Pakistan Telecommunication Authority to require registration of VPNs by 2020-06-30

[wkrp]

The Pakistan Telecommunication Authority issued a press release on 2020-06-10, stating that Internet users must register any VPNs with their ISP by 2020-06-30.

https://pta.gov.pk/ur/media-center/single-media/-100620 (archive)

30جون 2020تک وی پی این کی رجسٹریشن

(اسلام آباد: 10 جون، 2020):پاکستان ٹیلی کمیونیکیشن اتھارٹی (پی ٹی اے) کی جانب سے ورچوئل پرائیوٹ نیٹ ورکس (وی پی این) کی رجسٹریشن کا سلسلہ جا ری ہے۔ یہ اقدام پاکستان میں قانونی آئی سی ٹی سروسز / کاروبار کے فروغ اور ٹیلی کام صارفین کے تحفظ کے پیش نظر اٹھایا جا رہا ہے۔

قابل اطلاق قواعد و ضوابط کے مطابق، کمیونیکیشن کے کسی بھی ذرائع جس میں ابلاغ پوشیدہ یا خفیہ ہوجائیں کی پی ٹی اے سے رجسٹریشن ضروری ہے۔ وی پی این رجسٹریشن کی آخری تاریخ 30 جون 2020 ہے۔

واضح رہے کہ وی پی این کی رجسٹریشن کا عمل نیا نہیں ہے بلکہ سال 2010 سے جاری ہے۔مجاز صارف اپنے سروس فراہم کنندہ کے ذریعہ شروع کردہ سمارٹ اور تیز رفتار عمل کے ذریعے پی ٹی اے کے ساتھ اپنا وی پی این رجسٹر اکرسکتے ہیں۔

غیر قانونی ٹریفک کے خاتمے کے حوالے سے صرف غیر مجاز وی پی این کے خلاف کارروائی کی جائے گی جس سے قومی خزانے کو نقصان ہورہا ہے۔ پی ٹی اے پاکستان میں ٹیلی کام صارفین کے لئے اعلی معیار کی آئی سی ٹی خدمات کی فراہمی کو یقینی بنانے میں اپنے وژن کے مطابق خدمات انجام دینے کے لئے پرعزم ہے۔

خرم مہران
ڈاےئریکٹر تعلقات عامہ

https://pta.gov.pk/ur/media-center/single-media/public-notice---get-your-vpn-registered-170620 (archive)

Registration of VPN before 30 June 2020

(Islamabad: 10th June, 2020): Pakistan Telecommunication Authority (PTA) is continuing with the process of registration of Virtual Private Networks (VPNs). The exercise is being undertaken to promote legal ICT services / business in Pakistan and safety of telecom users.

As per applicable Rules and Regulations, appropriate registration is required from PTA for any mode of communication in which communication becomes hidden or encrypted. The deadline for VPN registration has been set as 30th June 2020.

The process for registration of VPN is not new and has been in vogue since 2010. Authorized users can register their VPNs with PTA through a smart and swift process initiated through their service provider.

Action will be taken only against unauthorized VPNs for terminating illegal traffic which causes loss to the national exchequer. PTA remains committed to serve as per its vision in ensuring that high quality ICT services are available to telecom users in Pakistan.

Khurram Ali Mehran
Director (PR)

It seems that there have also been newspaper advertisements.

https://pta.gov.pk/en/media-center/single-media/-100620 (archive)

https://pta.gov.pk/en/media-center/single-media/public-notice---get-your-vpn-registered-170620 (archive)

[wkrp]

An article by Ramsha Jahangir in Dawn, dated 2020-06-16, provides more details. The PTA has recently deployed a new DPI-based VPN detection system supplied by Sandvine.

https://www.dawn.com/news/1563843 (archive)

PTA asks internet users to register VPNs to avoid ban after June 30

KARACHI: Internet users in Pakistan will be unable to browse the web using encryption software after June 30, unless they register Virtual Private Networks (VPNs) with the telecom authorities.

Legitimate users can register their VPNs through their service providers by filling two forms, including undertaking and provision of basic documentation, without any charges, the PTA told Dawn.

A registration form shared with Dawn by an internet service provider shows that users will be required to disclose their static IP addresses as well as details of the VPN software they use, the purpose, and business details.

To monitor and curbing “grey traffic” — which inclu­des Voice over Internet Protocol and Virtual Private Networks — the PTA has deployed a sophisticated web monitoring system.

The equipment, which is worth $18.5m, is provided by Canada-based company Sandvine. The web monitoring system will use Deep Packet Inspection (DPI) to monitor communications, measure and record traffic on behalf of the PTA.

“The PTA can block VPN traffic by analysing the country’s traffic, flagging traffic that looks potentially VPN-like, and then breaking that connection,” said Amin Shah Gilani, former interim chief technology officer of Patari.

Sandvine, according to Mr Gilani, uses a mix of techniques to identify the type of traffic flowing through the system. This includes looking for patterns in the individual chunks of data as they pass through the system, observing the behaviour of a citizen’s traffic and matching it with previously known types of behaviours to understand what they’re doing.

It also involves machine learning models, where a computer has been trained to identify traffic types based on past data.

Several users have reported throttling of VPN services in Pakistan recently, including inability to access Tor Browser — a software that allows users to browse the Web anonymously.

However, the PTA said Tor was not blocked by the PTA and the authority would begin banning services after the June 30 deadline.

Citizen Lab's posts tagged "Sandvine" have information on Sandvine's past cooperation with censorship and malware delivery.

By searching Reddit (archive), I found an article from 7 months ago saying that the government had made a $18.5 million contract with Sandvine to create a "web monitoring system."

https://www.codastory.com/authoritarian-tech/surveillance/pakistan-nationwide-web-monitoring/ (archive)

Pakistan moves to install nationwide ‘web monitoring system’

Text by Umer Ali and Ramsha Jahangir 24 October, 2019

Pakistan has acquired the services of a controversial Canada-based company to help build a nationwide “web monitoring system,” Coda Story can reveal.

Sandvine is expected to provide equipment for monitoring and analyzing all incoming and outgoing internet traffic from Pakistan.

The agreement raises serious concerns about privacy and civil liberties in Pakistan, where government critics have sometimes seen digital retribution from officials and other powerful groups.

According to the agreement — a copy of which was exclusively shared with Coda — the contract is worth $18.5 million and dated December 12, 2018. The “web monitoring system” will use Deep Packet Inspection (DPI) to monitor communications, measure and record traffic and call data on behalf of the country’s national telecommunications regulator, Pakistan Telecom Authority (PTA).

The new system is the result of a controversial 2010 law that mandates the monitoring and blocking of any traffic to and from Pakistan.

Sandvine has come under criticism in the past for selling technology to authoritarian regimes. The company came under fire last year after an investigation by the Canada-based Citizen Lab revealed Sandvine DPI was being used in Turkey, Egypt and Syria to redirect users to download legitimate programs “bundled with spyware.”

Citizen Lab also found out that the Sandvine DPI equipment was being used to “block political, journalistic, and human rights content.”