India's Backtrack on Cyber Security Rules

"Accounts on instant messaging and calling apps continue to work even after the associated SIM is removed, deactivated, or moved abroad, enabling anonymous scams, remote 'digital arrest' frauds and government‑impersonation calls using Indian numbers."

"Long‑lived web/desktop sessions let fraudsters control victims' accounts from distant locations without needing the original device or SIM, which complicates tracing and takedown. A session can currently be authenticated once on a device in India and then continue to operate from abroad, letting criminals run scams using Indian numbers without any fresh verification."

"This mechanism enables service providers to validate, through a decentralized and privacy-compliant platform, whether a mobile number used for a service genuinely belongs to the person whose credentials are on record – thereby enhancing trust in digital transactions."

Department of Telecommunications, India  Monday

 

"Government has decided not to make the pre-installation mandatory for mobile manufacturers." 

India's Ministry of Communications  Wednesday 

 

"This is a welcome development, but we are still awaiting the full text of the legal order that should accompany this announcement, including any revised directions under the Cyber Security Rules, 2024."

"For now, we should treat this as cautious optimism, not closure, until the formal legal direction is published and independently confirmed." 

Internet Freedom Foundation  

Sanchar Saathi app logo and Indian flag appear in this illustration taken December 2, 2025. REUTERS/Dado Ruvic/Illustration

"[The app] 'Sanchar-Saathi', translated 'communication partner' in Hindi, [must be] preinstalled on all mobile handsets manufactured or imported for use in India."

"[Phone makers are asked to ensure the app is readily visible and accessible to the end users at the time of first  use or device  setup and that its functionalities are not disabled or restricted."

"[For those devices already manufactured and in the market across the country], the manufacturer and importers of mobile handsets shall make an endeavour to push the App through software updates."

Government of India declaration 

 

"[The order] represents a sharp and deeply worrying expansion of executive control over personal digital devices."

The state is asking every smartphone user in India to accept an open-ended, updatable surveillance capability on their primary personal device, and to do so without the basic guardrails that a constitutional democracy should insist on."

Internet Freedom Foundation  advocacy group

 

"[The rules are] clearly [an invasion of privacy]." 

"How do we know this app isn't used to access files and messaging on our device, which is unencrypted on device? Or a future update won't do that?"

"This is clearly an invasion of our privacy."

Cybersecurity analyst Nikhil Pahwa 

Internet privacy groups and political opposition had raised concerns that the app could be used as a mass surveillance tool. Photograph: Firdous Nazir/NurPhoto/Shutterstock

 

Smartphone makers on Monday received orders from New Delhi to henceforth pre-install the government-operated cybersecurity app, one that cannot be removed. India's mobile phone users number a massive 1.6 billion. According to government authorities, the app is meant to protect users from fraud; an ostensibly laudable concern meant to protect Indian citizens. Manufacturers were given 90 days to comply with the new rules detailed in a press release.

 

The app, it was explained. was specifically designed so that users could block and track lost or stolen phones. It also enables them to identify and disconnect false mobile subscriptions in their name, as well as a number of other protective functions. According to government figures, the app had to date assisted in the tracing of over 2.6 million phones. Statistics that failed to placate human right advocates and those politicians alarmed over the prospect of the possibility of  emerging serious consequences.

 

Opponents of Prime Minister Narendra Modi in the Congress party lost no time in demanding an immediate rollback of the order they described as unconstitutional. "Big Brother cannot watch us",  said Congress politician K.C. Venugopal. "A preloaded government app that cannot be uninstalled is a dystopian tool to monitor every Indian. It is a means to watch over every movement, interaction and decision of each citizen."

 

It is, in fact, a carbon copy of what pertains in China, where the Peoples' Republic monitors all of its equally numerous citizens' every move, in the world's largest, most populous communist country, and India's nemesis. As it happens, Russia issued a similar directive in August that ordered manufacturers to include a messaging platform named MAX on all new phones and tablets; yet another dictatorial regime intent on surveilling its public.

 

The backlash from cybersecurity experts was swift and condemnatory, however, in democratic India despite that 14 million users had downloaded the app, and that 2,000 frauds were being reported daily. Passed last week, made public on Monday, making registration mandatory, by Tuesday 600,000 new users registered. And by Wednesday, the order was rescinded

And nor were smartphone giants Apple and Samsung among others pleased; the new directives causing them to resist the app pre-installation on their phones.Condemnation and resistance that led the government by Wednesday to rescind the directive even while arguing that the move was necessary to verify the authenticity of handsets. India IS a democracy, after all and sensitive to any questioning of its upholding of democratic citizens' rights. 

India has 1.2 billion mobile users   Bloomberg via Getty Images