Icasa's Sim rules need a privacy backstop

Just one breach of a private fingerprint database would cause harm that no fine or apology could undo. You can change a password and cancel a bank card, but you can never cancel your finger. Once a fingerprint leaks, it is compromised for life, along with every bank and phone that trusts it. The consequences for consumers and for public safety would be catastrophic.

Under draft regulations Icasa published in the Government Gazette on 28 October, anyone activating or swapping a Sim would have their fingerprint or face checked against home affairs records, and existing subscribers would have two years to be verified. Operators that approve a swap for the wrong person would face fines of R2-million to R4-million per contravention.

Icasa’s own memorandum puts South Africa’s mobile subscriptions at 117.3 million. Data on that scale would become a target the moment any private company stored it, and the prospect of private companies holding prints for that many connections, if the final rules allow it, should worry every consumer and every bank in the country.

No private company should be forced to collect fingerprints, and none should be allowed to store or share them.
Lloyd Matthew and Heinz Vollmer

Doing a biometric check against home affairs is the right instinct, but the final rules must state plainly that no private company may store a customer’s actual fingerprint. The only body that should ever hold a South African’s fingerprint is home affairs. No private company should be forced to collect fingerprints, and none should be allowed to store or share them.

We expect criminals to attack the new system both online and in person. Online, they will target any database that holds prints, plant malware on in-store scanners, intercept scans in transit, send phishing messages asking people to “verify” their Sim with a fingerprint or selfie, and use deepfaked faces to pass remote face checks.

In the physical world, corrupt staff or agents may copy scans or approve swaps for a fee, and fake verification agents may harvest prints during the two-year re-verification window. Prints can be lifted from glasses and phone screens, victims can be forced to scan a finger during robberies, and insiders in government or at contractors may alter or sell identity records.

The alternatives

Each of the approaches below lets an operator confirm who a customer is without ever holding their fingerprint. None is experimental, and versions of each are already in use.

Revocable fingerprint tokens. A technique called a fuzzy extractor turns a fingerprint scan into a stable secret key, even though no two scans are ever identical. The operator stores only a salted hash of that key, never the print. Each network receives a different token, so leaked databases cannot be linked, and a leaked token can be cancelled and reissued like a password.
Prints sealed inside the Sim. A protected fingerprint template lives in the Sim card’s secure chip, the approach already used by fingerprint bank cards. The match happens on the chip itself, and the network receives only a signed yes or no.
Encrypted matching with home affairs. The scan is encrypted before it leaves the scanner and compared with the home affairs record while still encrypted. Only a signed match or no-match result comes back, so neither the operator nor anyone intercepting the traffic ever sees the print, and the print is never stored.
Keys that never leave your phone. A fingerprint or face scan can simply unlock a cryptographic key held in the phone’s own secure chip, the approach behind the passkeys already on Apple and Android devices. The network or bank receives a signed proof from that key, never a biometric. Because the proof is bound to the device and not to the phone number, a fraudulent Sim swap on its own gives the attacker nothing. The US Cybersecurity and Infrastructure Security Agency already recommends phishing-resistant authentication of this kind over codes sent by SMS.

None of this is theory. After India enrolled more than a billion people in its Aadhaar identity system, copies of identity data scattered across banks and mobile companies became the weak point. Its answer was tokenisation: citizens can present a revocable 16-digit virtual ID, and every company receives a different token that cannot be linked across databases or traced back to a biometric. India had to retrofit this. South Africa can build it in from the start.

Whichever methods operators choose should run alongside an SMS alert to the existing number, an email alert and a 24-hour pause on bank one-time Pins after every Sim swap. Banks can go further today: standardised network interfaces already let them check in real time whether a number was recently swapped, without collecting any biometric data. A fresh swap should be treated as a reason to freeze high-risk transactions until the customer confirms.

The same rules could help police catch the people behind Sim-swap fraud. A scan that fails to match the account holder may come from a fraudster handing over their own fingerprint or face at the scene of an attempted crime. Or it may come from an honest customer, such as a pensioner or manual labourer whose prints have worn smooth, or someone using a faulty scanner.

Our design therefore deletes by default, rather than punishing. Each failed scan would be sealed with encryption that no private company can open or delete, and held as evidence for 14 days by an independent custodian, together with the store, staff member, device and time. It would be released only to the South African Police Service’s cybercrime units under a court order. If the customer, bank, store or operator opens no criminal case in that time, the scan would be deleted automatically.

For years, criminals have hidden behind stolen IDs. Under biometric verification, every attempted swap leaves their biometrics at the counter, and that evidence belongs with detectives.

Security is the industry’s job, not the customer’s

For too long, the burden of security has fallen on customers, who are told to guard their Pins while criminals break into the systems around them. Icasa is right to put penalties on the table. Operators, banks, retailers and government agencies should hire red teams and security engineers to attack their own systems before criminals do. Prevention also needs the police and specialised cybercrime units to crack these cases and prosecute them, because criminals stop when they expect to be caught.

We believe Icasa should set the outcomes it expects and leave the methods to the operators, rather than writing specific techniques into law. Fraud methods change faster than regulations do, and a technique fixed in law today becomes a published target tomorrow.

The bar already has a name. The international standard for protecting biometric information, ISO/IEC 24745, requires that stored biometric data cannot be reversed or linked across databases, and that it can be revoked. Icasa could adopt those tests as the outcome every proposed method must meet, whatever technology sits underneath.

We propose that Icasa review anti-fraud methods in confidence, case by case, approving or rejecting them without publishing the detail criminals would study.