Will the new cybersecurity law strengthen defenses or create bureaucratic conflict?

As the federal IT minister prepares to introduce the new Cyber ​​Security Act 2025 to set up an independent National Cyber ​​Security Authority (NCA), key questions remain unanswered about funding, institutional coherence and the inherent tension between security and telecom companies.

The government has announced that new secure digital infrastructure will be built under the Digital Economy Enhancement Project (DEEP) supported by the World Bank. This strategic choice raises a key question: why is a World Bank-funded project (DEEP) focusing on digital public services positioned as the backbone of a national security law?

This proposed law addresses the fourth component of the World Bank’s DEEP, which is the Contingent Emergency Response Component (CERC) and is funded with zero dollars and is primarily concerned with the development of a CERC manual that includes an emergency action plan. DEEP is specifically funding the assessment of Pakistan’s cybersecurity infrastructure and the development of a comprehensive cybersecurity roadmap by the end of this year.

By incorporating the architecture of the new cybersecurity law directly into the DEEP project, the government seeks to achieve two goals: leveraging international investment and standardization.

The NCA would use medium-sized international investments (DEEP) to finance the otherwise costly development of secure infrastructure at the government level, bypassing reliance solely on the national budget. At the same time, it will enforce global best practices, as World Bank projects require strict standards for data governance and security. Logically, these good practices could then be followed by our National CERT.

However, the question remains: what happens to the existing National Emergency Response Team (PK CERT) and will the law lead to an institutional layoff? And what cybersecurity-related roles will remain in the Pakistan Telecommunication Authority (PTA)?

PK CERT (Pakistan Computer Emergency Response Team) is the officially designated National CERT, formally established under the CERT Rules 2023 to handle cyber incident response, threat intelligence sharing and coordination between national and sectoral CERTs.

Now the establishment of a new, general National Cyber ​​Security Authority with response powers could create bureaucratic overlaps with the operational functions already assigned to PK CERT. Will NCA become the policy-making body while PK CERT remains the technical implementation arm, or will NCA try to fully integrate PK CERT’s functions?

Similarly, the PTA has its own comprehensive cybersecurity framework for the telecommunications sector based on six pillars of legal framework, cyber resilience, proactive monitoring and incident response, capacity building, cooperation and collaboration and public awareness. Collectively, these pillars represent a holistic approach, ensuring a resilient and secure digital infrastructure across Pakistan’s telecom sector.

It remains to be seen whether the new Cyber ​​Security Act and the establishment of the National Cyber ​​Security Authority will streamline or rather confuse the PTA’s security mandate?

The PTA currently operates under a regulatory framework that focuses on communication and content. The proposed NSA, however, is intended to be the lead technical and policy body for national cyber security. If the NCA focuses strictly on national defense and the protection of critical infrastructure, the security role of the PTA may be limited to telecom operators. This could lead to a clear division of labor.

But if instead the NCA requires sweeping powers across the digital infrastructure, it would create a conflict over who sets the technical standards for telecoms networks – the incumbent telecoms regulator (PTA) or the new cyber authority (NCA).

The PTA’s current dual role as a regulator as well as an enforcer of censorship means that its actions are often seen through a lens of political control rather than technical security. The NCA must ensure that its overall cyber security strategy prioritizes technical defense and rights protection over the PTA’s tendency towards mass restrictions. So the real test of the new framework is whether the NCA, as a high-level authority focused on technical resilience, will support alternative, targeted security measures to blanket shutdowns mandated by the PTA.

Essentially, the new Cybersecurity Act provides an opportunity to either formalize the necessary security functions of the PTA under the NCA umbrella, thereby improving coherence, or it could simply add another layer of bureaucracy, further blurring the lines of authority in Pakistan’s critical digital space. The need for an “enhanced incident response” system is undeniable, but it must be based on the technical expertise that PK CERT has undertaken to develop.

If the new authority is primarily a political or bureaucratic body, it risks sidelining PK CERT’s technical competence, replacing expert-driven incident management with top-down political control.

A similar fiasco happened a few years ago when we tried to transfer the powers to run state-owned companies to a newly formed holding company – Sarmaya-e-Pakistan – a move that failed miserably and resulted in wastage of taxpayers’ money.

The author is a Cambridge graduate and works as a strategy consultant