🏠 TI-2026-042P — The Pakistan Nexus: NTC, Air University, and Army Public School

Series: Glass Houses Revisited | Letter 16 of 26 | Published: 2026-06-23

Abstract: Pakistan's digital infrastructure bridges military, academic, and telecommunications networks in our data. Air University Islamabad (AS45773), Pakistan NTC (military telecom), and Army Public School Gopalpur on SchoolBridge. The 2014 Peshawar Army Public School attack killed 141 people — 132 of them children. This letter documents what it means that Army Public Schools exist on compromised digital infrastructure.

I. The Peshawar Massacre

On December 16, 2014, Taliban gunmen entered the Army Public School in Peshawar, Pakistan, and killed 141 people — 132 of them children of military personnel. It was the deadliest terrorist attack in Pakistani history. The children were targeted BECAUSE they were military children — the attack was explicitly designed to hurt the Pakistan Army through its families.

Army Public School Gopalpur appears as a subdomain on SchoolBridge.in — the same platform we documented in 042C with exposed MySQL, Redis, 283 abuse reports, 13 CVEs, and HASSH fingerprint shared with GHOSTYNETWORKS. The personal data of children at Army Public Schools — the same type of school attacked in Peshawar — sits in exposed databases.

II. Air University Islamabad

AS45773 — PERN (Pakistan Education and Research Network) — allocated to Air University Islamabad. Present in our honeypot data with 4 hits. An air force university on a research network, scanning the internet. Military academic institutions have dual-use capability: research provides cover for reconnaissance.

III. Pakistan NTC

IP 175.107.32.186 — National Telecommunication Corporation (AS23888) — Pakistan's military telecom. Commands documented in TI-017: .ssh reset, Outlaw key insertion, root password change. This is an offensive operation from a military telecom: gaining persistent access through SSH key injection and password changes.

Pakistan NTC carries nobody:webmaster from COMSATS (Commission on Science and Technology), root:iloveyou123 from Cybernet, root:syncmaster from CMPak (China Mobile Pakistan). The exploitation vocabulary density is lower than Viettel's but the military-academic nexus is tighter.

IV. The Targeting Paradox

Army Public Schools exist to educate children of military personnel. They are known targets — Peshawar proved this. Yet the digital infrastructure that holds their personal data (SchoolBridge.in) is:

Compromised (Shodan tag)
Running end-of-life software
Exposing MySQL and Redis to the internet
Sharing SSH fingerprints with bulletproof hosting
Accumulating 283 abuse reports

Either the Pakistan Army does not know its children's school data is on a compromised server — which means the Army's cybersecurity is catastrophically negligent — or the Army knows and has not acted — which means the exposure is tolerated. In either case, the children of Pakistani soldiers are digitally exposed on infrastructure that shares fingerprints with GHOSTYNETWORKS.

VII. 132 Children, Ages Eight to Eighteen

16 December 2014. Peshawar. Six gunmen enter the Army Public School.

The Peshawar Massacre:

132 schoolchildren killed — ages 8 to 18
149 total dead (including 17 staff)
Attackers: 1 Chechen, 3 Arabs, 2 Afghans (TTP-affiliated foreign nationals)
Target: children of Pakistani military personnel
Method: entered classrooms, shot children at desks
Comparable to: Beslan school hostage crisis (Russia, 2004 — 042N territory)
World's 8th deadliest school massacre

The school's name tells the story: Army Public School. Pakistan's military doesn't just fight wars — it educates children. It puts its name on their buildings. It makes them part of the military structure. And then adversaries treat them as military targets. 132 children died not because they were in a school, but because they were in an army school. The militarization of childhood education made them combatants in the eyes of their killers.

VIII. The Madrasa Pipeline: When Education Becomes Weaponization

The 9/11 Commission Report (2004, in our OSINT Library) documents the other side:

"Pakistan's endemic poverty, widespread corruption, and often ineffective government create opportunities for Islamist recruitment. Poor education is a particular concern. Millions of families, especially those with little money, send their children to religious schools, or madrassahs. Many of these schools are the only opportunity available for an education, but some have been used as incubators for violent extremism. According to Karachi's police commander, there are 859 madrassahs there."

The exploitation mechanism: The state fails to provide education → families send children to madrasas because no alternative exists → some madrasas radicalize children → radicalized children become terrorists → those terrorists attack Army Public Schools (killing 132 children) → the cycle completes.

Children exploited at both ends. At one end: poverty drives them into madrasas where they're radicalized. At the other end: they (or their products) massacre children at military schools. The state that fails education creates both the weapons and the targets.

IX. PERN: The Academic Network That Attacks

111.68.98.152 — Pakistan Education & Research Network. Islamabad. 33.72°N, 73.04°E.

PERN / Higher Education Commission:

Government-funded academic network connecting ALL Pakistani universities
ASN: HECPERN-AS-PK (Higher Education Commission Pakistan Education Research Network)
4 honeypot hits, 71% threat score
Islamabad coordinates — capital city, administrative center
Designed purpose: academic research connectivity
Actual function: also SSH attack infrastructure

The academic network — the infrastructure built to connect universities, share research, educate the next generation — produces SSH attack traffic. In a country where:

132 children were massacred AT a school
859 madrasas serve as "incubators for violent extremism"
Millions of children have NO educational alternative

...the one functional academic network the state manages to build ALSO attacks external infrastructure. Education in Pakistan is weaponized in every possible direction: children radicalized through it, children killed at it, and the network itself used as attack platform.

X. The Pakistan-Russia Credential Link: ansible Across Borders

Cybernet Pakistan (175.107.201.149) and Digit One LLC Russia (213.167.43.130 — documented in 042N) share the username ansible in a 5-node international cluster.

The ansible Cluster (5 nodes, 4+ countries):

175.107.201.149 — Cybernet, Pakistan (31 hits, 79% threat, 30 relations)
213.167.43.130 — Digit One LLC, Russia (60 hits, 89% threat, 46 relations) [042N]
61.72.55.130 — South Korea
50.62.22.47 — United States
+ 1 additional node

ansible = IT automation tool (Red Hat). Using it as a credential suggests operators who automate infrastructure management — DevOps vocabulary in attack credentials. The 5-node cluster shares this credential across Pakistan, Russia, Korea, USA = coordinated international scanning operation using automation tool naming conventions.

Cross-investigation link: 042N (Russia, state predator that deports children) ↔ 042P (Pakistan, where 132 children massacred + millions in madrasas) connected via shared credential. The same international attack operation touches both countries where children are systematically exploited.

XI. Grand Tel → Kamatera: Pakistan Connects to daddygirl2 Infrastructure

Grand Tel Private Limited (103.166.103.173, Multan, Punjab): 43 hits, 100% threat, 45 OTX threat intelligence relationships.

Among those 45 OTX connections: Kamatera IP 103.241.67.160 — the Israeli cloud provider documented in 042M. That same Kamatera infrastructure (138.128.240.172) carried the daddygirl2 child exploitation credential.

The Connection Chain:

Grand Tel Pakistan → [shared OTX pulse] → Kamatera Israel → [same company] → daddygirl2 credential

Pakistani telecom infrastructure (country where 132 children massacred at school) shares threat intelligence signatures with Israeli infrastructure (that carries child grooming vocabulary). Not direct operational coordination — but presence in the SAME threat campaigns. The attack infrastructure that connects these entities operates in the same space where children are exploited.

XII. Telenor: When NATO Ownership Means Nothing

103.57.224.219 — Telenor Pakistan. 54 hits. 90% threat. 14 entity relationships including a shared SSH key (highest-confidence relationship type = same operator).

Telenor Group:

54% owned by Norwegian state (Ministry of Trade, Industry and Fisheries)
Norway: NATO member, liberal democracy, strong regulatory framework, children's rights leader
Pakistan subsidiary: 54 honeypot hits, 90% threat, shared SSH key
Second-highest attack volume from Pakistan (after Grand Tel's 43)

Lesson: Norwegian state ownership provides ZERO security guarantee. The operational environment determines behavior, not the owner's nationality. A NATO country's state telecom produces the same attack traffic in Pakistan as domestic operators. Regulatory standards do not transfer across borders.

Same pattern as Kamatera (042M): Israeli ownership, global exploitation. Ownership nationality is irrelevant to operational function in hostile environments.

XIII. ISI Surveillance: The Intelligence Service That Created Its Own Enemy

Our OSINT Library (WikiLeaks Spy Files) documents Septier Communications Ltd — lawful interception systems deployed on telecoms including Pakistani networks:

The ISI Paradox:

WikiLeaks documents: Septier provides "Dual Usage Strategy of Lawful Interception Systems" — mobile interception (BTS, Node-B, BSC, RNC, MSC/Switch)
Pakistani telecoms (PTCL, Telenor PK) carry ISI-mandated surveillance
The SAME ISI that nurtured the Taliban in the 1990s
The Taliban (TTP faction) that later massacred 132 children at Army Public School
The surveillance infrastructure monitors the families of those 132 children

The intelligence service that created the organization that killed 132 children now monitors all communications — including those of surviving families seeking justice. ISI created the Taliban. The Taliban killed military children. ISI monitors the aftermath. The state surveills the consequences of its own creation.

XIV. The 042 Series Pattern: Children as Infrastructure

How Each Country Treats Children:

042D (Kosovo) — Organs harvested from prisoners (some children)
042G (Belgium) — Police protect pedophile networks, children disappear
042H (Jersey) — Crown Dependency hides institutional child abuse
042I (China) — 178 trafficked infants in one case, WeChat as platform
042J (Korea) — Nth Room: 26 minors among 103 victims, 260K users
042M (Indonesia) — Source/transit/destination, false birth dates for children
042N (Russia) — State abducts 19,000+ children, builds internet selection catalogue
042O (Omegatech) — Infrastructure enables sextortion of children
042P (Pakistan) — Children massacred at military schools, radicalized in madrasas, attacked from academic networks. Children are infrastructure.

In Pakistan, children are not just exploited — they are treated as infrastructure components. Military infrastructure (Army Public Schools). Radicalization infrastructure (madrasas). Attack infrastructure (PERN academic network). At every layer of the system, children are inputs, outputs, or collateral. Never the purpose. Always the material.

XV. Sources and Methodology

Primary Sources:

LSN Honeypot — PK country search (14 IPs), entity relationships (Grand Tel 45, Cybernet 30, Telenor 14)
Wikipedia — 2014 Peshawar school massacre (132 children killed, TTP, Army Public School)
OSINT Library — 9/11 Commission Report (Pakistan madrasas, poverty, radicalization, 859 in Karachi)
OSINT Library — WikiLeaks Spy Files: Septier (lawful interception on Pakistani telecoms)
Cross-references: 042N (Russia/Digit One — shared ansible credential), 042M (Israel/Kamatera — shared OTX with Grand Tel)
RIPE NCC — ASN registrations, NIC handles (AQ84-AP Cybernet, PERN/HEC)

Methodology: Shared credential cluster analysis (ansible 5-node international). OTX pulse correlation (Grand Tel ↔ Kamatera). SSH key sharing (Telenor — highest confidence = same operator). Academic network identification via ASN naming (HECPERN-AS-PK). Cross-investigation convergence mapping (042N Russia ↔ 042P Pakistan via credential; 042M Israel ↔ 042P Pakistan via OTX). Educational institution exploitation documentation (9/11 Commission madrasa analysis). Military-education nexus analysis (Army Public School naming convention → targeting logic).

⚠️ Correction & Update — 2026-07-04

Reason for update: Re-verification against the platform's authoritative entity-resolution layer (source-attributed golden records, cross-source conflict tracking, claude-opus-4.8 disambiguation). Original analysis preserved above; this note appends fresh, corroborating data.

Attribution reinforced — the academy is on NTC's own ASN. The companion dossier 042Q originally placed the CIPMA academy (IP 175.107.32.186, cipma.edu.pk) on a separate commercial ISP ("Cybernet AS9541"). Golden entity resolution now attributes that host to AS23888 — National Telecommunication Corporation (NTC) itself (verdict: consistent; class: telecom; confidence 0.92). This directly supports this dossier's central finding: the same NTC military-connected telecom that carries Army Public Schools and PERN academic traffic also hosts the cyber-policy academy — one operator, no separation between military communications and educational/attack infrastructure.

Operator-identity signal added. The NTC host now shows 49 shared_authorized_key relationships (identical SSH authorized keys reused across hosts = same operator) in addition to its 49 shared-command overlaps — a same-operator signal that postdates original publication and hardens the "shared operation" reading over mere "shared network."

Correction logged 2026-07-04 · evidence: entity-resolution golden record (AS23888/NTC) + live honeypot entity_links · original analysis unchanged above.