In March 2014, the Brazilian telecommunications administration (Anatel) proposed a policy that would mandate the registration of all cell phones in Brazil — not SIM cards, but the actual phones. Why? Anatel’s reasoning is that it would enable the regulator to exclude from service cell phones considered to be dangerous or counterfeit. However, as we explain below, it would also put the privacy and free expression rights of vulnerable mobile device users at risk.
Access partnered with Brazilian think tank Instituto de Tecnologia e Sociedade (ITS) to undertake research and develop recommendations to prevent the negative impact that banning of non-compliant devices would have on human rights in Brazil.
Our joint study and opinion paper, Connectivity at Risk, explores the implications for users of cell phone registration policies. The English version can be downloaded here [PDF] and a version in Portuguese is available here [PDF]. A copy of this study has also been submitted to Anatel.
Here’s a brief overview of the key issues:
IMEI, a number for every device
According to the regulator’s proposal, all devices would be identified using an unique ID number present in all cell phones: the IMEI (International Mobile system Equipment Identity). Regulators would build a database of devices that are approved for use, which would in turn be shared with service providers. Devices not on the list would then be cut off from access to the cell phone provider network, even if the device has a valid SIM card.
The move to register mobile devices is ostensibly an effort to protect cell phone users and fight the trade of counterfeit goods. In fact, the proposed policy comes in reaction the widespread practice in low-income communities in Brazil of buying cheap phones from lesser known Chinese brands, popularly known as shanzai. These devices typically allow the use of two SIM cards in parallel, which lets users take advantage of special offers on data and call plans from different providers at the same time. Under the proposed plan, these phones and the people who use them would be cut off from mobile networks.
According to our analysis, the policy would give certain companies more control over mobile device imports, and increase profits for mobile providers. However, it would not adequately protect users’ right to access communication technologies, and endangers privacy and freedom of expression.
Human rights at risk
Mandating the creation of a database of pre-approved devices puts users’ privacy at risk, which is especially worrisome for vulnerable users such as activists or investigative journalists.
If the database were breached or abused, it could reveal the device number of every citizen. This could lead not only to privacy invasions, but also have a negative impact on the economy. When a Korean database of national identification numbers was hacked in 2011, for example, there were disastrous economic consequences. If the proposed registration policy requires people visiting Brazil to register their mobile devices or buy new ones, it could discourage travel and tourism.
As our report [PDF] reveals, these considerations are only the tip of the iceberg. We encourage you to read and share it, and to stay tuned for updates as we continue to advocate for policy that adequately protects the rights of users in Brazil.