Pakistan's cybercrime and criminal-procedure framework is again in the public spotlight after Pakistan wicketkeeper-batter Mohammad Rizwan appeared before the National Cyber Crime Investigation Agency (NCCIA) in Lahore in connection with an inquiry concerning alleged online betting, gambling and possible leakage of dressing-room information. According to reporting published on 3 October 2026, Rizwan appeared before NCCIA officials for several hours after receiving a notice under Section 160 of the Code of Criminal Procedure, 1898. Earlier reports also stated that investigators were conducting forensic examination of mobile devices linked to the inquiry.
This article does not assume that any allegation is established. An inquiry, summons or forensic examination is not the same as a finding of guilt. The purpose here is to explain the legal process: what a Section 160 CrPC notice means, how digital devices may become evidence, what due-process questions arise, and why chain of custody and forensic integrity matter.
What happened in the reported NCCIA inquiry?
Media reports state that Rizwan appeared before the NCCIA on 3 October 2026 in Lahore, where he was questioned in relation to allegations involving online betting, gambling and possible disclosure of team information. Dawn reported that the cricketer had been served a notice under Section 160 CrPC and that his mobile phone had earlier been taken for forensic examination. Separate reporting by Geo News over recent weeks described an ongoing examination of mobile-phone data and requests by Rizwan for written clarification about the inquiry and return of his device.
These reports describe an investigation in progress. At this stage, the legally important distinction is between allegation, investigation, evidence and proof. Pakistani criminal procedure requires investigators to gather admissible evidence through lawful means before any criminal liability can be established by a competent court.
What is a notice under Section 160 CrPC?
Section 160 of the Code of Criminal Procedure, 1898 concerns the attendance of persons who may be acquainted with the facts and circumstances of a case. In practical terms, an investigating officer may require such a person to attend for questioning, subject to the limits and safeguards imposed by law.
Receiving a Section 160 notice does not itself mean that the recipient has been convicted, charged or even necessarily treated as an accused. The legal character of the person's involvement depends on the facts, the investigation record and any subsequent proceedings.
Can investigators examine a mobile phone?
Modern investigations frequently rely on smartphones because they may contain messages, call records, photographs, application data, location information, browser history, financial records and other potentially relevant material. But extracting data from a device raises several legal and evidentiary questions.
Investigators must be able to show that the device and the extracted data are connected to the matter under inquiry, that the evidence was preserved without improper alteration, and that the forensic process can be explained and verified. If digital material is later relied upon in court, authenticity, relevance, integrity and chain of custody can become central issues.
Why chain of custody matters in digital evidence
Unlike a physical document, digital information can be copied, altered or corrupted without obvious visible signs. That is why sound forensic practice normally requires documentation of when the device was received, who handled it, what tools were used, whether a forensic image was created, how hashes or other integrity checks were recorded, and how the original device was preserved.
Where the prosecution relies on extracted messages or files, the defence may examine whether the data is complete, whether timestamps are reliable, whether the extraction method was scientifically sound and whether there was any unexplained break in custody.
Does a person have privacy and due-process rights during a cybercrime inquiry?
Yes. Investigative powers do not operate in a legal vacuum. Pakistan's constitutional framework protects dignity and privacy interests, while criminal-procedure and evidence rules govern how investigative material may be obtained and used. The precise scope of protection depends on the circumstances, the authority being exercised and the legal basis for the search, seizure or examination.
Where a device contains large amounts of personal and professional information unrelated to the inquiry, questions of necessity, proportionality and relevance may arise. The fact that investigators possess a device does not automatically make every piece of information on it relevant or admissible.
What about passwords, unlocking and forensic access?
Requests to unlock a device or facilitate forensic access may raise complex issues involving cooperation with investigators, privilege, self-incrimination, privacy and evidentiary admissibility. The correct response depends on the legal status of the person, the wording of the notice or order, the statutory authority invoked and the nature of the investigation.
Anyone facing such a request should obtain legal advice before refusing, consenting or handing over sensitive information, particularly where the device contains confidential business communications, privileged legal material or third-party personal data.
Can an investigation agency retain a phone indefinitely?
Retention of a device should remain connected to a lawful investigative purpose. If forensic imaging has been completed, questions may arise about whether continued physical retention remains necessary. A person seeking return of a device may request written reasons, identify the legal basis for continued possession and pursue appropriate remedies before the relevant authority or court where justified.
What should a person do after receiving an NCCIA or Section 160 notice?
A recipient should first verify the authenticity of the notice and carefully review the date, time, place, statutory provision and investigating authority identified in it. The person should preserve relevant records, avoid deleting or altering potentially relevant information, and consult counsel about the scope of questioning and any request involving electronic devices.
It is also sensible to keep copies of notices, acknowledgments, seizure or handover records and written correspondence with the agency. Where a phone or other device is handed over, the owner should seek a proper receipt or documented record identifying the device.
Why the Rizwan matter is legally important beyond cricket
The public interest in this inquiry goes beyond a sports personality. It illustrates how traditional criminal procedure now intersects with cybercrime enforcement, digital forensics and data privacy. Similar issues can arise for company directors, employees, journalists, professionals, online sellers and ordinary citizens whenever investigators seek access to smartphones or digital accounts.
As digital evidence becomes more common in Pakistan, procedural safeguards and forensic discipline will increasingly affect whether electronic material can withstand legal scrutiny.
Key legal takeaway
A Section 160 CrPC notice is an investigative step, not a declaration of guilt. Likewise, the seizure or forensic examination of a mobile phone does not by itself prove an allegation. Investigators must establish a lawful evidentiary chain, while affected persons retain the right to seek legal advice and challenge unlawful or disproportionate investigative action through available legal remedies.
Sources and current reporting
This explainer is based on publicly reported developments, including Dawn's report dated 3 October 2026 regarding Rizwan's appearance before NCCIA and Geo News reports concerning earlier notices, requests for inquiry details and mobile-phone forensic examination. Because the investigation is ongoing, subsequent official findings may alter the factual position.
Legal note: This article provides general legal information and does not constitute legal advice. Anyone directly affected by an NCCIA notice, cybercrime investigation, device seizure or digital-evidence dispute should obtain advice based on the specific facts and documents of their case.
Tags
This article provides general legal information and is not a substitute for advice on your specific matter. Speak with an advocate before acting on anything you read here.