A subscriber identity module (SIM) card is a smart card that maintains identification data that identifies a smartphone and links it to a particular mobile network. SIM cards hold information about the user, such as contact lists, stored text messages, network authorisation data, the location, phone number, and personal security keys. Mobile users can utilise these capabilities and data to support various internet service providers (ISPs) by using SIM cards. The most extensively used digital mobile network technology is the global system for mobile communication (GSM). First generation (1G) analogue networks based on the total access communication system standard in the 900 megahertz band were used to launch cellular telephone services in Sri Lanka in 1989. 5G systems are expected to meet customer demand for high-speed services like video calling and internet access along with artificial intelligence technology.
As part of the GSM association (GSMA) open gateway effort, the mobile operator community in Sri Lanka has announced the commercial introduction of a new industry-wide network application programming interface. By making sure that they are compatible with every cell network in the nation as well as hundreds more throughout the globe, they will assist companies and developers to speed up the expansion of digital services and apps. There are a few leading GSMA service providers that can be identified in Sri Lanka.
According to the Governmental law of the country, mobile SIM connections of Sri Lankan citizens should be registered under the national identity card (NIC) number. Almost all mobile SIM service providers in Sri Lanka act as ISPs, providing the opportunity to access the internet using the same SIM connection or using a separate SIM other than the voice call. A particular SIM can be a hard or electronic SIM. There are specific SIM connections that only provide their service as ISPs. It is required to forward the original identification documents where the customer’s NIC number, face, name and address are visible. An opportunity has been given for Sri Lankan citizens to forward supportive documents such as passports, driving licences, proof of billing, and bank statements or Grama Niladhari certificates to prove their identity. Foreign citizens visiting Sri Lanka also have the opportunity to purchase mobile SIM connections by forwarding an original passport where the customer’s passport number, face, name, and other details are visible. There are no clear limitations concerning the number of mobile SIM connections that could be purchased by one person. The number of SIMs that can be registered under a single NIC number by various service providers varies. A considerable number of temporarily installed and mobile SIM selling stalls have been established around the country by various service providers.
The proper application of Government implemented SIM registration regulations is due to the competition among the service providers. Individuals must be conscious of the fact that their NIC numbers are used on their mobile SIM cards. The Telecommunications Regulatory Commission of Sri Lanka stated that the person whose name the SIM is registered under shall be held accountable if any more SIMs are registered under their identity cards without their knowledge and if such SIMs are misused. Various service providers freely offer mobile SIM connections on either side of the roads or the pavement using temporary installed and mobile SIM issuing stalls. There are no limitations on issuing a number of SIM connections for a person collectively from all service providers in Sri Lanka. A single person may be registered for a considerable number of SIM connections purchased from various service providers. SIM service providers don’t consider the number of SIM connections registered by a particular person under another service provider in Sri Lanka. Some SIM service providers introduced limitations as only a maximum of five SIM connections can be registered under one NIC number. A considerable number of SIM connections can still be purchased under the same NIC number since there is no common database which can be accessed by all service providers to identify the number of SIMs issued under the particular NIC number by other service providers in Sri Lanka. The issuing of SIM and NIC verifications are done by the temporary installed and mobile SIM issuing stalls providing services on the pavements. Those temporarily installed and mobile SIM selling stalls don’t verify the NIC of a SIM issued person and without any delay, the SIM is issued when they get the copy of any NIC. Even using the NIC of a dead person, culprits can still purchase SIM connections from the temporarily installed and mobile SIM issuing stalls running on pavements.
Within the last few weeks, hundreds of foreign nationals, the majority representing China and India, were apprehended by the Sri Lankan authorities while engaging in online scam farms using various online platforms. During the preliminary investigations, it has been identified that they have mostly used social media applications to conduct online scams in various ways. While apprehending them, thousands of mobile phones, computers and internet access devices were taken under custody which were used to conduct online scams. There may be many loopholes within the Sri Lankan system that foreign nationals select Sri Lanka as their destination for operating online scam farms including weaker cyber security policies and cyber security laws. It is required to study and identify the rationale and root causes behind the apprehending of very few Sri Lankan citizens while a larger number of foreign nationals are apprehended within online scam farms. Those Sri Lankan citizens may also attend to online scams, may act as local supportive groups for foreign nationals operating in those scam farms or may execute dual roles at those online scam farms.
It is required to investigate how those foreign nationals acquire ISP SIM connections, and also how they find a large number of SIM connections in Sri Lanka to conduct those scam activities at established online scam farms. Those online scam farms create tangible impacts on the national security of the country, mainly in terms of economic security, information security and cyber security. It is required to investigate if Sri Lankan citizens supplied ISPs and SIM connections for those foreign nationals under their names, and how many SIM connections were registered under the particular NIC number. It is required to identify the main ISP used for conducting online scams based in Sri Lanka to understand the reasons as well as loopholes behind the system to use particular ISPs. It is understood that acquiring an ISP and SIM connections in Sri Lanka also becomes easier for those criminals rather than other regional countries when considering the huge number of foreign nationals and ISP SIM connections apprehended from aforementioned scam farms, back to back, with large quantities. The relevant Government authorities must conduct an in-depth study to understand the main ISPs selected by those criminals for operating the online scam farms based in Sri Lanka in addition to investigating other root causes.
With respect to the ISPs and the registering of SIM connections for operating online scam farms, more consideration and emphasis must also be given while investigating the root causes for a large number of foreign nationals to select Sri Lanka as their destination to run online scam farms. In the early stages, Myanmar was identified as the main destination for running online scam farms within this region. However, within a very short time, it has been identified that Sri Lanka has also become a destination for running online scam farms. There may be various reasons and loopholes in the Sri Lankan system which provides comfort zones with opportunities made easy for them to reach their target. When considering the huge number of mobile phones along with ISP SIMs apprehended within those online scam farms, it is required to understand how they have obtained ISP SIM connections in such large quantities in Sri Lanka. With respect to the acquiring of Sri Lankan ISP SIMs by culprits engaged in online scam farms, as a preliminary approach, it is proposed that the respective authorities implement a sound monitoring mechanism to observe the proper implementation of existing SIM registration regulations in Sri Lanka, in addition to establishing a common digital database for identifying the issuing of ISP SIMs by each service provider under a particular NIC number, keeping the mandatory records of fingerprints, current digital photograph, and bio data, using the common digital database to collectively limit the number of ISP SIMs issued under a particular NIC number rather that limiting such under individual service providers, similarly enhancing and introducing sound regulations on the registering of ISP SIMs under foreign passports and limiting ISP SIMs activation period according to the period of the visa granted, enhancing the credibility as well as the liability on the ISP SIM usage of customers, implementing a more strengthened legal system to initiate legal actions when the unauthorised handover of ISP SIMs is found, and updating the proposed common digital NIC number database in collaboration with the respective authorities to issue death certificates in order to avoid the issuing of ISP SIMs under the NIC numbers of dead persons.
The registration of ISP SIMs has fuelled Sri Lanka to become a destination for online scam farms, creating a significant threat to the country’s national security, mainly in terms of economic security, information security and cyber security. It is necessary to implement the sound and proper practising of the existing regulations and to strengthen them for the registration of ISP SIM connections in Sri Lanka to secure national security.
(The writer is serving as a Military Research Officer [Navy] at the Institute of National Security Studies of Sri Lanka think tank functioning under the Ministry of Defence. The opinions expressed are his own and not necessarily reflective of the Institute or the Ministry or this publication)
…………………………………………………………………………………….
The views and opinions expressed in this article are those of the author, and do not necessarily reflect those of this publication