During a recent briefing, lawmakers directly questioned the Pakistan Telecommunication Authority (PTA) about repeated breaches exposing the personal details of millions of citizens.
Officials revealed that sensitive data like SIM records, CNICs, travel history and even Hajj application information have leaked and been sold openly on the dark web, many of them for as low as Rs500.
Members of PTA confirmed at these disclosures that even the chairman s SIM record had been breached, reflecting the extent of the leaks.
PTA Chairman Major General (retd) Hafeezur Rehman also informed the committee, affirming that Pakistani citizens information often surfaces on the dark web.
"About 300,000 Hajj applicants information has been leaked. This needs a high-level inquiry," he stated. He further added that an inquiry was launched in 2022 and now has been picked up by the Interior Ministry.
The Dark Web Marketplace
Dark web, the most hidden part of the internet which only specialist equipment can access, is now a thriving underworld of stolen information black market. Pakistani citizens CNICs, SIM histories, and travel information are for sale at apparently peanuts, as low as Rs500 for mobile and Rs5,000 for foreign travel histories.
Senators cautioned that such violations not only facilitate identity theft and money laundering but also pose grave national security threats if malicious actors take advantage of the information.
Policy Vacuum
Despite blocking 1,300 websites engaged in illegal data trade, the PTA conceded its enforcement power is limited. Pakistan still lacks a comprehensive data protection law. The long-awaited Personal Data Protection Bill, 2023, modelled on the EU’s GDPR, remains stuck in parliament. Existing laws, such as the Prevention of Electronic Crimes Act (PECA) 2016, are largely punitive and do little to prevent systemic failures.
Also Read: Nadra launches new digital service – Will it end paperwork forever?
Experts and senators are urging immediate reforms: expedited passage of the 2023 bill, establishment of a secure national data center, implementing zero-trust digital architecture, and greater resources for institutions like the FIA. Public outreach campaigns and investment in cyber-resilience are also considered imperative.
Unless measures like these are taken, lawmakers caution Pakistan faces risk of losing public trust, financial instability, and ever-growing national security threats.
