In late October 2019, Pakistan’s plan to engage Canada-based firm Sandvine Corporation, which is notorious for its Internet surveillance technologies, resurfaced with the publishing of a report highlighting details of the contract signed over the matter.
The issue has been in the press since May 2019, when the government first announced plans for monitoring the country’s internet traffic. Minister for Parliamentary Affairs Azam Khan Swati told a Senate hearing that month that the Pakistan Telecommunications Authority (PTA) will be investing in mechanisms to observe and control grey traffic.
“The said monitoring system will be called Web Monitoring System (WMS). The contract has been signed between relevant telecom operators and the vendor without involvement of public money,” he announced.
The same month, another Senate session revealed that the PTA was looking to sign an agreement with Sandvine Corporation.
The company’s murky history has since been a cause for concern for digital rights activists and journalists. Among other instances, Sandvine had reportedly been involved in infecting Internet users in Turkey with spyware, and redirecting Egyptian users to affiliate ads.
Read more: Changing climate for tech startups
Speaking to MIT Technology Review Pakistan about the report he published in Codastory.com alongside Ramsha Jahangir, a journalist with Dawn newspaper, Umer Ali explains that Sandvine is providing services to Pakistan through a mediating company, i.e. Inbox Business Technologies, which is already engaged with the government on many projects. “The equipment they are providing is very invasive. It will be akin to reading out loud letters addressed to you directly at the post office in front of the staff, who will know everything about it,” he says.
The story mentions that the contract signed over the matter in December 2018 is valued at $18.5 million. The equipment procured as a result will enable the third-party firm to “use Deep Packet Inspection (DPI) to monitor communications, measure and record traffic and call data on behalf of the PTA.”
To put all responsibility for this move on the current government’s shoulders will be wrong, since the first agreement in this regard was signed during the previous government’s term, according to Ali.
“The monitoring system will cover the entire bandwidth of internet traffic. All internet service providers (ISPs) were forced by the PTA to pay for this system, so the claim that no public money has been spent on the project is true. The authority had threatened to cancel the licenses of the companies if they didn’t pay for the system,” Ali explains.
While internet monitoring doesn’t surprise many anymore, it is the gigantic scale at which it will be done with the WMS that has alarmed many.
Digital Rights Foundation (DRF) research manager Shmyla Khan worries that the move will worsen surveillance in the country. “The DPI being reported can be used to remove or block content, and at the same time it can be used to create a ‘firewall’ of sorts in which internet traffic will be monitored indiscriminately. It is hard to argue that such a system will be legal given the issues of privacy that it raises on two grounds.
“Firstly, such an undertaking expands the powers of the PTA beyond those envisioned in the relevant laws. Secondly, even if such a system is declared to be within the scope of powers envisioned by the law, it violates fundamental rights and is thus unconstitutional,” she argues.
Pakistan is following in the footsteps of China with these latest moves to enhance surveillance, according to Ali. “We are already moving in that direction. We have banned so many websites… we don’t just ban or block ‘immoral’ websites but go after anything that offers criticism or a different narrative, exactly like China. The technology that Pakistan is bringing in is just like that of China, where keywords can be filtered out in real-time,” he says.
An ever-expanding circle of reach
Officials have been changing their story with regards to the WMS for several years now. But in this particular case, we see an additional effort to keep the information hidden.
Read more: Inside Lahore’s public e-sports culture
“The efforts to keep things vague and changing statements is very deliberate because they want to worry about no outrage or pushback,” Ali says.
Hija Kamran, a program manager for Media Matters for Democracy (MMfD), believes that the government cannot take stakeholders on board when it comes to web monitoring because of the nature of the work itself. “Monitoring as a practice generally violates user privacy. The argument that it is being done to identify potential threats or terrorist activities paints the entire population with the same brush of being at fault or being a terrorist. And the reason why this process lacks transparency is because the authorities are aware they are violating users’ fundamental rights,” she says.
Kamran feels that existing laws in the country should be put into motion to enhance security, instead of initiating additional measures such as a web monitoring system, especially because “the so-called security measures often end up targeting rights activists and dissenters”.
Last February, a new social media monitoring program was initiated in the country. While it was originally supposed to counter hateful and anti-national content, its introduction led to the targeting of journalists and activists in the country instead. In such a climate, transparency is the need of the hour.
“We demand clarity in these processes, especially in the context of monitoring, from a rights-based approach. The authorities don’t like their orders being challenged. So, despite there being a certain level of transparency exercised in the process of monitoring citizens, on principle, mere transparency can’t legitimize the act of surveillance because it will continue to infringe users’ right to privacy,” Kamran notes.
Before the 2018 election, mainstream political parties had provided assurances that they would address the digital rights’ question. But activists feel that their statements have been nothing more than mere lip service.
“If you analyze past election manifestos of these parties, you’d see that upholding digital rights, privacy and free expression either didn’t exist in their mandate or could be found towards the end as a passing statement. This is a systemic issue, deep-rooted in how the legal system and discussions around it has been built, and how citizens’ rights are targeted for the sake of ‘security’,” Kamran says.
The regulatory and executive authorities in Pakistan have a strong grip over internet services. From petitioning internet companies for user data to simply shutting services down, the government wields a significant influence over how Pakistanis use the internet. A new WMS will allow it even more power than before – but does this new power fall under the ambit of the constitution?
Khan notes that, under the law, the PTA lacks the mandate for a mass monitoring role. “It is only section 54 of the PTA Act that authorizes the interception of calls and messages in the ‘interest of national security’. These powers are made clearer by section 37 of the Prevention of Electronic Crimes Act that gives the PTA the ability to remove or block ‘unlawful content’ as defined under the Act,” she says.
“A very good example of PTA’s abuse of power is one granted under Section 37 of PECA. PTA has used this law to extend censorship on the internet without any checks and balances or set of rules that they were supposed to formulate before implementing this clause,” she adds.
The authority is supposed to send a notice before content is banned, but that isn’t always the case. “It has failed to share with us any such notices despite MMfD’s multiple RTI requests. The Islamabad High Court has already declared that PTA doesn’t have the authority to block online content unless they draft rules for Section 37. While the rules are yet to be drafted, the authorities continue to introduce ways to curb free expression and privacy of citizens,” she notes.
Pakistanis are no strangers to web services. According to the World Bank, 73.36 percent of the country’s population uses the internet on their phones. In 2018, Facebook reportedly had around 32 million users in the country, while Twitter reported having an estimated 3.1 million.
According to a 2018 Internet Landscape report by Bytesforall, the country has 154 million cellular subscribers, 62 million 3G/4G subscribers, and 64 million broadband subscribers.
When the PECA was introduced, it was criticized widely for being a problematic law that would do much to harm user privacy and security, despite being meant to uphold it. If Sandvine’s new WMS is implemented, users will find their data further compromised.
Speaking of how it would work, Khan explains, “Deep packet inspection allows for the interception of all Internet activity, giving operators the power to examine the content of data packets. It can potentially be used to monitor individuals, intercept communications and block content which are obvious threats to the right to privacy, enshrined under Article 14 of the Constitution of Pakistan and free expression.”
In simpler terms, the government becomes the gatekeeper of any and all pieces of information that are to traverse digital spaces in the country. They choose with prejudice what users can and cannot have access to, blocking content as they see fit.
When such a system is in place, there is little in the way of protection that users can opt for. Khan believes that the way to go is to challenge the legality of a mass surveillance system, given that it heavily infringes on the rights allotted to Pakistanis under the constitution.
“We have to demand transparency from the state in the import and use of surveillance technology in order to ensure that the reasonable expectation of privacy by the average Pakistani user is not violated.
“At an individual level, investing in a reliable VPN is a great way to ensure that traffic is not monitored; however, make sure to use a reliable VPN that does not log your data,” she advises.
Apps such as Telegram already do not work in Pakistan because of their ability to help users communicate without the prying eyes of the government. Other apps such as Signal remain available, but with this new WMS their protective capabilities may prove irrelevant.
Targeted groups such as journalists and activists remain in danger despite encryption. “Deep packet inspection has been known to monitor HTTPS traffic that carries the SSL encrypted certification. It is, however, unclear if Sandvine can break end-to-end encryption. Given recent backdoors and attacks on commonly used end-to-end encrypted apps such as WhatsApp, there is a real fear that dissenters using digital spaces to organize and communicate will be disproportionately impacted by a mass surveillance system,” Khan says.
However, in Pakistan, the status of tools that can be used for protection itself is shaky. “Encryption is already illegal in Pakistan. Implementation of such systems only reinforces what the authorities have been trying to achieve,” Kamran notes.
Read more: Understanding Pakistan’s cybersecurity woes
“The core purpose of web monitoring system and subsequent attempts to control online content will affect users’ right to privacy and free expression on digital platforms, putting them under the increased and disproportionate scrutiny of law enforcement. We have an example of the Prevention of Electronic Crimes Act 2016 which was passed to curb cyber crimes, but has so far mostly suppressed freedom of expression through increased censorship. The proposed web monitoring system will likely also strengthen this trend of authoritarian control over citizens’ activities,” she adds.
In the Freedom on the Net Report 2019, Pakistan continues to be ranked ‘not free’, with scores in the significantly low range for both obstacles to access and violations of user rights.
The report also notes that 800,000 websites remain blocked in the country, while Pakistan tops the chart when it comes to countries with restricted social media content.
“Such developments do not give us much cause for optimism. However, as seen in the AWP petition to the Islamabad High Court, citizens resisting and using tactics such as strategic litigation can fight back and reclaim tiny bits of the internet that we are rapidly losing,” Khan notes.
During the last two decades, internet monitoring has progressively gotten worse in Pakistan. While different political parties may not have found much common ground on other issues, it seems that this is one aspect tying them all together.
Monitoring and surveillance have been on the rise since General Musharraf’s military government, and if current developments are anything to go by, this upward trajectory will not be changing course anytime soon.
Luavut Zahid is a journalist based in Lahore.