India bypasses own rules to buy Israeli phone-hacking tech - Al Jazeera

India’s Home Minister Amit Shah has signed off on a one-year waiver of the “make in India” procurement rules. The exemption allows government forensic institutions to buy at least 422 items of foreign technology, including products made by the Israeli firm Cellebrite.

The move clears the path for the National Investigation Agency (NIA) to purchase Cellebrite’s Premium Tool on a three-year licence for about 50 million rupees. The waiver applies to a wide range of digital and multimedia forensics products.

The exemption was granted despite a rule that mandates preference for eligible Indian manufacturers over foreign suppliers. The waiver, which was approved by the Home Ministry, was revealed in a letter dated January 7.

Expanded surveillance capabilities

The procurement list includes tools from foreign digital-forensics companies like Magnet, MSAB, Oxygen Forensics and Belkasoft. It also covers software for open-source intelligence, dark-web monitoring and cryptocurrency investigations.

Documents reviewed by Al Jazeera show that the Delhi Police sought software capable of bypassing passwords on Apple’s macOS, Microsoft Windows and Linux operating systems. The request also asked for tools to recover internet activity, browser histories and deleted files.

The police department demanded an “all-in-one” system to access more than 100 cloud services. This includes Google, Apple, WhatsApp, Instagram, Telegram, Discord and dating platforms such as Tinder, Grindr and OkCupid.

The specifications also sought the extraction of data from drones, wearable devices and smart home devices like Amazon Alexa and Google Home. The tools can use login tokens recovered from seized phones to access online accounts.

The expanded capabilities allow for mass surveillance rather than targeted, specific surveillance. This gives authorities a richer picture of an individual’s life, including their social media activity and connected device data.

Used by opposition states too

The procurement of this technology is not limited to the federal government and states ruled by the Bharatiya Janata Party. States governed by the opposition Indian National Congress party, including Himachal Pradesh, Kerala and Karnataka, also purchased similar phone-extraction and cloning tools.

Al Jazeera reached out to officials at the NIA, the Home Ministry and home departments of the opposition-ruled states for comments. None of them had responded to the request by the time of publication.

The Delhi Police reports directly to the Home Ministry. The NIA is India’s primary counter-terrorism agency.

Legal grey zone and privacy concerns

The digital-rights group Internet Freedom Foundation (IFF) argues that India’s current laws offer no guardrails against overreaching surveillance. The data extractions happen in a legal grey zone.

There is no statute or protocol that specifically authorises or regulates the forced unlocking and full extraction of data from a mobile phone seized by law enforcement agencies. Existing seizure powers under criminal law do not address these specific actions.

A 2017 Supreme Court judgement recognised privacy as a fundamental right under the Indian Constitution. The judgement established that any state intrusion into privacy must have a legal basis, pursue a legitimate state aim and be proportionate to that aim.

Bhandari noted that India only has an internal review mechanism in executive oversight. In contrast, countries like the United Kingdom or Germany have some element of parliamentary or judicial oversight.

The lack of oversight creates a situation where the person placed under surveillance often does not know about it. This makes it difficult to hold the government accountable for its actions.

Tools used against critics

The Indian government has faced accusations that it has used sophisticated spyware against journalists, activists, lawyers and political opponents during Prime Minister Narendra Modi’s years in power.

In 2019, WhatsApp disclosed that the Pegasus spyware, developed by the Israeli firm NSO Group, had been used to target Indian journalists and human rights defenders. Forensic examinations by Amnesty International later confirmed Pegasus infections on the phones of journalists Siddharth Varadarajan and Anand Mangnale.

The government has denied allegations of unauthorised surveillance. Cellebrite’s tools have been used against journalists and activists in countries like Serbia, Jordan, Kenya and Russia.

Popular YouTuber Dhruv Rathee, a critic of the Modi government, was detained by Delhi Police on the morning of a protest in New Delhi. His phone was confiscated, and he believes police tried to clone his iPhone using Cellebrite’s tools.

Rathee said the attempt may have failed because his device was running a newer version of the iOS operating system than what the tool was capable of tricking. Al Jazeera could not verify his account.

Mohammad Aslam Hussain, a reporter with the newspaper Siasat Daily, was detained with a cameraperson on October 10 in New Delhi. His phone was confiscated, and all recorded footage of their reporting was selectively deleted from the device.

Hussain uses a Samsung Galaxy S24 secured with a pattern lock and fingerprint authentication. He cannot say conclusively what tools the police used to bypass his phone’s authentication requirement.

How did they get inside my phone?

The lack of transparency in the surveillance capabilities of India’s security agencies is a growing concern for many. The government’s expanded powers, coupled with the absence of clear legal protocols, raise serious questions about privacy and accountability.