A Subscriber Identity Module (SIM) is used in mobile phones, smart watches and tablets. Nowadays, there are what is commonly known as the SIM card and the eSIM. The SIM card is a physical card which is inserted into the device's SIM tray. The eSIM is an embedded SIM. It can be downloaded from the Mobile Network Operator (MNO).
The SIM or eSIM is used to store the International Mobile Subscriber Identity (IMSI) which unambiguously identifies a mobile subscriber globally.
A mobile phone number is an eight digit number (9999 9999). There are three Mobile Network Operators in Mauritius. Each Mobile Network Operator is allocated a range of phone numbers. The first four digits of the allocations are (x specifies 0-9):
| Cellplus Mobile Communications Ltd | 525x , 526x, 5471, 550x, 553x, 570x , 575x , 576x, 577x, 578x, 579x , 580x, 581x, 582x, 583x, 5875, 5876, 5877, 5878, 590x , 591x 592x, 594x, 700x, 733x |
| Emtel Ltd | 5421, 5422, 5423, 5428, 5429, 543x, 544x , 545x, 546x, 5472, 5473, 5474, 5475, 5476, 5477, 5478, 5479, 548x, 5490, 5491, 5492, 5493, 5494, 5495, 5496, 5497, 5498, 5499, 551x, 571x, 572x, 573x, 574x, 584x, 585x, 593x, 597x , 598x, 701x, 703x, 730x |
| Mahanagar Telephone (Mauritius) Ltd | 527x, 528x, 529x, 552x, 586x , 5871, 588x, 589x, 595x, 596x, 702x, 731x |
The Mobile Network Operators offer prepaid and postpaid phone plans. A prepaid plan with 120 minutes of local calls and 6 GB of data costs USD 8/-. The prepaid plan is valid for 30 days. A monthly postpaid plan costs USD 13/- and comes with 400 minutes of calls on the MNO network, 60 minutes of local calls and 50 GB of data.
Since 2005, the customer was required to register his/her National ID number when he/she purchased a phone plan. Postpay customers were required to provide a proof of address.
It was found during a Commission of Inquiry held in 2017 that there were 28,000 SIM cards registered to an employee of a travel agency in 2023, the Information and Communication Technologies (Registration of SIM) Regulations 2023 was introduced to mandate the re-registration of all SIM cards and eSIMs. According to the Information and Communication Technologies Authority, the mandatory SIM re-registration was based on recommendations of the Commission of Inquiry on Drug Trafficking.
The SIM re-registration process requires the subscriber to submit a selfie by going through a liveliness detection test. The MNO retrieves the photo of the subscriber from the Central Population Database and does a comparison using facial recognition. This process raised significant privacy concerns given that it requires the collection and processing of biometric data. Furthermore, there is very little official information on the collection and processing of the biometric data.
Social media networks are in widespread use in Mauritius. Some of those networks, e.g. Signal, Telegram, WhatsApp, require a phone number to sign up for the service. There is a perception of anonymity as those services do not require other personal data as part of the registration. The SIM re-registration may be viewed as intrusive as it may be possible to identify a social media user without requesting the information from the social media network.
A well-known MNO in Europe offers an Orange Holiday Mauritius prepaid plan for roaming in Mauritius. The cost is EUR 39.99 for 10 GB of data and the prepaid plan is valid for 14 days. It is highly unlikely that a nationwide SIM re-registration regulation would fulfill the objective which was set by the regulator when it can be thwarted by switching to a foreign phone roaming plan. The cost of the foreign roaming plan is within reach for the adversary.
The purchase of a large number of prepaid SIM cards could be identified through a real-time fraud detection system at the MNO. However, such a purchase might not be for fraudulent purposes.
It would be more effective to have postpaid phone plans which are accessible to budget-conscious subscribers. The postpaid subscribers would not be anonymous as they are invoiced monthly. Subscribing to those phone plans would not require the collection and processing of biometric data.
1. "Dernier délai pour l'enregistrement de cartes Sim : 31 août", lexpress.mu, July 2005
2. "Commission drogue: l'homme aux 28000 cartes sim, «un danger public»", lexpress.mu, August 2017
3. "Information
and Communication Technologies (Registration of SIM)
Regulations 2023", Government Notice No. 93 of 2023, June 2023
4. "ICTA - Frequently Asked Questions", Information and Communications Technologies Authority, April 2024