India demands smartphone makers install a government app on every handset

India’s government has issued a directive that requires all smartphone manufacturers to install a government app on every handset in the country and has given them 90 days to get the job done – and to ensure users can’t remove the code. The app is called “Sanchar Saathi” and is a product of India’s Department of Telecommunications (DoT). On Google Play and Apple’s App Store, the Department describes the app as “a citizen centric initiative … to empower mobile subscribers, strengthen their security and increase awareness about citizen centric initiatives.” The app does those jobs by allowing users to report incoming calls or messages – even on WhatsApp – they suspect are attempts at fraud. Users can also report incoming calls for which caller ID reveals the +91 country code, as India’s government thinks that’s an indicator of a possible illegal telecoms operator. Users can also block their device if they lose it or suspect it was stolen, an act that will prevent it from working on any mobile network in India. Another function allows lookup of IMEI numbers so users can verify if their handset is genuine. Spam and scams delivered by calls or TXTs are pervasive around the world, and researchers last year found that most Indian netizens receive three or more dodgy communiqués every day. This app has obvious potential to help reduce such attacks. An announcement from India’s government states that cybersecurity at telcos is another reason for the requirement to install the app. “Spoofed/ Tampered IMEIs in telecom network leads to situation where same IMEI is working in different devices at different places simultaneously and pose challenges in action against such IMEIs,” according to the announcement. “India has [a] big second-hand mobile device market. Cases have also been observed where stolen or blacklisted devices are being re-sold. It makes the purchaser abettor in crime and causes financial loss to them. The blocked/blacklisted IMEIs can be checked using Sanchar Saathi App.” That motive is likely the reason India has required handset-makers to install Sanchar Saathi on existing handsets with a software update. The directive also requires the app to be pre-installed, “visible, functional, and enabled for users at first setup.” Manufacturers may not disable or restrict its features and “must ensure the App is easily accessible during device setup.” The app can access call logs and messages on users’ devices and shares them with the DoT when users report suspected fraud. Those functions mean India’s government will soon have a means of accessing personal info on hundreds of millions of devices. Apar Gupta, founder and director of India’s Internet Freedom Foundation, has criticized the directive on grounds that Sanchar Saathi isn’t fit for purpose. “Rather than resorting to coercion and mandating it to be installed the focus should be on improving it,” he wrote. The Register has also seen many Indian netizens express positive sentiment about the decision, on grounds that it may help to fight fraud. Few nations require installation of government apps. India, however, has made government apps a prominent part in daily life through services like the Aadhar digital identity service and the Unified Payments Interface, both of which are ubiquitous. So perhaps Indian netizens won’t feel that Sanchar Saathi is intrusive or unwelcome. Smartphone makers are yet to publicly react to the DoT directive. Big Tech companies have in the past pushed back against Indian regulations, notably in 2022 and 2023 when the nation demanded reporting of all cybersecurity incidents – even minor things like website defacements – within six hours of detection. India set a 60-day deadline to start sending incident reports, but just 15 organizations complied within ten months and India’s government later clarified the rules after receiving industry feedback. ®