Sanchar Saathi Mandate Expands Device Tracking, Not Security
The Indian government’s new order mandating the installation of a new citizen service app, “Sanchar Saathi”, offers no advantage to the public, while forcing smartphone manufacturers to record every device with the government.
India already tracks every telecom connection through KYC requirements for purchasing and activating a SIM card. This order goes beyond telecom networks to regulate all online communications (including OTTs), as outlined under the amended new Telecommunications Act, 2023.
The instructions for mandatory app installations, sent to all smartphone manufacturers, have been followed by orders to WhatsApp and Telegram to bind SIM cards to telephone numbers, as required by the Telecommunication Identifier User Entities or TIUE obligations under the Telecommunication Cybersecurity Rules, 2024.
This new set of rules aims to stop fraudulent phone calls, which have led to "digital arrests" and other scams. Many of these scams occur on WhatsApp, a platform where device IMEIs are not available, making scammers untraceable. The rules also require WhatsApp to auto log off from all web sessions every six hours.
The requirement to bind SIMs and mandatorily install Sanchar Saathi aims to collect information on fraudulent and spam phone calls received by consumers.
Another feature of Sanchar Saathi – SIM binding to IMEI numbers – allows stolen phones to be recovered. The Department of Telecom’s new Central Equipment Identity Register (CEIR) has extensively experimented with this feature. The CEIR is the telecom equivalent of the Central Identities Data Repository (CIDR), which holds all our biometric data for Aadhaar.
The CEIR facility has been heavily used by the police to track stolen phones by tracking their IMEI numbers. Telecom service providers collect this data with the help of SIM cards, and share it with police. A new SIM card in a stolen phone thus helps police identify its current user – thanks to SIM binding with the IMEI number.
Also read: Maharashtra BJP Leader's 'Your Every Word is Monitored' Remark Raises Questions on Surveillance
The police have extensively used this service to restore stolen mobile phones to their rightful owners.
The police also use telecom infrastructure to track how many mobile phones an individual possesses – for instance, to demand devices during digital device seizures for criminal investigations.
The Enforcement Directorate also often requires arrested politicians to submit all their previous phones (devices) with their recorded IMEI numbers. From the moment a SIM card is inserted into a phone, its data begins to be collected.
The Sanchar Saathi app now enforces this data collection – by binding a phone's IMEI number with the SIM number. This could potentially help reduce some cyber frauds originating from domestic cell phone numbers. However, it comes at a great cost – a further reduction in individual privacy.
It also sets a dangerous precedent, allowing the government to make similar demands in the future.
There is a growing pushback from the industry against this order, and it is unlikely to be enforced due to the public opposition. Apple Inc. has reportedly refused to follow the instructions and install Sanchar Saathi on its iPhones.
Other foreign manufacturers are likely to follow Apple's lead, though some domestic manufacturers may comply with the order to demonstrate their allegiance to the Indian state and its sovereignty.
The government's increased push for sovereign control over all forms of electronic infrastructure has already curtailed individual freedoms in India. The latest orders represent yet another step towards greater government control.
The telecommunications minister claims that Sanchar Saathi can be uninstalled or that its use is optional or voluntary. However, we all know that what starts as voluntary can quickly become mandatory in India.
While the state enforces a new app mandate, we must ask what could be achieved by older apps, such as the telecom regulator TRAI’s Do-Not-Disturb (DND) app. The DND app was also enforced on all phone manufacturers, and Apple had to modify its APIs to allow this app to report spam calls.
Also read: Pegasus Episode Should Not Make You Give Up Hope of Communicating Securely
Mandatory apps don’t help, yet the state is using – and misusing – this new telecom infrastructure to exert greater control over our digital lives.
Those seeking true privacy understand that they shouldn’t even insert a SIM card into a newly-purchased phone. I maintain multiple phones without SIMs to ensure the state has no record of them and that their identities are not linked to me.
True cybersecurity comes from privacy. What the state is pushing is cyber sovereignty – granting greater control to the state over citizens.
Anyone looking to escape these mandatory app installations can explore the Graphene OS project and buy a new phone running this operating system – without ever installing a SIM in it. This approach is about taking control of your own electronic devices rather than letting the state determine which applications it will force into your phone. All state-sponsored appware is some form of state-sponsored spyware.
Srinivas Kodali is a researcher on digitisation and a hacktivist.
This article went live on December second, two thousand twenty five, at nine minutes past nine at night.The Wire is now on WhatsApp. Follow our channel for sharp analysis and opinions on the latest developments.
