India bypasses its own rules to buy Israeli phone-hacking technology, raising surveillance concerns

India has exempted an Israeli phone-hacking company from New Delhi's own rules, allowing it to sell phone-extraction products and surveillance technology to government agencies and sparking concerns and criticism from rights groups and activists.

An investigation by the digital-rights group Internet Freedom Foundation (IFF) found that Indian Home Minister Amit Shah, a close confidante of Prime Minister Narendra Modi, signed off on exemptions from 'Make in India' procurement rules, clearing the way for government forensic institutions to buy at least 422 items of foreign technology, including products made by the Israeli firm Cellebrite.

Modi's federal government and state governments ruled by his Bharatiya Janata Party are not the only ones that bought this Israeli technology. States governed by the opposition Indian National Congress party, including Himachal Pradesh, Kerala and Karnataka, also purchased similar phone-extraction and cloning tools.

A review of documents revealed that India's expansive surveillance capabilities extend far beyond cloning phones and extracting data without passwords, to accessing cloud-based data from social media platforms such as Instagram, X and Tinder, as well as data from connected devices such as Amazon's Alexa and Google Home.

Experts argued that India's current laws offer no guardrails against overreaching surveillance and that the data extractions happen in a legal grey zone.

Vrinda Bhandari, a lawyer in the Supreme Court who works on digital rights and privacy issues, said it is clear there is an expansion of India's surveillance capabilities and it is becoming both wider and deeper. She said it is now easier to conduct mass surveillance rather than targeted, specific surveillance, and also possible to do more intrusive surveillance, adding that surveillance now gives a richer picture of an individual's life.

The IFF reviewed a letter from India's Ministry of Home Affairs dated 7 January in which Shah signed off on a wide-ranging, one-year waiver of 'Make in India' rules to clear a path for buying at least 422 forensic items. Under the rules, preference must be given to eligible Indian manufacturers over foreign suppliers in awarding government contracts, although exemptions are allowed with the approval of the minister in charge of the procuring department.

Another letter by the ministry dated 20 January showed Shah permitted the National Investigation Agency (NIA) to buy Israeli company Cellebrite's Premium Tool on a three-year licence for about 50 million rupees ($529,947).

In specifications demanded by the government that were revealed in a review of tender bids, the 'solution' software must be capable of using login tokens recovered from seized phones or computers to access more than 100 cloud services. Login tokens are in effect digital keys that keep users signed in to online accounts.

From the 422-item exemption list, the IFF identified 118 items under digital and multimedia forensics, including Cellebrite's Pathfinder, Inseyets On-Prem Pro and Inseyets Offline. Other products included tools from foreign digital-forensics companies such as Magnet, MSAB, Oxygen Forensics and Belkasoft, as well as software for open-source intelligence, dark-web monitoring and cryptocurrency investigations.

Cellebrite's tools have been used against journalists and activists in countries like Serbia, Jordan, Kenya and Russia.

The Delhi Police issued a request for a bid proposal for software for its National Cyber Forensic Laboratory, which comes under the Indian Cybercrime Coordination Centre, an initiative of the Home Ministry.

The capabilities the police department was seeking included software that bypasses passwords on Apple's macOS, Microsoft Windows and Linux operating systems, recovers internet activity, browser histories and deleted files, identifies traces of VPNs, bypasses screen locks, performs full file system extractions, decrypts backups and extracts information from messaging applications.

The Delhi Police demanded another 'all-in-one' system to access more than 100 cloud services, including Google, Apple, WhatsApp, Instagram, Telegram, Discord and dating platforms such as Tinder, Grindr and OkCupid, or platforms like Slack and OnlyFans, using account credentials or login tokens recovered from devices. Its specifications also sought the extraction of data from drones, wearable devices and devices like Amazon Alexa and Google Home.

Al Jazeera reached out to officials at the NIA, the Home Ministry and the home departments of the opposition-ruled states of Himachal Pradesh, Karnataka and Kerala for comment. The Delhi Police reports to Shah's ministry. None of them had responded by the time of publication.

Last month, when Modi's government faced street protests demanding the election chief resign, popular YouTuber Dhruv Rathee, a Modi critic, landed in New Delhi to participate in the demonstrations. On the morning of the protest, he was detained by Delhi Police while still at home and his phone was taken from him. Speaking on a podcast later, Rathee said he believed police had tried to clone his iPhone using Cellebrite's tools, but the attempt may have failed because his device was running a newer version of iOS than the tool was capable of handling. Al Jazeera could not verify Rathee's account.

Mohammad Aslam Hussain, a reporter with the newspaper Siasat Daily, told Al Jazeera that he was detained with a cameraperson on 10 October in New Delhi and his phone was confiscated at the scene. He said that when he got his device back later in the evening, all recorded footage of their reporting had been selectively deleted from the device. The reporter uses Samsung's Android-operated Galaxy S24 secured with a pattern lock and fingerprint authentication.

Hussain added that he cannot say conclusively what tools the police used to bypass his phone's authentication requirement, but said it raises several questions with no one willing to respond to them, asking how they got inside his phone.

The Indian government has faced accusations that it has used sophisticated spyware against journalists, activists, lawyers and political opponents during Modi's years in power. In 2019, WhatsApp disclosed that the Pegasus spyware, developed by the Israeli firm NSO Group, had been used to target Indian journalists and human rights defenders. Forensic examinations by Amnesty International later confirmed Pegasus infections on the phones of journalists Siddharth Varadarajan and Anand Mangnale. The government has denied allegations of unauthorised surveillance.

The central legal gap identified by the IFF is that India has no statute or protocol that specifically authorises or regulates the forced unlocking and full extraction of data from a mobile phone seized by law enforcement agencies. Existing seizure powers under criminal law do not explicitly address bypassing passcodes, copying an entire file system, harvesting login tokens to access cloud accounts, or rules for the retention and deletion of extracted data.

The Supreme Court, in a 2017 judgement, recognised privacy as a fundamental right under the Indian Constitution. The judgement established that any state intrusion into privacy must have a legal basis, pursue a legitimate state aim and be proportionate to that aim.

Bhandari noted that while some countries like the United Kingdom or Germany have some element of either parliamentary oversight or judicial oversight, India only has an internal review mechanism in executive oversight. She said the whole point of having oversight is to create friction for surveillance, so that it is not easy for the government to just target everybody.