Pakistan’s internet has once again found itself under the digital microscope. In recent months, users have experienced sluggish speeds, difficulty downloading media on WhatsApp, and intermittent connectivity issues.
Instead of addressing the root cause behind widespread outcry and economic concerns, government obfuscation on “firewall” rumours continues — the latest excuse for persisting crawling speeds being too much VPN use or “faulty submarine cables”.
While there is no transparency from the government or the Pakistan Telecommunication Authority (PTA) about the scale and scope of the country’s internet infrastructure plans, there is ample precedent that suggests what might be at play and why the authorities must come clean.
What are Pakistan’s existing capabilities to filter content on the internet?
Amidst a smokescreen of explanations, the government has acknowledged updating a web management system (WMS) for “increased cyber security”. According to the PTA, deployment of the WMS has been underway since December 2023. Meanwhile, industry sources said the government plans to complete the testing and installation of the system by the end of this month.
So, what is the WMS? Acquired in 2018 from the controversial company Sandvine, which is known for its Deep Packet Inspection (DPI) technology — that can identify traffic coming from VPNs and then block or hinder VPN traffic using techniques like packet dropping, rate limiting, or redirection — and surveillance capabilities, the system would allow the telecom watchdog to monitor all internet traffic going in and out of Pakistan.
As per the Sandvine contract, which expired in 2023, the system allowed URL filtering, IP blocking, including complete blocking of websites, and VPN whitelisting.
Industry sources told Dawn that the new system was more advanced and could throttle and limit content on an application basis. “Previously you would be able to block YouTube as a whole but now they can throttle specific apps and block individual pieces of content,” they claimed.
What type of content filtering can allow disruptions to specific apps, and sites in addition to throttling the Internet?
Governments employ different types of content filtering techniques with the potential to not only disrupt specific targeted services but also negatively impact overall internet performance. In practice, “national firewalls” and similar internet censorship technologies are just one tool in the box of mass surveillance systems. These techniques range from URL and IP filtering to application-based filtering and traffic shaping/throttling.
For instance, traffic throttling controls the bandwidth available to specific types of traffic, websites or applications. This can slow down or limit access to these services without blocking them. “We witnessed this issue in Pakistan late last year (2023) when many users complained about throttling of Twitter services,” said Aftab Siddiqui of Internet Society.
“It is common knowledge that PTA has been doing URL, IP, DNS level filtering for many years,” he added.
Companies like Sandvine have provided internet-blocking capabilities to repressive regimes such as Azerbaijan, Jordan, Turkiye and Egypt. In particular, DPI technology has allowed authoritarian governments like Russia to throttle X (erstwhile Twitter) and restrict access to VPNs.
According to US-based internet observatory Censored Planet’s analysis, in Russia, DPI technology targeted X traffic, filtering messages to and from its domains (twitter.com, t.co, twimg.com) and throttling speeds below 150kbps, rendering it unusable. In 2022, Rest of World also documented how governments were increasingly throttling services instead of completely blocking platforms to disguise censorship as a technical error or localised outage.
Experts have warned that these disruptions can extend beyond the intended scope, inadvertently affecting other applications, websites, or online services. While such tools cannot allow intercepting encrypted content, traffic records and devices such as mobile phones and laptops may contain personal and metadata. With few existing safeguards for data privacy, the collection and storage of the information could reduce users’ ability to control how this information is used and shared by whom and for how long, potentially impacting people’s freedom of expression.
How does content filtering at the national gateway level work? Is it via a combination of technologies? Or is it one “firewall” system?
Content filtering at the national gateway level typically involves a combination of technologies rather than relying on a single “firewall” system, Internet Society explained.
National-level content or application filtering usually employs a multi-layered approach. This can include firewalls doing DPI, DNS filtering, URL filtering and IP filtering, among other techniques. Each layer serves a specific purpose, such as blocking specific URLs, preventing DNS resolution of certain domains, or inspecting the content of data packets to identify and filter out undesired content. “It is not known what Pakistan is implementing but most likely a combination of all as mentioned above,” said Siddiqui.
Hajira Maryam, an Amnesty Tech spokesperson, told Dawn that these systems take different forms, but typically involve telecom operators in a country installing internet and telephone monitoring technology, as requested by communication regulators or security agencies.
Some governments, she continued, use national firewalls and censorship technology to block certain websites and online content to control what people can see and say on the internet. For example, countries like Algeria, China, Iran, Russia and Vietnam have blocked websites of human rights organisations including Amnesty International, to limit access to information about rights violations.
As highlighted by Amnesty Tech, the use of such national firewalls and censorship technology can stop people from freely sharing their opinions, accessing accurate information, and participating in open discussions. “Unless these restrictions are fair, legal, and necessary, they can violate fundamental human rights like freedom of expression and access to information,” said Maryam.
Some experts think Pakistan wants to follow the UAE’s example. How does content filtering in the UAE work?
Content filtering in the United Arab Emirates is known to be one of the most stringent in the world apart from mainland China. The process is very much centralised and managed primarily by the state through its main ISPs, Etisalat and du.
“They use a combination of URL and DNS filtering and DPI processes to block access to a wide range of content along with voice/VoIP services. This system is designed to enforce strict controls on what residents can access online, ensuring that the Internet is in line with the UAE’s cultural, religious, political, and commercial standards,” Siddiqui elaborated.
“The scale of implementing a content filtering system in Pakistan would be vastly different from that in the UAE, given the larger and more diverse internet user base in Pakistan. Therefore, while there may be some structural similarities, the complexity and scale of the task would be much greater in Pakistan,” he added.
What will be the impact of placing such controls on Pakistan’s internet infrastructure?
Unlike other countries, Pakistan’s international connectivity lacks path diversity as it is highly concentrated at both the physical and logical layers.
According to French researcher Nowmay Opalinski, who has published a study titled ‘The Quest for a Resilient Internet Access in a Constrained Geopolitical Environment’, the shape of the internet in Pakistan is helping authorities to have some control over it.
“Since the structure of Pakistan’s network is concentrated, it is easier to apply firewall tools as you don’t need to apply tech to a large number of routes. Yet such a concentrated structure brings resilience vulnerabilities,” he said.
“Because only a few ISPs, mainly two (PTCL and Transworld), concentrate the bulk of Pakistan’s Internet traffic which constantly goes out of the country’s border because of the lack of local hosting (which stands at 11 per cent according to ISOC), whenever a fault on the infrastructure of these two providers happen, the quality of the connection in the whole country gets downgraded.”
“This is what happens in case of a physical fault (submarine cable cut, or even cut on the domestic backbone during the summer 2022 floods), or a logical disruption at these two networks (for instance traffic monitoring, or BGP hijack),” Opalinski told Dawn.
On the other hand, Doug Madory, who is dubbed as the man who can see the Internet, said, “Pakistan is a country that has, over the years, struggled with Internet connectivity for a variety of reasons.”
“The country has only two international gateways (PTCL and Transworld) and is dependent on a handful of submarine cables. These cables occasionally suffer faults, and when they do, Pakistan has always seemed to be impacted especially hard. Adding a new national censorship system is likely to compound the connectivity problems faced by Pakistanis,” he said.
Madory further noted that Pakistan appeared to still be dealing with the impacts of the SMW4 cut on June 17, when PTCL completely lost three international transit providers which reduced the company’s international bandwidth and potentially increased latency to certain services.
With international connectivity concentrated along a few physical and logical routes, implementing content filtering at the gateway while considered an easy task for authorities could exacerbate the risk of single points of failure, emphasises the Internet Society. “Any disruption, whether due to filtering misconfigurations, equipment failure, or targeted attacks, could lead to widespread internet outages, affecting large portions of the country,” said Siddiqui.
Another issue is the lack of locally hosted popular content. Globally, a large portion of content is delivered through local caches and CDN (Content Delivery Network) nodes within the country. However, the Pulse Country Report highlighted that only 13pc of the popular content accessed by users in Pakistan comes from these local sources. For the remaining content, every request must leave the country, passing through these content filters or national gateways.
Additionally, the lack of local peering means that even local traffic often must be routed through external networks, which further exacerbates these issues, shared Siddiqui.
Industry sources confirmed to Dawn that recently most peering with international servers was either depicting high utilisation or choking in some instances. They hinted that gateway-level deployment at the two largest CDN providers would be enough to control and monitor internet traffic in Pakistan but also significantly increase costs and latency.
“Certain countries such as Iran and China have managed to balance both control and resilience through a more complex network architecture, but this needs a high level of planification and major investments, which currently is not in sight in anyways in Pakistan,” warned Opalinski.
Internet Society, based on technical analyses, maintained that Internet blocking to address illegal content or activities is generally inefficient, often ineffective and generally causes unintended damages to Internet users.
“We recommend that policymakers think twice when considering the use of Internet blocking tools to solve public policy issues. If they do and choose to pursue alternative approaches, this will be an important win for a global, open, interoperable and trusted Internet,” Siddiqui added.
