Exposed by Design

On 1 March 2026, Pakistan's national communication satellite PakSat-1R was hijacked. For several minutes its broadcast feed displayed scrolling anti-state messages before engineers regained control. The incident lasted minutes. The question it raises will last much longer: if Pakistan's satellite infrastructure can be penetrated and weaponised for strategic messaging, what does that imply for infrastructure that is simultaneously more critical and less visible — the power grid?

This working paper argues that Pakistan's electricity infrastructure, built on Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems (ICS), presents a Tier-1 national security exposure. The vulnerabilities are not hypothetical. They are the same classes of weakness that state-sponsored adversaries have already exploited to collapse power grids in Ukraine, probe infrastructure across Europe and North America, and attempt to trigger industrial disasters in the Middle East. Pakistan's grid is not meaningfully more secure than any of those targets. In several respects, it is less so.

Three findings anchor this assessment. First, Pakistan's grid architecture — aging legacy systems, inadequate IT/OT network separation, foreign vendor dependencies, and near-zero operational technology monitoring — creates an attack surface that Advanced Persistent Threats are designed to exploit. Second, Pakistan operates in a regional threat environment that includes state actors with both the capability and the strategic motivation to conduct sub-threshold infrastructure operations. Third, the institutional response, fragmented across NCCS, NEPRA, NTDC, and multiple DISCOs with no dedicated OT security mandate, is not commensurate with the threat.

The paper closes with a prioritised set of recommendations structured across three time horizons. It is submitted as a working paper, not a finished assessment, and the author explicitly invites challenge, correction, and expert input.