Expert recommendations for effective biometric SIM card verification
Jakarta (ANTARA) - Cybersecurity expert Pratama Persadha has recommended a series of technological implementation strategies for the biometric verification system for new prepaid SIM card customers, which is set to take effect in Indonesia soon, to ensure it operates effectively.
From preparing designs that prioritise privacy to implementing liveness detection mechanisms, these are some of the solutions recommended by the Chairman of the Communication and Information System Security Research Center (CISSReck).
“The most important thing is the application of the privacy by design principle from the early stages of system development. Biometric data must not be treated like ordinary customer data. The entire process of collection, transmission, storage, usage, and even data destruction must follow very high security standards,” the man, who is also a lecturer at the State Intelligence College, told ANTARA on Friday.
The state must strictly enforce the Personal Data Protection Law, particularly regarding the management of personal data, to ensure that the data used by telecommunications providers for verification is used as intended.
“Independent security audits need to be conducted periodically, including penetration testing, vulnerability assessments, cloud configuration audits, and cyber incident simulations,” said Pratama.
The implementation of the biometric verification system for new prepaid SIM card customers will begin in Indonesia on 1 July 2026 and will apply to all telecommunications providers, including XL Axiata, Telkomsel, and Indosat Ooredoo Hutchison.
Not only highlighting the role of the Government, Pratama also provided input for telecommunications providers to use robust encryption systems.
He also reminded that a liveness detection mechanism should be included in the verification systems provided by telecommunications operators.
This mechanism is essential to ensure that the face used belongs to a live human being present in person, rather than a photo, video, or deepfake manipulation.
Concluding his statement, Pratama reminded that when this system is implemented, telecommunications providers must also explain transparently how the system works.
The public needs to know what data is being collected, the purpose of the collection, and the mechanism for data deletion when the data is no longer required.
“Public trust will only be formed if technical security is accompanied by transparent and accountable data governance,” Pratama concluded.