A brand new service from Pakistan Telecommunications Limited (PTCL), the only fixed line operator in Pakistan, allows you to view a PTCL subscriber's telephone bill simply by entering the phone number! This means that you can view anyone's telephone bill online!
You just go to PTCL's billing area and enter the complete 8 digit telephone number. If your in Karachi be sure to prepend the digit 3 and if you're in Lahore you should prepend 2:
You can leave the account id field blank. Click on search and you are presented with the bill!
PTCL account ID workaround
Update 25 August 2010: PTCL has made changes to their search form that now require an account id.
However the check for this account ID requirement is only on their search form. If you directly enter the URL in your web browser you don't have to give an account ID. So just copy the following URL, replace 34323232 with the correct phone number and paste it in your web browser's location/address bar:
http://dbill.ptcl.net.pk/PTCLDupServiceInvoice.aspx?qsAcctID=&qsTeleNo=34323232
In the above case its a bill for an NIB bank office! But you can view anyone's bill. Your friend's, your neighbour's, even your enemy's PTCL bill!
To say the least this service by PTCL is a serious violation of privacy. Although PTCL does not display the actual phone number's called, it does display things like the National Tax Number and the address.
KESC
The Karachi Electricity Shortage Supply Company (KESC) also has a similar online bill viewing service. But they require you to enter your account number to view your bill. This is safer than PTCL's service but far from ideal. They should password protect the bill viewing section and only allow subscribers who sign up for this facility to view their own bill.
NADRA
Pakistan is the country with the world's largest biometric (fingerprint) database of its citizens managed by a government agency called NADRA. Some 90 million individual's data is stored in NADRA's database. So one should not expect privacy in such a country. NADRA has a service whereby you can SMS an individual's Computerized National Identity Card (CNIC) number to 7000 and get a reply containing their full name!
Privacy implications
While all of these little bits of data might sound harmless, you can piece together a pretty good profile of an individual from them. You can infer things about the subscriber's financial position by looking at his phone or electricity bill. How rich is he? Does he pay his bills regularly or does he have cash flow problems? Does he make a lot of calls overseas or not? Or simply whether the person is currently at home or on vacation!
Obviously web services should not be implemented like this. You don't just expose your subscriber's information online like this.