INDIA’S Home Minister Amit Shah has exempted foreign surveillance technology, including phone-hacking tools made by the Israeli firm Cellebrite, from the country’s ‘make in India’ procurement rules, clearing government agencies to buy equipment that can extract data from seized phones and other surveillance technology.
The exemption was revealed by an investigation by the digital rights group Internet Freedom Foundation (IFF).
It found that Shah, a close confidant of Prime Minister Narendra Modi, signed off on a wide-ranging, one-year waiver in a Ministry of Home Affairs letter dated January 7.
The waiver opened the way for government forensic institutions to buy at least 422 items of foreign technology.
A second ministry letter, dated January 20, shows Shah allowed the National Investigation Agency (NIA) to buy Cellebrite’s Premium Tool on a three-year licence for about 50 million rupees ($529,947).
The approval came less than two weeks after the wider waiver.
Under the ‘make in India’ rules, eligible Indian manufacturers must be given preference over foreign suppliers for government contracts.
The rules allow exemptions with the approval of the minister in charge of the procuring department.
Of the 422 items on the exemption list, the IFF identified 118 in the category of digital and multimedia forensics, among them Cellebrite’s Pathfinder, Inseyets On-Prem Pro and Inseyets Offline.
Cellebrite’s tools have been used against journalists and activists in countries including Serbia, Jordan and Kenya.
The list also covers tools from the foreign digital forensics companies Magnet, MSAB, Oxygen Forensics and Belkasoft, along with software for open-source intelligence, dark web monitoring and cryptocurrency investigations.
An exemption does not confirm that any agency has bought a particular product, but it shows the range of forensic capabilities now open to Indian agencies.
The purchases are not confined to Modi’s federal government or to states run by his Bharatiya Janata Party. States governed by the opposition Indian National Congress, including Himachal Pradesh, Keralam and Karnataka, have also bought similar phone extraction and cloning tools.
Documents show that India’s surveillance capabilities now reach well beyond cloning phones and extracting data without passwords, to cloud-based data held by social media platforms such as Instagram, X and Tinder and to data from connected devices such as Amazon’s Alexa and Google Home.
A Delhi Police request for bids seeks software for the force’s National Cyber Forensic Laboratory, which comes under the Indian Cybercrime Coordination Centre, a Home Ministry initiative.
The software must bypass passwords on Apple’s macOS, Microsoft Windows and Linux, recover internet activity, browser histories and deleted files, identify traces of VPNs, bypass screen locks, perform full file system extractions, decrypt backups and extract information from messaging apps.
The Delhi Police also asked for a separate ‘all-in-one’ system to get into more than 100 cloud services using account credentials or login tokens recovered from devices.
The list includes Google, Apple, WhatsApp, Instagram, Telegram and Discord, the dating apps Tinder, Grindr and OkCupid, and platforms such as Slack and OnlyFans.
The specifications also seek the extraction of data from drones, wearable devices and home assistants.
Vrinda Bhandari, a Supreme Court lawyer who works on digital rights and privacy, said: ‘It is clear that there is an expansion of India’s surveillance capabilities and it is becoming both wider and deeper.’
‘It’s now easier to conduct mass surveillance rather than targeted, specific surveillance and also possible to do more intrusive surveillance,’ she said. ‘(Today,) surveillance gives you a richer picture of an individual’s life.’
Last month, as Modi’s government faced street protests demanding the resignation of the election chief, the popular YouTuber Dhruv Rathee, a critic of Modi, landed in New Delhi to join the demonstrations.
On the morning of the protest the Delhi Police detained him while he was still at home and took his phone.
Speaking later on a podcast, Rathee said he believed police had tried to clone his iPhone using Cellebrite’s tools, and that the attempt may have failed because his phone was running a newer version of iOS than the tool was capable of tricking.
Rathee is not alone in his suspicion.
Mohammad Aslam Hussain, a reporter for the newspaper Siasat Daily, was detained with a camera operator in New Delhi on October 10, and his phone was confiscated at the scene.
He uses a Samsung Galaxy S24, secured with a pattern lock and fingerprint authentication.
‘When I got my device later in the evening, all recorded footage of our reporting had been selectively deleted from the device,’ Hussain said.
He said he could not say conclusively what tools police had used to get past the phone’s security. ‘But it raises several questions with no one willing to respond to them,’ he said. ‘How did they get inside my phone?’
The Indian government has faced accusations of using sophisticated spyware against journalists, activists, lawyers and political opponents during Modi’s years in power.
In 2019 WhatsApp disclosed that Pegasus, developed by the Israeli firm NSO Group, had been used to target Indian journalists and human rights defenders.
Forensic examinations by Amnesty International later confirmed Pegasus infections on the phones of the journalists Siddharth Varadarajan and Anand Mangnale.
The central legal gap identified by the IFF is that India has no statute or protocol that specifically authorises or regulates the forced unlocking and full extraction of data from phones seized by law enforcement agencies.
Existing seizure powers under criminal law do not explicitly address bypassing passcodes, copying an entire file system or harvesting login tokens to get into cloud accounts, nor do they set rules for keeping or deleting extracted data.
In a 2017 judgment, the Supreme Court recognised privacy as a fundamental right under the Indian constitution. It held that any intrusion by the state must have a legal basis, pursue a legitimate state aim and be proportionate to that aim.
When agencies ‘deploy these capabilities without any proper meaningful oversight, the net of surveillance is cast wider and deeper and a lot more people are affected without either legislative, parliamentary or judicial oversight’, she said.
Some countries, such as the United Kingdom and Germany, ‘have some element of either parliamentary oversight or judicial oversight’, Bhandari said, but ‘India only has an internal review mechanism in executive oversight’.
‘The whole point of having any oversight is to create a friction for surveillance, so that it’s not easy for the government to just target everybody,’ she said. ‘The current legal framework fails in this safeguard.’
