Annex 05 — Open Data Portal (CKAN)
Pakistan Open Data Portal CKAN 2.8.3 — 1,471 government datasets, 36 user accounts including 2 sysadmins, 22 organizations fully dumped via unauthenticated API.
- Record
- INV-852133
- Status
- published
- Assets
- 0
- Documents
- 0
- Map
- Not included
Annex 05 — Open Data Portal (CKAN)
1,471Datasets Dumped
36User Accounts
22Organizations
2,349Content Tags
8.9 MBTotal Data
| Field | Value |
|---|---|
| URL | https://opendata.com.pk |
| Platform | CKAN 2.8.3 |
| Server | nginx/1.12.2 (October 2017 — 8 years old) |
| API Base | /api/3/action/* |
| Authentication | None required for read operations |
robots.txt declares /api/ off-limits with a 7-day crawl delay. The API is fully accessible regardless.
API Endpoints Dumped
| Endpoint | Result |
|---|---|
| /api/3/action/package_search | 1,471 datasets (paginated) |
| /api/3/action/organization_list | 22 organizations |
| /api/3/action/tag_list | 2,349 tags |
| /api/3/action/user_list | 36 user accounts with email hashes |
| /api/3/action/package_list | Complete package name listing |
| /api/3/action/status_show | CKAN 2.8.3 version confirmed |
Dataset Analysis
| Query | Results | Content |
|---|---|---|
| "pakistan government" | 745 | Government operational data |
| "election" | 121 | Electoral data 1970–2024 |
| "census" | 30 | Population and demographic data |
| "military security" | 0 | No military data published |
Key Election Datasets
- Pakistan General Elections 1970–2024
- Election Database 1970–2018
- Pakistan — Polling Stations (locations, coordinates)
- Elections 2018 Findings
- By-elections data (multiple cycles)
Key Census Datasets
- Pakistan Tehsil District Census (granular geographic breakdown)
- Population density by region
- Population Stats (1998 Census)
- Punjab Annual School Census Report 2017–18
Organizations (22 total)
| Organization | Datasets | Type |
|---|---|---|
| Pakistan Bureau of Statistics (PBS) | 661 | Government agency |
| Gallup Pakistan | 430 | Polling/research |
| Friends of Open Data Pakistan | 189 | Community |
| CHISEL @ LUMS | 87 | University research lab |
| NCBC (National Big Data Center) | 61 | National R&D |
| CIPL @ ITU (Crime Investigation Lab) | 28 | Law enforcement research |
| HEC Pakistan | 0 | Higher Education Commission |
| PITC (Power IT Company) | 0 | Ministry of Energy (30M consumers) |
Notable: Crime Investigation and Prevention Lab (CIPL @ ITU) researches crime pattern discovery, surveillance optimization, evidence gathering, speech forensics, and vulnerability analysis — works directly with Law Enforcement Agencies.
Sysadmin Accounts
| Username | Email Hash | Status |
|---|---|---|
| odp-operator | 87078bd45eef9d578ab15c9b9e42a255 | active |
| ckan (Master Account) | 87078bd45eef9d578ab15c9b9e42a255 | active |
Note:odp-operator and ckan (Master Account) share the same email hash, indicating one email was used for both accounts. The odp sysadmin uses a different email hash shared with the odp-admin account (Zainab Salam). All 36 user email hashes are in MD5 Gravatar format — matchable against breach databases.
Security Assessment
- Outdated Software: nginx/1.12.2 (2017) and CKAN 2.8.3 — multiple known CVEs
- No API Authentication: All read endpoints accessible without credentials
- User Enumeration: Full user list with email hashes, edit counts, creation dates
- robots.txt Not Enforced: /api/ declared disallowed but fully accessible
- Sysadmin Credential Reuse: Two sysadmin accounts, one shared email hash
- Account Pattern Intelligence: Username patterns reveal institutional affiliations