APAC users need to beware bandit phones

"Shanzai", or bandit mobile phones are quickly finding favor in more Asia-Pacific markets due their low price, availability and innovative features. However, the lack of security standards, particularly an International Mobile Equipment Identity (Imei) number, could pose significant security risks to users and the data they keep on such devices, according to an analyst.

In an e-mail interview with ZDNet Asia, Bryan Wang, research director for connectivity in the Asia-Pacific region and country manager of China at Springboard Research, noted that most bandit phones are manufactured in the southern part of China's Guangdong province, where the creators of these phones are not tied down by industry regulations or trade practices.

Based on the IT market research firm's estimates, China's bandit phone shipments will reach 140 million in 2009, compared to 95 million last year. As for exports, 100 million such phones will be shipped from China this year--compared to 50 to 60 million in 2008--of which 60 percent will be distributed within the Asia-Pacific region.

"If we look at the sales of 60 million 'shanzai' mobile phones in the Asia-Pacific region, the figure represents close to 30 percent of total mobile phone sales in the region, excluding China. It is a very substantial proportion of the total mobile phone market in the region," said Wang. "From [a] price point perspective, it also drives subscriber growth in many developing markets."

One Web site that looks specifically into the "shanzai" market, shanzai.com, has defined the term to refer to "a vendor who operates a business without observing the traditional rules or practices, often resulting in innovative and unusual products or business models".

While the lack of accountability and adherence to industry standards has allowed manufacturers to innovate liberally, the model also has its drawbacks.

Bandit mobile phones usually come without the industry standard 15-digit Imei that allows telcos to identify a particular device on their networks. Without the code, phones will not be able to be tracked by security services, according to a recent report by ZDNet Asia's sister site ZDNet UK.

The inability to trace devices via mobile networks is a worrying trend for authorities such as the Indian government; last month, authorities terminated connections of handsets that did not possess legitimate Imei numbers. India's decision to clamp down on untraceable mobile phones had arisen from the country's anti-terrorist measures following the Mumbai attacks late last year.

Citing media reports in India, ChinaTechNews.com said there are currently 25 million mobile phones without Imei numbers in India, with "shanzai" mobiles making up the majority.

Following the clampdown, mobile phone retailers in India who continue to sell bandit phones without legal Imei numbers have been arrested. According to a report by The Economic Times last week, 3,500 bandit phones were confiscated and 23 shopkeepers arrested in raids.

Noting the development, Wong predicted that the sales of "shanzai" phones in many Asia-Pacific developing markets will encounter "significant decline" in the next three to six months.

Safety concerns
David Hall, Symantec's Asia-Pacific product manager for consumer products and solutions, noted that bandit phones could be viewed in the same light as "scareware", which are "oftentimes not manufactured by trusted companies but by vendors with malicious intent". Many "shanzai" products, he added, were created to maximize their monetary gain at the cost of consumers' safety.

"A pirated phone could come with various malware, for example tracking software, which steals any online transaction made on the phone," Hall told ZDNet Asia in an e-mail interview. "Today, consumers are increasingly using mobile phones that involve financial transactions such as banking and shopping. If the pirated phone has [the mentioned malware], the phone user will be subjected to a big security risk."

Springboard's Wong concurred, noting that data security on such devices is a "key challenge". Without legal IMEI numbers, it would be "very difficult" for users and operators to lock down the phone when it is lost or stolen.

In terms of product safety however, the quality of "shanzhai" phones is "satisfactory", added Wong. "There are only approximately a dozen incidences of battery explosions linked to shanzai phones in the past 12 to 18 months. If we consider the large volume of mobile handsets, this record is not significantly higher than other established brands."

According to Wong, consumers from developed countries will have "severe concerns" about the quality of such phones, especially on battery quality, but there are fewer concerns from those in developing markets, where there is a "lack of information about product safety".