Imagine arriving at a bank in Karachi to complete an urgent transaction. Its computers are working, but the connection to an essential external service has failed. Staff cannot complete the required checks. Customers wait. Now imagine a similar disruption affecting a hospital or government identity service at the same time.
This is a hypothetical scenario, not a report of a coordinated cyberattack. It raises a question Pakistan can no longer leave to technical departments alone: can the state keep essential services running when critical digital infrastructure fails?
Pakistan’s national-security debate often concentrates on military threats and territorial disputes. Those concerns remain important. But the state increasingly relies on networks that conventional military protection cannot secure by itself. An attack need not destroy a building to interrupt an essential service.
Pakistan Is Building a More Connected State
Citizens use NADRA identity verification for a growing range of public and regulated services. Banks process electronic transactions, while telecommunications operators provide the connections that allow customers and institutions to communicate.
In March 2024 the World Bank approved $78 million for Pakistan’s Digital Economy Enhancement Project. The programme aims to strengthen digital public services and support secure data exchange and authentication. The World Bank announcement describes an effort to make services more accessible.
Integration promises convenience. It also creates dependencies. A government office may keep its own computers running but become unable to complete a transaction when an external identity-verification service is unavailable. The effect depends on whether approved alternative procedures exist.
A connected state is not necessarily a resilient one.
NADRA and the Security of Digital Identity
Identity systems matter because their records are used beyond the institution that maintains them. Banks need reliable identity checks. Telecommunications providers use identity-related procedures for subscriber registration. Government departments increasingly rely on digital records.
In March 2024, Dawn reported findings from a joint investigation into compromised NADRA-linked citizen information. According to that reporting, particulars relating to approximately 2.7 million citizens had been compromised between 2019 and 2023. The investigation reportedly identified suspected insider involvement at several offices.
That finding does not mean attackers controlled the entire national identity database. Disclosure of records and loss of availability of the whole verification system are different threats. Both deserve attention.
A stolen password can be replaced. A date of birth or family relationship cannot. Identity systems therefore need strict access controls and reliable audit trails. They also need procedures for continuing essential services during an outage.
If a hospital cannot reach its usual identity-verification service, what approved alternative can it use? Such questions should be answered before a crisis.
Banking Has Become Critical Infrastructure
My years working with SWIFT and cross-border payments taught me how many separate systems may contribute to one transaction. SWIFT provides secure financial messaging for international payments. Raast supports domestic instant payments. Banks operate their own internal processing and customer applications.
A failure in one system does not automatically disable the others. A mobile-app outage is not the same as a failure of interbank settlement. Yet interruptions can spread when institutions share a critical service provider or communications link.
Pakistan’s banking networks have suffered downtime for years. The Banking Mohtasib’s 2012 annual report discussed frequent and extended interruptions. More recently, the State Bank introduced digital-service downtime reporting requirements.
In May 2026, I attempted to pay a K-Electric bill of Rs 24,050. The payment failed after my account was debited, and six days later I was still pursuing a reversal. I cannot establish the technical cause from my customer records. It was not evidence of a cyberattack. It did illustrate how service failure can outlast the initial error.
A systemic disruption would present a different challenge. Businesses might miss payment obligations while banks establish the integrity of transaction records. The outcome would depend on recovery procedures and alternative arrangements.
In October 2025, SBP issued its Technology Risk Management Framework for Payment Institutions. In February 2026 it announced the Cyber Shield Cyber Resilience Strategy for 2025–2030. These steps recognise that financial stability requires operational resilience, not merely protection from intrusion.
For more on the scale of digital payment growth, see my earlier analysis: Pakistan Has Become a Digital-Payments Economy. Has Its Financial Infrastructure Caught Up? International payments have their own dependencies, as explained in Why Your International Payment Can Be Stopped After Your Pakistani Bank Approves It.
Telecommunications Connect the System
A bank can keep its servers running while customers lose access because a communications network is unavailable. Government agencies can face similar problems when the links connecting them to external services fail.
Pakistan’s Critical Telecom Data and Infrastructure Security Regulations 2020 recognise the importance of protecting telecom infrastructure. But cybersecurity controls cannot substitute for practical redundancy.
A backup data centre offers limited protection if both sites rely on the same vulnerable communications route. A supplier used by several organisations can also become a shared point of failure.
Institutions should map these dependencies and test whether their backup arrangements really remain independent during disruption. A mobile internet shutdown does not necessarily disable all financial settlement systems; some institutions use separate channels. Accurate risk assessment must distinguish those architectures.
Not Every Digital Failure Is a Cyberattack
A software update can interrupt an essential service. Equipment may fail. Power and communications disruptions can affect organisations that have not been attacked at all.
The causes differ, but the question of continuity remains. A hospital needs a safe way to operate when electronic records are unavailable. A government department needs an approved procedure when a verification service cannot be reached.
Restoring a server is not always the same as restoring a service. Institutions may need to verify records and reconcile transactions before normal operations resume. The priority should be to preserve essential functions without weakening safeguards through improvised exceptions.
Who Coordinates a National Digital Emergency?
Pakistan adopted its National Cyber Security Policy in 2021 and introduced the Computer Emergency Response Teams Rules in 2023. These measures establish a framework for national and sectoral incident response.
The difficult question concerns practical coordination. Suppose a telecommunications provider suffers a serious incident and several banks lose connectivity. The operator must restore its network. Banks activate continuity plans. Regulators and incident-response authorities have separate responsibilities.
Who maintains a common understanding of the incident? Who prioritises restoration when several critical services need attention? How can institutions exchange information without exposing sensitive vulnerabilities?
It would be wrong to assume that no coordination exists. It would be equally wrong to assume that formal rules prove readiness. SBP’s industry-wide cybersecurity drill initiative is a useful model for testing operational responses. Similar exercises across sectors could expose shared dependencies before a real emergency does.
Can the State Continue Functioning?
A major cyberattack would not automatically stop Pakistan’s government. Institutions operate through different systems, and some have alternative channels. The serious risk is a prolonged disruption affecting several essential services at once.
The country has begun developing a stronger policy framework. The World Bank’s digital programme, national CERT arrangements and SBP’s Cyber Shield strategy show that policymakers recognise the challenge. Publicly available evidence does not yet establish how well these arrangements would perform in a coordinated, multi-sector emergency.
Pakistan needs joint exercises that test continuity rather than merely technical defence. Regulators should examine shared dependencies and require institutions to correct weaknesses found during recovery drills. Appropriate public reporting could demonstrate progress without disclosing sensitive network details.
I return to the bank in Karachi. A customer sees a transaction that cannot be completed. Behind that delay sits a network of institutions and external services. A larger failure would expose those relationships at national scale.
The test of digital national security is not whether every attack can be prevented. It is whether the state can keep essential services functioning while institutions recover.
About the author
Muhammad Munaeem Jamal writes from Karachi about political economy and public institutions. His professional background includes SWIFT operations and cross-border payments in Pakistan’s banking sector.
Featured image is an editorial illustration, not a photograph of a cyberattack.
Explore the series: Find related explainers on Raast, failed transfers, customer complaints and international remittances in the Pakistan Payments Guide.