P@SHA raises concern over NCCIA raids on legitimate IT firms, seeks warrants and joint oversight

ISLAMABAD: The Pakistan Software Houses Association (P@SHA) has raised serious concern over raids by the National Cyber Crime Investigation Agency (NCCIA) on legitimate software and IT companies, urging the agency to draw a clear line between lawful businesses and scam centres. In a statement on Monday, the association said the crackdown on fraud operations was sweeping up genuine firms as well, putting Pakistan’s IT exports and the trust of foreign clients at risk.

P@SHA Chairman Dr Shoaib Ahmed Khan said every dollar the industry earns rests on trust. “A foreign client who hears that his vendor’s office was raided and its servers taken away does not wait for the forensic report,” he said. Member companies have complained that NCCIA teams entered offices without showing a warrant, questioned staff for hours, and seized laptops, servers and mobile phones — even at premises where nothing unlawful was found.

Exports and young talent at stake

Dr Khan said IT is the only industry in Pakistan growing consistently at around 20 per cent a year. Exports reached a record $4.6 billion in FY26, up from $3.8 billion the year before, and the government has set a target of $10 billion by FY29 under the Uraan Pakistan programme. Pakistan produces more than 70,000 computing graduates every year, he noted, and the Ministry of IT, the Pakistan Software Export Board, Ignite, the State Bank and the Higher Education Commission are all working towards the same export targets. Indiscriminate raids, he warned, undo that collective effort and push skilled young people to leave the country. P@SHA also cautioned that foreign clients could shift contracts to competing markets such as India, the Philippines and Eastern Europe rather than wait for investigations to end.

What P@SHA is asking for

The association has asked that raids on registered IT companies be carried out only under court warrants and agreed procedures, that a company’s registration be verified with PSEB and P@SHA through a designated focal person before any action, and that devices be forensically imaged on site instead of being seized, with unrelated equipment returned within seven days. It has also proposed a joint coordination and grievance committee — bringing together the NCCIA, P@SHA, the Ministry of IT and PSEB — to review complaints, share intelligence on fraudulent operators and set the rules for raids on registered firms. P@SHA stressed that it fully supports every lawful, evidence-based operation against scam centres, but said enforcement must follow due process. The NCCIA had not responded to the statement at the time of writing.