India Waives Local Sourcing Rules to Procure Foreign Surveillance Tech

New Delhi — India’s Ministry of Home Affairs has granted exemptions from national procurement rules requiring preference for domestic manufacturers, allowing state and federal law enforcement agencies to acquire foreign digital forensics and phone-hacking tools. Documents obtained by the digital rights organization Internet Freedom Foundation show that Home Minister Amit Shah authorized waivers clearing at least 422 foreign technological items for procurement. The exempted list includes specialized software developed by Israeli firm Cellebrite as well as products from international forensic vendors such as Magnet, MSAB, Oxygen Forensics, and Belkasoft.

Under the approved waivers, the National Investigation Agency acquired Cellebrite’s Premium Tool on a three-year license valued at roughly 50 million rupees ($529,947). Tender specifications issued by the Delhi Police indicate that authorities sought capabilities to bypass screen locks, extract full file systems, and use recovered login tokens to access more than 100 cloud services, including social media accounts and messaging applications. The technical requirements also encompassed data extraction from smart home devices, wearable electronics, and unmanned aerial vehicles.

The procurement of foreign extraction technology is not limited to central authorities under the ruling Bharatiya Janata Party. State governments governed by the opposition Indian National Congress, including Karnataka, Himachal Pradesh, and Keralam, have also purchased mobile data extraction systems. The technology enables law enforcement to retrieve encrypted communication records, location history, and cloud data without requiring user passwords.

Privacy advocates and legal professionals have raised concerns regarding the absence of specific statutory frameworks governing mobile device extractions in India. Supreme Court advocate Vrinda Bhandari pointed out that current laws provide no explicit procedures for data retention or compulsory passcode overrides, leaving oversight entirely within executive review mechanisms. While a 2017 Supreme Court ruling established privacy as a fundamental right requiring legislative backing and proportionality for state intrusions, no specialized judicial authorization process has been established for device cloning.

The Ministry of Home Affairs, the National Investigation Agency, and regional police departments did not respond to requests for comment regarding the procurement exemptions or the deployment of these tools. In previous responses to allegations concerning the deployment of commercial spyware systems like NSO Group's Pegasus in 2019, the Indian government stated that it does not engage in unauthorized surveillance activities.

Written by Thomas Nussbaumer thomas.nussbaumer@alpineweekly.com