How Pakistan’s VPN ban undermines rights

Over the past year, Pakistan has teetered on the edge of digital oppression, and the proposed ban on ‘unregistered’ VPNs could be the tipping point toward becoming a fully mass-surveilled state.

The ban will not only hinder access to information within the country and restrict the rights to privacy and freedom of expression in digital spaces, but it will also have grave implications for socio-economic rights and create an internet isolated from the rest of the world.

‘Anonymisers’, such as VPNs and Tor Project, hide the identity of a user on the internet. They are essential tools for protecting human rights online, particularly in a context like Pakistan, where censorship, targeting, intimidation, and harassment of political dissidents, human rights defenders, and journalists are rampant. They enable secure access to information and facilitate the sharing of ideas.

VPNs have been a lifeline for users in Pakistan, allowing them to access vital information and continue to earn livelihoods. The manner in which the Pakistan Telecommunications Authority (PTA) is going about VPN registration has been marked by obfuscation and lack of transparency. The PTA has been issuing notices urging users to register their VPNs since 2020. However, when complaints regarding the lack of functionality of VPNs emerged in early November, the PTA called it a glitch only to emerge later with a VPN registration portal and a looming deadline of less than 20 days.

Anonymising tools also help protect political rights. It is becoming an unfortunately common tactic for governments to shut down or block parts of the web around elections, protests or other sensitive events. The national slowdown of the internet allegedly in response to protests by the Pakistan Tehreek-e-Insaf (PTI) and mobile internet shutdown in Islamabad from November 23 to 26 is an example of how the government has sought to limit internet access to suppress counter-narratives.

The Pakistani government’s November 30 deadline for registration of VPNs hinges on two justifications: alleged use of VPNs for ‘terrorism-related’ activities and to access what it calls ‘immoral content’, particularly pornography. However, the authorities have provided no evidence for their claims, nor provided less intrusive alternatives to an outright ban on unregistered, non-commercial VPNs. In fact, VPN usage has surged because of internet censorship encouraging people to use circumvention tools.

It must be underscored that Pakistan does not have any data protection laws, and proposals in the form of the Personal Data Protection Bill do not conform with international human rights standards. Collecting personal information and data from individuals registering VPNs will allow authorities to link VPN usage they see to specific people by correlating information with the registration database.

This VPN ban also comes as larger surveillance infrastructure is undermining the right to privacy. Pakistan has an interception system, which is installed at the telecom operator level and allows the monitoring and eavesdropping of the text messages and calls of users. That said, there is no proper legal oversight of the use of the intercept system. The Islamabad High Court has asked the federal government multiple times to disclose the legal grounds for its use and has not had a response.

The government has also reportedly handed intelligence agencies access to the intercept system. This carte-blanche access to the interception system is deeply concerning from a human rights perspective, as these sophisticated technologies facilitate increased monitoring and targeting of those who are already vilified by authorities in their quest to curb dissent.

Besides, there is reporting that the Pakistani government has been seeking new surveillance systems, such as the national firewall, which telecom companies will be obliged to install, and which could enhance the government’s capacity to monitor and censor internet users at a far greater scale.

While the Pakistani government has claimed they are merely regulating VPNs, in that those who register will be allowed to continue their usage, this obscures the fact that VPN registration is currently only open to ‘commercial’ use, effectively banning VPNs for educational, research or entertainment purposes. This restriction disproportionately impacts non-commercial users seeking to access information. Furthermore, political activity and dissent are also likely to be swept up in the dragnet of regulation.

The use of VPNs is largely misunderstood and has been deliberately reframed as a tool to mask so-called illegal activities, whereas it is an essential tool for accessing information and ensuring the privacy of digital data. The ban will disproportionately impact ordinary internet users, who are already weighed down by draconian cyber-crime laws, wholesale bans on social media platforms, arbitrary internet shutdowns, deliberate slowdown of the entire internet infrastructure, and non-transparent acquisition of surveillance technologies.

Amnesty International has previously called for greater transparency about internet disruptions and acquisition of surveillance technology, and the adoption of an international human rights law approach in its regulation of the internet.

VPNs help guarantee the right to privacy, free expression and access to information – all of which are even more vital in repressive online environments like Pakistan.

Jurre van Bergen is a technologist at Amnesty International’s Security Lab. He has previously secured newsrooms at the OCCRP.

Hajira Maryam works at Amnesty International’s Technology andHuman Rights programme as a media manager and mostly dedicates her time addressing the negative impacts of automation and artificialintelligence (AI).