June 8, 2020 – The Pakistan Telecommunication Authority (PTA) advertised a public notice calling for all “users” to register their Virtual Private Networks (VPNs) with the Authority by June 30, 2020.
The notice, published in newspapers and on PTA’s website, on June 7, mentions that use of any means of communication that is encrypted is “a violation of PTA regulations.” However, it does not mention the specifics of the referred regulations, leaving confusion among rights advocates and general internet users.
It further directs that users that are using the VPNs for legitimate purposes must register this through their internet service providers by the aforementioned date. The notice also states that as per law, there can be legal proceedings against anyone “involved in illegal use of unregistered VPNs.”
The announcement comes as part of the government’s ongoing crackdown on grey traffic through the Web Monitoring System (WMS).
The directive, as per the recently published notice, would allow users to ‘whitelist’ their VPNs to access ‘legitimate’ internet traffic. It’s imperative to state that many businesses use VPNs to build internal communication infrastructures, and they also help internet users in accessing public and unsecure internet connections without the risk of giving away sensitive information to anyone snooping on the traffic.
However, Asad Baig, co-founder and Director of Media Matters for Democracy, says that the notice does not give a lot of details on the specifics that should have been mentioned in it. He says, “While we understand that there are regulations that restrict the use of tools concealing communications, and the fact that Pakistani telecom sector is losing revenue to grey traffic, it is unclear which regulations the notice refers to.” He further adds that the notice leaves a lot of specifics to interpretations. “WhatsApp is an encrypted service, millions of websites that we access function on HTTPS security certificate that rules unauthorised interception to a degree. A blanket regulation that puts legal liabilities on individuals without outlining essential details will put the usage of the Internet at risk. It’s important that to maintain transparency and to ensure a clear process, the PTA clarifies these details to rule out confusion.”
The regulation under the Monitoring and Reconciliation of International Telephone Traffic Regulations 2010 (MRITT) outlines the monitoring and blocking of any traffic (encrypted or not), including voice and data, originating or terminating in Pakistan. This traffic includes the Voice or IP services, however, a March 2020 report mentions that PTA has ruled out the need for registration of VPNs and VoIPs for educational institutions and businesses in order to offer them relief during the COVID-19 lockdown in the country.
