Identity theft persists in Pakistan's biometric era

This is a guest piece. It does not necessarily reflect the views or position of Privacy International

To open a bank account in Pakistan, to get a new driver license or passport or to activate a SIM card, you need to present a computerized national identity card. These cards are about more than just proving identity; they are essential to getting on with your day-to-day life.

So what happens when you lose your identity to fraud?

Pakistan is one of the few nations that has registered almost the entire population’s biometric details and provided citizens with a computerized national identity card. But even with that system in place, fraud is still rampant. I took a closer look at the fraud industry to understand just how identity fraud persists in the new biometric era.

What happens to victims

I recently met 'Saleem', a UK-educated resident of Karachi who had to go through such fiasco after coming back to Pakistan from England. Saleem had received his computerized national identity card (CNIC) before travelling to England for higher education.

On his return in 2010, he was astonished to find that someone else was issued his CNIC with same particulars. The only thing that was different was the photo. It took him more than a year to resolve the issue after the National Database and Registration Authority (NADRA), the independent government agency responsible for the management of the entire national database system, conducted enquiries from various agencies regarding authenticity of Saleem's claims and whether or not he was the genuine identity-bearer.

He was one of the latest victims of identity fraud happening in Pakistan. Even in the world of biometric identity and strong systems, people are able to obtain fraudulent identity cards by changing their particular details, or, in some cases, only the photo ID. The former Chairman of NADRA, Tariq Malik also said that given increasing levels of forgery and misuse in other personal documents, now is the hour to get expired identity cards renewed. He said that the menace of bogus identity cards could be wiped out by updating personal biometric details in the national database.

A neatly suited, well-spoken man, Ali Muhammad Irfan, an immigration officer with the Federal Investigation Agency, sits in a warm office in Karachi. He deals with many deportee cases on a daily basis where people are able to obtain fraudulent identity cards and passports for international travel, in collaboration with agents in NADRA and passport offices. Many try to seek asylum in Australia, Norway, the UK and Germany. Yet most of them do not make it and are deported back to Pakistan.

In some cases, Irfan says, victims of fraud do not even know that an imposter will be able to obtain a forged identity card under their name and travel abroad for asylum or better life prospects.

NADRA reports that it has deployed a state-of-the-art facial matching system with the capabilities to stop fraud and forgery in identity documents, yet people are still able to obtain forged identity cards. This was very puzzling to understand given the supposed surety, accuracy and privacy of NADRA database that such a scam was still happening even after the introduction of new chip-based identity cards.

How fake documents are obtained

NADRA has established a centralized biometric data warehouse that is connected to more than 400 registration centres across Pakistan that feed it biometric details, including facial and thumb impressions. Given the complexity and isolation in which the systems work, I needed to access someone with inside NADRA with the information and contacts to explain the way biometric matching worked and how people are still able to obtain forged identity documents.

That’s when I spoke with ‘Nazeer’, who works as an identity agent for people coming from Afghanistan to Pakistan. Like a travel agent he arranges everything, from entering Pakistan through the Chaman border crossing to traveling to Karachi to obtain forged identity documents. The costs are going up these days, he says, as NADRA officials have implemented strict policies and required documentation for CNICs. He charges 130,000 Pakistan rupees, or $1,313 for a single person. According to the International Labour Organisation, the average monthly wage in Pakistan is roughly 25,229 rupees, or $255. The costs for entire family are even higher depending upon the number of individuals.

Last week, Nazeer reported obtaining five forged ID cards from Karachi for a family from Kunduz in Afghanistan. The process can involve finding a Pakistani family willing to sell their own identity for a hefty amount in exchange for registering aliens as family members and providing the necessary documentation for registering foreigners as siblings. Alternatively, it can also involve using already available identity cards from banks, universities and government offices where people provide copies of their CNIC as part of documentation.

I asked him how he gets information about families from NADRA, as isn't it all very safe with strict privacy controls in place? To my amusement, he laughed and said that the existing information is available at all banks where NADRA provides Verisys, a commercially available file integrity monitoring system for Windows computers. All you need to do is find a CNIC number with whom you can register it. The older the CNIC, the easier it is to commit the fraud: the older cards do not have any facial matching biometrics control on them.

The last step in the fraud is to educate the applicant about his 'parents' and 'siblings' so he can identify them when interviewed by NADRA officials. To do that, Nazeer said, there are certain people who will sell the entire files of information regarding families at a reasonable price. Once you have your ID card, you can apply for a passport to travel onwards.

Threat to privacy

Biometrics may be new in Pakistan but the new technology is not curbing identity theft as expected, due to a number of limitations and the easily availability of false documentation. The privacy of personal information is a serious concern. Already, the number of fraudulent or forged identity cards circulating casts doubt on the procedures and controls to protect data privacy and has led to the introduction of a chip-based identity card that is deemed safer and more secure.

Citizens in rich countries take identity documents for granted without having to worry about documentation and ID like people in poorer countries. Even though governments and aid partners around the world are spurring the demand for biometric identity for accurate identification to process social welfare payment programs, the facts remains that identity fraud is still a massive issue.

To date, there has been little empirical work on the effectiveness of biometrics for identity fraud control purposes in national registries. Companies with proprietary biometric and facial technologies have been reluctant to provide performance data and authenticity claims. Many biometric ID programs around the world are still in their infancy phase. The technology will take time to mature for us to fully reap the benefits on identity management systems. But for the time being, we need checks and controls to keep identities from being forged.