Sanchar Saathi: Surveillance In The Garb Of Safety?

Earlier this week, the Indian government dropped a bombshell on smartphone makers and millions of citizens. Every new phone sold in the country had to come pre-installed with the Sanchar Saathi app, a state-backed tool designed to combat telecom fraud and track stolen devices. At least, that is what the government said at first. And after much pressure, there has been some relenting from the powers that be. 

The biggest concern around Sanchar Saathi was that it was being thrust on users. The app was said to be non-removable, non-deletable, and deeply embedded in the device’s operating system once smartphone makers pre-installed it. And in the interim, an install campaign had already begun with SMS messages urging citizens to install the app. 

Naturally, it resulted in furore and a climate of fear. Many called it a way for the government to sneak in spyware on to smartphones. Others urged OEMs to push back. Apple reportedly refused to comply with the diktat, amid criticism from privacy advocates and citizens. 

Think tank Internet Freedom Foundation (IFF) said it will take steps to “support a challenge” to the new mandates in a court of law.

Amid much clamour and criticism, the government took a dramatic U-turn, announcing that the app would be optional. The episode exposes the fault lines in India’s digital governance, where the promise of security — ironically enough — raises concerns about the common man’s right to privacy and user autonomy.​ 

So, how did an app, designed to curb online fraud, invite a firestorm of criticism, all while raising concerns around privacy and security?

Sanchar Saathi: Safety Or Surveillance?

Sanchar Saathi’s mission, to protect users from fraud and theft, is noble, but its execution raises questions. Privacy watchdogs argue that the app’s deep integration into smartphones could turn every device into a surveillance tool, capable of accessing call logs, SMS details, and even device photos without explicit user consent. 

Although the government insists that the app is not meant for spying, its opaque privacy policy and a lack of clear opt-out mechanisms leave many unconvinced. 

“Viewed through the lens of the Supreme Court’s judgment in KS Puttaswamy (2017) that reaffirmed the fundamental right to privacy, this structure cannot pass the proportionality test… Forcing a permanent app installation for a sporadic verification function is not a marginal overreach; it is a textbook example of disproportionate state action under the Puttaswamy standard,” believes IFF.

Experts and reports on cybercrime routinely say that criminals use rooted or jailbroken phones that make it easier to remove any system app. If the government truly intends to stop cybercriminals and other miscreants, it may be going about the wrong way by mandating an app. “Criminals will not follow rules. It’s ordinary citizens who will get tracked,” said one lawyer.

There is also the honeypot risk. Sanchar Saathi’s architecture likely stores data in a centralised government server. For hackers and foreign adversaries, breaching this server even once would yield not just credit card details, but real-time location and device identity of virtually every Indian citizen.

How long is any uploaded data retained in government systems? And will the personal data be shared with law enforcement agencies? These questions are yet to be answered by the government, if indeed it is serious about the use of this app.

The SIM Binding Shadow

The Sanchar Saathi flashpoint cannot be separated from SIM binding — another government mandate announced last week. Under the proposed rules, messaging and social apps such as WhatsApp, Telegram, Signal and others would be required to tie user accounts to an active SIM and device identity. 

On the surface, this aims to curb anonymous abuse, fraud and spam. At a deeper level, the policy threatens to lock users into rigid digital identities and raises concerns over privacy. Three consequences stand out:

Number Portability Under Stress: If WhatsApp, UPI and other key accounts remain bound to a specific SIM, switching telecom operators could mean losing access, even temporarily. It adds a layer of friction to portability.

No More Multi-Devices? People who currently use apps across dual-SIM phones and tablets could find themselves locked into one primary device that the system recognises as ‘legitimate’.

The Traceability Question: Once SIM, device and the messaging app are bound, it becomes easier for authorities to trace messages and usage patterns back to physical individuals, especially when combined with KYC-verified SIM cards and Aadhaar-linked services.

Many argue that the announcement of SIM binding and Sanchar Saathi were meant to be complementary, and a means to surveil citizens. The government has stepped out and tried to downplay these concerns, but a firm answer on many of the pressing questions is yet to come.  

In an AI-first world, the possibility of running machine-learning models over the vast tract of Sanchar Saathi data could result in very deep surveillance into citizens’ private lives. 

“Today, the app may be framed as a benign IMEI checker. Tomorrow, through a server-side update, it could be repurposed for client-side scanning for “banned” applications, flag VPN usage, correlate SIM activity, or trawl SMS logs in the name of fraud detection. Nothing in the order constrains these possibilities,” said IFF.

That said, the revocation of the Sanchar Saathi mandate may have defused some of the immediate tension. Though one cannot rule out the return of Sanchar Saathi in a different form. 

But the underlying issues remain. India’s right to privacy judgement is celebrated globally, but the government’s efforts to get personal data of citizens runs counter to this. The sweeping powers to certain branches of the executive and the legislation in the Digital Personal Data Protection Bill are another major concern in this regard.  

As India continues to bolster digital governance, the debate over the balance between security and privacy is only expected to intensify. Cybersecurity is undoubtedly a major issue and with AI, the problem will only become more complicated. But solving this cannot come at the cost of basic expectation such as priacy and personal data protection.