India grants public procurement exemption to foreign forensic technology companies

It has been revealed that the Indian government has granted a one-year exemption from domestic manufacturing rules in public procurement to allow the acquisition of phone data extraction and digital surveillance technologies from Israeli tech company Cellebrite and similar foreign forensic firms.

According to a report by Al Jazeera based on research by the Internet Freedom Foundation (IFF), Home Minister Amit Shah approved the exemption paving the way for public institutions to purchase at least 422 foreign technology products. Despite India's "Make in India" policy, which under normal conditions prioritizes domestic manufacturers in public tenders, exceptions for purchasing foreign products can be granted with the approval of the relevant minister. According to a Ministry of Home Affairs document dated January 7 examined by the IFF, Shah approved a one-year exemption for forensic institutions to purchase foreign tech products. The list includes products from Israeli firm Cellebrite as well as companies such as Magnet, MSAB, Oxygen Forensics, and Belkasoft. Another document dated January 20 shows that Shah authorized the National Investigation Agency (NIA) to purchase the Cellebrite Premium Tool software under a three-year license for approximately 50 million rupees ($530,000).

The software in question has been used to purchase similar tools not only in states governed by the ruling Bharatiya Janata Party (BJP) but also in opposition Indian National Congress-run states of Himachal Pradesh, Kerala, and Karnataka. Tender documents reviewed by Al Jazeera revealed that tools requested by the Delhi police could bypass passwords on Apple macOS, Microsoft Windows, and Linux operating systems, recover deleted files, detect VPN traces, and extract data from messaging applications. The police also requested a system capable of accessing more than 100 cloud services and platforms—such as Google, Apple, WhatsApp, Instagram, Telegram, Discord, Tinder, Grindr, OkCupid, Slack, and OnlyFans—using account credentials or session keys obtained from seized devices. The tender specifications also requested data extraction from smart home devices, wearable technologies, and drones; however, experts noted that a product being on the exemption list does not necessarily mean it was purchased, and that the documents only show the scope of the requested technological capabilities.