Pakistan's VPN policy threatens access for ordinary internet users: officials, experts confirm

KARACHI: Starting from November 30, the government is set to enforce a restrictive new policy that will refrain internet users in Pakistan from accessing Virtual Private Networks (VPNs).

The Pakistan Telecommunication Authority (PTA) only offers VPN registration to companies and freelancers who use these services for commercial purposes, a senior official of the state regulator PTA confirmed to The News.

As of now, this policy excludes ordinary users who rely on VPNs for online privacy or to access content including restricted news websites or social media platforms such as X (formerly Twitter).

On November 15, the Ministry of Interior issued a directive to the PTA chairman to block "illegal VPNs" nationwide.

"VPNs are increasingly being exploited by terrorists to facilitate violent activities," the directive stated. "VPNs are also being used to discreetly access pornographic and blasphemous content."

The ministry urged companies to register their VPNs by November 30.

A VPN, or Virtual Private Network, establishes a secure and encrypted internet connection, enabling users to protect their online activity from surveillance, censorship, and data theft.

A narrow scope for registration

As the deadline approaches, PTA’s registration platform caters exclusively to companies, freelancers, embassies, banks, and call centers, requiring applicants to provide documents such as company certificates or freelancer authentication letters.

Companies and freelancers are also required to provide a fixed or static IP address, obtained from their internet service providers to qualify for registration, according to PTA.

"Once your VPN is whitelisted, you will not be affected if VPNs are blocked at the government's instruction," said a senior official of the PTA, who requested anonymity.

When asked how ordinary Pakistani internet users who wish to use VPNs for privacy or accessing restricted sites could register, the official said that only individuals working as "freelancers for commercial purposes are eligible."

This statement underscores the likelihood that general internet users, neither affiliated with companies nor freelancing commercially, may lose access to VPNs once enforcement begins after November 30.

Explaining why VPN registration is necessary, the official said, "The advantage is that we will know who is using VPNs for illegal purposes and what they are accessing."

But when asked about the type of information that will be accessible to the PTA of those who have registered, the official contradicted his earlier assertion, saying the authority was "not interested" in personal content.

He did not explain under what law or rules was the VPN ban being implemented.

The official also disclosed that, to date, 20,000 companies and freelancers, including the UAE and British High Commissions, have registered their VPN and IPs. He added that there are over 100 million VPN connections daily in Pakistan.

PTA’s spokesperson did not respond to The News’ requests for official comments.

During the current year, using VPNs has become a necessity for Pakistani online users due to increasing restrictions and unexplained social media outages.

In February, the government blocked X, citing "national security concerns." While in July, users reported difficulties in sending and receiving media files on WhatsApp, a problem that persists for some even today.

Furthermore, the website of the country’s opposition political party, the Pakistan Tehreek-e-Insaf, remains blocked since before the February 8 elections, as well as some international news websites also are inaccessible in the country.

The growing censorship has driven VPN usage up, with only ProtonVPN reporting a 350% increase in sign-ups on November 10.

Increasing censorship. Going the China way

On November 10, internet users in the country experienced a temporary VPN disruption for several hours. In response to media queries, PTA attributed the incident to a "technical glitch", without offering any additional details.

Simon Migliano, the head of Top10VPN, an independent VPN review website, said that the Pakistani state’s policy of only allowing VPN use for commercial purposes shows that the government grudgingly accepts that VPNs are essential for Pakistan’s economy, but it still intends to strictly control VPN use as much as possible.

"With this policy, the devil really is in the details," Migliano said. "The requirement for a static IP rules out most VPN services that people use to unblock content, which typically rely on dynamic IPs."

He added that Pakistan seems to be following China’s model, where only VPNs that meet stringent government criteria are allowed.

Migliano also suggested that the November 10 disruption was likely deliberate, possibly involving deep packet inspection to identify and block VPN traffic.

"Most free or inexpensive VPNs lack sophisticated obfuscation and are easily blocked," he said.

On August 26, the Pakistani government acknowledged in a written statement to the parliament that the PTA was using the Web Monitoring System (WMS) to block online applications and websites in the country.

Interestingly on November 10, several social media users reported their free VPN services to have been most affected. While a spokesperson for ExpressVPN, a paid VPN service, told The News via email that it did not receive reports of service interruptions from its users.

"Regardless of any efforts to disrupt or throttle VPN services, ExpressVPN remains reliable," it added in its short reply.

While VPN traffic should remain secure from state surveillance as the data is encrypted, Migliano warned that going forward government-approved VPNs could lead to privacy risks.

"The real problems start to occur when only government-approved VPNs are permitted, as is the case in China," he explained. "If a VPN provider can only operate in a country with the approval of the government, then they are vulnerable to that government demanding secret access to that service, such as access to traffic logs for example."

However, whether VPNs can be entirely blocked in Pakistan remains uncertain.

Even in China, some VPNs manage to operate by adapting to evolving censorship techniques, said Migliano.

"Where there is sufficient economic incentive, VPN providers with the resources will continue to develop new protocols, obfuscate their traffic to avoid detection, and adapt to blocking measures," he said.