How M-Pesa changed into surveillance tool

Lerato Matheka

“No deposits without your phone.”

When a convenient service turns into a surveillance tool for the sake of making profits.

This is how VCL Financial Services’ M-Pesa can be best described following a decision to prohibit deposits when the depositor’s phone is not in the immediate vicinity of an agent.

To enforce this decision, customers’ locations are tracked without their knowledge and consent.

“Transaction failed. You are only allowed to deposit to customers in front of you. Please try again” is a message that agents receive when trying to deposit for a phone that is not in the vicinity.

Surveillance is corrosive and makes people feel like they are always being watched. It undermines fundamental human rights, such as the right to privacy.

When conducted without any judicial oversight whatsoever, spying becomes especially harmful because it sometimes feeds into the national security apparatus that puts people on watch lists and subjects them to unwarranted scrutiny by law enforcement.

“We can have democracy, or we can have a surveillance society, but we cannot have both,” Dr Shoshana Zuboff, a professor emeritus at Harvard Business School once said.

Dr Zuboff is the author of “The Age of Surveillance Capitalism”.

Not only did the VCL Financial Services’ decision open floodgates for what amounts to mass surveillance but also effectively meant sending money to M-Pesa users when you do not have M-Pesa account yourself was verboten.

M-Pesa arrived in Lesotho in July 2013 when the telecommunications giant, Vodacom Lesotho (VCL), ventured into the highly thriving and profitable business of mobile money.

In 2014, the parliament enacted the Payment Systems Act to make provision for the management of interbank systems, clearing houses, and securities settlement systems, and for related purposes.

In 2017, the Central Bank of Lesotho (CBL) promulgated the Payment Systems (Issuers of Electronic Payments Instruments) Regulations.

The objective of these regulations is to provide for the licensing and oversight of issuers of electronic payment instruments including the issuance of e-money as well as general provisions applying to e-money issuers.

Then in July 2021, VCL announced that M-Pesa would operate under a new company, VCL Financial Services – an independent company licensed by CBL as a financial services provider.

VCL Financial Services is wholly owned by VCL.

VCL said the decision to separate the businesses followed the CBL’s recommendation – a move it welcomed – to separate the M-Pesa business from the GSM business.

VCL Financial Services is licensed under the Payment Systems (Issuers of Electronic Payments Instruments) Regulations same regulations as a mobile money issuer.

The regulations state that an e-money issuer, such as VCL Financial Services, should put in place measures to address consumer protection, education, and privacy by ensuring that its user charter, at a minimum, includes commitment towards ensuring safe operations, the privacy of customer information, reliable and quality service, and transparency of product and services.

But, is VCL Financial Services ensuring the privacy of its customers?

Advocate Letuka Molati told Newsday this week that according to the National Security Service Act, “(ONLY)… the minister on the application made by a member of the National Security Service (NSS) office, may issue a warrant authorising an act of surveillance, or upon delegation by the minister, the Director General of the NSS may issue such warrant and permission.”

Molati said: “A warrant to collect, track and trace anyone living in Lesotho is only authorised by the minister of security or may give authority to the Director General to spy on anyone.

“VCL Financial Services, through M-Pesa, is clearly in violation of people’s privacy and the acts of monitoring and accessing people’s locations in accessing service without any form of oversight whatsoever is a clear surveillance of the customers.”

He said M-Pesa users were previously allowed without their locations being tracked. He stressed that tracking people’s locations without their consent was flagrant surveillance, and thereby a violation of several laws including the Constitution.

“When M-Pesa was first introduced, it was meant to offer transparent, less costly, and convenient financial services, but suddenly there are a lot of issues involved including cohesion of profits allowing the service provider to chew with two molars and they are making more money than they are supposed to be doing by law,” he noted and charged that the government was allowing VCL Financial Services to victimise its consumers.

He added: “What is even more shocking about this is that an agent is not allowed to do a transfer with their device to a different user’s device, but once a customer has deposited the money into their own device, they can perform the act of sending money to another user who is not at proximity, this does not any sense at all.”

Lesotho may not have surveillance law but citizen privacy is protected by the constitution of Lesotho’s section 11 (1) and the Data Protection Act of 2011’s sections 15 and 50.

The danger of surveillance becoming normalised is that the very technologies we depend on will instead be used against us, to track us wherever we go and whatever we do.

CBL, as a regulator of VCL Financial Services, can ensure this never happens, however, it has allowed the company to continue despite the public outcry.

This paper sent a list of questions to the CBL but at the time of print, it had not responded to questions.

The failure of CBL to investigate whether VCL Financial Services is able to ensure that its surveillance technology is not used to suppress human rights demonstrates the degree of impunity to which the company operates.

Questions were also sent to VCL’s external affairs manager, Katleho Pefole, who acknowledged receipt of the email.

However, by the time of print, the company had not responded to the questions. Pefole sometimes speaks on behalf of VCL Financial Services, which is why the questions were sent to him.

According to Amnesty International (AI), an international non-governmental organization focused on human rights, with its headquarters in the United Kingdom (UK), too often, the threat posed to human rights by unlawful surveillance is downplayed by those who argue that such surveillance only threatens rights only when, in a system of unlawful mass surveillance, a person’s communications or data are seen by a human.

AI says this is incorrect.

It recommends that states must ensure that surveillance powers are strictly in line with international human rights law and standards, and should be proactively transparent about the tools purchased or in possession. M-Pesa is currently Africa’s leading mobile money service with more than 430,000 active agents operating across the Democratic Republic of Congo (DRC), Egypt, Ghana, Kenya, Lesotho, Mozambique, and Tanzania