NADRA’s QR CNIC Is an Upgrade—But Privacy and Design Need Answers

Why the QR Is Not Automatically a Security Downgrade

A QR code is merely a data carrier. It can hold nonsense, plain text, an internet address, an encrypted object or a digitally signed credential. Judging its security solely by the visible black-and-white pattern is like judging an online bank transfer by the colour of the button.

A properly designed QR credential can contain selected identity fields, a compressed photograph, an issuance timestamp or identifier and a digital signature produced by NADRA’s private signing key. A verifier can use the corresponding public key to confirm, even offline, that NADRA issued the payload and that nobody altered it after issuance. An attacker could print a different name or modify the encoded photograph, but the signature verification would fail.

This is why the argument that a QR code requires encryption to prevent forgery is technically incomplete. According to the NIST definition of digital signatures, signatures protect authenticity and integrity but do not provide confidentiality or replay protection. Encryption hides information; a signature proves its origin and detects alteration. These are separate security functions.

NADRA is therefore right on the broad direction. Any phone becoming a potential reader is transformative in a country where dedicated hardware never reached the ground. Pakistan’s improving mobile-internet environment can make online status verification increasingly practical, while offline signature verification can preserve basic functionality in low-connectivity regions.

The problem is not whether QR can be secure. It can. The problem is that NADRA has called the QR “secure” without publishing enough technical detail for citizens, cybersecurity researchers and institutional integrators to evaluate what that word means.

Does the QR Payload Need to Be Encrypted?

Not necessarily—but NADRA must disclose exactly what is readable.

If the QR contains only information already printed visibly on the same side of the card, encrypting that payload provides limited additional privacy. A person holding a photocopy can already read the printed name, CNIC number and other visible fields. A digital signature would be more important because it would tell an authorized verifier whether NADRA genuinely issued those fields.

The situation changes if the QR contains a photograph, complete addresses, family identifiers, tracking numbers or fields not otherwise visible to the person scanning that side. NADRA’s announcement confirms that cardholder information and a photograph will be encoded. Its published specimen also presents one QR area associated with the citizen’s photograph and another associated with citizen data. That makes the exact payload specification a public-interest issue, not an obscure engineering detail.

Using one secret decryption key inside every verifier application would be fragile because a sufficiently determined attacker could attempt to extract it from the software. But that does not mean Pakistan must choose between a completely open QR and permanent internet dependence. NADRA could combine a signed minimum-data payload with server-authorized access to sensitive fields, hardware-backed application keys, rotating verifier credentials, access logs and consent-based disclosure.

Modern W3C Verifiable Credentials standards also support selective disclosure, allowing a citizen to prove a required fact without handing over every other attribute. A hotel may need a verified name and photograph. A retailer checking age should not need a permanent address. A hospital may require an emergency identifier but not a citizen’s family tree. Pakistan should be moving toward purpose-limited verification, not digitizing the old habit of collecting everything.

Advertisement. Scroll to continue reading.

The Photocopy Problem Is Bigger Than the QR Code

Pakistan’s most dangerous identity technology may still be the office photocopier.

Citizens are asked to submit CNIC copies at residential gates, schools, employers, hotels, mobile shops, hospitals, courier counters and government offices—often without any meaningful explanation of retention, access or destruction. Those copies accumulate in drawers, WhatsApp groups, email inboxes and poorly secured databases. Nobody tells the citizen who will see them, how long they will remain stored or what happens after the original purpose ends.

A QR code could make this worse because it allows bulk capture without manual typing. A clerk who previously saw a photocopy can now extract standardized fields into a database within seconds. The QR does not provide direct access to NADRA’s entire database, but that reassurance misses the immediate privacy question: what information is already embedded inside the QR, and what can the scanning application save?

A photocopied QR is not necessarily a forged credential. It may be something more subtle—a replay of an authentic credential. If the scanner checks only NADRA’s signature, it may correctly report that the data was once issued by NADRA. That does not prove the person presenting the image is the citizen, that the citizen consented to the scan, or that the card remains active today. NIST explicitly notes that digital signatures do not inherently provide replay protection.

This is the same governance dilemma raised by Pakistan’s RoadDex surveillance debate: a useful verification technology becomes dangerous when access, retention, accountability and anti-abuse controls are treated as optional paperwork.

Pages: 1 2 3 4 5 6