MTC’s Verifi raises important questions and significant concerns in the absence of data protections, writes Frederico Links.
FOR THE PRICE of a fingerprint and a facial scan you can get world-class security and peace of mind with regards to your mobile phone use.
That, in a nutshell, is the premise and promise of MTC Namibia’s new Verifi offering, which was launched in mid-December 2020 and has since been extensively promoted on social media.
An MTC media release of 12 January 2021 states of Verifi that it uses “biometrics and artificial intelligence, powered by the use of biometric authentication and cyber security systems to continue providing a watertight consumer data protection system”.
In effect, the system operates like a SIM card registration system in that the subscriber hands over personal identification – in the form of “Namibian ID [card], driving licence, or passport if you are not Namibian” – to register their mobile number to access a mobile telecommunications service.
But it also goes further, requiring those who sign up – and they stress it’s voluntary – to provide a facial scan and fingerprints as well to enable verification. And the system is pitched to the public the same way SIM card registration systems have been pitched in other countries over the years: as a crime-prevention measure and as an enabler of safety and security.
However, MTC is adamant it’s not a SIM card registration system or even similar.
“This is not a SIM card registration system,” says MTC’s chief commercial officer, Melvin Angula, even though the system basically does what a SIM card registration system does: It registers a specific mobile number to a specific individual – forever.
MTC has found a way to work around the non-operationalised Part 6 of the 2009 Communications Act, which contains provisions for mandatory SIM card registrations by telecommunications service providers in the context of enabling state interception and surveillance of all telecommunications.
CONCERNS OF ABUSE
Over the last decade or so, many countries, including quite a number of African countries, have rolled out SIM card registration systems that are artificial intelligence (AI)-based and collect biometric data, including facial scans.
MTC’s Verifi, while home-grown with mobile payments firm Mobipay, is similar to a new mobile phone number registration system in Nigeria.
Such systems have been made notorious by authoritarian states, such as China, that have used them for mass biometric surveillance and political repression, through the tracking, blocking and shutting down of telecommunications and the internet of targeted individuals and groups.
In Africa, such systems have been rolled out where weak or no data-protection safeguards are in place.
A January 2021 policy brief on the issue by Cape Town, South Africa-based tech and policy think tank Research ICT Africa notes that African states were deploying such systems at a rapid rate, “but seldom in ways that are rights respecting and particularly privacy respecting”.
The paper states that many “AI systems collect vast amounts of data and apply invasive techniques to utilise personal data which benefits private companies”, and that the “use of facial recognition technology is proliferating at a rapid rate, faster than measures ensuring that people’s rights are protected in its deployment”.
The absence of comprehensive data-privacy safeguards in countries such as Namibia, where the introduction of AI-based biometric systems are being led by market-dominating state-owned entities, such as MTC Namibia, exposes consumers to abuse from both state and private actors.
This point was emphasised in a 2018 report by the United Nations (UN) special rapporteur on the promotion and protection of the right to freedom of opinion and expression that was tabled at the UN General Assembly that year.
The special rapporteur called for “extensive public consultation involving engagement with civil society, human rights groups and representatives of marginalised or underrepresented end users” before AI systems were introduced by countries, as well as for greater transparency around what sort of biometric data is collected, how it is processed and stored, and who has access to such data.
Despite this call, the human rights aspects of AI-based biometric systems have remained controversial worldwide.
For instance, since January 2021, under the ‘Reclaim Your Face’ campaign, more than 60 European civil society organisations have been calling on the European Union (EU) to limit and regulate the roll-out of such systems on the continent in the interest of protecting privacy and human rights.
“We are fully aware of these concerns,” Angula says.
“Those fears are well grounded, but should not hold us back.”
Namibia does not have a data-protection law, despite the Ministry of Information and Communication Technology indicating in late 2020 that a data-protection bill would be finalised and tabled in parliament before the end of the 2020/21 financial year.
When the list of bills that would be on the parliamentary agenda for 2021 was released earlier this month, the data-protection bill was not on it.
Angula says MTC has had to innovate despite this legal vacuum to improve customer mobile phone security, especially during the ‘Covid-times’ that have forced Namibians to transact more via their mobile devices, leaving them increasingly vulnerable to phone and identity theft.
He says MTC does over a thousand SIM card replacements per day, and that Verifi would lessen the burden on their systems and enable customers to do SIM replacements quickly and remotely, without having to enter MTC’s premises, thereby lessening congestion and adhering to Covid-19 distancing and occupancy health regulations.
The Verifi system was benchmarked against global data protection standards, including the EU’s General Data Protection Regulation (GDPR), and was constructed on highly secure blockchain technology, Angula says.
On the concerns around biometric surveillance, he says: “This has nothing to do with espionage.”
MTC is not the only Namibian entity that has introduced an AI-based biometric system, as even commercial banks have started rolling out such systems as part of their ‘Know Your Customer’ obligations, with one going as far as requesting through adverts of customers to send selfies (that will be fed into a facial recognition system) to a dedicated line.
For a number of years now the Namibian government has also been collecting biometric data for such things as passports, and the collection of such data will be rolled out to other government services over time.
With these practices already in full swing and safeguards still nowhere in sight, Namibians are well warned to tread cautiously.
* Frederico Links is a Namibian journalist and researcher. This article was commissioned by the Media Policy and Democracy Project (MPDP), an initiative of the University of Johannesburg’s department of journalism, film and TV, and Unisa’s department of communication science.
*(This article was first published in The Namibian newspaper of February 24, 2021).