It came to light, on December 1, that the Department of Telecommunications has asked all mobile handset manufacturers and importers to pre-install a government-mandated app, the Sanchar Saathi, on all mobile phones that come to India.

The founder-director of the Internet Freedom Foundation, Apar Gupta, discusses with us whether we should be concerned about this new move. 

Edited excerpts from the interview are as follows.

I want to start with the basics. This was an app that was launched by the Department of Telecommunications in January and it has come to light yesterday, first through a Reuters report and later through a Ministry of Communications press release, that now the government has mandated that it has to be pre-installed on all mobile handsets. They’ve said that this is so that people can know that the device they’re using is genuine – the handset is genuine – but there are going to be no features for you to remove it or even restrict it in any way.

Can you talk about what an app like this means? What does it do really?

So, the Sanchar Saathi app right now is available for download both on the Google Android store as well as the Apple app store and people can basically download it. There are several functionalities, for instance, if there’s a call you get for these kinds of cyber error scams, you can use a functionality called ‘Chakshu.’ You can report if your number and name is being used for creating multiple SIM cards and connections. So, it is in a sense a cyber security app but there are also a lot of reviews that the functionality which is promised does not work really well, and Jahnavi actually, a lot of the functionality also exists on the Sanchar Saathi website.

So it’s not just an app, it also exists as a standalone website. So essentially what the government is trying to do...it’s trying to provide you a way in order for you to feel a little much more secure, get to know who all are using a mobile number under your name or also if this handset which you’re using is genuine or not. The IMEI number, which is there, the unique identifier which is there on a handset, which is being sold to you, does that match the actual handset which is there.

There have been some questions raised about whether the government should be pre-installing an app on all mobile phones in use in a country. I think some reports have said that there is such an app exists in Russia and that is one global precedent that perhaps people wouldn’t be so keen to follow. What are your thoughts on this?

So, the first thing is that that the direction which has been issued on 21st of November has only been made public on December 1st after a Reuters report. So, this direction was issued secretly under the Telecommunications Rules which were issued last year in 2024 and undermine any kind of transparency. Because even if it has been issued to mobile handset manufacturers and sellers, the impact which is felt directly is on the smartphone user in India, every ordinary Indian.

And the direction because it is requiring a mandatory installation of the application which is being made by the government, also then, immediately gives rise to several forms of risk because the permissions which may be there in that or the changes which may be there in that are also indicated in this direction, to be in a way not removable by the user. So, even when the app comes installed, you do not have the ability at a later point in time to remove it and this, by itself, undermines any users autonomy but also gives risks of any kind of change in the app over a period of time in which your device permission such as the ability of the application to scan all of your photos, read all your messages, undermines your privacy. This is there in a clear way, in clear expressions contained within the directions.

So, this is why there has been such a high amount of public alarm and even if there is an application which is mandatory, installed on smartphones, let’s say in Russia, I don’t think it’s the best example of how any kind of regulation should be implemented in a democratic country like India, which has a fundamental right to freedom of speech and expression and has a fundamental right to privacy as well.

If you were to list maybe the two or three top concerns you have, based on this directive, what would they be?

So, the first which I have is that, it converts every smartphone into a vessel for state-mandated software that the user cannot meaningfully refuse, control, or remove. So you’re not in control of your smartphone. It makes it a Pandora’s box and it is being opened by the state.

The second is that the changes which may be there in the application are not limited by any law. Which means that because this application is installed by a direction which has been sent to smartphone manufacturers and sellers, you are not in control, the application is not bound by any law.

So Sanchar Saathi has not been created under the purview of a legislative mandate. It has not been created under specific rule-making power. Hence, the functionality can change any time. So, the state can quite simply send an upgrade on the app store and the app changes and while a lot of people may trust the government and say that the government will not scan in their pictures, it’s not interested in their private life, at the same time, upgrades to the application may introduce a vulnerability into your device. Because software upgrades, specifically from the government, or for an application which is not tested, which is mandatorily installed and you can’t remove it can result in a lot of the same security flaws that they’re trying to fix.

And finally, if you look at the purpose for which the application has been stated, needs to be mandatorily installed which is to verify IMEI numbers and to detect fake handsets as is being claimed – SMS-based systems, or your mobile services or USSB codes are very technical ways. This can already be done in a less invasive and much more proportional way of meeting the objectives of cyber safety, of cybersecurity. Forcing a permanent app installation for a one-time verification or a sporadic verification function is a substantive overreach and in many ways it would also be conflicting with the Supreme Court’s judgement in K.S. Puttaswamy versus Union of India which reaffirmed the fundamental right to privacy and required any invasion of privacy to be done in the least restrictive form possible.

You are a lawyer who works in this field. But for citizens who spend a lot of their time on their cell phones which have become so much of a part of everyone’s daily lives, and who do now have a Supreme Court-mandated fundamental right to privacy, what do you think the next step should be, how should we go about this?

In times like this when we see every week there’s some fresh hell regarding our digital lives, what is important is that for people not to give up hope and to engage in the conversation around that issue from the perspective that there is change which is possible.

If you do tag your public officials, your local MPs, members of parliament, or even the minister-in-charge which is Jyotiraditya Scindia and ask for accountability, I do think the government reconsiders. So, it’s very important let your friends know and especially those friends who say, “Kuch nai hoga, nothing’s going to change, you can raise your voice, why do you care your data is anyway." Challenge that level of cynicism, engage on it as a policy issue on which change is possible.

So, I think that’s the most important thing a person can do. The risks which are emerging from this is really something which everyone should think about. Suppose, today the government gets away with this power of getting an app all the time on your smartphones, tomorrow, it can basically demand what your smartphone should look like completely. It can demand that 20 apps should be there and what should not be installed as well – the latter it does through website blocking, which is opaque and secret. But then from the point your purchase a smartphone, it will determine how your smartphone works, which is a part of your daily lives and that according to me is what it would be like living in a modern dictatorship.

So, more people need to speak up on it. More people need to be engaged on it, with a degree of hope that change is possible.

Also read: Govt Wants Us to Have Its Cybersecurity App on Our Phone. Here Are the Times it Has Failed to Safeguard Our Data

You know cyber security has been a growing concern, we’ve seen several frauds being reported in, of course across the world, but definitely in India. It has been a growing issue. So, what should the government be doing? If you’re saying that this is perhaps not the best way to deal with it, what would be some better ways?

The best way would be public consultation, for experts to be invited, for a high degree of transparency on policing in India.

What does policing mean in India? Why do we not find a level of trust and comfort after 75-76 years of Independence in approaching a police station? This is a common experience for many. I’m saying this as a privileged, English-speaking person. So, it is a deeper policing issue, I would say. Are there enough people in our police departments who are well-trained?

Of course, there’s a technical side to this problem as well, right? But this all needs to be openly debated rather than pushing down authoritarian and surveillance applications onto our smartphones.

Another thing which is important for us to consider is that so many elements of our data are captured in so many public databases which are kept by the government and which have suffered data breaches. And the data protection law even now will take over 18 months to be completely implementable. Will there be any possibility of a data protection authority to levy a fine on a government department which has leaked our data – which is the very basis of why a lot of these cyber thefts take place?

One of the first few sentences a cyber scammer makes to a person who’s usually a victim is, 'We are calling from your bank, this is your bank account number, I’m your relationship manager, this is how much money you have there, this is your PAN account number' and try to establish trust.

Or even if it’s a police officer in a digital arrest scam, they also adopt these methods in which they already have personally identifiable information which usually an ordinary person does not have. So, I think it requires a high degree of transparency. There is a very real threat. There are a high number of people who are being scammed. There’s a sense of insecurity today online.

At IFF we quite often come across people who are facing different kinds of threats online and I would say that it requires a look at modern policing. What should policing look like? Because this is not a problem which can be fixed with an app. Even if this app is everything it would be a very technocratic solution and will only take into account those people who have smartphones, right? What happens to a lot of people who are scammed on feature phones? So, I would say that this does not fix the problem at all.

Thank you so much, Apar. We are going to continue following this issue and how this app goes forward – whether it is indeed mandated and will come into all our phones very soon. Thank you so much for breaking this down for us.

Thank you so much.

The Wire is now on WhatsApp. Follow our channel for sharp analysis and opinions on the latest developments.