PTA ordered telecoms to implement mass surveillance system: Court documents reveal

Last month, during hearings in a case regarding the illegal surveillance of Bushra Imran Khan, the wife of former prime minister, the Islamabad High Court (IHC) learned that the Pakistan Telecommunication Authority (PTA) had mandated telecom companies to finance, import, and install a system enabling mass surveillance of citizens' data.

Known as the Lawful Intercept Management System (LIMS), this system allows access to private messages, video/audio content, call records, and web browsing histories, according to court documents.

In the order dated June 26, which was released over the weekend, Justice Babar Sattar of the IHC noted that LIMS was being utilised by “designated agencies” for surveillance purposes.

The PTA directive required telecom companies to facilitate surveillance on 2% of their customer base, potentially affecting over four million citizens simultaneously.

Justice Sattar noted that the mass surveillance lacked legal basis and was being operated without judicial or executive oversight. While LIMS allowed agencies to access SMS, call data, and encrypted data, it did not provide automated decryption for encrypted data.

The PTA did not respond to Geo.tv’s requests for comments.

How does LIMS work?

As per IHC's order, a “designated” law enforcement agency initiates a track and trace request for a customer’s data.

The request then goes through LIMS in an automated manner, after which private information such as SMS and call data of the citizen available on the telecom network is reported back to the agency.

“Through such surveillance, voice calls made by subscribers can be heard and re-heard,” court documents disclose, “Their SMS messages can be read. The audio and video content generated by or that passes through the devices of consumers and details of web pages browsed by consumers can be reviewed and stored.”

In its order, the court ruled since the LIMS has been installed unlawfully, those agencies who are using the system to surveil citizens have rendered themselves liable to criminal liability.

“Such mass surveillance system seems inspired by George Orwell's ‘Nineteen Eighty-Four’,” read the IHC order.

Ramsha Jahangir, a journalist and a digital rights activist, told Geo.tv that there was nothing “lawful” about this surveillance system.

“Not only is this a significant breach of user privacy, but the secrecy surrounding this invasive system's deployment and use is alarming,” she said over the phone, adding that it even allows agencies to collect encrypted data, such as WhatsApp messages, and request tech companies to decrypt content.

Furthermore, Geo.tv found a 2016 document on the PTA's website mandating telecom companies wishing to operate in Pakistan to facilitate "lawful interception of communication" for security agencies. However, the document fails to specify which agency would conduct surveillance or cite relevant sections of the Pakistan Telecommunication Act supporting this requirement.

For now, the IHC has temporarily barred telecom companies from letting LIMS access their networks or from procuring consumer data.

It further directed PTA to file in a sealed report details about how the Lawful Interception Management System was procured and installed, how it is manned and the entities and the individuals who have, and have had, access to it.

The IHC has adjourned the hearing of the case till September and in the meantime, ordered that a show-cause notice be issued to PTA’s members and its chairman under Article 204 of the Constitution read together with Section 2(b) and 6 of the Contempt of Court Ordinance, 2003, for “making misrepresentations with regard to the Lawful Intercept Management System.”