Pakistan Requires People to Register Their VPN Use

Pakistan has been increasing the regulatory powers of the Pakistan Telecommunication Authority (PTA) by leaps and bounds in recent years. One of the PTA’s more recent rulings requires that citizens (and presumably visitors) in the country register their VPN use.

This ruling was first enacted in 2020, but has gone mostly ignored by businesses and individuals who continue to use VPNs for both work and personal purposes. Over the last two years, the PTA has made various announcements urging people to register their VPNs or face “disruption” of their services. It didn’t look like the authority was going to seriously enforce these ambiguous consequences, until now.

The PTA recently announced businesses in the public and private sectors as well as individuals, including freelancers, have to register their VPNs by October 31, 2022. While it hasn’t elaborated on what would happen to those who miss the deadline, telecommunications experts and digital rights activists have said an unregistered VPN ban could happen.

Pakistan: Register Your VPN or Face a Cut-Off

The Pakistani government has tried to ban VPN use since 2011, with little success. Yet recent changes to its internet laws has given the PTA more regulatory oversight and control over online access. Since ordering ISPs to prevent access to VPNs hasn’t worked, the PTA has now decided to require that people and businesses register their VPN use with the authority. 

This has raised concern among digital activist groups, and many have criticized the move as it was pushed through without consulting relevant stakeholders or allowing public comment. Despite being a potentially massive invasion of privacy, the PTA maintains it’s only to stop illegal Voice over IP (VoIP) traffic.

VoIP technology makes it possible to phone people over the internet using a landline or mobile number without the need for a landline or cell service. Companies use VoIP to make telemarketing calls, which is why the call often looks like it comes from a landline, but if you call back, the number doesn’t exist. VoIP traffic also includes calls made over services like WhatsApp and video calls on platforms like Zoom.

That said, the PTA’s excuse to monitor VPN traffic isn’t in line with its other messaging or its broader censorship actions, which makes it just that — an excuse. According to a recent public announcement, “Usage of any mode of communication by means of which communication becomes hidden or encrypted is a violation of PTA regulations.”

“PTA is only taking action against those using VoIP and VPNs for illegal traffic,” a PTA official also added. This led to the authority creating the “whitelist,” which is a list of legal channels that traffic may be routed through. This allows the PTA to control the traffic running through their channels, and charge for it. 

Apparently, people and businesses have been making international calls to local numbers using “shortcuts that circumvent telecom checkpoints” for years. This cheated the PTA out of “billions of rupees” as they applied expensive levies to VoIP traffic, but couldn’t charge people for the traffic they couldn’t track.

Pakistan’s New Censorship Laws

Even though the PTA has threatened to ban VPNs before without following through, it’s possible the authority will implement a VPN ban after this latest deadline. Recent increases in its regulatory power has given it the freedom to restrict Pakistani citizens’ access to online streaming services, dating apps, and even social media platforms like TikTok.

According to the PTA, these restrictions are meant to protect telecom users, however citizens don’t agree. The consensus seems to be that the PTA is trying to control people instead of focusing on telecom-related activities and improving infrastructure security. On top of that, the PTA’s wide-reaching powers of censorship will only be compounded if people start giving up their privacy by registering their VPNs with the government.

VPNs provide a significant barrier of protection for activists, journalists, freelancers, and people who don’t want to live under oppressive regimes. Pakistan’s government officials don’t seem to abide by their own rules, either. In 2021, shortly after the PTA banned TikTok in Pakistan, the former Prime Minister Imran Khan tweeted a TikTok video, and the only way for him to access TikTok was through a VPN. 

Yet if people register their encrypted traffic with the government, it’s entirely possible their traffic will be monitored and that they will be fined (or worse) for also illegally accessing TikTok with a VPN.

VPNs Protect People’s Right to Privacy

VPNs form a line of defense against a host of digital threats, including cyber attacks over Wi-Fi, Man-in-the Middle attacks, honeypots, DDoS, and digital snooping. All of that is important, but so are VPNs’ secondary function — preventing governments and ISPs from seeing your internet traffic.

That protection spills over into real life too. If the government can’t snoop on you, it can’t prevent you from exercising your right to freedom of speech and information. It also can’t prevent journalists and activists from doing important work to place a system of checks and balances on government activities.

If citizens have to register their VPN use, it’s entirely possible the Pakistani government will closely monitor their traffic and real life activities, or even try to prevent them from using said VPN. Not all VPNs adequately protect their customers either. 

Many, especially free VPNs, have subpar security and frequently suffer massive data breaches. . Some also don’t have the resources to prevent snooping entirely, as  DNS leaks and  WebRTC leaks are difficult to prevent. 

CyberGhost VPN has a strict No Logs policy and we’re located in Romania, which has privacy-friendly laws that don’t require we retain any user data. That means, even if the government requires us to hand over user data, we don’t have anything to give. On top of that, we use impenetrable 256-bit AES encryption, and provide a Kill Switch and DNS leak protection.

Secure Your Data Against Snooping