The work of Carlos Fuentes depicts scenarios in which repetition perpetuates harmful patterns; in turn, Octavio Paz called for a break with modern manifestations of repetition. The poet perceived them as expressions of a great void; put simply, modern repetitions lack soul, while mythical ones are creative.
Perhaps it is this lack of myths that somewhat blurs the Mexican telecommunications sector. Here, attempts to regulate the use of mobile lines through national registries have sought to address a recurring challenge: the use of cell phones in crimes such as extortion, kidnapping, and telephone fraud.
In this context, two initiatives emerged that marked different stages of regulation: the National Registry of Mobile Telephony Users (RENAUT) and, years later, the National Register of Mobile Telephony Users (PANAUT). Both sought to associate the user’s real identity with their mobile line, but the balance between security objectives, effectiveness, and respect for fundamental rights has been conflictive.
RENAUT was created in 2009 through a telecommunications law reform to prevent and address crimes in which cell phones were used, such as kidnapping or extortion. To register, users had to register their line data with their Unique Population Registry Code (CURP). The logic was that by linking each SIM to a real identity, criminals’ use of anonymous lines would become more difficult.
The registry failed to meet its objective, as despite the existence of RENAUT, complaints about telephone extortion continued to increase. In fact, a 26% increase in extortions was reported between December 2009 and January 2010 compared to the same period the previous year. Furthermore, the measure was easy to circumvent, and there was no strict identity verification. Since a CURP was sufficient and could be used by another person, many registrations were false.
As an example from a work of fantastic literature, in April 2010, 12,000 cell phone lines were registered in the name of the president at the time, Felipe Calderón, which evidenced the system’s vulnerability. As if that were not enough, leaks from the database emerged, along with rumors of the sale of data in clandestine markets. Faced with this, in 2011, the Senate approved its disappearance, and in 2012, the database and all associated records were destroyed.
After almost a decade, the creation of a new national registry, PANAUT, was promoted. Approved in April 2021 as a reform to the telecommunications law, this new registry defines the SIM card as a “removable smart device used in mobile equipment”. It ignores the existence of remotely reprogrammable virtual SIM cards. Unlike RENAUT, this registry included the collection of biometric data (fingerprints, face, etc.), in addition to information such as name, line activation date, address, nationality, contract type, among others. The idea was to update the mechanism with a more robust system that would supposedly be more difficult to falsify or evade. The declared objective remained the fight against telephone crimes, as well as facilitating tracking in cases of theft, fraud, extortion, or kidnapping.
Although PANAUT was approved as an improved version of RENAUT, this initiative was rejected due to criticism of its improvisation and deficient wording, which created more problems than it solved. Being perceived as a project with populist nuances, questioning its constitutionality for undermining individual security and privacy by violating human rights, and invading competencies of the defunct IFT, digital rights organizations warned that the collection of sensitive and biometric data constitutes a serious violation of the rights to privacy, intimacy, and freedom of expression.
Despite entering into force on April 16, 2021, shortly after its constitutionality was questioned. In April 2022, the Supreme Court of Justice of the Nation (SCJN) declared PANAUT unconstitutional, finding it violated the right to privacy.
As I mentioned in 2021, the creation of a mandatory and centralized registry of biometric data could lead to misuse of information, vulnerability to leaks, abuse of state power, and harm to legitimate anonymity in contexts of freedom of expression or dissent, with security risks since the biometric database is a coveted asset for hackers and no system is proof against infiltrations as demonstrated by hacks to NASA, CIA and European or Asian entities, in addition to not being aware of technological advances such as IP mobile networks (4G LTE) and voice services based on data packets leaving legal voids.
Furthermore, some experts questioned the real effectiveness of the measure: given that criminals can use SIMs from other countries, unregistered prepaid lines or resort to cloning, it has not been demonstrated that the registry really fulfills its security purpose, incentivizing a black market of SIMs for criminal purposes since criminals do not use traceable elements and the problem in prisons lies in the corruption that allows phones to enter rather than the lack of a database, supported by studies such as the “Statistical Study of the Number of Mobile Terminals and Calls from Mobile and Public Phone Booths Operating within a Sample of Prisons” that details patterns of fraudulent calls and illegal operations.
What can we learn? Both RENAUT and PANAUT offer several lessons for those seeking to regulate telecommunications for security purposes:
Mandatory registration does not guarantee security. That a SIM is nominally associated with a CURP or biometric data does not imply responsible use: fraud, cloning, the use of contraband SIMs, or registration in the name of third parties can continue to occur. RENAUT failed precisely because of these weaknesses.
Technical or administrative solutions do not replace an effective rule of law. To combat extortion or telephone fraud, it is not enough to know to whom a line is assigned: effective police investigation, control of the judicial power, detention of criminals, blocking of clandestine networks, etc., are required.
Centralizing data carries risks to privacy. Every database that contains personal or biometric information represents a target for abuse, leaks, or improper use. Even more so when the State imposes the obligation. The declaration of unconstitutionality of PANAUT reflects the tension between security and human rights.
Regulation must balance security objectives with those of civil protection. Imposing a universal biometric registry can have negative consequences on individual freedom, trust, legitimate anonymity, and even the telecommunications market.
Effectiveness vs. scalability. A system that requires strict verification, biometric collection, and state control can be complex to implement, costly, and subject to operational or coverage failures.
The lessons of RENAUT and PANAUT should guide future telecommunications regulations, ensuring effectiveness without sacrificing freedoms, uniting critics in an intellectual confrontation against measures that do not solve real problems and may even generate new ones.
In this sense, the public consultation to identify mobile lines must listen to the explanations from different industry actors so that, through consensus between mobile service providers and government authorities, an agreement can be reached on how to move forward on this issue. There are various interests in creating this type of database, from improving the security of Mexicans and ending fraudulent calls to counting active lines in the market more efficiently.
However, government authorities should consider the impact that creating this database could have on small operators, especially those in the process of obtaining their own spectrum licenses to launch mobile services. There is no doubt that these small players would have to modify their financial models, as they would face increased operating costs if the proposal for lineament identification from the Telecommunications Regulatory Commission (CRT) is approved.
According to government figures published in the Mexican newspaper El Economista, the cost of implementing the identity registration and validation system would represent a considerable financial burden, estimated at around 4,053 million pesos (equivalent to about 220 million dollars), initially borne by telecommunications operators, including both small wholesalers and retailers. It is expected that operators will eventually pass these costs on to consumers through rate increases or reductions in data package prices.
For operators with tighter profit margins than giants like Telcel or AT&T, this obligation would imply investments proportional to their operational scale in technological infrastructure, such as access and query platforms, integration with government systems such as CURP and RFC, and document verification processes, which could raise their operating costs, reducing their capacity to innovate or compete on prices.
Furthermore, considering the last spectrum schedule announced by the defunct IFT in December 2024 for the IFT-12 Tender that offered hundreds of blocks distributed in partial service areas (APS) presented the opportunity for small operators from remote and rural locations to access their own radio spectrum to offer mobile service for the first time in their existence. However, the new line registration requirements would increase the operating costs of these actors, creating entry barriers that could discourage participation in this type of auction.
Another key challenge lies in the impact on the target markets of existing and future operators, including indigenous communities and migrants, who total approximately 13 million people potentially affected by the telephony registry. Operators such as BAIT or even Movistar, which often focus on low-income, rural, or irregular migrant segments, would face higher customer acquisition costs due to barriers to registering users without internet access or valid documents, which could result in massive disconnections, loss of user base, and the need for registration campaigns in remote areas, increasing expenses in logistics and regulatory compliance.
This would not only raise costs per user, but could also generate fines for non-compliance or litigation, since the CRT proposal emphasizes the responsibility of providers in validating official identities, protecting personal data and enabling mechanisms such as portability and roaming, all of which demands resources that small operators might not absorb easily without affecting their economic viability or passing increases to vulnerable consumers, contradicting digital inclusion policies.
As seen, generating a database to identify users of mobile services is not simple, and over the years, with the arrival of new business models and technologies, it has become even more complex. It is for this reason that the CRT must consider the comments received on this topic as the beginning of a long and complex conversation that can repeat past mistakes or, positively, advance the development of the country’s telecommunications ecosystem.
Let’s not forget that the devil is in the details.
