Annex 09 — Federal Government Digital Infrastructure

Pakistan's federal digital infrastructure is centralized around a small number of critical systems managing national identity, government telecommunications, tax revenue, and citizen services for 220+ million people. During the Pakistan-Afghanistan war, virtually all of these systems are offline or access-restricted — but their architecture, attack surface, and historical breach data remain fully documented from pre-war reconnaissance.

1. NADRA — National Database & Registration Authority

NADRA manages the national identity database for 220+ million Pakistani citizens, including Computerized National Identity Cards (CNIC/NICOP), biometric data (fingerprint and facial), voter registration, and citizen verification services.

Wartime Platform Status

Nishan API Stack — Documented Capabilities

CNIC Number Structure — Intelligence Value

Every Pakistani Computerized National Identity Card number encodes geographic and demographic information in a predictable 13-digit format:

Format: ABCDE-XXXXXXX-M  (13 digits total)

Position 1:    Province code
               1=KPK  2=FATA  3=Punjab  4=Sindh  5=Balochistan  6=Islamabad  7=Gilgit-Baltistan

Positions 2-5: Division → District → Tehsil → Union Council (hierarchical)
Positions 6-12: Family tree identifier (sequential within locality)
Position 13:   Gender (odd = male, even = female)

A CNIC number alone reveals the holder's province, division, district, tehsil, union council, family lineage number, and gender — enabling geographic correlation and demographic profiling from ID numbers alone.

Historical Breaches

2. NTC — National Telecommunication Corporation

NTC provides telecommunications services to Federal and Provincial Governments, the Armed Forces, and defense projects. Its webmail system serves as the email backbone for the entire Pakistani federal government.

Wartime Service Status

NTC Services Portfolio

• Basic Telephony, Green Lines (secure government lines)
• Broadband Internet for government institutions
• Federal email, intranet, and data center solutions (Tier-III, ISO 27001 certified)
• Video conferencing, VPN, radio wireless networking
• SMS, call center services
• PKI certificates (code signing, SSL for .gov.pk domains)

3. NITB — National Information Technology Board

NITB is responsible for digitizing Pakistan's government operations at federal scale.

Scale

• 500+ digital initiatives under management
• 31 government portals
• 15 mobile applications
• Pakistan Citizen Portal (AI-powered grievance redressal across all agencies)

Key Platform Status

Upcoming: DEEP Super App

The Digital Economy Enhancement Project (DEEP), funded by the World Bank and led by NADRA under the Ministry of Interior, is a planned unified gateway for all federal and provincial services. As of February 2026, it was advancing toward launch — the war has since interrupted this timeline.

• Features: Digital wallet, biometric verification, AI guidance, cashless payments
• Integrations: NADRA, NTC, HEC, MOFA, Ministry of Interior
• Significance: When launched, a single platform would hold biometric + financial + travel + education data for 220M citizens

4. FBR — Federal Board of Revenue

FBR manages Pakistan's tax revenue collection through the IRIS 2.0 (Integrated Revenue Information System) and the PRAL API for enterprise bulk filing.

PRAL API capabilities (documented pre-war): Bulk income tax return filing, withholding statement submission, bulk sales tax invoice submission, POS integration, data validation, IP whitelisting + security tokens, sandbox testing environment.

5. Other Critical Infrastructure

SBP — State Bank of Pakistan

PTA — Pakistan Telecom Authority

HEC — Higher Education Commission

A 500 response on /.git/HEAD rather than a 404 is a significant indicator that a Git repository may be present on the production server. If the .git/ directory is accessible, it could expose full source code, commit history, credentials in configuration files, and internal API endpoints.

SUPARCO — Space & Upper Atmosphere Research Commission

6. PKI Infrastructure

NTC manages Pakistan's government PKI (Public Key Infrastructure). Its wartime outage has broader consequences beyond email:

• Government digital signatures for official documents are disrupted
• Code signing for government-distributed software is unavailable
• SSL/TLS certificate issuance for new .gov.pk subdomains is blocked

7. CMS & Framework Distribution

8. Network Infrastructure

9. Historical Breach Timeline

10. Post-Wartime Priority Targets

When Pakistan's infrastructure comes back online after the conflict, the following represent the highest-value targets based on this reconnaissance assessment, ranked by intelligence yield and breach potential.