Digital check-post

THERE has been no let-up in the woes of digital users in Pakistan as the internet continues to operate at a snail’s pace. To add insult to injury, at a press conference, the state minister for IT, Shaza Fatima, attributed the slow internet speeds to a surge in Virtual Private Networks (VPN) usage affecting Content Delivery Networks (CDN), while claiming that the government had done nothing to cause this.
What the minister failed to say is why the need for VPNs arose. Typically, VPNs are used as a data privacy measure. In Pakistan, internet users have turned to VPNs primarily to circumvent the blockades they are experiencing, especially the inability to transfer and download media over WhatsApp.
A VPN masks a user’s Internet Protocol address. Think of it as your home address. When you connect to a VPN, rather than the IP assigned to you by your internet service provider, the VPN assigns you a new address, but in another country. This allows users to circumvent geographical blockades instituted at the IP level.
Cloudflare defines CDNs as a “geographically distributed group of servers that caches content close to end users”. It defines caching as “storing copies of files in a cache, or temporary storage location, so that they can be accessed more quickly”. Distance affects latency — the time it takes to get to you. Food delivery orders are usually made from the closest branch to your address. If the order is routed from a branch further away the time it takes to get to you will increase. Similarly, if you have placed an order for the delivery of a product from outside the country, shipping will take longer than to those in the geographical area the store is located in.
Faults in submarine cables and increased VPN usage don’t explain WhatsApp media disruptions, which exist at an app functionality level. The chairman of the Pakistan Telecommunication Authority conceded before the National Assembly’s Committee on Information Technology that the web management system, also called the national firewall system — in existence since 2019 — was being upgraded. There is no disclosure as to what this system upgrade entails.
A recent article in this paper by Ramsha Jahangir quotes industry sources hinting at “gateway-level deployment at the two largest CDN providers … to control and monitor internet traffic in Pakistan”. The internet gateway, ie the Pakistan Internet Exchange, is where all international internet traffic comes in from and goes out of the country.
It appears that since content on global platforms cannot be removed directly, the ability to block and/ or restrict access is being enhanced. One part of this is restricting access but the second component linked to VPN registration is to enhance the ability to trace the source from where it originates. Even if content data is protected thanks to encryption, traffic data provides a lot of information about a user. Section 32 of the Prevention of Elec­tronic Crimes Act, 2016, requires service providers to retain traffic data of subscribers for up to a year. Traffic data is defined in Peca as “data relating to a communication indicating its origin, destination, route, size, duration or type of service”.
It’s not merely about placing containers to create diversions along a route or setting up a check-post to bar entry to the Red Zone. Once the vehicle arrives at the check-post, the next step would be to make a note of the type of vehicle and its number plate, to identify who it belongs to and determine the route the vehicle took to get to the check-post and where it had embarked from, ie, its point of origin.
During advocacy against Peca, the retention of traffic data was flagged as a privacy concern. The example of a high court in the Philippines striking down similar provisions in their cybercrime law was cited. Pakistan enacted Peca soon after. Other than a portion of Section 20 being struck down by the Islamabad High Court (IHC), no significant reading down — forget striking down — of unconstitutional provisions has taken place.
The apprehension to take such challenges to court is also reflected in the recent order by a two-member bench of the Supreme Court, which has restored the surveillance regime under the Lawful Intercept Management System, which was stayed conditionally by the IHC. The privacy rights of citizens remain hostage to the doctrine of necessity routinely applied by the legislature and judiciary in response to unqualified claims of national security. There exists an acceptance of executive overreach, a view that the government ‘can’ do this without adequately subjecting executive power to scrutiny against the letter of the law or the constitutional scheme.
The ‘everyone does it’ argument is not tenable. Specifics matter. A search for countries with a national ‘firewall’ to information control throws up results such as China and North Korea. While the de facto here prevails over the de jure in practice, there still exists a Constitution, and on paper, Pakistan is still a democracy. Tech tools and regulations in a democratic dispensation versus those under an authoritarian regime chart a different path. Of course, it’s not always a neat divide; so-called large democracies have justified surveillance and policing regimes in the name of national security. However, these come with significant local critique, judicial checks and congressional oversight, which have led to reform, but this is never mentioned when the subject is brought up here.
The damage that has been done to individuals and businesses is irreversible. Pakistan is being viewed as an unstable, unviable market where investment will lead to losses and there is no guarantee of service or data privacy. Whether you are an individual or a business, the highest public officer-holder or an average citizen who does not participate in political activity, centralised network filtering and monitoring affects everyone — judges, politicians, journalists, entrepreneurs — personally and professionally. What’s at stake is the livelihood of citizens and their right to do business as well as the fundamental rights of expression, access to information, and privacy.
The writer is a co-founder of Bolo Bhi, an advocacy forum for digital rights.
Published in Dawn, August 25th, 2024