The Karnataka High Court recently directed the State’s Cyber Command to examine and take steps to curb the unauthorised activation and circulation of SIM cards obtained using the Aadhaar and identification details of unsuspecting individuals [Mallikarjuna Vs State of Karnataka].

Justice Suraj Govindaraj passed the order while dismissing a plea filed by one Mallikarjuna to quash criminal proceedings intiated against him on allegtions that he possessed and attempted to sell 55 Jio and 20 Vodafone pre-activated SIM cards.

The Court has asked telecom operators to strengthen customer verification before the issue of SIMs, inventory management and oversight of authorized distributors.

“Pre-activated SIM cards, when circulated without the knowledge or consent of the persons in whose names they stand registered, may facilitate the concealment of the identity of the actual user and complicate the tracing of persons involved in unlawful activities,” the Court observed.

By its September 29 ruling, the Court directed the Director General of Police, Cyber Command, Karnataka, to assess how unauthorised SIM activation is detected, the challenges faced by investigating agencies in identifying actual users, and measures needed to prevent the misuse of identification documents belonging to unsuspecting individuals.

The case arose from a suo motu FIR registered by Bengaluru’s HAL police on September 8, 2022, following information that Mallikarjuna had allegedly used customers’ Aadhaar details and photographs to procure pre-activated SIM cards in their names but without their authorisation.

According to the prosecution, Mallikarjuna was employed as a promoter by Jio and was authorised to sell non-activated SIM cards, which customers were required to activate after completing the prescribed verification process.

The prosecution alleged that he was found in possession of 55 Jio SIM cards and 20 Vodafone SIM cards, all allegedly activated in the names of different individuals. He was accused of attempting to sell the cards to prospective purchasers at prices higher than their normal sale price.

Mallikarjuna contended that his possession of SIM cards was incidental to his employment as a Jio promoter.

The prosecution, however, placed a memo before the Court containing particulars of the individuals in whose names the recovered SIM cards had allegedly been activated.

The State argued that the activation had been carried out using Aadhaar particulars and other documents belonging to different individuals. It also pointed out that the petitioner’s employment with Jio could not explain his possession of 20 Vodafone SIM cards, as he had no employment relationship with that operator.

After considering the rival arguments, the Court held that the investigation against Mallikarjuna must continue.

The Court proceeded to flag the wider security concerns raised by unauthorised activation of SIM cards.

The Court has directed the Cyber Command to examine whether cases involving multiple SIM cards allegedly activated using third-party identification particulars indicated wider patterns requiring coordinated investigation, subject to the evidence available and applicable legal requirements.

It also directed the Cyber Command to consider issuing instructions to police authorities to ensure that credible information about unauthorised SIM activation, possession or distribution was examined promptly.

The Cyber Command was further asked to issue appropriate directions to the concerned telecom operators, including Jio and Vodafone, to review procedures governing the appointment, authorisation and supervision of promoters, distributors and other intermediaries entrusted with SIM cards.

The operators were directed to examine whether their systems adequately reconciled SIM cards supplied to intermediaries with those subsequently sold, returned, cancelled or otherwise accounted for.

Such systems should, wherever technically feasible and legally permissible, help identify unexplained discrepancies between SIM cards issued to an intermediary and those later activated or disposed of.

The Court also called for a review of internal controls to detect unusual SIM activation patterns, including repeated or suspicious activity associated with a particular intermediary, point of sale or distribution channel.

The operators were asked to review customer-verification procedures to prevent identification particulars from being used without the knowledge or authorisation of the persons concerned.

Where reliable information indicated that a SIM card might have been activated using another person’s details without authority, the operators were asked to consider appropriate remedial measures.

The Court also directed the Cyber Command to ask operators to examine whether customers had effective mechanisms to report suspected unauthorised SIM activation in their names.

The operators were further asked to consider informing affected customers about confirmed unauthorised SIM activations and facilitating corrective action, including rectification of inaccurate records and measures to prevent further misuse.

The Court called for stronger instructions and training for promoters, distributors and other authorised intermediaries engaged in the sale of SIMs, clearly setting out the limits of their authority, the prescribed procedures for transferring SIM cards to customers, and the consequences of unauthorised activation.

However, the Court stressed that these measures should not compromise the rights of employees, promoters or distributors against whom allegations had not been established.

It clarified that the directions did not authorise indiscriminate surveillance, unrestricted access to customer data or disclosure of personal information contrary to law.

Advocate T Vijay Kumar appeared for the petitioner (Mallikarjuna). High Court Government Pleader N Ranjith Kumar represented the State.

[Read Judgement]