Identity in reverse – mobile phones as leverage to enroll for digital ID, plus SIM overlays

As the deadline for linking SIM cards and digital ID numbers looms (again) in Nigeria, representatives from its mobile network operators and ID authority, plus their counterparts in Tanzania, explained the impact of enforcing the link in the second ID4Africa livecast dedicated to mobiles for identity and development. A huge boost for their national ID programs, the programs are more of a mixed basket for the countries’ telcos.

We also learnt more about the rights for the user built into Nigeria’s app for its digital ID card and how SIM card overlays could be a cheap and effective way to enable basic feature phones to have secure, smart digital ID.

Legacy building: sustained biometric capture for ID vs ‘catastrophic’ impact

Aliyu Aziz, director general of National Identity Management Commission (NIMC), said that while there had always been the requirement to link a SIM card to ID, “enforcement is always the issue.” So the country’s security situation was used as the leverage necessary to strengthen the enforcement – cutting off unregistered SIMs. “Security will not wait for us,” said Aziz. There have been deadline extensions since the initial 31 December 2020 date came and went. The next is 31 March 2022.

Security was also a deciding factor for requiring a biometric ID link for SIM cards in Tanzania, according to Edson Guyai, acting director, ID Management, of the country’s National Identity Authority (NIDA).

Tanzania required citizens to go to government offices to register for their national ID, whereas Nigeria also allowed third party agents to get started.

Nigeria went from around a million biometric ID registrations a month before the link requirement, to around five million, with a sustained rate of 2.5 to 3 million every month through 2021. The overall number enrolled has leaped from around 40 to 77 million. As the World Bank project comes online, enrollment capacity is set to increase with the hopes of 7 to 10 million new registrations a month. (Nigeria’s population is around 207 million with around 7 million new Nigerians born each year.)

Tanzania doubled its national ID count to around 20 million.

Aziz said around 17 million Nigerians had been registered via ‘front-end’ partners and another 2 million by mobile network operators (MNOs). He said this “pay per play” mechanism meant enrollment had happened more quickly than if the government had procured and operated the equipment itself. The government is building capacity, with 18,000 enrollment centers but that is “still a drop in the ocean.”

It was “a surprise in terms of the timelines” according to Linda Riwa, consumer business director, Vodacom Tanzania. The firm had to change its own platforms and buy large amounts of equipment including 20,000 registration devices.

Tanzania’s MNOs formed a consortium and bought 25,000 shared devices. The companies had to think about “how to be more creative as mobile operators,” said Riwa. They stopped competing and started collaborating.

If Nigeria does enforce the cancellation of subscribers in a week’s time, it could be “quite catastrophic” said Soyinka Shodunke, chief information officer, MTN Nigeria. He did not want to go into details as it is a listed company.

There are benefits for the MNOs. In both Tanzania and Nigeria fraud rates have fallen, such as for mobile money. The operators now have much more sophisticated, cleaner databases.

Shodunke acknowledged that the national system created an easier way to link multiple SIM cards to one individual and that the data amassed “with the algorithms that exist today, it’s a goldmine.”

However, Vodacom and MTN both said data was aggregated rather than held at the individual level.

“What legacy are you going to bring?” Aziz asked of his counterparts across Africa to encourage them to try the same approach.

Power to the people: update on NIMC digital ID app

The NIMC mobile phone app originally appeared on the scene as something of a backup when the agency was unable to fulfil deliveries of the plastic smartcard version. It has now evolved into much more.

Putting “the power over a person’s identity in the hands of the ID holder” is how the app was described by Uchenna Chigbo, acting director and senior special assistant to the DG at NIMC. She described the agency as the custodian of the identity

User consent has been addressed by tokenization, as announced on International ID Day last year. The app “gives the holder the right to issue virtual NINs” which are merchant-specific and last only 72 hours.

Users can now see all the statistics about how their ID has been used such as who has carried out a verification and when. Feature phones can also work as virtual NINs via USSD, and face biometrics and liveness detection are being considered for authentication.

There have been more than 16 million downloads of the app and more than 62 million digital profiles created on the app.

SIM cards as digital ID – for the most basic phones

If mobile connections are people’s real priorities and cutting these off is one way for governments to increase ID enrollment rates, why not make the SIM cards themselves a form of credential?

The final session of the live cast covered various approaches to SIMs as digital ID, as SIM cards already have a sufficient level of technology built in, and many – but not all – handset manufacturers make these parts of the SIM accessible, according to Dr. Chris Hicks, researcher, Alan Turing Institute.

Hicks demonstrated a way that simple feature phones can display a QR code of a NIN (with a 128×128 pixel screen), though there are insufficient pixels to display a full verifiable credential. The approach would work offline for the holder if the verifier had network connectivity. SIMs already have enough cryptographic functionality to work as a counter to allow other functionality.

SIM cards can do a whole lot more with a little enhancement. Taron Mohan of NextGen TeleSolutions demonstrated a stick-on overlay for SIM cards embedding an electronic chip 0.2mm thick. The layer is applied to a SIM card (the whole process taking 30-40 seconds and looking around as tricky as applying a smartphone screen protector).

The wafer chip brings the same functionality as the chip embedded on a payment card, but with higher memory, explained Mohan. The upgraded SIM now provides a secure element for the phone, independent of the rest of the device such as the operating software. It is also separate to the telco, phone manufacturer and SIM provider.

The overlay could come preloaded with slots for digital credentials which can be added. These could be a social security number, ID number, passport number, allowing the SIM to act as digital credential for all.

It can handle digital currencies, public and private keys. It is more secure than digital identity apps running within a phone’s OS as communications it uses do not go into the phone’s SMS inbox, vulnerable to scanning.

NextGen TeleSolutions has developed a simple scanning device that looks like a QR code scanner such as on a self check-out kiosk. Yet is equipped with OCR technology to read the alphanumeric codes shown on screen, rather than QR codes, meaning even the most basic handsets can use the overlay’s functionality.

Mohan said the fact the overlay has its own unique serial number can be used along with the mobile phone number to bind a user’s identity to the phone. There is a biometric level to this in India where the approach is being used with Aadhaar for financial operations via UPI, India’s payments system.

With the upgraded SIM card, users can perform transactions without using the network operator, said Mohan.

Article Topics

Africa  |  biometric identification  |  biometrics  |  digital ID  |  ID4Africa  |  Identification for Development (ID4D)  |  identity management  |  national ID  |  National Identity Management Commission (NIMC)  |  Nigeria  |  SIM card registration  |  smartphones  |  Tanzania