I.30 Computer Crimes

⬆️ Back to: P-I.I. Introduction to Computing

🧭

Page Outline — click a heading to jump. Past-paper questions sit in the last section.

🎯

Exam pattern (2016–2026): 2021 Q2(b) computer crimes and ethical challenges (7). Related questions (2017, 2018, 2026) are on I.31.

---

CSS Computer Science (Optional) — Paper-I, Section-A, Topic I, p.72-73. Covers: Computer Crimes.

Definition

• Computer crime (cybercrime): illegal activity carried out using computers or networks, or that targets computer systems themselves.

Common Categories

• Hacking: unauthorized access to a computer system or network
  • Definition: gaining entry to a computer, network, or account without the owner's permission, typically by exploiting a technical weakness or stolen credentials.
  • How it's committed: exploiting unpatched software vulnerabilities, guessing or cracking weak passwords, using stolen login credentials, or planting malware that opens a backdoor into a system.
  • Key features: it is fundamentally a technical breach of access controls; it may be done for curiosity, profit, sabotage, or espionage, and is distinguished from social-engineering crimes like phishing by its reliance on technical intrusion rather than deception.
  • Examples: an attacker exploiting an outdated web server to break into a company's customer database; a group breaching a government portal to deface it or steal records.
  • Pakistani legal context: PECA 2016 (Prevention of Electronic Crimes Act, 2016) criminalizes unauthorized access to information systems and data, making basic hacking itself a punishable offence regardless of whether further harm follows.
• Identity theft: stealing personal information to impersonate someone, typically for financial fraud
  • Definition: unlawfully obtaining and using another person's identifying information (CNIC number, bank details, login credentials) to impersonate them, usually for financial gain.
  • How it's committed: through phishing, data breaches, stolen physical documents, or malware that harvests personal data, followed by using that identity to open accounts, take loans, or make purchases in the victim's name.
  • Key features: the harm is compounded because the victim is often held liable or must prove non-involvement after the fact; it frequently combines with phishing or hacking as the initial data-gathering step.
  • Examples: someone using a stolen CNIC and leaked bank statement to open a fraudulent credit line; an attacker using breached login details to take over a victim's mobile-banking app.
  • Pakistani legal context: PECA 2016 addresses electronic fraud and identity-related offences, and such conduct also intersects with traditional fraud and forgery provisions.
• Phishing: fraudulent attempts (often via email) to trick users into revealing sensitive information (passwords, card numbers) by posing as a trustworthy source
  • Definition: a social-engineering attack where the perpetrator impersonates a trusted entity (a bank, employer, or well-known service) to trick the victim into voluntarily disclosing sensitive information or clicking a malicious link.
  • How it's committed: mass or targeted emails/SMS/messages that mimic a legitimate sender, directing victims to a fake login page that captures their credentials, or attaching malware disguised as a legitimate file.
  • Key features: relies on deception and psychological manipulation rather than technical intrusion; "spear phishing" refers to a version targeted at a specific individual or organization using personalized details.
  • Examples: a fake email claiming to be from a bank asking a customer to "verify" their account by entering their PIN on a lookalike website; a fraudulent SMS about a prize that links to a credential-harvesting page.
  • Pakistani legal context: phishing-enabled fraud falls under PECA 2016's electronic fraud provisions, and cases are typically investigated by the FIA (Federal Investigation Agency) Cyber Crime Wing.
• Cyberstalking: using digital means to harass or monitor an individual persistently
  • Definition: the repeated use of the internet, social media, or other electronic means to harass, threaten, or monitor a specific individual, causing fear or distress.
  • How it's committed: repeated unwanted messaging, tracking a victim's location or online activity, creating fake profiles to monitor or defame someone, or threatening to release private images or information.
  • Key features: distinguished from a single harassing message by its persistence/pattern; often intersects with harassment of women online, a specifically named concern in Pakistani cybercrime discourse.
  • Examples: repeatedly messaging or tracking an ex-partner across platforms after being asked to stop; creating a fake account to monitor and harass a coworker.
  • Pakistani legal context: PECA 2016 explicitly criminalizes cyberstalking as a distinct offence, one of the more frequently cited provisions of the law in public discussion.
• Fraud: using computer systems to deceive for financial or personal gain
  • Definition: using a computer or electronic communication as the instrument of deception to unlawfully obtain money, property, or services.
  • How it's committed: fake online stores that take payment without delivering goods, fraudulent investment or job schemes advertised online, manipulating online banking or payment systems, or business email compromise scams.
  • Key features: the computer/network is the means of the deception rather than an incidental detail; overlaps heavily with phishing and identity theft as enabling techniques.
  • Examples: a fake e-commerce website collecting advance payments and never shipping products; a scammer posing as a company executive to trick an employee into wiring funds.
  • Pakistani legal context: PECA 2016 defines and penalizes "electronic fraud" as a specific offence category.
• Denial-of-Service (DoS) attacks: overwhelming a system with traffic so it becomes unavailable to legitimate users
  • Definition: an attack that floods a target system, server, or network with excessive traffic or requests so that it cannot respond to legitimate users, violating the availability leg of the CIA triad.
  • How it's committed: a single source (or, in a Distributed DoS/DDoS attack, many compromised machines forming a "botnet") sends far more requests than the target can handle, exhausting its bandwidth or processing capacity.
  • Key features: unlike hacking or fraud, the goal is disruption rather than data theft or impersonation; DDoS attacks are harder to block because traffic originates from many distributed sources at once.
  • Examples: a botnet of infected computers flooding a bank's website during a promotional event so real customers cannot log in; attackers taking a news website offline in retaliation for its coverage.
  • Pakistani legal context: PECA 2016 covers offences that interfere with the functioning of an information system, which extends to DoS-style disruption.

Legal Framework in Pakistan

Computer crime in Pakistan is primarily governed by the Prevention of Electronic Crimes Act (PECA), 2016, which criminalizes unauthorized access, data breaches, cyberstalking, and other electronic offenses, and establishes the FIA Cyber Crime Wing as the primary investigative body. (See the dedicated "Cyber Crime and Internet Era (2017)" page for the fuller past-paper-focused discussion of this legal and societal context.)

---

MCQ Traps

• Phishing specifically relies on deception/impersonation; hacking is unauthorized technical access — the two often work together but are conceptually distinct.
• In Pakistan, cybercrime is primarily governed by PECA 2016, investigated by the FIA Cyber Crime Wing — a frequently tested specific fact.
• DDoS is about availability, not confidentiality — no data is stolen; the goal is disruption, unlike hacking, identity theft, or fraud, which all aim to obtain access or information.
• Identity theft and phishing are related but not identical — phishing is often the method used to obtain the information that then enables identity theft.

✅ Self-Test Questions (with Answers)

Q1. Define phishing and distinguish it from hacking.

Ans: Phishing is a social-engineering attack in which the offender impersonates a trusted entity — a bank, an employer, a courier service — to persuade the victim to voluntarily surrender sensitive information such as passwords, PINs, OTPs or card numbers, or to click a malicious link. It is typically delivered by mass email or SMS and routes the victim to a counterfeit login page that captures credentials as they are typed. Hacking, by contrast, is unauthorized technical access to a system or account, achieved by exploiting an unpatched vulnerability, cracking a weak password, or planting a backdoor. The essential distinction is the attack vector: phishing exploits the human being through deception, whereas hacking exploits the machine through a breach of access controls. The two frequently chain together, since credentials harvested by phishing are then used to gain the unauthorized access that constitutes hacking. A targeted variant aimed at a named individual or organisation is called spear phishing.

Q2. What Pakistani law primarily governs cybercrime, and which agency investigates it?

Ans: Cybercrime in Pakistan is principally governed by the Prevention of Electronic Crimes Act, 2016 (PECA 2016), enacted in August 2016 as the country's dedicated cybercrime statute. PECA criminalises a broad range of conduct, including unauthorized access to an information system or data, unauthorized copying or transmission of data, interference with an information system, electronic fraud and electronic forgery, identity crime, cyberstalking, cyber-terrorism, and offences against the dignity and modesty of a natural person. It also creates procedural powers for search, seizure, preservation and retention of traffic data, and provides a mechanism for the blocking or removal of unlawful online content.

The designated investigating agency is the Federal Investigation Agency (FIA), acting through its Cyber Crime Wing, which grew out of the National Response Centre for Cyber Crime (NR3C) and maintains reporting circles in the major cities where complaints are lodged. Content blocking is exercised through the Pakistan Telecommunication Authority (PTA).

• Statute: Prevention of Electronic Crimes Act, 2016
• Investigating body: FIA Cyber Crime Wing / NR3C
• Content regulator: Pakistan Telecommunication Authority

CSS angle: PECA 2016 has been persistently criticised by journalists' bodies and digital-rights organisations for vague drafting around defamation and content regulation, argued to chill freedom of expression protected by Article 19 of the Constitution — a ready balancing point for a descriptive or essay-type answer.

Q3. What is a Denial-of-Service attack designed to achieve?

Ans: A Denial-of-Service (DoS) attack is designed to make a system, server, service or network unavailable to its legitimate users. It achieves this by flooding the target with far more traffic or requests than it can process, thereby exhausting its bandwidth, memory, connection table or processing capacity, or alternatively by sending malformed input that crashes the service. Crucially, the objective is disruption, not theft: no data is necessarily stolen, copied or altered. In terms of the CIA triad of information security — Confidentiality, Integrity and Availability — a DoS attack targets Availability alone, which is precisely why examiners use it to test whether a candidate can distinguish it from hacking or data theft.

A Distributed Denial-of-Service (DDoS) attack is the amplified form, in which thousands of compromised machines forming a botnet attack simultaneously from many different IP addresses. This makes simple IP-blocking ineffective and is far harder to mitigate than a single-source flood. Motives include extortion, hacktivism, competitive sabotage, or diversion — saturating the security team's attention while a separate intrusion proceeds elsewhere.

• Target of the attack: availability of the service
• Data outcome: typically no data stolen or modified
• DDoS distinction: many sources (a botnet) rather than one
• Common defences: rate limiting, traffic filtering, content delivery networks, upstream scrubbing services

CSS angle: Under PECA 2016, conduct that interferes with or impairs the functioning of an information system is an offence, so DoS-style disruption is punishable in Pakistan even where nothing is stolen.

Q4. Write a 5-mark descriptive answer on cyberstalking: definition, method, and its treatment under Pakistani law.

Ans: Cyberstalking is the repeated and persistent use of the internet, social media, email or other electronic means to harass, threaten, intimidate or monitor a specific individual, causing that person fear, alarm or distress. The defining element is persistence and pattern: a single offensive message is harassment, but a sustained course of conduct directed at one target constitutes stalking. It differs from hacking in that no technical breach is necessary, and from phishing in that the objective is control and intimidation rather than financial gain.

Methods commonly include repeated unwanted messaging after being asked to stop; monitoring a victim's location, online activity or social-media presence; creating fake profiles to observe, contact or defame the target; distributing or threatening to distribute private images ("sextortion"); and coordinating others to pile on against the victim.

Treatment under Pakistani law: PECA 2016 criminalises cyberstalking as a distinct, named offence, covering conduct undertaken with intent to coerce, intimidate or harass a person — including following, contacting, monitoring, and taking or distributing photographs or videos in a manner that harms a person's reputation or causes distress. Aggravated treatment applies where the victim is a minor. Related provisions address offences against the dignity and modesty of a natural person. Complaints are lodged with the FIA Cyber Crime Wing (NR3C), which operates dedicated complaint circles, and the PTA can be directed to remove or block the offending content.

CSS angle: Cyberstalking provisions are the most publicly invoked part of PECA, particularly in cases of online harassment of women, and the Digital Rights Foundation's Cyber Harassment Helpline is frequently cited as a civil-society support mechanism — useful evidence of the gap between law on the books and effective enforcement.

Q5. Explain how identity theft, phishing, and fraud typically chain together in a single real-world scam.

Ans: These three offences are best understood not as alternatives but as sequential stages of a single criminal chain, where each stage supplies the raw material for the next. Phishing is the acquisition stage: the offender sends a message impersonating a bank or mobile-wallet provider, the victim enters their credentials or OTP on a cloned page, and the attacker captures them. Identity theft is the impersonation stage: armed with the CNIC number, account details and login credentials, the attacker now convincingly presents themselves as the victim to a bank, a telecom operator or an e-commerce platform. Electronic fraud is the monetisation stage: the assumed identity is used to transfer funds, obtain a loan or credit line, or make purchases, converting stolen information into financial gain. A typical Pakistani pattern runs: a fraudulent SMS claiming to be from a mobile-money service, followed by a SIM swap or account takeover using the harvested details, followed by draining the wallet balance.

• Stage 1 — Phishing: deception harvests the data.
• Stage 2 — Identity theft: the data enables impersonation.
• Stage 3 — Fraud: the impersonation is converted into money.

Examination point: because the stages are distinct offences, a single scam can attract multiple charges under PECA 2016 simultaneously — electronic fraud, identity crime and unauthorized access — rather than one. Investigation is handled by the FIA Cyber Crime Wing, and the chain also explains why prevention advice targets the weakest link, the human being at stage one.

📜 Past-Paper Questions & MCQs (CSS 2016–2026)

2021 · Paper-I · Q2(b) · 7 marks

Q. Write a detailed note on computer crimes and ethical challenges.

Quick revision + exam-ready answer

Quick revision — key points

• Define computer crimes and give categories
• Separate unlawful conduct from ethical concerns
• Explain fraud, malware, privacy and IP
• Apply prevention, education and legal safeguards

Exam-ready answer (7 marks)

Introduction: Computer crime refers to unlawful conduct in which a computer, network or digital information is used as a tool or becomes the target of an attack. Ethical challenges concern whether technology is used responsibly and fairly, even when a particular act may not constitute a crime.

A. Common types of computer crime

1. Unauthorised access and data theft: Breaking into accounts or systems to obtain confidential records. Example: stealing a company's customer database.
2. Financial fraud and identity theft: Using phishing, impersonation or stolen credentials to obtain money or misuse another person's identity.
3. Malware and ransomware: Deploying malicious software to damage systems, steal information or demand payment for restoring access.
4. Cyberstalking and harassment: Using digital platforms to threaten, intimidate or repeatedly harass individuals.

B. Major ethical challenges

1. Privacy and informed consent: Organisations should tell people what personal information is collected and must not misuse or unnecessarily retain it.
2. Intellectual property and plagiarism: Software piracy, unauthorised copying and presenting others' work as one's own violate professional responsibilities.
3. Algorithmic fairness and accountability: Automated decisions may discriminate or cause harm if biased data are used without adequate human review.

C. Prevention and responsible conduct

• Apply MFA, encryption, software patching, backups and least-privilege access to reduce technical opportunities for abuse.
• Promote digital literacy, ethical codes, transparent data policies, lawful reporting and responsible disclosure of vulnerabilities.
• Pakistan's cybercrime framework includes PECA, while professional ethics requires fairness and proportionality beyond minimum legal compliance.

Conclusion: Cybercrime prevention combines technical safeguards, effective law enforcement and public awareness. Ethical computing additionally requires respect for privacy, intellectual property and human rights.

2026 · Paper-I · Q2(b) · 6 marks

Q. You receive an email asking for your banking details. What kind of risk or security issue might this be? How would you respond?

Quick revision — key points

• Recognise phishing and social engineering
• Look for unusual sender addresses, urgent warnings and links
• Never share passwords, card numbers or OTPs through unsolicited email
• Verify independently with the bank, report and secure accounts if exposed

Exam-ready answer (6 marks)

The message is likely a phishing attack, in which a fraudster impersonates a trusted bank to obtain confidential account information. Such emails frequently include alarming warnings, misleading sender addresses, suspicious links or requests for passwords and one-time codes. The recipient should not reply, click links, download attachments or disclose banking details. Instead, the request should be verified through the bank's official app, website entered manually or a known customer-service number. The fraudulent message should be reported to the bank and email provider. If information has already been revealed, the customer should immediately contact the bank to secure the account, change affected passwords, enable multifactor authentication and examine recent transactions. Conclusion: independent verification and prompt reporting are the safest responses to suspected phishing.

Related topic: I.31 Cyber Crime and the Internet Era.