India Bypasses Its Own Rules to Acquire Israeli Phone-Hacking Technology

India has bypassed its own "Make in India" procurement rules, enabling government agencies to purchase phone data extraction and surveillance technology from an Israeli company. An investigation by the digital rights group Internet Freedom Foundation (IFF) revealed that Home Minister Amit Shah approved these exemptions.

This move has sparked significant concerns and criticism from human rights groups and activists. Experts argue that India's current laws offer insufficient safeguards against overreaching surveillance.

Highlights

• Home Minister Amit Shah approved exemptions from "Make in India" rules for the purchase of foreign technology, including products from the Israeli firm Cellebrite.
• This technology extends beyond phone cloning to accessing cloud-based data from social media platforms like Instagram and Tinder, as well as connected devices such as Amazon Alexa.
• Both the ruling Bharatiya Janata Party and opposition-governed states have acquired similar phone extraction tools.
• Experts contend that India's current legal framework creates a grey area for surveillance, facilitating mass surveillance rather than targeted operations.

Details

According to documents reviewed by the IFF, a letter from the Ministry of Home Affairs dated January 7 shows Shah approved a wide-ranging, one-year waiver of "Make in India" rules to clear the path for buying at least 422 forensic items. While "Make in India" rules typically prioritize domestic manufacturers, exemptions are permitted with the approval of the minister in charge.

Another ministry letter, dated January 20, indicated that Shah authorized the National Investigation Agency (NIA) to purchase Cellebrite's Premium Tool on a three-year license for approximately 50 million rupees (about $529,947). These solutions are expected to be capable of accessing over 100 cloud services using login tokens recovered from seized devices.

Requests for proposals from the Delhi Police also sought software capable of bypassing passwords on Apple macOS, Microsoft Windows, and Linux operating systems, recovering internet activity, browser histories, deleted files, and identifying VPN traces. Furthermore, specifications included access to over 100 cloud services (such as WhatsApp, Instagram, Telegram, Tinder) and data extraction from drones, wearable devices, and smart home devices like Amazon Alexa and Google Home.

Why it matters

These developments suggest an expansion in the scope and depth of India's surveillance capabilities. Digital rights advocates emphasize that due to gaps in the legal framework, such data extractions occur in a legal grey zone, potentially infringing upon individuals' privacy rights. Despite the Supreme Court's 2017 ruling recognizing privacy as a fundamental right, significant concerns persist regarding the transparency and oversight of surveillance mechanisms.