Pak Datacom’s shift to foreign satellite raises security concerns

Islamabad: Serious questions have been raised over Pak Datacom’s reported shift of satellite connectivity for sensitive government linked organisations from Pakistan’s PakSat network to UAE based Yahsat, with a former chief executive of the company has asked regulators to investigate whether required approvals were obtained and whether national data security safeguards were fully protected. Pak Datacom officials were contacted for their response to the allegations and questions raised in the complaint, but no reply had been received at the time of filing this story.

The concerns were raised by retired Brigadier Syed Zulfiqar Ali, who described himself in the complaint as a former chief executive and shareholder of Pak Datacom. He sent a formal complaint to authorities including the Pakistan Space Activities Regulatory Board, the Pakistan Telecommunication Authority, the Director General Technical and PakSat International, with a copy also sent to the Ministry of Information Technology and Telecommunication.

The complaint alleges that Pak Datacom moved VSAT services being provided to the National Bank of Pakistan and other government organisations from its local satellite arrangement to Yahsat’s YahClick service. According to the complaint, the earlier system used PakSat with network hubs located in Pakistan, while the new arrangement involves a UAE based satellite service.

The complainant described the change as a possible security concern because the National Bank of Pakistan handles important government accounts. The main issue raised is whether the satellite change followed Pakistan’s regulatory requirements and if the necessary approvals were obtained.

Pakistan’s Space Activities Rules state that government departments, armed forces and other government entities should use national satellite capacity and give the National Space Agency the first right of refusal. The same rules also provide an exception. If the required capacity is not available through a national satellite, services from a registered satellite operator may be used, subject to the regulatory process and an NOC from PSARB.

The key unanswered questions are whether national satellite capacity was unavailable, whether Yahsat was being used as a registered satellite service under the relevant rules and whether the required approvals or NOC were obtained.

The complaint asks the authorities to determine exactly these points. The complainant alleged that the move contradicted the Space Activities Rules and asked regulators to establish whether the formal procedure had been followed.

The rules give PSARB powers to regulate satellite activities and ensure maximum use of national space assets. They also empower the regulator to issue an NOC to government organisations for using other registered satellites when national satellites cannot provide or arrange the required capacity.

Pak Datacom is a listed company and, according to the documents supplied with the complaint, Telecom Foundation holds 55 percent of its shares while the remaining 45 percent is held by the general public.

The complaint states that Pak Datacom has worked with defence and public sector organisations and has provided satellite communication and network support to organisations including the National Bank of Pakistan, NADRA, OGDCL, AGPR and NLC.

According to the documents, Pak Datacom had been providing satellite backup connectivity to more than 400 National Bank branches. The complaint says this connectivity previously operated through PakSat, using hubs in Karachi and Islamabad before services shifted to Yahsat.

The complainant argued that keeping government connectivity on an indigenous network would provide greater control, particularly for organisations handling sensitive information. Pak Datacom’s reported use of a virtual private network was also mentioned in the material.

The complaint nevertheless argued that using a foreign satellite and overseas infrastructure required closer examination from a national security point of view. These concerns remain allegations that relevant regulators and the company must verify.

Another issue raised in correspondence sent to the Ministry of Information Technology concerned the cost of the reported transition. The complainant alleged that approximately $97,000 was spent on imported equipment. He also alleged that around Rs 10 million was paid in Customs duties and taxes and around Rs 4 million in demurrage charges.

The complaint linked the demurrage amount to alleged delay or negligence. The complainant requested an inquiry to determine whether the satellite shift was carried out according to the regulatory framework and whether the reported spending was justified.

The Space Activities Rules give PSARB authority to investigate possible violations. Under the rules, PSARB may form a special committee to conduct a fact-finding inquiry if an act or omission may have violated the regulatory framework. The rules also state that satellite-based communication services in Pakistan must be provided through national satellites or registered satellites.

Foreign satellite operators are also required to meet regulatory conditions for providing services in Pakistan. The documents therefore leave an important regulatory question open. If all required permissions, registration and NOCs were obtained and national satellite capacity was unavailable, the foreign satellite arrangement may fall within the exception provided by the rules.

If those conditions were not met, regulators would need to determine whether any breach occurred and what action, if any, is required. The reporter contacted Pak Datacom Acting CEO Ali Saleem Rana and other company officials seeking clarification on why VSAT connectivity was reportedly shifted from PakSat to Yahsat.

Questions were also sent asking whether the company had obtained the required approvals, how it responded to the security concerns and whether the reported expenditure figures were correct. No response had been received at the time the story was prepared.

Pak Datacom’s position will be incorporated if the company responds. The matter now centres on whether the responsible regulatory authorities confirm that the required procedures were followed and whether the foreign satellite arrangement met Pakistan’s security and space regulation requirements.

The central questions are whether the system was properly authorised, whether national capacity was considered first, whether government data remained protected and whether public and shareholder money was spent according to the rules.