Connect with us

Feature Articles

Tunisian government efforts to contain Covid-19 raises privacy concerns

Ranine Awwad



Tunisian government efforts to contain Covid-19 raises privacy concerns

Governments are relying on data-driven technology to help contain the Covid-19 spread. The Tunisian government has been using SIM cards for tracking purposes. Cell site location information is one of the various methods used to trace individuals. Smartphones send signals to cell towers operated by telecommunications operators. This process generates information about a citizen’s precise location. The measures implemented by the Tunisian government opens a new debate about privacy. In fact, international human rights frameworks apply to measures implemented to track and manage Covid-19 using mobile location data.

On May 18, 2020, following measures to slow down the spread, the Tunisian health minister announced a plan to utilize an application to track those infected with COVID-19. The new adopted application is called “Ihmi” or Protect was developed by a Tunisian startup company. The ministry said that this App does not invade personal data in ways that undermine the law. However, Akil Nagati, head of the Wizz Labs start-up behind the app, avowed that personal data would be archived for 14 days under the control of the National Personal Data Protection Authority and will only be used by “L’Observatoire des maladies émergentes” (ONME) for contacting people about the pandemic, according to the New Arab.

On June 14, 2020, during an interview with Altessia TV, Tunisian PM Elyes Fakhfakh indicated that monitoring citizens through their SIM card enabled the government to detect overcrowded places and the extent of commitment to the procedures. Fakhfakh confirmed the existence of an operating room working around the clock to follow the movements through mobile phone chipsets.

Fakhfakh confirmed that the authority has already approved a procedure to monitor the whereabouts of Tunisians via mobile phone SIM card during the period of comprehensive quarantine. “We do not monitor citizens and their personal data, and all monitoring activities were done in cooperation with the Personal Data Protection Authority”.

According to Mozaique Fm, Minister of Telecommunications Technologies and Digital transformation Mohamed Fadhel Kraiem said that the application used to track the extent of commitment to the quarantine “Manara” was used in conjunction with other applications. The process was done in full coordination with the Personal Data Protection Authority. Chawki Kaddas, Head of the Authority already denied knowledge of such application. “We are completely unaware of this project, despite our advice on the rest of the projects that concern personal data”, Kaddas told Mozaique Fm.

Minister of Telecommunications and Digital Transformation Mohamed Fadhel Kraiem avowed that there is an email on the subject dated April 4, 2020. This email includes a list of all the applications launched to counter Covid-19. “I suspect that there is a misunderstanding from the Personal Data Protection Authority Chairman,” said Kraiem.

The National Authority for the protection of Personal Data (INPDP) issued a notice regarding the issue on June 15, 2020. “The head of INPDP was consulted by the ministry in charge by email regarding the usage of a number of applications (Wikaya, StopCorona) including “Manara” that turns out to be the application explicitly mentioned by PM Fakhfakh” states the notice. The document issued by INPDP referred to an email sent by Kaddas on April 4, 2020, through which he evaluated the “Manara” application. Back then, Kaddas pointed out that if this procedure was used without identifying phone number owners, then it doesn’t violate the provisions related to the protection of personal data”. Kaddas emphasized that every observation of individuals while revealing their identities requires legal permission.

On June 15, 2020, the Ministry Of Communication And Digital Transformation Technologies published a notice on Facebook saying that this application relies on general data on the mobility of mobile phone use in a given area without relying on the personal data of citizens. “The Ministry confirms that is it is keen to respect the legal framework regarding the protection of personal data, in consultation with the National Authority for the Protection of Personal Data”.

The Ministry’s statement seems ironic as tracking the mobility of mobile phone usage means knowing the number’s movement. Thus, the ministry tracks a citizen’s movement, which violates their rights to privacy. In fact, Tunisia introduced mandatory SIM card registration in 2014.  Since then, mobile phone customers in Tunisia are required to present documentary evidence to prove their identity upon purchase of a SIM card.

“Governments must be transparent about the measures they are taking. Any claims that data is anonymous must be based on evidence and supported with sufficient information regarding how it has been anonymized” said Amnesty International in a joint civil society statement about State use of digital surveillance technology released on April 2, 2020.

The Tunisian constitution adopted in January 2014 contains explicit protection of the right to privacy. On March 9, 2018, the Minister of Justice Ghazi Jeribi announced that Tunisia would become the first country outside of the European Union to have a law on personal data protection. This law was approved in March 2018 and came into force on March 25, 2018.  However, there is a risk that many of these technology capabilities may become the norm of every Tunisian life in the future, as well as other countries in the world today.

Tracking applications are used as part of emergency measures but governments may retain the power of these tools for future use- tracking protestors for example. Samuel Woodhams, Top10VPN’s Digital Rights Lead, has commented on tracking tools used by the government saying that these measures will become the norm around the world. “Although some applications may appear entirely legitimate, many pose risk to citizens’ right to privacy and freedom of expression,” he told Business Insider.


Ranine joined Inside Telecom as an Investigative Journalist. Her extensive fieldwork and investigations shed light on many socio-economic issues. Over the past few years, she has transformed her key findings into in-depth analytical reports. She earned a Bachelor’s Degree in Journalism and Communication.


Ways for remote workers to stop cybercriminals

Yehia El Amine




The COVID-19 pandemic has drastically changed the way humans interact with each other across the board, handshakes have switched to fist bumps, massive conferences have gone digital in the form of webinars, and more importantly, employees have built makeshift offices within the comfort of their own homes.

According to Shefali Roy, former CCO & COO at TrueLayer, a UK-based FinTech firm, working from home has become the new norm.

“People are working longer and harder, which can be a big cause for concern with regards to employee burnout since they’re on high alert at all times due to the sudden merge of workstations and home comfort,” Roy said during a the MoneyFest 2020 webinar.

Thus, it isn’t strange for employees to start asking their employers about their work-from-home policy.

While remote working offers safety from a physical virus, it exposes employees to threatening digital viruses. Cybercriminals have taken advantage of this shift in the workplace and have targeted their sights around remote employees across the board.

According to a report published by Kaspersky there have been almost 726 million confirmed cyberattacks since the beginning of the year; “This has put 2020 on course to rack up somewhere in the region of 1.5 billion cyberattacks for the year,” the report stated.

While some companies have rejuvenated their IT security teams to deal with threats, many other companies haven’t and a big number of businesses are exposed to these breaches every day.

This leaves workers to fend for themselves against sophisticated cybercriminals’ intent on stealing their information and wreak havoc on businesses.

Fret not, according to the National Cyber Security Alliance, a U.S.-based cybersecurity non-profit, there are a number of ways that can help you protect your sensitive company information while venturing out of the digital safety of the office:

  • Think before you click. Cybercriminals are taking advantage of people seeking information on COVID-19. They are distributing malware campaigns that impersonate organizations like WHO, CDC, and other reputable sources by asking you to click on links or download outbreak maps. Slow down. Don’t click. Go directly to a reputable website to access the content.
  • Lock down your login. Create long and unique passphrases for all accounts and use multi-factor authentication (MFA) wherever possible. MFA will fortify your online accounts by enabling the strongest authentication tools available, such as biometrics or a unique one-time code sent to your phone or mobile device.
  • Connect to a secure network and use a company-issued Virtual Private Network (VPN) to access any work accounts. Home routers should be updated to the most current software and secured with a lengthy, unique passphrase. Employees should not be connecting to public Wi-Fi to access work accounts unless using a VPN.
  • Separate your network so your company devices are on their own Wi-Fi network, and your personal devices are on their own.
  • Always keep devices with you or stored in a secure location when not in use. Set auto log-out if you walk away from your computer and forget to log out.
  • Limit access to the device you use for work. Only the approved user should use the device (family and friends should not access a work-issued device).
  • Use company-approved/vetted devices and applications to collaborate and complete your tasks. Don’t substitute your preferred tools with ones that have been vetted by the company’s security team.
  • Update your software. Before connecting to your corporate network, be sure that all Internet-connected devices ‒including PCs, smartphones, and tablets ‒ are running the most current versions of software. Updates include important changes that improve the performance and security of your devices.

While employees can arm themselves with these helpful tips to fend off cyberattacks and breaches, remote workers can still educate themselves on how to spot phishing and ransomware attempts.

There are more than a handful of hints that could flag emails as suspicious or malicious, such as:

  1. Strange requests: these types of emails tend to give out information that’s out of the ordinary, maybe an unexpected request or one that isn’t directly relevant to you. The most likely case is that it’s a typical phishing email, even if the domain came from within your very own organization, call the sender and ask.
  2. Generic salutations: If someone is sending you an email and not addressing you personally, then chances are the sender doesn’t know who you are. Best-case scenario, it could be a marketing campaign, or the worst-case scenario is that you’re being targeted.
  3. Spelling errors: especially during emails, people will always double and triple check their emails for typos and spelling errors to remain professional. Thus, finding these errors are ‘phishy’ so beware!
  4. Be wary of attachments: this is exactly how cybercriminals worm their way into computers, which is why if the sender or email seems suspicious, chances are, the virus is laying in wait in the attachment.
  5. Shady URLs: hiding or spoofing links is the easiest thing to pull off, since the URL could take you to a different destination to where a link reads; although staying away from it is the best course of action, you could always hover over the link to check if the destination leads to where you expect it to.
  6. You’ve won our competition:while these traps can obviously be spotted, people are still falling for these schemes in 2020. Always remember, if it’s too good to be true, then it most likely is, so stay away.
  7. Scaremongering: A common approach used by cybercriminals is to claim something like “your account has been breached!”. This creates a sense of urgency and vulnerability and can prevent people from thinking clearly. If the claims in the email were true, would the sender really tell you in this way? Always check through a different means of communication.
  8. Change of behavior: Maybe you’ve received an email from somebody you trust such as your boss, or colleague, but the language used is different from normal. Maybe it’s too formal or informal. Maybe the email signature isn’t the normal one used. You’re probably used to the way these individuals talk to you, so if it’s not normal, something weird might be going on.

As time passes, and technologies get more and more advanced, so do cybercriminals, as they stay up to date with the technological winds of change to further find their weak points. Thus, employees who choose to stay remote have a responsibility toward their employers to remain safe online, as the damages are no longer measured on an individual level, but can take down entire organizations.

Continue Reading

Feature Articles

The importance of IoMT security across the healthcare system

Karim Hussami




In our hyper-connected world, advancing technology in IoT is bringing promise to many systems across industry sectors.

The Internet of Medical Things or IoMT which is a subset of the Internet of Things is one of the many emerging technologies that has impacted the healthcare system and our lives.

Hospitals and medical centers depend on smart devices for doctors to monitor their patients and their medical situations quickly and efficiently. In addition, these devices offer more precise analysis and earlier recognition of medical issues with the help of information flow.

According to a report published by Deloitte, “Hospitals in the U.S. have an average of 15 smart medical devices per bed, while the IoMT market is expected to reach $52 billion by 2022.”

Security risks for smart devices

IoMT, like any other technological device, is also subject to security risks such as cyberattacks. Malicious activities have increased in number in the last few years targeting medical institutions and being the cause of major disruption in the healthcare system, financial losses, which has lowered patient’s confidence in healthcare.

For example, hackers disabled computer systems at Düsseldorf University Hospital in Germany last September and led to the death of a patient while doctors attempted to transfer her to another hospital. The ransomware attack scrambles data, making computer systems inoperable.

The hospital’s President Arne Schönbohm said hackers took advantage of a well-known vulnerability in a piece of VPN (virtual private network) software developed by Citrix and warned other organizations to protect themselves from the flaw.

The need to implement robust IoMT security solutions in the medical industry has never been more important. Encryptions and conducting a secure boot – making sure that when a device is turned on, none of its configurations have been modified – are some of the basic yet fundamental security measures providers and manufacturers of IoT devices can take.

Other important security measures:

  • A defense strategy should be put in place and implemented with multiple layers of security available to protect against any risk. Make sure that authentication is properly followed, device access is limited, and device-to-device communication is monitored carefully.
  • The IoT device should be tested before it is put into production. Monitoring device security should be done throughout its life cycle to ensure fewer vulnerabilities. After the machine has been produced, security measures should be incorporated into its design such as conducting a risk assessment before the device is released for use in the market. Authentication measures should be built into the device.
  • Create an environment for teaching the culture of security, where the IT department can inform employees about issues and their dangers on the system or company they work for. In addition, conducting regular trainings to recognize vulnerabilities, cyber threats, risks and anomalies will speed up breach response.

Cyberattacks will never simply vanish. No matter the level of precautions we take, there will always be a degree of risk but making sure devices are secure and teams are vigilant and prepared, may help reduce overall disruption caused by cybercrime.

Continue Reading

Feature Articles

Taiwan: plans that will enable Fintech firms to access more customer data

Karim Hussami



Taiwan: plans that will enable Fintech firms to access more customer data

An open database of information is highly relevant for enterprises to get an idea of people’s needs and preferences which will give companies a chance to improve the quality of their products and services and help cultivate new ones.

The Joint Credit Information Center (JCIC) in Taiwan is planning to establish a database for local financial technology firms to obtain information on consumers’ credit risk information, the Financial Supervisory Commission (FSC) reported.

One of the ways in which financial service providers tend to use or deliver innovative services, is by adopting new technology. This has led Taiwan financial industry to spend over $700 million in 2017, on FinTech R&D and solutions in the areas of AI, AML, biometrics, blockchain, cloud services, cybersecurity, data analytics, payment, among other tech initiatives.

More info, better service

Taiwan’s information technology infrastructure is well-developed, with 90% 4G penetration and 80% mobile penetration, according to the International Trade Administration. “Taiwan is a strong market for e-commerce, online entertainment, mobile payment, and other technology-driven services.”

According to FSC Banking Bureau, electronic payment users exceeded eight million people in April 2020.

Respectively, information about consumers is a crucial part in company’s businesses and continuity as well as its success, that is why sharing is essential to progress.

After Fintech companies held a meeting in June 2020 with Taiwan’s Financial Supervisory Commission (FSC) Chairman Thomas Huang, suggestions circulated during the discussion noting that the center should make its data accessible to the fintech firms for the fact that the type of information it provides could help with developing various financial products or services.

As plans go ahead, the database would be launched in October 2021, according to the Banking Bureau, adding that fintech companies could also use the National Development Council’s open data service.

According to the Taipei Times, up until this time, 426 financial sector companies including local banks, securities firms, credit cooperatives, insurance providers and credit card issuers are among the businesses that have benefitted from JCIC’s raw data – currently not including Fintech enterprises.

Consumer approval before gaining access

Accessing information related to consumers is not as simple as one might think because it depends on customer approval and whether they agree to share their personal preferences online for a specific service.

Banking Bureau Chief Secretary Phil Tong said, “With consumers’ approval, the agency (JCIC) would provide their lending and repayment data to the companies, including how much money they have borrowed, what kind of loans they have taken and whether they have repaid on time.”

According to sources, the new database will not include consumers’ raw data and will follow personal data protection rules. The JCIC doesn’t share customers actual financial records.

Obviously, the new normal in business practice is for companies to obtain information about their customers, whether by their own efforts or by the help of a third party. Today, data enables growth.

Continue Reading