Pakistan spying on citizens through mass surveillance systems: Amnesty report

Pakistani authorities have been spying on millions of citizens, including journalists and prominent politicians, through tools of mass surveillance acquired from private foreign companies, Amnesty International said in a report on Tuesday.

The report titled ‘Shadows of Control: Censorship and Mass Surveillance in Pakistan’ claimed that Pakistan’s growing monitoring network was developed using both Chinese and Western technology.

“Pakistani authorities have continued to unlawfully surveil the country’s citizens, including regular citizens, journalists, as well as prominent politicians,” the report said.

The year-long investigation was carried out in collaboration with Paper Trail Media, Der Standard, Follow the Money, The Globe and Mail, Justice for Myanmar, InterSecLab and the Tor Project.

Pakistan’s unlawful mass surveillance and censorship expansion is powered by a nexus of companies based in Germany, France, the UAE, China, Canada, and the United States, Amnesty International said in its report.

In its findings, the rights watchdog stated that, “the Armed Forces and the Inter-Services Intelligence (ISI) use the Lawful Intercept Management System (LIMS) to surveil a significant portion of the population’s digital activity through Pakistani telecommunications providers.”

It says that the investigation exposes how Pakistani authorities have obtained technology from foreign companies, through a covert global supply chain of sophisticated surveillance and censorship tools, particularly the new firewall (the Web Monitoring System [WMS 2.0]) and a Lawful Intercept Management System (LIMS).

The report documents how the WMS firewall has evolved, initially using technology supplied by Canadian company Sandvine (now AppLogic Networks). Following Sandvine’s divestment in 2023, new technology from China-based Geedge Networks, utilising hardware and software components supplied by Niagara Networks from the US and Thales from France, were used to create a new version of the firewall.

LIMS uses technology from the German company, Utimaco, through an Emirati company called Datafusion.

“Pakistan’s Web Monitoring System and Lawful Intercept Management System operate like watchtowers, constantly snooping on the lives of ordinary citizens,” said Agnès Callamard, Secretary General at Amnesty International.

“In Pakistan, your texts, emails, calls and internet access are all under scrutiny. But people have no idea of this constant surveillance, and its incredible reach. This dystopian reality is extremely dangerous because it operates in the shadow, severely restricting freedom of expression and access to information,” Callamard added.

“There are human rights limitations to the search for profit in markets, but these have all been ignored. Pakistani people are paying the highest price.”

LIMS is mandated by the Pakistan Telecommunications Authority (PTA) to be installed across telecommunications networks, by private companies, allowing the Armed Forces and the ISI to tap into and access consumer data, such as phone calls, text messages, and even which websites people visit.

“LIMS and WMS 2.0 are funded by public money, enabled by foreign tech, and used to silence dissent, causing severe human rights harms against the Pakistani people,” said Jurre van Bergen, technologist at Amnesty International.

While both technologies enable mass surveillance by harvesting vast amounts of personal data or allowing the authorities to zoom in on someone’s browser habits, the WMS 2.0 also allows authorities to block VPNs or any website deemed to be “unlawful” content by the authorities.

Amnesty claimed that concerns around unlawful surveillance and online censorship in Pakistan are longstanding and “under an oppressive political landscape, the country’s legal system offers no real protection against mass surveillance”.

It claimed that anyone residing in Pakistan and accessing the internet can be subjected to targeted mass-surveillance enabled by LIMS, which allows the interception of phone location, phone calls and text messages once a phone number is inserted into the system at the request of state agents, which includes the officers of the spy agency, the ISI.

Additionally, the state agents operating LIMS can see website content if it’s accessed over HTTP by any Pakistani resident (the non-encrypted way to access a website). If accessed through HTTPS, the operator will only see which website was accessed through metadata, but not the encrypted content.

“Due to the lack of technical and legal safeguards in the deployment and use of mass surveillance technologies in Pakistan, LIMS is in practice a tool of unlawful and indiscriminate surveillance that allows the government to spy on more than four million people at any given time,” said Bergen.

Based on existing research and commercial trade databases, Amnesty found that the first iteration of the WMS was installed in Pakistan in 2018 using technology provided by a Canadian company, Sandvine, now AppLogic Networks. Amnesty dubs this WMS 1.0.

Amnesty found Sandvine in trade data as early as 2017 and as having shipped equipment to at least three Pakistani companies, which all have a history of working for the Pakistani government. One of these companies is Inbox Technologies and two other companies are SN Skies Pvt Ltd and A Hamson Inc.

Through a leak shared with the collaborators, and which is referred to by Amnesty as the Geedge dataset, it was discovered WMS 1.0 was replaced using advanced technology from China’s Geedge Networks in 2023. This version is WMS 2.0.

Installation and operationalisation of WMS 2.0 in Pakistan is enabled by software or hardware provided by two other companies: Niagara Networks from the United States and Thales from France.

Amnesty International believes that the technology provided by Geedge Networks is a commercialised version of China’s ‘Great Firewall’, a comprehensive state censorship tool developed and deployed in China and now exported to other countries as well.