☰
PTA unveils new regime to ‘localise’ VPN services
• Introduces licensing regime for local companies to provide proxy services
• P@SHA says permits may solve issue of unregistered VPNs
• New firms would be bound to allow authorities to access, surveil users’ data
ISLAMABAD: The Pakistan Telecommunication Authority (PTA) has devised a new strategy to ‘register’ Virtual Private Networks (VPNs) after its previous efforts to ensure compliance failed to yield the desired results.
The regulator has decided to introduce a new licensing category under which companies can apply for permits to provide VPN services.
The move would eventually address the problem of what officials call unregistered VPNs, as all but those proxies provided by licensed companies would be deemed unregistered and blocked.
With licensed service providers, authorities would be able to monitor the VPN traffic, as anonymity provided by proxy networks has been one of the biggest gripes of the authorities.
In a recent press release, the PTA said it has resumed granting Class Licence for Data services to service providers in Pakistan.
“VPN service providers are required to obtain Class Licence for Data (Data Services) to provide VPN and related services,” the press release stated.
The telecom regulator already issues licences to companies providing internet and cellular services and trackers to be fitted in vehicles.
Now, the PTA has added a new category of VPNs under licensed services.
The plan envisages that local companies — bound by Pakistan’s laws, terms of their licences, and regulatory provisions — will provide proxy services to users.
This will enable the regulator to exert more control on these companies, as opposed to the status quo, where most VPN providers are foreign companies.
Need for new regime
The idea of localised VPN service providers was floated by the Pakistan Software Houses Association (P@SHA), a representative body of companies providing IT and IT-enabled services.
“We have told the PTA and the IT ministry that to facilitate around 2.5 million freelancers in the country, the majority of them were females who were just supplementing the family income through meagre IT export projects, we needed an international model,” said P@SHA chairman Sajjad Syed.
He added that the VPN service providers would pay a licence fee to PTA.
These licensees would sell their VPNs to clients, just like cellular companies and ISPs sell their services, Mr Sajjad added.
If a user is not satisfied with the services of one VPN provider, they can switch to someone else.
“Besides, the government can monitor the content of the local VPN user, and this way, the security concerns related to VPNs can also be addressed,” said Mr Sajjad.
The companies will have to pay Rs300,000 as licence fees to provide VPN services nationwide and Rs100,000 for services in a province.
These licences would be valid for 15 years and, upon expiry, could be extended for another term of the same duration.
Surveillance
According to documents available on PTA’s website, the terms of licences applicable to the existing service providers would also apply to any company providing VPN services.
One of the provisions states that the company would “[p]romptly provide all information, as and when desired by the Authority [PTA], which helps it to quantify proliferation of the technologies or services whether technical, regulatory or financial in nature;”
The terms also bind the licensee to comply with the Pakistan Telecommunication (Re-organization) Act 1996 and other rules, and any violation could result in action as per the law.
Another provision stated that on grounds of national security, “…the licensee and/ or the service provider will have to provide “Lawful Interception” (LI) equipment to the nationally authorized security organizations, at the licensee’s own expense”.
It is important to note that a similar surveillance system has already been installed by telecom companies since they are also PTA licensees, Dawn reported earlier this year.
The details of this system were revealed during the proceedings of a case in the Islamabad High Court.
The court was informed that the data of any telecom consumer could be surveilled and retrieved, voice calls heard and reheard and SMSes read. Provisions in their licences bind these companies to ensure that up to 2pc of their entire consumer base can be surveilled through Lawful Intercept Management System (LIMS).
These licence provisions, if applied to VPN providers, would negate the purpose of proxy networks — anonymity.
Technical experts have argued that this new scheme is a “futile exercise” as it grants excessive oversight powers to authorities.
Wireless & Internet Service Providers Association of Pakistan Chairman Shahzad Arshad said it has already been announced that authorities can monitor the activities of local VPNs. “So, why would any international commercial entity like a foreign bank use the services of a local company?”
He added the use of VPNs could not be stopped, and if some proxies were blocked, people would switch to others since multiple options were already available to the public.
Published in Dawn, December 24th, 2024
Read Comments