Can somebody forge the new CNIC by copying its QR code?
Copying an authentic QR is not the same as altering it. A properly verified digital signature should expose modified data, but a copied code could replay genuine information. Verifiers must therefore compare the encoded photograph with the presenter, use biometric or liveness checks where appropriate, and check the card’s current status.
Is the QR code encrypted?
NADRA has not publicly disclosed enough technical detail to answer that conclusively. Digital signatures can prove authenticity without encryption, but they do not conceal encoded information.
Will the new card work offline?
Offline signature verification is technically possible, just as offline chip verification was technically possible. NADRA has not clearly documented which PakID functions work offline or how offline verifiers receive updated revocation information.
Could a blocked or cancelled CNIC still scan?
Its static data and signature could remain readable. A verifier must query live status or use a sufficiently current revocation list to know that the credential has been blocked or cancelled.
Should NADRA have used NFC instead?
A QR-first system is more deployable, but a hybrid QR-plus-secure-NFC model deserves consideration for high-assurance applications. NFC alone would not guarantee security or international recognition.
Must existing CNIC holders immediately replace their cards?
No. NADRA says previously issued identity cards remain valid until their respective expiry dates.
The Direction Is Right; The Public Explanation Is Not
Pakistan should welcome local production, cheaper deployment and verification technology that institutions can realistically use. Defending an idle chip merely because it was technically impressive would repeat the same mistake that kept it irrelevant for fourteen years.
But accountability is not hostility toward Pakistan. Asking NADRA to disclose how the QR protects privacy, proves freshness, checks revocation, binds the credential to its rightful holder and limits institutional data collection is the patriotic position. The state is asking every Pakistani to carry a machine-readable identity object for years; Pakistanis are entitled to know precisely what the machine can read.
The chip died because Pakistan never built its readers. The QR will fail for a more dangerous reason if Pakistan builds millions of readers without first deciding who may scan, what they may see, what they may retain and how citizens can challenge abuse. Share these questions, demand the specification, and do not let another fourteen years pass before the country discovers what its identity card was actually doing.
