It was stated on August 11 that personal data from about 15 million Kazakhs had been sold on the dark web, once again raising concerns regarding national security and the country’s quickly growing digital infrastructure. The database, said to include millions of records, allegedly came from Kazakhstan’s e-government system, according to The Diplomat. Kazakh authorities looked into the claim, and fact-checkers later found it could not be verified because the documents provided as evidence were not related to the e-government system.
Despite this, the episode highlights a broader issue in Central Asia: the pace of digitization is outpacing the region’s capacity to manage the security risks it entails. Governments are rapidly moving public services, financial transactions, identification systems, and administrative procedures online. While this shift makes life easier for both citizens and administrators, it also creates broader opportunities for digital attacks. Without improved cybersecurity governance and faster incident response, the very modernization efforts meant to strengthen these states could become their weakness. Kazakhstan shows the extent of the situation: according to government data, more than 15 million people are registered on its e-government portal, and about 90 percent of its 1,300 government services are now available online. The first problem is that so much sensitive information is concentrated in one system.
The central paradox of digital governance is that the more services a government brings online, the greater the efficiency gains, the greater the vulnerability to attack. This vulnerability is no longer just an IT issue; it has become a question of national security and, in effect, state sovereignty. If a breach occurs, citizens can face identity theft, phishing, and other forms of exploitation, and every such incident erodes the public’s trust in digital government.
The surrounding area is not starting from scratch; Uzbekistan has advanced its ‘Digital Uzbekistan 2030’ strategy to digitize government services and increase broadband access, while Kyrgyzstan’s Tunduk platform connects state databases so agencies can share citizens’ records electronically. Tajikistan and Turkmenistan have taken a more cautious approach, yet both countries are still extending their own e-government pilot schemes. A common gap across these initiatives is a shared regional arrangement on cybersecurity. Existing regional platforms, including the Shanghai Cooperation Organization and the Central Asia Regional Economic Cooperation program, have begun addressing aspects of digital and information security, but cybersecurity cooperation remains fragmented and lacks a comprehensive regional framework.
The real problem is that Central Asian states should begin to view cybersecurity as a regional responsibility rather than an entirely national one. At present, each country tends to look after its own databases, networks, and institutions, a reasonable approach, but a restrictive one. Because cyberattacks move faster than conventional ones, if one country identifies new malware or finds that its government systems are being targeted, any delay in passing that information to its neighbors leaves them vulnerable to the same attack. Establishing direct links between national cybersecurity agencies so threat intelligence can be passed quickly from one to another would reduce the time attackers have to carry out their attacks and help avoid one state being struck immediately after another.
Joint cybersecurity drills would also help, as they would allow states to stress-test their systems, detect weaknesses before attackers do, and practice how they would communicate with each other during a real incident, not just in theory.
The region should also aim to establish common standards for government databases and for critical digital infrastructure. Although this will not be easy, since legal systems and institutional capacity differ greatly among the five states, it is by no means impossible. Setting common baseline requirements for breach reporting, encryption, and authentication would give the region a firm foundation to build on, even before all countries achieve full harmonization. Whether or not the Kazakh leak turns out to be genuine, it has already demonstrated how swiftly public confidence can be shaken by a single cyber incident or even by an unverified claim when a government holds such a large amount of data in one place.
This does not justify slowing digitalization. Central Asia should not delay digitalization because of incidents like this; instead, it must ensure digitalization delivers on its promises. Digital transformation can improve governance, promote economic development, and enhance regional connectivity, but only if security keeps pace. Cybersecurity in Central Asia can no longer be seen as a national responsibility; it must be incorporated into the region’s security policy through common standards, faster information sharing, and joint preparedness. The region’s digital future is already being shaped. The issue to be decided is whether the Central Asian states build that future upon a foundation of shared cybersecurity or continue to address their vulnerabilities one country at a time.
If you want to submit your articles and/or research papers, please visit the Submissions page.
To stay updated with the latest jobs, CSS news, internships, scholarships, and current affairs articles, join our Community Forum!
The views and opinions expressed in this article/paper are the author’s own and do not necessarily reflect the editorial position of Paradigm Shift.
Abraiz Ali Ahmad is an international relations student at the University of Gujrat, with a strong interest in regional security, geopolitics, and connectivity. He enjoys looking beyond official statements and headlines to understand the interests, vulnerabilities, and consequences shaping regional developments. His particular areas of interest include South Asia, Central Asia, and the Middle East, especially where conflict, infrastructure, and geopolitics intersect.
