The Indian telecom department describes Sanchar Saathi as a
citizen-centric tool that "brings robust security features and
fraud-reporting capabilities directly to users' smartphones. The app
complements the existing Sanchar Saathi portal by providing convenient,
on-the-go protection against identity theft, forged KYC, device theft, banking
fraud, and other cyber risks.’’
Last week, the Department of Telecommunications ordered
mobile manufacturers and importers to facilitate the availability and
accessibility of the Sanchar Saathi app on devices for users in India.
According to my research, the Indian government had asked companies such as Apple, Samsung and Xiaomi to pre-install the app within 90 days. Reports also said that Apple was unlikely to oblige to the diktat from the government.
The directive, as expected, created a wide outrage with
privacy advocates raising concerns over the government overreach and
possibilities of government snooping. The move also met criticism from the key
opposition leaders who have also demanded rolling back the directive. Though,
the government has denied the charges of possible snooping. A senior tech researcher
said
‘’The Government has no business being in citizens' lives
and their phones. While this may have been rolled back, SIM binding mandate is
still a major concern that will make citizens lives harder. A very bad
architectural decision that will not solve the problem. If DOT is serious about
solving the issue, it should address major fraud vectors such as social
engineering like phishing, smishing, remote access apps SIM swap, mule bank
account, fake loan apps, cross border call centres. These require financial
network controls, not a phone side app,"
Moreover, Internet Freedom Foundation, a digital rights
organization, in an elaborated post said that the problems deepen when we look
at the scope and safeguards. The order invokes "telecom cyber
security" as a catch all justification, but it does not define the
functional perimeter of the app. Clause 5 of the Directions refers to
identifying acts that "endanger telecom cyber security," an
expression so vague that it invites function creep as a design feature, not a
bug. Today, the app may be framed as a benign IMEI checker. Tomorrow, through a
server-side update, it could be repurposed for client-side scanning for
"banned" applications, flag VPN usage, correlate SIM activity, or
trawl SMS logs in the name of fraud detection.
"Nothing in the order constrains these possibilities.
In effect, the state is asking every smartphone user in India to accept an open
ended, updatable surveillance capability on their primary personal device, and
to do so without the basic guardrails that a constitutional democracy should
insist on as a matter of course. IFF is deeply concerned with this direction
that sets up a precedent to enforce client-side scanning on all smartphones in
India and calls for its recall,"