eSIM and Nigeria’s Digital Security

The telecom industry has been characterized by rapid changes ever since telecommunication monopolies came to an end about 20 years ago.

It is however no news that eSIM has been introduced recently into the Nigerian market by major telecommunications industry players.

Each time an industry breaks new ground, it’s inevitable for consumers and insiders alike to raise some concerns. A technological advancement that reshapes the status quo can be perceived as a threat, even if closer inspection proves it to be an opportunity.

The eSIM is one such advancement, experts believe it is set to revolutionize telecommunications and IoT.

A GSMA accredited global mobile network provider, Truphone forecasted that by 2024, seven billion eSIMs will have been activated in consumer and IoT devices around the world coupled together with billion of industrial eSIM- ready devices expected to be shipped by 2025.

Recall, MTN Nigeria recently announced the commencement of e-SIM trial on its network upon approval given by the Nigerian Communications Commission (NCC). Following suit, 9mobile also launched eSIM last week.

The telco, MTNN said the trial was part of its continued drive to lead digital transformation, foster inclusion, improve customer experience and maintain the highest quality of service for its customers.

Speaking with Business Remarks, the Chief Executive Officer of Medallion Communications Limited, Engr Ikechukwu Nnamani said eSIM is an electronic or embedded SIM built directly into the motherboard of phones during manufacturing.

“Before now, subscriber identification information has been included in a physical device called the SIM Card. With the improvement of technology, the subscriber identification information can now be placed in a non-physical device. Instead, it is embedded into the phone itself”, Nnamani said.

The advancement in technology has made security risks become a major issue in the internet age.

According to Deloitte in its study titled “Nigeria Cyber Security Outlook 2020”, the year 2020 will experience a number of shifts that will affect the Nigerian Cyberspace – shifts in attack targets; attack magnitude; identification and authentication; monitoring; awareness and education; regulatory oversight; collaboration; and a shift in the way organizations deal with cyber-attacks.

“Many attacks in 2020 will move from big “well prepared” organizations to the seemingly unlikely targets”. Deloitte forecasted.

Allaying subscribers fear on the adoption of eSIM, the President, Association of Telecommunications Companies of Nigeria (ATCON), Mr Olusola Teniola stressed that eSIM is safe.

Teniola and Nnamani both agreed the advantages of eSIM are many and use cases are embedded in the Internet of Things (IoT), machine-to-machine communication, and automated manufacturing processes alongside Drones and their infinite uses.

ALSO READ: How MTN e-SIM Approved by NCC works

“The use of eSIM will greatly eliminate the case of stolen devices. eSIM will also help fight cybercrime as it will be easy to tie those that commit a crime online to their device during a forensic investigation.” Nnamani pointed out.

Speaking on its vulnerability, the eSIM technology, according to Teniola is securely based on encryption that already protects SIM communication in between the mobile device and BTS and core network elements.

“The virtual SIM versus the physical SIM card provides additional levels of security that prevents possible hackers from accessing sensitive personal data contained in the SIM.

“It is more likely human compromise in terms of disclosing passwords or PIN information by the owner of the eSIM that will have to be worked on and using biometric or facial recognition technology can add an extra level of secured access to avoid cybercriminals attempting to gain entry.

“There isn’t any threat to eSIM technology. The SIM design caters to mobile wireless connectivity”, Teniola told Business Remarks.

Speaking further, Nnamani who doubles as the Demadiur Systems Limited President noted that “a standard SIM Card has an encrypted and secured link to the network operator. That connection is protected from hacking”.

However, in his words, Nnamani disclosed that “An eSIM gives users the ability to download the profile directly into their phone. This means there is a possibility a hacker can download a new profile into someone else phone and take control of it. A hacker can set up the equivalent of a virtual sim card or dual sim without the user knowing of it.

“The GSMA has proposed the use of a unique key that will seek verification through a third-party server whenever someone requests a new profile. This is referred to as Subscription Management Data Protection (SM-DP+).

“With this in place, a device that attempts to download a new profile will trigger an SM-DP+ request, which will be confirmed by an operator. Then the provisioning process will proceed as normal, as the unique code could only have originated with the device in question.

“If this is fully implemented it will keep the eSIM secure from a profiling standpoint. However as stated earlier, all devices online remain susceptible to cybercriminals.” he explained.

On its part, GSMA posited that eSIM “offers an equivalent level of security and protection to that provided by the removable SIM card.” Embedded SIMs can be programmed to request verification from an operator whenever someone tries to change the user profile. This request can only come from the device itself, but a thief with a stolen phone in hand might be able to successfully change the profile.