India approves 422-item waiver for foreign phone-extraction tools
Home Minister Amit Shah signed off on exemptions allowing agencies to buy Cellebrite and other digital forensics software, bypassing domestic procurement rules.
By Samuel Hayes ·
A single letter from the Home Ministry unlocked the purchase of over 400 foreign forensic items for Indian law enforcement.
The waiver, approved by Home Minister Amit Shah on January 7, grants a one-year exemption to standard domestic procurement preferences. It covers at least 422 forensic items, allowing government institutions to buy technology from vendors like the Israeli firm Cellebrite. A separate letter dated January 20 authorized the National Investigation Agency to acquire a three-year license for Cellebrite's Premium Tool. The cost for that specific license is approximately 50 million rupees, or $529,947. These exemptions override the government's "make in India" programme, which typically favors eligible Indian manufacturers unless a minister approves an exception.
The Internet Freedom Foundation (IFF) reviewed these documents and found that 118 entries on the exemption list are for digital and multimedia forensic products. The list includes Cellebrite's Pathfinder, Inseyets On-Prem Pro, and Inseyets Offline. It also features software from Magnet, MSAB, Oxygen Forensics, and Belkasoft, alongside tools for cryptocurrency investigations and dark-web monitoring. An exemption confirms a product can be bought, though it does not prove a sale was completed. The IFF noted that opposition-governed states have also purchased similar phone-extraction and cloning tools.
Tender documents reveal the specific capabilities authorities are seeking. A Delhi Police request for its National Cyber Forensic Laboratory asked for software to bypass computer passwords and phone screen locks. The request included tools to recover deleted files, decrypt backups, and extract messaging data. Another specification sought a system to access more than 100 cloud services using credentials or login tokens recovered from seized devices. These services include social networks, messaging apps, and dating platforms. The specifications also cover data from drones, wearables, Amazon Alexa, and Google Home devices.
Concerns have grown about how these tools are used in the field. YouTuber Dhruv Rathee stated that police detained him in October and took his phone. He alleged officers attempted to clone his iPhone using Cellebrite tools, though Al Jazeera could not verify his account. Siasat Daily reporter Mohammad Aslam Hussain said footage was selectively deleted from his Samsung phone after police detained him on October 10. He could not identify the specific technology used. The IFF says India lacks a specific statute or protocol to regulate forced phone unlocking and full data extraction. Existing criminal law seizure powers do not explicitly cover bypassing passcodes or copying entire file systems.
Supreme Court lawyer Vrinda Bhandari told Al Jazeera that expanding technical capabilities allows for more intrusive surveillance without meaningful legislative, parliamentary, or judicial oversight. India's Supreme Court recognized privacy as a fundamental right in 2017, requiring state interference to have a legal basis and be proportionate. The government has denied allegations of unauthorized surveillance. Al Jazeera sought comment from the NIA, the Home Ministry, and home departments in Himachal Pradesh, Karnataka, and Kerala, but received no responses before publication.
The next step in the process is not yet defined by a public schedule, but the one-year exemption period began with the January 7 letter.
