In Nigeria, the government’s record of human rights violations has made citizens worried that a new policy connecting their mobile phones to national identity numbers will lead to increased surveillance.
In May 2021, the Nigerian federal ministry of communications and digital economy released a revised National Identity Policy for SIM Card Registration. The policy contained a prefacing mandate letter from President Muhammadu Buhari that directed Minister Isa Ali Ibrahim Pantami to ensure that no SIM card is allowed access to the Nigerian telecommunications network unless it has a National Identity Number (NIN) attached to it. The Nigerian government had previously initiated the registration of existing SIM cards in 2013. However, as of May 2021, they reported millions of unregistered and improperly registered SIM cards still accessing mobile network services.
Following years of encouragement to register, Nigerian mobile network users reported that the renewed policy enforcement came by way of government-backed threats of disconnection from mobile operators such as MTN. The initial NIN enrolment and NIN-SIM linkage deadline for citizens and legal residents was 30 June 2021. However, this deadline was extended multiple times in 2021, and was most recently extended to 31 March 2022 per a December 2021 NCC press statement. In the same statement, the NCC reported it had issued over 71 million NINs.
Nigerian citizens and legal residents have rushed to register for their NIN and NIN-SIM integration to avoid disconnection from mobile networks—but what are the possible effects and outcomes of the Nigerian government’s access to data from SIM cards of millions of Nigerian residents? What are the likely repercussions of the NIN policy and the risks posed to Nigerian citizens and legal residents in the long run?
In its May 2021 policy paper the NCC highlighted that the aim of the NIN-SIM integration policy is to determine the identities of current mobile phone users while simultaneously developing a national identity database. Additionally, the NCC explained that the main goal of the policy is to accelerate economic planning and development, promote digital inclusion, digital financial services, and other value-added services across the nation. However, the paper does not highlight (I) the data relationship between SIM cards and Nigerian data repository systems, (II) which arms of government will have access to data from the SIM cards, or (III) any other data retention practices that pertain to the integration process.
Moreover, the May 2021 policy paper highlighted plans to implement a Centralized Equipment Identity Register (CEIR), otherwise known as Device Management System (DMS), to serve as a repository for keeping records of all registered mobile phones’ International Mobile Equipment Identity (IMEI) and owners of such devices. Still, the policy did not explain how these IMEI numbers will be obtained or registered, nor did it provide specific information of how data from mobile phone users might be shared.
In essence, the Nigerian government is trying to create a database that links mobile phone users’ SIM cards with their NINs. Furthermore, the government wants to deploy a Device Management System that keeps records of all registered mobile phones’ IMEI and owners of such devices. The aim, an NCC joint statement has explained, is for the NINs to play a similar role as Social Security Numbers (SSN) do in the United States of America or the National Insurance Number (UK-NIN) in the United Kingdom. However, neither the American nor British governments require residents to link their SIM cards to their SSN or UK-NINs.
CASE STUDIES: ETHIOPIA, THE US, THE UK AND ZIMBABWE
As highlighted in the NCC’s joint statement, social security/identity numbers have been used in several countries across the world for identity tracking and to facilitate the provision of government services such as health insurance and taxation. While these may be necessary in Nigeria, the disparity in the era that these model identification numbers were established in the US or UK versus the era in which the Nigerian government is establishing its scheme is glaring. Social security numbers in the US were first issued in 1935, while the UK-NIN was introduced in the UK in 1948—both predating the invention of handheld cellular devices or SIM card technology. As a result, in comparison to Nigeria’s current strategy to weave the establishment of NINs with the registration of SIM cards, countries with social security/identity schemes predating cellular technology have had to update their database collection and/or tracking systems to keep the pace with technology innovation and growth.
The original purpose of the US government’s social security numbers was to uniquely identify US workers, enabling employers to submit accurate reports of covered earnings for use in administering benefits under a new ‘Social Security Program’. However, social security numbers have since come to be used to identify individuals within the US; numbers are now issued to citizens, permanent residents, and temporary working residents.
Similarly, in the UK, the National Insurance Scheme was introduced as a component of the social welfare reforms by the Liberal government in the early twentieth century and was designed to be a national health insurance scheme that eventually provided retirement pensions and other benefits. In the same manner as the social security number in the US, the UK-NIN has since become a de facto national identification number for taxation and other government administrative processes.
Noting the absence of a cohesive database for national identification of persons in Nigeria, it is understandable that the social security systems in the US and UK provide viable examples for the Nigeran government to use in developing its version. However, there is no evidence that American or British residents applying for a social security or national insurance number must provide additional telephone-related information besides their telephone number(s). Moreover, while residents purchasing a cellular plan or a pre/post-paid SIM card may be asked to provide some form of identification, absence of this information or refusal to provide this information does not prevent one from acquiring a SIM card. This is significant when one considers (I) the ubiquity of mobile phones and SIM card technology in Nigeria, (II) the storied history of Nigerian human rights violations by the Nigerian government, and (III) the absence of clarity regarding the technology utilized as highlighted earlier.
Across Africa, several countries have a history of instituting various forms of internet censorship and quasi-surveillance using citizens’ private data. For example, Zimbabwe’s Postal and Telecommunications Act of 2000 legalized the ability of the government to monitor email usage and requires internet service providers to supply information to government officials upon request. However, despite a 2004 Supreme Court ruling declaring that Act unconstitutional, a subsequent implementation of the Interception of Communications Bill of 2006 legalized the creation of a ‘monitoring and interception of communications center’ to oversee, amongst other things, all telecommunications and postal services. In Ethiopia, the ruling government has used its Freedom of the Mass Media and Access to Information Proclamation of 2008 and Anti-Terrorism Proclamation of 2009 to tighten control over the use of the internet with internet filtering, surveillance and content blocking. According to Human Rights Watch, information gleaned from telecom and internet sources is regularly used by Ethiopian police against Ethiopians arrested for alleged anti-government activities, with phone calls of alleged suspects being obtained and reviewed without judicial warrants.
The common theme amongst these examples is that each country has a variation of a law or decree that provides the government authority to monitor, intercept or block electronic communications when deemed necessary, usually in the interest of public or national security. The justification ‘for public and or national security’ by ruling governments to infringe human rights of expression, association, peaceful assembly and/or privacy may be a necessary tool in certain instances. However, the challenge is that such infringements can and have historically been used for nefarious and illegitimate purposes by ruling governments in various African countries. In Nigeria at least, the government’s human rights violation record does not provide any assurance to citizens that infringements will not be used illegitimately in the future.
THE CASE AGAINST MASS SURVEILLANCE
The advent of mobile phone technology spurred the mass production of devices designed with functionalities that can track the words, actions, and locations of their users. Such features have a variety of positive uses. For example, mobile phones help humans track their fitness data to achieve better health outcomes, to locate their devices when lost or stolen, or enable law enforcement to track the location or travel paths of perpetrators of crime. Mobile phones have also been used for nefarious purposes; for example, by criminals to locate victims who may have unknowingly shared their location data on the internet or to perpetrate various electronic fraud. While private citizens benefit from the various uses of mobile technologies, they are also susceptible to the risk of their data being shared with parties to whom they may not knowingly consent.
This risk, however, is not unknown to the world. In 2013, former CIA employee turned whistle blower, Edward Snowden, disclosed evidence that revealed that the US National Security Agency (NSA), with the cooperation of telecommunication companies and European governments were operating global surveillance programmes, which included telephone data collection. This revelation was not the first of its kind; however, it led to global campaigns against government data collection and increased public awareness about capabilities of governments worldwide, and the powers they wield to compel telecommunication companies to provide requested information.
The US government was able to collect bulk telephone data without requiring mobile phone users to connect their SIM cards to any form of government database. One can only fathom the vast range of metadata that can be accessed by the Nigerian government when SIM cards are linked to the NIN database or when telecommunications companies under their regulatory purview are compelled to acquiesce to the requests of the government. The mere fact that various telecommunications companies such as MTN, Etisalat and Airtel threatened to disconnect customers from their phone services due to pending NIN registration should be an alarming indicator of the far-reaching powers of the Nigerian government.
A small number of telecommunication companies own and control all telecommunications in Nigeria. However, Nigeria is not an outlier in this occurrence. The Democratic Republic of Congo and Malawi—two countries with a history of various forms of internet censorship and surveillance, also have their telecommunications markets dominated by a handful of companies. However, even worse off, 31 other countries have a state-owned telecommunications company as either the only or the dominant player in their telecommunications industries. In such instances, the smaller the number of telecommunication companies to control, the more susceptible they are to complying with government mandates to share customer data where required.
While the Nigerian government did not disclose intention to erect a population surveillance system, one of the potential (un)intended consequences of implementing the NIN system could be the creation of a quasi-surveillance system that can track mobile phone users’ location and activity data. Here, data security concerns become surveillance risks for Nigerians. As earlier identified, while these capabilities are helpful to prevent and solve crimes, Nigerians face the risk of their data being shared with government agencies without their consent and the legitimate justification of use for public interest.
LEGISLATION ANALYSIS: WHAT IS PUBLIC INTEREST?
The National Identity Management Commission (NIMC) Act, authorizes the development of a national identity database and the NIN scheme. One of the reasons the government has shared for the creation of the national identity database is to support law enforcement authorities in ascertaining facts about suspects and where adjudged necessary for the public interest. This is especially concerning when one reviews the phrase— ‘public interest’.
The concept of public interest is broad, vague and fluid. In her article, ‘In Pursuit of the Public Interest’, Carol Lewis explains how in numerous instances, governments worldwide have used the term ‘public interest’ to act on behalf of their populaces as a collective. For example, in most legal sectors, the crown represents ‘the people’, so it is commonplace for the crown to argue on behalf of the public in deciding or declining to prosecute a person or people based on public interest as codified by law. However, when government agencies use ‘for public interest’ in defence of public policies that may infringe on human rights or liberties, Nigerian citizens or legal residents do not have a basis to assess the validity of the public interest claim. For example, the Nigerian government has the power to acquire and revoke any right of occupancy, as contained in the Land Use Decree and the (Federal) Compulsory Land Acquisition Law cap 167, as long as the land is being revoked for a public interest project. However, the broad discretion of government authorities to interpret ‘public interest’ is unclear and has remained unchallenged so far.
The nature of the phrase ‘for the public interest’ is ultimately subject to the government’s interpretation. Theoretically, in a democratic state such as Nigeria, it would make sense that public interest is what the majority of elected representatives or the President determines. However, noting the sentiments of an absence of free and fair elections in the country over the last couple of election cycles, the legitimacy of the President to determine what is in the public’s interest can be debated.
Additionally, the NCC’s May 2021 policy paper cited numerous forms of security enhancement as their rationale for the implementation of the NIN policy and NIN-SIM integration. The NCC identified the preservation of national security, overcoming security challenges, enhancing national security, mitigation of security concerns and enhancement of security of Nigerians as reasons why Nigeria needs the NIN policy. However, while it may be easier to decipher what constitutes a security threat, for example, violent domestic terrorist attacks, Nigerians have a growing distrust in the ability of the government to act in good faith in determining what constitutes public interest. This is due to the storied history of the Nigerian government’s human rights abuses under the guise of national security or addressing a national threat.
PROTESTS: A CASE STUDY
One of the risks Nigerian citizens and legal residents face in linking their SIM cards to their NINs is the Nigerian government using their mobile phone metadata to track their location and activities when exercising their democratic right to protest. Nigerians have historically used protests to voice dissatisfaction with government policies or programmes. However, in Nigeria and across the world, citizens who lawfully exercise their rights to protest often face opposition from police and/or law enforcement—a recent example being the 2020 #ENDSARS protests.
The NIN policy was not as aggressively implemented at the time of the #ENDSARS protests. However, going forward, Nigerian citizens and legal residents who exercise their rights to protest provide law enforcement, opposition groups and random bad actors with their metadata by possessing their smartphones on them during protests. The effects for Nigerians can be further reaching because even individuals who do not own smartphones can unknowingly transmit data through SIM cards and telecommunication towers.
REVISITING PUBLIC INTEREST
As discussed earlier, the power to restrict citizens’ right to privacy, their homes, correspondence, telephone conversations, and telegraphic communications has been codified in the Nigerian constitution since 1999. As such, a social security system that links SIM cards of citizens’ mobile phones to their national identification number—and, subsequently, the NIN database—could potentially boost the government’s ability to restrict citizens’ rights to privacy.
Undeniably, there are numerous benefits to enabling authorities track the locations of people of interest, especially when one considers the prevalence of kidnap-for-ransom and other domestic terrorist activities in Nigeria. Therefore, using a nationwide database to help identify perpetrators of criminal activities would undoubtedly fall within the rationale of restricting the right to privacy for the public interest or in the interest of defence or public safety. However, with big data comes great responsibility. It is important for the government to identify how it intends to enforce its policies while not infringing on the privacy of Nigerian residents or obtaining their data via their SIM card without their knowledge or for use other than those outlined in the terms and conditions of the scheme. It is also important for the government to provide clarity on its interpretations of public interest, public safety, public order, and public morality to ensure it can practically be held accountable.
It is expected that complex questions as to the government’s authority or rationale to collect data on Nigerian residents will be presented to the Nigerian judiciary through litigation when the government begins utilizing the data it collects or has access to through the implementation of this SIN-NIN integration scheme. In the 2016 United States v. Moalin case, the United States Court of Appeals for the Ninth Circuit ruled that the US government may have violated the Fourth Amendment when it collected the telephony metadata of millions of Americans. Amongst these Americans were four Somali defendants that had been convicted of terrorism-related charges. Though not an exact comparison to the right of privacy as enshrined in the Nigerian constitution, the Fourth Amendment in the US constitution provides the people with the right to be secure in their persons, houses, papers and effects, against unreasonable search and seizure. However, as earlier identified, the US government did not intend, to nor do they currently directly connect SIM card data to their social security databases. In comparison, the NIMC provides officials more authority to access metadata on Nigerian residents through the NIN scheme. As a result, the Nigerian courts may face less questions about the authority to collect data and more questions about its interpretation of what it adjudges public interest that necessitates a restriction on the right to privacy.
Improved accountability means the government must provide a comprehensive guide to enrolment for the national identity database that includes: (I) a transparent orientation and identification of what the SIN-NIN integration entails; (II) what and how frequent metadata would be shared with the government; and (III) what arms of government and or non-government third parties have access to the metadata. Additionally, the government must provide an avenue for citizens to understand the technical aspects of the data integration. This is to ensure citizens are aware of the terms they agree to when complying with the policy. Otherwise, government officials must provide an opportunity for citizens to decline the data integration and alternatives through which citizens are able to enrol within the national identity scheme to satisfy the database development without compromising their privacy.
As discussed earlier, the government announced plans to develop a CEIR/DMS to serve as a repository for keeping records of all registered mobile phones’ IMEI and owners of such devices. Considering this, Nigerians should be adequately educated on the effects of these initiatives on their fundamental human rights and the implications of the government having access to the data citizens produce by utilizing their mobile phones daily⎈
The views, thoughts, and opinions published in The Republic belong solely to the author and are not necessarily the views of The Republic or its editors. We want to hear what you think about this article. Submit a letter to the editors by writing to [email protected].