India

India Grants Exemption to Israeli Phone‑Extraction Firm, Expanding Surveillance Reach

By Yashraj Sharma

India has exempted an Israeli phone‑hacking company from its own procurement rules, allowing the firm to sell phone‑extraction products and surveillance technology to government agencies. An investigation by the digital‑rights group Internet Freedom Foundation (IFF) found that Home Minister Amit Shah, a close confidante of Prime Minister Narendra Modi, signed off on exemptions from “make in India” procurement rules, clearing the way for government forensic institutions to buy at least 422 items of foreign technology, including products made by the Israeli firm Cellebrite. Both Modi‑led federal and state governments, as well as opposition‑ruled states such as Himachal Pradesh, Kerala and Karnataka, have purchased similar phone‑extraction and cloning tools.

Documents reviewed by IFF show that India’s surveillance capabilities extend beyond cloning phones to accessing cloud‑based data from social media platforms—Instagram, X and Tinder—as well as data from connected devices such as Amazon Alexa and Google Home. Vrinda Bhandari, a Supreme Court lawyer who works on digital rights and privacy, told Al Jazeera that India’s surveillance is becoming both wider and deeper, making mass surveillance easier and more intrusive.

A letter from the Ministry of Home Affairs dated January 7 shows Shah signed a one‑year waiver of “make in India” rules to allow the purchase of at least 422 forensic items. Another letter dated January 20 permitted the National Investigation Agency (NIA) to buy Cellebrite’s Premium Tool on a three‑year licence for about 50 million rupees ($529,947). The government’s specifications required software capable of using login tokens recovered from seized phones or computers to access more than 100 cloud services.

From the 422‑item exemption list, IFF identified 118 items under digital and multimedia forensics, including Cellebrite’s Pathfinder, Inseyets On‑Prem Pro and Inseyets Offline. Cellebrite’s tools have been used against journalists and activists in countries such as Serbia, Jordan, Kenya and Russia. Other products included tools from foreign digital‑forensics companies like Magnet, MSAB, Oxygen Forensics and Belkasoft, as well as software for open‑source intelligence, dark‑web monitoring and cryptocurrency investigations.

Al Jazeera reviewed a request for a bid proposal by the Delhi Police for software for its National Cyber Forensic Laboratory, part of the Indian Cybercrime Coordination Centre. The police sought software that bypasses passwords on Apple, Microsoft and Linux operating systems; recovers internet activity, browser histories, deleted files and traces of VPNs; bypasses screen locks; performs full file system extractions; decrypts backups; and extracts information from messaging applications. The request also called for an “all‑in‑one” system to access more than 100 cloud services, including Google, Apple, WhatsApp, Instagram, Telegram, Discord and dating platforms such as Tinder, Grindr and OkCupid, as well as platforms like Slack and OnlyFans, using account credentials or login tokens recovered from devices. The specifications also sought extraction of data from drones, wearable devices and smart‑home devices.

Al Jazeera reached out to officials at the NIA, the Home Ministry and home departments of opposition‑ruled states of Himachal Pradesh, Karnataka and Kerala for comments. None of them had responded by the time of publication.

The lack of transparency in India’s surveillance capabilities has raised concerns. Last month, during protests demanding the resignation of the election chief, YouTuber Dhruv Rathee was detained by Delhi Police while still at home. Rathee said he believed police had tried to clone his iPhone using Cellebrite’s tools, but the attempt may have failed because his device was running a newer version of iOS than the tool could handle. Another incident involved reporter Mohammad Aslam Hussain, who was detained with a cameraman on October 10 in New Delhi and had his phone confiscated. Hussain said that when he later recovered his device, all recorded footage of their reporting had been selectively deleted.

India has faced accusations of using sophisticated spyware against journalists, activists, lawyers and political opponents. In 2019, WhatsApp disclosed that Pegasus spyware, developed by the Israeli firm NSO Group, had been used to target Indian journalists and human‑rights defenders. Forensic examinations by Amnesty International later confirmed Pegasus infections on the phones of journalists Siddharth Varadarajan and Anand Mangnale.

Bhandari noted that India has no statute or protocol that specifically authorises or regulates the forced unlocking and full extraction of data from a mobile phone seized by law enforcement. Existing seizure powers under criminal law do not explicitly address bypassing passcodes, copying an entire file system, harvesting login tokens to access cloud accounts or establishing rules for the retention and deletion of extracted data. The Supreme Court’s 2017 judgement recognised privacy as a fundamental right and established that any state intrusion into privacy must have a legal basis, pursue a legitimate state aim and be proportionate to that aim. Bhandari said that when government agencies deploy these capabilities without proper oversight, the net of surveillance is cast wider and deeper, affecting more people without legislative, parliamentary or judicial oversight. She added that while some countries have parliamentary or judicial oversight, India only has an internal executive review mechanism, which she argues fails to provide adequate safeguards against overreaching surveillance.