Missed Connections? Evaluating the Global Spread and Legality of Mandatory SIM Registration in a Modern National Security Context.

• Author: Krishnakumar, Tarun

1. Introduction a. The "Burner" Phone: An Introduction b. Burner Phones around the World II. Mandatory Registration Policies: An Overview a. Modern Cellular Phone Technology b. SIM Card Registration Requirements: An Overview (i) The First Phase: 2000-2005 (ii) The Second Phase: 2006-2014 (i) The Third Phase: 2015-Present (ii) Legislative Attempts in the U.S. III. Evaluating Mandatory SIM Registration in an International Law Framework a. Analysis Relating to the Right to Privacy under ICCPR\ (i) Interference under Article 17 (ii) Legality under Article 17 (iii) Reasonableness/Non-Arbitrariness under Article 17 (iv) Conclusions on Article 17 Analysis b. SIM Registration and Freedom of Expression under the ICCPR c. European Perspectives on SIM Registration (i) SIM Registration under the Convention and Charter IV. Analyzing SIM Registration in a Modern National Security and Law Enforcement Context: A Case Study Approach a. Scenario 1: The Lost Phone b. Scenario 2: The Bomb Plot c. Scenario 3: A Multi-site Attack d. Scenario 4: Lone Actor or Autonomous Cell e. Lessons from the Case Studies f. A Note on Situational Crime Prevention (SCP) Theory V. Conclusions and the Way Ahead for SIM Registration 1. Introduction

   1. The "Burner" Phone: An Introduction

      Pawlowski stated this was why he wanted burner phones because then he could "just talk business on [one] phone and then ... anything fund related [would be discussed on] a different burner." Fleck agreed with Pawlowski's proposal to use burner phones to avoid detection, adding, "[t]hen if anybody's ever trying to record you, they'll never get it, you know what I mean?" Pawlowski responded, "Exactly, that's the point. That's the [...] whole point of the burner phone, yes." (1) In popular culture, a "burner' phone is a pre-paid cell phone which can be "purchased without providing a name or Social Security number." (2) Also known as a "dope" phone, it is typically a low-cost disposable device purchased with cash, without a contract, (3) and, therefore, which has no "subscriber" (4) or "owner" (5) information associated with it. In contrast, phones purchased on a contract or lock-in basis require the submission of identity and basic contact information to the service provider for billing and related purposes.

      In a world characterized by increasing levels of private and public data collection, burner phones may help promote some measure of privacy and anonymity (6) without the lock-ins associated with contractual arrangements. (7) For the same reasons, law enforcement views such devices with suspicion and considers them to be predominantly used by criminals to elude police (8)--being particularly favored by individuals involved in "drug conspiracies" so that they "...can avoid detection." (9) This notoriety has also pervaded the United States judiciary, with the Seventh Circuit noting, with a nod to the hit series The Wire, that these phones are "difficult to trace and a favored tool of drug dealers." (10)

      Unsurprisingly, concerns regarding the traceability of these devices have raised fears of their use by domestic and foreign terrorist actors to plan, coordinate, or carry out attacks. (11) In fact, terrorists in New York City (12) and Paris (13) were reported to have relied on such unregistered prepaid devices to attempt to set off explosives and coordinate attacks, respectively. At the same time, it is worth noting that there is no material or empirical evidence in public domain that shows that burner devices are actually more harmful to law enforcement or security objectives than devices which are linked to subscriber identities.

      Despite these tensions and uncertainties, it cannot be seriously disputed that the burner phone, or more generally, the ability to purchase such phones and prepaid SIM cards freely, is well-entrenched in U.S. culture. This is exactly why it comes as a surprise to many that this is not the case for the vast majority of the world.

   2. Burner Phones around the World

      In stark contrast to the U.S. approach, as of December 2018, at least 150 jurisdictions around the world did not permit the sale of unregistered prepaid mobile phone connections. (14) This includes prepaid connections bundled with phones (i.e. burner phones) as well as (loose) prepaid SIM cards, which can be inserted into any compatible device. (15) Individuals in these countries must typically satisfy a pre scribed standard of identity verification and provide personal information such as name, data of birth, residence details, an identity card, and, in some cases, local references or biometrics before a prepaid phone connection can be activated. (16) For the purposes of this article, any legal or regulatory requirement that mandates identity verification prior to the issuance of a new prepaid phone connection (whether bundled with a device or just a SIM card) is referred to as a "mandatory SIM registration" or "mandatory prepaid registration" requirement.

      While it is not unknown for different countries to adopt varying approaches to regulation in general and to telecommunications policy in particular, several factors make the spread--and ubiquity--of mandatory SIM registration requirements interesting and worthy of further study. First while almost all jurisdictions which have such requirements justify them on national security or law enforcement grounds, there is no empirical or other evidence that has been offered to show that these requirements actually help prevent attacks or tangibly benefit security or law enforcement objectives. Some case studies, in fact, show the opposite effect. (17) Evidence, where offered, is largely anecdotal. Second, while SIM registration requirements have spread worldwide, it is notable that jurisdictions like the U.S., U.K., and Israel--three countries with sophisticated security establishments that are also frequent targets for terrorist plots--have not required mandatory SIM registration. Third, the dispersed nature of these regimes has meant that there has been little scholarly analysis that studies these measures from an international legal perspective --and seemingly none within the U.S. To date, most of the (exceptional) work surrounding these issues has been from civil society, activist groups, non-legal academia, and the broader mobile industry. Last, in the absence of any express international-level guidance or harmonization, it is puzzling that nearly three-fourths of the world has enacted analogous SIM registration measures with broad uniformity measures that only started being discussed in the early 2000s. In other words, a measure with unsubstantiated benefit, and potentially severe cost and human rights implications, has been enacted by most of the world with uniformity and at nothing less than breakneck speed. (18)

      This article seeks to frame the emergence of mandatory SIM registration policies in a new analytical context by raising several questions concerning these requirements including relating to the global status quo, their legality, and effectiveness in a modern national security context. Part II will introduce the nature and spread of these frameworks around the world in addition to highlighting key attempts to introduce similar requirements within the U.S. While domestic courts around the world have had occasion to consider the legal implications of these requirements, there has been no uniformity in outcomes. To supplement domestic law analyses, Part III attempts to analyze these requirements, with reference to the right to privacy as framed within instruments of International Human Rights Law such as the International Covenant on Civil and Political Rights (ICCPR) and relevant European frameworks. Next, Part IV attempts to analyze the law enforcement and national security applications of SIM registration information by constructing hypothetical law enforcement investigative scenarios. These scenarios will be used to illustrate the usefulness and limitations of data gathered through mandatory SIM registration requirements--and the assumptions that must be satisfied if such measures are to be effective in the modern context. Part V offers conclusions on these policies, the assumptions they must satisfy to be effective, and pragmatic recommendations on the way ahead for policymakers.

2. Mandatory Registration Policies: An Overview

   This section aims to provide a brief overview of the status quo of mandatory registration requirements around the world as of late December 2018, starting with an introduction to relevant elements of modern cellular phone architecture and identifying notable efforts at introducing equivalent requirements in the U.S--a phenomenon that has largely escaped analysis.

   1. Modern Cellular Phone Technology

      Modern cellular phones are complex devices consisting of several individual component systems and circuits. At their core, most modern phones consist of two primary components: the handset/device itself and a Universal Integrated Circuit Card (UICC) containing a Subscriber Identity Module (SIM). (19) Colloquially, this latter component is referred to as a "SIM card."

      While originally only found in phones which used the GSM family of technologies (conformed to by more than 90% of phones in use today globally (20)), today SIM cards are also used in other devices. While the handset contains the hardware and circuitry necessary for cellular transmissions and other functionalities, the SIM card ensures security and contains information (21) necessary to enable subscriber authentication on a cellular network. (22) SIM cards also facilitate interoperability between networks and the portability or "nomadicity" of devices: (23)

      With the SIM card acting as the key to the network, a user could switch equipment by removing the small smart chip and inserting it in a different GSM device. As SIM cards began to allow the storage of user data such as contacts, SIM removal also meant that users could take their...