Pakistani authorities have initiated legal proceedings against two individuals in Lahore over their alleged involvement in operating an unauthorized online platform known as “Mini NADRA,” which investigators believe was being used to provide access to sensitive citizen information. According to Cyber Crime Investigation Agency (CCIA), the operation resulted in the recovery of approximately three terabytes of digital data along with two mobile phones that have been taken into custody for forensic examination. Officials identified the individuals as Muhammad Arsalan and Ali Raza and stated that the investigation centers on claims that the platform was connected to the unauthorized handling and distribution of personal information belonging to more than 10 million Pakistani citizens. A formal case has been registered under the Prevention of Electronic Crimes Act, while authorities have emphasized that the investigation remains ongoing and that the digital evidence will undergo detailed forensic analysis before any final conclusions are reached.
According to information shared by investigators, the recovered records are believed to include a wide range of personal and telecommunications related information. The material reportedly contains SIM ownership and registration details, call detail records commonly referred to as CDRs, SIM databases, live location information, family tree records, and other sensitive information associated with government institutions. Authorities stated that the alleged operators had established the platform using the name “Mini NADRA,” creating the impression of access to information associated with National Database and Registration Authority. Investigators are examining how the information was obtained, the scale of its distribution, and whether additional individuals or networks may have been connected to the activity. The recovered storage devices are expected to play a significant role in determining the origin, authenticity, and scope of the data discovered during the operation.
CCIA further indicated that investigators are also examining the alleged use of a dark web platform identified as “Khoji,” which officials believe may have been associated with the exchange of sensitive digital information. Authorities said the platform is being reviewed as part of the broader investigation to determine whether it was used for the acquisition or circulation of citizen records. The digital evidence collected during the operation has been transferred to a forensic laboratory, where specialists will conduct technical analysis to verify file integrity, identify data sources, and establish any links between the recovered information and online services allegedly involved in the case. Officials have not released additional technical findings at this stage, noting that forensic examination is still in progress and that further developments will depend on the outcome of that analysis.
The case highlights the continuing importance of safeguarding sensitive personal information as government agencies strengthen efforts to address cyber related investigations involving unauthorized digital platforms and data handling activities. While authorities have outlined the initial findings from the operation, they have also stressed that the legal process will continue alongside the forensic review of the recovered evidence. The outcome of the investigation is expected to provide greater clarity regarding the origin of the reported data, the methods through which it was allegedly accessed, and whether any additional digital infrastructure or individuals were involved. As cyber investigations become increasingly complex, cases involving large volumes of personal information continue to underscore the need for strong data protection practices, responsible management of sensitive records, and continued cooperation between investigative authorities and forensic experts.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
