KARACHI: Internet users in Pakistan will be unable to browse the web using encryption software after June 30, unless they register Virtual Private Networks (VPNs) with the telecom authorities.

In a press release dated June 10 and newspaper advertisements, the Pakistan Telecommunication Authority (PTA) has invited customers using VPNs to browse the internet to register with their service providers.

VPNs allow internet users to connect to the web undetected, meaning that they can access banned websites and send emails without fear of government interception.

However, many businesses, including banks, use encrypted connections to communicate with their branches and customers, to protect sensitive data such as account numbers and passwords.

According to the PTA, the exercise is being undertaken “to promote legal ICT services/business in Pakistan and safety of telecom users”.

Action may be taken against customers using VPNs without permission

“As per applicable rules and regulations, appropriate registration is required from PTA for any mode of communication in which communication becomes hidden or encrypted,” the PTA said.

The authority added that the advertisement is issued by the PTA in the light of clause 6 of Monitoring and Reconciliation of Telephony Traffic Regulations (MRITT), 2010.

The regulation under MRITT mandates the monitoring and blocking of any traffic (encrypted or not), including voice and data, originating or terminating in Pakistan. This includes all encrypted VoIP services.

The PTA maintained that as per telecom rules and regulations, it was only taking action against those using VoIP and VPNs for terminating illegal traffic, causing loss to the exchequer.

Legitimate users can register their VPNs through their service providers by filling two forms, including undertaking and provision of basic documentation, without any charges, the PTA told Dawn.

A registration form shared with Dawn by an internet service provider shows that users will be required to disclose their static IP addresses as well as details of the VPN software they use, the purpose, and business details.

The deadline for VPN registration has been set as June 30.

This is not the first public call by the PTA warning users against a VPN ban.

The PTA said all service providers are well aware of the process and registering their customers using VPNs since 2010. It said the authority was also in touch with its licensees to ensure that VPNs in their network were registered for usage.

‘Action against illegal traffic’

The authority has warned that action will be taken only against unauthorised VPNs for terminating illegal traffic, “which causes loss to the national exchequer”.

According to PTA’s definition, the use of illegal gateway exchanges to bypass the legal gateways and terminate/originate international traffic, through VoIP gateways, GSM gateways, WLL phones, mobile SIMs or other related equipment so as to avoid applicable taxes and/or regulatory fee, is termed as grey trafficking.

To monitor and curbing “grey traffic” — which inclu­des Voice over Internet Protocol and Virtual Private Networks — the PTA has deployed a sophisticated web monitoring system.

The equipment, which is worth $18.5m, is provided by Canada-based company Sandvine. The web monitoring system will use Deep Packet Inspection (DPI) to monitor communications, measure and record traffic on behalf of the PTA.

“This system will facilitate in the identification and eradication of grey traffic causing huge loss to the national exchequer, and internet content management as mandated under Clause 37 of Prevention of Electronic Crimes Act, 2016,” the authority said in a press release in October last year.

“The PTA can block VPN traffic by analysing the country’s traffic, flagging traffic that looks potentially VPN-like, and then breaking that connection,” said Amin Shah Gilani, former interim chief technology officer of Patari.

Sandvine, according to Mr Gilani, uses a mix of techniques to identify the type of traffic flowing through the system. This includes looking for patterns in the individual chunks of data as they pass through the system, observing the behaviour of a citizen’s traffic and matching it with previously known types of behaviours to understand what they’re doing.

It also involves machine learning models, where a computer has been trained to identify traffic types based on past data.

This way, the authorities can ­monitor and detect IPs using VPN-like traffic without registration, leading to a potential ban on the VPN application being used from access across the country.

Several users have reported throttling of VPN services in Pakistan recently, including inability to access Tor Browser — a software that allows users to browse the Web anonymously.

However, the PTA said Tor was not blocked by the PTA and the authority would begin banning services after the June 30 deadline.

While the PTA maintains the decision to register VPNs is meant to curb grey traffic, digital rights groups say the move is a direct threat to internet freedom in the country.

“A person uses VPNs primarily for two reasons: one to access blocked content on the internet, and second to ensure privacy and anonymity on local servers. The VPN registration will essentially make the purpose of having one redundant,” said Hija Kamran of the Media Matters for Democracy.

“It seems the intent is to control and regulate internet traffic through constantly proposed laws that directly influence right to privacy and various other civil liberties online,” she told Dawn.

Published in Dawn, June 16th, 2020