Last month, during hearings about the illegal surveillance of Bushra Imran Khan, the wife of a former prime minister, the Islamabad High Court (IHC) discovered that the Pakistan Telecommunication Authority (PTA) had mandated telecom companies to finance, import, and install a system enabling mass surveillance of citizens’ data. This system, known as the Lawful Intercept Management System (LIMS), allows access to private messages, video/audio content, call records, and web browsing histories, according to court documents.
In an order dated June 26 and released over the weekend, Justice Babar Sattar of the IHC noted that LIMS was being used by “designated agencies” for surveillance. The PTA directive required telecom companies to facilitate surveillance on 2% of their customer base, potentially impacting over four million citizens simultaneously.
Justice Sattar emphasized that this mass surveillance lacked a legal basis and operated without judicial or executive oversight. While LIMS enabled agencies to access SMS, call data, and encrypted data, it did not provide automated decryption for encrypted data. The PTA did not respond to the requests for comments.
LIMS works as follows: a designated law enforcement agency initiates a track and trace request for a customer’s data. This request goes through LIMS in an automated process, and then private information, such as SMS and call data, is reported back to the agency. Court documents reveal that voice calls made by subscribers can be heard, SMS messages can be read, and audio/video content and web browsing details can be reviewed and stored.
In its order, the court ruled that the LIMS had been installed unlawfully, making the agencies using it for surveillance criminally liable. The IHC order compared this mass surveillance system to George Orwell’s “Nineteen Eighty-Four.”
Ramsha Jahangir, a journalist and digital rights activist, told Geo.tv that there was nothing “lawful” about this surveillance system. She called it a significant breach of user privacy and criticized the secrecy surrounding its deployment and use. Jahangir noted that the system even allows agencies to collect encrypted data, such as WhatsApp messages, and request tech companies to decrypt content.
It was also found a 2016 document on the PTA’s website that mandated telecom companies wishing to operate in Pakistan to facilitate the “lawful interception of communication” for security agencies. However, the document did not specify which agency would conduct the surveillance or cite relevant sections of the Pakistan Telecommunication Act supporting this requirement.
For now, the IHC has temporarily barred telecom companies from letting LIMS access their networks or from procuring consumer data. The court further directed PTA to file a sealed report detailing how LIMS was procured and installed, how it is manned, and the entities and individuals who have had access to it.
The IHC has adjourned the hearing of the case until September and has ordered that a show-cause notice be issued to PTA’s members and its chairman under Article 204 of the Constitution, together with Section 2(b) and 6 of the Contempt of Court Ordinance, 2003, for “making misrepresentations with regard to the Lawful Intercept Management System.”
