Several months ago, India's digital governance landscape was jolted by an unusual experiment in the control of state-controlled devices, one that briefly shifted the conversation from telecommunication networks to the mobile phones carried in consumers' pockets during the conversation.
It has been instructed that all mobile handsets intended for the Indian market be shipped with a pre-installed government-developed security application called Sanchar Saathi, which is a technology shield against the use of cell phones. This was an initiative that is being positioned by the Indian Government as a technological protection against cell phone crimes.
According to the app's promotional materials, Communication Partner (which translates to Communication Partner) was created to help users, particularly those in the mobile sector, counter mobile phone theft, financial fraud, spam, and other mobile-led scams that, as a result, have outpaced traditional police efforts.
Further, the Department of Telecommunications (DoT), the regulatory authority responsible for overseeing the mandate, stated that the application’s core functionalities could neither be disabled nor restricted by end users, effectively making the application a permanent component of the operating environment, effectively classifying it as such.
A 120-day deadline had been set for device makers to submit a detailed compliance report, including a system-level integration assessment, an audit confirmation and a detailed compliance report.
It is important to note, however, that the order, which was originally defended on the basis of cybersecurity, quickly encountered a wave of public and political opposition.
Leaders of opposition, privacy advocates, and digital-rights organizations questioned the proportionality of this measure as well as the inherent risks associated with compulsory, non-removable state applications on personal devices, as well as stating that such software could be used to collect mass data, track real-time locations, and continuously profile people's behavior.
It did not take long for the Department of Transportation to retract the mandatory installation requirement after a short period of time, stating that users had already accepted the application and that mandatory pre-installation was not required. Despite the swift withdrawal, the policy failed to quell wider unrest, amplifying fears that the policy reflected a deeper intention to normalize state access to private hardware with the rhetorical background of crime prevention, rather than quell it.
Many commentators pointed out the uneasy similarities between this situation and the surveillance state described in George Orwell's 1984, where oversight is not only a default state of affairs but a matter of course. Several commentators feared that the episode was a sign that an eventual future where the individual might lose control over their personal technology to government-defined security priorities could be envisioned.
Many experts, however, believe that the controversy involves not just a single application, but rather a precedent that the application tries to set-one that raises fundamental questions about the role of technology in society, whether this is a legitimate right, and the limits of privacy of citizens in the largest democracy in the world.
Additionally, the mandate extends beyond new inventory, in that already in circulation handsets must be updated to accommodate the government application through software updates. As a result of the accompanying provisions, it is explicit that users and manufacturers cannot disable, limit, or obstruct its core functionalities.
The directive, which was conceived as a measure to strengthen cyber intelligence and combat cyber fraud, has sparked a widening discussion among security researchers, civil-rights activists, and technology policy experts over the past few months.
It has been reported that some security researchers, civil-rights advocates, and technology policy experts are warning that such state applications, which are compulsory and non-removable, will markedly alter India's approach to digital governance in a profound way, blurring longstanding boundaries between security objectives and individual control over private technology.
After abruptly reversing its policy on Wednesday, the Indian government withdrew the directive that had instructed global smartphones manufacturers such as Apple and Samsung to embed a state-developed security application into all mobile handsets sold in the country.
Several opposition lawmakers and digital-rights organizations, including those from the opposition party, reacted violently to the decision following a two-day backlash in which it was claimed that the Sanchar Saathi application, which means "Communication Partner" in Hindi, was not intended for security purposes but rather for surveillance purposes by the state.
In response to the mandate, critics from across the political aisle and privacy advocacy groups had publicly attacked the directive as an excessive intrusion into personal devices, claiming that the government was planning to "snoop on citizens through their phones."
In response to mounting criticism, the Ministry of Communications issued a statement Wednesday afternoon confirming that the government had decided not to impose mandatory pre-installation, clarifying that manufacturers would no longer be bound by the order.
As it was first circulated confidentially to device makers late last month, the original directive came into public discussion only after it was leaked to domestic media on Monday.
According to the order, new handsets were required to comply with the requirement within 90 days of its release, and previously sold devices were also required to comply via software updates. This order was explicitly stating that key functions of the app cannot be disabled or restricted in order for them to be compliant with the rules.
Despite the fact that the ministry had positioned the policy in a way that was supposed to protect the nation's digital security, its quiet withdrawal signifies a rare moment in which external scrutiny reshaped the state's digital policy calculus, emphasizing the importance of controlling personal technology, especially in the world's second largest mobile market.
When the directive was first circulated to industry stakeholders, it was positioned to provide a narrow compliance window for new devices, but set a much more stringent requirement for handsets already in use. For manufacturers to ensure that all new units, whether they were manufactured in the factory or imported into India, carried the Sanchar Saathi application by default, they were given 90 days to do so.
When the unsold devices had already been positioned in retail and distribution pipelines, companies were instructed to deliver the software retroactively through system updates to ensure that the devices were present throughout the supply chain, ensuring that they were present across supply chains. The policy, if it had been enforced, would have standardized the tool throughout one of the world’s largest mobile markets.
Over 735 million people use smartphones every day.
Government officials defended the mandate as a consumer protection imperative, arguing that it was necessary to protect consumers from telecom fraud based on duplicate or cloned IMEI numbers - 14 to 17 digit identification codes for mobile phones - which are the primary authentication codes on mobile networks.
With the Sanchar Saathi platform, linked to a centralized registry, users can report missing smartphones, block stolen devices, block suspicious network access, and flag fraudulent mobile communications that have been sent.
There was also evidence that it was necessary to launch the app in the first place: according to government data, since the app was launched in January, it has been able to block more than 3.7 million lost or stolen phones, and over 30 million illicit mobile connections have been terminated, including scams involving telecom companies and identity frauds associated with the app.
Despite this, the mandate put India at odds with Apple, a company whose history is characterized by a reluctance to preload government and third party applications on its products, citing ecosystem integrity and operating system security as key concerns.
In spite of Apple's relatively small share of the India smartphone market share of 4.5%, it holds a disproportionate amount of weight in global discussions about secure device architectures.
Several industry insiders have noted that Apple's internal policies prohibit the inclusion of external software before the retail sale of the product, making regulatory friction a probable outcome.
It was believed in the beginning that New Delhi would eventually sway Apple's pre-installation requirement, replacing it with optional installation prompts or software nudges which could be delivered at the operating system level, replacing mandatory pre-installation.
A security researcher who spoke on condition of anonymity argued that negotiations could lead to a midpoint.
Rather than imposing a mandate, they might settle for a nudge, the researcher said, echoing broader industry assumptions that the policy would prove to be more malleable in practice than it initially appeared. Privacy advocates, however, felt that the short lifespan of the order did not diminish its significance despite the fact that its duration was relatively short.
Organizations that represent civil society have warned that non-removable, mandatory state applications - even when they present themselves as essential tools to combat fraud - may affect the normalization of a level of technical authority over individual devices that extends well beyond the prevention of telecom crimes.
A quick comparison was drawn between Russia's recent requirement that a state-backed message application be embedded into smartphones and similar software standardization efforts in Russia and Russia-aligned regulatory environments, among other examples. According to Mishi Choudhary, a lawyer specializing in technology rights, "The government removes user consent as a meaningful choice, encapsulating the core argument from digital rights groups," he said.
Prior to the order being leaked to Indian media, the Ministry of Communications, which issued it on a confidential basis, declined to publicly release the entire directive or make any substantive comments regarding privacy issues. Critics contend that this silence compounded fears by leaving behind an impression of regulatory overreach that was not tempered by clarified safeguards, but by political optics.
The episode of the cybercrime crisis continued to evoke questions about the transparency in cybersecurity policymaking, the future of digital consent, and the precedent that would be set when state security frameworks began to reach into the software layer of personal hardware in a democracy already struggling with rapid digitization and fragile public trust, even after the government announced it would not enforce pre-installation requirements anymore.
A number of technology policy analysts also issued important warnings about the mandate, arguing that the risks lay not just in the stated purpose of the application but in the level of access it may be able to command in the future.
Prasanto K. Roy, a specialist in India's digital infrastructure, who maintains a long-term study of the country's regulatory impulses, characterized the directive as an example of a larger problem: the lack of transparency about what state-mandated software might ultimately be allowed to do on the hardware of individual users.
During an interview, Roy commented on the report that while Sanchar Saathi's internal workings are still unclear to the public, the permissions it seeks indicate that it is worth exercising caution. Despite the fact that we are not sure exactly what it is doing, we can see that it is asking for a lot of permissions from the flashlight to the camera which suggests that it has the potential to access almost everything.
“That alone is problematic,” he added, reflecting a growing consensus among cybersecurity researchers that expansive access requests carry structural risks when they are connected to applications that aren’t subject to independent audits or external oversight, even when explained as security prerequisites.
According to the Google Play Store's declaration, the application does not collect nor share user data, a statement which the government cited in its initial defense of the policy.
The government, however, has limited its public communication around the order itself, which has exacerbated questions about consent and scope.
A BBC spokesperson confirmed that the company has formally contacted the Department of Telecommunications seeking clarification on both the privacy posture of the application as well as what safeguards if any might apply to future updates and changes to the backend capabilities of the application.
Roy, in addition, highlighted the fact that the requirements for compliance tend to conflict directly with long-standing policies maintained by most global handset manufacturers, particularly Apple, which in the past has resisted embedding government or third-party applications at the point of sale, and isn't likely to do so in the future either.
The vast majority of handset manufacturers prohibit the installation of any government app or any external app before a handset is sold - except for the Chinese and Russian companies, Roy stated, adding that the Indian order effectively forbade manufacturers from deviating from long-established operating norms.
Even though Android is the most prevalent smartphone in India, Apple's market share has become a crucial part of the policy's geopolitical undertones estimated at 4.5 percent by mid-2025 which has been attributed to the policy's geopolitical undertones. Apple has not yet issued a public statement about compliance, but it has been reported that they plan not to.
Apple is planning to communicate its concerns with Delhi, according to sources cited by Reuters, while a Reuters report said the company would register its objections with the Indian government in writing. Apple was reported to not intend to comply with India's directive, and was planning on raising its concerns with the Indian government, as suggested in another Reuters report.
Even though the comparison did little to soften its reception, the Indian directive is not completely without international precedent.
According to a report published by the Russian media in August 2025, all Russian mobile phones and tablets sold domestically must carry the MAX messenger application endorsed by the government, sparking a similar debate around surveillance risks and digital autonomy.
In this episode, India was placed along with a small but notable group of nations that have tightened device verification rules through a software-based approach to enforcement, rather than relying on telecom operators or network intermediaries for oversight.
That parallel underscored the concerns of privacy advocates rather than eased them.
This reinforced the belief that cybersecurity policies that rely on mandatory software, broad permissions, and silent updates - without transparent guardrails risk recalibrating the balance between fraud prevention and digital sovereignty for individuals.
Indian spyware mandate's brief rise and fall will probably outlast the order itself, leaving a policy inflection point that legislators, courts, and technology companies cannot ignore for the foreseeable future. This episode illustrates one of the most important aspects of modern security the debate shifts from intention to capability once software is a regulation instrument, instead of reassurance to verification once it becomes a regulatory instrument.
The government globally faces legitimate pressure to curb digital fraud, secure device identities, and defend the telecom infrastructure. However, experts claim that trust isn't strengthened by force but by transparency, technical auditability, and clearly defined mandates anchored in law rather than ambiguity that strengthen trust.
For India, the controversy presents an opportunity not to retreat but instead to recalibrate.
According to analysts, cybersecurity frameworks governing consumer devices should also contain public rule disclosures, third-party security assessments, granular consent architectures, sunset clauses for software updates from the state, and granular consent architectures.
The groups who are representing the rights of digital citizens have also urged that future antifraud tools be activated with opt-ins, data minimization standards, local processing on devices, and not silent updates to the server without notification to the user.
However, the Sanchar Saathi debate has raised larger questions for democracies that are navigating mass digitization in the future who owns the software layer on personal hardware and how far can security imperatives extend before autonomy contracts are imposed?
There is a growing consensus that the next decade of India's digital social contract will be defined by the answers, which will determine how innovation, security, and privacy coexist not just through negotiation, but through design as well.
