The PTA is Watching the Wires and Ignoring the Locks

Between the VPN registration drive and the national firewall, the telecom regulator has thought hard about controlling encrypted traffic. It has published almost nothing about whether the encryption protecting that traffic will survive the next decade.

The Pakistan Telecommunication Authority has spent a remarkable share of the past two years thinking about encryption, though almost entirely from one direction. It built a VPN registration portal, licensed commercial VPN providers, and kept a national web-management system running through several upgrades, all of it concerned with who is permitted to send encrypted traffic and under what conditions. What the regulator has published far less about is the question that will matter most by the end of this decade, which is whether the encryption protecting the country’s telecom core can withstand a quantum-capable adversary. That imbalance is the subject here.

The governing instrument is the Critical Telecom Data and Infrastructure Security Regulations, notified in September 2020 and now being revised. The 2020 text was a genuine step forward, establishing three maturity levels for operator security, mandatory third-party audits, automated network monitoring, and explicit protection for critical telecom infrastructure. A draft update circulated in October 2025 reframes the regime around critical information infrastructure, adds a data-localisation requirement that keeps sensitive telecom data inside Pakistan, and references strong encryption in the form of TLS, IPsec, and VPNs. Both versions treat encryption as a control to be present rather than a parameter to be specified, so neither names an algorithm, a key length, or a migration horizon, and neither mentions post-quantum readiness at all.

The surrounding activity confirms where the regulator’s attention has been. The VPN registration portal opened in November 2024 during a stretch of degraded connectivity that was partly traced to submarine-cable faults, and by late 2025 the PTA had begun licensing VPN service providers under a reinstated value-added-services regime. The web-management system, in place in some form since 2006 and last upgraded in 2023, was confirmed operational by a National Assembly committee in early 2026 ahead of the coming 5G spectrum auction. All of this is real regulatory work, and some of it is defensible on its own terms, but none of it touches the strength of the cryptography inside the network.

That omission is consequential because telecom infrastructure has one of the longest replacement cycles of any critical system. Core routing equipment, lawful-interception platforms, and subscriber-authentication systems are procured to run for a decade or more, which means hardware bought under the current rules will still be carrying traffic well into the 2030s, the exact window in which NIST intends to disallow today’s public-key algorithms and in which the European and American migration deadlines fall. An operator that buys quantum-vulnerable equipment in 2026 with no agility requirement attached is locking in an exposure that outlasts the procurement by years, and the regulator is currently silent on the point at the precise moment the 5G build-out is putting new long-life equipment into the ground.

The correction fits naturally into work the PTA is already doing. The CTDISR revision is open, so the simplest move is to add a clause requiring licensees to conduct a quantum-safe readiness assessment of their core networks and to maintain a cryptographic inventory of the equipment carrying subscriber and signalling traffic, mapped to the same maturity levels the regulations already use. That asks operators to know what they are running before they are asked to change it, which is the sequence every credible national roadmap follows. For new procurement tied to the 5G rollout, the licensing conditions could require crypto-agility, meaning equipment able to accept a software update to post-quantum algorithms rather than needing a rip-and-replace, so the country is not buying obsolescence with a ten-year warranty.

A regulator that can register hundreds of thousands of VPN endpoints is plainly capable of asking its licensees a harder and more useful question about the cryptography inside the network itself. The concluding piece in this series turns to NTISB, whose Pakistan Security Standard is the one document in the entire national stack that so much as mentions the quantum problem, and to what it would take to turn that mention into a requirement.

Sourcing: 
CTDISR 2020 (S.R.O. 1226(I)/2020); 
CTDISR 2025 draft (Oct 2025); 
PTA VPN registration and CVAS licensing timeline (2024-2025); 
NA committee confirmation of WMS (early 2026); 
NIST deprecation timeline; 
EU/US PQC deadlines.