Discover more

Law textbooks and casebooks South Asia rights Legal writing style guides Legal ethics training programs Human rights documentaries Legal news subscriptions

The Leaflet

Takeaways from the Sanchar Saathi saga: Cybersecurity policy must be evidence-driven, non-arbitrary, transparent | The Leaflet

Law and Technology Explainer

Takeaways from the Sanchar Saathi saga: Cybersecurity policy must be evidence-driven, non-arbitrary, transparent

The Sanchar Sathi episode was ultimately about a larger tension: how to balance India’s burgeoning cybersecurity needs against the constitutional right to privacy and informed consent?

Harsh Gour

Published on: 4 December 2025, 08:52 pm

Takeaways from the Sanchar Saathi saga: Cybersecurity policy must be evidence-driven, non-arbitrary, transparent

INDIA’S DEPARTMENT OF TELECOMMUNICATIONS (‘DoT’) recently quietly ordered all smartphone makers to pre-install its new “Sanchar Saathi” cybersecurity app on every phone sold in India.

The directive, under the Telecom Cyber Security Rules, instructed manufacturers to push the app to new devices. Once this came to light, opposition leaders, privacy advocates and tech companies immediately raised alarms. Sanchar Saathi, analysts alleged, was a potential snooping app - a Big Brother tool whereby the state could peer into citizens’ phones. But, after public discontent, the government has backed off. On December 4, days after the original directive, the government announced that the pre-installation of Sanchar Saathi would not be mandatory and that the app remains voluntary and privacy-protective.

CERT-In, India’s cyber emergency response team, reported a sharp rise in cyber incidents (from about 15.9 lakh cases in 2023 to over 20.4 lakh in 2024), and the National Cyber Crime Reporting Portal saw over 1.23 lakh related cybercrime cases reported in 2024. Crime statistics are no longer confined to rare news articles – in the Lok Sabha, the Home Ministry noted over 2.05 lakh police-registered cybercrime cases between 2021 and 2023. The government argues that Sanchar Saathi would give ordinary users tools to fight this scourge at the grassroots: blocking stolen phones by IMEI, flagging duplicate SIMs, reporting spam or spoof calls and more.

But as this clash over the app’s rollout shows, any intrusion into India’s vast mobile network also raises deep questions about legal authority, consent and who controls our data.

But as this clash over the app’s rollout shows, any intrusion into India’s vast mobile network also raises deep questions about legal authority, consent and who controls our data.

With Sanchar Saathi, these criteria are in tension. The app was mandated by an executive rule rather than a debated statute. The stated goal of curbing telecom fraud is valid. But is preloading an app the least privacy-intrusive way to do it? And is this step proportionate to the claimed harm?

The mandatory install rule failed the Puttaswamy test. The order would have treated every handset as a potential “state tap” by baking an app into its system. Users would lose the effective choice to say “no”; deactivation would be technically constrained, and deletion might require rooting the phone. In effect, the government planned to rely on the app’s design (including possible carrier-level privileges) to enforce compliance. This stands in uneasy tension with the DPDP Act, which emphasises individual control and consent over personal data.

Even if the DoT insists data is minimal, the previous sweeping rule that every phone must host the app suggested a broad inference of data collection: for instance, mandatory phone number registration and access to SMS/call logs means linking user identities to the device. The DPDP Act permits exceptions for national security (Section 17), but requires oversight - here, none was visible.

Puttaswamy specifically warns against blanket measures that treat citizens as suspects en masse. Tools like the Central Monitoring System (‘CMS’) and National Intelligence Grid (‘NATGRID’) have faced similar critiques: they gave the state sweeping powers to monitor communications or combine data without individualised warrants, often relying on executive orders rather than statute. Sanchar Saathi can be seen as another strand in this evolving surveillance ecosystem. It aggregates data at scale (IMEIs, call reports, fraud complaints) under one roof. If ever misused, it could facilitate profiling or tracking of innocent users under broad definitions of “fraud prevention.” The jurisprudence requires any such aggregation to meet strict proportionality.

Will collecting device IMEIs and call logs from millions of users survive such scrutiny? The DPDP Act suggests stricter consent, but its carve-outs for national security (Section 17) mean the ultimate check lies in judicial review, not in self-certification by a ministry.

Sanchar Saathi’s ongoing tale is a reminder that liberties and security are not binary opposites.