Ransom Ware Corporate Governance, and the Law A Case for Reclassification Under PECA 2016
DOI:
https://doi.org/10.59022/IRSHAD-iijcl.11Keywords:
Pakistan, Ransom Ware, Corporate Risk, Cyber Law, Fiduciary Duty, PECA 2016, Case LawAbstract
Ransom ware has evolved from an individual cybercrime into a significant corporate governance risk. This research examines how legal systems should reclassify ransom ware within corporate risk frameworks. It focuses specifically on Pakistan's Prevention of Electronic Crimes Act, 2016 and proposed amendments. The study aims to analyze fiduciary duty, board accountability, and mandatory incident reporting obligations. It uses a qualitative research design, applying doctrinal analysis and document analysis throughout. Data was drawn from scholarly literature, official legal texts, and recent policy publications. Findings show that current laws inadequately address corporate-level ransom ware liability and reporting gaps. Boards often lack clear guidance for meeting cyber security governance responsibilities under existing law. The research recommends institutional reform, phased implementation, and clearer statutory definitions for ransom ware. It also suggests balancing corporate obligations with fundamental digital rights protections carefully. These findings support treating ransom ware as a governance priority requiring coordinated legal reform. The study concludes that modernizing corporate cyber law strengthens accountability and national resilience together
References
Abdin, A. Z. U. (2025). Filling the gaps in Pakistan's national cyber security framework: A case for a comprehensive cybersecurity act in Pakistan. Research Journal of Social Sciences and Arts, 4(3). https://doi.org/10.71317/RJSA.004.03.1108
Ahmad, M. T. (2026). The Prevention of Electronic Crimes Act, 2016: Balancing cybercrime control and freedom of online expression in Pakistan. Pakistan Journal of Humanities and Social Sciences, 14(1). https://doi.org/10.52131/pjhss.2026.v14i1.3209
Al-Taie, B. F. K., Ali, S. I., & Al-Fandawi, H. H. F. (2025). The impact of corporate governance on cybersecurity risks: Internal auditing as a mediating variable. International Journal of Business and Technology, 13(3). https://doi.org/10.58915/ijbt.v13i3.297
Allahrakha, N. (2023). Balancing cyber-security and privacy: Legal and ethical considerations in the digital age. Legal Issues in the Digital Age, 4(2), 78–121. https://doi.org/10.17323/2713-2749.2023.2.78.121
Allahrakha, N. (2024). Who governs cyberspace in the age of AI? Open Science Framework. https://doi.org/10.31219/osf.io/6a2db
Aslam, M. A. (2025). Regulating misinformation or silencing dissent? A critical analysis of PECA amendments and corporate digital compliance in Pakistan. Journal of Media and Communication Studies, 7(2), 45–62. https://doi.org/10.59075/crsss
Awan, J. H., Memon, S., & Burfat, F. M. (2019). Role of cyber law and mitigation strategies in perspective of Pakistan to cope cyber threats. International Journal of Cyber Warfare and Terrorism, 9(2), 29–38. https://doi.org/10.4018/IJCWT.2019040103
Baker, T., & Shortland, A. (2023). The government behind insurance governance: Lessons for ransomware. Regulation & Governance, 17(4), 1000–1020. https://doi.org/10.1111/rego.12505
Baloch, A., & Abid, D. A. (2026). Cybercrime regulation in Pakistan: An assessment of the Prevention of Electronic Crimes Act, 2016 and the role of law enforcement agencies. Social Science Review Archives, 4(2), 1–18. https://doi.org/10.70670/sra.v4i2.2387
Bhatti, M. A., & Jamil, S. (2023). Factors effecting cyber incident occurrence: Mediating role of cyber incident reporting mechanism. International Journal of Cyber Criminology, 17(2), 112–133. https://doi.org/10.5281/zenodo.4766708
Bhutta, T. A., & Rashid, A. (2026). Cybersecurity governance in Pakistan: Evaluating public sector preparedness through International Telecommunication Union Global Cybersecurity Index framework. Journal of Public Policy Practitioners, 5(1), 1–25. https://doi.org/10.32350/jppp.51.03
Cremer, F., Sheehan, B., Fortmann, M., Kia, A. N., Mullins, M., Murphy, F., & Materne, S. (2022). Cyber risk and cybersecurity: A systematic review of data availability. The Geneva Papers on Risk and Insurance – Issues and Practice, 47(3), 698–736. https://doi.org/10.1057/s41288-022-00266-6
Elsayed, D. H., Ismail, T. H., & Ahmed, E. A. (2024). The impact of cybersecurity disclosure on banks' performance: The moderating role of corporate governance in the MENA region. Future Business Journal, 10(1), Article 115. https://doi.org/10.1186/s43093-024-00402-9
Frank, M. L., Grenier, J. H., & Pyzoha, J. S. (2021). Board liability for cyberattacks: The effects of a prior attack and implementing the AICPA's cybersecurity framework. Journal of Accounting and Public Policy, 40(5), Article 106860. https://doi.org/10.1016/j.jaccpubpol.2021.106860
Gale, M., Bongiovanni, I., & Slapničar, S. (2022). Governing cybersecurity from the boardroom: Challenges, drivers, and ways ahead. Computers & Security, 121, Article 102840. https://doi.org/10.1016/j.cose.2022.102840
Haider, M. S., & Hussain, R. (2026). Legal ambiguity in Section 21 of PECA 2016 and its impact on fundamental rights in Pakistan: An analysis through legal language. The Critical Review of Social Sciences Studies, 3(1), 1–15. https://doi.org/10.59075/v01f4q50
Hansel, M. (2024). Ransomware as a threat to peace and security. Journal of Cyber Policy, 9(2), 245–268. https://doi.org/10.1080/23738871.2024.2357092
Iqbal, M. (2023). The Prevention of Electronic Crimes Act (PECA) 2016: Understanding the challenges in Pakistan. Siazga Research Journal, 2(4), 273–282. https://doi.org/10.58341/srj.v2i4.35
Karim, A. (2026). Cybersecurity governance in Pakistan: Institutional gaps, policy failures, and strategic reforms. In Digital transformation and cybersecurity in emerging economies (pp. 185–210). Springer. https://doi.org/10.1007/978-3-032-28051-0_10
Kausar, S., & Laghari, A. R. (2025). Social engineering attacks in Pakistan: Analyzing the weakest link in cyber security. Journal of Development and Social Sciences, 6(1), 364–374. https://doi.org/10.47205/jdss.2025(6-I)32
Khadam, N. (2023). How to punish cyber criminals: A study to investigate the target and methods of cybercrimes in Pakistan. Heliyon, 9(12), Article e22634. https://doi.org/10.1016/j.heliyon.2023.e22634
Khan, A. U. A. (2025). Cyber crime in Pakistan: Trends, challenges, and legal responses. Advance Social Science Archive, 4(1), 1358–1366. https://doi.org/10.55966/assaj.2025.4.1.080
Khawaldeh, A. M. (2026). Civil liability odds in information leaks: Controversial legal debates and emerging judicial doctrines in Jordan. Laws, 15(2), Article 26. https://doi.org/10.3390/laws15020026
Kumar, R. (2026). Under the guillotine of digital authoritarianism: A critical review of Pakistan's Prevention of Electronic Crimes (Amendment) Act 2025. SSRN Electronic Journal. Advance online publication. https://doi.org/10.2139/ssrn.6965419
Larena-Luengo, A., Martínez-Herraiz, J.-J., Ferrer-Oliva, M., & Medina-Merodio, J.-A. (2026). Influence of human and organizational factors on security perception: Mediating role of cyber incident reporting mechanism. International Journal of Information Security, 25(3). https://doi.org/10.1007/s10207-026-01277-3
Liu, C., & Babar, M. A. (2026). Corporate cybersecurity risk and data breaches: A systematic review of empirical research. Australian Journal of Management, 51(1), 62–92. https://doi.org/10.1177/03128962241293658
Lodhi, A. R. K., Sajjad, A., Akbar, K., Uddin, S. S., Jabeen, R., & Lashari, A. H. (2024). Artificial intelligence, cyber law, and data protection: Legal challenges and regulatory responses in the digital age. TPM: Testing, Psychometrics, Methodology in Applied Psychology, 31(2), 1–15. https://doi.org/10.4473/TPM31.2.1
Majeed, Y., Majeed, A., & Minhas, M. T. (2026). Cybersecurity governance in the digital era and IT: Integrating regulatory oversight, risk management, and organisational resilience. Social Science Review Archives, 4(1), 1–18. https://doi.org/10.70670/sra.v4i1.1711
Marotta, A., & Madnick, S. (2025). Analyzing and categorizing emerging cybersecurity regulations. ACM Computing Surveys, 58(2), 1–36. https://doi.org/10.1145/3757318
Mirza, M. N. (2022). 3-Cs of cyberspace and Pakistan: Cyber crime, cyber security, and cyber law. Journal of Political Studies, 29(S-I), 76–85. https://doi.org/10.47205/jps.2022(29-S-I)76
Opitz, E. L. (2018). Cybersecurity for the board of directors of small and midsized businesses. Board Leadership, 2018(159), 4–5. https://doi.org/10.1002/bl.30115
Pitafi, Z. R. (2024). Perspective chapter: Cybersecurity and risk management. In Cybersecurity and risk management. IntechOpen. https://doi.org/10.5772/intechopen.1186435
Sadat, A., Lawelai, H., & Younus, M. (2025). Comparative analysis of National Cyber Security Index: A case study of Pakistan and Indonesia. Kasetsart Journal of Social Sciences, 46(1), 1–12. https://doi.org/10.34044/j.kjss.2025.46.1.01
Saleem, H., Jan, J., & Areej, A. (2022). Cyber crimes trends in Pakistan: Analyzing the legal framework and enforcement challenges. Society, Law and Policy Review, 1(1), 10–22. https://doi.org/10.62585/slpr.v1i1.21
Shabana, S., & Rahman, A. (2024). Cyber crimes and security challenges in Pakistan: An analysis of PECA 2016 application. Journal of Political Stability Archive, 4(2), 16–28. https://doi.org/10.63468/jpsa.4.2.16
Sharma, D., Reddy, S., & Shahid, H. (2023). Cybersecurity obligations for critical infrastructure: Emerging legal norms, enforcement gaps, and governance challenges. Legal Studies in Digital Age, 2(3), 49–63. https://doi.org/10.61838/kman.lsda.322
Teichmann, F., & Wittmann, C. (2022). When is a law firm liable for a data breach? An exploration into the legal liability of ransomware and cybersecurity. Journal of Financial Crime, 30(6), 1491–1498. https://doi.org/10.1108/JFC-04-2022-0093
Worsley, M. K., Kendall-Morwick, J., & Houston, K. A. (2025). Change waits for no one: An examination of the legal response to ransomware attacks. Criminal Justice Policy Review, 36(6), 259–280. https://doi.org/10.1177/08874034251363431
Zia Ul Islam, Khan, M. A., & Zubair, M. (2019). Cybercrime and Pakistan. Global Political Review, 4(2), 12–19. https://doi.org/10.31703/gpr.2019(IV-II).02
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Khadeeja Ahmad Hussain (Author)
This work is licensed under a Creative Commons Attribution 4.0 International License.
