India waives make-in-India rules to buy Cellebrite phone-extraction tools

Home Minister Amit Shah signed a one-year waiver on January 7 that exempted the Israeli firm Cellebrite from India’s make-in-India procurement rules, covering at least 422 forensic products and letting agencies purchase phone-extraction and surveillance technology.

On January 20, the National Investigation Agency’s purchase of Cellebrite’s Premium Tool was also cleared on a three-year license priced at about 50 million rupees, or $529,947. Federal agencies and Congress-ruled states including Himachal Pradesh, Keralam and Karnataka bought similar phone-extraction and cloning tools.

According to the Internet Freedom Foundation’s investigation, the 422-item exemption list contained 118 digital and multimedia forensics products, among them Cellebrite’s Pathfinder, Inseyets On-Prem Pro and Inseyets Offline. It also carried offerings from Magnet, MSAB, Oxygen Forensics and Belkasoft, along with software for open-source intelligence, dark-web monitoring and cryptocurrency work.

Delhi Police requested software for its National Cyber Forensic Laboratory, which sits under the Indian Cybercrime Coordination Centre, a Home Ministry initiative. The software can get past passwords on macOS, Windows and Linux, retrieve internet activity, browser histories and deleted files, and spot VPN traces. It also handles full file-system extraction, backup decryption and the pulling of data from messaging applications.

The police also wanted an all-in-one system to enter more than 100 cloud services by using credentials or login tokens pulled from seized devices. The services named in that request include Google, Apple, WhatsApp, Instagram, Telegram, Discord, Tinder, Grindr, OkCupid, Slack and OnlyFans. Police specifications also called for data extraction from drones, wearable devices, Amazon Alexa and Google Home.

The country’s surveillance capabilities cover cloud-based information from Instagram, X and Tinder. They also cover data from connected devices including Amazon Alexa and Google Home. Current Indian laws offer no guardrails against overreaching surveillance, experts said, and data extractions take place in a legal gray zone.

Supreme Court lawyer Vrinda Bhandari, who works on digital rights and privacy, said surveillance powers are spreading wider and deeper, making mass surveillance simpler and more invasive. She said agencies use these capabilities without real oversight, without legislative, parliamentary or judicial review, and that this affects more people. Bhandari said Britain and Germany have parliamentary or judicial oversight elements, unlike India, which relies on internal executive review alone, and that the current legal setup does not build friction to stop mass targeting.

The Internet Freedom Foundation said India lacks any statute or protocol specifically allowing or controlling forced unlocking and complete data extraction from seized mobile phones. Current criminal law seizure powers do not clearly cover breaking passcodes, copying entire file systems, gathering login tokens for cloud accounts, or setting rules for keeping and deleting extracted data. The Supreme Court’s 2017 ruling said privacy counts as a fundamental right under India’s Constitution. Separately, it held that state intrusions require a legal basis, a legitimate aim and proportionality.

Exempting a company does not prove an agency purchased a particular item. It does reveal the forensic capabilities available for buying by government bodies.

In 2019, WhatsApp said Pegasus spyware, made by Israeli firm NSO Group, had targeted Indian journalists and human rights defenders. Amnesty International later confirmed Pegasus infections on the devices of journalists Siddharth Varadarajan and Anand Mangnale. The Indian government denied allegations of unauthorized surveillance. Officials at the National Investigation Agency, the Home Ministry, and the home departments of Himachal Pradesh, Karnataka and Keralam did not respond to Al Jazeera before publication.

Dhruv Rathee, a YouTuber, said he thought Delhi Police tried to copy his iPhone with Cellebrite tools during a protest detention, but the attempt may have failed because his device ran a newer iOS version. Al Jazeera said it could not verify his account.

Mohammad Aslam Hussain, a reporter for Siasat Daily, said police detained him on October 10 in New Delhi and took his phone, and that he later found recording footage selectively deleted. He owns a Samsung Galaxy S24 that runs Android and locks with a pattern and fingerprint, and he said he cannot say for certain what tools police used.