Understanding the SIM registration exercise – an insider’s perspective (Part I)

As of early 2021, over 157 countries globally require mandatory SIM registration with some level of proof of identity. A good number of these countries empower mobile operators to validate customers’ ID credentials against a government database or token. However, there is lack of comprehensive data protection or privacy frameworks to support these projects such as the one in Ghana.

Over a decade ago, Ghana embarked on this exercise with the policy-adoption as part of efforts to help mitigate security concerns and to address criminal and anti-social behaviour. To date, there has been no empirical evidence that mandatory SIM registration directly leads to a reduction in crime.

What is not in doubt is that the ability of mobile network operators to verify customers’ identity documents can enable user trust for many consumers who access value added mobile and digital services in a fast-changing ICT world.

The SIM registration exercise, announced in 2019 by the Minister for Communication and Digitalisation – Mrs. Ursula Owusu Ekuful, finally started on October 1, 2021.

Prior to commencement of the activity, all key stakeholders were asked to collaborate and conceptualise a registration process that was easy, fast and favourable for all Ghanaians irrespective of technology – i.e. 4G, 3G or 2G. Above all, the SIM registration process was expected to be safe, and fully considerate of the ongoing COVID-19 pandemic and potential negative societal health impact for Ghanaians.

Early warnings

Having experienced SIM registration in other countries like Nigeria and Tanzania, mobile network operators were quick to identify all the risks involved in performing a SIM registration exercise during the pandemic. Chief among these risks was the fear that large crowds would congregate at SIM registration points in a bid to get registered to avoid losing their mobile numbers by the March 31, 2022 deadline. The obvious implication of this was that points of congregation would become COVID-19 super-spreader events. Network Operators, who had started engaging with the Vice President’s Office and the National Identification Authority (NIA) on SIM registration, recommended that the process should be:

1. Broken into two phases
   1. A USSD phase that allowed all Ghanaians to link their Ghana Cards to their SIM
   2. A biometric phase, using the NIA’s framework (software, hardware and database)
2. Free for all Ghanaians
3. Self-service – Protecting Ghanaians by allowing the entire process to be completed in the safety of their homes, with the service centres of the various network operators serving as a backup for people facing challenges.

The ministerial takeover

Having made significant progress with the Vice President’s Office, the National Communications Authority (NCA) and the National Identification Authority (NIA), the Honourable Minister took charge of the discussions and categorically stated that all prior discussions with the Vice President’s Office were null and void. This was her remit and things would be done her way. I remember the shock in the room when the NCA was roundly lambasted for engaging with the Vice President’s Office and told to scrap all previous plans and come up with an entirely new process whereby KelniGVG would be involved somehow in designing the process and solution.

The NIA problem

One could argue that, to a large extent, the current chaotic SIM registration situation may be as a result of the NIA’s ineptitude at the time, as they:

1. Did not have biometric verification devices (BVDs) readily available in the right numbers and at the right cost for network operators to adopt quickly and cheaply
2. The COVID-19 pandemic had negatively impacted the global supply of microchips required to mass-manufacture and ship BVDs to Ghana in any reasonable time
3. Saw an opportunity to make an incredible amount of money from network operators by charging 30 pesewas (GH¢0.3) for every verification. With over 41.8 million active SIM cards in Ghana, that is a payday of GH¢12,540,000! This has since been negotiated downward to 10 pesewas for each verification.

Simply put, if at the time the minister hijacked the process the NIA was ready, we would probably not be in this completely unnecessary situation. In all fairness, the NIA did say on several occasions that if they were given till October 2021 they would be in a position to properly support the exercise, as they would be taking stock of a large quantity of BVDs.

KelniGVG Introduction

Sensing an opportunity to grab important data, the ministry instructed the NCA to engage KelniGVG, their technical partners, to develop a solution to biometrically register all Ghanaians, businesses and foreign nationals. Network operators were instructed to collaborate with KelniGVG in conceptualising, building and testing the solution. It was agreed that, against all odds, we would commence the SIM registration exercise in mid-October 2021. The minister later suddenly changed her mind and decided that we would commence on October 1, 2021 instead.

Now, to say that KelniGVG is a dodgy company is putting it lightly. This is the same company cited in the almost US$180million alleged fraudulent revenue assurance deal with the government of Ghana. How do we allow this same company to suddenly evolve into building a software to collect citizen’s sensitive biodata through an app which no one has proof over its risks and vulnerabilities?

Well, from the experience of those in the queues, the delays are 80 percent a creation of the untested, incompetent software being used to capture citizen’s sensitive primary information. The software was sold to complete end-to-end registrations within 2-5mins – but it is doing an average of 30mins with its unresponsiveness, even at the start of day when the Telcos open shops.

The stuff you don’t know

1. The NIA has a biometric verification application that simply verifies a person’s identity against what is stored in the NIS without harvesting a person’s data again
2. KelniGVG is NOT connected to the NIA’s national biometric database, the National Identification System (NIS)
3. The fingerprint information currently being collected is:
   1. Not being verified against the NIS
   2. Being held in a separate database situated at the National Information Technology Agency (NITA) that is neither owned nor managed by the NIA.
4. The current face ID verification against the Ghana Card is NOT sanctioned by the NIA
5. Neither the NCA nor their technical partners KelniGVG have the legal mandate to collect, process and store the biometric data of Ghanaians. This falls under the mandate of the NIA
6. The fingerprint data being collected by KelniGVG is NOT compatible with the data already captured and stored by the NIA as part of the NIS.

Note: the NIA has written to all network operators as well at the NCA to categorically state this fact. Read the letter here.

7. The method by which KelniGVG is capturing fingerprints is not standardised and globally approved, and hence prone to a significant amount of error
8. KelniGVG has not been able to demonstrate that the fingerprints being collected can be verified at a later date. Indeed, KelniGVG does not even have a verification platform that can be used for the purpose of verification.

What should we do next?

Ghanaians, the time for being passive is past. It is important that we force the Ministry, NCA, NIA and KelniGVG to be accountable for their actions.

1. Why is KelniGVG collecting biometric information when the NIA has already effectively done this?
2. Under what conditions is this information being held; and who will have access to it, now and in the future?
3. If the NIA is the legitimate identification authority, why are they deliberately being kept out of the biometric verification process in favour of KelniGVG?
4. It’s unfortunate that the Data Protection Commission is an appendage of the Ministry of Communications and Digitalisation. Elsewhere, they would have issued a whitepaper to enable citizens understand how their data is being captured and how their rights are covered under the legal powers.

It is important to note that considering the spirit of the NIA letter in respect of the entire biometric part of this current exercise, it could be an exercise in futility and we are likely going to have to do this all over again.

As an insider with professional experience, I am keen on safeguarding consumers and business interests because the two are not mutually exclusive for sustainability of the ecosystem. I would encourage the key stakeholders to put aside their personal interests, commercial appetites and align accordingly to enable the sector show respect to Ghanaian citizens and get them out of the queues NOW!

I will try and bring you a second part with recommendations in the ensuing days.

A concerned citizen.

#BeingAccountableToThePeopleWeSworeToServe