Pakistan’s unlawful mass surveillance and censorship expansion is powered by a nexus of companies based in Germany, France, United Arab Emirates (UAE), China, Canada, and the United States, Amnesty International said today in a new report “Shadows of Control”. The year-long investigation was carried out in collaboration with Paper Trail Media, DER STANDARD, Follow the Money, The Globe and Mail, Justice For Myanmar, InterSecLab and the Tor Project.
The investigation exposes how Pakistani authorities have obtained technology from foreign companies, through a covert global supply chain of sophisticated surveillance and censorship tools, particularly the new firewall (the Web Monitoring System [WMS 2.0]) and a Lawful Intercept Management System (LIMS). The report documents how the WMS firewall has evolved over time, initially using technology supplied by Canadian company Sandvine (now AppLogic Networks). Following Sandvine’s divestment in 2023, new technology from China-based Geedge Networks, utilising hardware and software components supplied by Niagara Networks from the U.S. and Thales from France, were used to create a new version of the firewall. The Lawful Intercept Management System (LIMS) uses technology from the German company, Utimaco, through an Emirati company called Datafusion.
“Pakistan’s Web Monitoring System and Lawful Intercept Management System operate like watchtowers, constantly snooping on the lives of ordinary citizens. In Pakistan, your texts, emails, calls and internet access are all under scrutiny. But people have no idea of this constant surveillance, and it’s incredible reach. This dystopian reality is extremely dangerous because it operates in the shadow, severely restricting freedom of expression and access to information,” said Agnès Callamard, Secretary General at Amnesty International.
“Pakistan’s mass surveillance and censorship have been made possible through the collusion of a large number of corporate actors operating in as diverse jurisdictions as France, Germany, Canada, China and the UAE. This is nothing short of a vast and profitable economy of oppression, enabled by companies and States failing to uphold their obligations under international law.
“Pakistan’s Web Monitoring System and Lawful Intercept Management System operate like watchtowers, constantly snooping on the lives of ordinary citizens. Agnès Callamard, Secretary General at Amnesty International.
“There are human rights limitations to the search for profit in markets, but these have all been ignored. Pakistani people are paying the highest price.”
WMS 2.0 can block both internet access and specific content, with virtually no transparency.
LIMS is mandated by the Pakistan Telecommunications Authority (PTA) to be installed across telecommunications networks, by private companies, allowing the Armed Forces and the Inter-Services Intelligence (ISI) to tap into and access consumer data, such as phone calls, text messages, and even which websites people visit.
“LIMS and WMS 2.0 are funded by public money, enabled by foreign tech, and used to silence dissent, causing severe human rights harms against the Pakistani people,” said Jurre van Bergen, Technologist at Amnesty International.
While both technologies enable mass surveillance by harvesting vast amounts of personal data or allowing the authorities to zoom in on someone’s browser habits, the WMS 2.0 also allows authorities to block VPNs or any website deemed to be “unlawful” content by the authorities.
A murky system of surveillance operating in shadows
Concerns around unlawful surveillance and online censorship in Pakistan are longstanding. Under an oppressive political landscape, the country’s legal system offers no real protection against mass surveillance. Domestic laws lack safeguards and those that exist, such as warrant requirements under the Fair Trial Act, are often ignored, while authorities acquire ever more sophisticated surveillance and censorship tools from foreign companies. The purchase of these sophisticated technologies has amplified the country’s capacity to silence dissent, including by targeting journalists, civil society and the public.
A journalist interviewed for the report told Amnesty International he believed he was under constant surveillance, which has forced him towards self-censorship.
“Obviously, everything is monitored, be it email or calls.” He outlined that after publishing a story on corruption, he came under severe surveillance that affected him and those around them. “After the story, anyone I would speak to, even on WhatsApp, would come under scrutiny. [The authorities] would go to people and ask them, why did he call you? [The authorities] can go to these extreme lengths… now I go months without speaking to my family [for fear they will be targeted],” the journalist said.
“The mix of inadequate laws and these new technologies are accelerating the State’s capabilities to restrict the rights to privacy, freedom of expression and freedom of peaceful assembly, all of which contribute to a chilling effect and a shrinking of civic space in the country,” said Agnès Callamard.
Suppliers of the Lawful Intercept Management System
Through commercial trade databases on subscription-based platforms, Amnesty International found that a German company, Utimaco, and an Emirati company, Datafusion, supplied most of the technology that enables LIMS to operate in Pakistan. Utimaco’s LIMS allows the authorities to sift through the telecommunications companies’ subscriber data, which is then made accessible through Datafusion’ Monitoring Center Next Generation (McNG).
Anyone residing in Pakistan and accessing the internet can be subjected to targeted mass-surveillance enabled by LIMS which allows the interception of phone location, phone calls and text messages once a phone number is inserted into the system at the request of state agents, which includes the officers of the spy agency, the ISI.
Additionally, the state agents operating LIMS can see website content if it’s accessed over HTTP by any Pakistani resident (the non-encrypted way to access a website). If accessed through HTTPS, the operator will only see which website was accessed through metadata but not encrypted content.
“Due to the lack of technical and legal safeguards in the deployment and use of mass surveillance technologies in Pakistan, LIMS is in practice a tool of unlawful and indiscriminate surveillance that allows the government to spy on more than four million people at any given time,” said Jurre van Bergen.
National Firewall from China also known as the Web Monitoring System (WMS) 2.0
Based on existing research and commercial trade databases, Amnesty International found that the first iteration of the WMS was installed in Pakistan in 2018 using technology provided by a Canadian company, Sandvine, now AppLogic Networks. Amnesty International dubs this WMS 1.0.
Amnesty International found Sandvine in trade-data as early as 2017 and as having shipped equipment to at least three Pakistani companies who all have a history of working for the Pakistani government. One of these companies is Inbox Technologies and two other companies Amnesty International found during the course of the investigation are SN Skies Pvt Ltd and A Hamson Inc.
Through a leak shared with the collaborators, and which is referred to by Amnesty International as the Geedge dataset, it was discovered WMS 1.0 was replaced using advanced technology from China’s Geedge Networks in 2023. This version is WMS 2.0.
Installation and operationalization of WMS 2.0 in Pakistan is enabled by software or hardware provided by two other companies: Niagara Networks from the United States and Thales from France.
Amnesty International believes that the technology provided by Geedge Networks is a commercialized version of China’s “Great Firewall”, a comprehensive state censorship tool developed and deployed in China and now exported to other countries as well.
Lack of regulation, control and transparency
Of the 20 companies contacted by Amnesty International, only US-based Niagara Networks and Canada-based AppLogic Networks (formerly Sandvine) responded to our questions. Their responses are included in the report. Datafusion Systems and Utimaco responded to research questions sent by Amnesty International in October 2024, and their responses are reflected in the report, though the companies did not provide responses to subsequent letters detailing the findings of the report.
Amnesty International also contacted nine government entities. The German Federal Office for Economic Affairs and Export Control (BAFA) and the Canadian Trade Controls Bureau acknowledged receipt of our letter but did not answer our questions. The Pakistani government did not respond to any of our letters.
There has been a continued failure by companies and multiple countries such as China and the UAE, as well as countries in the EU and in North America to regulate, control, and provide transparency on exports of surveillance technologies that have detrimental human rights consequences, such as in Pakistan.