In a bid to promote legal information and communications technology (ICT) services in Pakistan and for the safety of telecom users, the Pakistan Telecommunication Authority (PTA) is continuing with the long-pending process of registration of Virtual Private Networks (VPNs), the use of which has significantly increased across the country over the past few years.
A VPN extends a private network across a public network and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. It is programming that creates a safe, encrypted connection over a less secure network, using tunneling protocols to encrypt data at the sending end and decrypt it at the receiving end.
Through a public notice, the PTA has declared the use of any mode of communication such as VPN, by means of which communication becomes hidden or encrypted, a violation of its regulations.
“Users, which are required to use VPN for their legitimate purposes, must register their VPN with [the] PTA through their respective internet service providers [ISPs] till 30-06-2020,” read the notice.
On top of interruption of services, legal action may also be initiated against those found in illegal use of unregistered VPNs, it added.
“The step is being taken to eliminate all grey traffic [the use of illegal telephone exchanges for making international calls bypassing the legal routes and exchanges] from Pakistan. It is the case with many companies running call centre services in the country using VPN or unregistered Voice over Internet Protocol (VoIP) services to make international calls appearing as if they’re located somewhere, in most cases, the United States (US),” sources told The Current.
The authority wants to eliminate grey traffic after registration of VPNs and has already started to blacklist internet protocol (IP) addresses of corporate clients of several ISPs, they said.
‘NOT THE FIRST TIME’:
“It isn’t the first time that the PTA has directed registering VPNs as the process was long-pending,” an official told The Current on the condition of anonymity.
“Through a similar public notice in 2014, the authority had announced that all unregistered VPNs will be blocked in its continuous efforts against grey traffic. All such users were required to apply to PTA for registration of their VPN connections through their respective service providers latest by May,” they said, adding that not much had, however, followed the announcement back then.
Speaking to The Current, Digital Rights Foundation (DRF) founder Nighat Dad also said it wasn’t the first time such an announcement had been made by the PTA, but it was very important for the authority to clarify the notice.
“They need to make it clear if the notice is only for financial institutions and software companies using VPNs or if it applies to individuals as well,” she said while seeking a better interpretation of the announcement.
Dad also said the authority should be asked as to which provision was invoked for the process to continue. “There is one regulation on grey traffic from 2010 which included a provision on VPN registration, but the PTA should clarify the law and its provision under which the said notification was issued.”
‘VPNS ARE NOT PERMITTED’:
When contacted, PTA Public Relations Director Khurram Mehran said that under applicable rules and regulations, appropriate registration from the authority was required for any mode of communication in which it becomes hidden or encrypted.
“The process for registration of VPNs is not new and has been in vogue since 2010. Authorised users can register their VPNs with the authority through a swift process initiated through their service provider,” he said, adding that action would be taken only against unauthorised VPNs for terminating illegal traffic, which causes loss to the national exchequer.
PTA remains committed to serve as per its vision in ensuring that high quality ICT services are available to telecom users in Pakistan, Mehran said.
“VPNs are not permitted and so are blocked whenever reported or detected. Whoever wants to use one can do so after registration under regulation,” he said when asked if the announcement also applied to individuals.
