And then they came for VPNs

ON Nov 28, 2024, Punjab Chief Minister Maryam Nawaz posted a video on X — via a VPN, of course, since X has been officially banned by the government — announcing Pakistan’s first IT city.

One wonders what an IT city can possibly offer a country that lacks basic connectivity and regular access to platforms and content on them. Digital infrastructure is not about constructing buildings or laying down roads, but ensuring stable connectivity and everything that sustains it.

Since the beginning of 2024, internet users in Pakistan have experienced slow internet speeds purportedly due to damage to the undersea cables. Then came the ban on X, announcements of an upgrade to the web-management system, installation of a national firewall, disruptions in WhatsApp media functions, and the blocking of VPNs.

Typically, VPNs are used as a privacy measure. But in Pakistan, VPNs are mainly used to circumvent arbitrary government bans such as the one on X. WhatsApp has become a medium of day-to-day communication for businesses and individuals. WhatsApp media disruptions — the inability to send and receive audio notes, images, videos and stickers over mobile data — have led many to turn to VPNs.

Lately, many users have reported their inability to access specific content on platforms, such as videos on YouTube channels. For instance, comments under videos by court reporters who provided extensive coverage on the 26th Amendment reveal how their videos do not load on mobile data without a VPN. And now VPNs are being blocked.

What was initially attributed to a technical glitch, was soon followed by an announcement by the Pakistan Telecommunication Authority (PTA) to register all VPNs, accompanied by the usual narrative of terrorist activity and access to ‘immoral’ content, including a fatwa by the Council of Islamic Ideology — later withdrawn — about VPNs being ‘un-Islamic’.

But the PTA’s registration process — the deadline for which has been extended — is not for everyone. Their registration form provides two options: company and individual — the latter for freelancers only. In order to register, first an account has to be set up, which requires the following details: company name, nature of business, phone number, address, name of contact person, their email, mobile number and CNIC, as well as the email of the CEO or head of the company.

Once the account is set up, the VPN registration form becomes accessible. That form asks for the following information: service provider, customer ID, phone number, purpose of use, type of VPN, planned date for establishing communication link, IP address and static IP address.

A VPN ban allows for increased surveillance online and diminishes privacy.

Apart from the privacy and traceability issues it creates, here’s the other problem. The registration requires a static IP, which is an IP that stays the same and does not change, unlike dynamic IPs which are more commonly used. There are only so many static IPs. There is an availability issue as well as a higher cost attached to it. Some people who approached their ISPs for IP verification were told only connections on company names could be verified for VPNs.

So what happens to freelancers? Or those who work with various companies on a short-term basis who will not furnish them with the required documentation that the registration process requires? Or clients who refuse such data disclosure requirements due to privacy concerns?

Given the connectivity issues in Pakistan, people also tend to use multiple ISPs, or switch between broadband and mobile data, and between official and personal VPNs depending on where they are working from and what is working at any given point. Besides, VPNs are used across sectors, and not just in the corporate world. What of them?

The fact is that VPNs have become an integral part of daily life across sectors for personal and professional use for individuals and various organisations due to the arbitrary denial of access and blocking of content by the government. Students, journalists, researchers, and small-scale home-run businesses, who work solo or in fluid structures and from different locations and may not have the ability to meet verification requirements or even qualify, all rely on them.

Also, in a surveillance state where there is no data protection law, where the cybercrime and anti-terrorism laws (among others) are arbitrarily used to construct mala fide cases, coercive powers are abused to persecute dissidents and arbitrarily restrict access to platforms, and where there exists no accountability of the regulator, the executive and LEAs, and whims prevail over rule of law, more privacy should be the order of the day, not less.

Should it be permissible for the authorities to know every time you leave your house, where you go, at what time and who you communicate with? Should it be permissible to have a permanent tracker on you, in real-time, all the time? A VPN ban allows for increased surveillance online and diminishes privacy.

In today’s Pakistan, when we will have access to the internet, to what degree, what will be accessible and what won’t, lies in the hands of the executive and the regulator, without any guardrails or recourse. They transgress, and arbitrarily suspend services or restrict access. The courts provide no remedy either. This, unfortunately, has become the new normal.

The online world in Pakistan mirrors the offline reality — just like cities are shut down and areas cordoned off, at any given time networks are suspended indefinitely; and access to platforms and content on the internet is restricted much like containers are placed to prevent entry. No timeline is specified as to how long the disruption will last, because for that there will need to be acknowledgment and shouldering of responsibility for the act itself.

Meanwhile, government officials continue to use a platform that is banned on account of national security and terrorist activity. The nation would love to know which VPNs they are using, which don’t get blocked. Have these been registered? Does the use of VPNs by government officials to access and post on a banned platform such as X qualify as ‘legitimate’ use?

The writer is a co-founder of Bolo Bhi, an advocacy forum for digital rights.

Published in Dawn, December 2nd, 2024