In the digital age, a substantial part of everyday life, economic activity, education, business, communication and freedom of expression depends on cyberspace. Protecting citizens, institutions and the state from cybercrime is therefore an important responsibility of the government. Yet a fundamental constitutional question remains: how far can state power extend in the name of security?
In an article published on 28 September under the title Why Amend the Cybersecurity Law to Restrict Freedom of Expression?, political scientist Ali Riaz raised concerns that extend beyond individual provisions of a proposed law. At their heart lie fundamental questions about the relationship between the state and its citizens, the limits of government authority and the protection of civil liberties. The central issue is whether cybersecurity measures will protect citizens or provide the state with further means to control their freedoms.
Security must not come at the expense of liberty
Cybercrime is a genuine threat. Effective legislation is needed to address hacking, identity theft, financial fraud, data theft, online harassment, sexual abuse and attacks on critical information infrastructure.
However, combating cybercrime and controlling freedom of expression are not the same thing. Citizens’ security, privacy and freedom of expression should not be treated as competing interests. A sound cybersecurity law must protect all three.
The state has a duty to bring offenders to justice. But it must exercise particular caution before treating criticism of the government, opposition to official decisions or questions about information as criminal acts. The government has access to legislation, administrative machinery, law enforcement agencies and technological resources. Citizens, meanwhile, rely on their rights, freedoms and access to legal remedies.
This raises several essential questions. Where are the limits of state authority? Who monitors the exercise of that authority? And where can citizens seek redress if those limits are exceeded?
Vague legal definitions create uncertainty
The language of legislation must be sufficiently precise for citizens to understand in advance what constitutes an offence. Incorrect information is not necessarily the same as a deliberate falsehood. Harsh criticism does not automatically amount to defamation. Political disagreement is different from criminal incitement, while investigative journalism cannot be equated with deliberate disinformation.
If a law fails to establish these distinctions clearly, it can create uncertainty and leave citizens vulnerable to arbitrary enforcement. This is one of the key concerns surrounding proposed Section 26.
The question is not simply whether false information should be addressed. It is also who should determine what is false and under what standards that decision should be made.
Should that authority rest with the government, the police, administrative officials, a regulatory body or an independent judicial authority? The answer has constitutional implications because the power to determine what is considered false can also influence the boundaries of public debate.
Verification of facts and restriction of expression are separate matters. Legal action should be based on a clearly defined offence, credible evidence and a fair process, rather than the preferences or political interests of those in power.
Can apprehension justify state intervention?
Proposed Section 8(2) raises another concern by addressing circumstances in which information is feared to pose a threat to public order or security. This prompts a fundamental question: should the law primarily respond to offences that have occurred, or should authorities be able to restrict citizens’ speech because they anticipate a possible threat?
If apprehension becomes a basis for legal action, it is essential to establish who determines the nature and credibility of that apprehension. Citizens must also have access to an effective remedy when authorities act on questionable grounds.
The more ambiguous the legal basis for state intervention, the more uncertain citizens’ freedoms become. Cybercrime may require a rapid response, but speed cannot replace justice or due process.
The use of mobile courts to adjudicate such offences also warrants careful scrutiny. To what extent should the executive branch be involved in the roles of complainant, investigator and judge? The separation of powers is not merely a theoretical principle of political science; it is a fundamental constitutional safeguard for individual liberty.
If political criticism, satire, forceful public statements and genuinely harmful falsehoods are placed within the same legal framework, the space for free expression may narrow considerably. A democratic legal system must distinguish between speech that causes legitimate harm and speech that challenges those in authority.
Investigative journalism and the public interest
Investigative reports concerning corruption, irregularities or abuses of power can damage the reputation of influential individuals. But does every such impact amount to defamation, or can the disclosure serve the public interest?
The distinction is crucial. Journalism often depends on examining evidence, questioning official accounts and exposing information that powerful people would prefer to keep private. A legal framework that fails to protect legitimate reporting could discourage journalists from pursuing matters of public importance.
Journalists’ digital devices may contain confidential sources, documents, interview records and unpublished material. Searches of those devices, or the seizure of their contents, must therefore account for the protection of sources and the requirements of investigative journalism.
The public’s right to know and the freedom of the press are not enemies of cybersecurity. They are essential components of an accountable state.
Digital devices also hold extensive records of private life, including personal communications, photographs, documents, banking details, family information, business records and private thoughts. State access to such material can amount to a significant intrusion into an individual’s personal sphere.
The question is not simply whether the state possesses legal powers to access digital information. It is whether the exercise of those powers is necessary and proportionate, what safeguards govern their use, who provides independent oversight and what remedies are available in cases of abuse.
Suspicion may justify an investigation, but suspicion alone is not proof of a crime. Access to private data must rest on a clear legal basis and be subject to meaningful safeguards, including appropriate judicial authorisation where required.
Lessons from previous cybersecurity laws
The controversies and experiences associated with the enforcement of earlier digital security legislation must inform the development of any new law.
Research cited in Ali Riaz’s article indicates that 1,417 cases were filed under the Information and Communication Technology Act between 2012 and June 2017, with approximately 65 per cent brought under Section 57. Between October 2018 and September 2023, a further 1,436 cases were filed under the Digital Security Act, involving 4,520 accused people.
These figures underline why changing the name of a law is not enough. The principles guiding state authority, the wording of legal provisions and the practices of enforcement must also be reconsidered. Otherwise, restrictions associated with earlier legislation may persist under a different legal framework.
The figures also reinforce the importance of examining how laws operate in practice, rather than judging them solely by their stated objectives. A law intended to protect the public must be assessed against its actual effects on citizens, journalists and other people who use digital platforms to communicate or express their views.
Countering misinformation through transparency
Rumours and disinformation can cause real harm, and the state has a legitimate interest in addressing them. But criminal penalties alone are not a sufficient response.
A more effective approach requires the free flow of information, independent journalism, professional fact-checking, timely disclosure of official information and protection of citizens’ right to access public records.
The first response to false information should be to provide accurate, verifiable information. Punishment should be a last resort, reserved for clearly defined offences and imposed through fair legal procedures.
Restricting access to information does not necessarily eliminate rumours. When reliable information becomes harder to obtain, speculation can fill the gap. Transparent communication and prompt official clarification can help the public distinguish verified facts from unsupported claims.
For this reason, any expansion of the state’s access to citizens’ devices, data and communications must be accompanied by clear legal authority, independent oversight, appropriate judicial safeguards, tests of necessity and proportionality, and effective remedies against misuse.
Security measures should never turn citizens’ private lives into an unrestricted field of state surveillance.
The constitution must remain the ultimate safeguard
The state is not the guardian of the people in the sense of possessing unlimited authority over their lives. It is their servant. Governments exist to serve citizens, not the other way around.
The state should not determine what citizens must see, say or think. Its responsibility is to protect them from crime and harm, not to control their conscience or freedom of expression.
The proper philosophy of cybersecurity is to make citizens safer, not more easily controlled.
Parliament, the government, the administration, the police, the Election Commission and the judiciary are all institutions exercising constituted power. Their authority derives from the people and the constitutional framework. That authority is therefore limited; it is not absolute.
The people are the source of public authority, while state institutions are entrusted with exercising it. The constitution establishes these institutions and defines the boundaries within which they must operate. No cybersecurity law can legitimately stand above the constitution.
Cyberspace is not a lawless territory beyond the reach of the state. Equally, it must not become an area in which government authorities exercise arbitrary control. Digital spaces are part of citizens’ broader civic lives, where rights and responsibilities must be respected.
A democratic law must provide security without demanding the surrender of freedom. It must empower the state without placing its actions beyond accountability. And it must uphold the law without allowing legal provisions to become instruments for diminishing citizens’ rights.
Three questions should remain central to any democratic republic: What may the state do? What must it not do? And what remedies are available to citizens when it exceeds its authority?
Without clear answers to these questions, no security law can be considered fully democratic.
Cybersecurity and the challenge of state reform
One of the central lessons of the post-July reform agenda is that meaningful change requires more than replacing laws or restructuring institutions. It also requires changing the way state power is organised, understood and exercised.
Reform cannot be complete without protecting citizens’ rights, freedoms and dignity. Cybersecurity legislation must form part of this wider effort to build institutions that are accountable to the public and constrained by constitutional principles.
The debate, ultimately, is not only about how cybercrime should be prevented. It is also about how much power the state should receive in
