Nadra files complaint in COAS family data breach case

ISLAMABAD: The National Database and Registration Authority (Nadra) has submitted criminal complaints in a magistrate court against four of its officials for having gained unauthorized access to the family data of Chief of Army Staff Gen Asim Munir.

The data breach had occurred shortly before the appointment of the army chief and was used to determine the travel details of the COAS’s family members to different countries through the FIA’s immigration record.

Initially, eight officials had been accused; six of them were placed under investigation pending inquiry and eventually four of them including a director-rank officer, Syed Amir Hussain Bukhari, were found to be guilty by the investigation.Nadra has filed the complaint against the four in the court of a first-class magistrate under Section 31 of the Nadra Ordinance, 2000. Per the complaint filed, the accused “by accessing the data of citizens illegally, unwarrantedly and without authorization have evidently breached instructions/Standard Operating Procedures issued time to time in this regard and thereof violated regulation 3 of [the] Nadra Employees Service Regulations 2002 [and] thus committed an offence under section 30 (1) (f) of the Ordinance. The illegal and unlawful acts of the [respondents] amount to heinous offences therefore, they are liable to be prosecuted inter-alia under section 28 & 30 (1) (f) of [the] Nadra Ordinance”.

This story was initially broken by Azaz Syed of Geo News. In response, Nadra had confirmed the breach incident which, it said, occurred when Tariq Malik, then chairman of Nadra, was out of the country. Malik had ordered an inquiry into the matter and vowed to bring the culprits to justice. The current complaint against those found guilty was filed under his watch. Tariq Malik has since resigned -- he handed in his resignation late Tuesday after a meeting with PM Shehbaz Sharif.

Other than Nadra’s director-rank officer, three junior employees have been held accused for this breach. While Syed Amir Hussain Bukhari, the director, is said to have accessed the details of two members of the COAS’s family from Islamabad, the other employees had gained access from where they had been posted: Kohistan, Dera Ismail Khan and Kohlu.Nadra had revealed that the army chief’s family record was not just accessed through its system; nine other institutions like banks, law-enforcement agencies and housing societies too had accessed this information. It is still unclear whether any inquiry has been ordered to determine the intention of those who accessed the data from those institutions.In the complaints filed by Nadra, the inquiry reports from the investigation have also been attached. In the case of Amir Bukhari, tangible evidence is said to have been found as he texted two CNIC numbers from the COAS’s family data to one of his subordinates, Rehman Mehmood Butt. After getting the required information, he sought their passport numbers. On being asked why he did that, he had told the inquiry committee that someone had come to inquire about this particular family tree claiming one member of his family was missing from the data; Bukhari says he had referred the matter to Butt as a routine query. When asked by the inquiry why he wanted to obtain passport numbers, he had claimed that the message was wrongly sent to Butt but was in fact meant for his wife whose family was to travel abroad and needed some help.The other staffers named in the complaints had claimed their accounts had been used by someone else but the inquiry committee didn’t give their claims much credence since the Nadra data of several individuals had been found in their phone records. These three accused are Saifullah, deputy assistant director (trainee) in Kohistan, Farooq Ahmed, junior executive in Kohlu and Muhammad Ali, deputy assistant director (internee) in Dera Ismail Khan. According to the investigation, the record of as many as 14 CNICs was accessed by all four accused.