Cybersecurity - The Times Of Central Asia

Viewing results 1 - 6 of 5

Digitalization

Face Pay, Palm Scans, and AI Cameras: Inside Kazakhstan’s Digital Transformation

Daily life in Almaty, Kazakhstan’s largest city, increasingly resembles scenes from a futuristic film. Subway fares can be paid with a glance, schoolchildren enter campuses by scanning their palms, and traffic flows are monitored by an expansive video surveillance system. With just a smartphone, citizens can apply for a marriage license, open a business, or access official documents within seconds. Kazakhstan has embraced rapid digitalization, positioning itself as a regional leader in GovTech and fintech. Authorities promote this trajectory as a means to create a secure and efficient environment, and the public has largely welcomed it. The country now boasts one of the world’s highest penetration rates for cashless payments and digital services. Yet the swift adoption of emerging technologies has brought new challenges. The digital infrastructure is evolving faster than the country’s legal frameworks can adapt, raising concerns among experts about how to balance technological convenience, public safety, and the right to privacy. Biometric Security or Overreach? Kazakhstan’s biometric systems are being integrated into a growing ecosystem of everyday services. A prominent example is the Alaqan system in schools, which replaces traditional entry cards with palm-scanning technology. Currently in a pilot phase at nearly 300 schools, the government plans to expand the system nationwide within the next two to three years, should it prove to be successful. Supporters argue this enhances child safety by preventing unauthorized access. Critics, however, warn that it also involves building a vast biometric database of minors, requiring unprecedented security protocols. Simultaneously, the Ministry of Digital Development is rolling out a national video surveillance network powered by artificial intelligence. The system, which integrates citywide cameras into a unified platform, will enable real-time facial and license plate recognition and detect incidents such as fights, large gatherings, or abandoned items. Minister of Artificial Intelligence and Digital Development Zhaslan Madiyev described the system as a tool to monitor public safety 24/7. Equipment Dependence and Strategic Risk Much of Kazakhstan’s surveillance infrastructure relies on equipment from major Chinese companies such as Hikvision and Dahua. Their products are favored for their cost-effectiveness, but concerns have been raised internationally over cybersecurity vulnerabilities and potential data access “backdoors.” Several U.S. and EU countries have imposed restrictions on these firms for national security reasons. In Kazakhstan, which pursues a multi-vector foreign policy, the issue is viewed more as technical than political. Experts recommend diversifying suppliers and enforcing strict data encryption protocols, regardless of the origin of the equipment. Kazakhstan’s exposure to cybersecurity risks became clear in February 2024, when a leak involving the Chinese firm iSoon compromised databases belonging to local telecom operators and targeted government institutions, including the Unified Pension Fund. The incident prompted an urgent reassessment of data security practices. Centralized data hubs, experts noted, can only function securely if accompanied by significant investment in cybersecurity infrastructure. Legislation Lagging Behind While Kazakhstan has a law on personal data, experts argue it is outdated, particularly given the rapid integration of artificial intelligence into public systems. Recent legislative amendments now allow biometric identification to...

Cyberattacks

Cyberattacks Double in Kazakhstan in Early 2025

Kazakhstan experienced a sharp increase in cyberattacks during the first quarter of 2025, with 30,000 information security incidents recorded between January and May, double the number reported during the same period in 2024. According to data from research agency Ranking.kz, the most significant growth was observed in botnet-related activity, including spam mailings, password cracking, and remote system intrusions that cause service disruptions. Such incidents surged to 17,600 in the first quarter of 2025, compared to just 1,700 a year earlier. Conversely, attacks involving computer viruses, worms, and Trojans declined by 17.9% year-on-year, totaling 7,900 cases. However, phishing attempts targeting Kazakhstani users rose by 37.2%, reaching 2,000 reported incidents. Other categories saw a decrease. Cases involving inaccessibility of internet resources dropped by 48.1% to 112, while distributed denial-of-service (DDoS) attacks fell to 23, down from 30 in the same period last year. Incidents of unauthorized access or modification of digital content also declined slightly, with nine reported cases versus 13 previously. Despite the rise in cyber threats, Kazakhstan’s IT sector continues to demonstrate robust growth. In 2024, the value of services in computer programming, consulting, and related fields reached 1.5 trillion tenge (approximately $2.9 billion), a 36.3% increase compared to 2023. Since 2016, the volume of services in this sector has expanded more than tenfold, and by over fivefold since 2019. Regionally, Almaty and Astana dominated the sector, accounting for 90.2% of all IT services provided. Almaty led with KZT 853.1 billion ($1.6 billion), followed by Astana with KZT 486.7 billion ($950 million). The lowest activity was recorded in the Ulytau region, with only KZT 712.3 million ($1.3 million) in services. Separately, The Times of Central Asia previously reported that a Chinese firm involved in cyber intelligence operations had been active in Kazakhstan for several years, accessing telecom data over an extended period.

Banking

Kyrgyz Bank Launches Loan Self-Limitation to Fight Fraud and Boost Cybersecurity

For the first time in Kyrgyzstan’s financial market, a state-owned bank has introduced a self-limitation service on loans, aiming to strengthen cybersecurity and protect citizens from financial fraud. A New Step Toward Cybersecurity According to the Union of Banks of Kyrgyzstan, Eldik Bank, a state-owned institution, has launched a digital self-limitation service for its clients. The bank believes the mechanism could significantly enhance cybersecurity across the entire banking sector, especially if commercial and other state banks adopt the initiative as well. Earlier, the National Bank of the Kyrgyz Republic (NBKR) had started examining international experiences regarding self-prohibition of online loans and the feasibility of implementing such a practice domestically. The NBKR notes that a self-ban mechanism could not only shield customers from fraud but also encourage more informed decision-making when applying for loans. The Union of Banks of Kyrgyzstan has called on the wider banking community to collaborate on this initiative, advocating for a shared database of clients who have opted to limit their access to new loans. Learning from Regional Experiences In an interview with The Times of Central Asia, Anvar Abdraev, President of the Union of Banks of Kyrgyzstan, explained that the move was motivated largely by a global rise in banking fraud. “Russia and Kazakhstan have already introduced such a service in their banks. Statistics in these countries show that a large number of financially literate people use this service, probably because of the recent increase in bank fraud around the world,” Abdraev said. He added that promoting financial literacy and offering additional protective mechanisms is becoming a crucial component of banking policy across the region. Legislative Efforts Underway The mechanism is currently being actively promoted within Kyrgyzstan’s parliament. A draft bill to formalize the introduction of self-limitation on loans has been submitted for public discussion. “The Union of Banks is also participating in the discussions and is part of the working group drafting the legislation,” Abdraev said. “We aim to create a comprehensive digital platform where, alongside self-limitation, additional customer protection mechanisms would be operational.”