DEV Community

RC
RC

Posted on Originally published at randomchaos.us

Mandatory ID is the breach, not the fix.

The FCC wants to require every telecom in the United States to store a government-issued identification number and physical address for essentially all phone customers. The obligation would cover new and renewing customers alike, so over time it closes over existing subscribers too, not only people buying a new line.

The practical effect is the end of the burner phone, a line that isn't tied to your identity at the point of purchase. The FCC is pitching the collection partly as a way to combat scammers. For business and foreign customers, carriers would also have to record the intended use case of bulk phone plan purchases and the customer's IP address. The agency's proposal includes a long list of other things the collected data could help authorities do.

What the rule builds is a standing identity database at every carrier: government ID numbers and home addresses, keyed to phone numbers. Under the rule, collection and retention become legal obligations, so data minimization, the one control that reliably shrinks breach impact, is off the table by design.

For anyone who runs these systems, that changes the threat model. The data you are compelled to hold is the data that can be subpoenaed, sold by an insider, scraped through a weak API, or dumped after an intrusion. A government ID number, a verified address, and a phone number together form a near-complete identity record, and the rule would place one in the account systems of every US telecom. A mandate to collect also removes the simplest answer a carrier can give to a subpoena or a government request, which is that it does not hold the data. The FCC's own filing lists other things the collected records could help authorities do.

Against that sits the anti-scam rationale. The people who lose a usable burner are privacy-conscious users, domestic abuse survivors, journalists, and many others who rely on a line not linked to their identity at the point of purchase.

Privacy advocates and civil rights activists compare the measures to those in authoritarian countries, where buying a mobile plan without surrendering your identity is difficult. Jay Stanley, senior policy analyst at the ACLU's Speech, Privacy, and Technology Project, told 404 Media: "For decades, civil libertarians have looked overseas at authoritarian countries where the government requires people to register to get a mobile phone to ensure they can be tracked. We never thought that would happen here." He added that "with this rulemaking, the government is contemplating taking away people's ability to get a burner phone, which will hurt low-income people, domestic violence victims, and anyone else who cares about their privacy."

Top comments (0)