Report reveals how NIMC policy led to data breaches, but these X influencers executed campaign to delegitimize it
By Shehu Olayinka
Following a report published by The Cable Newspaper that revealed how a circular issued by the National Identity Management Commission (NIMC) to its verification service agents exposed the private data of over 100 million to unlicensed entities and profiteers on March 18, 2024, it became the target of an online suppression campaign to delegitimize it.
A network of social media accounts on X, previously known as Twitter, broke the rules of the micro-blogging website by engaging in a chain of coordinated influence campaigns, discrediting the report.
Earlier on, an accountability platform, the Foundation for Investigative Journalism, disclosed in a report how XpressVerify.com possessed unrestricted and unfettered access to every registered Nigerian National Identification Number and confidential information.
FIJ’s report pointed out that XpressVerify unlawfully monetized both the recovery of NINs and classified information of Nigerians on Nigerian identification databases.
It stated that the standalone website has been managing and using information from the National Identity Database, and anyone can retrieve details such as phone numbers, full names, NINs, addresses, and photographs of any Nigerian whose data is on the database for as little as N200.
Meanwhile, this release of privacy has meant criticism from thousands of Nigerians at home and abroad for allowing an unlicensed website unfettered access to the confidential information of registered Nigerians.
Immediately after The Cable article was shared on X, several accounts under the report’s comment section revealed coordinated and mapped-out criticism against the report and unwavering support for NIMC’s impending inquiry.
They were also clamouring about the competency of the agency in managing Nigerians’ data.
Analysis and collation of dozens of tweets show that the campaign was ultimately aimed at targeting the publication of The Cable, which detailed how a circular issued by the NIMC under the leadership of Abisoye Coker-Odusote exposed the private data of over a million to unlicensed businesses and profiteers.
Caption: Some of the accounts that targeted The Cable report
The campaign aims to stifle The Cable story. Every account carefully conveys the same message: Nigerian data is secure with NIMC, and XpressVerify is not one of the licenced partners utilised for NIN verification.
They also refrain from using hashtags as a means of evading capture. This consistency, along with the distribution of shared content and the synchronisation of posting times, point to a purposeful influence operation aimed at influencing public opinion regarding the case.
Caption: Some X accounts shared statements released by the NIMC after FIJ published its report.
Coordinated attempts by actors to disseminate misinformation or alter the truth in order to accomplish predetermined objectives and results are known as influence operations. Influence operations aim to change the attitudes or behaviours of the target audience.
Targeting the Nigerian populace is the first step in the process. Next, an appropriate narrative or tale must be created (NIMC assures Nigerians of data security), and a network of accounts on social media, particularly influencers, is then gotten to support the narrative. NIMC’s ability to handle NIN data is its aim.
In the Nigerian online information ecosystem, influence operations are a typical strategy. A network of X (Twitter) accounts broke the rules of the social media site in January 2024 while executing what seemed to be a planned influence campaign for Erisco Foods Limited.
Nigerian food product maker Erisco Foods Limited was hit hard after a consumer, Chioma Okoli, was arrested after criticising one of the company’s goods on social media last year.
Influencers were also observed organising concerted social media efforts to improve Betta Edu’s reputation and win her back into cabinet as the suspended Minister of Humanitarian Affairs and Poverty Alleviation.
Consequently, another campaign discovered on X aimed at garnering support for NIMC’s capability in handling NIN-SIM linkage was unravelled during the investigation.
The campaign was to support the NIMC handling of the NIN-SIM linkage.Millions of Nigerian telecommunications subscribers have lamented the barring of their phone numbers by telcos after they linked their national identification numbers with the SIM card. We discovered that some of the same accounts that were part of the NIN-SIM campaign also participated in the influence activities that were directed towards The Cable.
We found the campaign had run on March 18, 2024, and more than forty uses of the #NimcNccCollaboration hashtag in posts about the topic and what NIMC is trying to achieve.
Concurrently, these accounts operate, utilising and resharing the same flyers to portray the NIMC as capable and deflect Nigerians from the problems arising from the NIN-SIM linkage.
To avoid being discovered, they alter their captions.
Jaafar Umar Abba (@JaafarUmarAbba) is one of such users who added the hashtag #NimcNccCollaboration to over 20 relating to NIN-SIM linkage.
Caption: Jaafar Umar Abba handle posting the hashtags on X
Sharing and resharing NIMC-published memos on their handles was prevalent among these actors. This, however, ranged from minutes to hours. Their posts remained consistent.
How The Cable, FIJ report unfolded
FIJ had on March 16, 2024, reported that expressVerify.com, a private website, was profiting from the data of Nigerians who had registered. Utilising the Nigerian identification database, the website made money by recovering NINs and personal data.
XpressVerify.com, according to FIJ, has been managing and using information from the National Identity Database. Anybody can retrieve details such as phone numbers, full names, NINs, addresses, and photographs of any Nigerian whose data is on the National Identity Database for as little as N200.
The Cable had done a follow-up report that exposed how a recent directive by Abisoye Coker-Odusote, the director-general and CEO of NIMC, to reinstate the NIN verification service (NVS) opened the door to unlicensed and unauthorised parties to gain unfettered access to the database of all Nigerians captured on NIN.
Several weaknesses in the NVS were found by the World Bank in 2017 during an assessment, highlighting the need for tighter audit controls, greater transparency, and personal data security.
It was found that, without NIMC’s knowledge, a licenced agent could create its own application programming interface (API) calls and offer services to sub-agents.
Violating Social Media Policy
The X handles that were involved in the campaign have broken several platform restrictions, according to our analysis of the X usage policy.
For example, the platform forbids users from exchanging or organising “exchange follows” or posting activities, such as joining “follow trains.”
Additionally, it forbids using its services “in a manner intended to engage in behaviour that manipulates or disrupts people’s experience or platform manipulation defences, or artificially amplify or suppress information.”
The policy went further to list the forms of platform manipulation to include “inauthentic engagements that attempt to make accounts or content appear more popular or active than they are.”
It also includes coordinated activity that attempts to artificially influence conversations through the use of multiple accounts, fake accounts, automation and scripting.
