Pakistan's government introduces VPN permits to combat usage

The Pakistan Telecommunications Authority (PTA) hasn't given up on its pursuit of VPNs and has announced a new plan to tackle unregistered VPNs.

The regulator has introduced a new licensing category under which companies can apply for permits to provide VPN services – which at this stage appear to simply be proxy servers.

Proxy servers allow you to change your IP address and, in most cases, select an IP address from another country, meaning you can access blocked content. However, although your browsing activity is hidden from your Internet Service Provider, it isn't hidden from the proxy.

What's more, proxy servers don't encrypt your data and can't protect or secure your data – this makes them far less secure than the best VPNs.

This move is the PTA's latest attempt to tackle unregistered VPNs following its U-turn on a VPN ban back in December. The proxies provided by local companies would be allowed to operate, but all other VPN services would be deemed as unregistered and subsequently blocked.

Why has this step been taken?

Authorities in Pakistan have long been frustrated by the use of proxy servers and VPNs, and with licensed service providers, users' internet traffic would be able to be monitored and accessed.

On 19 December 2024, the PTA announced the resumption of granting Class Licenses for Data Services. VPN companies are now required to obtain a Class License for Data (Data Services) to provide VPN, and related, services.

It is envisaged that local companies, bound by Pakistan's laws, license terms, and regulatory provisions, will provide proxy servers to users. This will enable the PTA to exert greater control over these companies and proxy usage due to the fact most VPN providers are foreign companies and much harder to regulate.

In a PTA document, it states that, when asked, a registered company should "promptly provide all information, as and when desired by the Authority." This poses serious data privacy risks and defeats the purpose of using a VPN or proxy to protect your privacy online.

The plan was proposed by the Pakistan Software Houses Association (P@SHA), who had previously warned the shutdown of VPN services would cost Pakistan's IT industry millions of dollars.

A quick history of Pakistan's ongoing VPN crackdown

This is not the first time VPNs have been the subject of a crackdown in Pakistan, as the government has been attempting to suppress their usage since the latter part of 2024.

A VPN shutdown was experienced between 9-10 November 2024, with many people reporting disruptions to VPN connections. As a result of this, the Proton VPN Observatory, run by the team behind Proton VPN, reported a large spike in VPN sign-ups – 350% over the baseline.

Despite the shutdown being blamed on a glitch, moves to restrict VPNs were taken. VPNs were declared "un-Islamic" and all VPNs had to be registered with the government by 30 November 2024 or be blocked. The block would affect all unregistered, and personal-use VPNs.

Authorities said that VPNs were being used to access "immoral" content, however the "un-Islamic" claim was later retracted and put down to a "typo", with the word "not" mistakenly omitted from the statement.

Following the initial wave of VPN restrictions, the social media app Bluesky was blocked in Pakistan. Reports of the app being blocked were first recorded on 20 November 2024, and this follows a ban of X (formerly Twitter – the app Bluesky is based on) in February 2024.

WhatsApp was the next app to be caught up in the crackdowns, with users reporting problems sending and receiving voice notes and messages between 23-25 November 2024. The issues coincided with protests from supporters of the opposition party PTI, with anger being directed towards the current government and the treatment and imprisonment of former Prime Minister, and PTI founder, Imran Khan. Significant disruption to WhatsApp was seen in regions where there is strong support for Khan's PTI party.

Despite the suppression of VPNs and social media, government officials have not experienced the same difficulties as the people of Pakistan. Prime Minister Shehbaz Sharif has continued to regularly post on X throughout this period, despite its ban, and must be using a VPN to do so.

Government U-turn

Despite the barrage of restrictions, Pakistan's government U-turned on their initial VPN at the beginning of December. The reversal was down to differing interpretations of the Prevention of Electronic Crimes Act (PECA) 2016. The government wanted to use its clauses to justify the ban, but the Law Ministry stated only "content", and not "tools" could be blocked.

However, the U-turn did not signal an end to privacy restrictions, and the latest announcement of a localised plan to introduce proxy servers and combat unregistered VPNs shows the government's desire to suppress VPNs hasn't faded.

Are there still ways to protect your privacy?

Whilst there are still ways to bypass restrictions, the risk of doing so is not entirely known and it is worth exercising caution when doing so.

If they can be subscribed to, using one of the best VPNs is still an effective and secure way of bypassing restrictions. The most secure VPNs offer class-leading levels of encryption and privacy, with many boasting no-logs policies meaning they do not collect your browsing data. VPNs are far better at protecting you than proxy servers due to this encryption, and like a proxy server, they can spoof your IP address and location.

If getting a VPN isn't possible, then using the Tor Browser is a good alternative. It is free, and is heavily focused on anonymity. It utilises the Onion Network, which is a multi-layered network that routes your traffic through multiple encrypted nodes – and no single node knows your traffic history.

Pakistan is not the only country to experience suppression of internet freedoms, with many countries around the world affected in recent months, including Mozambique and Russia. As incidents of internet restrictions become more common, it is vital people are made aware and have the appropriate tools to combat them in order to protect their digital privacy and freedoms.