India has ordered all new smartphones to come pre-loaded with a non-removable, state-run cybersecurity app, raising privacy concerns across the nation.
The order, made public on Monday, mandates that smartphone makers have 90 days to ensure all new devices include the government's Sanchar Saathi app, designed to help citizens verify the authenticity of handsets and report suspected misuse of telecom resources.
With over 1.2 billion mobile users in India, this move has garnered criticism from cybersecurity experts, asserting that it breaches citizens' rights to privacy.
Launched in January, the Sanchar Saathi app enables users to check a device's IMEI, report lost or stolen phones, and flag fraudulent communications. An IMEI— the unique 15-digit number that identifies mobile devices— is essential for phone authentication.
The Indian Department of Telecommunications has stated that mobile devices with duplicate or spoofed IMEI numbers pose serious threats to telecom cybersecurity, especially considering the prevalence of a second-hand mobile device market where stolen or blacklisted devices may be re-sold.
The app must be readily visible and accessible during device setup and cannot be disabled or restricted. Smartphone manufacturers are also tasked with updating existing yet unsold devices with the app.
Critics argue that the broad permissions requested by the app raise significant concerns regarding potential surveillance. The advocacy group Internet Freedom Foundation highlighted that the app's design allows invasive access, essentially becoming a standard feature in every smartphone sold in India.
Experts have also pointed out compliance challenges, as it contradicts policies of most smartphone manufacturers, particularly Apple, which historically refuses such government mandates. Reports indicate that Apple intends to voice its concerns to Indian authorities.
This initiative reflects a global trend, as seen in Russia, where state-backed apps are required on all phone sales, echoing similar privacy concerns.
