The Pakistan Telecommunication Authority (PTA) has launched a new strategy to regulate Virtual Private Networks (VPNs) after previous attempts to ensure compliance were unsuccessful. The PTA’s new approach includes creating a licensing category under which companies can apply for permits to offer VPN services, addressing the issue of unregistered VPNs. Under this system, all VPNs, except those provided by licensed service providers, will be considered unregistered and blocked.
The move is aimed at monitoring VPN traffic, as the anonymity offered by proxy networks has raised concerns among authorities. The PTA announced in a press release that it has resumed granting Class Licences for Data services to service providers in Pakistan, stating that VPN providers are required to obtain this licence to operate legally.
In addition to internet and cellular service providers, the PTA has now included VPNs under licensed services. This shift aims to ensure that local companies, bound by Pakistani laws and regulations, provide VPN services to users. This approach will allow the PTA to have more control over VPN providers, as many VPN services are currently offered by foreign companies.
The idea of localised VPN service providers was proposed by the Pakistan Software Houses Association (P@SHA), which represents companies in IT and IT-enabled services. P@SHA Chairman Sajjad Syed emphasized the importance of local VPN services for the country’s growing freelance community, particularly for women engaged in IT export projects. He highlighted that the new system would enable businesses to access VPN services while allowing the government to monitor content for security purposes.
VPN service providers will be required to pay a licence fee of Rs300,000 to operate nationwide or Rs100,000 to provide services in a specific province. Licenses will be valid for 15 years and can be extended for another term. The terms of these licences also mandate that service providers promptly provide information requested by the PTA and comply with national security requirements, including providing Lawful Interception (LI) equipment to security organizations at their expense.
Critics argue that this surveillance system could undermine the purpose of VPNs by stripping away their ability to offer anonymity. Technical experts have raised concerns about the excessive oversight powers granted to authorities under the new licensing system.
Shahzad Arshad, Chairman of the Wireless & Internet Service Providers Association of Pakistan, questioned the feasibility of this system, pointing out that international companies, such as foreign banks, may not trust local VPN providers if their activities are subject to monitoring. He added that blocking certain proxies would not stop VPN use, as users would simply switch to other available options.
The new licensing system marks a significant step in the PTA’s efforts to control VPN services in Pakistan, but it has raised concerns about privacy and the potential for overreach.
