Can NCCIA Access Your Phone and Photos in Pakistan? What the Law Allows

Short answer: No. We found nothing in Pakistan's cybercrime law that lets the National Cyber Crime Investigation Agency (NCCIA) look into anyone's phone or gallery at will. Every power we read needs a court warrant, a written notice or a named offence. It can take your phone in a case. It cannot browse your photos for no reason.

A message goes round every few months: "NCCIA can see your gallery, delete those photos now." It sounds scary and it is mostly wrong. The law is more specific, and more limited, than the rumour.

We read the Prevention of Electronic Crimes Act, 2016 (PECA) in its compiled form with amendments up to 2023, and the National Assembly's text of the 2025 amendment that created the NCCIA. We could not read the NCCIA's own website, which blocked our request on 12 October 2026. So the legal points below come from the Act itself, and anything about agency tools is marked as reported.

NCCIA has no general power to look inside a phone

The Act gives the agency powers tied to an investigation of an offence. We found no section that allows a blanket look at any citizen's phone, gallery or chats. Unauthorised access to someone's device is itself an offence under section 3 of the same Act.

The 2025 amendment replaced section 29. It says the Federal Government shall set up the NCCIA to inquire into, investigate and prosecute offences under the Act. Its officers are treated as police officers of equivalent rank, and the old FIA cyber crime wing ceases to exist. Under the new section 30, only an authorised officer of the NCCIA can investigate an offence under the Act.

That is a statement of who investigates. It is not a power to inspect phones in general. The powers to search and seize sit in separate sections, and each has conditions.

The law gives six routes to phone data, each with conditions

PECA names several routes. Some need a court. Some are notices to a company or a person. Which one applies depends on whether the agency wants your device, your stored content or only your traffic records.

Traffic data means records such as who contacted whom and when. It is not the photos or messages themselves. Content data is the actual material, such as pictures and message text.

Photos on your phone are reached by seizing it or by a court order

Pictures stored on a handset are reached in one of two ways. The agency obtains a warrant and takes the device, or a court orders the person in control of the data to provide it. A cloud backup is the second case, because the company holding it is the one ordered to hand it over.

Section 33 asks the court to be satisfied that there are reasonable grounds to believe the device or data is needed for a specifically identified offence. The warrant lets an officer enter the specified place and access, seize or secure the relevant device or data.

There is one exception. For an offence of cyber terrorism under section 10, a gazetted officer may act without a warrant if getting one would risk the data being destroyed. The officer must tell the court within 24 hours. This is a narrow case and not the ordinary one.

Section 35 also says the officer must act with proportionality and must not interfere with data that is not part of the offence. A device may be seized as a last resort only, when technical measures to copy the data cannot do the job.

Calls, messages and platform requests follow other rules

For a telecom company, PECA requires retention of traffic data for a minimum of one year and its release on a court warrant. For a social media or app company, the agency can send a preservation notice or seek a court order. The company is not required to watch its users in advance.

Section 38 says a service provider has no obligation to proactively monitor material on its service. It also allows the provider to tell an affected user about a notice. The agency can ask the provider to keep an investigation confidential for 14 days, and a court can extend that period.

Real-time collection under section 39 is done through a designated agency notified under the Investigation for Fair Trial Act, 2013. The court order must say why it is needed. The period may not go beyond what is necessary and, at first, not more than seven days.

No official list names phone brands as safe or unsafe

We found no NCCIA, PTA or government advisory that ranks phone brands or models as safe or at risk from the agency. Phone makers publish their own security details. A comparison of update years and encryption is in the check of how long each brand supports your phone.

The practical risk to a typical person is not the agency. It is a lost phone, a fake APK, a stolen SIM or a scam caller. The steps to check a phone for spyware and to review app permissions on Android deal with those.

What reports say about AI and monitoring systems

We could not read any NCCIA page naming an AI model that "does the reporting". What exists in reports is narrower. It does not describe a tool that opens individual phones.

• Reports say the NCCIA launched an AI-enabled tool called Katalyst in 2026, built with the UK-Pakistan UPSCALE programme, to sort child sexual abuse referrals. Its stated job is to review reports, not to read citizens' phones. We could not confirm this on an official page.
• Reports say Pakistan installed a Web Monitoring System that inspects internet traffic at network level. PTA has previously described a "web management system" and denied it is a firewall. We could not read the PTA page that carried that statement.

A network system sees traffic passing through the network. It does not see a photo that never leaves your phone. We have no official text that says otherwise.

What to do if a call or notice arrives

Do not argue on the phone and do not share codes. A real notice is written, names the case or offence and comes through proper channels. Check it from the agency's published contact, not from the number that called you.

1. Hang up and do not call back the number that contacted you.
2. Write down the number, date, time and what was said.
3. Look up the NCCIA helpline and complaint portal independently. The route to report a cybercrime to the NCCIA lists what to confirm.
4. Ask for any notice in writing, with the case reference, the officer's name and a station address.
5. Keep a lawyer's number ready before you visit any office.

Fake NCCIA and PTA callers use spoofed numbers. The method is set out in the check of a fake PTA, NCCIA or bank call. If a genuine officer contacts you, a verified written notice is the proof, not a phone call.

Common questions

Can NCCIA see my WhatsApp messages without my knowledge?

We found no power that allows that for a person's own chats. The routes we read are a court order for content data, a seizure of your device under a warrant, and a requirement under section 35 to give access during an investigation.

Can NCCIA access my gallery remotely?

We found no provision for browsing a person's gallery remotely without a warrant or order. Unauthorised access to a device is an offence under section 3. Any tool or method used on a phone would have to sit within the court-ordered powers.

Do I have to give my phone passcode?

Section 35 allows an authorised officer to require a person who holds decryption information to grant access in readable form for the investigation. Whether a particular demand is valid depends on the case. Speak to a lawyer before you answer.

Does NCCIA need a warrant to take my phone?

Normally yes. Section 33 needs a court warrant for a specified place and a specifically identified offence. The only exception we read is a cyber terrorism offence, with the court told within 24 hours.

Which phone brand is safest from NCCIA?

No official source ranks brands for this. Strong passcodes, current updates and encryption help against theft and hacking. They are not a reason to expect the law to stop at a brand name.

Is a call from NCCIA asking for my OTP real?

No genuine agency or bank needs your OTP over a call. Hang up and verify through channels you find yourself.

How we verified this

What we checked, where we read it, and what we could not confirm.

We read the compiled text of the Prevention of Electronic Crimes Act, 2016 (amendments up to Act XXXVII of 2023) and the National Assembly's text of the Prevention of Electronic Crimes (Amendment) Act, 2025 on 12 October 2026. The NCCIA website, complaint.nccia.gov.pk, blocked our automated request that day, so the helpline and portal should be confirmed in your own browser. For the Act itself, see the National Assembly of Pakistan and Pakistan Code. This is a plain reading of the law, not legal advice.