LAHORE: Two men accused of running a website resembling NADRA in name have been arrested in Lahore, with three terabytes of sensitive data recovered from their possession.
According to a spokesperson for the National Cyber Crime Investigation Agency, the data was recovered from suspects Muhammad Arsalan and Ali Raza, who obtained and sold the sensitive and personal data of more than 10 million citizens.
Data on SIM card ownership and registration, SIM databases, call detail records and citizens’ location data was also recovered from the suspects.
The data includes citizens’ family trees and information relating to various government departments.
According to the spokesperson, the suspects established a website under the name “Mini NADRA” to provide NADRA-related information, and were also involved in the illegal purchase and sale of sensitive data and in providing access to a platform named “Khoji”.
Related: Punjab Declares War on Corruption: Secret Cell Formed, Helpline 1350 Activated
Two mobile phones were also recovered from the suspects. Forensic analysis of the three terabytes of data is under way.
A dataset combining identity records, SIM ownership, call detail records and location history represents an unusually complete profile of an individual. Each element is damaging in isolation; together they permit a level of tracking and impersonation that neither the telecom operator nor the identity authority would authorise for any private party.
Family tree data compounds the risk. It links an individual to parents, siblings, spouses and children, which is precisely the material required for social engineering attacks, for defeating knowledge-based identity verification at banks and telecom outlets, and for targeted extortion.
Datasets of this composition do not arise from a single external breach. SIM registration records, call detail records and location data sit with telecom operators; identity and family tree records sit with the national identity authority; departmental information sits across multiple government bodies. Assembling them requires access at multiple points.
The forensic examination now under way will be directed at establishing that chain — where each dataset originated, whether access was obtained through compromised credentials, insider assistance or vulnerabilities in departmental systems, and who the buyers were.
The National Cyber Crime Investigation Agency handles offences under the Prevention of Electronic Crimes Act 2016, which criminalises unauthorised access to information systems, unauthorised copying or transmission of data, and the offering of such data for sale.
Sites presenting themselves as informal front-ends to official identity databases have proliferated in Pakistan, marketed openly on social platforms and messaging groups and typically charging small per-query fees. Their commercial viability depends entirely on sustained unauthorised access to official records.
Leave a Reply