,
12 tweets,
3 min read
Read on Twitter
This is a bad bad, very bad idea at its core! Exposing crucial personal data to everyone has so many risks which is not worth the benefits of it. Thread. 1/n
First of all, all you require is a CNIC and email/phone to register an account. Worse that can only be email. CNIC in Pakistan are taken for granted. They roll hand to hand like biryani.
Worse place is the photocopiers where no regulation stops them from personal identity theft. Recently in November, I went to get some photocopies of CNIC in Gujranwala and even after telling the person to make 1 copy, he made 2. Tried best to hide one until I got both from him.
So as soon as you are passed first step on this web portal, you are now warned in red, that registration by using anyone else's information is not allowed. Bravo, that would stop all the potential data theft / criminal activity. That can only be indicative measure at most. 
Even worse is the next action, a set of questions to verify identity but wait for it. It gives you half of the personal information already. For me, it said, tell us your wife {FULL_NAME} place of birth. I mean of course, they were thinking of 4 marriages allowance.
Second question is mother's place of birth. I wonder why they did not consider step-parents here by giving specific mother name. Anyhow, family members, close friends, relative or anyone could get hold of such information easily!
Same goes for siblings, FULL NAMES are exposed to confirm their places of birth. Step 2 will now error if you did not put a valid CNIC in first place but would not let you edit it. So you start over again. Seems like a useless step if it did not verify the CNIC in first place. 🧐
Then you pay and voila. You get literally all the crucial personal information right there with an ID photo. The so called *INDICATIVE* profile, gives you additional information but at least it is masked out. Other information is last few mobile numbers, passports, travels info.
Needless to say that it is massively vulnerable data theft platform for the mass out there. I do not see a general use case of this at all. Why would anyone else outside of official capacity would need to access/see such a profile. No where in world any govt exposes such info.
Also not for forget the missing business opportunity for govt which is shadowed by Rs 500 fee which probably is taken as steady revenue stream and a barrier to system abuse.
Also can someone from legal explain that under what regulations, govt is or is not allowed to expose such personal data. Same to protect it first against any abuse.
This could have been better as a service open to registered businesses only so a good track record of data access is maintained and much better revenue stream. Please take it offline!!!
