EDITORIAL: The latest hearing of the Senate Standing Committee on Interior shone a sharp spotlight on the alarming state of cyber security across key state institutions, including NADRA and the FBR, whose repeated breaches have resulted in the leakage of citizens’ sensitive personal data.
Senator Afnanullah Khan was particularly forthright in pointing out systemic failures in data protection, warning that the scale and frequency of data theft from official databases could indicate possible official connivance.
At the same time, this pattern also signals deep structural weaknesses in the country’s cyber security architecture. As the senator noted, consolidated datasets sourced from NADRA, the FBR and even the banking system are available on the dark web, underscoring the gravity of the threat and the inadequacy of existing cyber security systems.
Troublingly, this fragility extends beyond the public sector. Private companies, including banks, telecom operators and digital platforms, among others, remain exposed to leaks, hacks and organised cybercrime, often operating with outdated security protocols and weak incident-response mechanisms.
Attackers, meanwhile, have grown increasingly sophisticated, deploying automated tools, social engineering and cross-database correlation to monetise stolen data at scale. Clearly, cyber security is still not treated as a core governance and business risk that is backed by sustained investment, enforcement and accountability, rendering both the state and the market vulnerable in an increasingly hostile digital environment.
Recent years have seen the government aggressively push a digitalisation agenda. The Digital Nation Pakistan Act passed last year, for instance, aims to build a robust digital society, economy and governance system, envisaging increased digitalisation of government departments and provision of digital identities for all citizens. What has received far less attention is that pursuing such a far-reaching agenda is not without serious risks.
Rapid digital expansion sans critical safeguards, creates large centralised data repositories, opens up more points of attack and increases the damage when systems are compromised. Any drive towards digitalisation, whether in the public or private sector, must therefore be matched by the institution of robust, continuously evolving safety protocols and protection mechanisms.
It is, then, shocking that Pakistan still lacks a comprehensive data protection legislation that safeguards citizens’ personal and financial information, and mandates systematic investments in cyber security infrastructure, including frameworks to combat hacking, digital crimes, identity theft and financial fraud. Recent government actions in the digital realm, in fact, have exacerbated existing weaknesses in the country’s cyber security infrastructure.
Measures such as throttling internet speeds and attempting to restrict VPN usage reveal a limited understanding of the broader implications of these actions. Slower internet, for instance, impedes critical communication channels, delaying security updates and creating vulnerabilities that cybercriminals can exploit.
Restricting VPNs, meanwhile, undermines essential tools for online privacy and the protection of sensitive data, weakening the security of both public and private systems across the economy. On top of that, institutions like the National Cyber Crime Investigation Agency appear to prioritise citizen surveillance and clampdown on dissent over building genuine cyber resilience, a disconnect reflected in persistently low conviction rates in cybercrime cases.
What is urgently needed, therefore, is firstly a recalibration of government priorities, placing cyber security above citizen surveillance in its digital agenda. Equally critical is a comprehensive data protection legislation that mandates all entities moving to digital platforms to maintain the requisite infrastructure and expertise essential to secure their systems against evolving cyber threats.
Ongoing upgrades to security protocols and digital capacities must be a statutory requirement to stay ahead of emerging risks. Importantly, an independent regulatory body, manned by data security experts rather than career bureaucrats, must oversee the enforcement of such a law. The government must realise that without a dedicated regulatory framework, the risks associated with digital expansion could actually end up undermining its benefits
