India has waived domestic procurement preferences to allow government forensic institutions to acquire foreign technology, including phone-extraction tools from Israeli company Cellebrite, according to an investigation by the Internet Freedom Foundation. The digital-rights group’s findings have prompted concerns about surveillance powers and the legal protections available to people whose devices are seized.
Documents reviewed by the IFF included a January 7 Home Ministry letter approving a one-year exemption covering at least 422 forensic items. Home Minister Amit Shah authorised the waiver. Procurement rules under the government's “make in India” programme favour eligible Indian manufacturers but permit exceptions approved by the minister responsible for the purchasing department. A separate January 20 letter authorised the National Investigation Agency to acquire a three-year licence for Cellebrite’s Premium Tool for about 50 million rupees ($529,947).
The IFF classified 118 entries on the exemption list as digital and multimedia forensic products, including Cellebrite’s Pathfinder, Inseyets On-Prem Pro and Inseyets Offline. Products from Magnet, MSAB, Oxygen Forensics and Belkasoft also appeared, alongside software for cryptocurrency investigations, dark-web monitoring and open-source intelligence. An exemption establishes that a product can be procured, rather than confirming a completed purchase. The source investigation also reported purchases of similar phone-extraction and cloning tools by opposition-governed states.
Tender documents examined by Al Jazeera show the breadth of capabilities sought by authorities. A Delhi Police request for its National Cyber Forensic Laboratory sought software to bypass computer passwords and phone screen locks, recover deleted files and browsing records, decrypt backups and extract messaging data. Another requested system would access more than 100 cloud services using credentials or login tokens recovered from devices. Those services included social networks, messaging applications and dating platforms. Specifications also covered data from drones, wearables, Amazon Alexa and Google Home devices.
Accounts from people whose phones were confiscated have added to concerns. YouTuber and government critic Dhruv Rathee said police detained him before a protest in October and took his phone. He later alleged that officers tried to clone his iPhone with Cellebrite tools, possibly unsuccessfully. Al Jazeera could not verify his account. Siasat Daily reporter Mohammad Aslam Hussain said footage had been selectively deleted from his secured Samsung phone after police detained him on October 10. He could not identify what technology might have been used.
The IFF said India lacks a specific statute or protocol authorising or regulating forced phone unlocking and complete data extraction. Existing criminal-law seizure powers do not explicitly cover bypassing passcodes, copying entire file systems, collecting login tokens for cloud access or governing the retention and deletion of extracted information.
Supreme Court lawyer Vrinda Bhandari told Al Jazeera that expanding technical capabilities allow more intrusive surveillance without meaningful legislative, parliamentary or judicial oversight. India's Supreme Court recognised privacy as a fundamental right in 2017, requiring state interference to have a legal basis, serve a legitimate aim and be proportionate.
The government has denied allegations of unauthorised surveillance. Al Jazeera sought comment from the NIA, the Home Ministry and home departments in Himachal Pradesh, Karnataka and Keralam, but received no responses before publication.
