India Grants Exemptions for Israeli Phone-Hacking Tech Amid Surveillance Concerns

New Delhi, India – India has granted exemptions to its own procurement rules, enabling an Israeli company specializing in phone-hacking technology to sell its products to government agencies. This decision has raised significant concerns and drawn criticism from human rights groups and activists.

An investigation by the digital-rights group Internet Freedom Foundation (IFF) revealed that Indian Home Minister Amit Shah, a close associate of Prime Minister Narendra Modi, approved waivers from the “make in India” procurement regulations. These exemptions allow government forensic institutions to acquire at least 422 foreign technology items, including those from the Israeli firm Cellebrite.

The procurement of this technology is not limited to the federal government or states governed by Modi’s Bharatiya Janata Party. States administered by the opposition Indian National Congress party, such as Himachal Pradesh, Keralam, and Karnataka, have also purchased similar phone-extraction and cloning tools.

A review of available documents indicates that India’s surveillance capabilities extend beyond simple phone cloning and data extraction without passwords. These capabilities now include accessing cloud-based data from social media platforms like Instagram, X, and Tinder, as well as data from connected devices such as Amazon’s Alexa and Google Home.

Experts argue that India’s current legal framework lacks sufficient safeguards against excessive surveillance, placing data extraction activities in a legal grey area. Vrinda Bhandari, a Supreme Court lawyer specializing in digital rights and privacy, stated, “It is clear that there is an expansion of India’s surveillance capabilities and it is becoming both wider and deeper.” She further commented, “It’s now easier to conduct mass surveillance rather than targeted, specific surveillance and also possible to do more intrusive surveillance. [Today,] surveillance gives you a richer picture of an individual’s life.”

The IFF examined a letter from India’s Ministry of Home Affairs, dated January 7, in which Minister Shah authorized a one-year waiver of “make in India” rules for the purchase of at least 422 forensic items. Typically, these rules prioritize eligible Indian manufacturers over foreign suppliers, but ministerial approval can permit exemptions.

Another ministry letter from January 20 shows that Shah permitted the National Investigation Agency (NIA) to acquire Cellebrite’s Premium Tool through a three-year license valued at approximately 50 million rupees ($529,947).

Tender bid reviews revealed that the government sought software capable of using login tokens from seized phones or computers to access over 100 cloud services. These login tokens act as digital keys for online accounts.

While an exemption for a company does not confirm specific product purchases, it highlights the range of forensic capabilities made available to Indian agencies. The IFF identified 118 items from the exemption list related to digital and multimedia forensics, including products from Cellebrite such as Pathfinder, Inseyets On-Prem Pro, and Inseyets Offline. Cellebrite’s tools have previously been used against journalists and activists in various countries.

The list of procured items also included tools from other foreign digital-forensics companies like Magnet, MSAB, Oxygen Forensics, and Belkasoft, alongside software for open-source intelligence, dark-web monitoring, and cryptocurrency investigations.

Al Jazeera reviewed a bid proposal request from the Delhi Police for software for its National Cyber Forensic Laboratory. The specifications included software capable of bypassing passwords on macOS, Windows, and Linux operating systems, recovering internet activity and deleted files, identifying VPN traces, decrypting backups, and extracting data from messaging applications.

The Delhi Police also requested an “all-in-one” system to access over 100 cloud services, including Google, Apple, WhatsApp, Instagram, Telegram, Discord, dating platforms like Tinder and Grindr, and professional platforms like Slack and OnlyFans, using account credentials or login tokens. The specifications also covered data extraction from drones, wearable devices, and smart home devices like Amazon Alexa and Google Home.

Officials from the NIA, the Home Ministry, and the home departments of opposition-ruled states were contacted for comment but had not responded by the time of publication.

Concerns about surveillance capabilities have been amplified by personal experiences. Popular YouTuber Dhruv Rathee, a critic of Prime Minister Modi, recounted being detained by Delhi Police and having his phone confiscated. He suspected that the police attempted to clone his iPhone using Cellebrite tools, but the attempt may have been unsuccessful due to his device running a newer iOS version.

Mohammad Aslam Hussain, a reporter for Siasat Daily, also shared an experience of detention and phone confiscation, during which recorded footage was selectively deleted from his device. He questioned how his phone’s security was bypassed, stating, “But it raises several questions with no one willing to respond to them.”

India has previously faced accusations of using sophisticated spyware, such as the Pegasus spyware developed by NSO Group, against journalists, activists, and political opponents. The government has consistently denied allegations of unauthorized surveillance.

Bhandari highlighted the difficulty in holding surveillance practices accountable, noting that affected individuals are often unaware they are being monitored. She explained that without proper oversight, surveillance capabilities expand unchecked, impacting more individuals without adequate legislative, parliamentary, or judicial review.

“The current legal framework fails in this safeguard,” Bhandari concluded, emphasizing that effective oversight is crucial to prevent governments from engaging in widespread surveillance.