Digital check-post
There has been no let-up in the woes of digital users in Pakistan as the internet continues to operate at a snail’s pace. To add insult to injury, at a press conference, the state minister for IT, Shaza Fatima, attributed the slow internet speeds to a surge in Virtual Private Networks (VPN) usage affecting Content Delivery Networks (CDN), while claiming that the government had done nothing to cause this.
What the minister failed to say is why the need for VPNs arose. Typically, VPNs are used as a data privacy measure. In Pakistan, internet users have turned to VPNs primarily to circumvent the blockades they are experiencing, especially the inability to transfer and download media over WhatsApp.
A VPN masks a user’s Internet Protocol address. Think of it as your home address. When you connect to a VPN, rather than the IP assigned to you by your internet service provider, the VPN assigns you a new address, but in another country. This allows users to circumvent geographical blockades instituted at the IP level.
Cloudflare defines CDNs as a “geographically distributed group of servers that caches content close to end users”. It defines caching as “storing copies of files in a cache, or temporary storage location, so that they can be accessed more quickly”. Distance affects latency, the time it takes to get to you. Food delivery orders are usually made from the closest branch to your address. If the order is routed from a branch further away the time it takes to get to you will increase.
Similarly, if you have placed an order for the delivery of a product from outside the country, shipping will take longer than to those in the geographical area the store is located in.
Faults in submarine cables and increased VPN usage don’t explain WhatsApp media disruptions, which exist at an app functionality level. The chairman of the Pakistan Telecommunication Authority conceded before the National Assembly’s Committee on Information Technology that the web management system, also called the national firewall system, in existence since 2019, was being upgraded. There is no disclosure as to what this system upgrade entails.
A recent article in this paper by Ramsha Jahangir quotes industry sources hinting at “gateway-level deployment at the two largest CDN providers … to control and monitor internet traffic in Pakistan”. The internet gateway, ie the Pakistan Internet Exchange, is where all international internet traffic comes in from and goes out of the country.
It appears that since content on global platforms cannot be removed directly, the ability to block and/ or restrict access is being enhanced. One part of this is restricting access but the second component linked to VPN registration is to enhance the ability to trace the source from where it originates.
Even if content data is protected thanks to encryption, traffic data provides a lot of information about a user. Section 32 of the Prevention of Electronic Crimes Act, 2016, requires service providers to retain traffic data of subscribers for up to a year. Traffic data is defined in Peca as “data relating to a communication indicating its origin, destination, route, size, duration or type of service”.
It’s not merely about placing containers to create diversions along a route or setting up a checkpost to bar entry to the Red Zone. Once the vehicle arrives at the check-post, the next step would be to make a note of the type of vehicle and its number plate, to identify who it belongs to and determine the route the vehicle took to get to the check-post and where it had embarked from, ie, its point of origin.
During advocacy against Peca, the retention of traffic data was flagged as a privacy concern. The example of a high court in the Philippines striking down similar provisions in their cybercrime law was cited. Pakistan enacted Peca soon after. Other than a portion of Section 20 being struck down by the Islamabad High Court (IHC), no significant reading down, forget striking down, of unconstitutional provisions has taken place.
The apprehension to take such challenges to court is also reflected in the recent order by a two-member bench of the Supreme Court, which has restored the surveillance regime under the Lawful Intercept Management System, which was stayed conditionally by the IHC. The privacy rights of citizens remain hostage to the doctrine of necessity routinely applied by the legislature and judiciary in response to unqualified claims of national security.