Suryaa Now India Desk: India's government has relaxed its domestic procurement rules to allow an Israeli cybersecurity company to supply advanced mobile phone extraction and surveillance technology to Indian investigative agencies, raising serious concerns among digital rights organisations over privacy, transparency and government surveillance.
An investigation published by Al Jazeera on November 12, citing documents reviewed by the Internet Freedom Foundation (IFF), found that Union Home Minister Amit Shah approved exemptions from the government's Make in India procurement requirements, opening the way for government agencies to purchase at least 422 foreign forensic technology products.
The products include sophisticated digital investigation tools manufactured by Israeli company Cellebrite, which specialises in extracting information from mobile phones and other electronic devices.
According to documents reviewed by the Internet Freedom Foundation, the Ministry of Home Affairs issued an approval on January 7 granting a one-year exemption from certain Make in India procurement requirements.
The exemption covered at least 422 forensic technology items, including 118 products related to digital and multimedia forensics.
A separate government communication dated January 20 reportedly authorised the National Investigation Agency (NIA) to procure Cellebrite's Premium Tool under a three-year licence for approximately Rs 5 crore.
The Make in India procurement framework generally gives preference to eligible domestic manufacturers when government departments purchase equipment and technology. However, the rules permit exemptions with approval from the relevant minister.
The investigation noted that an exemption permitting foreign products does not independently establish that every listed product was subsequently purchased or deployed.
Cellebrite's forensic technology is designed to assist investigators in recovering information from mobile phones and other digital devices.
Depending on the device, operating system and software version, such tools can potentially bypass certain security restrictions, extract stored information, recover deleted files and access data that may otherwise be difficult to retrieve.
The investigation also identified procurement requirements seeking capabilities to access more than 100 cloud-based services using login credentials or authentication tokens recovered from seized devices.
These services reportedly include Google, Apple, WhatsApp, Instagram, Telegram, Discord and dating platforms such as Tinder.
The technology specifications also covered data extraction from connected devices, including smart speakers, wearable technology and drones.
Documents reviewed by Al Jazeera revealed that Delhi Police had sought sophisticated software for its National Cyber Forensic Laboratory.
The requested capabilities included bypassing passwords on Apple macOS, Microsoft Windows and Linux systems, recovering deleted files, analysing internet browsing histories, identifying VPN usage and extracting information from messaging applications.
The specifications also sought tools capable of unlocking certain mobile devices, performing full file-system extractions and decrypting digital backups.
Such capabilities can support criminal investigations, but digital rights advocates argue that access to personal information must be subject to clear legal safeguards and independent oversight.
The issue has attracted additional attention following allegations by journalists and political commentators that their mobile phones may have been accessed during police detention.
YouTuber Dhruv Rathee reportedly suspected that police attempted to clone his iPhone using Cellebrite technology after his detention in October. Al Jazeera said it could not independently verify his account.
Journalist Mohammad Aslam Hussain also told Al Jazeera that footage stored on his Samsung Galaxy S24 had been selectively deleted after police confiscated his device during his detention in New Delhi.
He said he could not conclusively establish which technology, if any, had been used to access his phone.
These accounts have intensified questions about how investigators handle seized electronic devices and whether adequate protections exist against unauthorised access.
The Internet Freedom Foundation has warned that India's existing legal framework does not provide sufficiently specific safeguards governing forced mobile-phone unlocking, complete data extraction and access to cloud accounts through recovered authentication tokens.
Supreme Court lawyer Vrinda Bhandari, who works on digital rights and privacy issues, said the expansion of surveillance capabilities requires meaningful legislative, parliamentary and judicial oversight.
India's Supreme Court recognised privacy as a fundamental right under the Constitution in its landmark 2017 judgment.
The judgment established that government interference with individual privacy must have a legal basis, serve a legitimate objective and satisfy proportionality requirements.
However, privacy advocates argue that existing oversight arrangements are insufficient to regulate the growing technical capabilities of law enforcement agencies.
Al Jazeera reported that it contacted the National Investigation Agency, the Union Home Ministry and the home departments of Congress-governed Himachal Pradesh, Karnataka and Kerala for comments.
The publication said none had responded by the time its investigation was published.
The government has previously faced allegations concerning the use of sophisticated surveillance software against journalists, activists and political figures. It has denied allegations of unauthorised surveillance.
The latest revelations have renewed the debate over the balance between national security, criminal investigations and citizens' constitutional privacy rights.
Advanced forensic technology can help law enforcement agencies investigate cybercrime, terrorism, financial fraud and other serious offences.
However, experts argue that unrestricted access to personal devices and cloud accounts could expose private communications, photographs, financial information and sensitive personal records.
The key question now is whether India will introduce stronger legal and independent oversight mechanisms to ensure that powerful surveillance technologies are used only for legitimate investigative purposes.
Source: Al Jazeera investigation by Yashraj Sharma; Internet Freedom Foundation.