New Delhi, India – India has exempted an Israeli phone-hacking company from New Delhi’s own rules, allowing it to sell phone-extraction products and surveillance technology to government agencies and sparking concerns and criticism from rights groups and activists. An investigation by the digital-rights group Internet Freedom Foundation (IFF) found Indian Home Minister Amit Shah, a close confidante of Prime Minister Narendra Modi, signed off on exemptions from “make in India” procurement rules, clearing the way for government forensic institutions to buy at least 422 items of foreign technology, including products made by the Israeli firm Cellebrite. Modi’s federal government and state governments ruled by his Bharatiya Janata Party are not the only ones who bought this Israeli technology.
States governed by the opposition Indian National Congress party, including Himachal Pradesh, Keralam and Karnataka, also purchased similar phone-extraction and cloning tools. A review of documents revealed that India’s expansive surveillance capabilities extend far beyond just cloning phones and extracting data without passwords to accessing cloud-based data from social media platforms – such as Instagram, X and Tinder – as well as data from connected devices such as Amazon’s Alexa and Google Home. Experts argued that India’s current laws offer no guardrails against overreaching surveillance and the data extractions happen in a legal grey zone.
Under “make in India” procurement rules, preference must be given to eligible Indian manufacturers over foreign suppliers in awarding government contracts. However, the rules allow exemptions with the approval of the minister in charge of the procuring department. Another letter by the ministry dated January 20 showed Shah permitted the National Investigation Agency (NIA) to buy Israeli company Cellebrite’s Premium Tool on a three-year licence for about 50 million rupees ($529,947).
In specifications demanded by the government that were revealed in a review of tender bids, “solution” software must be capable of using login tokens recovered from seized phones or computers to access more than 100 cloud services. Login tokens are in effect digital keys that keep users signed in to online accounts. Although an exemption for a company does not confirm whether a certain product was purchased by any government agency, it points to the range of forensic capabilities that opened up for procurement by Indian agencies.
From the 422-item exemption list, the IFF identified 118 items under digital and multimedia forensics, including Israeli company Cellebrite’s Pathfinder, Inseyets On-Prem Pro and Inseyets Offline. Cellebrite’s tools have been used against journalists and activists in countries like Serbia, Jordan, Kenya and Russia. Other products included tools from foreign digital-forensics companies like Magnet, MSAB, Oxygen Forensics and Belkasoft as well as software for open-source intelligence, dark-web monitoring and cryptocurrency investigations.
Al Jazeera reviewed a request for a bid proposal by the Delhi Police for software for its National Cyber Forensic Laboratory, which comes under the Indian Cybercrime Coordination Centre, an initiative of the Home Ministry. Consider the capabilities the police department was seeking in its request: software that bypasses passwords on Apple’s macOS, Microsoft Windows and Linux operating systems; recovers internet activity, browser histories, deleted files and identifies traces of VPNs; bypasses screen locks; performs full file system extractions; decrypts backups; and extracts information from messaging applications. The Delhi Police demanded another “all-in-one” system to access more than 100 cloud services, including Google, Apple, WhatsApp, Instagram, Telegram, Discord and dating platforms such as Tinder, Grindr and OkCupid or platforms like Slack and OnlyFans using account credentials or login tokens recovered from devices.
Extract — continue reading at the source.
