Intelligence Bureau, he had been unable to have the accounts shut down. “I was told that only Twitter administration could do that,” Senator Raza Rabbani said during a session in the Senate.
Bodla estimates that in 2016 his office received roughly 2,500 complaints of cybercrimes. Of those, around 166 or 167 went on to reach the inquiry stage. And 61 of those cases led to the registration of an FIR. Many complainants choose not to pursue their case because they are unable to go through such a lengthy procedure, particularly if they do not live in a city with an NR3C office—in this case they must make repeated trips to the nearest office while their case continues. “Sometimes people back out of the complaint because they fear for their reputation or they feel social pressure to let it go,” Bodla says. Between 2016 and 2017, some of the complaints resolved by the NR3C included instances of vulgar messages, the non-consensual use of photographs, publication of “objectionable content” and the creation of fake profiles. In March 2017 a woman was arrested for the first time for blackmail via social media.
When I ask Bodla what happens to complainants who are unable to bear the cost of travel to the nearest NR3C office, he admits that more cybercrime centres are needed, particularly for those who do not live in major cities. He says his office has requested the creation of fifteen more centres, in cities like Multan, Sukkur, and Gwadar. There has been no word on whether the request has been approved. He is irritated when asked about women or minors who may not have permission to travel to another city alone and who do not want to confide in their family about being harassed or targeted online. “The people who have those kinds of problems don’t even come to us,” he says. “I can’t speak for them.”
In the Hamara Internet survey, Nighat’s organization learned that 15 percent of the 1,800 women surveyed in schools and colleges across Pakistan had reported a case of harassment to the FIA. Only 11 percent of these said they believed making a complaint to the NR3C would help. Some 53 percent of the women who had filed a complaint said the agency wasn’t helpful at all.
Bodla says the only way to stay safe online is to follow two golden rules: never ever upload or share any pictures or messages, and remember that anything you share can never be deleted. When I ask how he intends to have a generation of Pakistanis plugged into Facebook, Instagram, Twitter, Snapchat, and WhatsApp follow those rules, he admits that there is a need for “R
and D” (research and development).
There are fifteen people, including five investigators, currently working under Bodla. Only one is a woman. The NR3C is required to have her present during raids, in case they encounter women in the suspect’s home or need to arrest a female suspect. A male officer is more likely to deal with complainants, including women who need to report vulgar messages, doctored photographs, or intimate pictures, videos or messages shared without their consent. While organizations like DRF have called on the FIA to consider cultural norms in a place like Pakistan and have more women in the NR3C handle complaints, Bodla says that is not possible. “I have five investigators, and even if I wanted to address complaints to my female employee, she cannot handle all of them,” he explains. When a woman calls the NR3C helpline, she cannot choose to speak with a male or a female officer—she must talk to whoever happens to answer her call. If the complainant withholds some material or the NR3C believes there isn’t sufficient evidence, the case is not taken forward. Even if there were more female employees in the NR3C, Bodla argues, it wouldn’t make any difference – after all, a complainant has to be prepared for any photographs, messages or videos to be seen in court if needed. “The complainants have to be aware that everything—nude pictures, videos or whatever—has to be on the record and perused in court. If they’re not willing to do that, there’s no case.
