Annex 08 — Balochistan Province Deep Intelligence

Strategic Context

Balochistan's provincial government is the only remaining accessible provincial .gov.pk portal during wartime — Punjab, Sindh, and KPK are all down. This makes it the highest-value provincial target for intelligence collection.

Single Admin Vulnerability — Critical Finding

One individual administers both the main provincial government website and the Science & IT Department website, creating a single point of failure for Balochistan's entire government web presence.

Cross-Site Admin Correlation

balochistan.gov.pk     → admin_bal      (ID 4)
sit.balochistan.gov.pk → admin          (ID 1)
                          ↓
                    SAME GRAVATAR HASH
                    49d835e800b2f8de9d230f39d1718274e0364b4aff0a72de4bd274d82dbbf38b

Exploitation Consequences

• Single point of failure — one compromised account = control of two government sites
• Password reuse probability — same person administering both sites likely reuses credentials
• Phishing target — gravatar hash → email address lookup → spear-phishing vector
• WordPress admin compromise — full CMS control, plugin backdoors, shell upload potential

Government Officials — Divisional Commissioners

Balochistan's eight divisions each have a commissioner serving as the senior civilian administrator for law and order, revenue collection, and disaster management. All eight were named in extracted WordPress content.

Gwadar Safe City Project — CPEC Surveillance

The Gwadar Safe City Project is a CPEC-linked surveillance and command-and-control initiative for the port city central to China's Indian Ocean strategy. Job vacancy pages exposed full staffing data.

PMU Gwadar — Technical Positions (298 Candidates Shortlisted)

GSC — Shift Operations Roles

The "Incharge Command & Control" position confirms centralized surveillance operations. Software, network, and radio communication engineers indicate digital C2 capability. The 298 named shortlisted candidates represent the full technical staffing pipeline for a system designed to monitor one of China's most strategically significant overseas infrastructure assets.

Budget & Financial Data (2020–2026)

The WordPress media API exposes direct download URLs for provincial budget documentation spanning six fiscal years.

• PSDP Documents (Public Sector Development Programme) — 2020–2026
• White Papers — provincial budget justification and policy rationale
• Volumes I–VIII — detailed budget breakdowns by department
• Budget Speeches — political priorities and government commitments
• Annual Budget Statements — revenue and expenditure accounts

Each document URL is a direct unauthenticated download link from the WordPress media library, containing original filenames with upload timestamps.

Departmental Legislation Exposed

WordPress pages contain full text or direct references to legislation governing 14 departments:

Dual TLD Confusion — Impersonation Risk

Balochistan operates government services across two top-level domains simultaneously: .gov.pk and .gob.pk. This inconsistency creates a direct impersonation and phishing vector.

Citizens conditioned to trust .gob.pk domains for Balochistan services are potentially unable to distinguish them from typosquat domains. A threat actor registering balochistan.gob.pk.example.com or similar could intercept citizen interactions.

WordPress Content Summary

robots.txt Note

The balochistan.gov.pk robots.txt explicitly blocks AI crawlers including ClaudeBot, GPTBot, Google-Extended, Bytespider, and Applebot-Extended. It also contains Cloudflare Managed Content signals: ai-train=no. Despite this, the WordPress REST API is completely unprotected — robots.txt applies only to polite crawlers, not targeted API enumeration.

Risk Assessment Summary