Bytes for All

State of Privacy Pakistan

tech-admin — Sat, 26 Jan 2019 15:45:24 +0000

State of Privacy Pakistan tech-admin Saturday, January 26, 2019

Introduction
Right to Privacy
Data Protection
Identification Schemes
Policies and Sectoral Initiatives

Introduction

Acknowledgment

The State of Privacy in Pakistan is the result of an ongoing collaboration by Privacy International and the Digital Rights Foundation.

Between 2014-2016, Bytes for All contributed to previous versions of the 'Data Protection' sections of this briefing.

Key Privacy Facts

1. Constitutional privacy protections: Article 14(1) of the Constitution of the Islamic Republic of Pakistan states that "[t]he dignity of man and, subject to law, the privacy of home, shall be inviolable."

2. Data protection laws: In July 2018, the Ministry of Information Technology and Telecommunication (MoITT) presented a draft data protection bill for consultation. The legislative process is still on-going.

3. Recent scandals: Interception across Pakistani networks remains pervasive; some of it is also unlawful, according to investigative and media reports.

4. ID regime: Pakistan has one of the world’s most extensive citizen registration regimes. This is run by the National Database & Registration Authority (NADRA). NADRA was used for the elections which took place in 2018.

Right to Privacy

The constitution

The Constitution of the Islamic Republic of Pakistan enshrines the right to privacy as a fundamental right. Article 14(1) of the Constitution confirms that "[t]he dignity of man and, subject to law, the privacy of home, shall be inviolable."

As a fundamental constitutional right, the right to privacy is meant to take precedence over any other inconsistent provisions of domestic law. Article 8 of the Constitution provides that "[a]ny law, or any custom or usage having the force of law, in so far as it is inconsistent with the rights conferred [under the Constitution], shall, to the extent of such inconsistency, be void." Article 8 (5), furthermore, states that "[t]he rights conferred by this Chapter shall not be suspended except as expressly provided by the Constitution."

Yet Pakistan's constitution also includes a wide-ranging exception to the primacy of fundamental rights. The provisions of Article 8 do not apply to any law relating to the 'proper discharge' of the duties of the Armed Forces or the police. The breadth of this exception is troubling, especially given the central role that the Armed Forces in particular have played in Pakistan's domestic political landscape historically.

Regional and international conventions

Pakistan is a signatory to several international and regional instruments with privacy implications, including:

The International Covenant on Civil and Political Rights (signed April 2008, ratified June 2010). Article 17 of the ICCPR states that "no one shall be subject to arbitrary or unlawful interference with his privacy, family or correspondence." The ICCPR also commits Pakistan to ensuring the protection of other rights that rely on the protection of privacy, such as freedom of expression and freedom of association.
The Cairo Declaration on Human Rights In Islam (signed August 1990). Article 18 of the CDHRI affirms that: "a) Everyone shall have the right to live in security for himself, his religion, his dependents, his honor and his property. (b) Everyone shall have the right to privacy in the conduct of his private affairs, in his home, among his family, with regard to his property and his relationships. It is not permitted to spy on him, to place him under surveillance or to besmirch his good name. The State shall protect him from arbitrary interference. (c) A private residence is inviolable in all cases. It will not be entered without permission from its inhabitants or in any unlawful manner, nor shall it be demolished or confiscated and its dwellers evicted."
The Convention on the Rights of the Child (ratified November 1990). Article 16 of the CRC states that "1) No child shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence, nor to unlawful attacks on his or her honour and reputation. 2) The child has the right to the protection of the law against such interference or attacks."

Communication Surveillance

Introduction

Pakistan’s sizeable population generates a huge amount of communications traffic. Approximately 73.36% of Pakistanis have a mobile phone subscription, according to the Pakistan Telecommunications Authority. An estimated 22.2% of the population uses the internet. Fifty operational internet providers and six mobile operators serve this demand.

Social media platforms are widely used in Pakistan. The social network Facebook reportedly had approximately 32 million Pakistani users in 2018. Twitter is estimated to have 3.1 million users. Pakistan also has a rapidly growing blogging community. Blogspot.com is ranked among the top five visited sites by Pakistanis, while the top 20 sites include Facebook, YouTube, DailyMotion, Blogger.com, Wordpress.com, Pinterest and Twitter.

Surveillance laws

A number of laws regulate communications surveillance in Pakistan.

The Investigation for Fair Trial Act (2013)

This act allows for access to data, emails, telephone calls, and any form of computer or mobile phone-based communication, subject to a judicial warrant. However, a warrant can be requested wherever an official has ‘reasons to believe’ that a citizen is, or is ‘likely to be associated’ with, or even ‘in the process of beginning to plan’ an offence under Pakistani law.

The Prevention of Electronic Crimes Act (2016)

Introduced in the wake of the deadly December 2014 terrorist attack on a Peshawar school, the Prevention of Electronic Crimes Act (PECA) was drafted as part of the government's National Action Plan to combat terrorism. The PECA was designed to tackle cyberstalking, online harassment, forgery, blasphemy and forms of cyberterrorism. As has been analysed at length by Pakistani and foreign rights organisations including Privacy International, Digital Rights Foundation, Human Rights Watch and Amnesty International, the PECA utilises such overly broad legal language that it potentially criminalises freedom of expression, and further weakens the right to privacy of Pakistani citizens. On 11 August 2016, despite severe criticism and condemnation by Pakistani and international rights organisations and bodies, the National Assembly of Pakistan approved the PECA, making it law.

Section 34 gives the Pakistan Telecommunications Authority the power to block or remove access to information "if it considers it necessary in the interest of the glory of Islam or the integrity, security or defence of Pakistan or any part thereof, friendly relations with foreign states, public order, decency or morality.”

Section 36 allows for "Real-time collection and recording" of data: "[i]f a Court is satisfied on the basis of information furnished by an authorised officer that there are reasonable grounds to believe that the content of any information is reasonably required for the purposes of a specific criminal investigation, the Court may order, with respect to information held by or passing through a service provider, to a designated agency as notified under the Investigation for Fair Trial Act, 2013 (l of 2013) or any other law for the time being in force having capability to collect real time information, to collect or record such information in real-time coordination with the investigation agency for provision in the prescribed manner."

Section 38 states: "Notwithstanding immunity granted under any other law for the time being in force, any person including a service provider while providing services under the terms of lawful contract or otherwise in accordance with the law or an authorized officer who has secured access to any material or data containing personal information about another person, discloses such material information to any other person, except when required by law, without the consent of the person concerned or in breach of lawful contract with the intent to cause or knowing that he is likely to cause harm, wrongful loss or gain to any person or compromise confidentiality of such material or data shall be punished with imprisonment for a term which may extend to three years or with fine which may extend to one million rupees or with both.

Provided that the burden of proof of any defense taken by an accused service provider or an authorized officer that he was acting in good faith, shall be on such a service provider or the authorized officer as the case may be."

Section 39(1) permits the sharing of “electronic communication or data or for the collection of evidence in electronic form” with any foreign government “24 x 7 network, any foreign agency or any international organisation or agency for the purposes of investigations or proceedings”.

Section 39 (2) gives the government the permit to “forward to a foreign government….any information obtained from its own investigations if it considers that the disclosure of such information might assist the other government, agency or organisation etc.”

The Monitoring and Reconciliation of Telephony Traffic Regulations (2010)

In addition to the acts listed above, section 4 of the Monitoring and Reconciliation of Telephony Traffic Regulations (2010) requires each long distance and international service provider to establish a system that allows for real-time monitoring and recording of traffic on its networks.

Data retention

Pakistani providers are required to retain communications data as a condition of their operating license. Since 2004, network providers have been required to comply with requests for interception and access to network data as a standard condition of the PTA’s award of operating licenses to phone companies.

The 2002 Electronic Transaction Ordinance (ETO) in points 5 and 6 imposes data retention requirements:

“The requirement under any law that certain document, record, information, communication or transaction be retained shall be deemed satisfied by retaining it in electronic form if :

(a) the contents of the document, record, information, communication or transaction remain accessible so as to be usable for subsequent reference;

(b) the contents and form of the document, record, information, communication or transaction are as originally generated, sent or received, or can be demonstrated to represent accurately the contents and form in which it was originally generated, sent or received; and

(c) such document, record, information, communication or transaction, if any, as enables the identification of the origin and destination of document, record, information, communication or transaction and the date and time when it was generated, sent or received, is retained.

The Prevention of Electronic Crimes Act 2016 requires judicial oversight for access to retained data. Section 29 states:

"A service provider shall, within its existing or required technical capability, retain its specified traffic data for a minimum period of one year or such period as the Authority may notify from time to time and, subject to production of a warrant issued by the court, provide that data to the investigation agency or the authorized officer whenver so required."

Surveillance actors

Security and law enforcement agencies

Since its creation in 1947, Pakistan’s armed forces, security and intelligence agencies have had a central role to play in Pakistani politics; these include three periods of military rule, the most recent from 1999 to 2008. Pakistan’s geographic location has also meant that it was a key American geopolitical partner during the Cold War, which in turn has influenced and strengthened the intelligence agencies. This relationship continues into the present day, with the onset of the global anti-terrorism effort.

The Pakistani government is engaged in a protracted conflict against armed militant groups within and outside its borders; it is a key player in the global ‘war on terror’. Communications surveillance — of phone and internet protocol (IP) traffic, domestically and internationally — and other forms such as biometric or device registration, is justified by the government as necessary to counter these internal and external threats, even as it becomes less targeted and more widespread against ordinary civilians.

Intelligence functions are dispersed across a number of government agencies that collect and/or use intercepted communications. Each branch of the armed forces has its own intelligence service conducting signals intelligence. The main agencies include:

The Inter-Services Intelligence (ISI);
The Intelligence Bureau (IB);
Federal Investigation Agency (FIA);
Crime Investigation Department (CID);
National Counter Terrorism Authority (NACTA);
National Crises Management Cell (NCMC); and
Military Intelligence (MI).

The Ministry of Justice is responsible for the Federal Investigation Agency and others that use intercepted communications data for criminal investigation and prosecution. Under the Ministry of Science and Technology, the Joint Intelligence Technical and Joint Intelligence X units carry out a number of surveillance research and development functions. The Intelligence Bureau, under the Prime Minister, has also used intercepted communications data.

Surveillance capabilities

IMSI Catchers

Law enforcement agencies across Pakistan widely use mobile monitoring equipment for identification and/or interception. The Pakistani government has imported many tactical communications surveillance technologies from Europe. In 2010, the German government granted German companies export licenses valued at EUR 3.9 million to export “monitoring technology and spyware software” to Pakistan, according to Privacy International*. Between 2012 and 2014, Swiss companies were granted licenses to export dual-use communications surveillance technology to Pakistan. The total value of the three exports based on the category provided was over CHF 1 million according to records obtained by Privacy International.

* Update: This briefing has been updated to remove an erroneous reference to equipment supplied by ABB to Pakistan

Internet Protocol monitoring centre

In 2013, the Inter-Services Intelligence (ISI), Pakistan’s best known intelligence agency, sought to commission a mass surveillance system to tap international undersea cables at three cable landing sites in southern Pakistan, according to documents obtained by Privacy International. The “Targeted IP Monitoring System and COE [Common Operations Environments]” would allow Pakistan to collect and analyse a significant portion of communications travelling within and through the country at a centralized command centre.

The total intake of data every second sought by Pakistan in the proposal document would rival some of the world’s most powerful surveillance programmes, including the UK’s ‘Tempora’ and US’ ‘Upstream’ programmes. What the ISI wanted to build, according to the request for proposals, was a complete surveillance system that would capture mobile communications data, including Wi-Fi, all broadband internet traffic, and any data transmitted over 3G. According to the documents, the interception activities were to be “seamless” and “must not be detectable or visible to the subscriber”.

Intrusion malware

In April 2013, computer forensic research by The Citizen Lab revealed the existence of a command and control server for FinFisher, an intrusion malware suite, operating within Pakistan. FinFisher is produced by Germany-based company FinFisher GmbH; prior to 2013, the FinFisher suite was sold by Anglo-German company Gamma International. The following year, documents obtained from a FinFisher server revealed support requests from an apparent Pakistani client – identification number ‘ID 32’ – dating back to 2011. In 2013, following this revelation, the Pakistani civil society group Bytes for All filed a petition in the Lahore High Court. The court ordered the PTA to look into the matter and produce a report within one month. The PTA has not yet filed their report, and attempts to gain further hearings on the issue have been unsuccessful.

Pakistan also sought to acquire intrusion malware from Hacking Team, an Italian company and rival of FinFisher. Pakistani companies attempted to contract business with Hacking Team for sale to Pakistani law enforcement or intelligence clients in March 2015, according to analysis of leaked data by the Digital Rights Foundation. Hacking Team's core business centred around their Remote Control System (RCS) software suite, which allows customers to infiltrate the computer and mobile devices of targeted individuals and install backdoors, in turn allowing for undetectable monitoring.

Lawful interception on communications networks

Pakistan has a thriving communications surveillance industry that has developed to meet the growing demand for increased levels of surveillance. Pakistani companies such as the Center for Advanced Research in Engineering and the National Radio Telecommunication Corporation of Pakistan have all developed network surveillance tools, partly in collaboration with the military. Other companies provide both interception technologies as well as facilities to monitor and analyse transmitted data.

An investigation Privacy International found seven international firms providing lawful interception equipment in Pakistan– Alcatel (France), Atis (Germany), Ericsson (Sweden), Huawei (China), Trovicor (Germany) (formerly Nokia Siemens Networks), SS8 (US) and Utimaco (Germany). The equipment, ranging from lawful interception gateways and switching equipment to monitoring centres, was provided to Pakistani networks including, PTCL, Mobilink, Ufone and others to facilitate law enforcement and intelligence agencies' access to communications data.

Two companies in particular – Trovicor, a German surveillance technology company and the company of which it was formerly a unit, Nokia Siemens Networks (NSN) – were particularly active in providing monitoring centre solutions to the Pakistani government. NSN has been a main player in the Pakistani surveillance market since the late 1990s and was one of the first companies to provide mobile (GSM) network lawful interception capacity in Pakistan.

Packet Inspection

The same technologies that the Pakistani government uses for censorship are also used for surveillance. Censorship of online content is widespread and justified as a means to prevent the sharing of pornographic, obscene, and blasphemous material in the Islamic republic.

The Pakistani government has purchased a number of ‘packet inspection’ technologies. Pakistan Telecommunications Ltd (PTCL), Pakistan’s largest telecommunications company that also operates the Pakistan Internet Exchange has proxies in place to do “deep packet inspection” of internet traffic. The technology to conduct deep pack inspection were provided in part by US-based Blue Coat systems, according to industry sources speaking to Privacy International. Blue Coat’s “ProxySG” product acts as a gatekeeper of access to the internet and services within it, from Secure Socket Layer (SSL) encryption, to HTTPS. Packet filtering products by Netsweeper have also been installed on PTCL’s network, according to a 2013 investigation by the Citizen Lab. They have reportedly been a vital tool in the government’s censorship of the internet.

Civil society organisations have taken legal action to protest surveillance in Pakistan. In 2012, Bolo Bhi and several bloggers and others also took the government to court against its practise of blocking websites and the plan to have a national filtering system in place, arguing that the IT Ministry and the PTA were illegally blocking and censoring access to some websites and forums that criticised the workings of the state. In 2011, civil society group Bytes for All announced it would challenge the validity of the SMS filter in court.

Surveillance oversight, checks and balances

There is currently no stringent public oversight of surveillance. Attempts to push forward such measures in the past have been unsuccessful. Checks and balances are currently in the form of provisions that request that the courts approve warrants, as well as public outcry from civil society stakeholders.

Surveillance case law

Privacy International is not aware of any specific surveillance case law in Pakistan. Please send any tips or information to: research@privacyinternational.org

Examples of surveillance

Popular support for surveillance of communications is high in Pakistan. Intermittent but devastating attacks within Pakistan’s major cities by insurgent groups, such as the 2014 Peshawar school attack by a Taliban-affiliated group, have been cited as a reason to expand surveillance in Pakistan.

Surveillance of citizens

Interception across Pakistani networks is therefore pervasive; some of it is also unlawful. A Supreme Court hearing about a case concerning phone tapping revealed that the ISI had tapped 6,523 phones in February, 6,819 in March and 6,742 in April 2015. A case was brought in 1996 following evidence that the then-Chief Justice’s phone had been tapped. No details about the procedures and process for intercepting communications have yet been publicly released.

In 2016, Senator Saleem Mandviwalla of the Pakistan People's Party, claimed that "the federal government had authorised the tapping of his phone and interception of his personal data."

Surveillance of activists and journalists is reportedly widespread. In February 2017, the Digital Rights Foundation published a report detailing the experiences of seven female journalists in Pakistan. They detailed extensive social surveillance and harassment, as well as suspected electronic surveillance.

Attacks on Pakistani territory frequently prompt calls for more invasive surveillance capacities. For example, an assassination attempt on Khawaja Izharul Hassan, the opposition leader of the Sindh Assembly, in September 2017 prompted politicians including Senator Raza Rabbani to write to university officials urging more surveillance of students.

UK and US government surveillance

Pakistan networks have also been targeted by the UK's Government Communications Headquarters (GCHQ). In 2010, a joint unit of the US' National Security Agency (NSA) and GCHQ hacked the world’s largest producer of SIM cards, Gemalto. The breach, detailed in a secret 2010 GCHQ document, gave the surveillance agencies the potential to secretly monitor a large portion of the world’s mobile communications, including both voice and data.

GCHQ successfully identified the identifying information of tens of thousands of SIM cards in a number of countries. However, GCHQ’s automated key harvesting system failed to produce results against Pakistani networks. This is despite there being “priority targets” for the UK in Pakistan, and despite the fact that GCHQ had a store of ‘Kis’ keys from two major Pakistani providers, Mobilink and Telenor. GCHQ has also hacked into the Pakistan Internet Exchange, a common point of transfer for a significant portion of Pakistanis’ communications, as part of its Computer Network Exploitation operations, giving the spy agency “access to almost any user of the internet” inside Pakistan.

Pakistan cooperates heavily with international surveillance initiatives against its own citizens, particularly those led by the US National Security Agency (NSA). The Pakistani government is by far the largest known recipient of NSA funds.

The NSA appears to especially value its relationship with Pakistan. The NSA maintained a ‘special collection service’ at its embassy and consulates in Pakistan. In 2008, it maintained at least one server in Pakistan for its programme XKeyscore, which searches and analyzes intercepted data. Under the Boundless Informant program, the NSA collected over 97 billion pieces of intelligence globally over a 30-day period ending in March 2013. Within this, Pakistan had the highest number of intercepted DNR (dialed number recognition) and second highest number of intercepted DNI (dialed number identification).

Pakistan also featured strongly in the NSA’s Fairview program. Fairview is a mass surveillance programme designed to collect phone, internet and e-mail data in bulk from the computers and mobile telephones of foreign countries’ citizens. NSA slides published in Brazil’s O Globo show that in one month in 2012, for instance, the NSA analyzed 11.7 billion records of DNI traffic into and out of Pakistan, as well as traffic to top Pakistani domain names.

A June 2012 NSA document shows that the NSA, through its SKYNET programme, harvests call data from Pakistani telecommunications providers (though it does not specify how) and that 55 million phone records were fed into an NSA analysis system for an analysis exercise. Known ISI agents were tracked in this experiment and an Al Jazeera journalist was misidentified as being a member of Al Qaeda.

In November 2016, a group called the Shadow Brokers released a cache of data purporting to be taken from the NSA. The cache revealed hundreds of IP addresses apparently compromised by the NSA as part of its operations. The data suggests that elements of Pakistan's internet infrastructure, including PTCL gateway exchange in Lahore, and ISPs including Paknet (which was merged into PTCL in 2007), Multinet and Micronet were compromised.

The Pakistani government’s reaction to revelations that foreign governments have engaged in mass surveillance of communications has been mixed. In 2013, Pakistani senators expressed concern after initial revelations about the scale of NSA surveillance in Pakistan, and in 2014, the Pakistani Foreign Office officially protested against the NSA’s surveillance of its left-leaning political party, the Pakistan People's Party (PPP). The Pakistani government have made few statements about the NSA’s activities in Pakistan. In contrast, civil society in and out of Pakistan reacted vehemently to the revelations.

Data Protection

Data protection laws

Personal Data Protection Bill, 2018

In 2018, the Ministry of Information Technology and Telecommunication (MoITT) presented and sought comments on a draft personal data protection bill.

The draft bill proposed by the Ministry has a number of significant shortcomings which were presented jointly by DRF and PI. These included, amongst others: the failure to include the data processing activities of public bodies and government within the ambit of the law, weak definitions of certain key terms which could lead to misinterpretation including for ‘personal data’, ‘consent’ and ‘sensitive personal data’, the absence of strong safeguards against mass surveillance, the failure to regulate international data sharing, and the inclusion of broad powers awarded to the Federal Government to make exemptions.

The legislative process is on-going, and no comprehensive data protection law has been adopted yet. In the absence of direct data protection legislation, data privacy and protection is theoretically still regulated through provisions in the following pieces of legislation.

The Electronic Transactions Ordinance (2002)

The Electronic Transactions Ordinance (2002) does not regulate data protection directly, but it criminalises unlawful or unauthorised access to information. Section 36 of the ETO states:

"Any person who gains or attempts to gain access to any information system with or without intent to acquire the information contained therein or to gain knowledge of such information [...] shall be guilty of an offence under this Ordinance punishable with either description of a term not exceeding seven years, or fine which may extend to one million rupees, or with both."

The same law envisages the establishment of a government-appointed body to certify electronic documents, and in Section 43(2)(e) grants powers to that body to make regulations for the privacy and protection of its users. However, it appears that the government is yet to establish this certification body, let alone draft regulation to protect the privacy of its users.

The Freedom of Information Ordinance (2002)

According to section 17 of the Freedom of Information Ordinance, "Privacy and personal information", certain forms of "information is exempt if its disclosure under this ordinance would involve the invasion of the privacy of an identifiable, individual (including individuals) other than the requester."

Prevention of Electronic Crimes Act (2016)

The Prevention of Electronic Crimes Act (2016) also contains a number of sections related to data privacy. However, these are intended to grant law enforcement and other government entities access to the private data of citizens, or to restrict citizens from gaining access to government data. Sections 3, 4, 5, 6, 7 and 8 make it a crime for anyone to gain unauthorized access to any information system or data, or copying or transmission of critical infrastructure data, punishable with a prison sentence up to 3 months to seven years or a fine of up to fifty thousand to 10 million rupees.

Section 31 allows a law enforcement officer to require a person to hand over data without producing any court warrant if it is believed that it is "reasonably required" for a criminal investigation. This can be done at the discretion of the officer and needs only be brought to the notice of a court within 24 hours after the acquisition of the data. Section 32 requires telephone and Internet service providers to retain traffic data for at least one year. Law enforcement bodies can demand access to that data subject to a warrant issued by a court. Section 30 allows courts to issue a warrant to a law enforcement officer to search and seize any data that "may reasonable be required" for a criminal investigation. In cases involving the vaguely defined "cyberterrorism", the officer can search and seize the data without a warrant and notify the court within 24 hours of its seizure.

Section 32 requires that law enforcement officers carrying out a search and seizure "take all precautions" to maintain the secrecy of the seized data and not interfere with any data not related to the crime under investigation. Under Section 38, if a law enforcement officer knowingly shares seized data to any other person, it can be punished with a prison term of up to three years and a fine of up to one million rupees.

Section 35(2)(b) requires that law enforcement officers carrying out a search and seizure "take all precautions" to maintain the secrecy of the seized data and not interfere with any data not related to the crime being investigated. Under Section 38, if a law enforcement officer knowingly shares seized data to any other person, it can be punished with a prison term of up to three years and a fine of up to one million rupees (around US$ 9,500).

Section 39 permits for real-time collection and recording of information for a criminal investigation if a Court is satisfied on the basis of information furnished by an authorized officer.

Section 42 allows the government to share any data obtained from its investigation with any foreign government or international agency.

National Database and Registration Authority Ordinance, 2000

The ordinance establishing NADRA, Pakistan's database authority, states in section 4(j) that it shall be responsible for "ensuring of due security, secrecy and necessary safeguards for protection and confidentiality of data and information contained in or dealt with by the National Data warehouse at individual as well as collective level."

Electronic Data Protection Act 2005 (draft)

In 2005, the Ministry of Information Technology circulated a draft law on data protection. However, for unclear reasons it was never tabled in Parliament. It appears that this draft legislation was initially written primarily with the intention of meeting the needs of Pakistan's software industry to conduct international business, rather than to address actual privacy issues. This is clear from Section 4 of the draft law:

"4. Government activity and exemptions — (1) This Act does not apply to the processing of personal or corporate data carried out by federal, provincial or local government.

(2) The federal government, in respect of local data only, by notification in the official gazette, may exempt any public or private sector, entity or business from the operation of this Act.

The rest of the draft law is filled with similar exemptions and vague terminology.

Law enforcement access to stored data

Since 2004, network providers have been required to comply with requests for interception and access to network data as a standard condition of the PTA's award of operating licenses to telecommunications providers.

Accountability mechanisms

Habeas Data/Subject access requests

Pakistan does not have any legislation explicitly allowing an individual to request data about themselves. However, it may be possible to request this information under Freedom of Information legislation.

Freedom of Information (FOI)

The Constitution has an explicit provision for the public's right to information in Article 19A, which states:

"Every citizen shall have the right to have access to information in all matters of public importance subject to regulation and reasonable restrictions imposed by law."

The federal government is still in the process of enacting a Right to Information Act whereas three provincial governments have passed Freedom of Information laws. The provincial laws for Khyber-Pakhtunkhwa (K-P) and Punjab have received praise from experts, while the FOI laws for the federal government and Baluchistan have been found to have serious flaws. The old Freedom of Information Ordinance (2002) which was enacted by the government of General Pervez Musharraf is still in effect at the federal level. The Sindh government has recently enacted a new law called the Sindh Transparency and Right to Information Law 2016.

In 2013, the federal government drafted a new Right to Information Act that was finalised in 2014 with amendments by the Senate Standing Committee on Information and Broadcasting. The draft has received widespread praise as it incorporates many progressive elements from the K-P and Punjab laws. The Senate's Select Committee approved the draft of the bill in February 2017 while the standing committee of Senate approved the bill in May 2017. However, the government has so far not tabled the bill in the National Assembly.

Article 8 of the current federal Freedom of Information Ordinance (2002) excludes a wide range of information from public access under the law. This includes any records relating to defence and national security, and further gives the federal government the discretion to exclude any other document from the purview of the law "in public interest".

Consumer protection rules

Pakistan has consumer protection legislation for all four of its provinces and the Islamabad Capital territory. The laws establish consumer courts, to which consumers can direct complaints against defective products and misinformation by sellers.

The laws do not have any provisions explicitly to protect the privacy of consumer data held by suppliers of goods and services. However, there are some provisions that could potentially be exploited for this purpose. For example, Article 13 of the Sindh Consumer Protection Act 2015 states that a "provider of services shall be liable to a consumer for damages proximately caused by the provision of service that have caused damage." However this would seemingly require the damage from any data breach to have already occurred in order for the provider to be held accountable.

Research published by the Digital Rights Foundation in December 2016 found that Pakistan's mobile service providers were inconsistent in their provision and publication of privacy policies, and that none of the privacy policies that were available indicated an awareness of the passage of the 2016 Prevention of Electronic Crimes Act.

Data breaches: case law

There exist a few informative cases related to the right to privacy in Pakistan which may be precedent-setting.

In Ghulam Hussain vs Addition Sessions Judge, Dera Allah Yar (PLD 2010 Quetta 21), the petitioner complained that the police raided his home on the basis of 'secret information' that it was being used as a gambling den, without a prior enquiry being carried out by a magistrate. The court ruled in favour of the petitioner that only in certain exceptional circumstances can the privacy of the home be violated. The Petitioner was also acquitted of charges.

In Taufiq Bajwa vs CDGK (2010 YLR 2165), the petitioner filed a case stating that his right to life under Article 9 of the Constitution had been violated by the boundary wall of a neighbouring park which was of such a height that it allowed a person to look inside his home. The court supported the petition and held that the park and wall must be reconstructed such that the petitioner's privacy is not violated. The case affirms that the courts interpret Article 9 ("right to life") widely enough to be used to protect the right to privacy.

In M.D.Tahir v. State Bank (2004 CLC 1680), the Lahore High Court held that the practice of collecting the private information of bank holders and presenting them to tax authorities, without any allegation of wrongdoing was a violation of the right to privacy. The State Bank of Pakistan had previously issued a directive that called for the collection, without any sustainable juridical criteria, of personal information like name, address, NTN Number and NIC Numbers of individuals who have obtained ten thousand rupees as interest. The directive was struck down and it was held that "taking of private information without any allegation of wrongdoing of ordinary people is an extraordinary invasion of this fundamental right of privacy."

Examples of data breaches

In 2010, the Shah Faisal branch of NADRA in Karachi reported a data breach in the form of a theft of "computers and other equipment", including hard drives, according to Alertboot Endpoint Security. The data breach was low-tech, and involved a physical break-in.

In 2012, a Turkish hacker claimed to have accessed NADRA's servers as well as those of the Federal Investigation Agency (FIA) by spawning backdoors. In 2014, NADRA received a report from the head of the ISI concerning the possibility of data leaks through the Pakistan government's reliance on third party companies database and verification software and hardware.

In 2017, a bug in the infrastructure of the Punjab Information Technology Board was reportedly responsible for a leak of thousands of Pakistanis' personal information, including CNIC numbers, the front and back of CNIC cards, CVs and other information.

Since at least 2014, databases have been illegally sold online. These contain hundreds of thousands of records with names, national ID card numbers, home addresses and phone numbers of mobile phone users. It is believed that this data is used primarily by mobile marketers to market their products. It is not clear how exactly this data is leaked, but it is speculated that it could be due to a combination of mobile service providers storing consumer data insecurely, as well as the possibility that employees within the companies themselves are leaking the data to those willing to purchase it. It is not clear whether the government has taken any action to combat these crimes.

In April 2018, Careem, a transportation network company which is based in Dubai, made a public statement that they had identified “a cyber incident involving unauthorised access to the system we use to store data” on 14 January 2018. Data reported to have been stolen included customers’ name, email address, phone number and trip data of 14 million users.

In May 2018, an investigation published by the news website TechJuice alleged that sensitive personal data obtained from the Punjab Information Technology Board (PITB) portal was being sold publicly. The data which was reported to have been compromised included CNIC Information, NADRA Family Tree Data, Criminal Records, Rent Tentee & Hotel Visitor Information and Offline Databases of Registered Mobile Users. The leak was condemned by civil society organisations but the PITB dismissed the leak.

In November 2018, the Federal Investigation Agency’s cyber-crime unit reported that 22 Pakistani banks experienced a mass skimming operation which took the details of nearly 20,000 credit and debit cards. The details were then sold and used to make fraudulent online purchases. It is unclear how much money was stolen in total but the Head of the FIA said that “a “large amount of money” had been stolen”.

Identification Schemes

ID cards and databases

The registration of personal data is widespread in Pakistan, and public opinion is for the most part in favour of it. This in part because recent terrorist attacks and ongoing political instability, and that many high profile news stories following these have attributed the security services' success tracking down criminals and terrorists to the storage of their information in National Database & Registration Authority (NADRA) databases.

Pakistan has one of the world's most extensive citizen registration regimes — over 96% of citizens reportedly have biometric ID cards.

In 2012 NADRA announced a so-called chip-based Smart NIC (SNIC) containing its owner's biometric photo, a computer chip, address and parental information. NADRA has said that it aims to replace all current CNICs with SNICs by 2020. A SNIC is necessary in order to open a bank account, get a new driver's licence, passport, broadband internet connection or a SIM card.

Biometric data collected by NADRA include iris scans, fingerprints (both hands), a photograph taken at a NADRA centre, and a scan of the citizen's personal signature. Given the scale of the task, NADRA has found itself at the heart of a number of controversies regarding the lack of proper checks and balances. There have been a number of reports of corruption at NADRA centres, where the biometric verification/application process can be bypassed. Serious misidentification errors can occur and forgery is rife.

In July 2016 NADRA introduced an SMS verification service, to investigate the validity of a citizen's own CNIC, as well as of those in their "family tree", i.e. anyone in their family linked to their CNIC. Although the government has declared this to be a positive step, it has come under fire as knowledge of one CNIC is enough to find out the personal information of other family members, which in turn can put them at risk. This is especially worrying in a country rife with persecution of religious, ethnic and LGBT minorities.

Voter registration

In August 2015, the Government of Pakistan's Election Commission coordinated with NADRA what they reported to be the first election via biometric verification of voters.

The election in a constituency in Haripur district was intended to be a pilot for future elections in other districts and nationwide. NADRA has indicated that this would be a positive means of tackling electoral fraud. There are concerns, however, that requiring biometric verification to vote may disqualify non-verified but legitimate voters from using the ballot. There is also the concern, as with pre-biometric registration, that the biometric verification exercise would not tackle voter intimidation effectively, and may in some instances would make it easier to intimidate voters. This is especially a concern in districts in Pakistan where votes can still be bought by village elders or landlords. In September 2017, the Election Commission also experimented with electronic biometric voting machines for NA-120 and NA-4 by-elections.

NADRA provided support to the Election Commission of Pakistan ahead of the 2018 election to verify unique voters via National Citizen Database. All unverified voters were removed, and they were not permitted to conduct a vote. It was reported that out of a number of 81 million voters, 36 million had been verified.

SIM card registration

The registration of personal data is widespread and enjoys a high level of popular support. Terrorist attacks have been cited by the government in its ongoing drive to ensure that all SIM cards are registered via biometric verification. For example, it was reported that the perpetrators of December 2014 attack on an army-run school in Peshawar in which 132 children were killed had used mobile phones with SIM cards that were registered to a woman who had no connection to any of the attackers, indicating that the SIMs had been registered fraudulently.

SIM cards must now be registered to their user. Unlike in most countries with mandatory registration, SIM cards are also biometrically verified against the National Database and Registration Authority's (NADRA) national database, often by fingerprint. The government plans to have all SIM cards biometrically verified. As of March 2015, 68.7 million SIMs had been biometrically verified out of 103 million SIMs in use at that time. Unfortunately, NADRA has not provided up to date numbers since. However, there have been reports of corruption as well as honest incompetence on the part of the verification system resulting in some SIMs escaping being deactivated. This number has been shrinking however, given the aggressiveness of the re-verification drive.

Policies and Sectoral Initiatives

Cybersecurity policy

The Prevention of Electronic Crimes Act (2016), though dealing with cybercrime in particular, has provisions that also concern "cyber terrorism". Section 10, "Cyber terrorism", states:

"Whoever commits or threatens to commit any of the offences under sections 6, 7, 8 or 9, where the commission or threat is with the intent to:

(a) coerce, intimidate, create a sense of fear, panic or insecurity in the Government or the public or a section of the public or community or sect or create a sense of fear or insecurity in society; or

(b) advance inter-faith, sectarian or ethnic hatred,

shall be punished with imprisonment of either description for a term which may extend to fourteen years or with fine which may extend to fifty million rupees or with both."

Cybercrime

The Prevention of Electronic Crimes Act (PECA) (2016) regulates cyber crime in Pakistan. The PECA establishes mechanisms by which state officers may order the retention or provision of communications data (including from operators of communications networks). While the officer is required to notify a court of these orders, the court has no role in vetting or reviewing the grounds, or of considering the necessity or proportionality of any action taken. These powers apply to communications data rather than the content of communications. Yet significant concerns remain about the bill’s implications for citizens’ privacy. Communications data allow very precise conclusions to be drawn concerning the private lives of the persons whose data has been retained, relating to personal associations, patterns of behaviour and the like, as the Court of Justice of the European Union recently noted. Pakistani civil society groups have also been actively engaging in consultation processes around the PECA, after a version of the draft bill was leaked in early 2015.

The Federal Investigation Agency (FIA), an autonomous federal institution charged with investigating terrorism, federal crimes as well as electronic crimes. Its National Response Centre for Cyber Crimes (NR3C) was established in 2002, but it was not until the promulgation of the Prevention of Electronic Crimes Ordinance (PECO), that the agency gained greater legislative powers to investigate, prosecute and control electronic crime, report the Pakistani civil society group Bytes for All.

The Punjab Protection of Women Against Violence Act (2016) also makes a one-line mention of cybercrime as contained within the definition of "violence" that the Act criminalises.

In February 2018, the government included in the proposed budget for the fiscal year 2018-2019 the establishment of the Cyber Patrolling Unit whose creation was approved on 16 January 2018 by the Departmental Development Working Party (DDWP). The Unit is to consist of personnel of Federal Investigation Agency (FIA) who will be responsible for tackling child pornography as it has been mandated to do so by the Prevention of Electronic Crimes Act (2016). It was reported that the Unit would be integrated with the National Database and Registration Authority (NADRA) and the Pakistan Telecommunication Authority (PTA).

Encryption

Encryption in the form of Virtual Private Networks (VPNs) and encrypted messaging apps is illegal in Pakistan, ostensibly for security reasons as, according to the Pakistan Telecommunications Authority, these "conceal communication to the extent that prohibits monitoring".

If a company or individual wishes to use encryption without being penalised, a formal request must be sent to the PTA and accepted. In 2015 Blackberry and its encrypted messaging service, Blackberry Messenger (BBM) were banned and asked to leave Pakistan, as Blackberry would not hand over access to its user base and servers. Blackberry was permitted to stay, although the details of the agreement have not been made public. The popularity of messaging apps that are encrypted by default, such as WhatsApp, or Apple's FaceTime and VPN services, have made enforcement of this ban on encryption difficult to impossible to implement. According to reports, however, certain messaging and VOIP services may eventually require a license to operate in Pakistan. It is extremely difficult to see how this would be implemented. There is concern that Pakistan may emulate the United Arab Emirates and Saudi Arabia, both of which have blocked WhatsApp voice calls and FaceTime calls.

Licensing of industry

The Pakistan Telecommunication Authority (PTA) is the main regulatory and license-issuing body overseeing the internet and telecom industry in Pakistan. It also promotes the spread of internet and telecommunication services and makes recommendations on matters of policy. The PTA has been given authority to monitor internet traffic when required by law and has also been given responsibility, according to Section 34 of the Prevention of Electronic Crimes Act (2016), to block “objectionable” content. The PTA chairman and members are appointed by the federal government and it reports to the Ministry of Information Technology and Telecommunication, according to the Pakistan Telecommunication (Re-organization) Act (1996).

The PTA has also been given the ability to issue policy directives. An example of this is the 21 July 2011 directive that called for the banning of encryption mechanisms except on a case by case basis, provided a formal request has been made to the PTA.

Freedom House's 'Freedom on the Net' index mentions that international human rights organisations, free expression groups and experts have expressed reservations about the PTA’s governance structure, openness, and independence as a regulatory body. Freedom House cite "the repeated failure to make new appointments" to the PTA, following a number of reservations over the transparency of the appointment process.

In terms of blocking and filtering content, the authority relies primarily on maintaining a blacklist of URLs that are blocked at both the internet exchange point (IXP) through the Pakistan Internet Exchange (PIE) and by the internet service providers (ISPs). A 2013 report by the Citizen Lab revealed that PTA has been using Canadian company Netsweeper's technology for blocking and filtering online content.

Communications Service Providers

There are at least 50 operational internet service providers (ISPs) in Pakistan. These include Pakistan Telecommunication Company Ltd (PTCL). It was reported that the overall bandwidth in Pakistan ranges around 130,000 Mbits through four undersea cables – three controlled by Pakistan Telecommunication Company Ltd (PTCL) and one by Transworld Associates (TWA). As of June 2017, a new submarine cable, the AAE-1 (also called Asia-Africa-Europe-1) cable, has been servicing Pakistan. PTCL, an ISP which is partly owned by the government, also operates the Pakistan Internet Exchange (PIE) which facilitates most of the internet traffic exchange between ISPs inside and outside the country. PIE was created in 2000 to provide a single backbone for Pakistan by providing peering points for ISPs.

As of 2017, there are four cellular mobile service providers operating in Pakistan: Mobilink/Jazz/Pakistan Mobile Communications Limited (PMCL) (owned by VimpleCom Ltd), Warid (merged with Mobilink by VimpleCom in 2015), Ufone/Pak Telecom Mobile Limited (owned by Etisalat), and Zong Pakistan (owned by China Mobile Pakistan). Apart from Mobilink, the rest are owned by foreign service providers (Telenor, however, retains a 42.95 % share in VimpleCom Ltd).

A fifth provider, the Special Communication Organisation (SCO), is owned by the Government of Pakistan, and offers cellular services. In October 2017, the National Assembly Standing Committee on Information Technology approved a proposal to allow the SCO to operate commercially and compete with the private telecom operators nationwide. The SCO previously had primarily been responsible for providing communications services in the northern Azad Jammu & Kashmir and Gilgit Baltistan regions bordering India. Describing itself as a "public sector organization working under Ministry of IT", the SCO has an unclear relationship to the Pakistan Army, with some reports describing the SCO as a subsidiary of the Pakistan Army.

Nationwide fiber-optic framework

The Pakistani government appears to be engaged in a "radical overhaul" of Pakistan’s communications network infrastructure facilitated by the Long Term Plan (LTP) for a China-Pakistan Economic Corridor (C-PEC).

According to a roadmap document covering the period 2013-2015 seen by Dawn, a critical component of the partnership between the two countries is a new, upgraded fibre optic cable network which connects Pakistan directly with China via central Asia. The revelation about the proposed network raised security concerns that internet traffic could potentially be monitored by China.

E-governance/digital agenda

Over the past two decades, the federal government has laid out several plans and initiatives to promote the use of digital technologies in government services, including:

the National IT Policy and Action Plan of 2000;
the Electronic Government Directorate of 2002;
the promulgation of the Electronic Transaction Ordinance in 2002, to facilitate the use of electronic documents for official purposes;
the E-Government Strategy and 5-Year Plan for the Federal Government, published in 2005;
the National Information Technology Board, created in 2014 by merging the Electronic Government Directorate and the Pakistan Computer Bureau;
the announcement in 2014 that an e-government master plan is being formulated;
the announcement of the E-office initiative in 2015; and
the announcement that Pakistan joined the Open Governance Partnership (OGP) in December 2016, work on National Action Plan still in progress.

However, the implementation of these plans and initiatives has been haphazard and unsustained due to political and other reasons. The official e-government portal, pakistan.gov.pk has been neglected in the past. The current form of the portal lists links to other government websites and pages to assist users in finding information related to government services. A large portion of those links are broken.

The quality of the websites of individual ministries and departments varies greatly depending on the enthusiasm and resources of the leadership of those departments at any given time. Most of the federal government websites do not use HTTPS/SSL, however, increasingly, those sites offering services that require users to log in to an account such as the Federal Board of Revenue's Taxpayer Facilitation Unit or the National ID card online application website are now using SSL.

The e-government services offered by the provincial governments vary in the same way. For example, the web portals of the governments of Punjab and Khyber-Pakhtunkhwa are better maintained with up to date information and the former also uses secure data protocol HTTPS/SSL.

All e-government services such as filing taxes or filing a complaint with an ombudsperson require users to provide their national identity card numbers.

Health sector and e-health

Privacy International is not aware of any specific privacy issues related to the health sector and e-health in Pakistan. Please send any tips or information to: research@privacyinternational.org

Smart policing

The Punjab government introduced "Hotel Eye Software" to link 500 hotels and guest houses with the database of Criminal Record Office. Information of all guests staying at the hotels and guest houses will automatically will be sent to the database to identify criminals. Other cities of the province will also be brought in the scope of this project. [See also section on 'Smart cities' below']

Transport

The National Database and Registration Authority (NADRA), the government body responsible for issuing national identity cards, also offers an e-Vehicle Management System to other government departments and the private sector to make it easier for them to identify and track the movement of vehicles using RFID chips. The services offered by this system are:

The ability for government authorities to identify and track the movement of vehicles as they pass through road checkpoints;
The ability to identify a vehicle for the purpose of controlling access to a secured premises through designated gates; and
A way for road and highway authorities to quickly collect tolls from drivers through an electronic credit mechanism.

It is not clear if these services use NADRA's national registration database for identification and what security provisions are in place to control access to the data.

Motorway e-tags and m-tags

One of the places where this service has been deployed is on a number of motorways connecting Islamabad, Lahore and Peshawar (M-1, M-2, M-3, M-4). Drivers on these roads have the option of installing and RFID in their windshield which automatically deducts the toll fee from a pre-paid account each time they pass through a toll gate. Registering for this system requires drivers to provide their national identity card number.

Originally, tolls on the M-1, M-2 and M-4 were collected by the National Highways Authority (NHA) under the Ministry of Transportation using NADRA's e-tag system. However, since 2016, the tolls on all four motorways are collected by the Frontier Works Organization, an administrative branch of the Pakistan Army, using their own "m-tag" system that also uses RFID chips.

It was also reported in February 2016 that the NHA is considering other toll payment options such as the use of mobile phone or credit cards.

Metrobus

The metrobus mass transit systems implemented by the Punjab Government in Lahore, the twin cities of Islamabad and Rawalpindi and Multan also use RFID chips to track the distance traveled by riders. Travelers have the option of purchasing either a single-use plastic RFID token for single-rides or a pre-paid RFID-base card for multiple trips. Travelers do not need to provide their national identity card number for either, and the only data needed is the traveler's first and last name in the case of the multiple-use card.

Ride-sharing apps

Various ride-sharing apps are being used in Pakistan. The main two are Careem, a company based in Dubai, United Arab Emirates, with operations in around 50 cities in the Middles East, South Asti and Africa, and Uber, a USA-based company with operation in 570 cities worldwide.

A detailed study published in January 2019 by Digital Rights Foundation on the practices of Uber and Careem in the country, highlighted the need for better complaints mechanisms and security procedures, which are particularly necessary from a gender perspective and the specific impacts that such policies have over women. They also found that both companies’ privacy policies lacked basic guarantees such as data breach disclosures and contain unspecified data sharing provisions, among other flaws.

Smart cities

The federal government, through National Database and Registration Authority (NADRA) and Chinese company Huawei has implemented the country's first ever smart city project, the Punjab Safe City project, in Islamabad and Lahore in 2016. Islamabad would receive 2,000 high-powered CCTV cameras enabled with Intelligent Video Surveillance technology, while the number of cameras for Lahore would be 8,000. The technology has facial recognition capabilities, and the network is integrated with NADRA's central database of the citizens containing other biometric data.

The Sindh government has also announced a Safe City Project for the country's financial hub and largest city Karachi. The Khyber-Pakhtunkhwa government has also been implementing a Safe City Project in Peshawar city. The Baluchistan government has also announced to implement a Safe City Project in Quetta and Gwadar.

Migration

In August 2017, the Ministry of State and Frontier Regions, and Afghan Commissionerate in collaboration with Afghan government Ministry of Refugees and Repatriations and the United Nations High Commissioner for Refugees (UNHCR) started registration of Afghan refugees across Pakistan. NADRA registered 2.8 million Afghan refugees and issued cards to 1.6 million of these. Around 840,000 refugees were repatriated to Afghanistan from Pakistan.

Emergency response

Privacy International is not aware of any privacy issues related to emergency response in Pakistan. Please send any tips or information to: research@privacyinternational.org

Humanitarian and development programmes

During military operations in tribal areas, the Federally Administered Tribal Areas (FATA) Disaster Management Authority in support of NADRA launched a campaign to verify citizens' identities to access emergency recovery support. Verification was subject to clarification by NADRA's citizen data and biometric verification. A Livelihood Support Grant and Child Wellness Grant have been established to help temporary displaced persons of FATA.

Social media

The government periodically launches crackdowns against social media. In May 2017, Interior Minister Chaudhry Nisar Ali Khan stated that anti-army content on social media would not be tolerated. The Federal Investigation Agency (FIA) has summoned several social media activists and questioned them. Some of them have also been charged under defamation clauses of PECA and Penal Code of Pakistan.

Blasphemy

Blasphemy is illegal in Pakistan; this is frequently given as a justification for increased online surveillance.

Anti-terrorism court in Pakistan sentenced a 30-year-old man, Taimore Raza, to death in June 2017 for publishing blasphemous content on social media. In another case, a Christian was sentenced with life imprisonment in September 2017 for sending blasphemous text messages. Another anti-terrorism court indicted four suspects for committing blasphemy on social media.

The government of Pakistan has sought to block Facebook pages and Twitter accounts, and obtain information on those accounts' owners. In March 2016, a Pakistani man was given a 13 year prison sentence for allegedly posting "religiously offensive material" on Facebook. Blasphemy carries either the death penalty, life or an extended prison sentence.

Between July and December 2016, according to Facebook's Global Government Requests Report, the Pakistan government had made a total of 1,002 requests for account information, with 67.56% of those requests resulting in "some data" being produced. Facebook also restricted access to 6 items of content "alleged to violate local laws prohibiting blasphemy and condemnation of the country's independence".

List Icon (DO NOT USE)

List Image (DO NOT USE)

Location

Pakistan

Related learning resources

State of Privacy

More about our partner

Bytes for All

Content

Reports

Change

We uncover and expose

Summary

A study of privacy and surveillance issues in Pakistan. The State of Privacy project was last updated on January 2019, unless otherwise provided on specific pages.

Identity Policies: The Clash Between Democracy and Biometrics

melissab — Tue, 30 Jan 2018 17:24:59 +0000

Identity Policies: The Clash Between Democracy and Biometrics melissab Tuesday, January 30, 2018

To celebrate International Data Privacy Day (28 January), PI and its International Network have shared a full week of stories and research, exploring how countries are addressing data governance in light of innovations in technology and policy, and implications for the security and privacy of individuals.

According to the World Bank, identity “provides a foundation for other rights and gives a voice to the voiceless”. The UN Deputy Secretary-General has called it a tool for “advancing legal and political rights”.

Yet, if identification is such a boon, we would expect to see the democratic process interrogating the system, giving individuals and communities the opportunity to be consulted and to fully highlight the issues, and that the kinks would be ironed out before implementation.

But, as the work conducted by Privacy International and its international partners show, this is not the case. We see identity systems pushed through by decree, diktat, or through means that allow less democratic accountability, denying the systems a mandate. We see the uses of biometrics expand beyond their original purpose, being used for purposes and contexts beyond their original uses. We can see the private sector, too, using these systems to link together pieces of identity, to learn more and more about people’s lives.

In many cases, identity systems are not a tool for protecting rights: they are a means by which the powerful exercise their control, often over vulnerable or under-served population.

Democracy and Biometrics In Argentina

Identity systems, particularly national identity systems, are often introduced without the firm and rigorous debate that such a major measure deserves. For example, consider the case of the Federal Biometric Identification System for Security (SIBIOS) in Argentina, introduced in 2011. SIBIOS is a database that contains the biometric details (in this case, fingerprints, palm prints, and photographs) of much of Argentina’s population. As outlined in the decree that established the system, the goal of this system is public security and crime prevention.

However, despite SIBIOS being a major project with serious implications for privacy in Argentina, it was not introduced through a debate in congress. Rather, this was introduced by decree 1766. By introducing it in this manner, essential debate on the issues was bypassed. With the decree only vaguely highlighting the goals and need for such a system — the “essential protection of the right to security” — it becomes impossible to both understand the need for such a system, as well as evaluate its effectiveness.

As our partners from the Asociación por los Derechos Civiles (ADC) argue, “the decree seems to be based on the logic of identifying individuals effectively and easily through biometric technology, not because it is the best solution for the concrete security need, but because it is available. When the legislative debate is bypassed, one loses perspective about the safeguards that must be in place to guarantee the exercise of human rights.”

Read: The Identity we Can’t Change

Updated: State of Privacy Argentina

Function Creep: NADRA In Pakistan

Concerns about identity systems are multiplied by the tendency of “function creep”: identity systems being used for more and more uses, beyond their originally-stated goals and purpose. An example of this is the system maintained by the National Database and Registration Authority (NADRA) in Pakistan, a further example of a biometric system being introduced without a debate over its efficacy.

The NADRA database contains fingerprints and photos for facial recognition. The ordinance that codified NADRA in 2000, at a time when Pakistan was under military rule, was to establish “an improved and modernized system of registration in the country”. As analysed in an upcoming publication by our partner Bytes for All, the establishment of this database risks the erosion of the right to privacy.

The uses of this database have expanded more and more. In 2014, NADRA’s database was linked to SIM card registration, which is of dubious value in fighting terrorism. Similarly, having a database of photographs, like with NADRA, leads the way to facial recognition systems: indeed, this is the case with the Safe Cities project. This is an initiative in several major cities in Pakistan that employs high-resolution CCTV cameras, making use of the NADRA database combined with the tracking of GPS and SIM/IMEI data.

As these systems become utilised in new and different ways, and as the tools and power to analyse biometrics are enhanced, then the data collected can be used for many new and intrusive purposes. When the initial data collection is conducted without a legal framework that can address potential future abuses, this behaviour by the state can continue unabated.

Updated: State of Privacy Pakistan

Identity and the Private Sector

It is not only the public sector in which this function creep occurs: the private sector, too, can embrace the power of an identity database. For example, the Indian Aadhaar biometric database of 1.3 billion people has not only been a source of increasing function creep in the public sector; it also has an increasing role in the private sector as well. Aadhaar is now used for an increasing amount of purposes, from dating sites through to the financial services sector. Nowadays almost everything is linked to an individual’s Aadhaar number.

In the financial sector, this means that more and more sources of data are used to make decisions on issues like credit scoring. This leads to the construction of a financial identity, that is then used to judge the individual’s worthiness for financial services. Privacy International recently published a report on this sector, based on fieldwork not only in India but also Kenya.

As Nandan Nilekani, former chairman of the Unique Identification Authority of India wrote, “as data becomes the new currency, financial institutions will be willing to forego transaction fees to get rich digital information on their customers.” Much of that data links back to the single Aadhaar number, enabling private enterprises to link together multiple data sources to build a more detailed picture of people’s lives. Just as identity systems enable the state to know more about our lives, so too must we be cautious about their use in the private sector.

Updated: State of Privacy India

Conclusion

While states’ implementation of identity systems varies across the world, we can see emerging themes: identity systems introduced without a proper democratic process, expanding in scope in both in the public and private sectors. For something as intrinsically personal as identity, and with identity systems so open to potential abuse, the lack of democratic debate and accountability is concerning. Identity systems are claimed to be a useful a tool for security, and are an empowering tool for citizens to make claims from the state. But, rather than empowering people and making them safer, a lack of accountability and control means that they become disempowering.

Learn more

Identity

What PI is fighting for

Develop Protections Against Data Intensive Systems in the Global South

Our fight

Challenging Corporate Data Exploitation

Location

More about our partner

Bytes for All

La Asociación por los Derechos Civiles

Content

News and Analysis

Reports

Data and Control: Protecting Rights, Protecting People

melissab — Mon, 29 Jan 2018 17:40:48 +0000

Data and Control: Protecting Rights, Protecting People melissab Monday, January 29, 2018

At the core of data protection debates, there is a power play between empowering individuals to control their data and empowering those who use (or want to) use their data.

By regulating data processing it provides avenues for individuals to exercise their rights if there is any unlawful interference in this power play.

If there is no regulation, or if it is weak, inefficient or abused, personal data turns into yet another mechanism for those in power to exert and retain control of our data, and ultimately many aspects of our lives.

In the face of powerful actors, including the state, the private sector and other entities, people might feel powerless and feel a degree of resignation about how their data might be used and indeed misused. As individuals, we are being increasingly embedded, by design — not by choice — into ever-more data-intensive systems, be it the obligations to be enrolled in a mass biometric identification system to access welfare services, through to facing increased scrutiny of your identity to access from financial services.

But data protection, if well-regulated and enforced, can give us power and protection. A few days ago, as we celebrated Data Privacy Day 2018, we welcomed the fact that there are now 126 countries worldwide which have comprehensive data protection laws.

Unfortunately, the reality of the current legal and regulatory frameworks, as explored by the Privacy International Network, tells a different story. There are still many countries across the world that have yet to adopt comprehensive data protection frameworks and of the 126 that have one, many experience challenges with upholding and enforcing the highest data protection standards and need to be reformed. The majority of countries that are yet to adopt or improve their data protection frameworks are having to do so in a context of weak democratic institutions and limited rule of law, and yet they are the biggest consumers, adopters and testers of innovations in technology and policy.

Governments and private companies alike tend to frame regulation of their data intensive activities as impediments and burdens to their businesses and their profits. Any meaningful restriction to those activities tend to be portrayed as an unnecessary obstacle to achieving economic development, stability and order, or even national security. Protecting our rights over our data has yet to make it to the top of their priorities. Maybe some day.

Countries such as Argentina, India and Pakistan manage some of the largest biometric databases in the world. Others like Paraguay and Chile are implementing biometric border management systems, and Lebanon is starting to implement a smart city programme. These are only some of the many examples we have been documenting.

Yet, only half of these countries have comprehensive data protection frameworks. The other half need to urgently reform their legislation, as they fail to comply with basic data protection and privacy standards.

As outlined in various research produced by the Privacy International Network and showcased this week, there is a need to initiate legislative processes to adopt comprehensive data protection frameworks, and to reform those that already exist.

Laying Down The Foundation For Reform

Research conducted by TEDIC into nine public databases revealed that public servants in Paraguay have a poor understanding about the processing of their personal data and the measures they should be taking to protect that data. Such findings call into question the effectiveness of Paraguay’s legislation on data protection and support the need for reform to address its many loopholes.

Similarly, there is a need for reform in Chile and Argentina, both countries that have data protection laws. Research by Derechos Digitales and the Asociación por los Derechos Civiles illustrates how each respective legal framework is outdated and ill-equipped to face current and emerging data protection and privacy issues, such as the use of biometric technology and drones. This means that they are failing to provide the necessary protections to guarantee and secure individuals’ power to control their data. On the contrary, the half-hearted effort actually puts people at risk, as they are encouraged to trust in a flawed system to protect them.

Preparing For A Legislative Process

In research produced by SMEX about the current legal and policy landscape on data protection in Lebanon, they reveal that the personal data of Lebanon citizens is vulnerable to being unlawfully accessed and leaked due to the absence of a comprehensive data protection law, which would impose obligations on data processors and controllers. Currently there is little or no recourse for the victims of those data breaches and leaks.

The Centre for Internet and Society (CIS) has been at the forefront of the data protection debate in India, working for almost a decade to inform policy-makers of the need for such a law in India. With its population of 1 billion people, the Indian government has created the largest biometric database — Aadhaar — in the world. In addition to exploring issues around Aadhaar, CIS has been re-thinking, questioning and exploring internationally recognised data protection principles to understand their potential and limitations for the Indian context.

Similarly, in Pakistan, where discussions for a data protection law have been long running, Bytes for All (B4A) has been exploring the main privacy and data protection issues such as biometrics, particularly in relation to the National Database & Registration Authority (NADRA). Similar to the situation in India, civil society organisations in Pakistan have been considering what the best regulatory mechanisms would be.

Escalating Our Work To New Spaces

Over the course of our work with our international network on data-intensive systems, Privacy International also engaged with stakeholders, nationally and internationally, around the question of data protection across the world. We raised awareness about the need for the above subjects to be addressed as human rights issues by attempting to integrate them within the UN human rights monitoring mechanisms such as the Universal Periodic Review under the ambit of the Human Rights Council as well as the Human Rights Committee which oversees the implementation of the International Covenant on Civil and Political Rights. In 2017 we welcomed the recommendations made by the Human Rights Committee that Pakistan should adopt a comprehensive data protection law in line with international standards.

We also engaged with the national data protection authorities on reform of the law in Argentina and mechanisms for effective enforcement in The Philippines. In countries like Brazil, Uganda and Indonesia we have been engaging with CSOs to advocate for the adoption of data protection laws that are currently absent. Recognising the role of international entities and regulators, we have also monitored and where possible engaged with the work of the Council of Europe, the Association of Francophone Data Protection Authorities as well as the 39th International Conference of Data Protection and Privacy Commissioners.

The diverse work carried out by PI and our international network of partners highlight a wide range of urgent reforms that are needed in existing regulatory and legal frameworks on data protection, and indeed highlight the need for protections to be introduced where there are currently none — all to ensure that the individual can retain control of their data.

For further information on the State of Privacy across the world, we invite you to refer to the collaborative research project produced by the Privacy International Network.

Learn more

Data Protection

What PI is fighting for

Develop Protections Against Data Intensive Systems in the Global South

Location

More about our partner

SMEX

Bytes for All

Centre for Internet and Society

La Asociación por los Derechos Civiles

La Asociación de Tecnología, Educación, Desarrollo, Investigación, Comunicación (TEDIC)

Our impact

Building the Global Movement

Our campaign

Enhancing Data Protection Standards

Content

News and Analysis

Reports

We've come a long, long way together: building coalitions around the right to privacy

melissab — Thu, 29 Oct 2015 13:47:09 +0000

Language English

Photo: Flickr/Elvert Barnes. Some rights reserved.

In the wider civil society space, the opportunities for travel come thick and fast. From the multi-stakeholder perspective, the Internet Governance Forum will be held during November in João Pessoa, Brazil. There is the Stockholm Internet Forum in, naturally, Stockholm. In freedom of expression there is the International Freedom of Expression Exchange Strategy Conference in Trinidad & Tobago, while End Violence Against Women International's conference will be held in Washington in March 2016. What doesn't happen often is an opportunity for these weary travellers to meet in one place and discuss their backgrounds, their similarities, their differences. This is what excites me about the upcoming World Forum for Democracy , which will be organised by the Council of Europe in Strasbourg on 18-20 November 2015. It will be an occasion to meet new people, to bring more minds to think about how surveillance affects their work as well as them as individuals within our and their society, and to discover what the right to privacy means to them.

Building coalitions working on surveillance has reached a new stage. We now have a strong international network of organisations from diverse countries already representing an impressive array of stakeholders across disciplines. That took time and effort to build. The next phase is to push even further the diversity in background and discipline of organisations engaged in these debates as we advocate for the protection of the right to privacy as a fundamental human right.

NSA/GCHQ who?

While the focus of privacy and surveillance in the media has been on the deeply important Edward Snowden revelations, building a global network has provided an opportunity to move away from the simplified nexus of NSA and GCHQ. Casting an eye around the world we see organisations making gains in elevating their national discourse around privacy and pushing governments to make changes. In Pakistan, a successful challenge against the dangerously bad Prevention of Electronic Crime Bill because of its lack of inclusion of civil society in the debate led to the postponement of the bill and a consultation with the previously frozen out groups. Alongside this, exposing Pakistan's Inter-Security Intelligence agency's proposal for a mass surveillance system helped to drive national debate on what is a proportionate interference with the right to privacy, which involved local groups such as the Digital Rights Foundation, Bytes 4 All and Bolo Bhi.

In Colombia, the release of two investigative reports into the shadowy world of intelligence agencies has provided organisations in the country with the opportunity to question their own representatives about their knowledge of surveillance capabilities. A meeting of the intelligence commission, the committee that oversees the work of Colombian intelligence agencies, in early October was too coincidental to not have been influenced by the work of organisations like the Karisma Foundation in beginning discussions with lawmakers directly and delivering the reports to the relevant stakeholders.

Only five years ago, these stories of civil society stirring debates on privacy and national security wouldn't have been possible.

It has taken years for this global network to form. Privacy International began the conversation through work in Asia in mid-2008. This is often referred to as the first time that the right to privacy had been discussed with organisations in the region, such as the Centre for Internet and Society in India, or the Foundation for Media Alternatives in the Philippines. Those first conversations have come a long way, as shown by the development of initiatives like the International Principles on the Application of Human Rights to Communications Surveillance, which has been signed by 420 organisations from around the world, as well as the expansion of Privacy International across continents from Latin America to Africa and Asia.

Discovering new allies

Establishing this global network required the identification of an ideal type of partnering organisation. It was to be either engaged in research or activism, with a focus on policy relating to modern forms of communication like the internet. An interest in law, the state, and the effect of the private sector helped too. Now, this ideal type is being rewritten, expanded with new characteristics.

Coalition development is in a new phase. Groups outside of the field of internet governance and 'digital rights' are now becoming involved in the debate about privacy and surveillance. In Britain, the role of organisations focused on victim support and child protection are starting to taking an active role in the discussions about the forthcoming Investigatory Powers Bill, which will spell out the powers of the security services to conduct surveillance and associated safeguards. Other civil society actors will be represented in the coalition Don't Spy On Us, which includes organisations such as Privacy International, Open Rights Group, Liberty, Big Brother Watch, Article 19 and English PEN, and which has helped to expand the base of participants in the discussions.

Journalist groups have been growing in their presence also. Press Gazette's Save Our Sources campaign focused on the protection of the anonymity of sources after the unlawful use of the Regulation of Investigatory Powers Act to identify the source of a story from The Sun. The National Union of Journalists has also been running a campaign on these issues for over a year.

The global network has continued to expand its address book too. In Chile, Derechos Digitales has been reaching out to indigenous communities threatened with displacement from their land to discuss the effect surveillance has had on their work. Meanwhile, in South Africa, the Right 2 Know Campaign published a series of case studies on the harassment of various activists, community leaders, think tanks and local unions by intelligence agencies.

These past few years have shown groups from different professional backgrounds and operating at different scales, either nationally or internationally, have become more engaged in the topic of surveillance. This is both a natural and a necessary development. As our lives are increasingly dependent upon the use of technology to communicate, and the devices we carry broadcast information about us even when we are not using them, the discussion on privacy and surveillance needs to reach all areas of society.

The idea to be presented at the World Forum for Democracy is built on the back of this international movement. Currently, national jurisdictions around the world make a distinction between the communications of a national and those of a non-national, and afford them with different human rights protection. In our increasingly interconnected world, this distinction is a big hurdle to the realisation of a meaningful right to privacy, without discrimination. By introducing a right to privacy through interference based jurisdiction – where states owe a negative obligation not to interfere with a person’s communication – our right to privacy will travel with the communications we send.

The success of this idea requires a worldwide, international movement with diverse voices, who will work towards this change using the skills and experiences acquired in their own work, whether that is through strategic litigation, policy development or community organising. All skills and approaches have a role to play in realising the right to privacy across the world.

As I look at the programme for the World Forum for Democracy, and at the different Labs to be held, I see an opportunity to continue to expand this coalition, as well as to learn from other groups’ experiences of building similar movements. Labs organised by interfaith, intercultural, or anti-hate groups bring together people that Privacy International would not normally cross paths with. Meeting new ideas and perspectives on how to achieve change – this is where creativity sparks.

The past few years have exposed Privacy International’s area of work to different cultures, different contexts and different challenges. It has been for the better. The participation of PI, along with some of its partners, in the World Forum for Democracy appears set to carry on this trend.

Large Image (DO NOT USE)

List Image (DO NOT USE)

List Icon (DO NOT USE)

What PI is fighting for

Develop Protections Against Data Intensive Systems in the Global South

Learn more

Privacy

Data Intensive Systems

Location

More about our partner

Foundation for Media Alternatives

Digital Rights Foundation

Derechos Digitales

Fundación Karisma

Bytes for All

Our impact

Building the Global Movement

GCHQ-NSA intelligence sharing unlawful, says UK surveillance tribunal

staff — Fri, 06 Feb 2015 15:47:23 +0000

GCHQ-NSA intelligence sharing unlawful, says UK surveillance tribunal

Language English

staff Friday, February 6, 2015

British intelligence services acted unlawfully in accessing millions of people’s personal communications collected by the NSA, the Investigatory Powers Tribunal ruled today. The decision marks the first time that the Tribunal, the only UK court empowered to oversee GHCQ, MI5 and MI6, has ever ruled against the intelligence and security services in its 15 year history.

The Tribunal declared that intelligence sharing between the United States and the United Kingdom was unlawful prior to December 2014, because the rules governing the UK’s access to the NSA’s PRISM and UPSTREAM programmes were secret. It was only due to revelations made during the course of this case, which relied almost entirely on documents disclosed by NSA whistleblower Edward Snowden, that the intelligence sharing relationship became subject to public scrutiny.

The claimants in the case are Privacy International, Bytes for All, Liberty, and Amnesty International.

In a previous December 2014 ruling, the IPT held that GCHQ’s access to NSA data was lawful from that time onward because certain of the secret policies governing the US-UK intelligence relationship were made public during Privacy International’s case against the security services. Yet that belated disclosure could not remedy the lack of transparency regarding the UK-US sharing prior to December 2014, meaning that all UK access to NSA intelligence material was unlawful before the Court’s judgement.

In light of today’s ruling, Privacy International and Bytes for All will now ask the court to confirm whether their communications were unlawfully collected prior to December 2014 and, if so, demand their immediate deletion.

While we welcome today’s decision, Privacy International and Bytes for All disagree with the tribunal’s earlier conclusion that the forced disclosure of a limited subset of rules governing intelligence-sharing and mass surveillance is sufficient to make GCHQ’s activities lawful as of December 2014. Both organisations will shortly lodge an application with the European Court of Human Rights challenging the tribunal’s December 2014 decision.

While that appeal is pending, GCHQ will retain unfettered access to this material intercepted by the NSA. The two agencies by default share intelligence gleaned from PRISM and UPSTREAM, sometimes with few or no safeguards. Secret policies divulged during Privacy International’s case revealed that British intelligence services can request or receive access to bulk data from foreign agencies like the NSA without a warrant whenever it would "not be technically feasible" for the government to obtain it themselves.

PRISM and UPSTREAM, which have been in existence for nearly a decade, were made public in June 2013 by NSA whistleblower Edward Snowden. Through PRISM, the NSA has gained access to the data and content handled by some of the world’s largest Internet companies, including Microsoft, Yahoo, Google, Facebook, PalTalk, AOL, Skype, YouTube and Apple. With UPSTREAM, the NSA intercepts bulk data via fibre optic cables that carry the world’s communications. The scope of this surveillance is unprecedented. For instance, the top five programmes within UPSTREAM created 160 billion interception records in one month. In one day, the NSA was able to collect 444,743 e-mail address books from Yahoo, 105,068 from Hotmail, 82,857 from Facebook, 33,697 from Gmail and 22,881 from unspecified other providers.

Eric King, Deputy Director of Privacy International, said:

"For far too long, intelligence agencies like GCHQ and NSA have acted like they are above the law. Today’s decision confirms to the public what many have said all along — over the past decade, GCHQ and the NSA have been engaged in an illegal mass surveillance sharing program that has affected millions of people around the world.

We must not allow agencies to continue justifying mass surveillance programs using secret interpretations of secret laws. The world owes Edward Snowden a great debt for blowing the whistle, and today's decision is a vindication of his actions.

But more work needs to be done. The only reason why the NSA-GCHQ sharing relationship is still legal today is because of a last-minute clean-up effort by Government to release previously secret “arrangements”. That is plainly not enough to fix what remains a massive loophole in the law, and we hope that the European Court decides to rule in favour of privacy rather than unchecked State power."

Shahzad Ahmad, Country Director, Bytes for All, Pakistan, said:

"IPT's pro-people decision sets a wonderful precedent for future rulings not only for UK courts, but also for developing countries like Pakistan which look up to developed countries for policy-making. The ruling also proves that no authority, including the military and intelligence, is beyond the purview of law, and in countries where this is not the case, the scope of law needs to be improved."

Mark Scott of Bhatt Murphy Solicitors said:

“Had Edward Snowden not made his disclosures and had our clients not pursued this litigation we can only wonder whether the security services would ever have disclosed their mass surveillance operations. However, this is only a partial victory and the litigation must now proceed to the European Court.”

James Welch, Legal Director for Liberty, said:

“We now know that, by keeping the public in the dark about their secret dealings with the National Security Agency, GCHQ acted unlawfully and violated our rights. That their activities are now deemed lawful is thanks only to the degree of disclosure Liberty and the other claimants were able to force from our secrecy-obsessed Government.

But the Intelligence Services retain a largely unfettered power to rifle through millions of people’s private communications – and the Tribunal believes the limited safeguards revealed during last year’s legal proceedings are an adequate protection of our privacy. We disagree, and will be taking our fight to the European Court of Human Rights.”

Timeline of PRISM and TEMPORA disclosures

6 June 2013: Washington Post and Guardian reveal PRISM

21st June 2013: Guardian reports on TEMPORA

8th July 2013: Privacy International files legal challenge against UK government over mass surveillance programmes

9th January 2014: Pakistan based partner organisation, Bytes for All for all joins legal challange

14th February 2014: Directions hearing to agree issues to be decided takes place

16th June 2014: GCHQ forced to reveal secret policy for mass surveillance of residents’ Facebook and Google use

13th July 2014: Week-long hearing considering the legal regime of TEMPORA and NSA intelligence sharing begins

28th October 2014: Secret policy reveals GCHQ can get warrantless access to bulk NSA data

5th December 2014: IPT decides Tempora, and as of 5th Dec, intelligence sharing between NSA and GCHQ is in principle lawful.

Location

United Kingdom

United States of America

Pakistan

What PI is fighting for

Regulate Intelligence Sharing: Intelligence Agencies’ Mass Transfer of Data Globally

Modernise the Rule of Law and Strengthen Surveillance Safeguards

Our fight

Contesting Government Data and System Exploitation

Learn more

Mass Surveillance

Communications Surveillance

Intelligence Sharing

Image (DO NOT USE)

More about our partner

Bytes for All

Our impact

Fighting Mass Surveillance in the Post-Snowden Era

Our legal action

10 Human Rights Organisations v. United Kingdom

Target Profile

UK Intelligence Agencies

Change

We demand change and litigate

Content

News and Analysis

Pakistani government advertises for bids to build national firewall capable of blocking up to 50 million websites containing "undesirable content"

staff — Thu, 23 Feb 2012 12:08:58 +0000

Pakistani government advertises for bids to build national firewall capable of blocking up to 50 million websites containing "undesirable content"

Language English

staff Thursday, February 23, 2012

In an advertisement placed in national newspapers yesterday (23rd February), the National ICT R&D Fund of Pakistan (which operates under the auspices of the Ministry of Information Technology) requested proposals for "the development, deployment and operation of a national level URL Filtering and Blocking System". Further information provided on the Fund's website stated:

"Internet access in Pakistan is mostly unrestricted and unfiltered...Many countries have deployed web filtering and blocking systems at the Internet backbones within their countries. However, Pakistani ISPs and backbone providers have expressed their inability to block millions of undesirable web sites using current manual blocking systems. A national URL filtering and blocking system is therefore required to be deployed at national IP backbone of the country."

The government wants the capacity to block any content deemed “undesirable” by the Pakistan Telecommunications Authority “from time to time.” It is seeking a system of hardware boxes to be deployed at IP backbones in major cities across the country, including Islamabad, Karachi and Lahore. Each box “should be able to handle a block list of up to 50 million URLs...with processing delay of not more than 1 milliseconds”.

Islamabad-based human rights organisation Bytes For All (B4A) has condemned the government's decision to expand its programme of internet censorship in this way. B4A is calling upon the UN Expert Panel on Human Rights, which will convene in Geneva on 29th February 2012, to recognise the gravity of the current situation in Pakistan and to consider the dangerous precedent it sets. It is also asking companies and research institutions to refrain from bidding for the contract to build the filtering and blocking system. The organisation believes that the Pakistani government is still unwilling to acknowledge the critical importance of open internet access to economic and social progress, and instead wishes to use the Internet as a tool to stifle free expression, and monitor and control its population.

Shahzad Ahmad of Bytes For All said:

The use of vague terminology like "undesirable" always rings warning bells - the government is essentially looking for carte blanche to block whatever online content it chooses. In the run-up to the 2013 elections, this may well include material that is critical of the current government or endorses its political opponents; the proposed system could represent a serious infringement of the citizen's constitutional right to democratic participation and open elections. The government's actions are disturbingly reminiscent of the authoritarian military regimes of the past.

Background

Bytes for All (B4A) Pakistan is a human rights organization with a focus on Information and Communication Technologies (ICTs), and one of Privacy Internatonal's PrivAsia partners. It stimulates and organizes debate on the relevance of ICTs to sustainable development and strengthening human rights movements in Pakistan. B4A also focuses on capacity building for human rights defenders, educating them on digital security, online safety and privacy.

B4A works on the following areas:

Strategic use of ICTs for women’s empowerment and combating violence against women
Freedom of Expression
Privacy Rights in Pakistan
Digital Security for Human Rights Defenders
Open Governance
Open Net Initiative
Greening IT
Internet & Human Rights
Global Information Society Watch
Innovation for Development
Internet Governance

Location

Pakistan

What PI is fighting for

Promote Strong Cyber Security and Protections for People

Learn more

Communications Surveillance

Image (DO NOT USE)

More about our partner

Bytes for All

Content

News and Analysis

Bytes for All

State of Privacy Pakistan

Table of contents

Introduction

Key Privacy Facts

Right to Privacy

The constitution

Regional and international conventions

Communication Surveillance

Introduction

Surveillance laws

Surveillance actors

Surveillance capabilities

Surveillance oversight, checks and balances

Surveillance case law

Examples of surveillance

Data Protection

Data protection laws

The Electronic Transactions Ordinance (2002)

The Freedom of Information Ordinance (2002)

Prevention of Electronic Crimes Act (2016)

National Database and Registration Authority Ordinance, 2000

Electronic Data Protection Act 2005 (draft)

​Law enforcement access to stored data

Accountability mechanisms

Habeas Data/Subject access requests

Freedom of Information (FOI)

Consumer protection rules

Data breaches: case law

Examples of data breaches

Identification Schemes

ID cards and databases

Voter registration

SIM card registration

Policies and Sectoral Initiatives

Cybersecurity policy

Cybercrime

Encryption

Licensing of industry

E-governance/digital agenda

Health sector and e-health

Smart policing

Transport

Motorway e-tags and m-tags

Metrobus

Smart cities

Migration

Emergency response

Humanitarian and development programmes

Social media

Identity Policies: The Clash Between Democracy and Biometrics

Data and Control: Protecting Rights, Protecting People

We've come a long, long way together: building coalitions around the right to privacy

NSA/GCHQ who?

Discovering new allies

GCHQ-NSA intelligence sharing unlawful, says UK surveillance tribunal

Pakistani government advertises for bids to build national firewall capable of blocking up to 50 million websites containing "undesirable content"

Law enforcement access to stored data