Can you catch perpetrators using even registered VPNs? Here's why it's complicated

It would not be easy to catch someone involved in nefarious activities using Virtual Private Networks (VPNs), even with registration, a top IT sector official warned on Thursday, adding that the policy’s implementation could deal a significant economic blow to the country’s 2.3 million IT workers.

"When you are connected to a VPN, it has a secure transaction. Nobody knows what data is going through this VPN, so catching (someone using) this is not that easy," said Sajjad Mustafa Syed, Pakistan Software Houses Association (P@SHA) Chairman, while speaking on Geo News programme, "Geo Pakistan".

Syed revealed this in response to a query about whether it was possible to arrest someone involved in criminal or terrorist activities using VPNs, an encrypted internet network, even after registration.

To another query about whether perpetrators using VPNs could not be caught and what the use of the registration process was, he said the country would only end up creating classes of digital haves and have-nots. "Some people would be able to access the digital world, and the rest will not be able to do that."

The Pakistan Telecommunication Authority (PTA) on November 13 introduced a streamlined process for legitimate users to register their VPNs. The development came days after the regulatory body began blocking unregistered VPNs in Pakistan to "regulate internet security and ensure the safety of users."

Sources within the PTA said unregistered VPNs posed a significant security risk, as they might allow unauthorised access to sensitive data. Furthermore, they could potentially provide access to illegal content.

Explaining VPN registration, the P@SHA chairman said registration for a VPN meant that the PTA would register a static IP of a user or the site the user wanted to access — either end would have to be registered with the PTA for access.

"Here arises the problem, because our (IT) industry cannot do this, as whenever you connect with a VPN, you get a new IP address, and the registration process, as per the PTA, would take about eight hours. Such a lengthy process would delay the work of online freelancers, and companies would then prefer other countries for this job."

"As far as static IP addresses are concerned, you do not have such a large number of addresses that a multitude of internet users could utilise. So, it is next to impossible to implement this policy," he added.

Syed said that even if the policy were implemented, concerns related to national security would still not be addressed because even a terrorist could register for a VPN.

On the other hand, he said, as per a conservative estimate, the restriction would cause a $1 billion annual loss to the country’s IT exports.

Moreover, he said, some large international companies did not want the sharing of IP addresses — whether of the company or the one they were working with — a third party. He added that once they realised this was happening, the contracts would be cancelled.

The VPN restriction could deal an economic blow to 2.3 million IT workers in the country, the P@SHA chairman warned.

Meanwhile, expressing reservations over the decision, the Wireless & Internet Service Providers Association of Pakistan (WISPAP) stressed the need for a balanced policy.

Surprisingly, PTA Chairman Hafeez Ur Rehman admitted before the Senate Standing Committee that the IT industry could not progress without VPNs.