101: SIM Card Registration

Photo credit: warrenski

Mandatory SIM card registration eradicates the potential for anonymity of communications, enables location-tracking, and simplifies communications surveillance and interception. By facilitating the creation of an extensive database of user information, it places individuals at risk of being tracked or targeted, and having their private information misused. In the absence of comprehensive data protection legislation and judicial oversight, SIM users' information can be shared and matched with other private and public databases, enabling the state to create comprehensive profiles of individual citizens.

But SIM card registration prevents criminal and fraudulent activities…

This is a frequent justification for these measures but experience shows otherwise. SIM registration has not been effective in curbing crime, but instead has fueled it: states which have adopted SIM card registration have seen the growth of identity-related crime, and have witnessed black markets quickly pop up to service those wishing to remain anonymous. Moreover, SIMs can be illicitly cloned, or criminals can use foreign SIMs on roaming mode, or internet and satellite telephones, to circumvent SIM registration requirements.

In Pakistan, requiring SIM card registration resulted in the emergence of black markets for unregistered SIM cards, and a rise in identity fraud. Mexico’s card registration law was enacted in 2009 but was repealed just three years later after yielding no improvement in the prevention, investigation, and prosecution of associated crimes.  

It has been exposed as ineffective and inefficient in some countries that have adopted its use: Canada, Czech Republic, Ireland and the Netherlands have all rejected proposals to establish a similar measure.

Any requirements for mandatory SIM card registration limit the individual’s right to privacy and anonymity in exercising free expression. As was noted by the UN Special Rapporteur on Freedom of Expression David Kaye in his June 2015 report on encryption and anonymity, “compulsory SIM card registration may provide Governments with the capacity to monitor individuals and journalists well beyond any legitimate government interest”.

Isn’t anonymity suspicious? Isn’t it a shield for criminals, trolls, scammers?

Anonymity benefits many people: the ability of journalists and citizens to remain anonymous while exercising their freedom of expression is important in ensuring individuals have the ability to freely enjoy their right to impart and receive information, free from state control. It empowers women and members of the LGBTQ community by giving a voice to those often denied their right to be heard. 

In repressive environments, anonymity is just about the only protection enjoyed by whistleblowers, human rights defenders, journalists, and members of the political opposition. It also gives a safer space to the marginalised by allowing them to speak out against oppression and abuse without fear of retaliation.

When one’s primary means of communication is directly linked to one’s real identity, the protection offered by anonymity disappears. Women, sexual minorities, and other vulnerable groups are exposed anew as targets of unlawful surveillance, trolling, and all sorts of harassment — a very real prospect now that most social media accounts must be linked to an active mobile number. 

What are the consequences of associating SIM registration info to other data?

This practice can enable profiling with several consequences. An individual's phone number could potentially be matched with their voting preferences or health data, enabling governments to identify and target political opponents, for example, or people living with HIV/AIDs. 

As many developing countries have or are planning to introduce compulsory SIM registration, governments would have phone numbers, tracking data, subscriber information (including address and family name). In countries with political and ethnic tensions, pairing these data with political activity might result in physical risks for the people involved. While communications surveillance systems may help a government improve national security, they are equally likely to enable the surveillance of human rights defenders, political, immigrants, and other groups. SIM card registration also brings the potential for discrimination and even exclusion from basic services.

How does the act of registering a SIM card cause discrimination or exclusion?

When mobile phones are the most common form of accessing important avenues such as banking and finance, this could result in exclusion from numerous vital public services. In some countries, the poorest individuals are often unable to buy or register SIM cards because they don't have identification documents. Undocumented migrants can face a similar problem. In addition, given the extra  burdens that SIM registration places on telcos, this may result in additional costs being passed on to customers.

Mandatory SIM card registration also tends to discourage or discriminate against categories of people. Requiring people to personally appear and present identification documents in order to purchase a SIM card will prove tricky for those with limited mobility, those that live in remote places, and those who simply do not have basic documentation like birth certificates. They may be forced to forego with registration — and their ability to communicate — altogether. This is why, in his 2015 report, the UN Special Rapporteur also recommended that “states should refrain from making the identification of users a condition for access to digital communications and online services and requiring SIM card registration for mobile users.”

Wait, isn’t access to mobile phones universal?

Access to mobile phones is not universal and, where there are mobiles, they may be shared by families. In some contexts, it is the dominant male in the household (usually the father) who ‘owns’ the phone. In this scenario, the use of mobile phones for notifying individuals about, for example, a test result, to report incidents of domestic violence, or to provide reminders about an appointment of which their family members are not previously aware could, to put it lightly, be a complicated affair.

While it may be possible to exclude specifics about a disease or medication in messages, the mere fact that one is being contacted by a health actor can be stigmatising. 
Therefore, some eHealth systems have started disguising these messages, using codes such as sport scores or messages from ‘friends’ to communicate sensitive health data, but this is not a universal practice. 

In developing countries, SIM card registration is key to accessing loans financial services. Don't you want this to happen?

The social change enabled by mobile money transfer services is undeniable. Yet a change that has not been much explored is that these services, like M-Pesa in Kenya, also produce a vast amount of data (in this case for the telco Safaricom.) Each of the millions of transactions that take place a year tell a story. 

But there is also a way in which this data is known by third parties. The transmission of the content of the money transfers over M-Pesa, for instance, is encrypted. However, the details of any transactions are sent, unencrypted, by plain SMS. Even if M-Pesa transactions themselves are sent via secure and encrypted means, the account information is not. The messages that someone sends for receiving or sending money include the name of the recipient (from the registration of the SIM), the amount sent, and their current balance. This facilitates the gathering of personal data by apps. The fact that the transactions can be tracked becomes a large part of the power of the lenders.