3.1.9. Authorities’ surveillance capabilities, including online

The Pakistani authorities have built up considerable surveillance capabilities in recent years288 and their degree of control of online/social media content continued to expand.289 The state’s surveillance operations have been enhanced by advanced foreign-made surveillance and censorship tools and lacked or often ignored legal safeguards.290 According to a digital rights activist quoted by the Islamabad-based journalist Osama Ahmad, the lack of comprehensive legislation on data protection and rules regulating surveillance technologies hampers the effectiveness of existing laws protecting citizens’ rights.291 Against this backdrop, state authorities have repeatedly used the 2016 Prevention of Electronic Crimes Act (PECA) (amended in 2025), which contains vague wording on ‘hate speech’, defamation and ‘cyber terrorism’, as a means of targeting activists, journalists and the political opposition.292 PECA gave the Pakistan Telecommunication Authority (PTA) ‘unchecked’293 discretionary powers to remove and block online material and obliged telecommunications providers to store traffic data for periods of one year or more upon request by the PTA. According to testimony given by the PTA, telecommunications providers are obliged to ensure that up to 2 % of their customers (i.e., over 4 million users across the country) can be surveilled at any given time through LIMS, a system used by the ISI and the armed forces to track calls, text messages and internet activity. Journalists interviewed by Amnesty International pointed to actual or attempted instances of hacking of their email, WhatsApp and X accounts and interceptions of phone calls and messages.294