India Mandates Pre-Installed Cybersecurity App on New Smartphones

The Indian government has mandated that all new smartphones sold in the country must come pre-installed with a state-run cybersecurity application called Sanchar Saathi. This directive, announced by the Department of Telecommunications (DOT), requires smartphone manufacturers to ensure compliance within 90 days. The app is designed to assist users in verifying the authenticity of their devices and reporting suspected misuse of telecom resources, but it has sparked significant privacy and surveillance concerns among experts and citizens alike.

Privacy advocates have raised alarms about the app's extensive permissions, which allow it to access a range of device functionalities. According to the app's privacy policy, it can manage phone calls, send messages, and access the device's camera and location, among other features. The Internet Freedom Foundation, an advocacy group, has labelled the app's requirements as an infringement on user rights, stating that it effectively turns every smartphone into a tool for state surveillance that users cannot refuse or control meaningfully.

In response to the growing backlash, India's Minister of Communications, Jyotiraditya Scindia, clarified that the app will not be mandatory. He stated on social media platform X, "This is a completely voluntary and democratic system - users may choose to activate the app and avail its benefits, or if they do not wish to, they can easily delete it from their phone at any time." However, concerns remain regarding how users can disable the app's functionalities if they cannot be restricted or removed.

Launched in January, the Sanchar Saathi app aims to mitigate issues related to smartphone security in a country with over 1.2 billion mobile users. The app allows users to check their device's International Mobile Equipment Identity (IMEI), report stolen phones, and flag fraudulent communications. The IMEI is a unique identifier for mobile devices, essential for authenticating them on cellular networks.

The government has argued that the app's implementation is crucial for enhancing telecom cybersecurity, particularly in light of the significant second-hand smartphone market in India. The DOT has expressed concerns about the sale of devices with duplicate or spoofed IMEI numbers, which can pose serious risks to users and the telecom sector. The department stated that such practices could financially harm consumers who unknowingly purchase stolen or blacklisted devices.

Despite the government's assurances regarding the app's intentions, experts have highlighted the potential for abuse given its broad permissions. Technology analyst Prasanto K Roy noted, "We can't see exactly what it's doing, but we can see that it's asking for a great deal of permissions - potential access to just about everything from flashlight to camera. This is itself worrying."

The app's launch comes amid a global trend of increasing scrutiny over state surveillance and privacy. In August, Russia implemented similar measures, requiring devices sold in the country to feature a state-backed messaging application. India's move, however, appears to be particularly controversial due to the scale of its smartphone market, which is predominantly dominated by Android devices, although Apple’s iOS accounts for a small percentage.

Compliance with the government's order could be challenging for manufacturers, as it contradicts the policies of many major companies, including Apple. Reports suggest that Apple intends to communicate its concerns regarding the mandate to the Indian government, signalling potential pushback from major players in the smartphone market.

As the deadline for compliance approaches, the Indian government must address the growing concerns over privacy and the implications of its surveillance measures. With a vast number of users and a rapidly evolving technological landscape, the balance between security and individual rights remains a pressing issue in India's digital future.