The TRA has published a public consultation paper declaring its intention to regulate the use of Virtual Private Networks (VPN) in Oman. The new regulations would require corporates to apply for a permit to use VPN and would completely prohibit the use of VPN by consumers.
A VPN is a secure private network accessible through a public connection – it is widely used by businesses to exchange information between their external branches using public internet services while having all that information securely tunnelled through the VPN.
Besides the straightforward use of VPNs by businesses, the use of VPN by consumers has increased over the years either to avoid ISP censorship or to access geographically-restricted web services from a non-qualifying location (e.g. Hulu and the BBC iPlayer).
In countries like Oman where the internet is censored, VPN technologies can be used to bypass this censorship. The majority of consumer users of VPN in Oman use it to overcome the prohibition of using unlicensed VoIP services such as Skype. This is possible through VPN as users can use their restricted connection to tunnel all their communications through a private network that is connected to an unrestricted ISP service on the other end. So as long as the user can connect to the VPN, all restrictions imposed by the ISP become irrelevant.
The draft regulations of the TRA clearly attempt to stop consumers from bypassing the various restrictions imposed on the internet in Oman, the regulations seem to acknowledge the need for businesses to use VPN to securely communicate as any business can apply for a permit, however, the TRA will still retain the right to reject any request by a company to use VPN if the TRA is not convinced of its need to use VPN. Consumers may be fined up to RO 500 if they are discovered to use VPN.
The upcoming ban of VPN will upset a lot of people, but it is hard to argue against this specific new regulation as the majority of consumer uses of VPN in Oman involve carrying out prohibited activities (e.g. using VoIP). However, that is not to say that VPN doesn’t have any legitimate uses by consumers at all. VPN is used by universities are abroad to provide students with access to the university’s network when they are abroad, this is fundamental for students on distance learning programs or those doing a research in Oman. Many universities subscribe to countless electronic academic journals which can only be accessed through a secure connection as required by the publishers of these journals. Students may also need to connect through a VPN to submit their assignments to the electronic blackboard system or any other electronic learning system.
Besides the need for students on distance learning programs to use VPN, the wide definition of the term “VPN” in the new regulations could be problematic as it will capture any instance where a private network is created over a public connection, for example, remote access technologies such as ones that would allow you to retrieve files from your desktop computer through your phone would fall under this definition as you have to establish a private network with your computer over the public internet connection to do this process. Some gaming services could fall under this definition as well as a “private” network would have to be established to enable the players to play against each other.
There is no doubt that the prohibition of VPN is inline with the country’s general policy on the prohibition of encryption tools and the way the internet has been regulated this far, but the internet has developed in a way that makes security and encryption fundamental aspects of many new applications. Attempting to strictly regulate all these technologies that involve encryption could render the internet in Oman seriously crippled if this regulation goes too far.
This post was originally published as a column on Muscat Daily.