top | item 46104193

India orders smartphone makers to preload state-owned cyber safety app

900 points| jmsflknr | 3 months ago |reuters.com

733 comments

order

Some comments were deferred for faster rendering.

rishabhaiover|3 months ago

I'm shocked by people and state using the crutch of cyber crime or scams to push a totalitarian solution to a problem that is better solved by improved education and targeted campaigns against common security pitfalls.

I abhor any decision that robs even a grain of my individual freedom.

wosined|3 months ago

Sounds so authoritarian. Luckily, in the UK you only have to scan your face and ID to access cat photos.

ibejoeb|3 months ago

It's all happening really quickly, so I haven't been able to keep up. I know Starmer said that digital ID will be mandatory to work in the UK. Did he mention how that would be implemented? Is the UK going to issue and official device to everyone in country, or are the people supposed to pay for it? What about homeless, poor, and the provisional residents?

4gotunameagain|3 months ago

Are you talking about downloading reddit, which is infested with the weirdest pornography that exists ?

While I am very much against facial scanning etc, it is quite clear that something needs to be done about the access of porn to kids. It is a drug like any other that we do not allow kids to consume.

nbsande|3 months ago

> With more than 5 million downloads since its launch, the app has helped block more than 3.7 million stolen or lost mobile phones, while more than 30 million fraudulent connections have also been terminated.

I might be reading this wrong but these numbers seem very weird. Did more than half the people who downloaded the app block a stolen phone? And did each person who downloaded the app terminate 6 fraudulent connections?

blackoil|3 months ago

It's easy just use made up definitions for "helped", "fraudulent" and "terminated".

SSLy|3 months ago

> And did each person who downloaded the app terminate 6 fraudulent connections?

That much is believable, if not on the low side. Spam there is intense.

sharadov|3 months ago

Indian government is big on pronouncements.

It will be a garbage app that most likely will not work, considering the historical incompetence of the Indian government's expertise in all things tech.

I am pretty certain Apple and Samsung will pay off someone in the government.

sateesh|3 months ago

You are confounding intent with the implementation.It might be a garbage app to start with, but there is no opt out for the users. Given the payoff and endless iterations resources will be thrown at it and it would eventually get better.

lacy_tinpot|3 months ago

Isn't one of the largest payment processors in the world made by the Indian Government?

Personally I wouldn't risk my personal digital privacy on the incompetence of the government. I'd assume the opposite.

__rito__|3 months ago

I wouldn’t venture in the direction that many here will take.

I will point out that India have the highest number of victims of cyber-fraud. I personally know many people who have lost significant sums through social engineering attacks. The money is transferred to multiple mule accounts and physical cash is siphoned off to the fraudsters by the owners of those account. They choose helpless, illiterate, village dwelling account holders for this.

Another huge issue is unregulated loan apps. There are horror stories of people installing apps in order to take high-interest loans and then those apps stealing their private photos and contacts or accessing camera to take photos in private moments, and then sending those photos to contacts via WhatsApp when interest payment is overdue.

Then there are obvious security issues with terrorism and organized crime.

The government wants data. It's clear why. There is huge potential for misuse.

thisisit|3 months ago

> I will point out that India have the highest number of victims of cyber-fraud

Combined with worst enforcement and investigation efforts to tackle this issue. The default resolution on a cyber crime report is : Fraudster's account is blocked and they are given a choice to plead forgiveness from the accuser. They often return the money in lieu of the complaint being rescinded. Then fraudster is free to con others. Fraudsters know this is a numbers game that is why they hit every morsel they can get a bite.

Worse yet people use the cyber crime provision to take revenge. People can file frivolous cases without proof and ge others account locked. Banks will treat you with disdain and police will tell you to settle privately too.

What about investigations you ask? Very few cases reach that level. Local police file the FIR and they don't even know what is "cyber" in cyber crime. Fraudsters can continue playing the numbers game.

So, yes it is easy to talk about victims when the policies are lacking. And then this high number of victims can be used as a crutch to push insecure apps on everyone's phones. The worst part of it? They will get data and still remain clueless and inept in solving the high number of cyber crimes.

marginalx|3 months ago

And you trust the government to only use it for good purposes? and not to track people who may be protesting or belong to opposing political/religious/cultural views? We know based on historical pegasus complaints that this trust has to be earned and can't be given.

There are lots of ways to solve for this, mandating that these companies own the identification process through their systems, report misuse, govern apps. Why taken on the ownership of a process that is better handled outside of government while the government holds them to account via huge fines and timelines but giving these large companies ownership of protection from scams or stolen phones etc...? win win and I think these large companies are due spending extra money to protect their users anyway.

SamuelAdams|3 months ago

I wonder if this will cause a reduction in remote jobs for citizens. Compliance with US laws like HIPAA and FERPA have strict requirements regarding access. Many employees use 2FA on their personal devices, which if passed this law would interfere with.

tzs|3 months ago

How would this interfere with 2FA?

petterroea|3 months ago

I wish the article talked more about this app India wanted to pre-install. Forcing the pre-install of apps is worrisome in general, but there's some nuance that is missed by not explaining what is being forced on the citizens. "Cybersecurity app" can mean a lot. From the looks it's a government-sponsored "brick my phone"-kind of app for disabling stolen phones?

rglover|3 months ago

The more I see stuff like this, the more I think "you know, I don't think the world is collapsing, I think the old world is collapsing." Governments in their current form are increasingly becoming irrelevant (h/t to "The Fourth Turning") and actions like this prove it.

fn-mote|3 months ago

How is this demonstrating governments are irrelevant? It seems like it is demonstrating their continued power.

Steelmanning the argument, perhaps you see this as a demonstration that corporate power has gotten so large the government is being forced to react. I might believe that, but I can’t get from there to irrelevance.

Animats|3 months ago

What does this app actually do, in detail? Anyone know?

more_corn|3 months ago

It doesn’t matter what the app does today it can be made to do anything they want after the fact. Monitor speech, location, contacts, content, preserve evidence for prosecution, inspection your dinner choices or your sexual habits.

This is on the far end of the spectrum of bad.

shevy-java|3 months ago

It's always the same - governments suddenly wanting to spy on people.

We need a world where this can be guaranteed to not happen. We need 3D printing everywhere, without restrictions or payload attached.

b3lvedere|3 months ago

"We need a world where this can be guaranteed to not happen"

I doubt such a world exists in this current universe.

JumpCrisscross|3 months ago

Do we have a breakdown of what this app actually does?

pixelatedindex|3 months ago

https://sancharsaathi.gov.in

- Report fraud/scam calls and SMS directly from your phone.

- Block or track lost/stolen phones by disabling their IMEI so they can’t be misused.

- View all mobile numbers registered under your ID and report any unauthorized SIM cards.

- Verify if a phone is genuine with an IMEI/device authenticity check.

- Report telecom misuse, such as spoofed calls or suspicious international numbers.

The stated goal is protect users from digital fraud and safer telecom usage, who knows how good it’ll be. Probably a PITA.

batrat|3 months ago

It's a dangerous trend that is happening. From EU chat control to this, is like everybody is so interested to know what the hell I'm doing with my life. The problem is with my kids, they likely will not enjoy freedom as we did it.

qwerty59|3 months ago

Very concerning. I will be suprised if companies like apple comply though.

embedding-shape|3 months ago

Do they actually have a choice? Usually with laws and orders from the government, you can't do much than either go with the flow, try to lobby against it afterwards, or straight up refuse and leave the market. Considering Apple's ties to India, I feel like Apple is unlikely to leave, so that really only leaves Apple with the first; comply and complain.

reactivematter|3 months ago

How is it different from preloading apps like Netflix, GMail and other shady apps for profits that collects a lot of data.

Considering India's low literacy, having a state owned cyber safety app shouldn't be much of an issue. It's not like a backdoor, but safety of citizens, which is the prime mandate of a sovereign state.

alabhyajindal|3 months ago

The difference is restricting removal of the app. It takes away the user's choice. As far as I know all preloaded apps, at least on Android, can be disabled if not uninstalled.

> The November 28 order, seen by Reuters, gives major smartphone companies 90 days to ensure that the government's Sanchar Saathi app is pre-installed on new mobile phones, with a provision that users cannot disable it.

stickfigure|3 months ago

What stops someone from loading GrapheneOS on their (Indian) Android phone?

bastard_op|3 months ago

Mostly the fact that GrapheneOS only works on Google Pixel hardware currently and vendor unlock status. It's the only available phone hardware that provides full bootloader unlock capabilities AND suitable security protections baked into the secure enclave and boot process, including things like rate limiting in hardware like password cracking attempts via external brute-force input means, lockdown of usb ports until boot unlocked with a pin, etc. Their website spells out all the reasons.

Other phone makers could if they wanted to do the same, but do not as an active choice, or at least somebody's choice above them.

alephnerd|3 months ago

It will be used as evidence that the person who has GrapheneOS on their phone is attempting to break the law. Telegram and Signal chats are often used as circumstantial evidence of malfeasance in Indian national security cases, so the jump to using GrapheneOS as evidence of malfesance is tiny.

john61|3 months ago

The year of the Linux phone in India is coming.

quantum_state|3 months ago

Horrible for a so-called democratic country …

jeroenhd|3 months ago

The clipper chip was brought to us by the country that proclaims to spread democracy across the world. Democracies can be authoritarian if you scare the public enough.

0ckpuppet|3 months ago

If it can be abused, it will be abused. Corruption exists anywhere humans exist. Convenience and security are the bait. Why do people want to be caged?

marginalx|3 months ago

"With 5 million total downloads - the app has saved 3.7 million lost phones", this somehow doesn't add up for me, as this implies more than 74% of phones are stolen? Or this this govt lying to pad the numbers to make the app look like a sheep in wolves clothing.

perryizgr8|3 months ago

People download it only when their phone is stolen.

jmonty900|3 months ago

> Apple's iOS powered an estimated 4.5% of 735 million smartphones in India by mid-2025, with the rest using Android, Counterpoint Research says.

Sounds like Google should be the one leading the charge against this. Will be interesting to see what they do.

> The app is mainly designed to help users block and track lost or stolen smartphones across all telecom networks, using a central registry.

It's an app. That's all it does now (presumably). Once installed, it can be changed in the future to do all kinds of terrible things. This is big brother.

thisislife2|3 months ago

A government minister has clarified that the app is not mandatory but "optional" and can be deleted by the user is they don't want to use it - Sanchar Saathi app optional, can be deleted, says Telecom Minister Scindia - https://www.thehindu.com/sci-tech/technology/sanchar-saathi-... .

arunabha|3 months ago

> A government minister has clarified that the app is not mandatory but "optional" and can be deleted by the user

In India it doesn't really mean anything. As an example the biometric based id 'Aadhaar' is 'voluntary' on paper, The Modi govt had to concede this after a Supreme court judgement that made it clear that Aadhaar cannot be made mandatory. However in practice it's anything but. Govt officials will openly refuse to consider other forms of id. They have been informally told by the highest rungs of govt that they will be protected against any complaints and that they need to insist on Aadhaar.

The whole point is to make daily life practically impossible without Aadhaar so that the citizens give in and 'voluntarily' give their biometrics.

risfriend|3 months ago

This is just bad PR from Indian government. Communication minister clarifies the app is optional https://timesofindia.indiatimes.com/technology/tech-news/tel...

Reuters/BBC have been famous to pounce and sensationalizing.

master-lincoln|3 months ago

Sounds like both articles are right: There was a private government order to preload that app to smartphone makers. And it is not mandatory for citizens to use the app.

No sensationalizing apart from you it seems

SilverElfin|3 months ago

I assume that in the US, the major manufacturers of phones and their operating systems already have backdoors for national security reasons. I think back to the past leaks from Snowden regarding the PRISM program. That program specifically included Google and Apple cooperating with the government under the FISA Amendments Act of 2008.

So while this state-owned cyber safety app is authoritarian, I wonder if it reflects just the most practical way India’s government can achieve the same things that the US has.

bossyTeacher|3 months ago

And this is why we need unlockable bootloaders and stuff like Graphene and LineageOs. Having only two mobile Os is very convenient until stuff like this happens.

lez|3 months ago

It is happening, in spite many won't really deeply believe. Every day 33 brits are arrested for what they say online.

It's happening, and it's time we say no. It's uncomfortable, but we need to do it en masse, right now.

Do not buy backdoored hardware, help others get rid of the backdoors, use anonymous technology to organize protests.

There has to be a line.

Kelteseth|3 months ago

I didn't find any context for your claim so here is some reddit comment:

So it’s true 3,300 people were arrested for posts online. What they don’t tell you are the statistics or context. The actual law for these arrests covers EVERYTHING online. These arrests include those arrested for terrorism (if the planning/act of terror includes any online communication in the UK), threats of violence, racist abuse, hate speech and unwanted communication (including sending unsolicited sexual photos to strangers). It also includes spreading false information that could cause harm or affect an ingoing investigation.

If you look at convictions, only 137 people were actually sentenced in 2024.

https://www.reddit.com/r/DebunkThis/comments/1mmux6r/comment...

catlikesshrimp|3 months ago

Google, the phone manufacturer and now the state running bloatware on my phone. I will have three dialers, calendars, etc. All of them uninstallable

user3939382|3 months ago

I can actually not have a phone like I don’t need one that bad if they want to make it a nightmare. I can go back to a dial tone.

kwar13|3 months ago

I have to say I'm really surprised that I didn't find "fighting CP & terrorism" as the main push for this.

whizzter|3 months ago

The article mentions blocking phones with stolen IMEI's, but iirc that's mostly up to telecom network providers to block rather than some "app". Also doesn't Apple have their own locking technology?

In short, the arguments for this seems to stink?

alwinaugustin|3 months ago

Want to check number of SIMs in your name? Download Sanchar Saathi to check:Links to Play store and App Store. Department of Telecom

I was getting these messages for sometime and installed it finally. It is the same app that is mentioned in the article. My phone is already in the system then.

choeger|3 months ago

Just another round in the decades-long battle of who owns your device: Industry or state. It's never you, mind you, who owns your device.

The perversion is that you are legally responsible for what happens with your device, but you are unable to prevent others from using it as they wish. An app like this is automation for putting people into jail. Just upload some illegal content and then "detect it". There's literally nothing you can do to defend against this attack, and it will work until it's overused.

m3kw9|3 months ago

If the app requires an on device backdoor, Apple won’t likely cave to it. If it’s sandboxed, the amount of things it can do is limited to tracking user location, given Apple also disabled turning off location sharing

seatac76|3 months ago

Such a stupid move, I’d bet that it’ll be withdrawn quietly.

nout|3 months ago

Why would you give the government such power? Don't think about the current government that you may be happy about - think about the next one.

mcny|3 months ago

I don't get it. Don't many if not most of these scams originate from India? Wouldn't it be better to stop the scammers directly?

spoaceman7777|3 months ago

So, basically, this is just SIM card functionality for the age of eSIMs?

A lot of people in this thread seem unaware of what SIM cards actually are and do.

HardwareLust|3 months ago

Apple said this morning they will not comply.

zkmon|3 months ago

Does this mean visitors to India would also get this app installed on their phone as soon as they land in India?

mindaslab|3 months ago

The government is afraid of its people.

nephihaha|3 months ago

This is going to tie in with digital ID. Obviously the Indian government has never been corrupt or abusive.

tintor|3 months ago

Does it apply to iPhones manufactured to India, which are meant for export to other countries?

gnarlouse|3 months ago

Totalitarianism is a form of class warfare. Make class warfare M.A.D.

elia_is_me|3 months ago

i thought 'india' here indicate china before i clicked in.

hereme888|3 months ago

As "totalitarian" as it sounds, it actually makes sense that India's govt had to take such drastic steps. Telecom providers and smartphone manufacturers have criminally refused for decades to protect end-users, because it makes them money.

Govt can't have their population at large being scammed by criminals and do relatively nothing about it. It's a huge economic and productivity drain people seem to have "accepted as normal".

So how do you not shut down and arrest these greedy international corporations, which would disrupt a country's infrastructure, despite ongoing warnings? Force them.

To me it's akin to the US govt mandating software that allows users to report any and all spam, fully traceable to criminals and providers, whom the govt could prosecute/heavily fine 100% of the time. Dangerous 2-edged sword, but if takes down that despicable scam industry, later it can transition to a law mandating the same protection but in a privacy a preserving manner.

radium3d|3 months ago

Is this going to be a requirement for BRICS member countries?

bitlad|3 months ago

Too bad, 90% traffic they will monitor would be porn.

profsummergig|3 months ago

ref: "the new tobacco"

this last year i'm seeing very concerning behavior in students in the 14-20 range. complete addiction to their phones. very deep interests in things i was completely unaware that they existed. similar to how when i started noticing anime girlfriends/waifus in 2016.

about 40% are deep in discord communities where i literally cannot figure out a single sentence of what they're talking about.

if society doesn't do something, and soon, say goodbye to the cognitive ability of a large chunk of future generations.

SuperSandro2000|3 months ago

When do we find the first Critical CVE in it?

melvinodsa|3 months ago

In wrong hands, this is a very dangerous tool.

figmert|3 months ago

Meanwhile the US has more than 4 different state owned cyber crime apps named after random things such as Google, Apple, Microsoft and Facebook, and many more. The kicker is they run all over the world.

Anyway, that doesn't in any way negate that this is shit for the people of India.

HackerThemAll|3 months ago

Soon in U.S.

For the safety and security of children, of course.

oldjim798|3 months ago

Honestly shocked it took this long for governments to start doing this; it seemed inevitable that governments would want all the data private entities have been enjoying.

More and more it seems like the benefits of being connected are not worth the cost of being so visible to so many hostile (state and non-state) actors

gblargg|3 months ago

DO NOT PRELOAD! DO NOT PRELOAD!!!

pdyc|3 months ago

What should have happened is that they should have forced mobile vendors to allow users to uninstall all apps. What actually happened is that they are asking for their app to be installed as well, sigh.

pete1302|3 months ago

OK: added to debloat list.

renewiltord|3 months ago

These things are more a factor of aggregate risk handling. As an example, if you have tuberculosis it is possible even in the US for the country to mandate that a doctor watch you take the treatment. Totalitarian? Authoritarian? A tool that could be used to force someone to have to show up to where a state-controlled authority could confirm that they are? Yes, all of these things could be words you could assign to that.

But societal combined risk is commonly handled in this way. In the US, if you employ someone you have to report that you paid them to a central federal government. Way to track someone? Surveillance state? All words you could use.

And the government previously restricted gambling and so on. The question isn't "why would a bad government do these things?". The question is "would a benevolent government do these things?" and "if so, why?". And the answer is quite straightforward, I think:

Someone in the government has observed that there is a great deal of cyber crime in India. A fairly uneducated population, with very high smart-phone penetration (85%+ apparently), and a large number of fraudulent actors that their federal government is unable to enforce against. So they're attempting to attack the problem where they can.

This is ultimately India. They don't need insidious "app on your phone" / stingray / any other sophisticated solution. The local politicians can manipulate local authorities to get your cell tower association data and SMS. And if they want your comms devices they will rubber-hose the secrets out of you.

Someone I know worked at a big FAANG. He's Indian so went back to Bangalore to see his ailing mother. One day he took an auto-rickshaw while wearing his FAANG sweatshirt. The driver took him to a makeshift jail where he, police officers, and a magistrate conspired to threaten the guy with prison unless he paid $10k. $10k is nothing to a FAANG engineer, so he paid up, was brought in front of court on some lesser charges and then had to pay a small fine (much less than $10k). And then he flew back to the West Coast and never returned to India. Trying to reason about this kind of place using the perspective of the West is meaningless.

I think it unlikely they're trying to use this as cyber-surveillance. India simply does not have the infrastructure necessary to do that at scale. And they have the infrastructure for the rubber-hose, and Indians wear their identification on their sleeve, so to speak. Names point to ethnic groups and castes. Primarily endogamous marriage means if you want to perform violence against groups you can simply spread out from one member of the family unit being visibly of that group.

Using an app to get access to someone's data there is sort of like using Heartbleed to get root on a machine on which you are in /etc/sudoers with NOPASSWD.

Lapsa|3 months ago

reminder - there's tech out there that enables reading your mind

bilekas|3 months ago

>With more than 5 million downloads since its launch, the app has helped block more than 3.7 million stolen or lost mobile phones

Ah yes, so because someone has stolen MY phone, I should give up all my right to privacy and allow the government to have their claws in my phone.

Logic. What a silly point to make when 'findmyphone' services, which are OPT-IN litterally do the same thing.

spaceman_2020|3 months ago

the good news is that I'm personally on my last few years online. I don't think there's anything really worthwhile in this space to do as a contributor or even as a consumer

mk89|3 months ago

When the hell do we start to build these products here again like it was just 20 years ago? And let's stop with "it's too expensive here...". For God's sake, these are products we use every minute of our lives.

Enough is enough...

tedggh|3 months ago

“The welfare of the people has always been the alibi of tyrants.”

bobse|3 months ago

[deleted]