BANGKOK -- Thailand will require anyone buying a SIM card in the country -- a central part of mobile phones -- to register fingerprints or facial scans in a government database, a security measure that some worry could be abused to give the ruling junta broad surveillance capabilities.
The government launched a biometric registration system for prepaid SIM cards in December. This will be extended in February to include postpaid contracts, covering nearly all SIM cards sold in the country. The fingerprint and facial scans are linked to the SIM cards' respective phone numbers and stored in a database operated by the National Broadcasting and Telecommunications Commission.
If SIM card suppliers -- including mobile carriers such as Advanced Info Service, Total Access Communication and True -- fail to comply with the registration requirement, they could face fines or have their licenses suspended.
The system is intended partly as an anti-terrorism measure, according to the government. Thailand has seen numerous bombings in which cellphones were used to detonate explosives, using the electric current that flows through a phone when it receives a call. This technique was reportedly used in the August 2015 bombing at Erawan Shrine in downtown Bangkok, which killed 20 people, and a string of attacks at resorts in southern Thailand in August 2016.
Cellphone detonators allow bombs to be set off from a distance, making it tougher to track down the culprit. Using prepaid phones, which do not need to be linked to a credit card or bank account, can complicate matters further.
Authorities believe that tying SIM cards to biometric data will help deal with a wide range of offenses beyond terrorism as well, helping police apprehend criminals while also providing a source of evidence. "We also want to require registration of previously purchased SIM cards in order to protect the public," NBTC Secretary-General Takorn Tantasith said in November.
But some worry that the system will be ripe for abuse. Combining personal identifiers with location and other data that can be gleaned from a phone could give authorities a detailed picture of a given person's day-to-day activities.
"We didn't need to do this before," Aphiralak Namkhonon, a 38-year-old office worker who bought a prepaid SIM card from a phone dealer, said with a frown. "I don't feel good about it from a privacy perspective."
The requirement applies to international visitors as well. Mark Wallace, an American who plans to stay in Thailand for a month, remarked that it felt strange, noting that the U.S. doesn't require biometric data when buying a SIM card.
A 2016 survey by Thailand's National Statistical Office showed that 50.5% of those aged 6 or older used smartphones. Some private-sector research firms see this figure approaching 100% in 2019. The government is considering other ways to use the biometric data it collects from phone owners, including linking it to a digital identity platform due to roll out as early as 2019, a step that could make financial services such as online banking more secure.
But some experts warn against building systems that rely too much on cellphones.
Facial and fingerprint registration "is a good approach, but it's not enough for mobile banking," said Prathan Phongthiproek, cybersecurity manager at KPMG Phoomchai Business Advisory, a Thai arm of the global accounting firm. He argued that the registration system will help with hijacking of phone numbers, but not with device theft or "shoulder surfing" -- looking at a device over the user's shoulder to steal personal information.
With economic growth fueling the proliferation of mobile phones, more emerging and developing countries are implementing biometric registration for SIM cards. Pakistan and Bangladesh imposed fingerprint requirements in 2015, while Nigeria launched such a system around 2011.
Some 1.5 billion people, mainly in Africa and Asia, lacked any official proof of identity, according to a 2016 World Bank report. Implementing national identification systems such as ID or health insurance cards can be hugely expensive. For countries considering such programs, taking advantage of the mobile devices that so many people carry with them constantly is an appealing option for efficiently registering and managing data on a limited budget.
