Govt clarifies on cybersecurity app after pushback

JYotiraditya Scindia, the government minister of communication theory, said on tues that the Sanchar Saathi cybersecurity app, which a previous directive to mobile river speech sound makers said must be pre-installed on phones, can be deleted by users if they so wish.The clarification came after widespread criticism of the move by digital rights activists and politicians, after some reports of the directive said the app could not be removed. To be sure, HT’s report cited unnamed department of telecommunications (DoT) officials, and said that the app could be deleted by users.“This is a completely voluntary and democratic system—users may choose to activate the app and avail its benefits, or if they do not wish to, they can easily delete it from their phone at any time,” clarified Scindia on X, adding that the app is meant to help users protect their privacy and stay safe from online fraud. He also repeated this to reporters outside Parliament.The Sanchar Saathi portal, launched by the government in May 2023, helps citizens check mobile connections linked to their IDs, report fraudulent numbers, and trace lost or stolen phones, as per its website. The mobile app was launched earlier this year in an effort to crack down on cybercrime.The confusion stemmed from one clause of the directive issued on November 28, but first reported Monday, that said phone makers had to ensure the app’s “functionalities are not disabled or restricted.” A DoT official, speaking on condition of anonymity, told HT that this clause is aimed at manufacturers, ensuring they don’t preload the app in a way that renders it unusable or hidden. “It simply means they shouldn’t later claim they installed it as required but that its features don’t work or aren’t visible to users,” the official explained.But many took this provision to mean that users could not delete the app. To be sure, the wording seems to suggest as much, and executives across phone makers said DoT would do well to issue a note on the clarification. A second DoT official, who too asked not to be named, said one would be issued shortly.Two executives at a phone maker which received the directive on November 28, told HT that the government’s clarification appears to be a step back after significant backlash. They added that phone makers have 90 days to respond to the directive, and that their company will do so. One of them added that talk of his company refusing to comply with the DoT directive is “pure speculation” for now. Neither wished to be identified.Opposition calls it a ‘snooping’ appAs the uproar unfolded on the second day of the winter session of Parliament, opposition parties denounced the cybersecurity app as a “snooping” mechanism. Congress leaders Mallikarjun Kharge and Priyanka Gandhi Vadra said the move threatens privacy and amounts to government overreach, arguing that cybersecurity cannot justify intruding into citizens’ phones.CPI(M) MP John Brittas wrote to Scindia and said pre-installed apps could start collecting data from the moment they appear on a device, and that this risk becomes more serious when combined with the government’s recent SIM-to-device binding mandate for messaging apps. The government, in a separate directive on November 28, directed major app-based communication services including WhatsApp, Telegram, and Signal to ensure their apps cannot be used unless the device contains the active SIM card linked to the user’s mobile number.BJP National Spokesperson and Lok Sabha MP Sambit Patra said misinformation is being spread about Sanchar Saathi, even after the facts a have been put forth. “Sanchar Saathi has not come with any intention that the government should spy on anyone or keep surveillance on anyone. Sanchar Saathi can neither read your messages nor access your messages. Sanchar Saathi cannot listen to your calls and it has no capability of listening to your incoming calls or your outgoing calls in any manner,” he said.Privacy concerns Privacy rights activists and tech policy think tanks have also raised concerns.Some experts said the minister’s clarification does not resolve several underlying privacy concerns. “The app also seeks high-risk permissions, including access to call and SMS logs, phone management, SMS sending, camera, photos and files, which could raise serious questions about profiling, misuse, and function creep, even if most users never actively open the app. Clause 7(b)...has understandably triggered fears that this ‘optional’ app could still operate as a system-level, non-removable service in practice. The DoT’s clarification on this clause will be crucial, but unless the mandate shifts to a genuinely opt-in model with strong purpose limitation, data-minimisation and transparency safeguards, the privacy risks will remain significant,” said Sachin Dhawan, Deputy Director at tech policy think tank The Dialogue.According to the government, the Sanchar Saathi website has been used by more than 200 million people, and over 15 million are connected to the app. Citizen reports have led to the disconnection of 14.3 million numbers through the ‘Not My Number’ feature and another 4.1 million fraudulent connections. The platform has also helped trace 2.6 million lost or stolen phones, and enabled the blocking of 6.2 lakh fraud-linked IMEIs.