Your CNIC contains a lot more information about you, than you think!

 

The identity number alone, without anything else known, carries information about your permanent address and gender. Till 2001, identity card number contained 11 digits, but since then, the number consists of 13 digits and they carry everything that is needed for a security check up.

There are three parts of the identity number, separated by a dash mark. The first part consists of five digits and it is based on the permanent address of the card holder. The second part consists of seven digits and it is randomly generated and the third part is of one digit only and it determines the gender of the card holder.

In the five address digits, the first one is based on the province, second on division, third on district, fourth on tehsil and fifth on union council. Each province is assigned a number in NADRA’s system. KPK is 1, FATA is 2, Punjab 3, Sindh 4, Balochistan 5, Islamabad 6 and Gilgit Baltistan 7. The further administrative units are also assigned numbers and those are based usually on alphabetical arrangement. These numbering lists are available at Pakistan Bureau of Statistics’ website. So, for example, a person living in, say Rawal town, Rawalpindi, will have identity card number 37421. Someone in F10, F11 Islamabad will have 61101.

The last digit of the identity card is assigned according to the gender of the card holder. Odd digit is assigned to men and an even digit to women. Eunuchs are assigned an even or odd number according to whether they identify as a male or a female. So, if someone has your identity card number, he knows your gender and your address down to the union council.

All identity cards issued now are Computerized National Identity Cards (CNICs) because NADRA’s system has been computerized since 2004. Before 2004, card numbers were issued manually albeit in accordance with the same rules. Also, since 2012, NADRA has started issuing Smart National Identity Card (SNICs) that contain a microchip. This microchip holds more information about you than is written on the card; along with carrying your picture and signature in it, it also carries your finger prints. These SNICs are contact smart cards, meaning they only transfer this information when they are physically contacted through an authorized machine. Unlike mobile SIM cards, that are contactless smart cards and transmit your location and any other information in them through radio waves even if the mobile is off.

National identity cards hold this much information about the 200 million people and one expects that the state will ensure the security of citizens’ data. But in 2017, Wikileaks revealed that UK and US had access to NADRA’s database. They set up a front company, International Identity Services, that NADRA hired as a consultant and through this fake company, both the countries had stolen the data of all citizens. NADRA termed the Wikileaks report as baseless and said that no data breach was ever occurred nor have they ever shared citizens’ data with any other country.

But the reports seem accurate. For example, after the San Bernardino attack in US in 2015, CNN showed the identity documents of the shooters, one of which was of Pakistani citizen.

But the shown identity document was not a picture of actual CNIC of the attacker, instead the identity information was doctored onto a template of a Pakistani CNIC card.

This led to some people speculating that the CNIC shown in the media was fake. but as NADRA’s record showed, the information on the card, such as CNIC number, name and address, was all correct. but photo was indeed doctored.

This episode clearly showed that US had all the raw information that is mentioned on the computerized national identity cards issued by NADRA, hence verifying the Wikileaks report. One can only hope that NADRA has realized the importance of the data it collects from the people and has heightened the security of its database.