CrCF Statement: Office of the National Broadcasting and Telecommunications Commission must investigate and provide clarification on the mobile phone facial recognition system in the Deep South of Thailand

Statement: Office of the National Broadcasting and Telecommunications Commission must investigate and provide clarification on the mobile phone facial recognition system in the Deep South of Thailand

Published on 25 June 2019

On 21 June 2019, mobile phone owners in the Deep South of Thailand (Pattani, Yala and, Narathiwat) and 4 districts of Songkhla (Jana, Nathawi, Sabayoy, and Tepa Districts) received an SMS message stating that any person using a mobile phone in the area must re-register their sim card and photograph through a facial recognition system to confirm their identity by 31 October 2019. Using mobile phones without registering through this system will be disallowed after the deadline.

“Internal Security Operations Command (ISOC) Region 4 requires mobile phone users in the Deep South and 4 districts of Songkhla to register in the system by 31 October 2019. To check sim card status press *165*5*identification number # then call out, otherwise, would not be able to use their mobile phone. For more information, press *915653. For information in Yawi (local malayu dialect), press*915654”

Col Pramote Promin, spokesman for Internal Security Operations Command (ISOC), explains that the order came from an announcement by the Office of the National Broadcasting and Telecommunications Commission’s, according to the Royal Gazette on 9 April 2019, with the purpose of preventing identity theft in financial transactions or organizing insurgent activity in the Deep South.

The Cross-Cultural Foundation’s findings from investigating the matter are as follows:

1. The announcement from the Office of the National Broadcasting and Telecommunications Commission (NBTC) about “the registration and data collection of the mobile phone users” does not state that the registered user needs to take a photo to confirm their identity. Section 3 article 9 clearly states that in case of an ordinary person, the user only needs to provide identification number or passport number, name and surname, address, phone number, service activation date, name and the location of the service point.
2. The announcement does not specify that registered service users have to register in the identity verification system. The system only applies to new sim card users. For the Deep South and 4 districts of Songkhla, regardless of the announcement, it does not only apply to the new sim card user but also users who have already registered their sim cards, otherwise, their mobile phone would be deactivated.
3. Article 13 of the announcement specifies that, if the service providers collect user data, the service provider must have a standard information security protection regime to protect user privacy and freedom of communication. However, no service providers have a clear explanation on this matter.
4. The mobile phone network service provider’s currently lack accountability in informing the user of whether and to what extent the announcement authorizes officers to access personal information on a mobile phone. There is little information on where the data is stored, who operates the data collection, who has access to the data, and whether the user could request that data be deleted. The SMS message made by the Internal Security Operations Command (ISOC) has triggered a high degree of skepticism toward the service providers’ acknowledgement of the security sector’s order on the face recognition system.

Recommendations

1. The Office of the National Broadcasting and Telecommunications (NBTC) Commission must investigate and ensure correct implementation of the announcement by the mobile phone network service provider. It must ensure that there is no external influence or manipulation from any government sector and that the facial recognition system must not violate privacy and freedom of communication.
2. The Office of the National Broadcasting and Telecommunications Commission (NBTC) must implement protection measures to prevent rights violations as it regards privacy, freedom of communication, and discrimination. Furthermore, it must ensure that the registered personal information is safely stored or destroyed without external influence or manipulation from both the private and public sector, except for the case of a court order.
3. Mobile phone service providers must reconsider the implementation of facial recognition and identification for sim cards. The technology remains flawed, as research indicates that mass data collection usually leads to racial profiling and, in turn, wrongful arrests. The risks of racial discrimination may erode public trust in policing the region.

For more information, please contact Chanatip Tatiyakaroonwong

Human Rights Researcher, Cross Cultural Foundation, Tel. 062-286-8688