Notes on Internet Privacy

Posts and research from the URnetwork team and community.

RSS

Two hauliers described a voice. A ledger named Amr Emara.

On 30 May 2024, police at a Suez checkpoint found hashish in two truckloads of onions. The drivers said an unknown man had phoned them to coordinate the route. Investigators traced the number to a mobile operator's registration ledger, found a computer-science student's name, and a court sentenced him to life. On 10 August 2026, according to reporting the regulator has not confirmed, Egypt's telecom regulator referred all four mobile operators to the Public Prosecution over lines registered in citizens' names without their knowledge — and announced that the fix is a face scan.

The drivers did not know who owned the drugs. Questioned after the seizure at the Suez checkpoint, they said they were hauliers, that a man had been phoning them to coordinate the route, and that they knew neither his name nor his face.

So investigators did the obvious thing. They took that number and looked it up.

The number came back registered to Amr Abdel-Hakam Emara, then a computer-science undergraduate in Abu Kabir. He was tried in absentia and sentenced to life imprisonment — «السجن المؤبد», which Article 14 of Egypt's Penal Code defines as detention «مدة حياته», for the duration of his life. Egyptian headlines call it "25 years"; this desk's own brief did too.

The life sentence rests on counsel's statement and his sister's account; no judgment has been seen. Dr Kamal Shaib names the Assiut Military Felonies Court, case 172 of 2024, and the paper that interviewed his sister files the case as «جنايات السويس», Suez felonies — a discrepancy no document reconciles.

Nobody told him. The judgment sat unserved for more than eighteen months while he attended lectures and sat examinations, until two court bailiffs came to his family's door asking where Amr was.

He turned himself in. At the retrial, on 17 June 2026, the court imposed the same sentence. On or about 4 August, his family was told it had been ratified — the step that makes the judgment executable. He is twenty.

Ten lines, one signature, one afternoon

Here is what put him there, as his sister Yasmin told Al-Masry Al-Youm. A friend asked to borrow his national ID card. The friend's sister sold mobile lines at a company branch and needed one more line to hit the sales target that kept her in her job — «التارجت», the target.

Emara went to the branch with him, handed over his card, and signed what he understood to be a contract for one SIM. Ten lines were opened in his name that day, his sister says. They were activated and sold on. NTRA, Egypt's telecom regulator, allows an Egyptian ten voice lines per operator: the fraud was exactly the size of the rule.

That is the family's account. The prosecution's is the ledger: the number was registered in his name, and that is what identified him.

On 7 August 2026, three days before the referral, NTRA's spokesman Mohamed Ibrahim went on the Extra News channel and explained the arrangement. Lines pass between people over the years «دون علم المالك الأصلي» — without the original owner's knowledge — «وهو ما قد يعرضه للمساءلة القانونية باعتباره المتعاقد على الخط»: which may expose him to legal liability as the party who signed for the line.

That is Amr Emara's conviction, described by his regulator as the system working, and the citizen's job to police.

"Legal responsibility is personal"

The same day, NTRA published a statement on its own website. Its second paragraph is the most interesting sentence any Egyptian institution has produced this month:

«يُطمئِن الجهاز المواطنين إلى أن مجرد تسجيل خط هاتف محمول باسم شخص لا يرتب بذاته مسؤوليته عن الأفعال التي تتم باستخدامه… فالمسؤولية القانونية شخصية، ولا تُنسب الأفعال إلى غير مرتكبها.»

The mere registration of a line in a person's name does not by itself make him responsible for what is done with it. Legal responsibility is personal.

Then the clause that gives it away: «دون إخلال باختصاص جهات التحقيق والقضاء في تقدير الأدلة» — without prejudice to the jurisdiction of the investigating and judicial authorities in assessing evidence. The regulator says the register is not proof. It also says the question is not its to decide. About three days earlier, a court's answer had become final.

The answer is a better register

On 10 August 2026, NTRA referred all four of the country's mobile operators to the Public Prosecution: Orange Egypt, Vodafone Egypt, e& Egypt and Telecom Egypt's WE. It closed the corporate bulk-registration channel. It ordered operators to text the older lines on those corporate systems, telling whoever holds them to attend a branch, re-contract in their own name, or lose it. And it told them to accelerate facial biometrics — «بصمة الوجه», the face print — for buying a line and for reading your own register entry. As at 11 August the referral is known only from reporting; NTRA has not published it.

A mandatory identity register produced a life sentence for a man whose only act was signing a form at a branch. The state's answer is to make the register harder to fool.

Nobody in Egypt is proposing that the register stop being the thing a court believes.

The rules already said all of this

Two pages deeper on the same website sit rules NTRA has published for years. The corporate ones require operators to register every new corporate SIM «ببيانات المستخدمين الفعليين للشرائح» — with the data of the lines' actual users — and forbid activating a SIM «الا بعد اخذ صورة ضوئية ملونة من الرقم القومي الساري للمستخدم الفعلي» — without first taking a colour copy of the actual user's valid national ID.

That is the emergency package of 10 August 2026, and it was already the rule.

The individual rules are stricter, and Emara complied with every one: «يستلزم التعاقد على شريحة التليفون المحمول تواجد العميل شخصياً» — contracting for a SIM requires the customer to be present in person.

He was present in person. That is how it happened.

A number you are not allowed to read

Emara's case sent Egyptians to «أرقامي» — Arqami, "my numbers" — the service in NTRA's app that lists the lines against your national ID. Souad Mohamed found ten, at an operator she says she has never used. Mohamed Saudi found five.

NTRA had recently switched Arqami off, the spokesman explained, because anyone could look up the lines against a national ID using only that ID number. It came back with a patch: the app now shows only part of each number.

Saudi, who screenshotted his five in full before the outage, can no longer read them. The patch took the register away from the person whose name is in it.

The published way out is a form. Attend a point of sale, hand the employee your original ID, and have them stamp an «استمارة عدم حيازة الخط» — a non-possession-of-line form. The remedy for a line issued by a point-of-sale employee against your ID is a form filled in by a point-of-sale employee against your ID.

What is not established

NTRA's statements never mention Amr Emara — not the 7 August reassurance, not the 10 August referral. The desk looked and did not find a link. What it found is about six days between a life sentence becoming final and four operators being sent to prosecutors, with a wave of complaints in between. Adjacent in time; not proven causal.

What the desk does not have: any law number in the referral, which cites only «أحكام القانون»; a length for the grace period, which is only «المهلة المحددة»; the judgment itself, only counsel's statement of its docket and a sister's account of the hearing; and in Iraq, any count of the citizens whose names were used. NTRA published its reassurance; it has not published its enforcement.

The same failure, in Iraq, on the same day — 10 August

In Baghdad that evening, Baligh Abu Kalal, head of the executive apparatus of Iraq's Communications and Media Commission, stopped SIM sales through agents and points of sale across the Kurdistan Region, confining them to licensed operators' main branches until «آليات التوثيق الإلكتروني والتحقق الأمني» — mechanisms of electronic authentication and security verification — are in place.

His stated reason is the story: the Commission had observed «شكاوى ومؤشرات تتعلق بتسجيل شرائح اتصال بأسماء مواطنين من دون علمهم أو موافقتهم» — complaints and indicators concerning the registration of SIM cards in citizens' names without their knowledge or consent. The measure exists, he said, to prevent «التزوير وانتحال الهوية» — forgery and identity impersonation — and the replacement is being built with the licensed companies and «الأجهزة الأمنية», the security agencies. Across the Commission's entire published record, «انتحال الهوية» appears exactly once: in this order.

Two tracks share one timeline. Amr Emara's life sentence became final on or about 4 August 2026; about six days later, Egypt's reported referral and Iraq's published order landed the same day. Ten lines opened on one signature filled the ten-line voice cap exactly. Adjacency is not cause.
Two tracks share one timeline. Amr Emara's life sentence became final on or about 4 August 2026; about six days later, Egypt's reported referral and Iraq's published order landed the same day. Ten lines opened on one signature filled the ten-line voice cap exactly. Adjacency is not cause.

The case for the face print, made properly

Ahmed Badawi, who chairs the communications committee of Egypt's House of Representatives, put the history on television. Between 1997 and 2018, he said, dealers were handed three or four hundred lines apiece to sell against the operators' targets. Tens of thousands of lines went out that way. The channel was the leak; closing it is the direct fix; and a live face check at the counter defeats the trick used on Emara — a borrowed card and one signature. His claim, as at 11 August, is that in a month the face print «سيقضي على استخدام أي خط هاتف بغير اسم صاحبه الحقيقي» — will end the use of any line not in its true owner's name.

That is a serious argument. It is also not an answer to Amr Emara, because nothing in either country's package touches the step that convicted him: a number in a ledger, read as a person.

Badawi announced that Egypt would stop its agents and distributors and sell lines only through operators' official branches. Forty-eight hours later, in the Kurdistan Region, Iraq's Commission ordered the same thing.

Two states. One failure. The same remedy, with no contact between them — a legislator's announcement, then a regulator's regional order. Searching in Arabic and English on 11 August, we found no outlet in either language that has printed them together.

That is not a coincidence about Egypt and Iraq. It is what this design does.

References (5 sources)

References

All retrievals 11 August 2026 unless stated. Arabic translations are the desk's own; Arabic is quoted verbatim, including each source's own spelling and grammar as published.

Primary — the regulators, in their own words

  • https://www.tra.gov.eg/ar/بيان-صادر-عن-الجهاز-القومي-لتنظيم-الات/ — National Telecom Regulatory Authority

(Egypt), «بيان صادر عن الجهاز القومي لتنظيم الاتصالات بشأن ما أثير حول وجود خطوط هاتف محمول مسجلة بأسماء بعض المواطنين دون علمهم» — 7 August 2026. HTTP 200, 49,911 bytes. Source of «فالمسؤولية القانونية شخصية» and of the four WhatsApp reporting numbers.

  • https://www.tra.gov.eg/ar/المركز-الإعلامي/البيانات-الصحفية — NTRA press releases. HTTP 200, 50,953 bytes.

Newest item is 7 August 2026; the 1 February 2026 spectrum-auction item is second. Dates render in Eastern Arabic numerals («٧ أغسطس ٢٠٢٦»), which is the likely reason an earlier sweep recorded February as the newest entry. The desk's inherited claim that NTRA "published nothing" does not survive this probe and is corrected in the text.

  • https://www.tra.gov.eg/ar/تنظيم-شرائح-أفراد/ — NTRA, «القواعد التنظيمية لبيع شرائح التليفون المحمول

للأفراد». HTTP 200, 48,835 bytes. Undated. Source of the in-person requirement and of the cap: «بحد اقصى 10 خطوط صوتية و5 خطوط بيانات من شركة محمول».

  • https://www.tra.gov.eg/ar/تنظيم-شرائح-شركات/ — NTRA, «القواعد التنظيمية لبيع شرائح التليفون المحمول

للشركات». HTTP 200, 47,493 bytes. Undated. Requires registration to «المستخدمين الفعليين» and forbids activation without the actual user's colour ID copy — i.e. the substance of the 10 August package.

  • https://www.tra.gov.eg/wp-json/wp/v2/postsHTTP 401, 131 bytes,

{"code":"rest_cannot_access","message":"DRA: Only authenticated users can access the REST API."}. The REST API is deliberately closed; this is a refusal, not an absence.

  • https://www.tra.gov.eg/page-sitemap.xml — HTTP 200, 124 URLs, pagination exhausted. Sorted by

lastmod, the only page touched on 10 August 2026 is the cyber-certified-companies list (2026-08-10T05:25:41+00:00). This is the bound on "NTRA has not published the referral."

  • https://cmc.iq/wp-json/wp/v2/posts/21012 — Communications and Media Commission (Iraq), «أبو كلل يصدر

أمراً فورياً بإيقاف مبيعات شرائح الهاتف النقال عبر الوكلاء في إقليم كردستان لحين استكمال التوثيق الإلكتروني» — date 2026-08-10T20:04:09, date_gmt 17:04:09, modified 2026-08-10T21:06:27. HTTP 200, 11,590 bytes. No order number, no statute, no end date.

  • https://cmc.iq/wp-json/wp/v2/search?search=<term>&per_page=100 — all HTTP 200,

every response x-wp-totalpages: 1, so no set is truncated: انتحال الهوية → x-wp-total: 1; تسجيل الشرائح → 2; التوثيق الإلكتروني → 2; نقاط البيع → 2; كردستان → 12; شرائح → 35.

Secondary — the case

  • https://www.vetogate.com/5682240 — Veto, by Sameh El-Maghazi — 26 June 2026, 19:43. HTTP 200 with a

Chrome UA. Carries counsel's own statement: محكمة جنايات أسيوط العسكرية، القضية رقم 172 لسنة 2024, «السجن المؤبد» on عمرو عبدالحكم عمارة, and counsel د. كمال شعيب.

  • https://www.almasryalyoum.com/news/details/4296126 — Al-Masry Al-Youm, by Mohamed El-Qammash —

18 June 2026, 15:09. HTTP 200, 351,430 bytes. Interview with the sister, Yasmin: offence date 30 May 2024, the Suez checkpoint, two onion trucks bound for Ismailia, hashish, the traced number found «مسجل رسميًا فى دفاتر شركة الاتصالات» — registered officially in the telecom company's books — the sentence upheld 17 June 2026, and the ten lines opened on one signature. The paper tags the case «جنايات السويس» — Suez felonies — which does not obviously reconcile with counsel's Assiut military court; the discrepancy is stated in the text rather than resolved.

  • https://www.dostor.org/5603036 — Al-Dostor, by Sara El-Wardani — 18 June 2026, 04:12. HTTP 200,

108,436 bytes. Sharqia; the friend «إبراهيم ع. ش»; the sales target; more than one line on one card.

  • https://www.l2tat.com/أخبار-الحوادث/بسبب-شريحة-هاتف-التصديق-على-حكم-المؤبد — Laqtat, by Yasmin Sharaf —

4 August 2026. HTTP 200, 282,586 bytes. Ratification of the life sentence, sourced to the sister's Facebook post. The case's media name is «التارجت».

  • https://www.aldhshan.com/2026/06/blog-post_385.html — «شرح المادة ١٤ من قانون العقوبات المصري» —

16 June 2026. HTTP 200, 519,032 bytes. Article 14 verbatim: «مدة حياته إذا كانت العقوبة مؤبدة». Egyptian legal commentary treats "25 years" as a misnomer; conditional release for a life sentence is possible after twenty years under art. 52 of Law 396/1956 as amended by Law 152/2001, at discretion.

Secondary — the response

  • https://www.masrawy.com/news/news_economy/details/2026/8/10/3030856/ — Masrawy, by Aya Mohamed —

10 August 2026, 16:40, edited 16:45. HTTP 200, 252,879 bytes. The referral statement at length, including «كافة الخطوط القديمة المسجلة على أنظمة الشركات» — the corporate-systems scope, which is narrower than "every line in Egypt" — and «خلال المهلة المحددة», the unstated grace period. This reporting, not an NTRA publication, is the source for the referral.

  • https://www.masrawy.com/news/news_economy/details/2026/8/7/3029439/ — Masrawy, by Aya Mohamed —

7 August 2026, 16:38. HTTP 200, 248,848 bytes. NTRA spokesman Mohamed Ibrahim on Extra News: the ten-line cap, «المسؤولية القانونية تظل على صاحب التعاقد الأصلي», and why «أرقامي» was suspended — anyone could read the lines against a national ID «باستخدام الرقم القومي فقط».

  • https://www.masrawy.com/news/news_economy/details/2026/8/10/3030858/ — Masrawy, by Aya Mohamed —

10 August 2026, 16:43. HTTP 200, 257,293 bytes. Malak Saif El-Din (14 lines), Souad Mohamed (10), Mohamed Saudi (5), Abeer Ahmed; the masked digits; the «استمارة عدم حيازة الخط» procedure.

  • https://www.shorouknews.com/news/view.aspx?cdate=08082026&id=3f02fa0e-063e-4fed-a16e-40858cabc871

Shorouk News, by Mohamed Shaaban — 8 August 2026, 22:05, updated 22:06. HTTP 200, 109,780 bytes. Ahmed Badawi: stop the agents and distributors; sell only through official branches; 1997–2018, Abdel Aziz Street, 300–400 lines per dealer, «عشرات الآلاف من الخطوط»; and blocking from 9 August of «أي خطوط يثبت تشغيلها بغير أسمائها الحقيقية».

  • https://www.maspero.eg/press-center/2026/08/09/978714/ — Maspero / National Media Authority, by Medhat

Abdel-Aleem — 9 August 2026, 01:24. HTTP 200, 179,472 bytes. The "within a month" timetable is Badawi's, not NTRA's; also the national «حصر» of registered numbers, and the cases of Egyptians working abroad and of the dead, referred to a meeting chaired by NTRA chief executive Mohamed Shamroukh.

  • https://www.egyptindependent.com/egypts-ntra-addresses-reports-of-identity-fraud-with-mobile-ids/Egypt

Independent — 8 August 2026. Checked directly for any mention of Emara, the "Target" case or the verdict: none, and no law number.

  • https://almadapaper.net/447838/ — Al-Mada (Baghdad) — 10 August 2026, 20:12. HTTP 200, 146,091 bytes.

Received the CMC statement directly. Every Iraqi report found reproduces it and adds nothing: no complaint count, no named citizen, no dealer count. Also carried by INA (https://ina.iq/ar/local/270537-.html), Al-Rasheed and Shafaqna.

  • https://research.lawlab.africa/egypt/ — Law Lab Africa, Egypt dossier, "updated 1 August 2026". HTTP 200,

52,661 bytes. Personal Data Protection Law No. 151 of 2020; Executive Regulations by Prime Ministerial Decree No. 816 of 1 November 2025, in force 2 November 2025; compliance deadline 1 November 2026; Personal Data Protection Center established 2025; status "Law in force, enforcement not found", "No decisions published". Baker McKenzie's January 2026 alert (https://www.bakermckenzie.com/en/insight/publications/2026/01/egypt-important-data-protection-update) attributes decree 816 to the Minister of Telecommunications and dates it to December 2025; the discrepancy is recorded and no argument rests on the issuer.

The bound on the pairing. Five Arabic and three English searches, 11 August 2026, on the case, the docket, the sentence, the two regulators' measures, the biometric timetable and the pairing itself. No outlet in either language printed Egypt and Iraq together; the English search for the Iraqi order returns the Korek shutdown instead. An absence found by search is a weak negative and is claimed as no more than that.

Probes that failed, with the exact failure mode

  • https://www.alwafd.news/5897325HTTP 403, 5,725-byte Cloudflare "Just a moment…" interstitial to

both WebFetch and curl with a Chrome UA. The article exists; this is not a 404.

  • https://www.alarabiya.net/arab-and-world/egypt/2026/08/07/…HTTP 403 with a 179,381-byte bilingual

"ACCESS DENIED" page.

  • https://gate.ahram.org.eg/daily/News/205280/107/986569/…HTTP 403, 6,930 bytes. The Ahram network

refuses this desk on its Arabic gate as well as its English site.

  • https://masaar.net/ar/egypt_laws/قانون-العقوبات/HTTP 403, 6,067 bytes.
  • https://www.tamimi.com/law_update_articles/from-policy-to-practice-…/HTTP 307 redirect to itself,

no body. https://www.kennedyslaw.com/…/egypt-s-personal-data-protection-law-…/HTTP 403.

  • https://www.parlmany.com/News/2/576307/HTTP 404, 1,925 bytes, on the truncated slug. The headline

«"المؤبد مش 25 سنة"…» is cited from the search index only, as a title, and nothing rests on it.

  • A guessed Masrawy article id returned HTTP 200 for a different article (dollar exchange rates, id

3030871). A 200 is not evidence you fetched what you asked for; the correct id was found by search.

Further Discussion

The register convicted him, and the fix is more register

**A ledger entry did the work a witness could not.** Amr Abdel-Hakam Emara, twenty, a computer-science undergraduate in Abu Kabir, was sentenced to «السجن المؤبد» — which Article 14 of Egypt's Penal Code defines as detention «مدة حياته», for the duration of his life. Two hauliers stopped with hashish in truckloads of onions told investigators that a man had phoned them to coordinate the route and that they knew neither his name nor his face. Investigators traced the number. It came back registered to Emara, and that is what identified him. He was convicted in absentia; on retrial on 17 June 2026 the court imposed the same sentence. The sentence and the docket come from his counsel and his sister; no judgment has been seen. **The regulator disclaims the inference and disclaims the power to stop it, in the same paragraph.** On 7 August 2026, about three days after that inference had been ratified as final against Emara, Egypt's NTRA published that «فالمسؤولية القانونية شخصية، ولا تُنسب الأفعال إلى غير مرتكبها» — legal responsibility is personal, and acts are not attributed to anyone but the person who committed them — and that merely registering a line in a person's name does not by itself make him responsible for what is done with it. Then, in the next clause: «دون إخلال باختصاص جهات التحقيق والقضاء في تقدير الأدلة» — without prejudice to the jurisdiction of the investigating and judicial authorities in assessing evidence. The body that runs the register says the register is not proof, and says the question is not its to decide. A reassurance about how evidence ought to be weighed, from an institution that says weighing evidence is not its business, is a press release, not a control. **And the emergency rule was already the rule.** NTRA's own published corporate-SIM rules required registration to «المستخدمين الفعليين», the actual users, and forbade activating a SIM without a colour copy of the actual user's valid national ID. The 10 August package mostly re-issues that, closes the corporate bulk-registration channel, and adds one genuinely new thing: «بصمة الوجه», a face print, as the load-bearing check. So the answer to a register that convicted the wrong man is a register that is harder to fool. Nobody in Egypt is proposing the other change — that the register stop being the thing a court believes. Harden the enrolment and the ledger entry becomes *more* persuasive to the next court, on the same evidentiary step that nothing in the package touches.

The register did not convict him; an investigator's inference did, and the answer is a better register

**The fraud happened inside the rule, which is why a document check cannot catch it.** On his sister's account, a branch employee opened ten lines on one signature in a single day. That is not a breach of NTRA's cap; it is what the published cap permits — ten voice and five data lines per person per operator. Emara attended in person and handed over his own valid national ID, which is every control the paperwork asks for. A borrowed card plus one signature defeats every document check ever designed. It does not defeat a live face at the counter. If you want the specific fraud that destroyed this man's life to be impossible, a biometric bind at the point of sale is the one control that does it, and no amount of disapproval of registers supplies a substitute. **The leak was the channel, not the check.** Ahmed Badawi, who chairs the communications committee of Egypt's House of Representatives, put it on television: between 1997 and 2018, dealers in a Cairo electronics market were handed three or four hundred lines apiece to sell against the operators' targets, and «عشرات الآلاف من الخطوط» — tens of thousands of lines — went out that way. Badawi announced on 8 August that Egypt would close the agents and distributors; on 10 August Iraq's Commission ordered sales confined to licensed operators' main branches across the Kurdistan Region. A legislator in one state and a regulator in another, with no contact between them, reached for the identical lever inside forty-eight hours, which is evidence that the lever is *right*, not evidence that it is reflexive. The pairing this desk found cuts both ways. **And here is the limb we cannot answer.** Emara's remedy exists only because the register does. «أرقامي» — Arqami, "my numbers" — is what let Egyptians read the lines held against their own national ID, and it is what produced the named people in this story: Malak Saif El-Din with fourteen, Souad Mohamed with ten at an operator she says she has never used, Mohamed Saudi with five. Auditability and attributability are the same property of the same database; you cannot let a citizen check the entry without also letting a prosecutor read it. **This desk has no design for an identity system that lets a court attribute a phone call, lets a citizen audit their own entry, and cannot be made to convict the wrong person — and neither do Egypt's critics.** "Stop making the register load-bearing" is a slogan until somebody says what a drug-trafficking prosecution uses instead of the number. We are not able to say what that is. That limb stands, and this desk is not going to pretend otherwise.

Comics

#1The register convicted him, and the fix is more register
#2The register did not convict him; an investigator's inference did, and the answer is a better register