Registering Prepaid Sim Cards: Nine Controversies

“Register your prepaid and get free calls/internet transfer/win a car” – you can hear from Polish telecom operators, as a reminder and encouragement that all pre-paid SIM cards have to be registered by 1st of February 2017. One could almost think that this is just a nicely co-ordinated campaign of leading telecoms, aimed at collecting a bit more data about their clients in exchange for a bonus. Nothing new under the sun in the data-driven world? Well, not exactly. A real stake in this data collection effort is to increase control over all users of telecommunication networks in Poland, with particular focus on foreigners. The demand for more data, this time, came not from the market but directly from the policing arm of the state.

Obligatory registration of prepaid SIM cards was introduced in Poland by the controversial anti-terrorism law in June 2016. This law is based on the (unacceptable, from human right perspective!) assumption that every foreigner may pose a threat for national security and, as such, can be subjected to some form of surveillance. Obligatory registration of SIM cards is not the most effective surveillance method (as it can be easily circumvented) and – from a foreigner’s perspective – certainly not the most serious limitation of their rights. However, it is the one implication of the anti-terrorist law that will affect the business operations and daily life of people living in or travelling to Poland, with all its inconvenience and practical burdens. And the one that – with no single doubt – will take effect (though not necessarily the one that the lawmakers intended for): all the unregistered cards will stop working after Wednesday, February 1st. However, this fact should not stop us from questioning the logic behind the new regulation and showing its (unintended) consequences. So here it is: our list of 9 questions about the obligatory registration of prepaids.

1. Why should I register my prepaid at all?

This is the number one question on the lists of FAQ at every telecom operator’s website. Their answer is: because the anti-terrorism law says so. But they do not answer why this obligation was introduced in the first place. Our answer is: because Polish intelligence agencies want to have even more control. And they believe that registered prepaids are going to make their job easier, at least with regard to those individuals that kindly registered their numbers in their own name.

2. How registering prepaid cards is going to make the work of intelligence agencies easier?

The reasoning of the lawmakers was that registered cards are going to make it way easier to identify the owners of the numbers linked to the criminal activity, especially in the context of the false bomb alarms. However, the measure will not be 100% effective, as the registered owner can sell the card or pass it to somebody else, without obligation to update personal data in the operator’s register. Engaging a number of intermediaries and leaving false traces will not be much of a challenge for a determined criminal. In such case, the identification of the actual owner may take some time.

3. Do I have to register a card in my own name?

No. You can use a card registered in someone else’s name (parent, grandchild, sibling, spouse, employer, friend…) and vice-versa, pass your card onto another person. You can buy a registered card on Allegro (Allegro rules say you cannot, but, you still can). You can buy one in Germany or Czech Republic, or register it under anyone that will be open to such a favor (and there are always people willing to do little favors for money). It is also relatively easy to register a number under somebody without this person even knowing it – just take his or her registered phone and register your card through SMS (or make a copy of their ID, as some operators allow for the registration through snail). While we do not encourage such practices, we hereby show that this new surveillance mechanism can be circumvented in many ways.

However, as one of our readers noticed, using a number registered in someone else’s name can be dangerous, as this person retains actual control over the number. In practice, she or he will be able to block active SIM card and make a duplicate – which opens the door to stalking or identity theft. She or he can also control the history of connections and other billing data.

4. Is the registration going to help fighting terrorism?

In theory, registration of all SIM cards should limit the ability of anonymous communication and camouflage of people engaged in criminal activity. But you will probably think – just like we do – that no criminal will register the card in his or her own name (unless they want to be caught). Cecilia Malmström – the European Commissioner for Trade (previously: Home Affairs) – said in the European Parliament that there is no evidence that this is a successful measure to fight crime. The British government thought so, too, and – based on the detailed analyses carried out by intelligence agencies and security experts – decided not to introduce such regulation into British law.
Perhaps Polish lawmakers have information that we don’t, proving the opposite. However, they were not willing to share it with the public, neither in the written justification for the new law nor in response to our direct questions.

5. What consequence can I face for selling registered SIM cards?

No legal consequences, by any means. The minister for internal affairs, Mariusz Błaszczak, threatens in the media that “those who are selling those cards, can face legal consequences in the situation whereby these cards were used for a criminal activity”. However, there are no legal sanctions for selling SIM cards. Certainly, interrogation by the police or an intelligence agency is not a pleasure for most people. However, such incidents may occur to anybody, whose personal data was used to register a card related to anything that happened to attract the attention of law enforcement – not just criminal activity or an act of or terror.

6. Cards used in elevators and vending machines also have to be registered. Why?

Yes, we also could not believe it. However, both the Office for Electronic Communications and the Ministry of Digital Agenda have recently reminded that not only phones but also machines – such as vending machines and elevators – are using prepaid cards (for automatic communication with its operators).

The Office for Electronic Communication clarified that “the main aim of the regulation is to increase the effectiveness of the Polish anti-terrorism system and the safety of Polish citizens. Obligation to register SIM cards is aimed at limiting the ability to communicate and camouflage of people engaged in criminal activity, also – terrorism activity”.
Really, we have no clue how registering a prepaid card in a vending machine is going to help catching terrorists.

7. What about the right to anonymous communication?

Forget about it. Polish lawmakers believe that the convenience of intelligence agencies is much more important than fundamental rights, e.g. the right to anonymous communication and protection of professional secrecy by lawyers, journalists, doctors…

8. Is my personal data safe?

Registering cards at petrol stations, in banks, by mailmen, by snail mail or email (with a scan of your ID attached!) – it sounds like a joke written for the 20th anniversary of Polish data protection law (which we are celebrating this year). Or perhaps it is a vigilance test before the new European Data Protection Regulation comes into force? The essential feature of all databases is that they tend to leak…

We should also be asking about safeguards preventing misuse of our data by intelligence agencies. It is worth mentioning that all countries where registration of SIM cards is obligatory, have in place strict control mechanisms over how law enforcement agencies access and use telecommunication data, including the personal data of card owners. In Poland, this area of state operations is beyond any form of independent control.

9. Who is going to pay for it?

The lawmakers cunningly counted that the new obligation will not incur any costs for the public budget. Why? Simply because this burden will be shifted to telecom operators and their clients. And it is obvious that the bill will be rather high. Aggressive marketing campaigns (500-1000 PLN bonus, BMW to win in a lottery, …), risk losing a large number of customers (who do not register the number on time), and building the whole network of registration points for SIM cards – all that costs money. Our money.

***

Co-writers: Wojciech Klicki, Katarzyna Szymielewicz and Małgorzata Szumańska. This article was originally published by the Panoptykon Foundation.