A comprehensive report by Amnesty International has alleged that Pakistani authorities are conducting widespread surveillance on over four million citizens using advanced mass surveillance tools procured from foreign private companies. Titled “Shadows of Control: Censorship and Mass Surveillance in Pakistan,” the report claims that the state unlawfully monitors the digital activities of regular citizens, journalists, and prominent politicians, significantly tightening control over the country’s cyber landscape.
The core of this surveillance apparatus is the Lawful Intercept Management System (LIMS), a product sold by the German company Ultimaco. Since 2007, this system has been used to monitor a significant portion of the population’s digital activity through telecommunications providers. Amnesty’s technologist revealed that the number of phones under surveillance could be even higher, as all major mobile operators have been ordered to connect to LIMS. The Pakistan Telecommunication Authority (PTA) obligates these providers to ensure that up to two per cent of their entire consumer base can be surveilled.
The report explains that LIMS allows authorities to classify and store internet traffic, text messages, and voice communications. With just a phone number, the data is made accessible through another product called Monitoring Centre Next Generation (McNG) by Datafusion. This system enables operators to see who someone called, when it happened, what websites were browsed, if WhatsApp or a VPN was used, and even track their location. Authorities also employ a powerful firewall, WMS 2.0, which can block two million active internet sessions at a time.
Amnesty attributed this unchecked mass surveillance to a critical lack of technical and legal safeguards. The workings of the LIMS system came to public light during the hearing of the Bushra Bibi vs Federation of Pakistan case in the Islamabad High Court (IHC). The case was filed to investigate the legality of telecom interception after a series of leaked audio recordings of calls between politicians and public figures became public between 2022 and 2023, highlighting the extent of the privacy breach.
