Deanonymization for the Good: How Authorities Fight "Gray" SIM Cards

Man

Professional
Messages
2,965
Reaction score
488
Points
83
The state has been fighting so-called "gray" SIM cards for several years now. An important milestone in this work, aimed against fraudsters, "telephone" criminals and terrorists, was marked by the bill No. 647048-8 submitted to the State Duma for consideration.

Changes in legislation are aimed at deanonymizing mobile subscribers and, as a consequence, combating mobile numbers that do not allow the subscriber’s identity to be identified.

RAPSI, together with experts, analyzed why it is so important to limit the circulation of “gray” SIM cards, and also examined the provisions of the new bill.


"Gray" numbers as the basis of crime

According to statistics from the Russian Ministry of Internal Affairs, 304.1 thousand crimes committed using information technology, telecommunications or in the field of computer information were registered in January-May of this year. This is 16.5% more than in the same period last year. Almost half of such crimes (46.7%) were committed using mobile communications, which is 20.9% more than in the same period last year.

Fraudsters, as a rule, do not use phone numbers by which law enforcement agencies can easily and simply establish their identity - they use "gray" SIM cards, that is, those issued with fictitious, incomplete or incorrect passport data. In such a case, it is extremely difficult to find the caller.

Experts are confident that the distribution of such “gray” SIM cards is a serious threat to the security of both individual citizens and the entire country.

In addition, “gray” SIM cards are one of the key components of many telephone fraud schemes.

It seems that many of our fellow citizens are familiar with calls from mobile numbers, when the caller introduces himself as a bank employee, a mobile operator employee, or even an FSB officer. Depending on the legend, the attacker demands to redirect the money to a safe account, provide data from SMS messages, etc. The statistics of the Bank of Russia for 2023 are as follows: cyber fraudsters managed to steal 15.8 billion rubles from the accounts of Russian citizens and carry out more than 1.17 million successful operations to illegally withdraw funds, which is 33% more than the previous year.

For more information on telephone fraud and social engineering methods, read the RAPSI article “The Fraudster, the Bank and Me: The Anthropology of Telephone Scams”.

Since the beginning of the SVO, "gray" numbers have been actively used to achieve their goals by Ukrainian special services, terrorists and other individuals whose criminal intentions are much more dangerous to society than simple fraud. Thus, since mid-2022, a whole wave of news has rolled across the country about arson of relay cabinets on railways, military registration and enlistment offices, various types of sabotage and terrorist attacks committed by our own citizens.

Methods of recruitment to commit illegal acts vary – from pressure on mercenary motives to threats and blackmail. But the means of such recruitment, as a rule, are mobile communications and the Internet. Even if the victim of a telephone attack promptly contacts law enforcement agencies in connection with a call received with an offer (demand) to commit, for example, sabotage, it will be extremely difficult to find the caller.

Thus, the fight against “gray” SIM cards becomes an element of protecting national security.

In addition, “gray” numbers are also actively used by drug dealers, arms dealers, extortionists and other representatives of the criminal world, as well as all kinds of online hooligans involved in bullying and cyber-harassment: they are almost impossible to identify, and therefore they feel complete impunity.

As we can see, the problem of "gray" SIM cards is quite extensive. The scale of prevalence of such SIM cards is also impressive. According to Roskomnadzor, 76.9 million violations of the reliability of subscriber information have been identified since November 1, 2023. Of these, 69.8 million violations have been corrected - operators have entered correct data. 3.7 million SIM cards issued with violations have been blocked, or contracts for them have been terminated, most of them in the first half of this year.

In addition, the agency found that 265 people currently have more than 1,000 SIM cards each. In total, they own over 1.1 million mobile numbers.

In this context, more and more experts are speaking out in favor of toughening the liability, including criminal liability, for those selling "gray" mobile numbers. In addition, it is proposed to also take into account the liability of mobile operators in the issue of their distribution. When "gray" SIM cards are sold or distributed without control for years, there can be no talk of any accidents or coincidences, experts are sure.

Given the current geopolitical situation, many experts agree that foreigners should not have easy access to Russian SIM cards. Each of those who express a desire to purchase a national mobile number of the Russian Federation must be identified by a wide range of features. This is necessary for the safety of Russian citizens.

The rules will be strictest for foreign subscribers

Proposals for improving Russian legislation in the area of SIM card circulation have been expressed in the new draft law “On Amendments to the Federal Law “On Communications” and the Federal Law “On the Implementation of Identification and (or) Authentication of Individuals Using Biometric Personal Data, on Amendments to Certain Legislative Acts of the Russian Federation and Recognition of Certain Provisions of Legislative Acts of the Russian Federation as Invalid” (in terms of clarifying the specifics of providing communication services), which was submitted to the State Duma for consideration at the beginning of the summer and has already been adopted by deputies in the first reading.

According to the explanatory note to the bill, the changes will help to regulate the relationship between operators and subscribers, including foreign citizens, when providing mobile communications services. The proposed measures will also help prevent illegal actions by subscribers.

The most important provisions of the draft law under consideration concern the procedure for concluding contracts for the provision of mobile communications services with foreigners.

Thus, if the document is adopted and comes into force, then the conclusion of an agreement on the provision of mobile communication services with foreigners will be possible only upon a personal visit to the office or sales point of the communication operators/dealers and upon passing identification and (or) authentication using the “Unified system of identification and authentication of individuals using biometric personal data”.

The previous procedure for identification by passport will be retained only for diplomats and persons equivalent to them and representatives of international organizations. It is expected that this will increase the level of reliable identification of foreigners at the place of conclusion of the contract and ensure the correct linking of the personal data of such subscribers to the subscriber numbers issued.

Contracts with foreigners will also necessarily include information about the identification code of the device used (IMEI), that is, a foreigner will not be able to use a SIM card on another device not specified in the contract - if moved, the card will be blocked.

When concluding an agreement with a subscriber who is a legal entity or individual entrepreneur, when the user of communication services is a foreigner, the agreement will also need to include information about his employment relationship with the subscriber who is a legal entity or individual entrepreneur, if the SIM card is used as a service card.

The bill also provides that a foreign citizen or stateless person may be allocated a total of no more than 10 subscriber numbers.

The initiators believe that all this will improve the level of correct identification of foreign subscribers in the communications network.

The bill also addresses the issue of using those SIM cards that will already be in circulation by the time it comes into force. Thus, with foreign subscribers who have concluded contracts for the provision of mobile radiotelephone services before the day the bill comes into force, it will be necessary to conclude new contracts taking into account the new requirements by March 1, 2025.

In case of failure to comply with the relevant requirements, the operator will be obliged to terminate the provision of communication services under the relevant agreements.

There will be fewer calls from scammers

The bill also obliges the communications operator, before the start of providing services, to notify subscribers of all contracts registered in their name for the provision of communications services, with the possibility of suspending service for those numbers for which the subscriber did not actually enter into a contract.

Operators will send such notifications to subscribers via the State Services portal and via SMS messages. The State Services portal, as promised, will feature a new section, My SIM cards, which will indicate all telephone numbers registered to the passport details of a specific individual.

Despite the fact that some minor comments have been made regarding the draft law concerning legal technique and the need for linguistic and stylistic adjustments to the draft text, the draft law has been conceptually received very positively by law enforcement officers and the legal community.

Experts note that the planned tightening of the rules for the sale of SIM cards will not have any negative consequences for law-abiding citizens who use their number exclusively for legal purposes - as a rule, Russians do not buy SIM cards so often that verification and other complications would really cause them inconvenience.

At the same time, the bill could seriously complicate illegal access to mobile communications services, make some fraudulent schemes completely impossible to implement, and reduce risks for people and national security.

If the bill is adopted, then everyone who has a mobile phone will be able to assess how effective the new regulation will be in practice - for example, much will become clear from the reduced number of calls from fake banks, fake police officers and pseudo-FSB officers, and other telephone scammers.

Expert opinions:

Rifat Sabitov, Chairman of the Commission for the Development of the Information Community, Mass Media and Mass Communications of the Public Chamber of the Russian Federation, Deputy General Director - Head of the Regional Department of VGTRK:

"The need to bring order to the SIM card market in order to stop the spread of dangerous and malicious content, fraud using the so-called "gray SIM cards", numbers without an identified owner, is absolutely obvious and long overdue. Each of us, sometimes for as long as we are happy a day, becomes the target of an aggressive attack from such numbers: calls, mailings in messengers, which are impossible to get rid of. The procedure for the circulation of SIM cards must be transparent and understandable. Subscriber verification is needed, it is necessary to check the data of users of already issued SIM cards, which is what cellular operators are currently actively doing.

For Russians, when applying for a SIM card, a passport is sufficient; the bill also requires mobile operators to post information about a citizen's registered numbers on the State Services portal. This will allow us to control what contracts with mobile operators we have concluded, if any, and use.

A stricter procedure is provided for foreign citizens wishing to purchase a Russian SIM card. Here, biometric data and identification of the device on which the card will be used are required. Additionally, the number of mobile numbers assigned to one person is limited. And this is correct, retailers of cellular services are focused on Russian passports, it is problematic for them to verify various forms of foreign documents, additional security measures are needed.

In this regard, I believe the draft law is relevant. We will assess to what extent, if it is adopted and comes into force, the mobile communications environment will be cleaned up, spam and illegal content will be reduced. It is quite possible that it will be appropriate to introduce stricter requirements for registration of SIM cards for Russian users as well.

As for the measures of responsibility for the trade in grey SIM cards, which is obviously illegal, it should be proportionate to the damage caused. Therefore, I believe we can talk about criminal liability."

Alexander Malkevich, First Deputy Chairman of the Commission for the Development of the Information Community, Mass Media and Mass Communications of the Public Chamber of the Russian Federation, Co-Chairman of the Coordination Council for the Integration of New Subjects of Russia under the Public Chamber of the Russian Federation:

"Any anonymity plays into the hands of criminal elements. This also applies to "gray" SIM cards, which are a significant threat to the security of our citizens and our country. The opportunity to purchase a "gray" SIM card registered to a fictitious person is a boon for scammers, terrorists and Ukrainian special services. And we must understand that demand creates supply. As we know, the vast majority of anonymous calls from scammers come from the territory of Ukraine. Thus, anyone wishing to purchase a "gray" SIM card may be a potential enemy, or at least a criminal. Perhaps this sounds harsh, but when it comes to people's safety, there is simply no other way.

When developing such measures, it is necessary to take into account the interests of law-abiding citizens - they should not suffer from what was originally intended for criminals. The new bill contains prerequisites for solving such problems - verification through the "Gosuslugi" portal. Of course, we should not forget about the separate rules for the circulation of SIM cards for foreigners - a limit on the number of cards and sale only after registration in the Unified Biometric System. It is worth noting that many other countries have certain measures to control the use of SIM cards by foreigners, and they did not just appear out of nowhere.

There is another category of citizens that is sort of in the middle - they use "gray" SIM cards, but for everyday purposes. For example, to get a discount on the first order on the marketplace. It is necessary to convey to them that with their "everyday" actions they stimulate the supply of such cards on the market, which are then used by criminals and representatives of unfriendly countries. In addition, it is necessary to understand that such SIM cards are registered to a fictitious individual or legal entity, that is, to fraudsters. Therefore, if a person starts using a "gray" SIM card, for example, logging into social networks, instant messengers, banking applications, his personal data and money will fall into the hands of intruders.

It may seem that I blame only the users for this whole situation. In no case – in the matter of distribution of “gray” SIM cards a significant share of responsibility lies with the operators. Of course, by one chance or another several “gray” SIM cards may actually appear on the market – everyone sometimes makes mistakes. But when “gray” SIM cards are sold or distributed without control for years, there can be no talk of any accidents or coincidences. This is more like complicity.

The bill continues to be considered in the State Duma of the Russian Federation and, in my opinion, it could provide for additional liability measures. For example, Artem Kiryanov, Deputy Chairman of the State Duma Committee on Economic Policy, announced an interesting additional measure in the Public Chamber of the Russian Federation: there should be a legislatively prescribed mechanism for the forced blocking of calls from suspicious numbers and SIM cards.

Regarding criminal liability for the sale of "gray" SIM cards. Perhaps such a measure is appropriate for an individual who does this. A simple fine is not enough - if such a person is part of a criminal group, comrades will easily help pay it off, and after some time he may again be seen near the entrance to the metro with a pack of SIM cards. If we are talking about liability for the operator, I think that a turnover fine at least is quite appropriate, considering the consequences of the distribution of such cards.

Identification of the SIM card user is an important step towards the security of each individual citizen of our country. If he is law-abiding, he has absolutely nothing to fear. And let's hope that he will not have any unnecessary inconveniences either. On the contrary, this will seriously complicate the life of fraudsters, or even make the use of such SIM cards impossible. This is the very case when anonymity does not bring any benefits, but only harms those who live honestly and observe the laws of their country."

Artem Kiryanov, Deputy Chairman of the State Duma Committee on Economic Policy:

"A bill was recently introduced to the State Duma, the authors of which were Vasily Piskarev, Chairman of the Committee on Security and Anti-Corruption, and Anton Gorelkin, Deputy Chairman of the Committee on Information Policy, Information Technology and Communications. According to this bill, a section called "My SIM cards" should appear on "Gosuslugi" so that the user can see which numbers are registered to his passport data and can stop servicing unused ones.

In the context of the SVO, foreign citizens are under particular suspicion, so the bill also provides for the introduction of special requirements in relation to them.

In general, it is necessary to convey to Russians the danger of "gray" SIM cards. They can be registered to a fictitious individual or legal entity, that is, to fraudsters. Therefore, if a person starts using such a "gray" SIM card, logging into social networks, instant messengers, banking applications, his personal data and money will fall into the hands of intruders. "Gray" SIM cards are one of the key components of many fraudulent schemes, so eradicating their illegal distribution will become a serious obstacle to criminal activity.

It is necessary to take into account that "gray" SIM cards are to some extent attractive to ordinary Russians, not scammers, who use them for utilitarian purposes. For example, they leave a "gray" number in various applications and when registering loyalty cards, so as not to encounter SMS spam on the main number later. The desire to protect your main number is understandable, but a "gray" SIM card is not needed for this, it is enough to register a second number in your name and use it in a similar way.

The active use of "gray" SIM cards by ordinary citizens only fuels the demand for this service and "inflates" the market, which contributes to the growth of crime. The authorities, including law enforcement agencies, are forced to deal with the consequences of such negligence. People's personal data is essentially "digital oil" in value. A leak of personal data is, first and foremost, a blow to the safety of citizens. The least that can threaten the victims of such incidents is receiving spam calls and messages. Otherwise, Russians may encounter real scammers and extortionists and suffer financial losses.

VPN services have become another “risk zone” for users’ personal data today. Applications have been caught more than once in a negligent attitude towards users’ personal data. In addition, there are also frequent cases of such services’ databases being leaked to the darknet or sold to third parties. Today, in addition to everything else, VPNs have become a powerful tool for attackers, with the help of which they can cause a lot of problems for users. Starting from spam mailings and ending with serious fraud with extortion.

I think that it is not necessary to introduce criminal liability, that is, a special section in the Criminal Code for SIM cards, because a whole range of actions with SIM cards already fall under the Criminal Code. In particular, I see the possibility of turning to the article on fraud.

As for administrative liability, of course, it should be significantly higher than it is today. That is, perhaps it is necessary to review liability for illegal turnover of SIM cards within the framework of the Code of Administrative Offenses. Accordingly, liability should be provided for both individuals and legal entities."

Alexander Khinshtein, Chairman of the State Duma Committee on Information Policy, Information Technology and Communications:

Under pressure from the state, the "gray" market has changed - so now the problem of holders of thousands of "SIM cards" has come to the fore. According to Roskomnadzor statistics, more than a million mobile numbers are registered to a total of only 256 people. How and who uses them, one can only guess.

Back in late 2020, we gave Roskomnadzor the ability to block "gray" SIM cards when amendments to the Law "On Communications" were adopted. Since then, operators are required to check the information entered by legal entities and individual entrepreneurs who are corporate subscribers, and about individuals, in the Unified Identification and Authentication System of the State Services portal. Thanks to this, the regulator is carrying out comprehensive work to identify and block dubious "SIM cards" - since 2024, those SIM cards whose users cannot confirm their data simply stop working.

Source
 
Top