Nigeria: NIMC is planning to replace ID numbers with digital tokens

Former Nigerian President Goodluck Jonathan launched a new national identity project in August 2014. The new e-ID card was billed as the “super app” of civil registers and traditional ID cards, combining digitally verifiable identification with the ability to make electronic payments and even withdraw cash from ATMs.

To cut a long story short, it failed miserably. As had a previous attempt ten years before.

After only 1.2 million cards had been issued, a court order in 2019 put a temporary halt to new card issuance. The NIMC then shifted its focus away from e-cards and toward simply issuing paper-printed National Identification Numbers (NINs). So far, the NIMC has successfully registered over 71 million Nigerian residents and citizens, accounting for approximately 35% of the population.

Nigeria’s identity management office is now implementing the next phase of its ambitious digital ID program, a virtual e-ID that anonymizes personally identifiable information used for KYC verification.

On the one hand, it is a long-overdue milestone, and on the other, it sends a message of confidence that the government is serious about digitally IDing Nigerians.

What is the significance of digital IDs?

Legal identification is essential in general. People have the right to have their government legally recognize them for social protection, financial inclusion, and migration. Identification is how people demonstrate their recognition. In theory, digital IDs simply replace paper records with ID databases that are digitally stored and accessible.

Of course, today’s digital IDs are capable of much more than just recognizing and authenticating identity claims. Some governments want them to act as go-betweens for the population and basic services.

The Aadhaar number in India is an excellent example of a widely successful digital identity project. Given the country’s enormous population, Aadhaar now covers 99 percent of Indian adults. “Because of Aadhaar, many have gained access to public services they had long been entitled to,” write K. Sudhir and Shyam Sunder, both Yale faculty members. Banks and mobile phone companies have enrolled low-income people who were previously regarded as too risky and expensive to be viable customers.”

Subsidies and food aid, which were previously diverted through “ghost” recipients, are now directed to those in need, and rural-urban migrants have access to a wide range of services that would otherwise be difficult to obtain. In Malawi, fingerprinting for credit disbursement assisted in lowering loan default rates and encouraging repayment behavior.

However, untokenised unique identifying numbers (UINs), such as Nigeria’s NIN, can expose people to privacy violations because they have a single identifying number that follows them across every database they interact with. For example, while the NIMC advises Nigerians not to share their NIN, the same NIN is one of the channels for verifying customer identity.

A digital token is that critical extra layer that prevents personally identifiable information (PII) from being recorded while also allowing a company to securely verify the user’s identity. My previous example, India’s Aadhaar, is tokenised in the same way that NIMC intends. What’s more, The Reserve Bank of India has even requested that all service providers tokenize card and card-on-file storage, but that’s a story for another day. Tokenisation, in other words, is an important component of privacy protection.

Improving data privacy

Nigeria’s National Information Technology Development Agency (NITDA) issued the Nigerian Data Protection Regulation in 2019, following in the footsteps of Europe (NDPR).

The NDPR was largely modeled after the European model, but some analysts argue that it is insufficient and lacks sufficient legal standing because it is not a law. This flaw, combined with the federal government’s abandonment of a proposed data protection bill late last year, has created a legal grey area for how data is handled in Nigeria.

Private companies, for example, may handle, store, or even sell personal data in ways that are not only unethical but also illegal. Instead of relying on the honor code illusion, a NIN token prevents this from happening.

By tokenizing the authentication process, NIMC is assisting in preventing private companies from accessing and storing personally identifiable information about users in an unethical manner.

NIMC has now instructed service providers to only verify NIN tokens, not actual NINs. Because of this KYC policy change, startups, telcos, and organizations that use NIN will need to update their onboarding processes and app interfaces in order to verify NIN tokens. According to Kasim Sodangi, National Coordinator for the Office of Nigerian Content Development in ICT at NITDA, using NIN tokens to verify user identities will be less expensive for private companies’ KYC.

What will happen now?

Users can generate NIN tokens through the NIMC mobile application or via USSD (*346*3*Your NIN*AgentCode#). Agent codes function similarly to unique merchant numbers in that they identify the service provider requesting the verification. This means that tokens generated for merchant X can only be used for that merchant and remain valid for only 72 hours.

What does this mean for providers of services?

In general, not much has changed. To authenticate users’ identities, service providers can continue to use the Bank Verification Number (BVN) or any other KYC verification channel. The only significant change affects startups that require a NIN for KYC. Such businesses will need to apply as enterprises in order to obtain unique merchant keys with which to verify virtual NINs or tokens. To access NIMC’s API, you can also use KYC verification services such as Smile Identity. NIMC also claims that using the service will be less expensive than using BVNs for KYC.

While telcos and Nigeria’s National Pension Commission (PENCOM) have begun dry runs of the new process, Usman Abiola, Principal Product Manager at Smile Identity, says they have yet to try the product and expect to get access later in February. Despite crippling trust issues and a generally poor service infrastructure, NIMC has issued over 70 million NINs. A large part of that success can be attributed to the mandated linking of NINs to individual SIM cards. Tokenisation will, of course, protect people’s personal data, but it is only a small part of the massive work required to improve data protection and enforcement in Nigeria.