India has waived its procurement rules to let government agencies buy phone-extraction and surveillance products from Israeli firm Cellebrite, raising concerns about expanding state surveillance and weak safeguards.
Home Minister Amit Shah, a close Modi ally, approved a one-year “Make in India” exemption, allowing agencies to procure at least 422 foreign forensic products, the Internet Freedom Foundation (IFF) found. Documents show the technology can unlock phones, access cloud accounts and extract data from connected devices.
A Home Ministry letter dated January 7 authorised the waiver. The rules favour Indian firms but permit ministerial exemptions. In a second letter, dated January 20, Shah allowed the National Investigation Agency (NIA) to buy Cellebrite’s Premium Tool on a three-year licence for about $529,947.
Of the 422 items, 118 were digital and multimedia forensic products, including Cellebrite’s Pathfinder, Inseyets On-Prem Pro and Inseyets Offline, tools from Magnet, MSAB, Oxygen Forensics and Belkasoft, plus open-source intelligence, dark-web monitoring and cryptocurrency software.
Similar tools were bought by Modi’s federal government and Bharatiya Janata Party-ruled states, as well as opposition-run Himachal Pradesh, Keralam and Karnataka.
Tender documents reviewed by Al Jazeera show agencies sought tools that use login tokens recovered from seized phones or computers to access more than 100 cloud services. Tokens keep users signed in.
A Delhi Police tender for its National Cyber Forensic Laboratory sought software to bypass passwords on Apple macOS, Microsoft Windows and Linux; recover browsing histories and deleted files; detect virtual private network traces; bypass screen locks; copy entire file systems; decrypt backups; and extract messaging-app data.
Police also wanted an “all-in-one” system to access Google, Apple, WhatsApp, Instagram, Telegram, Discord, Tinder, Grindr, OkCupid, Slack and OnlyFans using account credentials or recovered tokens. Specifications covered data extraction from drones, wearable devices, Amazon Alexa and Google Home. The laboratory is part of the Home Ministry’s Indian Cybercrime Coordination Centre.
The NIA, Home Ministry and home departments of opposition-governed Himachal Pradesh, Karnataka and Keralam did not respond to Al Jazeera’s requests for comment.
YouTuber Dhruv Rathee, a Modi critic, said on a podcast that police may have tried to clone his iPhone with Cellebrite software after detaining him at home in New Delhi during last month’s protests demanding the election chief’s resignation. He thought it may have failed because his phone ran a newer iOS version. Al Jazeera could not verify his account.
Mohammad Aslam Hussain, a reporter for Siasat Daily, told Al Jazeera that police detained him and a cameraperson in New Delhi on October 10 and seized his phone. When it was returned later that day, footage of their reporting had been selectively deleted, he said.
Hussain’s Samsung Galaxy S24 uses a pattern lock and fingerprint authentication. Unable to establish how police accessed it, he asked: “How did they get inside my phone?”
India has faced previous allegations of spyware use against journalists, activists, lawyers and political opponents. WhatsApp disclosed in 2019 that Pegasus, made by Israeli firm NSO Group, had targeted Indian journalists and human rights defenders. Amnesty International later confirmed infections on the phones of journalists Siddharth Varadarajan and Anand Mangnale. The government has denied unauthorised surveillance.
Supreme Court digital-rights lawyer Vrinda Bhandari said surveillance was becoming wider and more intrusive. The IFF said India has no specific law or protocol governing forced phone unlocking, full data extraction, using login tokens to access cloud accounts, or the retention and deletion of extracted data.
The Supreme Court recognised privacy as a fundamental right in 2017, ruling that state intrusion must have a legal basis, pursue a legitimate aim and be proportionate. Bhandari said India relied on internal executive review, unlike Britain and Germany, which have elements of parliamentary or judicial oversight.
Without meaningful scrutiny, people could be monitored without knowing, she said. Oversight should create “a friction for surveillance”, making it harder for the government to target everyone. “The current legal framework fails in this safeguard,” she said.
