Pakistan's Digital Panopticon

“You have nothing to fear if you have nothing to hide.”

I have heard this argument from every group of stakeholders countless times in my decade-long experience advocating for the right to privacy in Pakistan. But it’s an interesting realisation that these fundamental rights otherwise protected under the Constitution mean nothing to the government responsible to protect them, when an advisor to the Prime Minister of Pakistan says this on live television.

The comment was made in response to the many questions that people rightly have about the recently issued notification by the Ministry of Information Technology and Telecommunication (MoITT) of Pakistan authorising the Inter-Services Intelligence (ISI) – the main intelligence agency in the country, “to intercept calls and messages or to trace calls through any telecommunication system.” The notification states that this order is issued in the interest of national security and in line with Section 54 of the Pakistan Telecommunication (Re-Organisation) Act of 1996, also known as the PTA Act.

Titled “National Security”, section 54(1) of the PTA Act states, “Notwithstanding anything contained in any law for the time being in force, in the interest of national security or in the apprehension of any offence, the Federal Government may authorise any person or persons to intercept calls and messages or to trace calls through any telecommunication system.”

National security has been a favourite excuse of governments around the world to use whenever they want to stifle their citizens’ rights. From the US to UK to Pakistan and India to China, Saudi Arabia, Vietnam, Iran, and others around the world, all of them have censored the internet or surveilled citizens under the pretext of national security. But has anyone ever been able to define what “national security” actually means?

Legal framework

The fact is that not a single law in Pakistan puts forward a comprehensive definition. Even the most recently introduced “National Security Policy 2022-2026” does not offer an inclusive (or any) definition. It is, however, interpreted and addressed by many legal frameworks, policies and constitutional provisions, but the term itself remains ambiguous, and so the broad usage as an excuse to justify draconian regulations and to strike down any criticism.

Something being legal does not mean it is constitutional and rights-respecting as well.

The PTA Act is not the only law that grants law enforcement authorities (LEAs) direct powers to surveil citizens. In fact, section 4(6) of The Monitoring and Reconciliation of Telephony Traffic Regulations, 2010 drafted under section 5 of the PTA Act also mandates the service providers to monitor real-time network traffic, and section 5(6) demands unencrypted access to this data. In addition, section 5 of The Telegraphs Act, 1885 legalises interception of messages “on the occurrence of any public emergency, or in the interest of the public safety,” a certificate of proof issued from the government to establish threat to public safety, whereas the Investigation of Fair Trial Act 2013, or IFTA, that legalises this interception in cases where the LEAs have reasonable suspicion on an accused person. This requires a court order, and the law mandates that the surveillance will not exceed 60 days.

It is worth noting that Article 14 of the Constitution of Pakistan gives the right to privacy of home to every citizen, and many precedents extend this right in digital spaces as well – for example, a key 1996 Supreme Court judgement in the case regarding then-Prime Minister Benazir Bhutto ordering phone tapping of judges, leaders of political parties and various high-ranking civil and military officers, which was one of the reasons of dissolution of parliament. The court held that an individual’s privacy under Article 14 was not just restricted to physical boundaries of home or work but also extended to spaces outside of home. The judgement also stated that this kind of surveillance not only violates right to privacy, but also directly infringes on the right to freedom of expression as it has the ability to control people’s ability to speak freely, as well as rights to life and dignity of man.

In essence, surveillance and interception of phone records were deemed unconstitutional by the Supreme Court of Pakistan. And while various laws do contradict this precedent, as mentioned earlier, by legalising surveillance, but something being legal does not mean it is constitutional and rights-respecting as well.

Extensive Real-Time Surveillance

The recent notification authorising ISI officers to intercept phones and internet history of people is an alarming development for various reasons. First and foremost, the notification comes amidst an ongoing case in the Islamabad High Court (IHC) pertaining to the leak of audio call records of Bushra Bibi – the wife of former Prime Minister Imran Khan, with her lawyer. She contested the audio leaks in the court arguing that this is a violation of her right to privacy. In the series of hearings since 2023, the court has questioned Pakistan Telecommunication Authority (PTA) that regulates digital media, Pakistan Electronic Media Regulatory Authority (PEMRA) that regulates mainstream media, the Attorney General and Additional Attorney General of Pakistan, Federal Investigations Agency (FIA) that is authorised to investigate electronic crimes in the country, regarding the source of the audio as well as the legality of phone tapping of a citizen. The court also highlighted the confidentiality of the conversation between the client and their attorney that was being breached when the audios were leaked and spread on the internet and mainstream media. The court said, “Illegal surveillance is an offence punishable by law.”

Secondly, even though the PTA Act and the IFTA enable authorities to intercept communications of individuals based on reasonable suspicion, this interception merits a court order that, to this day, has not been issued even once in the past 11 years since the passage of the Investigation of Fair Trial Act in 2013. It’d be naive to assume that the government of Pakistan has never intercepted anyone’s phone because no warrant has been issued for the same, especially witnessing how the governments have been trying to control online platforms and dissent on the internet through new laws, each more draconian than the last. This, however, is the first time in many years that the government is being questioned by the higher courts for the surveillance of citizens and violation of their privacy on digital platforms.

So it warrants a question: when the law i.e. the PTA Act has been around since 1996 – almost 3 decades, why did the government issue the notification just now during an ongoing high-profile case where these very powers are being contested? For many, this is an attempt of the current government to relieve itself from accountability in the court amidst the hearings in Bushra Bibi’s case of audio leaks.

With this kind of model present on the networks, call records, messages, audio and video content as well as unencrypted metadata of the encrypted apps would be accessible in real time, however, encrypted chats remain inaccessible.

What is more interesting is that this case is also the first time the PTA revealed it has mandated the telecom companies in the country to “finance, import and install” a mass surveillance system, Lawful Intercept Management System (LIMS), on their networks. According to the court documents, the system will enable the surveillance of 2% of the telecom subscribers in the country at a time, making up to 4 million people under active surveillance at once.

Although not much is known about this system or how it is being deployed, what the available information suggests is that on a technical level, it is based on the Deep Packet Inspection (DPI) focused web-monitoring system which the government of Pakistan secured in 2018 from Canadian company Sandvine, sanctioned in the US for doing business with authoritarian regimes around the world. DPI is an additional layer to the traditional surveillance model that typically involves inspection of Internet protocol (IP) containing network location identifiers along with Transmission Control Protocol (TCP) that enables devices to exchange messages on a network. DPI adds a layer of application-based inspection of traffic into this model allowing the surveillance system to access the content being received on a device – say mobile phone or a computer. With this kind of model present on the networks, call records, messages, audio and video content as well as unencrypted metadata of the encrypted apps would be accessible in real time, however, encrypted chats remain inaccessible.

Not only has this information not been made public before it was mentioned in the court, it was also not notified officially to the public by any parties involved. The blatant surveillance is a direct violation of 200 million people’s constitutional right to privacy, and the one that has been protected by various international human rights framework that Pakistan has ratified, like the Universal Declaration of Human Rights (UDHR), the International Covenant on Civil and Political Rights (ICCPR), and many other instruments.

Right to privacy is directly linked with the exercise of other fundamental rights as well, like the freedom of expression, freedom of assembly, freedom of association, access to information, among others. LIMS is a threat to all of these rights.

It is imperative to note that all of this is happening without any sort of transparency in processes of acquiring and deploying such systems. Any information that the public knows at the moment is either through court documents as mentioned earlier, or through speculations which are then confirmed in parts by the authorities.

Criticism =/= terrorism

Coupled with IP-level blocking of online content, the Pakistan government is deploying a sophisticated digital surveillance and censorship model to stifle civil liberties in the country to, what the authorities call, curb “anti-state propaganda”.

In a recent press conference that the Director General of Inter Services Public Relations (ISPR) – a PR wing of the Pakistan Army, hosted, he referred to criticism of the state as “propaganda” or “digital terrorism”.

For the authorities, anything that criticises the government and official institutions constitutes “anti-state” – think: investigative journalism looking into corruption or policies and practices that impact the country and its people in any way – propaganda; or criticism of state policies – propaganda; or tracking the performance of sitting government or institutions – propaganda; or highlighting electoral rigging – propaganda; or protesting state violence – propaganda; or demanding constitutionally protected rights – propaganda. Anything that does not align with or challenges the state’s authoritarian fantasy can and will be labelled anti-state propaganda, a threat to national security, and digital terrorism, even though Pakistan’s legal system does not criminalise criticism of the state and there is no vocabulary of “digital terrorism” in this framework, and rightly so.

To refer to criticism of the state, its policies and its institutions, as “terrorism” is a disservice to people who have lived through the violence the country has witnessed in its war against terror.

But words have meanings, and those meanings have connotations and point towards much deeper issues.

Pakistan and its people have been subjected to a fair share of violence that has taken the lives of millions of people. The “war against terror” that was initiated in the country has had drastic implications that news and subsequent reports may not show. The impact on people who survived the war, on those who lived through it, lost family members, friends, businesses, all of them were introduced to a new normal that entailed violence everywhere they looked. “Terrorism” has taken lives of innocents, the aftermath continues to invoke a certain feeling that triggers lifelong trauma.

To refer to criticism of the state, its policies and its institutions, as “terrorism” is a disservice to people who have lived through the violence the country has witnessed in its war against terror.

This reference also shows that the state institutions have no trust on the citizens they are hired to serve. It demands that if the authorities want to trust the citizens, they will have to prove that they are in fact innocent and deserving of the services that the citizens pay them for. A sense of reverse hierarchy only fit for an authoritarian state.

With this new surveillance regime coupled with decades-old censorship models, it becomes critical to acknowledge the impact of this narrative. In a country like Pakistan where when the cybercrime law (PECA) was passed in 2016 in the name of “protecting the daughters of the nation”, the first time it was used was to arrest bloggers and journalists critical of state institutions. These arrests started a wave of this law being used repeatedly to stifle civil liberties. The affect of a surveillance regime, coupled with laws that legalise it, is a direct threat to the safety of individuals who are already under state’s scrutiny, especially journalists, activists and dissidents. It also adds another layer to the risks of being geolocated during a gathering of journalists, activists and even political opponents, who are routinely attacked with violence.

No transparency

Looking around us, we can argue that all governments are taking strict measures around the world, but the problem arises when these policies are drafted and passed in complete secrecy with no regard for democratic processes of multistakeholder consultations or even any transparency whatsoever. Pakistan has been passing internet regulation policies behind closed doors with information having to leak afterwards to the media and civil society. Even with the implementation of tools like LIMS as well as Sandvine’s web monitoring system that the Pakistan government acquired in 2018, along with the ongoing ban on Twitter, recent throttling of Whatsapp as well as consistent censorship of voices on social media, the secrecy has been worrying and points at the larger trend of a concerted effort to not let people enjoy their freedoms, in whatever form they exist in the country at the moment.

There shouldn’t be a need for this secrecy if the government believes these measures are proportionate and in line with the democratic values and the constitution itself. Surveillance and censorship, for one, are not democratic in any way or form, and directly hinder the exercise of fundamental rights. They are a threat to the right to privacy and freedom of expression, and in extension, to all the other rights that the Constitution of Pakistan guarantees, and have no place in a democracy. The facade is falling off, and with it, the country leans further towards an authoritarian regime.