CSS Prepare

optional · CSS study notes

I.31 Cyber Crime and the Internet Era

⬆️ Back to: P-I.I. Introduction to Computing

🧭

Page Outline — click a heading to jump. Past-paper questions sit in the last section.

🎯

Exam pattern (2016–2026): 2017 Q2(a) cybercrime and privacy (8) · 2018 Q2(b) preserving digital evidence (4) · 2026 Q2(b) phishing email (6).

CSS Computer Science (Optional) — Paper-I, Section-A, Topic I, page iv / p.80 (2017 Past Paper). Covers: Cyber Crime and Internet Era.

Definition

  • Cybercrime: criminal activity carried out using computers or the Internet, targeting computer systems, networks, or data.
    • As global Internet usage grew, cybercrime evolved from isolated hacking incidents into large-scale, often cross-border, organized activity — the specific framing this 2017 past-paper question is built around.

Key Points for This Past-Paper Angle

  • The borderless nature of the Internet means cybercrime frequently crosses national jurisdictions, complicating law enforcement and prosecution — an attacker in one country can target victims in another with minimal legal recourse for the victim.
  • Anonymity tools — VPNs (Virtual Private Networks), proxy servers, cryptocurrency — have made tracing perpetrators significantly more difficult than in the pre-Internet era.
  • Governments worldwide have responded with dedicated cybercrime legislation. In Pakistan, this is primarily the Prevention of Electronic Crimes Act (PECA), 2016, which criminalizes unauthorized access, data breaches, cyberstalking, and other electronic offenses, and establishes the FIA (Federal Investigation Agency) Cyber Crime Wing as the primary investigative body.
  • The rise of e-commerce, online banking, and social media has expanded both the opportunities for legitimate digital life and the attack surface for cybercriminals — a key "Internet era" theme examiners expect in an essay-style answer on this topic.

Suggested Essay Structure for This Question

  1. Define cybercrime and briefly note its evolution alongside Internet growth
  2. Explain the borderless/jurisdictional challenge unique to the Internet era
  3. Cite Pakistan's legal response (PECA 2016, FIA Cyber Crime Wing)
  4. Conclude with the trade-off: growing digital economy = growing attack surface

MCQ Traps

  • The defining challenge of "Internet era" cybercrime, as distinct from earlier forms, is its cross-border/jurisdictional nature — not simply that it uses computers.
  • PECA 2016 is the specific, correct legal reference for Pakistan — don't confuse it with unrelated general IT policy documents.

✅ Self-Test Questions (with Answers)

Q1. Why does the borderless nature of the Internet complicate cybercrime prosecution?

Ans: Because criminal law is territorial while the Internet is not. A state's jurisdiction, police powers and courts stop at its frontier, yet an attacker in one country can target victims in another instantaneously, routing traffic through servers in a third. This mismatch between a borderless crime and a bordered legal system is the defining challenge of Internet-era cybercrime, and is what distinguishes it from earlier forms rather than the mere fact that computers are involved.

The specific obstacles:

  • Jurisdictional conflict. Where was the offence committed — where the attacker sat, where the server stood, or where the victim suffered loss? Several states may claim jurisdiction, or none may act.
  • Dependence on mutual legal assistance. Obtaining evidence abroad requires a Mutual Legal Assistance Treaty (MLAT) request, a process that commonly takes months, while the digital evidence it seeks may be overwritten or deleted within days.
  • Absence of dual criminality. Extradition and cooperation generally require the conduct to be an offence in both states. Where a country has weak or no cybercrime law, it becomes a safe haven from which attacks can be launched with impunity.
  • Attribution is technically hard. VPNs, proxy chains, the Tor network, botnets of compromised third-party machines and cryptocurrency payments obscure both the origin of an attack and the destination of its proceeds.
  • Evidence is volatile and held by foreign private companies. Logs are short-lived, and the platforms holding them answer to their own national law, not the victim's.
  • Asymmetric cost. An attack costs the perpetrator little and can be automated against thousands of victims; each investigation costs the state a great deal, so small individual losses are rarely pursued.
  • State-linked actors. Where an attack is tolerated or sponsored by a government, cooperation is not merely slow but refused, turning a criminal matter into a diplomatic one.

International responses exist but are incomplete: the Council of Europe's Budapest Convention on Cybercrime (2001) is the principal instrument for harmonising offences and speeding cooperation, but several major states are not parties, and INTERPOL channels assist coordination without conferring jurisdiction.

CSS angle: Pakistan's PECA 2016 provides for international cooperation, and the FIA Cyber Crime Wing works with foreign counterparts, but Pakistan is not a party to the Budapest Convention, so cross-border evidence-gathering still depends on slower bilateral routes — a practical illustration of the gap between domestic legislation and effective transnational enforcement.

Q2. What Pakistani law and agency are the standard reference points for this topic?

Ans: The law is the Prevention of Electronic Crimes Act, 2016 (PECA 2016), and the agency is the Federal Investigation Agency (FIA) Cyber Crime Wing. These are the two specific references an examiner expects in any answer on cybercrime in Pakistan, and a vague gesture at "IT laws" or "government policy" will not earn the mark.

PECA 2016 was enacted in August 2016 as Pakistan's dedicated cybercrime statute, replacing a patchwork of earlier and lapsed provisions. It criminalises, among other conduct:

  • Unauthorized access to an information system or data, and unauthorized copying or transmission of data
  • Interference with an information system, covering damage and disruption
  • Electronic fraud and electronic forgery
  • Identity crime — the unauthorized use of another's identity information
  • Cyberstalking and offences against the dignity and modesty of a natural person, with aggravated treatment where the victim is a minor
  • Cyber-terrorism, and the glorification of an offence

It further grants procedural powers for the search, seizure, preservation and retention of data and traffic records, and provides for the removal or blocking of unlawful content, a power exercised through the Pakistan Telecommunication Authority (PTA).

The FIA Cyber Crime Wing, which developed from the earlier National Response Centre for Cyber Crime (NR3C), is the designated investigating body, operating reporting circles in major cities where complaints are lodged. Prosecutions are heard by courts designated under the Act.

CSS angle: A strong answer should note the live controversy surrounding PECA. Journalists' organisations, bar associations and digital-rights bodies such as the Digital Rights Foundation and Bolo Bhi have argued that its provisions on defamation and content regulation are vaguely drafted and liable to be used against legitimate criticism, raising a tension with freedom of expression under Article 19 of the Constitution. The balanced conclusion is that Pakistan's difficulty is less the absence of law than the combination of over-broad speech provisions and under-resourced enforcement against ordinary financial cybercrime.

Q3. How has the growth of e-commerce and online banking expanded the "attack surface" for cybercrime?

Ans: The attack surface is the total set of points at which an unauthorised party can attempt to enter or extract data from a system. The migration of commerce and banking online has enlarged it dramatically, because activities once confined to a physical branch, conducted face-to-face with paper records, now traverse public networks and are exposed continuously to anyone on the Internet. In the pre-Internet era, robbing a bank required physical presence and accepted physical risk; today an attacker anywhere in the world can probe millions of accounts simultaneously at negligible cost.

The specific ways the surface has widened:

  • Continuous, global exposure. Online services are reachable 24 hours a day from every jurisdiction, so there is no closing time and no geographic filter on who may attempt entry.
  • Massive concentration of valuable data. Retailers and banks now hold vast centralised databases of card numbers, CNIC details and transaction histories, making a single breach far more profitable than any individual theft — a shift from retail crime to wholesale crime.
  • Many more endpoints to defend. Every customer's phone, laptop and home router is now part of the system. Security therefore depends on millions of untrained users, and the human being becomes the weakest link, which is precisely what phishing and social engineering exploit.
  • Long and complex supply chains. Payment gateways, third-party processors, cloud hosting and delivery partners each add an entry point; a breach anywhere in the chain can compromise the whole.
  • New channels of attack: mobile banking apps, QR-code payments, one-time-password interception, SIM-swap fraud, card-skimming malware on e-commerce checkout pages, and fake online storefronts.
  • Speed and irreversibility of loss. Funds can be moved through multiple accounts and converted to cryptocurrency within minutes, long before a victim notices or a bank can freeze anything.

The essential trade-off to state in a conclusion is that convenience and exposure grow together: the same connectivity that lets a customer in Gilgit pay a merchant in Karachi instantly also lets an attacker in another country reach both. Digital growth cannot be separated from digital risk; it can only be matched by proportionate investment in security, regulation and user awareness.

CSS angle: Pakistan illustrates this sharply. Branchless banking platforms such as Easypaisa and JazzCash and the growth of Raast, the State Bank's instant payment system, have brought millions into the formal financial system while generating a corresponding rise in electronic fraud complaints to the FIA Cyber Crime Wing. The State Bank of Pakistan has responded with cybersecurity and digital-payment security frameworks for financial institutions, alongside the criminal provisions of PECA 2016.

📜 Past-Paper Questions & MCQs (CSS 2016–2026)

2017 · Paper-I · Q2(a) · 8 marks

Q. The internet era has given rise to cybercrimes. Given the need to maintain privacy, which is an ethical responsibility of the government, what technical means would you suggest to curb this problem?

Quick revision + exam-ready model answer

Quick revision — key points

  • Control crime through MFA, encryption and network defence
  • Use CERT, digital forensics and secure logging
  • Respect privacy through minimisation and targeted access
  • Oversight, legality and education complete the response

Exam-ready answer — structured

Introduction / direct answer: Cybercrime includes phishing, unauthorised access, ransomware, fraud and identity theft.

Main explanation

  • Governments should reduce criminal opportunity while protecting lawful communication and personal data. First, enforce strong authentication, especially multifactor authentication, on sensitive systems.
  • Second, encrypt data in transit and at rest, while keeping encryption keys secure. Third, deploy firewalls, intrusion detection/prevention systems and centrally managed endpoint protection.
  • Fourth, establish CERT/CSIRT incident-response arrangements and prompt vulnerability reporting. Fifth, use narrowly scoped forensic investigation, audit trails and court-authorised access rather than indiscriminate surveillance.
  • Sixth, promote secure software development, patching, backups and user awareness. Seventh, adopt data minimisation, access controls, retention limits and independent oversight.
  • In Pakistan, PECA 2016 forms part of the statutory cybercrime framework, but investigatory powers must be exercised subject to applicable safeguards. Judgement: security is strongest when targeted technical protection is paired with due process, transparency and proportionality.

2018 · Paper-I · Q2(b) · 4 marks

Q. How can digital evidence be preserved from a crime scene? Write in detail with examples of digital devices commonly used today.

Quick revision + exam-ready model answer

Quick revision — key points

  • Secure, record and photograph the crime scene
  • Assess volatile evidence before powering down
  • Image storage, hash it and use write blockers
  • Document chain of custody; give device examples

Exam-ready answer — structured

Introduction / direct answer: First secure the scene, document device condition, visible screens and connected peripherals, and prevent unauthorised access.

Main explanation

  • If a powered-on system contains volatile evidence, a trained examiner should assess live collection before shutdown; otherwise preserve it in the least altering manner. Create a forensic bit-for-bit image of storage media using write-blocking where applicable, and compute cryptographic hashes (e.g., SHA-256) to verify integrity.
  • Maintain an unbroken chain of custody recording who collected, transferred and examined each item. Examples include mobile phones, computers, USB drives, DVR/CCTV systems and cloud-account logs.
  • Analyse a verified copy rather than modifying the original.

2026 · Paper-I · Q2(b) · 6 marks

Q. You receive an email asking for your banking details. What kind of risk or security issue might this be? How would you respond?

Quick revision + exam-ready answer

Quick revision — key points

  • Identify phishing/social engineering
  • Spot suspicious sender, links and OTP requests
  • Do not click; independently verify and report
  • If exposed, contact bank and secure accounts immediately

Exam-ready answer — structured

Introduction / direct answer: This is most likely phishing, a social-engineering attack intended to steal banking credentials, payment details or one-time codes.

Main explanation

  • Warning signs include urgency, threatening language, suspicious sender domains, lookalike links, unexpected attachments and requests for passwords or OTPs. Do not reply, click the link, open attachments or supply details. Verify the request independently using the bank's official application, website typed manually or known helpline.
  • Report the message through the bank's official channel, mark it as phishing and delete it. If details have already been entered, immediately contact the bank to secure the account, change compromised credentials, revoke suspicious sessions and monitor transactions.
  • Principle: legitimate verification takes place through independently established bank channels, not unsolicited links.

Digital evidence from a crime scene is preserved using a structured, step-by-step process designed to prevent data alteration, loss, or contamination. [1, 2]

Core Phases of Digital Evidence Preservation

Identification and Documentation ◦ Survey the scene to identify all active or powered-off digital devices, storage media, and network connections. ◦ Photograph the physical state of the devices, cable connections, and any visible screen activity before touching them. ◦ Record timestamps, serial numbers, models, and take screenshots of active on-screen chats, logs, or sessions. [1, 2, 3, 4]

  • Identification and Documentation
    • ◦ Survey the scene to identify all active or powered-off digital devices, storage media, and network connections.
    • ◦ Photograph the physical state of the devices, cable connections, and any visible screen activity before touching them.
    • ◦ Record timestamps, serial numbers, models, and take screenshots of active on-screen chats, logs, or sessions. [1, 2, 3, 4]

Isolation and Network Disconnection ◦ Isolate devices from cellular, Wi-Fi, or Bluetooth networks to prevent remote wiping, incoming messages, or automated updates from altering the data. ◦ Place mobile phones or wireless devices into Faraday bags (which block all radio, Wi-Fi, and cellular signals) or switch them to Airplane Mode if turning them off risks losing volatile data. [1, 2, 3, 4]

  • Isolation and Network Disconnection
    • ◦ Isolate devices from cellular, Wi-Fi, or Bluetooth networks to prevent remote wiping, incoming messages, or automated updates from altering the data.
    • ◦ Place mobile phones or wireless devices into Faraday bags (which block all radio, Wi-Fi, and cellular signals) or switch them to Airplane Mode if turning them off risks losing volatile data. [1, 2, 3, 4]

Handling Power and Volatile Data ◦ If a computer is off: Leave it off. Do not turn it on. ◦ If a computer is on: If destructive software is running, disconnect the power immediately. Otherwise, trained examiners capture volatile data (RAM, active sessions) before shutting it down. ◦ If a mobile device is on: Connect it to an external portable battery pack if necessary to prevent it from shutting down and locking (which can trigger stronger encryption), or follow specialized extraction protocols. [1, 2, 3]

  • Handling Power and Volatile Data
    • ◦ If a computer is off: Leave it off. Do not turn it on.
    • ◦ If a computer is on: If destructive software is running, disconnect the power immediately. Otherwise, trained examiners capture volatile data (RAM, active sessions) before shutting it down.
    • ◦ If a mobile device is on: Connect it to an external portable battery pack if necessary to prevent it from shutting down and locking (which can trigger stronger encryption), or follow specialized extraction protocols. [1, 2, 3]

Forensic Acquisition (Bit-for-Bit Imaging) ◦ Never analyze or work off the original storage media. ◦ Use hardware or software write-blockers to ensure no data is written to or altered on the original drive while creating a duplicate. ◦ Create a bit-for-bit forensic image (an exact sector-by-sector duplicate). [1, 2, 3, 4, 5, 6]

  • Forensic Acquisition (Bit-for-Bit Imaging)
    • ◦ Never analyze or work off the original storage media.
    • ◦ Use hardware or software write-blockers to ensure no data is written to or altered on the original drive while creating a duplicate.
    • ◦ Create a bit-for-bit forensic image (an exact sector-by-sector duplicate). [1, 2, 3, 4, 5, 6]

Cryptographic Hashing and Integrity Verification ◦ Generate a cryptographic hash value (such as MD5 or SHA-256) for the acquired data. ◦ This acts as a digital fingerprint; if a single bit of the file changes later, the hash value will change, proving whether the evidence was altered. [1, 2, 3, 4]

  • Cryptographic Hashing and Integrity Verification
    • ◦ Generate a cryptographic hash value (such as MD5 or SHA-256) for the acquired data.
    • ◦ This acts as a digital fingerprint; if a single bit of the file changes later, the hash value will change, proving whether the evidence was altered. [1, 2, 3, 4]

Chain of Custody and Secure Storage ◦ Document a strict Chain of Custody log recording every person who handled the evidence, the exact time, date, and the reason for handling it. ◦ Store physical devices and media in anti-static bags, cold storage, or climate-controlled, access-restricted facilities protected from magnetic fields and extreme temperatures. [1, 2, 3, 4, 5]

  • Chain of Custody and Secure Storage
    • ◦ Document a strict Chain of Custody log recording every person who handled the evidence, the exact time, date, and the reason for handling it.
    • ◦ Store physical devices and media in anti-static bags, cold storage, or climate-controlled, access-restricted facilities protected from magnetic fields and extreme temperatures. [1, 2, 3, 4, 5]

Examples of Common Digital Devices Today

  • Smartphones & Tablets (e.g., iPhone, Android devices): Hold text messages, encrypted chat logs (e.g., WhatsApp, Telegram), call histories, GPS location tracks, and EXIF photo metadata. Preservation note: Placed in Faraday bags or kept powered via external packs to prevent auto-lockout. [1, 2, 3, 4, 5, 6]
  • Laptops & Desktop Computers: Contain hard disk drives (HDDs) or solid-state drives (SSDs) with operating system logs, deleted files, emails, web browsing history, and volatile RAM data. Preservation note: Photographed, isolated from networks, and imaged using write-blockers. [1, 2, 3, 4, 5, 6]
  • Smartwatches & Wearables: Store heart-rate data, step counts, GPS routes, and synced phone notifications. Preservation note: Kept isolated from Bluetooth pairing to prevent data sync/overwrite.
  • Smart Home & IoT Devices (e.g., smart locks, IP security cameras, smart speakers): Record movement logs, audio snippets, Wi-Fi connection times, or video footage. Preservation note: Cloud-linked data must be preserved via official provider preservation requests alongside local extraction. [1, 2, 3, 4]
  • Vehicles (Infotainment and Telematics Units): Modern cars log Bluetooth device pairings, call logs, GPS navigation history, and speed/brake sensor data. Preservation note: Extracted using automotive forensic tools or by pulling dedicated black-box/infotainment modules. [1]