Govt urged to mandate prepaid Sim registration | Bangkok Post: tech

The Security Expert Association has urged the ICT minister to be aware of unregistered prepaid mobile users who use such handsets as cyber crime tools.

Prinya Hom-anek

Last week, the National Telecommunications Commission (NTC) raised the issue of whether the usage of the BlackBerry devices (BB) complies with the Computer Crime Act BE2550, which states that log files have to be stored for 90 days. But BB manufacturer Research In Motion says the devices store their data in Canada.

Meanwhile, Aree Jiworarax, Director of the Bureau of Information Technology Regulation, under the Information and Communication Technology minister, said the RIM system did not violate the law because mobile operators collect log files under the Computer Crime Act, so the BB does not violate the law.

Currently, 90 percent of servers are located outside Thailand, requiring service providers to keep traffic transactions data and provide this when needed. However, until now, there has been no single case requiring the ICT to ask for such data from mobile operators.

Prinya Hom-anek, committee member and secretary at the Thailand Information Security Association (TISA), which was involved in the Computer Crime Act drafting process, said the ICT minister should not concentrate only on the log file, as the main purpose of the law is to identify users who employ multiple devices to access the Internet.

The biggest national security issue that ICT minister and National Telecommunications Commission (NTC) should be concerned with is not the BlackBerry issue but unregistered prepaid mobile phone users which allow hackers to easily buy mobile Sim and gain access to the internet and perform actions which violate the Computer Crime Act but which are hard to trace.

There is an increasing global trend to commit crime. In some countries, such as Singapore and Malaysia, prepaid Sims must be registered.

Visitors have to buy Sims at designated shops and show their passports as proof of identity.

"The government should consider implementing a private, reliable, trusted cloud mail system or reliable internal mail system, because other countries did not allow their officers to use public email services." Prinya emphasised.

Surangkana Wayuparb, Director, Ethical, Legal, and Social Impact of Information at National Electronics and Computer Technology Center (Nectec), who oversaw the main draft of the Computer Crime Act, said the law considers service providers have the duty to store or keep traffic data that helps to authenticate users, but unregistered prepaid users are very difficult to trace.

"Thailand's mobile services concentrate on marketing ease of use and affordable prices for prepaid services, but they should consider the repercussions of chasing a gain in revenue while trading off national security. Many other countries do not allow the unregistered use of prepaid services," Surangkana noted.

The mobile operator source, who asked not to be named, admitted that currently there is no register of prepaid Sim card buyers' information, whether on feature phone or smart phone, including prepaid datacard services.

Currently, operators keep users' numbers and access Internet usage time but did not keep all URL or website details because this is such a huge amount of data, with some users topping 10,000 actions per day.

At present, there are more than 10 million mobile users connected to the Internet. Some 800,000 of these are smart phone users and less than 50 percent of these are prepaid.

If the government wishes to increase national security by mandating registration for mobile users, the strategy needs to be implemented equally across all mobile operators and the details stored in a central system.

Previously, in 2005, there was an attempt to register mobile users nationwide but to date only three of the volatile southernmost provinces have strictly adhered to the registration requirements, as this has helped to reduce the use of mobile phones as bomb triggers.

"Thailand has lot of Sim distribution points, like Indonesia and Hong Kong, unlike Singapore and Malaysia, which have smaller areas which are easier to control," said the source.

According to a Trend Micro Report titled "The Future of Threats and Threat Technologies: How the Landscape Is Changing - More Choices for Connectivity" stated that shifts in the technology industry coupled with business and consumer adoption mean that these targets are changing. In the future, mobile devices such as smart phones and the public/private cloud will become greater targets for cyber crime.

In a 2009 Trend Micro smart phone survey, over 50 percent of users already surf the web from their device for over 30 minutes per week. Of these, more than 12 percent are spending more than 120 minutes per week surfing, and the numbers are growing.

This behaviour is expected to continue to grow. The report considers the implication of this development as it relates to threats from mobile phones.

"This week, TISA will submit the suggestion to the Ministry of Information and Communication Technology and the association will recommend the government settles an agreement with RIM that if there are any investigate cases related to national security, it will allow the authorities to access their customers' data," said Prinya.

"Lawful Intercept, or obtaining communications network data pursuant to lawful authority for the purpose of analysis or evidence should be considered in for use in Thailand as well."