Pakistan Telecommunication Authority to require registration of VPNs by 2020-06-30 about bbs HOT 1 OPEN

An article by Ramsha Jahangir in Dawn, dated 2020-06-16, provides more details. The PTA has recently deployed a new DPI-based VPN detection system supplied by Sandvine.

https://www.dawn.com/news/1563843 (archive)

PTA asks internet users to register VPNs to avoid ban after June 30

KARACHI: Internet users in Pakistan will be unable to browse the web using encryption software after June 30, unless they register Virtual Private Networks (VPNs) with the telecom authorities.

Legitimate users can register their VPNs through their service providers by filling two forms, including undertaking and provision of basic documentation, without any charges, the PTA told Dawn.

A registration form shared with Dawn by an internet service provider shows that users will be required to disclose their static IP addresses as well as details of the VPN software they use, the purpose, and business details.

To monitor and curbing “grey traffic” — which inclu­des Voice over Internet Protocol and Virtual Private Networks — the PTA has deployed a sophisticated web monitoring system.

The equipment, which is worth $18.5m, is provided by Canada-based company Sandvine. The web monitoring system will use Deep Packet Inspection (DPI) to monitor communications, measure and record traffic on behalf of the PTA.

“The PTA can block VPN traffic by analysing the country’s traffic, flagging traffic that looks potentially VPN-like, and then breaking that connection,” said Amin Shah Gilani, former interim chief technology officer of Patari.

Sandvine, according to Mr Gilani, uses a mix of techniques to identify the type of traffic flowing through the system. This includes looking for patterns in the individual chunks of data as they pass through the system, observing the behaviour of a citizen’s traffic and matching it with previously known types of behaviours to understand what they’re doing.

It also involves machine learning models, where a computer has been trained to identify traffic types based on past data.

Several users have reported throttling of VPN services in Pakistan recently, including inability to access Tor Browser — a software that allows users to browse the Web anonymously.

However, the PTA said Tor was not blocked by the PTA and the authority would begin banning services after the June 30 deadline.

Citizen Lab's posts tagged "Sandvine" have information on Sandvine's past cooperation with censorship and malware delivery.

By searching Reddit (archive), I found an article from 7 months ago saying that the government had made a $18.5 million contract with Sandvine to create a "web monitoring system."

https://www.codastory.com/authoritarian-tech/surveillance/pakistan-nationwide-web-monitoring/ (archive)

Pakistan moves to install nationwide ‘web monitoring system’

Text by Umer Ali and Ramsha Jahangir 24 October, 2019

Pakistan has acquired the services of a controversial Canada-based company to help build a nationwide “web monitoring system,” Coda Story can reveal.

Sandvine is expected to provide equipment for monitoring and analyzing all incoming and outgoing internet traffic from Pakistan.

The agreement raises serious concerns about privacy and civil liberties in Pakistan, where government critics have sometimes seen digital retribution from officials and other powerful groups.

According to the agreement — a copy of which was exclusively shared with Coda — the contract is worth $18.5 million and dated December 12, 2018. The “web monitoring system” will use Deep Packet Inspection (DPI) to monitor communications, measure and record traffic and call data on behalf of the country’s national telecommunications regulator, Pakistan Telecom Authority (PTA).

The new system is the result of a controversial 2010 law that mandates the monitoring and blocking of any traffic to and from Pakistan.

Sandvine has come under criticism in the past for selling technology to authoritarian regimes. The company came under fire last year after an investigation by the Canada-based Citizen Lab revealed Sandvine DPI was being used in Turkey, Egypt and Syria to redirect users to download legitimate programs “bundled with spyware.”

Citizen Lab also found out that the Sandvine DPI equipment was being used to “block political, journalistic, and human rights content.”

from bbs.