Pakistan’s Biometric ID Scheme is Stripping Citizenship from Thousands of People

The National Database and Registration Authority has received global praise for the design and maintenance of a vast system that holds the information of 98% of the country’s population. For some, however, it is making normal life impossible

SATURDAY, MAY 21, 2016. Balochistan, Pakistan. Akhtar Mansour, head of the Afghan Taliban, finished his lunch at a roadside cafe, and was en route to the provincial capital of Quetta when his white Toyota Corolla was reduced to a smoldering mass of twisted metal by two Hellfire missiles, fired by a U.S. military Reaper drone.

Mansour was killed in an instant, his death now a footnote to America’s 20-year misadventure in Afghanistan. But he was survived by a shiny piece of mint green plastic, retrieved from the car’s charred remains: an identity card issued by Pakistan’s National Database and Registration Authority (NADRA) that identified him as Muhammad Wali, a Pakistani citizen.

For Pakistan’s government, the discovery that the leader of the Afghan Taliban had acquired this supposedly secure and unforgeable form of identification was a source of great embarrassment. In response, a nationwide identity “reverification” campaign was launched to root out foreigners posing as citizens, forcing 180 million people to prove that they were, in fact, Pakistani.

That was the summer when, with the War on Terror as a dramatic backdrop, a woman named Gulzar Bibi received a letter from NADRA informing her that her ID card had been blocked. She didn’t know it then, but the news would turn her life upside down and leave her living in fear for years to come.

***

Fifty-three years old and a mother to nine children, with a voice prone to swelling indignantly when launching into a story, Gulzar has lived in an informal settlement in the Pakistani capital of Islamabad for the past 40 years. She spends the monsoon months muttering Quranic verses, praying that the water rising in the garbage-choked sewers nearby will not wash her home away. For the rest of the year, she fights off threats of eviction from Islamabad’s municipal authorities, staring down bulldozers dispatched to raze her house.

Life is usually difficult for Gulzar, but NADRA’s decision to suspend her computerized national ID card (CNIC) made it impossible to do things most people take for granted. Her cell phone stopped working and she was unable to access welfare programs that provided food rations, state-subsidized medicines and free schooling for her children. Quickly, her eldest daughter realized that her ID card had been suspended as well. In official NADRA parlance, it had been “digitally impounded.” Then, all three of Gulzar’s sons followed, along with a brother in Lahore. Like dominos, the whole family fell.

The letter instructed Gulzar to visit a government office three miles away. A widow who barely makes ends meet by cleaning rich people’s houses, she grapples with a number of long-term health conditions. Years ago, she had been bitten by a pair of dogs. The infection festered, curdling into sepsis and debilitating her for life. “I walk two steps and I’m out of breath,” she told me. Still, she had to go. She could not survive without state support.

Gulzar’s predicament wasn’t an aberration. In October 2016, NADRA revealed that it had been blocking an average of 225 CNICs every day since September 2013 — throwing, by that count, a grand total of nearly 660,000 lives into chaos. Many have been reinstated but, as of March 2020, more than 150,000 identities remained suspended. Over the past two decades, the CNIC has come to underpin all aspects of Pakistani life. Since it is also an official marker of citizenship, an impounded card renders its holder, to all intents and purposes, stateless.

Established in 2000, NADRA has been internationally celebrated for designing and maintaining a national database that holds the personal and biometric information of 98% of the Pakistani population. The World Bank has referred to the organization as “the single source of truth for identification data” in the country. The authority — which falls under the jurisdiction of the interior ministry, but operates as an independent corporate body — has since helped to implement identity-related projects in Bangladesh, Kenya, Nigeria, Sri Lanka and South Sudan.

But, as thousands of Pakistanis can attest, NADRA is also a perfect example of the dangers of unchecked digitization, of how centralized databases can be wielded against people who don’t fit the state’s idea of a model citizen — to the particular detriment of women, working-class people and ethnic, sexual and religious minorities — and how such systems can push someone like Gulzar even further into the margins. The information collected by NADRA, staggering in its volume and increasing by the minute, is also maintained in the absence of legal safeguards, meaning that there is no way of knowing how it has been, will be, or could be used in the future.

Despite multiple requests, NADRA did not respond to the questions raised by this report.

***

Biometrics — deriving from the Greek “bios” (life) and“metron” (measure) — have formed part of identification systems for thousands of years. Evidence exists from Assyrian payment receipts to inky footprints on Chinese divorce records. In South Asia, however, the gathering and collation of this form of personal information has long been associated with ideas of criminality and state control.

In 1858, near the Hooghly River in West Bengal, India, the English civil servant William James Herschel ordered a local contractor named Rajyadhar Konai to stamp his palmprint on a piece of paper, in order to make an agreement they had reached binding and indisputable.

“I was only wishing to frighten Konai out of all thought of repudiating his signature hereafter,” Herschel later recalled. Herschel was struck by the unique yet highly reproducible nature of the human handprint and his decision marked its first modern use for official purposes. For administrators of the British Empire such as him, the native population of South Asia tended to blur together. Individual identity was, as one scholar put it, unfixed in the colonial gaze. Herschel believed that the uniqueness of a person’s biometric information could help colonial authorities to keep track of people on an individual level.

The practice of fingerprinting, writes historian Chandak Sengoopta in his book “Imprint of the Raj: How Fingerprinting was Born in Colonial India,” is a bit like curry powder: “Developed in India but not indigenous, British but not evolved in Britain itself… incorporated into British tradition and then gradually retransmitted to the world at large, blurring the simplistic distinction we often make between home and empire.” By 1897, the entire Bengal police force had taken up fingerprinting. Four years later, the London Metropolitan Police would begin using it in criminal investigations, too.

***

More than a century later, Gulzar stood in line at NADRA’s newly inaugurated “Mega Center” in Islamabad’s central business district to reinstate her card. She wasn’t aware of the murky history of identification on the Indian subcontinent, but she still couldn’t help feeling like a criminal. Not only does a blocked CNIC have immense material ramifications, it also takes a psychological toll. You can’t help but wonder, what did you do to provoke the blocking of your ID and what will the future consequences be?

This anxiety is especially pronounced for Pashtun people like Gulzar. Pashtuns account for the majority of blocked CNICs — 63% in 2017 — despite accounting for just 15% of Pakistan’s population. The Pashtun community has historically lived in southern Afghanistan and northwestern Pakistan, an area long unsettled by war and displacement and once again making worldwide headlines for those same reasons. It is unclear what your legal rights are if NADRA blocks your card, but many Pakistani Pashtuns fear being categorized as Afghan refugees and forcibly sent across the border, to a country they have never lived in.

At the NADRA office, Gulzar learned why her card had been blocked. NADRA’s database is organized as a network of family trees, with a man as the designated head of each registered household. One of her brothers had lost his CNIC and, when a stranger tried to pass it off as his own, the system flagged it and blocked all other linked IDs.

The officials were far less helpful when it came to fixing the problem. Gulzar would have to provide some sort of evidence that her family had been resident in Pakistan before 1978, the year the country amended its citizenship laws to account for East Pakistan becoming the newly independent Bangladesh. And, no, copies of her long-deceased parents’ papers would not do. Perhaps some sort of land record? Maybe a tenancy agreement from 40-odd years ago?

Gulzar’s heart sank. Although she now lives in Islamabad, she grew up nearly 125 miles away, in Peshawar, the capital of Khyber Pakhtunkhwa province. “My parents, grandparents, uncles are all dead,” she told the person handling her case. “The only land to their name is the graves in which they’re buried.”

The NADRA official shrugged. If Gulzar wanted her CNIC to be reinstated, heading back to Peshawar was the only way.

Gulzar’s worries over her suspended identity were not just for herself. “I’m an old woman,” she shrugged. “I’ll die soon enough.” Her biggest concern was that if she didn’t scramble to sort the matter, her children would suffer. With that in mind, but no plan in place, she boarded a bus and set off in search of documentation that would prove she was from the country she had lived in all her life.

***

Rather than fading away, the colonial legacy of individual identification came to be seen as increasingly necessary in South Asia after Partition. The fall of the British Empire and the creation of an independent India and the new state of Pakistan in 1947 was a bloody and chaotic process. Nearly 10 million people scrambled across hastily drawn borders in what remains one of the largest migrations in human history. Who was Indian? Who was Pakistani? Who was a refugee, requiring state assistance? Governments on either side wanted to know.

In Pakistan, a citizenship law was enacted in 1951. People born there after that year, those who migrated there before 1952 and others with at least one Pakistani parent were deemed to be citizens.

Similar questions arose in 1971, when Bangladesh declared its independence. Under then Prime Minister Zulfikar Ali Bhutto, who came to power on the socialist promise of “roti, kapra aur makaan” — food, clothing and shelter for all — a national registry began collecting data in 1973. In the absence of a “full statistical database of the people,” Bhutto declared, “this country is operating in utter darkness.”

Looking back, you can see the emergence of a fundamental tension. Did Pakistan’s government want to know who people were in order to provide them with welfare entitlements or did it just want to know who they weren’t: an Indian, a Bangladeshi, or a member of some other ostensibly undeserving group? Welfare and surveillance aren’t necessarily mutually exclusive motivations, but in the ensuing decades — especially the 1980s, when millions of refugees fled the Soviet invasion of Afghanistan for the relative safety of Pakistan — the gap between them widened.

Gulzar Bibi was a little girl in 1973, when Pakistan first began issuing photographic IDs. (The very first was issued to Bhutto himself.) She lived in Peshawar, in a house bursting at the seams with grandparents, uncles and aunts, nieces and nephews. The men worked as butchers, while the women stayed home.

Her family had all moved out decades ago but, when Gulzar stepped off the bus from Islamabad, she went straight to her old house and knocked on the door. When the owners answered, she recited the names of her grandfather, father and uncles. Did they sound familiar and did the new residents remember buying the house from any of them?

They did. Relieved beyond measure, Gulzar returned to the NADRA office in Islamabad, brandishing a land deed from the mid-1970s. The officials wrinkled their noses. The document needed to be attested by a senior police official from a local station, they said — someone who could vouch for its veracity and for Gulzar herself. So, back to Peshawar she went, another day’s wages lost. No one at the station would sign off on the document for her. “We don’t know you,” they shrugged, “so how can we vouch for you?”

As she stood there, ready to give up, a memory floated into her head: the name of a police officer who used to visit the family shop when she was a little girl. He had retired long ago, staff at the station said, but they knew where he lived. So off she went, knocked on his door and reeled off, once again, the names of her grandfather, father and uncles. Did he remember them?

The old man squinted at her.

“Of course I do. You used to throw rocks at me when I’d come to the shop. How you’ve grown!”

***

If you know how to read it, your CNIC card can reveal a lot about you.

A sequence of 13 numbers serves a similar purpose to a social security number in the U.S. Many of those individual digits signify particular personal details. The first indicates your province of birth; the second, the division within that province, and so on, all the way down to your specific union council, the smallest administrative unit in Pakistan. The last indicates your assigned gender.

Your photograph appears on the right, in monochrome, and below it, your signature. On the left is an embedded microchip and, on the back, a QR code. Hold it up to the sun and a pair of ghost images will shimmer into view: a tiny silhouette of Pakistan and your own face. The card is printed in layers, each with its own security features — 36 in total, including microtext, holograms, guilloche patterns and rainbow printing. NADRA says that it is among the most secure digital identity cards in the world.

The data on the card is stored in its microchip, along with scans of your irises and all of your fingerprints. Along with the details of 180 million other citizens, this information is collected in a centralized database in Islamabad, which NADRA refers to as the Data Warehouse. According to a 2018 World Bank report, that database is linked to at least 336 public and private services. Three years on, the number is probably higher.

If you go to a store in Pakistan to purchase a new SIM card for your cell phone, this is likely what will happen: the salesperson will ask you to place your CNIC into a card reader; the reader then authenticates itself to the card, after which the card will verify itself to the device. Following this exchange — think of it as an introductory handshake — the reader will ask for your thumb scan and match it with the print stored on the card. If, for some reason, the system can’t match your credentials, you can’t buy a SIM. Or access your bank account. Or collect social security. Or vote.

Broadly speaking, digital biometric identification is composed of three processes: enrollment, which establishes information about a person; authentication, which confirms their identity; and authorization, which determines what services can be accessed after authentication. Think of it as a series of questions:

Enrollment: What do we know about you?
Authentication: How do we know it is you?
Authorization: What are you entitled to?

Proponents of biometric identification often invoke fraud prevention as a reason for its use, harking back to Herschel’s argument a century-and-a-half ago. There is, however, very little evidence to indicate that such systems do, in fact, curtail fraud in any meaningful way. As regards Pakistan, there is insufficient research to make an argument either way. Still, the idea has a remarkably firm grip on the popular imagination.

“There’s a way of thinking — it probably has strong colonial origins and isn’t unique to Pakistan, necessarily — that permeates Pakistani society, beginning with the elite,” said Haris Gazdar, a researcher who has worked on government social protection programs. “And that thinking is that people are opportunistic, that they’re liars and thieves, unless you can control them.”

It’s a Hobbesian view with a South Asian twist: left to their own devices, not only do people tend towards brute self-interest — in this part of the world, they are wily and have a peculiar gift for finding workarounds for almost any system or situation. (The North Indian and Pakistani concept of “jugaad,” or makeshift innovation, presents a more positive spin on this perceived trait.) Therefore, “anything automated,” Gazdar said, “anything that reduces the discretion of a person to do mischief, is deemed better.”

Digitization may hold within it dreams of a more streamlined, secure and scrupulous world, but it rarely plays out that way. In fact, it can make everyday life significantly more fraught, especially when systems do not work as intended. Sometimes — or in the case of Pakistan, often — there is no electricity or internet, meaning that card readers cannot work. Chip-based cards like NADRA’s are relatively secure: your biometric data isn’t transferred over a network, so it can’t be intercepted in that manner. They are, however, vulnerable to what are known as “man-in-the-middle” attacks, in which a malign party inserts themselves between two points of a digital conversation, making the legitimate participants believe that they are talking privately and directly to one another, when the exchange is actually being controlled by the attacker.

In addition, a significant number of people lack easily discernible fingerprints — most notably bricklayers and other manual laborers, but also some hairstylists, chemotherapy patients and older people — which complicates authentication.

Facial recognition isn’t foolproof either. Sometimes automated systems can’t tell two people apart, especially if they happen to be Brown or Black. Currently, a Pakistani Bengali man in Karachi is embroiled in a bizarre seven-year standoff with NADRA, which deploys facial recognition technology at its service centers. When he applied for a CNIC in 2013, he was photographed. When the card was collected in 2014, another photograph was taken, and the system verified that both images were of the same person. Except, they were not. The case appeared before an ombudsman, but remains unresolved. Since the case is ongoing, the man chose to remain anonymous for this story.

“The ombudsman was just as perplexed — he asked if this was a joke,” said Hiba Thobani, the man’s lawyer. “To the naked eye, it is clear that these are two separate people, but NADRA officials refused to acknowledge that their technology could be flawed.” The man in question still doesn’t have a functioning ID card.

***

Across the world, proposals for identity schemes often meet with robust opposition. In 2006, the British parliament announced plans that proved so contentious that they were repealed within five years. In India, successive governments have expanded the use of a controversial identity system known as Aadhaar, which contains the biometrics and personal information of over a billion Indians, despite opposition from a broad cross-section of activists, lawyers, researchers and politicians. When NADRA was established in 2000, however, there was no concerted movement against it.

One reason was that Pakistanis were familiar with the concept of a national ID card. Many had possessed a rudimentary paper version since 1973. Another was that NADRA, as a concept, absorbed people’s hopes and desires for Pakistan, even when they seemed contradictory. Some thought it would make the state more responsive to citizens, while others argued that it would deter criminals and other troublemakers. Some liked the idea of a more powerful state, others thought it would safeguard against state overreach, and everyone brightened at the thought of a more streamlined bureaucracy.

“At most, people said, ‘It’s an extra hassle,’” recalled Haris Gazdar. “Then they said, ‘OK, but at least it’s a one-window hassle.’”

The 2016 assassination of Akhtar Mansour and the discovery that he held a CNIC prompted the first widespread public scrutiny of NADRA’s processes. Farhatullah Babar was a senior member of the Pakistani senate at the time. “We raised this question in parliament: ‘Who issued this ID card and how? Was the state involved in any way?’” he said.

Mansour, an inquiry later revealed, had posed as a Pakistani since 2005. He had purchased property and flitted in and out of the country with ease. Was NADRA complicit or just incompetent? Would there be any real accountability? “We were told that NADRA had dismissed some lower-level functionaries,” Babar said. “The real issue, of course, was who greenlit his credentials, but the matter was not allowed to be pursued.”

Before the Mansour debacle, an underground market for NADRA data — including forged documents and counterfeit family trees — had proliferated across the country, reportedly in collusion with junior clerks at banks that used NADRA-provided verification software to steal people’s identities. It was only after Mansour’s death, Babar said, that there was any reckoning with the possibility of fraud actually being facilitated by NADRA or the use of its systems.

“The suspicion arose that, if certain state institutions could manipulate the national identity card for their own ends, then private individuals could do it too,” he told me.

That summer, NADRA began sending text messages to the head of every registered household, asking them to confirm the individuals on their family tree and to report any so-called “intruders.” Failure to do so could result in their CNICs being blocked.

t was around that time that Gulzar’s ID card stopped working. If you ask her, though, she’ll invoke a name rather than a year. “It was the era of Chaudhry Nisar,” she said, referring to Pakistan’s interior minister between 2013 and 2017. Nisar is a controversial figure, with an uncanny resemblance to Mr. Bean and a similar proclivity for public gaffes. In those years, the securitization of Pakistan was in full swing, and the sight of barbed wire, body scanners and sandbags on streets had become the new normal.

But, as terrorist violence surged — the December 2014 Taliban massacre in Peshawar of 149 people, including 132 schoolchildren, marking a particularly gruesome apogee — Nisar’s statements became emblematic of the state’s hamfisted approach. At one point he proclaimed that buying too many rotis might indicate a person’s involvement with terrorist activity and that any instances of such behavior should be immediately reported to the police.

Nisar also stated that the reverification exercise that followed Mansour’s killing — the cost of which was passed on to the public, with NADRA charging each participating household 15 Pakistani rupees — would be completed within six months. After that, the national identity database would, once more, be secure. Instead, many Pakistanis found themselves locked out of NADRA’s systems and forced to prove that they belonged in their own country. One woman, whose CNIC was blocked early in the process, threw a party for her whole neighborhood when it was reinstated — a full five years later. Some are still waiting.

It took Gulzar Bibi just four months to get her family’s cards unblocked, but the process left her with a permanent sense of dread. A few months ago, she found her son and daughter, Reza Gul, whispering heatedly in a corner. Unknown to Gulzar, they had gone to the NADRA office to apply for a passport for Reza Gul. When an official quizzed Reza Gul about her mother’s place of birth, she gave the wrong answer, sparking terror that the family’s CNICs had been suspended all over again.

“When they told me this, I swear to Allah, my head whirled — the curses that flew from my mouth!” Gulzar recalled.“I grabbed all my documents, put them in a plastic bag and went straight to that NADRA officer. I threw all our cards at him. I said listen, if you don’t want to issue her a passport, don’t — but how dare you block our cards again? Open them up right now or I’ll break every chair in this office. He was so terrified by all my fuss that he began apologizing. ‘You’re like our mother,’ he pleaded.” Gulzar refused to let up until the man confirmed that their IDs were free and functioning.

***

Gulzar’s youngest child, Saba Gul, a lanky 10-year-old with tousled hair, is fond of clambering upon the rubble that forms the boundary of the family home and peeping, like a solemn little soldier, over a tattered orange tarpaulin, strung up to replace a wall demolished in the city’s latest eviction attempt. While her mother talked, Saba skipped idly around the yard, squatting among the hens, trailing her fingers along the clothes draped on the line. From time to time, Gulzar looked towards her with an expression peculiar to mothers everywhere: one of stern affection.

Gulzar cannot enroll Saba in a government school. NADRA officials, she said, were refusing to issue the necessary documents because she was born after the death of Gulzar’s husband. The database flagged this tragic and inescapable fact as a system error.

“I didn’t know how to tell them she was already in my stomach when my man died,” Gulzar told me, drawing her shawl tight around her. “This is a conversation strictly for women, you know.”

Like any software, NADRA’s identification system operates within the limitations built into it by human designers. Given the system’s patrilineal structure, when a woman marries, her record moves from her father’s tree to her husband’s. When she renews her CNIC, her spouse’s name appears on the card, replacing the father’s. (NADRA has recently announced a relaxation in this policy but, either way, the records of Pakistani men require no such migration.)

Another rule, explained in a 2014 essay by Tariq Malik — head of NADRA at the time and chief architect of the organization’s biometric services — requires that the age of a person be less than the duration of their parents’ marriage. That stipulation assumes no children are ever born out of wedlock in Pakistan. Such rules are often presented as fixed attributes of the system, but they stem from choices made by people, based on a sense of what they believe Pakistani society should look like, not what it can and does look like.

Across the world, researchers are discovering the complex and occasionally counterintuitive consequences of database design. The United Nations High Commissioner for Refugees’ digital identity system, for instance, is also family-based. Unlike NADRA, however, the first and oldest person to enroll is registered as the head of the household. Accordingly, they then have the right to receive benefits on behalf of the family.

Emrys Schoemaker, a researcher whose work focuses on digital identities, explained that when families from South Sudan sought refuge in Uganda, women and children fled first. Designated as the official heads of their families, many women felt newly empowered. “They could make different financial decisions. They could invest in education,” Schoemaker said. “But their partners weren’t so happy about not being able to control household resources. Apparently, this was the biggest driver of domestic violence in refugee contexts.”

In the case of NADRA, a number of lawsuits illustrate how the messiness of real life collides with the constraints of an automated database. In 2013, the authority blocked the CNIC of Urooj Tabani, a young woman born in 1993. At the time of her birth, according to publicly available court documents, Tabani’s mother and father had been married for four years. A year later, another man surfaced, claiming to be her mother’s husband, alleging that they had married before then and never divorced. In turn, Tabani’s father filed for an annulment. Years later, in 2011, when Tabani turned 18 and got a CNIC of her own, he complained to NADRA and asked for her to be removed from his family tree. The authority complied, even though Tabani’s parentage was never in dispute. Under the logic of the rules governing NADRA’s database, the marriage had been voided, so Tabani couldn’t even exist.

Tabani sued NADRA in Islamabad High Court in 2019 and won. The court ordered NADRA and her father to each pay her half a million rupees ($2,886) in damages. But, in 2018, 22-year-old Tatheer Fatima had less luck. Fatima was making an opposite demand, petitioning the Supreme Court to remove her father’s name from her identity documents. As he had abandoned her at birth, stopped paying child support when she was a toddler and refused to facilitate her application for a CNIC or a passport, why should her identity be linked to his? Instead, she wanted to be known as “bint-e-Pakistan” — a daughter of Pakistan.

Over the years, NADRA has made accommodations for certain groups that do not fit its traditional notion of family. In 2014, following a three-year court struggle, it relaxed the definition of “parent” for orphans, allowing the head of an orphanage to become a child’s legal guardian. In 2017, with its hand once again forced by legal proceedings, NADRA clarified its policy regarding the “khwaja sirah” (trans or third gender) community. It would allow community leaders, or “gurus,” to appear in place of a parent on a khwaja sirah’s CNIC. A few years earlier, the community had locked horns with the authority, winning the right for its members to self-identify as a third gender on their CNICs and shutting down the authority’s initial recommendation that applicants wishing to be identified in that manner undergo a medical examination to prove that they were biologically intersex.

In Fatima’s case, however, the court took a proscriptively conservative approach. After hearing arguments from NADRA, which protested that it could not skip the father’s section in the database without installing new software, the court dismissed her petition altogether. The removal of her father’s name, it decreed, would be against both shariah and the constitution of Pakistan. In doing so, though, it sidestepped a fundamental question: why is paternity integral to citizenship?

And what if there is no father at all? In the late 2000s, a British-Pakistani woman moved to Islamabad with her five-year-old daughter. The child had been conceived in the U.K. via a sperm donor: a process not currently legal in Pakistan. When the woman sought to apply for the child’s Form B, NADRA officials were flummoxed. The system could not compute — literally — the existence of an essentially fatherless child. The woman, whose daughter is now 12 years old, had no desire to wade into a legal minefield, so she chose to rely on visa extensions to keep her child in Pakistan. It helped that her relatively affluent status meant that she could rely on private alternatives to government services and that she and her daughter had British citizenship to fall back on. For them, the CNIC problem simply became a vague annoyance to work around, like a missing step in a staircase.

***

Citizenship is an elusive concept in Pakistan. “So slippery in fact that,” in Urdu, “there is no word that adequately describes it,” says Aysha Siddiqi, a development and postcolonial geographer at Cambridge University. Colloquially, the word “shehri” — closer in meaning to “city-dweller” — is used. In 2012, Siddiqi began studying the aftermath of unprecedented floods in Pakistan. In the previous two years, heavy monsoons had caused the Indus River to burst its banks, inundating a full fifth of the country’s landmass. Nearly 2,000 people died. Another 20 million lost their homes and livelihoods.

This time, Pakistan, long dependent on international aid, had to rely on its own social protection mechanisms. Though the U.N. referred to the floods as the greatest humanitarian crisis in recent history, the global response was muted.

NADRA stepped in to help by using its biometric database to identify and assist those affected. The authority set up registration sites across flooded areas and used vans fitted with equipment to retake the fingerprints of individuals whose ID cards had been washed away. Some 700,000 CNICs were reissued, and 77 billion Pakistani rupees ($452 million) was distributed to nearly three million families. Many had never opened a bank account, so NADRA issued them with ATM cards to withdraw cash from temporary ones, opened by the government on their behalf.

Siddiqi describes what she saw as an example of “disaster citizenship.” A strengthening of the social contract between state and citizens in the aftermath of a crisis. “This was really the first time in most people’s living memory that they got a particular entitlement from the state, simply for being citizens — not because they had access to patronage or anything like that,” she told me. “The state reached out to them on this very universal platform in a very bureaucratized manner. The people I was spending time with wanted to be seen by the state and, in some ways, the NADRA card was giving them that.”

Slowly, and at least partly through schemes implemented by NADRA, citizenship was solidifying from an abstract notion to one with material benefits. According to Siddiqui, “to discount the borderline revolutionary potential of that would be disingenuous.” When an earthquake killed at least 800 people in southern Balochistan in 2013, NADRA officials served as first responders, simply because they had offices and vehicles in the region. For some Pakistanis, living in districts that had no other trace of the government — not even a post office or police station — their first encounter with the state, other than perhaps the military, was through NADRA.

***

The shimmering promise of NADRA as a great equalizer can be seen in a recent promotional video. A woman walks into a service center and sits across from a NADRA official. She looks into a lens, then presses her fingertips, one by one, on a biometric device. Walking away, with registration form in hand, her chin lifts slightly and she smiles. “I’ll have my own national identity card,” sings a voice in the background, “I’ll take every step with pride.” Other women appear on the screen: mothers, wives and widows, trans women, women in wheelchairs. “This card will be my honor.” They visit banks and hospitals, enroll in college, line up to vote and flash inky thumbs, beaming all the while. “We must fulfill our national responsibility and acquire a national identity card.”

The researcher Haris Gazdar understands that people often do not want to live “off the grid,” separated from the safeguards and benefits of citizenship. “Most people actually want to be on the grid, they want stuff from the grid. They would like to vote, they would like their children to go to proper schools, they would like to have bank accounts and phones and all of those things. And everything required to be on the grid — such as, say, a national identity card — they want access to that, too.”

Gazdar thinks of NADRA as an inevitability, something that the market would have created, had the state not. His concern is how it can become more inclusive and closer to the benevolent technological utopia of the promotional video. “Now that we have an instrument that is so important and powerful, how are we actually using it? And why are so many people out of it?” he said. “How is it that a lot of people have disputed claims? Why are we making life so difficult for people when errors occur?”

Most horror stories about ordinary people locked out of NADRA are part of an older, global narrative of bureaucracy as a brick wall. The difference is that, in most other encounters with the state, individuals do, at least, have some recourse. “The police have the power to arrest me and I have the right to contest that,” Gazdar said. “The procedures are laid out, even if they are frequently violated. With NADRA, the problem is that it’s grown so quickly and expanded into so many areas, because of the way that we use technology, that this conversation was never had.”

***

When digital rights advocate Nighat Dad moves through Lahore, Pakistan’s second-largest city, she always notices the CCTV cameras mounted above the streets, recording its inhabitants. “It’s pretty jarring, actually,” she said. “They flash abruptly when capturing an image. If you’re driving, it can be a safety hazard. People often complain about that flash, but I’ve never heard anyone ask exactly what is being recorded, where the data is being processed, who has access to it, when it will be destroyed. Those questions come to my mind, but an ordinary person won’t think that way. They’ve always been told that this system has been put in place to make us safer.”

The CCTV cameras — numbering at least 10,000 in 2,000 locations across the city, although nearly half reportedly do not work — are part of the Lahore Safe City project, one of several such initiatives linked to NADRA’s database being rolled out in urban areas across Pakistan. Most have been installed in partnership with the Chinese technology firm Huawei. (According to research from the Washington D.C.-based Center for Strategic and International Studies, Pakistan has signed more agreements of this nature with Huawei than any other country in the world.) The Safe City project first attracted scrutiny in 2019 when intimate images of couples in cars, captured by CCTV cameras, were leaked on social media, with license plates clearly visible.

Earlier this year, a California-based firm subcontracted to develop technology for the Lahore project sued Huawei in U.S federal court, alleging that Huawei had pressured it to build in a “back door” that would grant access to sensitive Pakistani data, including national identity records. Huawei denies the allegations.

In 2012, a Turkish hacker claimed to have accessed NADRA’s servers by creating backdoors to them. In 2015, intelligence reports warned of data leaks resulting from the government’s reliance on third-party technology, much of which is sourced from companies based in countries including France, Germany, Sweden and China. Last winter, the names, addresses and CNIC numbers of over 100 million Pakistanis were available for sale online, but both the interior ministry and NADRA denied responsibility for the breach.

Explaining the implications of compromised data to ordinary people is frequently challenging for digital activists. The threats often seem abstract and improbable. But, in Pakistan, the dangers are real and concrete. In late 2020, a 15-year-old girl went with her mother to a government welfare office to collect relief payments. An employee used the phone number on her records to harass her, then turned up at her house and raped her. A few months later, in a separate incident, a NADRA employee was arrested for harassing a woman over the telephone. He had retrieved her number from the NADRA database.

In the summer of 2021, as the Taliban reclaimed power in neighboring Afghanistan, it seized control of everything left behind by departing American forces, including military biometric devices and U.S.-funded Afghan government databases. Anxieties in Pakistan took a new turn. What if Pakistani data falls into the wrong hands at some point in the future?

“If the U.S. didn’t think about how that technology could be weaponized against Afghan citizens, do you really think we’ve thought about that?” asked Dad. When new technologies are introduced, she argues, they are always presented in a positive light, as crucial to national security and economic development. “But we’re never permitted to discuss its possible side effects. If you don’t give space to that discourse, then you’ll never consider the possibility of misuse. And you won’t have prepared for it.”

Dad then paused. Over the years, so much ground has been lost to technological evangelists that the comparatively small number of people with contrary views have been forced to reconfigure their positions. “Earlier, we were very outspoken in our opposition to a biometric database,” she said. “But now, so deep into the digital era, you sort of surrender yourself to its inevitability. We’ve come to the point where we’re like, ‘OK, biometric data is fine — but where’s the protection mechanism?’”

She is quick to point out that Pakistan still has no data protection law. A bill is currently under review. In its first iteration, government bodies were exempt from the stipulations contained within it. “Without a law, there’s just no way of holding anyone accountable,” said Dad. “We currently have no legal recourse, no way of holding to account Safe City administrators, telecoms companies, internet service providers — any public or private body that is handling our data, really.”

In 2016, Pakistan passed the Prevention of Electronic Crimes Act, a controversial law that ostensibly aimed to counter online harassment and terrorist activity. Instead, it has severely curtailed free speech and privacy. Journalists and bloggers critical of the state are frequently charged under the law and state agencies are authorized to collect and record their data in real time, without a prior warrant.

“We’re the only country in the world to pass such a law and, yet, we have no data protection measures in place,” said former senator Farhatullah Babar. “The result is that state agencies can play havoc with your data with absolute impunity.”

One example is a court order from 2017. While hearing a case on the proliferation of allegedly blasphemous content on the internet, a High Court judge ordered NADRA to maintain a database of individuals belonging to the Ahmadi community, a persecuted minority sect constitutionally barred from identifying as Muslim in Pakistan. The explicit purpose of the database was to ensure that Ahmadis do not hold public office. The court also ordered NADRA to provide details of people who officially changed their faith from Islam to other religions — a potentially life-threatening taboo in Pakistan — even though the country has no formal laws against apostasy.

Earlier this year, an anti-terrorism court ordered the authority to block the CNICs of the Pashtun civil rights leaders Manzoor Pashteen and Mohsin Dawar, the latter a sitting member of parliament. Pashteen and Dawar, who were charged with inciting sedition while addressing a rally in Karachi, were declared to have absconded when they failed to appear before the court in February. In response, a judge ordered that their ID cards be blocked. The order alarmed Dad, Babar and other observers. Unlike other instances of suspended CNICs, which could be argued away as technical or administrative errors, here was a clear example of the system being used against specific individuals in a pointedly punitive manner.

For the past two years, Hafiz Hamdullah, a former senator from Balochistan, has been contesting his blocked CNIC in court. NADRA said it digitally impounded Hamdullah’s card because intelligence agencies claimed that he was of Afghan origin, despite a long trail of Pakistani documents marking the milestones of his life. The Islamabad High Court noted that there was no proof he had not been born in the country. That alone, it said, made him a citizen under Pakistani law. In a detailed 29-page verdict, the court ruled that NADRA does not have the authority to decide citizenship. Its function is solely to furnish identity documents to eligible individuals. The process deployed by NADRA over the past decade — blocking CNICs while reviewing cases, leaving people in limbo for years — the document unambiguously stated, was illegal.

And yet, Dawar’s CNIC remains blocked, and the Hamdullah ruling can still be overturned by the Supreme Court. For the time being, at least, the system remains fraught with baffling contradictions.

***

There is a distinct sense of deja vu about Pakistan in 2021. Tariq Malik, the man who vastly expanded NADRA’s powers and influence as its chairperson between 2012 and 2014, is back in charge of the authority after a stint as chief technical advisor to the United Nations Development Program. One of his first moves upon reinstatement was to fire 47 NADRA employees for facilitating fraudulent ID cards. As of August 2021, amid allegations of four million fraudulent IDs circulating in the country, a new identity reverification campaign is now underway, with NADRA urging people to check for intruders lurking in their family records.

As the Taliban takeover of Afghanistan prompts an exodus of refugees, an old debate is also being reignited: what are Pakistan’s responsibilities towards its Afghan-origin communities, many of whom have known no other home? There are plans for a new ID for foreign residents in Pakistan, which will allow them to open bank accounts and do business. At the same time, though, Pakistan has drastically impeded people’s ability to move back and forth across the Afghan border.

Gulzar Bibi’s son-in-law is Afghan, a child of refugees. He makes his living driving a taxi in Islamabad. One year into the marriage, he and his family visited relatives in Afghanistan. His wife, Reza Gul, went too. “I warned them not to take her,” Gulzar said. “I only agreed to the marriage on the condition that she stays here, near me.”

The Durand Line — the boundary between Pakistan and Afghanistan — has historically been extremely porous, allowing Pashtun families, traders and fighters to freely move across it. But during their visit, in June 2016, Pakistan introduced a new policy: all Afghans wanting to cross into Pakistan would now require a valid passport and visa. Reza Gul wasn’t Afghan, but she had no way of proving she was Pakistani either: a legal minor, she didn’t have any official documentation, let alone a Pakistan identity card.

“She got stuck. She’d cry there. I’d cry here. I cried so much,” Gulzar recalled.

Eventually, the couple made it back to Pakistan. The first thing Gulzar did was march her daughter over to a NADRA office to sort out her documents.

On an overcast Sunday afternoon, Gulzar Bibi jiggled her foot on her bed, still seething. It had taken her all afternoon to recount her multiple run-ins with NADRA’s labyrinthine bureaucracy. In the yard, a rooster crowed repeatedly, as if in indignant agreement with her.

“At one point, I was ready to set fire to myself in front of the NADRA office,” she said. “This card, Allah, they treat it like some sort of national treasure, like gold.” She leaned forward. “Tell me, will we need an ID card to enter heaven now?”