The Draft Framework
On May 6, 2026, the Pakistan Telecommunication Authority published a draft licensing framework for In-flight Telecommunication Satellite (ITS) services, opening public consultation until May 31, 2026. The framework would let domestic and foreign carriers offer onboard broadband and cellular service to passengers in Pakistani airspace — for the first time legally — in exchange for a USD 10,000 fee, a 10-year licence, lawful-interception capability, type-approved equipment, mobile use limited to altitudes above 3,000 metres, and three coupled obligations that together reshape the data path: passenger data generated in flight must be stored and processed inside Pakistan; international bandwidth must come through a locally licensed Long Distance International (LDI) operator; and operators must build local gateway infrastructure that routes traffic through domestic systems.
The Strongest Case for the Rules
There is a real problem the PTA is responding to. In-flight connectivity is exactly the kind of cross-border data flow that bypasses the regulatory architecture most states have spent two decades building. A passenger streaming, logging in, or messaging from 35,000 feet above Lahore is technically routed through a satellite to a ground station that may sit in the Gulf, Europe, or Singapore — outside the reach of Pakistani lawful-interception regimes, outside the territorial scope of any future Pakistani data protection law, and largely opaque to domestic CERTs. Type approval for cabin equipment and altitude floors are also unobjectionable: they are aviation-safety provisions every regulator from the FCC to EASA imposes in some form. Pakistan has a defensible interest in not letting the only piece of telecom infrastructure used by its citizens that is wholly invisible to its regulators expand unregulated.
Where the Draft Overreaches
The harder question is whether bundling data localization and forced domestic routing onto in-flight services is a proportionate way to solve that visibility problem — and the evidence suggests it is not.
Start with the technical fit. In-flight connectivity is a textbook case of data that is inherently cross-jurisdictional. Analysing the EU's GDPR regime, Access Partnership has noted that satellite-routed cabin traffic must transit whatever ground teleport sits within the relevant satellite footprint, and that forcing operators to route only through specific national gateways adds compliance cost without resolving the underlying jurisdictional puzzle. Pakistan's draft asks operators to do something the physics of geostationary and LEO architectures don't easily accommodate: ensure that a Boeing 777 crossing Karachi-Doha terminates its cabin Wi-Fi session at a teleport inside Pakistan even when the satellite footprint and the most efficient ground link sit elsewhere.
Second, the draft layers on top of an already aggressive localization push. The PTA's Local Peering and Internet Exchange Points Regulations, 2026 already require that domestic traffic stay on domestic infrastructure, and the still-unpassed Personal Data Protection Bill 2023 contains a clause (Section 31.2) requiring "critical personal data" to be processed only on servers inside Pakistan. The Information Technology and Innovation Foundation has argued that this stack disproportionately benefits operators "accustomed to operating under centralized, state-controlled regulatory models," and Pakistan's own Digital Rights Foundation has separately warned that mandatory localization tends to impose compliance cost without delivering proportionate privacy gains. The ITS draft is the latest layer in that stack — but the marginal privacy benefit for the typical air passenger is small. In-flight browsing logs were not the problem the data protection bill set out to solve.
Third, the lawful-interception requirement, as drafted, is open-ended. Pakistan's existing telecom interception regime — built around Section 54 of the Telecommunications (Re-organisation) Act, 1996 — already attracts civil-society criticism for the breadth of grounds on which interception can be ordered. Extending it wholesale to in-flight sessions, with mandatory technical capability baked in at the licensing stage, locks passengers into the broadest version of that regime rather than the narrowest. A more proportionate design would tie interception capability to defined categories of serious offences and require that independent authorisation logs be returned to the PTA.
What a Proportionate Framework Would Keep
The PTA should hold on to the genuinely useful parts of the draft and shed the rest. Type approval for cabin equipment, the 3,000-metre altitude floor for mobile, the 12-month service-launch deadline, and a non-exclusive licence regime that allows multiple providers are all sensible. A modest fee structure encourages entry. Even mandatory disclosure of the satellite operator and ground-station chain would give Pakistan most of the regulatory visibility it actually needs — without forcing operators to engineer a domestic teleport for a service whose entire point is cross-border mobility.
What should go: blanket localization of passenger browsing logs (replace with retention obligations on the airline's domestic-licensed partner only); mandatory LDI gateway routing for in-flight traffic (replace with a requirement that operators name their ground-station jurisdictions and accept PTA audit rights); and an unbounded lawful-interception mandate (replace with defined-offence triggers and judicial sign-off).
The Stakes
Pakistan's aviation market is small but strategically placed: it sits on key Gulf-Asia and Europe-Asia flight corridors, and a regime that imposes high build-out costs and ambiguous interception duties will quietly shape which airlines bother turning cabin connectivity on over Pakistani airspace at all. Foreign carriers can simply switch off the service while crossing FIR-Karachi, as several already do over jurisdictions with onerous in-cabin rules. The losers, then, are Pakistani passengers — particularly business travellers on long-haul routes — and Pakistani carriers like PIA and Airblue that would otherwise gain a competitive product. The consultation closes on May 31. There is still time to rewrite the draft so it secures the legitimate sovereignty interest without sacrificing the service.