BOLNAY DO – A VOICEPK CAMPAIGN FOR FREEDOM OF EXPRESSION
September 22, 2025
By Rehan Piracha
LAHORE
A ground-breaking report by Amnesty International, ‘Shadows of Control’, has exposed the scale of Pakistan’s mass surveillance and internet censorship apparatus, warning that it gravely undermines the privacy and digital rights of citizens. The report details how advanced technologies, supplied by international companies, allow the Pakistani state to monitor communications, intercept private data, and restrict internet access on an unprecedented scale—without judicial oversight or legal justification.
How privacy has been compromised
Through the deployment of an upgraded national firewall system, that grants authorities sweeping access to digital communications and online activities, the privacy of Pakistani citizens has been systematically eroded. Confirmed by officials in August 2025, this new infrastructure marks a qualitative leap from previous surveillance capabilities.
The Pakistan Telecommunication Authority (PTA) has admitted that up to 2% of all telecom subscribers—over 4 million people—can be simultaneously surveilled without a court warrant. This system can track browsing patterns, monitor social media activity, intercept communications, and build detailed digital profiles of users. Crucially, all this occurs without judicial authorization, affecting every internet user regardless of suspicion of wrongdoing.
Authorities also exploit the system for content takedowns under vague grounds of “anti-state” activity. This has created a chilling effect on free speech, particularly in marginalized regions such as Balochistan and Khyber Pakhtunkhwa, where internet shutdowns are frequently imposed.
Additionally, the firewall detects attempts to bypass censorship through VPNs or privacy tools. The government’s requirement for VPN registration, alongside threats to block unregistered services, has stripped citizens of one of the few tools available to protect online anonymity.
The surveillance architecture
At the heart of this system lies the Lawful Intercept Management System (LIMS), a product of German company Utimaco. LIMS enables real-time interception of phone calls, text messages, and internet activity. Deployed via telecom operators who must comply under PTA licensing rules, the system is used to monitor millions of subscribers simultaneously, again without judicial warrants.
Alongside LIMS, the national firewall—initially built with Canadian Sandvine technology and later upgraded with Chinese hardware—censors online spaces. It blocks websites, social media platforms, VPNs, and even entire networks during political unrest or protests. These measures are carried out under overly broad laws that give the state sweeping powers in the name of “national security” and “public morality.”
What the government can access without permission
Under Pakistan’s existing legal framework, authorities have granted themselves extraordinary powers to access personal data and communications, far exceeding international standards of lawful surveillance.
Through the Pakistan Telecommunications Act, the PTA can order service providers to hand over user data, monitor traffic, and implement content filtering without requiring judicial warrants. Administrative orders replace judicial oversight, allowing unchecked surveillance.
According to Amnesty, the state—primarily through intelligence agencies like the ISI and the military—near total access to citizens’ digital lives:
Intercept calls and messages: LIMS allows live monitoring of voice and SMS communications.
Track internet activity: Even encrypted browsing can be tracked at the metadata level.
Access personal data: SIM registration linked with NADRA ensures citizens can be identified and traced.
Block and throttle internet: The WMS enables localized or nationwide shutdowns, as witnessed during elections and protests.
Capture unencrypted communications: Emails, VoIP calls, and other unprotected data remain vulnerable to interception.
These powers operate without transparency, judicial warrants, or independent oversight, rendering constitutional guarantees of privacy effectively meaningless.
Laws violated by the State
Digital rights activist Usama Khilji, co-founder of Bolo Bhi, said the government’s mass surveillance regime violates both domestic and international law. “We knew about these systems for years, but Amnesty’s report lays bare how Pakistan acquired them,” he told Voicepk.
In Khilji’s view, the mass surveillance exposed in the Amnesty report should be challenged in courts and the Supreme Court should also take notice of this violation of privacy of citizens.
- According to Khilji, the mass surveillance violates Article 14 of the Constitution that guarantees the right to privacy. The Supreme Court has previously ruled unauthorized interception unconstitutional, yet the state continues to bypass protections through executive orders and opaque policies.
- While PECA allows surveillance, it requires judicial authorization under Section 38. Amnesty’s findings show that warrants are rarely obtained. Instead, the law is routinely misused to target journalists, activists, and political dissidents.
- This law mandates judicial warrants for surveillance. However, the Islamabad High Court revealed in 2024 that ‘not a single warrant had been issued under the Act in over a decade’.
- As a signatory to the International Covenant on Civil and Political Rights (ICCPR), Pakistan is obliged to protect privacy (Article 17), freedom of expression (Article 19), and peaceful assembly (Article 21). Mass surveillance and internet shutdowns violate all three.
- International law also requires surveillance to be ‘necessary, proportionate, and prescribed by law’. Pakistan’s dragnet surveillance fails every test.
How citizens can fight back
Citizens can challenge mass surveillance through constitutional petitions in the High Courts and Supreme Court. Several cases are already underway, including journalist Saman Amjad’s petition demanding disclosure of details about the Web Monitoring System.
Legal challenges should argue that surveillance without judicial oversight violates fundamental rights under Articles 14 and 19, as well as constitutional principles of proportionality and due process.
Limited tools to protect privacy
While the state’s surveillance capabilities are extensive, citizens can take some steps to protect their privacy. According to Khilji, citizens can use encrypted messaging apps like Signal and WhatsApp (with end-to-end encryption enabled) offer better protection against interception.
Virtual Private Networks and the Tor browser can help bypass censorship and hide internet activity, though the government actively blocks many VPNs. Avoid sharing sensitive information over unencrypted channels like SMS or non-HTTPS websites. Citizens should refrain from using public or unsecured networks for confidential communications.
However, these are limited measures. The state’s technical capacity to monitor and block means that complete privacy is nearly impossible for the average citizen.