India bypasses own rules to buy Israeli phone-hacking tech

New Delhi, India – India has exempted an Israeli phone-hacking company from New Delhi’s own rules, allowing it to sell phone-extraction products and surveillance technology to government agencies and sparking concerns and criticism from rights groups and activists.

An investigation by the digital-rights group Internet Freedom Foundation (IFF) found Indian Home Minister Amit Shah, a close confidante of Prime Minister Narendra Modi, signed off on exemptions from “make in India” procurement rules, clearing the way for government forensic institutions to buy at least 422 items of foreign technology, including products made by the Israeli firm Cellebrite.

Modi’s federal government and state governments ruled by his Bharatiya Janata Party are not the only ones who bought this Israeli technology. States governed by the opposition Indian National Congress party, including Himachal Pradesh, Keralam and Karnataka, also purchased similar phone-extraction and cloning tools.

A review of documents revealed that India’s expansive surveillance capabilities extend far beyond just cloning phones and extracting data without passwords to accessing cloud-based data from social media platforms – such as Instagram, X and Tinder – as well as data from connected devices such as Amazon’s Alexa and Google Home.

Experts argued that India’s current laws offer no guardrails against overreaching surveillance and the data extractions happen in a legal grey zone.

“It is clear that there is an expansion of India’s surveillance capabilities and it is becoming both wider and deeper,” said Vrinda Bhandari, a lawyer in the Supreme Court who works on digital rights and privacy issues.

“It’s now easier to conduct mass surveillance rather than targeted, specific surveillance and also possible to do more intrusive surveillance,” she told Al Jazeera. “[Today,] surveillance gives you a richer picture of an individual’s life.”

The IFF reviewed a letter also seen by Al Jazeera from India’s Ministry of Home Affairs dated January 7 in which Shah signed off on a wide-ranging, one-year waiver of “make in India” rules to clear a path for buying at least 422 forensic items.

Under “make in India” procurement rules, preference must be given to eligible Indian manufacturers over foreign suppliers in awarding government contracts. However, the rules allow exemptions with the approval of the minister in charge of the procuring department.

Another letter by the ministry dated January 20 showed Shah permitted the National Investigation Agency (NIA) to buy Israeli company Cellebrite’s Premium Tool on a three-year licence for about 50 million rupees ($529,947).

In specifications demanded by the government that were revealed in a review of tender bids, “solution” software must be capable of using login tokens recovered from seized phones or computers to access more than 100 cloud services. Login tokens are in effect digital keys that keep users signed in to online accounts.

Although an exemption for a company does not confirm whether a certain product was purchased by any government agency, it points to the range of forensic capabilities that opened up for procurement by Indian agencies.

From the 422-item exemption list, the IFF identified 118 items under digital and multimedia forensics, including Israeli company Cellebrite’s Pathfinder, Inseyets On-Prem Pro and Inseyets Offline.

Cellebrite’s tools have been used against journalists and activists in countries like Serbia, Jordan, Kenya and Russia.

Other products included tools from foreign digital-forensics companies like Magnet, MSAB, Oxygen Forensics and Belkasoft as well as software for open-source intelligence, dark-web monitoring and cryptocurrency investigations.

Al Jazeera reviewed a request for a bid proposal by the Delhi Police for software for its National Cyber Forensic Laboratory, which comes under the Indian Cybercrime Coordination Centre, an initiative of the Home Ministry.

Consider the capabilities the police department was seeking in its request: software that bypasses passwords on Apple’s macOS, Microsoft Windows and Linux operating systems; recovers internet activity, browser histories, deleted files and identifies traces of VPNs; bypasses screen locks; performs full file system extractions; decrypts backups; and extracts information from messaging applications.

The Delhi Police demanded another “all-in-one” system to access more than 100 cloud services, including Google, Apple, WhatsApp, Instagram, Telegram, Discord and dating platforms such as Tinder, Grindr and OkCupid or platforms like Slack and OnlyFans using account credentials or login tokens recovered from devices. Its specifications also sought the extraction of data from drones, wearable devices and devices like Amazon Alexa and Google Home.

Al Jazeera reached out to officials at the NIA, the Home Ministry and home departments of opposition-ruled states of Himachal Pradesh, Karnataka and Keralam for comments. The Delhi Police reports to Shah’s mInistry.

None of them had responded to Al Jazeera by the time of publication.

For some, the lack of transparency in the surveillance capabilities of India’s security agencies is not just a theoretical concern.

Last month, when Modi’s government faced street protests demanding the election chief resign, popular YouTuber Dhruv Rathee, a Modi critic, landed in New Delhi to participate in the demonstrations.

On the morning of the protest, he was detained by Delhi Police while still at home. His phone was taken from him. Speaking on a podcast later, Rathee said he believed police had tried to clone his iPhone using Israeli company Cellebrite’s tools but the attempt may have failed because his device was running a newer version of the iOS operating system than what the tool was capable of tricking.

Al Jazeera could not verify Rathee’s account, but Rathee is not alone in this suspicion.

Mohammad Aslam Hussain, a reporter with the newspaper Siasat Daily, told Al Jazeera that he was detained with a cameraperson on October 10 in New Delhi and his phone was confiscated at the scene.

“When I got my device later in the evening, all recorded footage of our reporting had been selectively deleted from the device,” Hussain said. The reporter uses Samsung’s Android-operated Galaxy S24 secured with a pattern lock and fingerprint authentication.

Hussain added that he cannot say conclusively what tools the police used to bypass his phone’s authentication requirement. “But it raises several questions with no one willing to respond to them,” he added. “How did they get inside my phone?”

The Indian government has faced accusations that it has used sophisticated spyware against journalists, activists, lawyers and political opponents during Modi’s years in power.

In 2019, WhatsApp disclosed that the Pegasus spyware, developed by the Israeli firm NSO Group, had been used to target Indian journalists and human rights defenders. Forensic examinations by Amnesty International later confirmed Pegasus infections on the phones of journalists Siddharth Varadarajan and Anand Mangnale. The government has denied allegations of unauthorised surveillance.

Bhandari told Al Jazeera that another problem in holding overarching surveillance to account is identifying the affected party. Often, she pointed out, the person placed under surveillance “does not know about it, so what does one do?”

The central legal gap identified by digital rights group IFF is that India has no statute or protocol that specifically authorises or regulates the forced unlocking and full extraction of data from a mobile phone seized by law enforcement agencies.

Existing seizure powers under criminal law do not explicitly address bypassing passcodes, copying an entire file system, harvesting login tokens to access cloud accounts or establishing rules for the retention and deletion of extracted data.

The Supreme Court in a 2017 judgement recognised privacy as a fundamental right under the Indian Constitution. The judgement established that any state intrusion into privacy must have a legal basis, pursue a legitimate state aim and be proportionate to that aim.

Bhandari told Al Jazeera that when the government agencies “deploy these capabilities without any proper meaningful oversight, the net of surveillance is cast wider and deeper and a lot more people are affected without either legislative, parliamentary or judicial oversight”.

Bhandari noted that while some countries like the United Kingdom or Germany “have some element of either parliamentary oversight or judicial oversight, India only has an internal review mechanism in executive oversight”.

“The whole point of having any oversight is to create a friction for surveillance,” she said, “so that it’s not easy for the government to just target everybody.”

“The current legal framework fails in this safeguard,” Bhandari said.