Nine controversies about obligatory prepaid registration
“Register your prepaid and get free calls/internet transfer/win a car” – you can hear from Polish telecom operators, as a reminder that all pre-paid SIM cards have to be registered by 1 February 2017. One could almost think that this is just a nicely coordinated campaign of leading telecoms, aimed at collecting a bit more data about their clients in exchange for a bonus.
A real stake in this data collection effort is to increase control over all users of telecommunication networks in Poland, with a particular focus on foreigners. The demand for more data came this time not from the market but directly from the policing arm of the state. Indeed, in response to this measure being rolled out by restrictive regimes around the world, the GSM Association has been very good at pointing out the limited value of this approach from a law enforcement perspective.
Obligatory registration of prepaid SIM cards was introduced in Poland by the controversial anti-terrorism law in June 2016. This law is based on the assumption that every foreigner may pose a threat to national security and, therefore, can be subjected to surveillance. Obligatory registration of SIM cards took effect on 1 February 2017. After that, all the unregistered cards have stopped working. However, this should not stop us from questioning the logic behind the new regulation and showing its consequences, also the unintended ones.
1. Why should I register my prepaid card?
This is the number one question on the lists of frequently asked questions (FAQ) at every telecom operator’s website. Their answer is: because the anti-terrorism law says so. But they do not answer why this obligation was introduced. Our answer is: because the Polish intelligence agencies want to have even more control, despite the complete lack of empirical evidence that this measure has any meaningful benefit to crime-fighting.
2. How registering prepaid cards is going to facilitate the work of intelligence agencies?
The reasoning of the lawmakers was that registered cards are going to make it way easier to identify the owners of the numbers linked to the criminal activity, especially in the context of false bomb alarms. However, the registered owner can sell the card or pass it to somebody else, without obligation to update personal data in the operator’s register. Engaging a number of intermediaries and leaving false traces will not be much of a challenge for a determined criminal. In short, if criminals take precautions, they can easily circumvent mandatory SIM registration. On the other hand, if they don’t, metadata of mobile phones (especially call records and location data) mean that they can be identified without mandatory registration.
3. Do I have to register a card in my own name?
No. You can use a card registered in someone else’s name or pass a card registered in your name to another person. You can buy an already registered card on an online auction website Allegro (even if its rules officially say this is not allowed). You can buy one in Germany or the Czech Republic, or allow it to be registered by anyone that will be open to doing you such a favour. It is also relatively easy to register a number on somebody without this person even knowing it.
4. Is the obligatory registration going to help fighting terrorism?
In theory, registration of all SIM cards should limit the ability of anonymous communications related to criminal activity. But no criminal will register the card in their own name, unless they want to be caught! Cecilia Malmström in her role as European Commissioner for Justice and Home Affairs said there is no evidence that this is a successful measure to fight crime. Even the British government, that is famously extreme in its data collection practices, thinks so too, and based on the detailed analyses carried out by intelligence agencies and security experts, decided not to introduce such regulation in the British law.
5. What consequence can I face for selling registered SIM cards?
The minister for internal affairs, Mariusz Błaszczak, stated in the media that “those selling those cards can face legal consequences in the situation whereby these cards were used for a criminal activity”. However, there are no legal sanctions for selling SIM cards.
6. Cards used in elevators and vending machines also have to be registered. Why?
Both the Polish Office of Electronic Communications (UKE) and the Ministry of Digital Agenda have recently pointed out that not only phones but also machines – such as vending machines and elevators – are using prepaid cards for automatic communication with its operators. UKE clarified that “the main aim of the regulation it to increase the effectiveness of the Polish anti-terrorism system and the safety of Polish citizens. It is, however, even in the colourful imagination of the UKE, unclear how registering a prepaid card in the vending machine is going to help to catch terrorists.
7. What about the right to anonymous communication?
Forget about it. Polish lawmakers believe that the convenience of intelligence agencies (if we generously believe that this demonstrably ineffective measure would actually generate convenience) is much more important than fundamental rights, such as the right to anonymous communication.
8. Is my personal data safe?
From the point of view of data protection, registering cards at petrol stations, in banks, by snail mail or email, with a scan of your ID attached, sounds like a joke. We should also be asking about safeguards preventing misuse of our data by the intelligence agencies. Most countries where registration of SIM cards is obligatory have in place much stricter control mechanisms over how law enforcement agencies access and use telecommunication data, including the personal data of card owners. In Poland, this area of state activity is beyond any form of independent control.
9. Who is going to pay for it?
The lawmakers cunningly counted that the new obligation will not incur any costs for the public budget. This burden is shifted to telecom operators and their clients, and it is obvious that the bill will be rather high. Aggressive marketing campaigns, the risk of losing the customers who do not register the number on time, and building the whole network of registration points for SIM cards will represent a high cost, which will be transferred to the users.
9 controversies about obligatory prepaid registration (31.01.2017)
https://en.panoptykon.org/prepaid
GSM Association: Mandatory registration of prepaid SIM cards: Addressing challenges through best practice (April 2017)
http://www.gsma.com/publicpolicy/wp-content/uploads/2016/04/GSMA2016_Report_MandatoryRegistrationOfPrepaidSIMCards.pdf
Poland adopted a controversial anti-terrorism law (22.06.2016)
https://en.panoptykon.org/articles/poland-adopted-controversial-anti-terrorism-law
(Contribution by Anna Obem, with co-authors Wojciech Klicki, Katarzyna Szymielewicz and Małgorzata Szumańska, EDRi member Panoptykon Foundation, Poland)
