T least the government is not trying to cover it up. That, perhaps, is the only silver lining in the alarming scandal that has just come to light. We know now, straight from the horse’s mouth, that the fingerprint-based biometric verification system supposedly built to protect citizens’ digital identities has been thoroughly compromised. The minister of state for interior now casually dismisses it as ‘outdated’.
Scammers have reportedly enjoyed access to supposedly secure locations, such as airports, driving licence centres, passport offices, and possibly even Nadra, to physically steal citizens’ fingerprint data. And the crisis goes deeper. In a recent meeting of the National Assembly Standing Committee on Interior, state officials admitted that scammers continue to operate with impunity despite the blocking of 18.2m illegal SIM cards over the past two and a half years. By blaming ‘loopholes’ in the SIM issuance system and banking channels for giving criminals free rein to commit financial fraud, the state has admitted to a massive breach of public trust. No wonder citizens simply do not trust the authorities to guarantee their safety. It must be asked: what have the authorities been doing? Given the scale of the crisis, one would expect dedicated, multi-agency taskforces to be actively dismantling these fraudulent networks. Instead, it appears the relevant regulators the State Bank, the PTA, the National Cybercrime Investigation Authority, and Nadra have been operating in their own silos.
Now that a stakeholder committee has finally been directed to formulate practical legislative and technical measures, the outcome must be a centralised cybersecurity framework.
Pakistan and its citizenry cannot afford another bureaucratic talking shop that hums and haws while yet another crisis continues to metastasise. Further, the authorities’ sudden push to collect even more intrusive personal identification data, such as facial and iris scans, must be met with severe scrutiny from legislators. They must demand detailed assurances on exactly how this new data will be secured to ensure that the glaring mistakes of the past are not repeated. There must also be consequences for the breaches that have already occurred.
Before the state’s requests for more resources to ‘strengthen the system’ can be taken seriously, those responsible for the existing negligence must be held accountable for the financial losses already incurred by the citizenry. Anything less glosses over the scale of the negligence.