Areeba Jibril is a DRF intern focusing on issues related to privacy, free speech, and elections. She tweets at @AreebaJibril

Finding a Virtual Private Network (VPN) provider in Pakistan is easy. A quick google search will pull up multiple free services. Casual internet users may register for these services to circumvent paywalls and access online content that has been blocked in Pakistan. They can do this without even really knowing what they’re signing up for. More sophisticated users may use VPNs to ensure that their IP addresses, and therefore their geographical location and identity, remain hidden from the websites they visit.

What casual users likely don’t know is that the Pakistan Telecommunication Authority (PTA) has announced a registration requirement for all Virtual Private Networks (VPNs) by 30th June 2020. This is twenty-two days after they first posted a public service announcement on their website. The PTA regulations do not ban the use of VPNs entirely, but they do require users to register their VPN use with their Internet Service Providers (ISPs). To do this they must share their CNIC number, the purpose for which they would like to use a VPN, and which IP address they will be using their VPN with. The privacy intrusion is not limited to this information. –The notification is vague, therefore it is difficult to say with authority the extent of the privacy intrusions that may come about. There is online speculation about the extent of information that the government can feely request from non-VPN users and whether the same practices will apply to VPN-users as well.

The Pakistani government claims they’ve added this requirement to support the Information and Communications Technology (ICT) industry and promote the “safety of telecom users.” But requiring registration of VPNs defeats the purpose for which VPNs were created. VPNs cannot be private if they must be registered with ISPs, who are then required to share the information with the government. The information flow doesn’t stop there – the government has contracted with Sandvine Corporation, a US-based company, to monitor ‘grey’ internet traffic.

The 10th June announcement isn’t forthcoming regarding the significance of this announcement, by claiming that this is “not new”. It’s true that users have been reporting that their VPNs had suddenly stopped working since 2011. However, this new announcement includes the threat of legal consequences, without much clarity on what these consequences will be. The drastic consequences to privacy do not need to be new to be concerning. The PTA claims to be using its authority under clause 4(6) of Monitoring and Reconciliation of Telephony Traffic Regulations (MRITT), 2010. 

VPNs can be helpful for the average internet user when they want to access content such as television shows that aren’t otherwise available in Pakistan. But they serve a much more important purpose in promoting freedoms of opinion and expression by protecting the privacy of users. By using a VPN, users can ensure that the websites they visit and the content they post cannot be traced back to them. For many, anonymity is an important part of what makes the internet a safe place.

David Kaye, the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, noted, “Encryption and anonymity provide individuals and groups with a zone of privacy online to hold opinions and exercise freedom of expression without arbitrary and unlawful interference or attacks… A VPN connection, or use of Tor or a proxy server, combined with encryption, may be the only way in which an individual is able to access or share information in [environments with prevalent censorship].”

As the list of registered VPN users will be shared with ISPs, the risk of private information being accessed by those with malicious intent will increase dramatically. Without the ability to hide their physical location, users will be in greater danger if they use the internet to communicate discontent with the government and seek help anonymously. 

Some users may decide they cannot risk this intrusion to their privacy and refuse to register their VPNs. It is unclear how these users will be treated. The government can request that non-registered users have their VPNs blocked. However, they have also said that users who fail to register their VPNs can face legal consequences if they cause “loss to the national exchequer.” They maintain that they are adding this requirement to terminate “illegal traffic.” These vague terms should be a great cause of concern. What is illegal traffic? What will be considered a “loss to the national exchequer”? When will users be held legally accountable for failing to register their VPNs? The lack of guidance increases the risk that these laws will be used to target political dissidents and unpopular speech.

The notification concerning VPNs, coupled with the news from a few months back regarding ‘Deep Packet Inspection’ (DPI) poses a serious threat to online privacy and security for the common Pakistani citizens. DPI allows unprecedented access to a private individual’s activity online. The added issue with the DPI technology is the fact that the government has been incredibly silent on how they plan on using the technology and what the purpose of it is. This silence and general vagueness is somewhat similar to what we’re witnessing nowadays when it comes to this notification regarding VPNs in the country.   

Pakistan is not alone in regulating the use of VPNs. Belarus, China, Iran, Turkey, Iraq, Syria, Oman, Russia, Uganda, the UAE, and Venezuela have either introduced some measures to restrict the use of VPNs or banned the use outright. Iran allows the use of VPNs, but only if providers are Iranian while Russia bans VPN usage for sites that have previously been blocked by Russia’s governing body for telecommunications and mass media communications. Consequences for using VPNs are also wide-ranging. In China, the government has gone so far as to arrest a VPN provider. In Oman, private users face a 500 rial fine ($1300USD). 

Given the human and digital rights track record of these countries, this is not a list of countries that Pakistan should want to be on.  

Sources:

https://www.pta.gov.pk/en/media-center/single-media/public-notice---get-your-vpn-registered-080620

http://tickets.nexlinx.net.pk/index.php?/News/NewsItem/View/45

https://www.dawn.com/news/1512784

https://www.pta.gov.pk/en/media-center/single-media/public-notice---get-your-vpn-registered-080620

The coming Pakistan VPN ban: PTA sets deadline for VPN users to register by June 30th


https://www.pta.gov.pk/media/monitoring_telephony_traffic_reg_070510.pdf.

https://www.amnesty.org/en/latest/news/2017/08/vpns-are-a-vital-defence-against-censorship-but-theyre-under-attack/

Where are VPNs legal and where are they banned?


https://www.bbc.com/news/technology-41160383

This article has been authored by Zainab Durrani who is a Project Manager at DRF

The recent incident of internet shutdown in Balochistan’s provincial capital, Quetta, has been noted by the Digital Rights Foundation with a grave degree of concern.

Two days without the Internet

For over 48 hours, between 30 May and 2 June, 2020 Quetta remained without access to mobile internet services. This occurrence, especially in the middle of the global COVID-19 pandemic that is at its peak in Pakistan at the moment, is an egregious infringement on the residents’ right and access to information, effectively cutting them off from the rest of the world and depriving them of potentially essential and lifesaving information.

Internet shutdowns are a deliberate effort to cut-off particular communities from access to the internet, which includes information, social media platforms and services accessible online. Internet shutdowns come in a myriad of forms: the relevant authority can choose to throttle access to a specific section of the population by cutting off bandwidth; instituting broadband/mobile internet shutdowns, “Internet blackouts”; blanket internet shutdowns, mobile phone call and text message network shutdowns; service-specific (platform) shutdown e.g cutting off access to platforms like Twitter or Facebook.

This particular shutdown purportedly came after escalating tensions between members of the Hazara and Pashtun communities in Quetta. The deaths of three young men from the Pashtun community led to unrest in the city and the eventual blockage of internet services was to purportedly quell this unrest. However, as per sources, the reasons for the shutdown were unknown to the provincial government at the time, who were unsure as to why the Pakistan Telecommunication Authority (PTA) had disbanded services in the city. Additionally, no official public notice was given by the PTA to communicate the shutdown, and its expected duration.

Concerns for residents

Internet shutdowns are an ineffective way of dealing with unrest in a particular locality, in that they are a disproportionate measure and human rights groups over the world have pointed out that they have the potential to engender more panic in the absence of access to information.

The shutdown impacted the work of many throughout the city. As a journalist, Mr. Hafizullah Sherani from Voice of America expressed difficulty in filing reports, having to go through the extraordinary lengths which involved attempting to get connectivity on the roadside, in front of a friend’s office, at 2 AM ironically in order to file his story on the shutdown itself. Saadullah Akhter from Balochistan Express echoed this experience noting that ‘it was an abrupt suspension when the city was in grip of tension following Hazara Town lynching hence we faced immense difficulty in getting accurate information over the incident and sharing it with other colleagues and newsrooms.’

This shutdown impacted the lives of dwellers from all walks of life, who, in the process of getting through an unprecedented pandemic, are relying heavily on connectivity not only to remain in touch with friends and family, but to coordinate efforts to arrange resources such as plasma of recovered patients to help those suffering from COVID-19.

Not only was it a problem as a field reporter, notes journalist Rani Wahidi, but as a citizen who could not communicate with their family through secure channels like Whatsapp, to keep in touch throughout the day or share her location with them for safety purposes. The shutdown increased the difficulty of those stepping outside their homes to work during a global pandemic.

Are shutdowns effective?

Shutdowns are a common tactic used by the state to ensure elusive aims such as “security” and “safety”. This is particularly so in Balochistan which faces frequent internet shutdowns and connectivity issues. For instance, in 2018 parts of Balochistan witnessed three shutdowns over the course of a week, one of which occurred during the Pashtun Long March.

As per Access Now there were at least 213 recorded instances of internet shutdowns the world over during the year 2019 alone in 33 countries. Not only are these shutdowns generating a social cost that impedes human rights, there is an economic cost--and a hefty one at that. 

Researchers Samuel Woodhams and Simon Migliano report that:

"In economic terms, disruptions not only affect the formal economy but also the informal, especially in less well-developed nations. There can also be lasting damage with the loss of investor confidence and faltering development, all of which makes our estimates conservative.”.

"On the human rights side, these shutdowns clearly impact citizens' freedom of expression and the right to information and may even result in an increase in violence."

Internet shutdowns often have a severe impact on freedom of assembly and association as well as mobility. Sadia Baloch, activist and member of the Baloch Students Organization (BSO) said that the shutdown impacted the protest they were organizing for 4 year old Bramsh Baloch who lost her mother to violence and received injuries herself in Turbat, Balochistan.

‘... it specifically affected our protest which was on the next day,our mobilization was affected as very few people got the news and the rest of Balochistan has no internet facility which is a problem itself.’

While time-bound and location-specific internet shutdowns are very common, however there have been long-term shutdowns in the country as well. The former Federally Administered Tribal Areas (FATA) territories of Pakistan have also been facing an internet shutdown for 4 years now. 1460 days, give or take. ‘In early June 2016, at Torkham, the border forces of Pakistan and Afghanistan clashed over the construction of a gate by the Pakistani authorities on the border. This clash led to the suspension of 3G/4G services in bordering towns and tribal areas.’

The suspension of services is legally condoned under s.54 of the PTA Act which covers national security. S.54 (3) in particular reads: Upon proclamation of emergency by the President, the Federal Government may suspend or modify all or any order or licences made or issued under this Act or cause suspension of operation, functions or services of any licensee for such time as it may deem necessary. 

This is despite Islamabad High Court (IHC) ruling that mobile network shutdowns, including mobile based internet suspension were illegal. The judgment, from February of 2018,  indicated that access to telecommunication services is a fundamental right of the citizens of Pakistan, and any attempt to suspend said services is a violation of their constitutional rights. The case is currently pending on appeal.

Digital rights activist Usama Khilji of Bolo Bhi expressed his concerns by noting: 

‘The long standing internet shutdown in ex-FATA is a gross violation of the fundamental rights to information and freedom of expression and increasingly the right to education as guaranteed by the Constitution. Millions of Pakistani citizens cannot be left out of internet access as it impacts their ability to communicate, access information, and access education especially since the pandemic started. The Universal Service Fund set up by the government & contributed to by telecom companies must immediately be utilised to enable internet access in ex-FATA.’

Over the last few years, the situation has taken a turn for the worse in terms of a greater cost paid by those cut off from the internet. Currently, as students hailing from outside metropolitans have had to return home due to the implications of the coronavirus spread and there are more people working from home, blanket and arbitrary shutdowns will have a disproportionate effect, depriving them of access to information, work and an education. 

Being a member of the #KeepitOn campaign, which consists of 158 organizations from 65 countries that are devoted to fighting internet shutdowns, DRF is committed to reporting on and continuing its advocacy for constant and safe access to the internet for all. 

Sources:

https://slate.com/technology/2020/04/pandemic-internet-shutdown-danger.html

https://voicepk.net/quetta-tensions-lead-to-internet-shutdown/

https://www.poynter.org/fact-checking/2019/sri-lanka-blocked-social-media-to-stop-misinformation-about-the-easter-terror-attacks-but-it-didnt-work/

https://www.accessnow.org/pakistan-shuts-down-the-internet-three-times-in-one-week/

https://www.accessnow.org/cms/assets/uploads/2020/02/KeepItOn-2019-report-1.pdf

https://edition.cnn.com/2020/01/09/tech/internet-shutdowns-cost-intl-hnk/index.html

https://thediplomat.com/2020/06/balochistan-erupts-in-protests-over-a-murdered-mother-and-her-injured-4-year-old/

https://thediplomat.com/2019/03/balochistans-great-internet-shutdown/

https://digitalrightsfoundation.pk/islamabad-high-court-ruled-mobile-network-shutdowns-illegal/

DRF established the Cyber Harassment Helpline in December 2016. The services we’ve offered since then include, legal support to online harassment victims as well as digital security assistance and also psychological counseling of victims. 

As Pakistan entered its lockdown in response to the COVID-19 outbreak, we feared there would be an increase in cyber-harassment cases as well as cyber attacks in general. To explore this possibility we analyzed the data from our Cyber Harassment Helpline from the months of March and April 2020 and compared it to the data from January and February 2020, to compare how cases have grown in the lockdown. Given that the pandemic became a public health emergency in Pakistan in March 2020, we feel that the comparison can reflect the changing patterns of online harassment and violation in relation to the social ramifications of COVID-19 This analysis is being released in the form of a policy brief and includes a list of recommendations for concerned stakeholders. 

As compared to January and February, March and April saw an increase of 189% in complaints registered with our Cyber Harassment Helpline. 74% of the cases in March and April were reported by women, 19% by men, and 5% by gender non-binary persons. When the lockdown was enforced in March, for the safety of our employees, we had to close our office as well as shut down our Helpline’s toll-free number. This massive bump in recorded complaints came through email and our social media. 

We have found that “the forms of gendered violence that are largely directed at women in the digital sphere usually include sexual harassment, surveillance, unauthorized use and dissemination of personal data, and manipulation of personal information including images and videos. This form of violence acts as a significant barrier to women’s expression of themselves as well as meaningful engagement with the internet. A majority of the cases that the Digital Rights Foundation’s cyber harassment helpline received digitally during lockdown (April and May) pertained to blackmailing through non-consensual sharing of information, intimate pictures and videos.” 

Alongside this data, we are also releasing a list of 14 recommendations for relevant stakeholders. These cover issues of the FIA’s accessibility especially during the pandemic, and also how technology needs to be used hand in hand while dealing with harassment cases, like allowing for video testimonies etc. 

During the pandemic, the cyber harassment helpline has been working hard to provide uninterrupted services to complainants of online harassment, while ensuring the safety and well-being of our staff. Early in the lockdown period, we switched exclusively to online platforms, however, we have restored the toll-free number through cooperation from the Pakistan Telecommunications Authority and PTCL.

Our full policy brief is attached to this email. For more information on this policy brief and on the work of our Cyber Harassment team, you can get in touch with them using this email: 

[email protected]