Is catching culprits using registered VPNs possible? Expert weighs in

A top IT industry official stated on Thursday that even if an individual was registered for using a Virtual Private Network (VPN), it would be difficult to detect the user's engagement in illegal activity.

"A secure transaction occurs when one gets connected to a VPN, therefore, it is difficult to catch someone using VPN because no one knows what data is passing over it," said Sajjad Mustafa Syed, Pakistan IT Industry Association (P@sha) Chairman insisted, during the Geo News show "Geo Pakistan".

He revealed this while replying to a question on whether it was possible to apprehend someone engaged in terrorist or criminal activities using a VPN, an encrypted internet network, even after getting oneself registered.

The P@sha chairman rued that the restriction could, however, cause a great deal of economic damage to the country’s 2.3 million IT workers.

To another query about whether perpetrators using VPNs could not be caught and what the use of the registration process was, he said the country would only end up creating classes of digital haves and have-nots. "Some people would be able to access the digital world, and the rest will not be able to do that."

The Pakistan Telecommunication Authority (PTA) on November 13 introduced a streamlined process for legitimate users to register their VPNs. The development came days after the regulatory body began blocking unregistered VPNs in Pakistan to "regulate internet security and ensure the safety of users."

Sources within the PTA said unregistered VPNs posed a significant security risk, as they might allow unauthorised access to sensitive data. Furthermore, they could potentially provide access to illegal content.

Explaining VPN registration, the P@SHA chairman said registration for a VPN meant that the PTA would register a static IP of a user or the site the user wanted to access — either end would have to be registered with the PTA for access.

"Here arises the problem, because our (IT) industry cannot do this, as whenever you connect with a VPN, you get a new IP address, and the registration process, as per the PTA, would take about eight hours. Such a lengthy process would delay the work of online freelancers, and companies would then prefer other countries for this job."

"As far as static IP addresses are concerned, you do not have such a large number of addresses that a multitude of internet users could utilise. So, it is next to impossible to implement this policy," he added.

Syed said that even if the policy were implemented, concerns related to national security would still not be addressed because even a terrorist could register for a VPN.

On the other hand, he said, as per a conservative estimate, the restriction would cause a $1 billion annual loss to the country’s IT exports.

Moreover, he said, some large international companies did not want the sharing of IP addresses — whether of the company or the one they were working with — a third party. He added that once they realised this was happening, the contracts would be cancelled.

The VPN restriction could deal an economic blow to 2.3 million IT workers in the country, the P@SHA chairman warned.

Meanwhile, expressing reservations over the decision, the Wireless & Internet Service Providers Association of Pakistan (WISPAP) stressed the need for a balanced policy.

Surprisingly, PTA Chairman Hafeez Ur Rehman admitted before the Senate Standing Committee that the IT industry could not progress without VPNs.