Why the PTA’s move to register VPNs should concern us all

Internet users in Pakistan have been reacting strongly to a tweet by the Pakistan Telecommunications Authority, where it was notified that “public and private sector organisations, foreign missions and freelancers, who desire to use VPN for their legitimate purpose, must register their VPN by 31st October 2022” on the PTA website “to avoid disruption”.

A Virtual Private Network (VPN) is an application that reroutes internet traffic to a different Internet Protocol (IP) destination than the original one, thereby encrypting users’ internet traffic. VPNs make it difficult for an internet user to be spied on through surveillance tools, enable access to websites that are blocked in their own jurisdiction, and protect their basic privacy on the internet related to their personal data.

Why VPNs matter

VPNs are highly recommended by internet privacy advocates and digital security experts, especially if one is using public internet networks like airport WiFi. They are also recommended to circumvent insidious surveillance by state actors that often deploy illegal means to snoop on citizens. This includes local as well as foreign governments.

As per the National Security Agency (NSA) leaks by Edward Snowden, the United States spied the most on Iranian citizens using surveillance technology, followed by Pakistani citizens.

The Pakistani state itself has the capacity for surveillance of unencrypted internet traffic, using the Web Monitoring System (WMS) which was purchased for a whopping $18 million form Canadian firm Sandvine in December 2018.

This was bought under the garb of grey traffic reduction and paid for by internet service providers and telecom companies under the Monitoring and Reconciliation Telephony Traffic Regulations, 2010. However, deep packet inspection — which is the technology bought from Sandvine for WMS — is a dual use technology that is also effective in surveillance and censorship of the internet.

There are strong reasons to believe the blocking of YouTube twice in the past month were done through the WMS as Internet Service providers (ISPs) did not receive instructions from the PTA to block the video sharing platform. The WMS, meanwhile, does enable the PTA to block websites and applications at the internet gateway level without the cooperation of ISPs.

The PTA had passed VPN regulations in 2010, however, the text of it is not publicly cited in any of PTA’s press releases issued earlier this month, or in 2020 for that matter. The motivation behind VPN registration also seems to be whitelisting of IPs to curb grey traffic, but what is being ignored is the impact on users’ privacy.

It is also unclear what the PTA means by “to avoid disruption”. Do individual VPN users also have to register? Will any VPN services not registered with the PTA cease to function?

Upon registration of a VPN, the PTA will have access to information regarding the VPN being used, and also enable them to request data regarding the user from the VPN service provider, especially if users are using free services.

Censorship woes

The censorship of websites in Pakistan has also been a major issue of contention. The PTA claims it only blocks websites with “objectionable content” such as pornography and blasphemous content. However, what we have seen over the past few years is that a lot of political content gets blocked by the authority without prior intimation.

The Awami Workers Part (AWP) which is registered with the Election Commission of Pakistan (ECP) had its website blocked by the PTA prior to the 2018 elections without any notice or reason. The AWP had to approach the Islamabad High Court which ordered the PTA to unblock its website.

The website for Slate magazine — a US based current affairs publication — is also blocked and I, as a writer, am unable to access an article that I wrote for Slate on censorship by technology platforms globally. Medical websites have also reportedly been blocked. When I had filed a right to information request in 2013 with the PTA, requesting a list of blocked websites, the authority not only took very long to respond, it ultimately denied the request, citing security reasons.

Such lack of transparency is a threat to our democracy.

Flawed vision

The issue with the PTA’s vision of the internet in Pakistan is that it only views it from a security and business lens, completely ignoring citizens’ basic right to freedom of speech, right to privacy, and right to access to information, which are protected by the Constitution.

Pakistani citizens have their mobile sim cards linked biometrically to their identity, their mobile phone sets are registered with the PTA under their name, their internet connections are registered with the PTA including their IP addresses, VPNs have to be registered, there was an effort to centralise the domain name system (DNS), hundreds of websites are blocked, the Web Monitoring System is used to carry out surveillance of social media users as submitted by the PTA in the Islamabad High Court, and on top of this, blocking of social media applications such as YouTube and TikTok is a constant looming threat.

There is a pressing need for policymakers and legislators as well as the judiciary to understand the functioning of the internet so that efforts to control it in a Big Brother fashion can stop. Pakistanis deserve the right to private communication because vulnerabilities expose them to threats from bad actors and foreign governments other than just our own.

If it must, the state should only carry out surveillance under the law, having followed due process, including obtaining warrants from the court. The current practice of unbridled spying by the state also enables certain elements to use these powers and tools to blackmail opponents and actors unconstitutionally as we have seen throughout history, but even more so in the recent past.

And the first step has to be transparency regarding moves, as well as consultation with stakeholders before such wide-ranging measures are imposed on everyone.

What the PTA needs is a vision of the internet as an open space that Pakistanis can use to connect, communicate, be entertained, and use to progress further. Pakistani freelancers are some of the most active in the world, and the country’s IT exports are constantly rising. Let’s accelerate this rise rather than make efforts to slow it down in the name of security.