ISLAMABAD: A parliamentary body on Thursday expressed its concern over the access to data being given to a US firm linked with global cyber surveillance.

The Senate Standing Commi­ttee on Cabinet Secretariat was probing the matter of the Pak­istan Telecommunication Auth­o­rity (PTA) signing an agreement with the US-based Sand­vine Corporation, to monitor, analyse, and curb grey traffic.

The issue was referred to the standing committee when Senator Mushtaq Ahmed during the previous Senate session asked a question about the PTA signing an agreement for monitoring internet traffic with a company working as a partner with Israeli intelligence.

During the meeting, members wondered if under the arrangement, Sandvine — allegedly linked with Israeli intelligence agencies — would have easy access to all digital information, including WhatsApp.

Senator Ahmed told the committee that the company was involved in intelligence gathering for the US government in Turkey and spied on Turkish nationals living in the US.

Pakistan Peoples Party Senator Robina Khalid said that the new system would compromise digital security in Pakistan.

“Background checks of Sandvine Corporation will reveal that it has a sister company NSO, known for global cyber surveillance,” Ms Khalid said.

Committee chairman Senator Talha Mahmod shared a news story published by the BBC saying that Sandvine’s sister company NSO — a cyber-technology company — had stolen data of 1.5 billion users only last week.

“The surveillance software involved was developed by Israeli firm NSO Group. Hackers were able to remotely install surveillance software on phones and other devices through WhatsApp,” the report stated.

The chairman informed members that the company Fransisco Partners, which owned Sandvine, also owned NSO. “They are after Pakistan. They are keeping an eye on Pakistan’s move,” he said.

In his response, PTA chairman retired Maj Gen Amir Azeem Bajwa said that his office had not signed any contract in violation of the PPRA rules. He explained that both mobile and Long Distance and International (LDI) operators were bound to deploy a monitoring system to check grey traffic.

The government was deprived of a huge sum in taxes that were continuously lost to grey traffic, he said, adding that the PTA had asked cellular operators to form a joint consortium to fund the system to check grey traffic as well as objectionable content online.

The PTA chairman addressed the ‘misperception’ that the company installing the equipment for the purpose was an Israeli company. He clarified that Fransisco Partners was an equity company that had invested in some 200 technology companies and not just Sandvine and NSO.

“Sandvine and NSO are not connected. Nonetheless, we have taken an undertaking that the technology being provided does not have security flaws. Secondly, we involved the Inter-Services Intelligence (ISI) for a security audit after which the system will become functional. The ISI was involved at time of proof of concept of the system. The system will not become functional if security objections arise,” he maintained.

He also clarified concerns that data would reside in the equipment that would be installed in Pakistan.

“If security vulnerability is identified at any stage, the project will be cancelled and the company will be held accountable. We ensure security for all such projects,” he said. The senior official also said that operators were already using equipment provided by Sandvine. Sandvine won the project through open bidding.

However, the committee directed PTA to run thorough background checks on the company and report back in the next session.

Telecos making payments abroad

The committee said that cellular mobile operators were spiriting foreign exchange out of Pakistan under various headings such as royalty payments, technical fees and on imports of technological equipment.

“If these cellular companies are showing continuous losses or making bare minimum profits then we would like inland revenue to investigate how they are parking money outside Pakistan,” said the committee chairman.

In response, officials from inland revenue office of the Federal Board of Revenue (FBR) told the committee that telecos were paying some form of royalties, as well as making payments abroad as technical fees.

A senior official from the inland revenue department explained that while cellular operators had paid Rs7 billion in taxes, as much as Rs75bn was outstanding with these companies against which they had obtained stay orders from courts.

“An additional some of Rs50 billion have been recovered after some stay orders were vacated,” the official informed the committee.

The chairman gave the inland revenue department a month to brief the committee with more details.

Published in Dawn, May 24th, 2019