Nigeria's NCC Device Management System: How IMEI Registration Could Fight Crime

Nigeria is moving toward a telecommunications environment where identifying a mobile device could become almost as important as identifying the SIM card inside it.
The Nigerian Communications Commission is rolling out its Device Management System (DMS), which uses the International Mobile Equipment Identity, or IMEI, associated with SIM-enabled devices to build a central device registry.
The NCC says all SIM-enabled communication devices brought into Nigeria will eventually have to be registered before sale, while devices that aren't properly registered will not be permitted to operate on Nigerian mobile networks.

The immediate objective sounds straightforward: identify counterfeit, cloned, illegally imported and non-type-approved devices while making stolen phones easier to block.
But Nigeria's security problems make the technology much more interesting. Could knowing which physical devices are operating on Nigerian networks also help authorities investigate kidnapping, terrorism and other crimes?

Potentially, yes. But there is an equally important question: How far should that capability go before device accountability becomes mass surveillance?

Your SIM and Your Phone Are Not the Same Identity

Every phone that connects to a mobile network involves different identifiers. Your SIM identifies your subscriber relationship with the network. Your phone's IMEI identifies the physical device.
That distinction matters. Someone can remove a SIM card from a stolen phone and insert another one. The subscriber identity has changed, but the handset's IMEI normally remains associated with that physical device.

The NCC's proposed system uses this device layer. Its earlier DMS project documents explicitly identified several intended capabilities: reducing counterfeit phones, discouraging theft by making flagged devices unusable, facilitating the blocking or tracing of stolen devices, mitigating the use of stolen phones for crime and supporting national security. The document also explicitly listed reducing kidnapping among the intended benefits. That does not mean registering IMEIs magically solves kidnapping. It means investigators potentially gain another piece of information.

A Stolen Phone Could Become Much Less Valuable

This may be the most immediate benefit ordinary Nigerians notice. Today, a stolen smartphone can be resold, modified or reused with another SIM. With an effective national equipment register, a device reported stolen could have its IMEI flagged and potentially be prevented from operating across Nigerian mobile networks.
The NCC says the new framework will enable devices reported stolen to be blocked across Nigerian networks.

That changes the economics of phone theft. A thief doesn't gain much from stealing a ₦1 million smartphone if the device quickly becomes incapable of connecting to Nigerian cellular networks.
It won't eliminate theft—the device could potentially be dismantled for parts, exported or manipulated but reducing resale value removes one incentive.

The NCC already advises victims of phone theft to record their IMEI, file a police report and contact their network operator. It notes that an IMEI can potentially assist tracking depending on the circumstances in which the stolen device is subsequently used. A centralised national system could make that process considerably more systematic.

Could It Help Fight Kidnapping and Terrorism?

This is where expectations need to remain realistic. A central IMEI registry could potentially help law enforcement connect devices, SIM identities and network activity during authorised investigations. Imagine a phone associated with a criminal investigation repeatedly appearing with different SIM cards.

Changing the SIM doesn't necessarily change the handset's IMEI. That could provide investigators with another identifier to work with.
The national-security dimension isn't new. The NCC and Office of the National Security Adviser previously said fake, stolen and substandard devices created concerns around cybercrime and terrorism, and the DMS project was partly intended to respond to security concerns involving telecommunications.
The NCC's original procurement documentation similarly said the system should support the fight against cybercrime and insecurity.
For kidnapping investigations, device information could therefore become one investigative clue among many. But we should not exaggerate what an IMEI database can do.

An IMEI is an identifier, not a magic GPS tracker. Criminals can avoid conventional cellular networks, abandon devices, use multiple handsets, attempt IMEI manipulation, exploit internet-based communication or use phones belonging to innocent people. Sophisticated terrorist organisations can similarly adapt once they understand how a surveillance or identification system works.
The DMS should therefore be viewed as another tool available to the telecommunications and security ecosystem—not as a technological solution to insecurity itself.

There Is Also a Counterfeit-Phone Problem

Security isn't the only argument for the system. Nigeria has a large market for imported smartphones, including grey-market and second-hand devices.
The NCC says its current rollout is primarily an automated Type Approval compliance framework designed to ensure SIM-enabled devices imported, sold and used in Nigeria meet regulatory and technical standards. It is currently working with Customs, manufacturers, importers and market associations to onboard existing stock and authenticate future imports.
Once fully implemented, unregistered devices could be prevented from operating on Nigerian networks. That could make it harder to build a business around counterfeit or illegally imported devices.

But it also introduces commercial risks. Device manufacturers, importers and vendors have already raised concerns about implementation deadlines, registration volumes, potential costs and whether the platform can handle large numbers of IMEIs. The NCC extended an onboarding deadline for existing stock to October 6 following industry feedback.

If implementation is badly managed, legitimate phones could be incorrectly blocked or delayed at importation. Additional compliance costs could also eventually reach consumers.

Then Comes the Surveillance Question

This is where Nigeria needs to be careful. A database capable of identifying devices across telecommunications networks is powerful infrastructure.

The NCC has specifically said the DMS is designed for device identification and Type Approval compliance, that it stores device-identification information including IMEIs, and that it does not give the Commission access to the contents of people's devices or enable it to monitor personal communications. That distinction matters. Knowing that device "X" exists isn't the same as reading the WhatsApp messages stored inside device "X".

But privacy concerns don't disappear simply because message contents aren't collected. Device identifiers can still become sensitive when combined with other information.
If an IMEI can be connected with subscriber registration, network activity, location records or other datasets through separate lawful processes, the resulting information can reveal substantially more about an individual.

Nigeria already has separate regulations covering lawful interception of communications. The NCC lists the Lawful Interception of Communications Regulations 2019 among the country's telecommunications regulations.

The important policy question is therefore not merely:Can government technically identify devices?

It is: Who can access that information, for what purpose, under whose authorisation, for how long, and what happens when someone abuses it?

Nigeria Needs Security and Privacy at the Same Time

Nigeria does not have to choose between fighting crime and protecting privacy.
The Nigeria Data Protection Act already requires personal-data processing to be fair, lawful and accountable and gives individuals rights and remedies when their privacy rights are violated. Nigeria Data Protection Commission on the Data Protection Act
We recently discussed why strengthening that institution matters in Nigeria Turns a Recovered Corruption Asset Into NDPC Headquarters — Why It Matters for Data Protection and Digital Fraud.

The same safeguards become increasingly important as government databases grow. There should be clear rules governing access to DMS information, audit logs showing who queried records, defined retention periods, security standards protecting the database itself and meaningful consequences for unauthorised access.
Because a database designed to fight criminals also becomes valuable to criminals if compromised. Imagine a malicious insider, hacker or corrupt official gaining inappropriate access to a system connecting devices with identifiable individuals.

The technology intended to improve security could itself create another security risk. That is why cybersecurity has to be designed into the system rather than added after deployment.

The Bigger Question Is What Nigeria Builds Around the IMEI

Nigeria has legitimate reasons to know whether devices connecting to its telecommunications infrastructure are genuine, approved or reported stolen.

A functioning DMS could make stolen phones harder to resell, make counterfeit devices easier to identify and provide additional technical evidence during properly authorised criminal investigations.

For a country dealing with kidnapping, terrorism, cybercrime and widespread phone theft, those are meaningful opportunities. But Nigerians should resist two extremes. The first is assuming every centralised technology system is automatically government surveillance.
The second is assuming that because a system has a legitimate security purpose, unlimited collection or access should therefore be acceptable.

Both positions miss the real issue. As we argued in Data Privacy Concerns Grow as AI Continues to Advance, powerful technologies become safer when accountability grows alongside capability. The same principle applies here. A national device registry could become useful infrastructure for Nigeria.

• It could make phone theft less profitable.

• It could make illegal devices easier to remove.

• It could give investigators another trail when criminals repeatedly change SIM cards.

• And it could improve accountability across the device market.

But the DMS will ultimately be judged by more than what it can technically do. The real test will be whether Nigeria can use device identity to make criminals easier to find without making every Nigerian easier to watch.

Read more: Nigerian Court Rules on Truecaller Contacts and Data Privacy
Read more: WhatsApp Ends Android 5 Support Today, iPhone Users Are Next in November — Check If Your Phone Is Affected