The spate of insecurity ravaging the Northern part of Nigeria has taken another toll on the telecoms sector in Nigeria. This is as Kaduna state joins Zamfara, Sokoto and Katsina states who shut down telecoms operations in some part of their states to prevent the coordination of banditry and to help the security forces crack down escalating criminal activity and, in particular, gangs who specialize in abduction and extortion.

Zamfara State, alone had 2,177,431 active voice subscribers and 1,592,746 active internet subscribers, out of a total of 192,413,613 active voice subscribers and 144,949,194 active internet subscribers in the first quarter of 2021 who have been affected by this development. With more LGAs in Katsina and Sokoto and the entire Kaduna State, the number of subscribers affected may be very high.

It was estimated that the four big telecom operators might have lost N6.3bn after two weeks of shutting down operations in Zamfara state. While the shutdown has continued in Zamfara State, Sokoto and Katsina states have also shutdown telecoms activities in some local government areas in their states. With Kaduna joining, the telecoms operators, especially the four major ones (MTN, Globacom, Airtel, 9Mobile) would be counting big revenue losses as a result of this. Even their ongoing projects would have been stalled as they business would go on in an atmosphere of insecurity.

According to Governor Aminu Tambuwal of Sokoto State, the seven governors of the North-West had all endorsed the practice of shutting down base stations to fight insecurity, an indication that more could be shut down soon. This is an indication that any dream of an imminent revenue from the affected states by the telecoms operators may be a mirage

The NCC has inaugurated an incidence response facility, called the Center for Computer Security Incident Response (NCC-CSIRT). This is to address incidences of cybercrimes, protect telecoms infrastructure and encourage increased participation in nation’s digital economy. The centre aligns with the National Cybersecurity Policy and Strategy (NCPS) published by the Office of the National Security Adviser (ONSA), which requires each sector to establish a computer incident response team that will provide requisite services to the stakeholders and players within the sector. The NCC-CSIRT is to ensure continuous improvement of processes and communication frameworks to guarantee secure and collaborative exchange of timely information while responding to cyber threats within the telecoms sector.

According to NCC, the CSIRT’s services will commence with four main thrusts, namely; monitoring, incident management, communication, and alert and warning. It has a mandate to assist the telecoms sector in the defence and response to major cyber threats and attacks targeted at the members, provide information, technical as well as policy advisories to strengthen the defensive and response capabilities to cyber threats in the sector. The Centre will liaise with other sectoral CSIRTs as well as local and international security frameworks to protect the communications sector and the general wellbeing of the Nigerian people. The centre will also provide guidance and direction for the constituents in dealing with issues relating to the security of critical infrastructure in their possession; and to periodically assess, review and collate the threat landscape, risks, and opportunities affecting the communications sector and provide advice to relevant stakeholders.

As the internet usage increase since the COVID-19 period, there has been a rise in cyber incidents and criminal activities. The CSIRT will assist the telecoms sector with the management and coordination of cyber security incidents and threats. This will help to provide proactive steps towards building trust, and safety needed for growing the digital economy

In line with the constitution which makes 18 years as the age of consent in Nigeria, the NCC is set to enforce the contract between service providers and their subscribers. One of such is to disallow a minor or a person less than 18 years from engaging in the contract of SIM acquisition which requires a person of proper legal status to undertake. In the Reviewed/Draft Registration of Telephone Subscribers Regulations, presented on Tuesday, October 6, 2021, a subscriber is a person of 18 years and above, with a proper legal status, and matured and rational enough to bear certain responsibilities, obligations and liabilities imposed by a contract.

In order not to contravene the constitution, the NCC intends to limit SIM acquisition to those of this legal status. In the Reviewed/Draft Registration of Telephone Subscribers Regulations, the NCC defines any person below the age of 18 as minor, while a “subscriber is a person from the age of 18 years who subscribes to communications services by purchasing a subscription medium or entering into a subscription contract with a licensee.” It is therefore incumbent on parents or guardian of such people to acquire SIMs in their names for their children and wards under this age. However, they must be ready to take responsibilities for any liability that might accrue thereafter from the use of such SIM card. The policy therefore puts a significant responsibility on parents and guardians to monitor the activities of their minors.

The implication of this policy is that any person below the age of 18 is disqualified from registering and owning a SIM card in any of the network companies in Nigeria. If the policy comes in place, network operators will in the short run delete and loss the subscribers who are not of this age. The ability of them to gain back these subscribers in the long run will depend on the ability of parents and guardians to have the trust that will catalyze them to register SIMs for their adolescents. Even at that, those below the age of 18 without parents, guardians or people who can place adequate trust on them will be lost completely until they reach the legal age of contract as provided by the constitution. This may result to another round of revenue loss to the telecoms companies in Nigeria.

In an attempt to rid the nation of illegal telecoms systems, the NCC has uncovered about 1300 illegal masks and towers in the nation’s capital, Abuja. According to the Federal Capital Territory (FCT) Department of Outdoor Advertisement and Signage (DOAS), 126 of these illegal towers without documentation have been demolished, while a few others who met the requirements have been regularized. However, the DOAS have also written to the NCC to decommission those that are far from meeting the regulatory standards

This finding shows that many illegal masks and towers through which a significant number of Nigerian’s currently receive mobile connectivity, exist throughout Nigeria. There are therefore many companies, unknown to law, competing with other telecom firms in Nigeria, in an era of insecurity. While the known firms in the industry may not be exonerated from this illegal installation of masks and towers, the DOAS has mapped out strategies to raise a huge amount of money from this. In order words, there is room for the regularization of these illegal masks and towers, but such would have to come through the payment of fines. These illegal operators should therefore note and prepare to pay such fines or see such illegal masks and towers demolished.

The Nigerian communications commission (NCC) has set new mobile international rate (ITR) for voice services paid by overseas telecom carriers for terminating international calls on local networks in Nigeria at $0.045. The new rate which shall take effect from January 1, 2022, is the floor price or the minimum that can be charged for ITR services. The essence of charging this new rate in the U.S. dollars is to enable Nigerian operators to receive an increasing rate in Naira terms should there be naira devaluation. The new ITR is denominated in dollars to help the local operators. Being denominated in Naira, the existing ITR had multiple negative impacts on local operators which was further exacerbated by episodes of devaluation of naira which ultimately left Nigeria from being a net receiver with respect to international minutes to a net payer.

The new ITR floor rate makes it unlawful for any local networks in Nigeria to charge below the fixed rate. Thus, no licensee shall charge and/or receive effective rate per minute below determined ITR floor rate. Therefore, all networks in Nigeria shall therefore put into consideration all payment discounts, volume discounts and any other concession so as not to go below the fixed ITR. However, operators are free to negotiate a rate above the floor and this will be entirely left to commercial negotiation between the operators and international carriers/partners.

The NCC had engaged Messrs’ Payday Advance and Support Services Limited to undertake a cost-based study of voice MTR that is most suitable for the Nigerian telecommunications industry, given the challenges faced by the local operators as a result of the denomination of ITR in Naira. Based on different parameters as well as regulatory measures such as international experience, cost model results, the state of competition in the sector and the Nigerian macro-economic environment, in addition to the information provided by the stakeholders, the NCC arrived at the present cost-based ITR of $0.045 for voice services paid by overseas telecom carriers for terminating international calls on local networks in Nigeria.

There is a new Android malware named ‘AbstractEmu’, attacking android devices, this is reported by the Nigerian Communications Commission (NCC). If the malware gains access to smartphones, it takes complete control of infected smartphones and silently modifies device settings while simultaneously taking steps to evade detection.

This AbstractEmu is distributed via Google Play Store and third-party stores such as the Amazon Appstore and the Samsung Galaxy Store, as well as other lesser-known marketplaces like Aptoide and APKPure. So far, a total of 19 Android applications that posed as utility apps and system tools like password managers, money managers, app launchers, and data saving apps have been reported to contain the rooting functionality of the malware. The apps include All Passwords, Anti-ads Browser, Data Saver, Lite Launcher, My Phone, Night Light and Phone Plus, among others.

The rooting malware although rare, and very dangerous. It operates by using the rooting process to gain privileged access to the Android operating system, the threat actor can silently grant itself dangerous permissions or install additional malware – steps that would normally require user interaction. Elevated privileges also give the malware access to other apps' sensitive data, something not possible under normal circumstances.

Once installed in a device, it leverages one of five exploits for older Android security flaws that would allow it to gain root permissions. It also takes over the device, installs additional malware, extracts sensitive data, and transmits to a remote attack-controlled server. It can also modify the phone settings to give app ability to reset the device password, or lock the device, through device admin; draw over other windows; install other packages; access accessibility services; ignore battery optimisation; monitor notifications; capture screenshots; record device screen; disable Google Play Protect; as well as modify permissions that grant access to contacts, call logs, Short Messaging Service (SMS), Geographic Positioning System (GPS), camera, and microphone.

Although the app has been removed from the Google Play Store, the other app stores are likely distributing them. Consequently, to mitigate the risks. The NCC creates a two-fold advisory include:

• Users should be wary of installing unknown or unusual apps, and look out for different behaviours as they use their phones.
• Reset your phone to factory settings when there is suspicion of unusual behaviours in your phone.

This is the second malware reported by the NCC since October. The first was Flubot.

Similarly, the NCC also alerted of an advanced persistent threat (APT), an Iranian hacking group known as Lyceum (also known as Hexane, Siamesekitten, or Spirlin) targeting telecoms, Internet Service Providers (ISPs) and Ministries of Foreign Affairs (MFA) in Africa with upgraded malware in a recent politically motivated attacks oriented in cyberespionage. The hacking group is known to be focused on infiltrating the networks of telecoms companies and ISPs. Between July and October, 2021, Lyceum was implicated in attacks against ISPs and telecoms organisations in Israel, Morocco, Tunisia, and Saudi Arabia. Lyceum has been linked to campaigns that hit Middle Eastern oil and gas companies in the past. The APT is also responsible for a campaign against an unnamed African government's Ministry of Foreign Affairs. The group appears to have expanded its focus to the technology sector.

There are various ways through which the lyceum group could attack its target. Lyceum's initial onslaught vectors include credential stuffing and brute-force attacks. Once a victim’s system is compromised, the attackers conduct surveillance on specific targets. Lyceum will attempt to deploy two different kinds of malware: Shark and Milan (known together as James). Both malwares are backdoors. Shark, a 32-bit executable written in C# and .NET, generates a configuration file for domain name system (DNS) tunneling or Hypertext Transfer Protocol (HTTP) C2 communications. Milan is a 32-bit Remote Access Trojan (RAT) that retrieves data. These two malwares are able to communicate with the group’s command-and-control (C2) servers. The APT maintains a C2 server network that connects to the group's backdoors, consisting of over 20 domains, including six that were previously not associated with the threat actors.

The malwares usually target individual accounts at companies of interest, once these accounts are breached, they are used as a springboard to launch spear-phishing attacks against high-profile executives in an organization. The suggests that not only do these attackers seek out data on subscribers and connected third-party companies, but once compromised, threat actors or their sponsors can also use these industries to surveil individuals of interest.

There are however ways to guard against this kind of threats. The NCC therefore re-echo ngCERT reports that multiple layers of security in addition to constant network monitoring is required by telecom companies and ISPs alike to stave off potential attacks.

Specifically, telecom consumers and the general public are advised to:

• Ensure the consistent use of firewalls (software, hardware and cloud firewalls).
• Enable a Web Application Firewall to help detect and prevent attacks coming from web applications by inspecting HTTP traffic.
• Install Up-to-date antivirus programmes to help detect and prevent a wide range of malware, trojans, and viruses, which APT hackers will use to exploit your system.
• Implement the use of Intrusion Prevention Systems that monitors your network.
• Create a secure sandboxing environment that allows you to open and run untrusted programs or codes without risking harm to your operating system.
• Ensure the use of virtual private network (VPN) to prevent an easy opportunity for APT hackers to gain initial access to your company’s network.
• Enable spam and malware protection for your email applications, and educate your employees on how to identify potentially malicious emails.

Another approval has been granted to Airtel Nigeria by the Central Bank of Nigeria (CBN) to operate as a super-agent Network in Nigeria. The super-agent licence, allows Airtel to create an agent network that could service the customers of licenced Nigerian banks, Payment Service Banks (PSB) and licenced mobile money operators in Nigeria. This licence is different from the PSBs licence in which approval-in-principle was granted to Airtel and MTN on the 4^th of November to float) to launch SMARTCASH and MoMo Payment Service Banks Limited, respectively. The PSBs licence is the right  to provide financial services such as accepting cash deposits and carrying out payments and remittances, issuing debit and prepaid cards, operating electronic wallet and rendering other financial services to the consumers in Nigeria. MTN Nigeria, was the first telecoms firm to obtain a super-agent licence in 2019.

Just like in the case of the PSBs, the approval-in-principle means that Airtel will have to fulfil the minimum requirements for a super-agent within a stipulated period before a full licence is granted to them. According to the CBN, a Super-Agent shall be licensed under the following requirements:

• Must be a company with an existing business, operational for at least 12 months.
• Must be registered with the Corporate Affairs Commission (CAC).
• Must have a minimum Shareholders’ Fund, unimpaired by losses of N50million.
• Must obtain a reference letter from a Financial Institution (FI) as part of its documentation for licence.
• Must have a minimum of 50 agents.

The Super-agents shall undertake the following responsibilities:

• Be responsible for monitoring and supervising the activities of the agents.
• Have information on the volume and value of transactions carried out for each type of service by each agent (which should be made available to the principal).
• Monitor effective compliance with set limits and establish other prudential measures in each case.
• Take all other measures, including onsite visits, to ensure that agents operate strictly within the requirements of the law, guidelines and the contract.
• Notwithstanding the responsibility by the S-A to monitor and supervise their agents, the CBN may at any time request for any information or carry out inspection as it deems necessary.

These licenses will help to diversify the revenue sources of Airtel and others granted them licences and will help boost Nigeria’s financial inclusion drive. It will attract greater competition in Nigeria’s financial services space and as such will help lower the cost of financial services and offer a diverse range of financial products in coming periods ahead.

Sequel to appeals by the Mobile Network Operators and other industry stakeholders, soliciting for a further extension, the Federal Government through the NCC has extended the deadline for the National Identity Number (NIN)-Subscriber Identity Module (SIM) data verification exercise till the 31^st of December, 2021. The extension is to ensure better compliance with government’s directive provide the enabling environment for the registration of Nigerians in remote areas, diaspora, schools, hospitals, worship centres, as well as foreigners, diplomatic missions, those in other areas that were hitherto unreachable, and increase enrolments in countries with a significant number of Nigerians. This will avoid widening the digital divide.

The review of the progress of the exercise indicated that over 66 million unique National Identity Numbers (NIN) have been issued- an indication of progress achieved in the ongoing NIN-SIM linkage. However, a significant part of the populace is yet to be registered into the National Identity Database (NIDB), which may be due to some challenges which the Federal Government has looked into and has made efforts to alleviate, hence the need to extend the deadline.

As of October 30, 2021, over 9,500 enrolment systems and over 8,000 NIN enrolment centres within and outside the country has carried out 66 million NIN enrolments, with an average of 3 to 4 SIMs linked to the NIN. The Federal Government has pledged to allow all innocent, law abiding citizens and residents will not lose access to their phone lines as long as they obtain and link their NIN. To this end, the NCC has created additional NIN enrolment centres within and outside the country, and many more coming up. This will ensure that the remaining citizens and legal residents living in the country and the diaspora are able to obtain their NINs and link them with their SIMs before the end of the year.

The NIN-SIM verification process is geared towards supporting the Government’s drive to develop Nigeria’s digital economy, strengthen the ability of government to protect the cyberspace and support the security agencies.

The Nigerian Communications Commission (NCC) is adjusting regulatory instruments and management tools to ensure regulations are fit for future imperatives of a robust telecoms sector. Among the adjustments is our ongoing review of the Telephone Subscriber Registration Regulations, meant to strengthen the framework for digital identity. The Spectrum Trading Guidelines is also being reviewed to ensure more efficient use of spectrum. The NCC is laying institutional foundations through co-operation with other regulatory institutions and international organisations such as the International Telecommunications Union (ITU). The Commission is also developing and adapting governance frameworks to enable the development of agile and future-proof regulation as well as equally adapting regulatory enforcement activities to the “new normal”, imposed by the COVID-19. All these adjustments to regulatory instruments and management tools are to ensure alignment with the rapid technological changes and innovations that are emerging at a high speed and with sophistication and therefore fit for future imperatives of a robust telecoms sector

The NCC is tackling illegal and harmful content on over-the-top (OTT) platforms. It had to opt for "a middle ground that promotes safe use of digital service platforms without necessarily stifling the exercise of the citizen’s right to free expression as guaranteed in the Nigerian Constitution.” The NCC censors technology platforms in three scenarios, namely, restriction of person-to-person communications; restriction of Internet access generally; or restriction of access to specific content, which governments find objectionable.

Broadband Penetration and Data Subscription, September 2021

The national broadband subscription and penetration for the month of September, the end of the third quarter of the year is 76,365,158 and 40.01% respectively. This showed an insignificant increase over 76,289,063 subscribers recorded at the end of the second quarter of 2021, and 0.04 basis points over 39.97% penetration at the end of the same period. However, when compared to the immediate past month, the broadband penetration fell short of the 78,255,250 subscription and 41% penetration recorded in August by about 2.5% and over 100 basis points, respectively. This shows that the broadband subs cription and penetration in Nigeria is growing at a decreasing rate. This rate of growth is not encouraging given the Nigerian National Broadband Plan 2020-2025, which targets at least 90 per cent of the population and penetration rate of 70 per cent, and may jeopardise the efforts of the government to deliver data download speeds of about 25Mbps and 10Mbps to people in urban and rural areas, respectively by 2025.

Part of the reason attributed to this is the Federal Government’s policy of linking the National Identification Number (NIN) to SIM cards which started since December 2020. The government has just extended this policy for the sixth time, to the end of 2021, this might further dampen efforts at increasing broadband subscription and penetration. So far, about over 66 million Nigerians have been captured under NIN registration, each having an average of three to four SIMs, some of which are inactive. This is far behind over 210 million people in Nigeria. This big gaps amidst the decreasing growth in broadband penetration suggests that it might be very difficult to achieve the elaborate plan of at least 90 per cent of the population and 70% penetration by 2025.

Internet Data Subscription, September, 2021

There is also minimal increase in the number of active internet data subscription in the month of September, 2021. With a total of 139,922,679, the number of internet data subscribers surpassed that of August with 52,632 or 0.04% subscribers, and June, the end of the second quarter by 107,766 or 0.08% subscribers (see figure 1, below).

Analysed according to the subscribers on each of the licensed service providers utilizing the GSM, the data shows that, MTN got about 41.7%, 0.2% less than 41.9% it recorded in August and 0.9% less than its share of 42.6% at the end of June, the end of the second quarter on 2021. With a share of 27.8% in September, Globacom gained 0.2 more than its share in August and 0.7% more than its 27.1% second quarter share. 9Mobile lost 0.1% and 0.2% of its August and June shares of 4.3% and 4.4%, respectively. Airtel maintained its 26.2% share in august, with a 0.1% gain over June data subscription.

The data shows that while Globacom increased its number of data subscribers by 0.2%, MTN lost that same percentage of its data subscribers. 9Mobile’s data subscribers reduced by 0.1% while Airtel’s remained the same. In other words, only Globacom made an inroad into data subscriptions in September, 2021.