Internet Freedom - Not So Much in Mobile Land

Last week was Internet Freedom Day - a year after a bill attempting to restrict content online, the so-called SOPA/PIPA bill, was defeated in the United States Congress. We here at NDItech are people of the Internet. We believe, as described in the Declaration on Internet Freedom, that

a free and open Internet can bring about a better world. To keep the Internet free and open, we call on communities, industries and countries to recognize these principles. We believe that they will help to bring about more creativity, more innovation and more open societies.

But, we are worried. As an organization that supports and works for democratic principles and practices, empowered communities, and responsive and accountable governments under the rule of law, and, as a unit within this organization that believes and works on the effective and innovative use of technology in this work, we see troubling trends. 

These are trends not happening on the Internet as we typically define it per se, though even there is plenty to worry about. What we are seeing is in the land of mobile phones - the devices and networks where most of the world communicates today.  There is actually very little information on 'internet freedom' issues in telecommunications - there is no 'state of mobile freedom' report, and there is precious little data on mobile censorship, SMS tracking, surveillance, etc.  Much of it is anecdotal, unsubstantiated, or both.

The African Surveillance Regime 

However, there is a recent paper, The Rise of African SIM Registration: Mobility, Identity, Surveillance and Resistance, that adds some interesting data. (Disclosure: I provided some of the data for the study). The authors write (emphasis mine): 

"The African experience with mobile telephony has been extolled as one of the most important moments in the continent's ongoing economic development. Yet in a region where mobile telephony is the predominant form of communication, SIM (Subscriber Identity Module) registration schemes are threatening to throttle the technology’s developmental potential. These mandates, which require the registration of identity information to activate a mobile SIM card, are fast becoming universal in Africa, with little to no public debate about the wider social or political effects. 

The paper, for the first time, specifies the degree to which mobile surveillance policies and practices have been adopted in Africa, using SIM card registration requirements. 

As the authors point out, there are numerous examples of policies such as "government policies for mobile data retention by telecommunications service providers (in which these companies store call detail records on behalf of the police and security agencies for a specific period of time), law enforcement use of specialized surveillance equipment such as IMSI catchers to eavesdrop on communications and to track the location of mobile devices, and policies for the government registration of SIM cards with personal information such as name, national identification number, address, photograph, fingerprints, and so forth. For SIM cards whose users, for whatever reason, do not do so, the penalty is network disconnection. What is especially interesting about SIM registration as compared to other forms of communications surveillance is that registration requires the active participation of the individual, with immediate consequences (i.e. loss of access) for failing to comply."

Why is this so critical for our work?  Mobile communications, by definition, is not anonymous and not secure, However, it can be, in countries without such registration, pseudonymous in the sense of revealing only a phone number, a SIM numbers, and an IMSI number.  Tying the SIM (and IMSI) to a national identity card, for instance, makes all communications with that SIM card and phone immediately traceable to the person it is registered to. This makes even pseudonymous communications impossible on a mobile device. 

The Astonishing RIse of Requiring that SIM Cards be Tied to Personally-Identifiable Information - And What It Means. 

The numbers are astounding: 

Of the 54 countries in Africa, as of October 2012 at least 48 require or are in the process of requiring the registration of personally identifiable data in order to activate a prepaid SIM card. 

This is a notable change from just a few years ago. Prior to 2006, none of the countries in Africa had such a policy in place— across the continent one was able to purchase a prepaid card and use it more or less anonymously. In contrast to wealthier markets, African mobile telephony is overwhelmingly prepaid, a structure that enabled access for populations without credit records, fixed addresses or reliable income, but which has also resulted in much greater anonymity for users. The growth of SIM registration mandates might be understood as a general reaction to this. More specifically, there are a few apparent reasons for this sudden adoption of SIM registration policies.

In taking a closer look at telecommunication policies in many of these countries, independent of this paper, it turns out that in fact, there is a lot of verbatim copying of policies going on - under the guise of reducing crime and for national security considerations, but with notable absence of any data on the same in conjunction with SIM card registration. The authors note: 

Given the lack of evidence about the efficacy of SIM registration either for security or commerce, the spread of the phenomena suggests elements of what DiMaggio and Powell (1983) call “institutional isomorphism”. Instead of organizational homogenization occurring due to the demands of, say, market competition, many models and behaviors spread and are copied due to ambiguity: “when the environment creates... uncertainty, organizations may model themselves on other organizations.” In the case of SIM registration, although states have little evidence of the advantages, transformations wrought by the growth of largely anonymous mobile communication create a situation of unpredictability where imitation is likely to occur. Furthermore, because few stakeholders have challenged these policy proposals, governments have not needed to supply evidence in their favor.

In a groundbreaking paper, the German author Nicola Jentzsch (Implications of Mandatory SIM Card Registration of Mobile Phone Users in Africa - PDF) notes: “..there are essentially no robust empirical studies that show that such measures make a difference in terms of crime detection as criminals have a number of ways of circumventing rules” 

And yet, precisely this debate continues to dominate political debate in most African states on the need for these identification policies. In quite a few countries, these measures enable a greater degree of political and social control, especially since political organizing and expression via mobile devices is now standard fare in many countries. We would welcome greater empirical analysis as to what degree the desired suppression of social media, concerns about the ability of people to organize and express themselves, and political instability and dissent play a role in the rapid adoption of surveillance mechanism such as SIM card registration requirements. 

Interestingly, telcos - the mobile operators - may actually be benefitting of the SIM registration requirements, contrary to conventional wisdom. Since it takes millions of dollars and considerable administrative resources for operators to administer registration, especially in countries where this requirement is new, what is the upside for operators? While detailed data is not available and operators have not been forthcoming with any cogent economic analysis, the authors note:

"The introduction of SIM registration rules arguably increases switching costs and thereby reduces ‘churn’, the industry term for customer migration to competitors. This is because registration requirements are often burdensome and force customers to take time to visit registration centers to provide documentation and submit their personal information. Mobile operators stand to benefit from government-mandated policies, even if there may be upfront costs associated with registering users. Registration data may also be used by providers to market new services and products to customers, given that it enables “operators to have a predictable profile about the users of their network.” 

In the early days of SIM card registration requirements (such as 2006), some operators complained, notably in South Africa. The authors note that 

"operators argued that public safety is the responsibility of the state (that their existing tax dollars support), the government was of the position that the operators “are in possession of a very productive and lucrative resource and that it is therefore appropriate in the circumstances that they should bear particular obligations in respect of the implementation." In all, the top three operators reported spending around U.S. $120 million to authenticate subscribers, a price that was likely passed onto consumers."

Since 2006, however, operators have largely acquiesced to the mandate and turned it into their favor - largely by being able to data-mine and micro-target consumer for value-added services such as mobile money services, for instance.  

The authors note that these requirements are starting to have an effect.  They note that mobile diffusion is slowing down as a result of SIM card registration requirements, decreasing the boost in mobile subscriptions often considered critical for a development agenda.  There are implications for crime and a mobile financial inclusion agenda. Most importantly from our point of view, however, are the anti-democratic tendencies this growing surveillance regime implies. The authors note forcefully that:

"....in considering SIM registration and resistance, it is crucial to consider it as a component of a growing surveillant assemblage that also incorporates other technologies such as biometric identity card and electronic passport systems, which are rapidly being adopted by governments on the continent, new video surveillance technologies, and, especially important in the African context, electronic health systems.

This is exacerbated by the low level of democratic development in Africa. According to Freedom House (2012), only 10 countries qualify as free, and one of those— Mali— was the site of a recent coup. Whitehouse (2012) notes that, “the number of electoral democracies on the continent has fallen from 24 to 19 in the last seven years.” Indeed, non-democratic African countries have proved quite adept at subverting any potential liberatory effects of ICT. Ethiopia has maintained a government monopoly on telecommunications and invested significantly in controlled networks; Swaziland’s absolute monarch is a large shareholder in the monopoly mobile operator MTN, which also has his daughter on the board of directors, and has been accused of shutting down its network to impede political protests. More broadly, mobile communications are a far more controlled infrastructure than the Internet, limiting their potential. The addition of SIM registration requirements only serves to lower the barrier to surveillance. The resulting chilling effects arise just as many hope that mobiles can be used to promote democracy on the continent.

So, on as we celebrate having fought back restrictions on Internet Freedom in some places, let's not forget:  Internet Freedom in Mobile Land is Elusive and Declining.