A Home Ministry-approved purchase of Israeli firm Cellebrite's phone-forensics software by the National Investigation Agency (NIA) has renewed questions about the tools available to India's police and investigation agencies to access data on seized phones, and the legal safeguards governing their use.
The purchase has also drawn attention to a larger gap: while Indian laws provide for interception, decryption and searches of digital devices, there is no comprehensive, dedicated framework specifically governing the forensic extraction, retention and handling of data copied from seized phones.
The Internet Freedom Foundation (IFF) reported on November 7 that Union Home Minister Amit Shah had personally approved an exemption allowing the NIA to procure Cellebrite's Premium Tool under the Make in India procurement policy.
According to IFF, the purchase was for a three-year licence and was awarded to Nextechno Gen Pvt Ltd. The awarded value was Rs 4,97,99,515, while the estimated cost recorded in the procurement paperwork was Rs 4,98,15,000 — a difference of Rs 15,485.
IFF also flagged inconsistencies in the documents, including references to both one-year and three-year licence periods.
Five bidders participated in the procurement process. The exemption concerned the domestic procurement preference under the Make in India policy and should not be described as a no-bid purchase.
IFF said it had not independently seen the underlying ministerial approval note. It had examined the January 20 letter recording the approval and the February bid documents.
Its procurement tracker separately listed 15 Cellebrite-linked entries across 11 tenders as of November 6. These included tenders at different stages, such as evaluations and renewals, and should not be read as 15 completed purchases. IFF identified three entries as awarded.
The agencies and departments listed included the NIA, the Serious Fraud Investigation Office, the Department of Military Affairs, and police or forensic departments in Kerala, Karnataka and Himachal Pradesh.
The issue gained renewed attention after Delhi Police detained YouTuber Dhruv Rathee on October 10, ahead of a Cockroach Janta Party protest.
Speaking later on comedian Kunal Kamra's podcast, Rathee said he suspected that police had attempted to extract data from his phone.
That remains his allegation. It does not establish that an extraction took place or identify the software, if any, that may have been used. No independent examination of Rathee's device has been made public.
The absence of detected spyware would not, by itself, establish that no forensic extraction had taken place. These are different methods of accessing data and require different forms of technical examination.
The terms used in discussions about digital surveillance often refer to different technologies and activities. Treating them as interchangeable can lead to confusion about what an agency can do and which legal provisions apply.
Mobile forensic tools: Mobile forensic products such as Cellebrite UFED and Premium, MSAB XRY, Oxygen Forensic Detective and Magnet AXIOM are used to acquire, process or analyse digital evidence from mobile devices. Their capabilities vary: some offer methods to access locked devices, while others are primarily used to examine and analyse data acquired from phones or other sources. The information that can be recovered depends on the device model, operating system, security settings, extraction method and software licence. No single tool can access every device or recover all available data. A procurement record alone does not establish that investigators successfully accessed a particular phone.
Spyware: Tools such as Pegasus are designed to gain access to a target's device remotely, potentially without the user's knowledge. Unlike conventional forensic extraction, this does not require investigators to have physical possession of the phone.
Network interception: Lawful interception systems and procedures enable authorised agencies to access communications while they are transmitted over telecommunications networks. India's Central Monitoring System is part of the country's interception infrastructure. This is different from copying data already stored on a seized phone, although the legal framework under Section 69 of the Information Technology Act also covers certain information stored in a computer resource.
Database-access platforms: NATGRID enables authorised agencies to access and analyse information from multiple databases. It is not a mobile-phone extraction tool and should not be grouped with forensic software.
These distinctions matter because the technology used, the information accessed and the applicable legal safeguards can differ substantially.
Historical procurement records show that several central and state agencies have sought or acquired mobile and digital forensic products. However, a tender or bid establishes a procurement requirement or process, not necessarily that a tool has been delivered, installed or remains in active use.
Delhi Police's National Cyber Forensic Laboratory was found to have several forensic products, including Cellebrite UFED and Physical Analyzer, MSAB XRY, Oxygen Forensic Detective and Compelson MOBILedit, during on-site reporting by MediaNama in December 2020.
The Forensic Science Laboratory in Rohini, Delhi, sought two MSAB XRY PRO units through a GeM tender dated September 28, 2026. The tender was marked as a single-tender procurement and was awarded to Themis Forensics Private Limited. The award does not, by itself, confirm delivery or activation.
Himachal Pradesh's Directorate of Forensics at Junga issued a tender in June 2026 seeking renewal of existing XRY Office and Forensic Tool Kit licences, along with new licences for Oxygen Forensic Detective, Magnet AXIOM and Magnet Witness. The Magnet Witness specifications included an audit-log requirement, indicating that logging was part of at least one of the procurement specifications examined.
Hyderabad Police sought a range of digital forensic products through an Open Competitive Bid in 2021. The listed products included XRY, Oxygen, EnCase, FTK and Cellebrite products.
Kerala Police issued a tender in 2020 for products including XRY, Magnet AXIOM Complete, EnCase and UFED Cloud Analyzer.
The NIA also had an Oxygen Forensic Detective licence listed in a 2019 procurement record. The record should not be taken as confirmation that the licence remains active.
India's Centre for Development of Advanced Computing (C-DAC) has also developed domestic digital forensic products. These include MobileCheck Suite, CyberCheck and SIMXtractor, among others, which it says have been deployed through its reseller network.
These products serve different forensic purposes. Their existence does not establish that they offer the same device-access or passcode-bypass capabilities as Cellebrite Premium. No evidence in the procurement material examined establishes that they are direct technical equivalents.
The records therefore offer a picture of procurement activity over several years, rather than a verified, current inventory of forensic tools held by every Indian investigation agency.
Not uniformly, and the easy framing that no rules exist anywhere does not hold up. The 2009 IT interception and decryption rules require written authorisation, a two-month executive review of every direction, and a six-month destruction duty for intercepted material. Telecom interception carries similar rules notified in 2024. NATGRID has a documented audit committee chaired by the Deputy National Security Adviser, per a 2016 Lok Sabha answer. The Karnataka High Court, in its 2021 Virendra Khanna judgment, set out procedures and limits for compelling access to a seized smartphone.
What is missing is more specific. None of these frameworks is written for the act of forensically extracting and retaining data from an already-seized phone. The accurate description is that India lacks a comprehensive, dedicated framework for forensic phone extraction, not that no statute governs this space at all. A provision that could eventually matter, the Digital Personal Data Protection Act's investigation exemption, is enacted but not yet in force: the government's own November 2025 notification places it in a commencement group that starts eighteen months after publication, and even once active it preserves separate data-security obligations. A constitutional challenge to the IT Act's decryption power, filed by IFF in 2019, remains pending before the Supreme Court — pending, not struck down.