PTA asks corporations to register VPNs or have their IPs blacklisted

ISLAMABAD: Pakistan Telecommunication Authority (PTA) has started the registration of Virtual Private Networks (VPNs), warning that IP addresses with unregistered VPNs would be blacklisted.

In its statement to Profit, PTA maintained, “The exercise is being undertaken to promote legal ICT services/businesses in Pakistan and to ensure the safety of telecom users.” 

There have been media reports that several corporate connections are already being terminated as part of PTA’s VPN policy. The rationale given by the authority on the matter is that “this is done to block grey traffic and illegal Voice over IP (VoIP) companies working as call centres and other data entry operations”.

“A number of companies in Pakistan are running call centres through VPNs, thus pretending to be working in the US or other countries. It all falls under the grey traffic category, however, the IP addresses are currently being blocked for corporate clients of different Internet Service Providers (ISPs),” PTA said.

The ISPs have been notified of the development, with the PTA directing them to convey the message to all corporate clients using unregistered VPNs. The deadline for the registration is 30th June 2020 and those failing to comply with the directives will have to face legal action if they are using VPNs for any illegal activities.

As per the PTA, use of any mode of communication such as VPN by means of which communication becomes hidden or encrypted is a violation of the authority’s regulations. 

When questioned on the digital rights angle and the practicality of this system to detect and block unregistered IP addresses, PTA spokesman Khurran Mehran said, “The process for VPN registration is not new and has been in vogue since 2010. Authorized users can register their VPNs with PTA through a smart and swift process initiated through their service provider.”

The authority also made an official statement through its Twitter page saying, “Action will be taken only against unauthorized VPNs for terminating illegal traffic which causes loss to the national exchequer. PTA remains committed to serving as per its vision in ensuring that high quality ICT services are available to telecom users in Pakistan.”

PTA did not give any response to the question regarding whether this policy will be extended for individual smartphone users as well or not.

Currently, individual users may use VPNs legally but only as long as they are registered. However, registering a VPN with the government poses a legitimate threat of leaking your browsing activity to the government.

Sources familiar with the VPN technicalities told Profit that to ensure data protection, a VPN requires high-end security features (such as 256-bit encryption), a strict no-logs policy, and an automatic kill switch. A quality VPN ensures anonymous online activity, an IP masking prevents authorities from finding a user’s location, while encryption adds a further layer of security by making it impossible for the government to see browsing activity and personal information of the internet user.

The debate on the moralistic and freedom of privacy around internet usage in Pakistan is a tricky one. At the moment, on a state level, we do not have a comprehensive set of rules and regulations governing the right to privacy vs. government’s right to ensure security and preventing grey traffic. The Digital Rights Bill that was drafted in 2018 and then amended in 2020 is still up for public debate and is yet to be formalized into law.

Strictly speaking on VPNs, however, even though the Pakistani government has a history of briefly but repeatedly blocking users from accessing a number of popular sites, including YouTube and Quora, and it also heavily filters content which restricts the usage as well, in matters of public usage VPNs are still legal in Pakistan.