The Federal Board of Revenue (FBR) has launched a forensic investigation into data hacking with the help of specialists in order to find the Russian hacker and put in place the required measures to prevent such events in the future.
According to sources with knowledge of the events, it is exceedingly difficult to find the hacker, but we have begun an inquiry in this respect. The forensic audit or inquiry is also underway, with the Irish business and other specialists involved.
Simultaneously, the FBR has begun development on the disaster recovery system by relocating all FBR data to a new location for catastrophe management. The disaster recovery system would ensure that the FBR could run a parallel database system in the event that the FBR had to shut down primary machines in the future.
The FBR is looking for a Russian hacker as well as the purchaser of FBR system keys and passwords. However, officials have stated that it will be a difficult effort.
At the same time, the FBR is putting in place additional measures to prevent future cyber assaults on the FBR system. As a result, third-party forensic investigators were tasked with both implementing security procedures and tracking out the hacker.
The FBR created a “disaster recovery system” in 2008 to preserve a comprehensive backup database of importers/exporters in the event that Pakistan Customs Computerised Clearance System (PACCS) information was unintentionally lost. In the past, a suicide assault at an Islamabad hotel damaged the Evacuee Trust Building, where PRAL kept its taxpayer information. To safeguard data, importers/exporters’ data was kept in multiple places outside the PRAL office as a preventative measure.
Dr. Muhammad Ashfaque, Chairman of the FBR, recently told the media that the cyber assault on the FBR’s database succeeded in interrupting the system but failed to get access to any data or transaction information. There was no proof that the FBR’s data had been compromised, but the attackers were successful in disrupting our system. “There was a breach of our system, and it appeared that the attackers did not wish to go beyond that,” he said, adding that there were 850 data machines in all, 400 of which were interrupted.
“The data was not lost at all,” he stated emphatically. When questioned if the data had been sold for $26,000, he stated that nothing of the like had occurred. He also stated that there were lengthy procedures involved in purchasing $80 million using World Bank funds and that it was anticipated that all necessary procedures for making a purchase would be finished shortly, tax officials noted.
