New Delhi: The Indian government has granted exemptions from domestic procurement rules to facilitate the acquisition of sophisticated Israeli digital-forensic technology capable of unlocking mobile phones, extracting personal information and accessing data stored on cloud platforms. The decision, which reportedly received approval from the Union home minister, Amit Shah, has renewed concerns over the expanding surveillance capabilities of Indian law-enforcement agencies and the absence of clearly defined safeguards against their misuse.
According to an Al Jazeera investigation, documents examined by the digital-rights organization Internet Freedom Foundation (IFF) show that the Ministry of Home Affairs authorized exemptions covering at least 422 foreign forensic products, including technology developed by the Israeli company Cellebrite. The exemptions permit government agencies to procure specified imported equipment without following the usual domestic-preference requirements under the Make in India procurement framework.
A ministry communication dated January 7 this year, reportedly recorded Shah’s approval for a one-year exemption covering the products, of which 118 were identified as digital and multimedia forensic tools. A separate authorization dated January 20 permitted the National Investigation Agency to procure Cellebrite’s “Premium Tool” through a three-year licence valued at approximately ₹5 crore.
The distinction between procurement authorization and completed purchases is important because inclusion in an exemption list does not establish that every product was acquired or deployed. Moreover, the “Make in India” framework itself provides for exemptions with ministerial approval, meaning that the decisions do not, by themselves, establish a violation of procurement law.
From seized phones to cloud accounts
The technology involved goes considerably beyond conventional forensic examination, which ordinarily involves retrieving information from a device already accessible to investigators. Cellebrite’s products are designed to extract information from compatible smartphones, including certain password-protected devices, and help investigators analyse communications, files, contacts and other digital records.
Documents reviewed in the investigation also describe requirements for systems capable of using recovered authentication tokens to access more than 100 cloud-based services. Such tokens can sometimes enable access to accounts without requiring users to enter their passwords again, potentially exposing information stored on platforms such as WhatsApp, Instagram, Telegram and Tinder.
The Delhi Police’s procurement specifications reportedly sought capabilities to recover deleted files, decrypt backups, examine internet histories and extract information from computers running Windows, macOS and Linux. They also covered connected devices, including smart-home assistants, wearables and drones, indicating an increasingly broad approach to digital evidence collection.
Such capabilities can be valuable in investigating terrorism, organized crime, financial fraud and cyberattacks, particularly when suspects use encrypted devices or distribute evidence across multiple online accounts. However, extracting an entire device’s contents can also expose information unrelated to an investigation, including confidential journalistic material, professional communications and the personal information of third parties.
The investigation indicates that interest in these technologies extends beyond the central government and states governed by the BJP. Opposition-governed states, including Karnataka, Himachal Pradesh and Kerala, have also reportedly purchased comparable digital-extraction systems, suggesting that their adoption cuts across political divisions.
Privacy concerns and international controversy
The controversy has also drawn attention to earlier allegations of surveillance targeting journalists and political activists in India, particularly those involving the Israeli-developed Pegasus spyware. In 2019, WhatsApp disclosed that Indian journalists and human-rights defenders had been targeted, and subsequent forensic investigations by Amnesty International identified Pegasus infections on the devices of Indian journalists.
Cellebrite’s technology is distinct from Pegasus, which is designed for covert remote surveillance, but its potential for abuse has attracted international scrutiny. In December 2024, Amnesty International documented how Serbian authorities had used Cellebrite equipment to unlock phones belonging to journalists and activists, sometimes facilitating the installation of additional spyware.
Following those findings, Cellebrite restricted access to its products for certain customers in Serbia in February 2025. The company has maintained that its products are intended for lawful investigations and do not themselves install malware or conduct continuous remote surveillance.
Legal vacuum raises difficult questions
India’s Supreme Court recognized privacy as a fundamental right in its landmark 2017 Puttaswamy judgment, establishing that state interference must satisfy requirements of legality, legitimate purpose and proportionality. However, digital-rights advocates argue that India’s existing legislation does not adequately specify when investigators may forcibly unlock devices, copy their complete contents or access associated cloud accounts.
The latest investigation also cited allegations from individuals whose phones were confiscated during recent protests in New Delhi, including YouTuber Dhruv Rathee and journalist Mohammad Aslam Hussain. However, the technology allegedly used on their devices has not been independently established, and the accounts cannot be treated as proof of unauthorized forensic extraction.
The MHA, NIA and several state authorities had not responded to Al Jazeera’s requests for comment when its investigation was published. No subsequent official clarification establishing the precise extent of the acquisitions or the safeguards governing their deployment could be independently verified for this report.
The central issue, therefore, extends beyond India’s decision to purchase foreign technology despite its domestic manufacturing priorities. It concerns whether investigative agencies possessing increasingly intrusive digital capabilities are subject to sufficiently transparent legal procedures, independent oversight and enforceable restrictions on the collection and retention of personal information.