When we discover that mobile phone lines have been registered in citizens’ names without their knowledge, or that national ID data was used to issue SIM cards to other people, today’s issue goes far beyond a simple mobile SIM card. In the past, registering a line under someone else’s name was primarily a service problem. Today, the situation is completely different. A phone number has become an integral part of a citizen’s digital life. We use it to receive verification codes, recover passwords, open accounts, log into applications, and execute financial transactions. It is also linked to e-wallets and payment services. Consequently, a SIM card registered to one person but under the control of another can be used in operations far exceeding a mere phone call—including financial fraud, identity theft, fake accounts, and potentially far more dangerous activities. However, as the problem grows more severe, so does the need to investigate the entire chain of responsibility.
It is only natural to feel concerned. But concern shouldn’t immediately push us to seek the most complex solutions; it should lead us to ask the right question first: How did this happen in the first place? Who violated the regulations? Who entered the data? Who activated the line? How did the company’s system accept the transaction? And how did these operations pass through both internal corporate oversight and the regulation of the National Telecommunications Regulatory Authority (NTRA)?
These questions must precede any talk of collecting citizens’ fingerprints or creating new biometric verification systems. Diagnosing the problem incorrectly almost always leads to choosing the wrong solution.
The Problem Is Not That the State Doesn’t Know the Citizen’s Identity
We are not dealing with an anonymous market. There are national IDs, contracts, electronic systems within telecom companies, and established rules governing the sale, registration, and activation of SIM cards. Therefore, the issue isn’t simply whether we know the person in front of us is the actual ID holder. The more critical question is:
How was someone inside—or linked to—the system able to use a citizen’s data for a transaction that the citizen never consented to?
Here lies the distinction between two completely different problems:
- Identity Verification: Is this person truly who they claim to be?
- Transaction Authorization: Did this citizen actually consent to issuing this specific line in their name?
We can succeed at the first and fail completely at the second. Even if a citizen stands before a camera and their face or fingerprint is verified with near-perfect accuracy, the underlying question remains: Does the system prevent an employee from issuing an additional, unrequested line? Does each line require independent consent? Is the citizen immediately notified that a new line or e-wallet has been registered in their name? Can they reject or halt the transaction?
This is where the real problem lies. The core of this crisis is governance, not identity confirmation. From an information systems and cybersecurity perspective, the cases being discussed resemble a failure in governance, privilege management, and oversight rather than a failure to prove a citizen’s identity. This issue manifests across several levels:
- Point-of-Sale (POS) Outlets: If SIM cards are sold or activated outside clear, disciplined channels, the first step is not collecting more citizen data. The first step is tightening control over sales outlets. Every operation must be linked to a specific branch, employee, device, and timestamp so that any transaction can be traced back to ask: Who executed it? Who approved it? Where did it take place? Only then can violations be tracked.
- The Employee as an Insider Threat: Security systems are often designed assuming the attacker is an outsider. Yet, some of the most dangerous breaches and abuses originate internally. An employee who already possesses a username, password, and system access rights can pose a far greater threat than an external hacker. Here, fingerprints fall short. If a single employee can enter customer data, verify it, issue the line, and activate it without independent oversight or separation of duties, the problem isn’t the citizen’s identity—it’s the system’s design. In modern architecture, authorized access isn’t enough; privileges must be strictly limited, every action logged, and anomalous operations subjected to review.
Technology Can Detect the Problem Before It Escalates
Telecom companies possess vast amounts of data, and analyzing this data can easily flag unusual patterns. Data analytics can readily detect:
- An employee issuing an abnormally high number of SIM cards.
- A specific branch generating suspicious registration activity.
- A single national ID number used to register multiple lines within a short timeframe.
- A cluster of SIM cards activated and immediately used to create e-wallets or digital accounts.
These are not hidden anomalies. They are precisely the types of patterns that Fraud Detection and Behavioral Analytics systems are built to uncover. Even without artificial intelligence, simple rules and automated alerts can surface numerous cases. Thus, a legitimate question arises: Were corporate systems tracking these patterns? If they were, what action was taken? If they were not, why?
Why Should the Citizen Pay for Weak Oversight?
This exposes another flaw in some proposed solutions. When a company or regulatory framework fails to prevent the misuse of citizen data, the suggested fix is often demanding even more sensitive data from the citizen. In essence, the victim of the flaw is made to bear the risk and cost of its remedy. This logic needs serious reconsideration.
Citizens do not define employee permissions, design corporate software, monitor third-party distributors, or permit unauthorized use of their ID cards. Why, then, should the initial response be: “Give us your fingerprint too?”
Biometric Data Is Not a Silver Bullet
There is a common misconception that adding fingerprint or facial recognition automatically renders a system secure. This is false. While biometrics can be a useful component of certain verification frameworks, they are not a magic cure. Every biometric system carries error margins: it may reject the legitimate owner (false rejection) or incorrectly accept a match (false acceptance).
Performance depends heavily on hardware quality, algorithm precision, image clarity, lighting, and configured threshold sensitivity. However, the broader concern extends beyond recognition accuracy. Establishing a massive biometric infrastructure immediately raises critical questions:
- Where will the data be stored, and who will have access to it?
- Will raw facial images be stored, or only derived digital templates?
- How will the data be encrypted, and who manages the encryption keys?
- How long will the data be retained, and what happens in the event of a breach?
These are fundamental questions. If a password leaks, it can be reset. If an ID card is compromised, it can be reissued. A digital certificate can be revoked. A human being, however, cannot change their face or fingerprints. For this reason, biometric collection must always remain an exception backed by strong justification, rather than the default first response.
What Happens When “The System Is Down”?
While this phrase is often used sarcastically, it poses a crucial engineering question regarding a scenario we frequently encounter with public services. If biometric verification becomes a mandatory prerequisite for issuing any line or service, what happens when the central system goes offline? Does service halt across all branches? Is there an alternative process? Who holds the authority to use it?
This reveals a significant dilemma: without a fallback mechanism, system downtime can freeze services entirely. Yet, if an exception override is introduced, that very mechanism risks becoming the backdoor used to bypass verification altogether.
Designing such a platform requires meticulous business continuity planning, robust backups, clear fallback protocols, and strict audit trails over exceptions—a level of operational complexity that should only be introduced after proving the issue cannot be resolved through simpler means.
Review the Existing System Before Adding a New One
Following a crisis, proposals for new rules, devices, and systems naturally emerge. However, this approach carries a risk: new technology can easily obscure the harder, foundational question:
Who is accountable for the failure of the existing system?
If existing regulations already prohibit issuing a line without specific procedures, yet widespread violations occur, we must establish clear facts: Were companies enforcing the rules? Were there infractions by employees or agents? Were audit systems operational? Were alerts raised and ignored? Were independent reviews conducted? And what actions did the regulator take?
A regulator’s role is not merely to draft new rules, but to ensure existing ones are strictly enforced. Real oversight does not start with technology; it starts with accountability.
We Need a National Digital Identity—But Not This Way
None of this implies that Egypt does not need to modernize its digital verification infrastructure. On the contrary, Egypt genuinely needs a unified national digital identity framework. However, building fragmented, sector-specific silos is not the solution.
If telecom companies build their own system, banks construct another, the government a third, the postal service a fourth, and insurance providers a fifth, we will repeatedly duplicate data, security risks, and operational costs. A superior approach relies on a national infrastructure that enables citizens to prove their identity securely across different entities without requiring every entity to clone and store their complete profile.
The guiding principle must be data minimization: collecting only the bare minimum required for the task.
- If a service provider only needs to confirm a user meets an age requirement, it does not need a complete copy of their personal data.
- If it needs to verify identity validity, it does not necessarily need to permanently retain the verification payload.
This represents the correct direction for digital transformation: Privacy by Design—embedding privacy protections into system architecture from day one, rather than patching them on after a breach occurs.
The same principle applies to Blockchain, Artificial Intelligence, and Biometrics. These are tools—suitable in specific contexts and improper in others. Distributed ledger technology, for instance, can assist in audit trails or log integrity verification. However, it makes little sense to adopt Blockchain first and then search for a problem to apply it to, deploy AI simply because it is available, or build a biometric database just because the technology permits it.
In successful digital transformation initiatives, the proper sequence is always:
- Thoroughly understand and analyze the problem.
- Establish governance and policy.
- Design operational procedures.
- Select the appropriate technology.
The Dimension of Rights and Freedoms
Any initiative involving the large-scale collection of sensitive data extends beyond technical considerations—it directly impacts the identity data of millions of citizens. It is entirely legitimate for society to ask:
- What is the precise purpose of this data collection?
- Who owns it, and who holds access rights?
- Will it be restricted strictly to issuing phone lines, or could it later be linked to other services?
- Are there clear legal boundaries preventing purpose creep?
- Is there an independent body auditing access logs?
These questions become increasingly critical as telecommunications intersect with social media accounts, financial services, and digital identity. Technological capabilities expand rapidly, and an infrastructure built for today’s purpose can easily become a tempting tool for a very different purpose tomorrow. Therefore, building technical capabilities must be preceded by establishing the legal and institutional safeguards that govern their use.
Ultimately, this issue offers an essential lesson that extends far beyond the telecommunications sector:
Technology should follow governance, not substitute for it.
If the core issue is privilege abuse, fix access management. If the flaw lies within sales outlets, regulate the distribution channels. If oversight is weak, activate real auditing. If fraudulent patterns exist, leverage data analytics to detect them. And if violations occur, hold both the perpetrators and those who enabled them accountable.
Only after a comprehensive study proves a genuine operational gap—one that cannot be closed through simpler means—should we select the appropriate technology: minimizing risk, cost, and intrusion into citizens’ privacy.
As the saying goes: “Don’t use a cannon to kill a fly.”