EU wants identification system for users of prepaid telephone cards

The EU Member States must try to adopt a EU-wide common mechanism for identifying users of prepaid telephone cards. According to Spain, the current Presidency of the Union, such a system is necessary for combating organised crime.

Spain tabled the proposal at a meeting in the beginning of this year of the Working Party on Drug Trafficking, falling under the European Council of Justice and Home Affairs. According to Spain, 'one of the technological breakthroughs most widely used by criminal organisations' is anonymous prepaid telephone cards.

Spain points at the notorious Council Resolution of 1995 on the lawful interception of telecommunications (Enfopol-Papers), which sets out so called requirements enabling the European Member States the interception of telecommunications. 'The ministers recognises with concern that use of prepaid telephone cards under present conditions of anonymity for users prevents the implementation of the requirements and principles laid down in this Council Resolution,' states the Spanish proposal. 'The lack of regulation of anonymous prepaid telephone cards clashes with the need for law enforcement agencies to have access to telecommunications.' According to Spain most European Member States do not keep records of prepaid cards or of their users.

Spain therefore wants the European Member States to consider a 'set of harmonised regulatory requirements' for identifying users of prepaid card technology which help to 'eliminate anonymity reconcilable with commercial operators' protection of their customers' personal data'.

Spain affirms however there are difficulties in putting into practice a mechanism for identifying users of prepaid telephone cards. But Spain states that the use of prepaid cards in criminal organisations is 'so hampering investigations into organised crime' that the scope for action should at least be explored.

The Dutch government tried for several years to establish a registration system for the users of prepaid telephone cards. Each buyer of a prepaid card should identify itself and the telecom operators should keep records of the data. As the telecom providers opposed strongly to this idea, it never came through. The providers feared the costs of this plan. The operators however suggested an alternative approach: the introduction of the so-called IMSI-catcher. Since March of this year, the IMSI-catcher has been formally introduced in the Netherlands.

The IMSI-catcher is a technical tool, which enables the law enforcement agencies to trace the unique IMSI-number of prepaid telephones. The IMSI-catcher presents itself as a support transmitter of the GSM-network. All mobile telephones nearby the IMSI-catcher are forced to record themselves by this fake transmitter. The moment the mobile phones record themselves, the fake transmitter states the temporary identification number of the telephone is no longer valid. The mobile phones then record themselves automatically anew with their IMSI-number. The IMSI-catcher registrates this IMSI-number. After that, the observation team that uses the IMSI-catcher must note two locations and moments the suspect is using its telephone.

With this data it is possible to track in the records of the telecom provider which telephone number belongs to the IMSI-number of the telephone of the suspect. Now law enforcement agencies are able to intercept directly the telephone of the suspect and to analyse the traffic data of the telephone used by the suspect.

According to minutes of deliberations between the government and telecom providers, the Dutch telecom providers lost their enthusiasm for the use if the IMSI-catcher when it was formally introduced. The providers feared disturbance of their networks and possible claims of subscribers, but according to the Dutch government this risk is limited.

Another problem is the alternative way in which an IMSI-catcher can be used. The catcher can be used to disturb deliberately all telecommunications in an area, or to intercept directly communications. In the Netherlands this is only allowed in crises like hostage situations. The Dutch government and providers agreed to lock the jam and interception function of the IMSI-catcher before use. The Dutch police opposed the locking of the catcher. The police thought it was sufficient to lay down in rules in which situation the other functionalities of the catcher could be used; a technical lock was superfluous. But the Ministry of Justice insisted on the technical lock. It feared difficult discussions before court on the question whether the police did or did not secretly use the direct interception functionality of the IMSI-catcher.

The Dutch intelligence agencies are also authorised to use the IMSI-catcher, but they have more powers. Intelligence agencies can use the direct interception facility of the IMSI-catcher, and are not obliged to keep record of the use of the IMSI-catcher.