India's Cellebrite Purchases Expose Gaps in Rules for Searching Seized Phones

A Rs 4.98 Crore Purchase With Wider Privacy Stakes

A Ministry of Home Affairs letter dated 20 January 2026 records Union Home Minister Amit Shah's approval for the National Investigation Agency (NIA) to bypass Make in India procurement requirements and buy Cellebrite Premium, a tool designed to unlock phones and extract their contents. The resulting contract went to Nextechno Gen Private Limited for Rs 4,97,99,515, or about Rs 4.98 crore.

The purchase forms part of a wider pattern identified by the Internet Freedom Foundation (IFF), a digital rights organisation. Its examination of procurement records found 15 listings naming Cellebrite products across 11 tenders in 2026, involving central investigative bodies, military authorities and state police or forensic departments.

The records describe powerful capabilities: recovering passwords, attempting to bypass passcodes and copying data from supported devices, including material stored in some protected folders. India has laws covering seizure, decryption and electronic evidence, but no dedicated statute, rule or published protocol setting out the complete process for forensic extraction from phones.

For someone whose device is taken, the consequences can extend beyond losing access to calls or messages. A forensic copy can preserve photographs, conversations, location records and app data after the physical phone has been returned. The procurement records reviewed by IFF contain no retention periods, deletion requirements or specific protections for journalists, lawyers and people who have not been accused of an offence.

The debate became more immediate after YouTuber Dhruv Rathee alleged that Delhi Police tried to copy his iPhone during his detention in October 2026. His allegation remains unverified, and police have not publicly responded. The procurement documents, meanwhile, provide a detailed account of what agencies have sought to buy and the administrative route used to approve it.

What the Ministry Approved

The Home Ministry's letter carries file number 80016/2026/ADMIN NIA-HQ. Issued by its Police Modernisation Division, it was signed by Vinod Kumar Dubey, Assistant Commissioner for Procurement, and addressed to the NIA's Director General. It refers to an NIA note dated 20 August 2025.

The letter records approval for a single exemption from the Public Procurement (Preference to Make-in-India) Order 2017 and its revision dated 19 July 2024. Those procurement rules give preference to domestic production. The exemption allowed the agency to proceed with the specified foreign product.

The approved proposal covered one Cellebrite Premium Tool with a licence lasting three years, at a proposed cost of Rs 4,98,15,000. The ministry's Integrated Finance Division concurred on 13 January 2026, and the letter records ministerial approval on 17 January.

The final contract value was Rs 15,485 below the proposed amount. That small difference leaves the central issue unchanged: the records explain permission to purchase the tool, while the rules controlling access to the personal information it can retrieve remain incomplete.

The Tender Contains Conflicting Details

The NIA published bid GEM/2026/B/7172473 on 6 February 2026. Five bidders participated, with Nextechno Gen Private Limited receiving the contract. The bid names the Home Minister as the authority granting the procurement exemption.

The documents contain two discrepancies. The ministry letter and technical specification describe a licence lasting three years, while the bid lists a subscription lasting one year. A certificate also gives an approval date of 13 August 2025, whereas the ministry letter records approval on 17 January 2026.

The procurement records described by IFF do not resolve those inconsistencies. The licence period matters because it determines how long the purchased access lasts and when further expenditure may be required.

The NIA's documents state that no other company makes software with the same name and specifications. They do not show an assessment of whether an Indian product could perform the same function. Comparing a named product with an alternative that performs the required investigative task is a different procurement exercise.

How the Purchases Developed

Delhi Police had Cellebrite tools by at least December 2020, including UFED and Physical Analyzer at the National Cyber Forensic Laboratory in Dwarka. Its forensic resources also included products from other suppliers.

A Home Ministry order dated 20 March 2025 approved an exemption covering 19 foreign forensic products for the Delhi Police Crime Branch. Three were Cellebrite products: UFED 4PC, Digital Collector, and Inspector with MacBook Pro.

The records and legal proceedings span several years:

• 2019: IFF filed its Supreme Court challenge concerning Section 69 of the Information Technology Act and related interception rules and authorisations.
• December 2023: The Centre told the Supreme Court that a committee would prepare guidelines concerning searches and seizures of digital devices.
• 20 March 2025: The Home Ministry cleared the Delhi Police procurement exemption covering three Cellebrite products.
• 20 August 2025: The NIA submitted the note referenced in the ministry's later approval letter.
• 13 to 20 January 2026: Financial concurrence, ministerial approval and the ministry's letter followed.
• 6 February 2026: The NIA published its Cellebrite tender.
• 10 October 2026: Rathee was detained before a planned protest, and his phones were taken, according to his account.

The 2026 tenders extend beyond the NIA. They include a Serious Fraud Investigation Office contract awarded to TNS Networking Solutions, purchases or renewals involving Karnataka and Himachal Pradesh, and a Kerala facility management service involving mobile extraction, with Alibi Global identified as an awardee. Department of Military Affairs bids sought batches of phone unlocks.

IFF's wider tracker contains about 100 surveillance related tenders published since July 2025. Another 25 tenders concerned mobile forensic extraction without naming brands at the bidding stage. Their eventual suppliers and products cannot be identified from those bid descriptions alone.

What Phone Extraction Can Retrieve

Cellebrite is an Israeli digital forensics company. Its tools help investigators gain access to supported devices and collect information for examination. The NIA's specification shows that access depends on the phone model, software and security state.

The specification requires brute force passcode cracking for listed Android devices and some older iPhones. Brute force means repeatedly trying possible passcodes until the correct combination is found, subject to the tool's capabilities and the device's protections.

For iPhone 11 through iPhone 14 models, the specification calls for full file system extraction after the device has been unlocked at least once since startup. A phone's security state changes after its first successful unlock, which can affect what forensic software can access.

The requested capabilities also cover protected storage areas, including Samsung Secure Folder, Huawei Private Space and Xiaomi Second Space, along with data from named applications. These are specifications sought by the buyer; whether extraction succeeds on a particular phone depends on its configuration and supported software.

A full file system extraction can collect chats, photographs, contacts, call logs, location history and application data. Investigators may then examine that copy separately from the handset. Returning the phone therefore leaves a further practical question: who controls the copied information, and for how long?

Why the October Seizures Matter

Rathee said police took his phone and his parents' phones when he was detained on 10 October ahead of a planned protest at Jantar Mantar in Delhi. The protest sought the Chief Election Commissioner's resignation, and police had refused permission for it.

Rathee later described his suspicions during an appearance on comedian Kunal Kamra's podcast. He said specialists examined his returned phone and found no spyware, and he believed an attempted Cellebrite extraction had failed because his iOS version was newer than the tool could handle. He also referred to the phone's battery history showing several hours of charging during police custody.

DIGIPUB News India Foundation documented the detention of journalists covering the protest, including reporters who had shown press identification. Some journalists also had their phones seized. IFF demanded the return of the devices and publication of seizure records on 12 October.

Nearly a month after the detentions, some phones remained with police, according to IFF's account, and owners had not been told what had been done with them. A journalist's device may contain unpublished reporting, private conversations and the identities of confidential sources. A family member's phone may contain extensive personal information unrelated to the reason another person was detained.

What Existing Laws Cover

The Bharatiya Nagarik Suraksha Sanhita (BNSS), India's criminal procedure law, provides powers connected with searches and seizure. Section 106 concerns seizure of property connected with an offence, while Section 105 requires recording of search and seizure processes through audio and video means.

Those provisions address taking possession of property and documenting the process. They do not set a complete set of conditions for unlocking a phone, choosing which files to copy, limiting subsequent access or deleting information after examination.

Section 63 of the Bharatiya Sakshya Adhiniyam addresses certification of electronic records for use as evidence in court. Certification concerns the handling and presentation of electronic evidence. The rules governing what investigators may collect in the first place require their own legal basis and safeguards.

Section 69 of the Information Technology Act provides powers to order interception, monitoring or decryption of information in a computer resource. The framework requires a written order from the competent authority, ordinarily the Union or State Home Secretary. IFF says it knows of no such order concerning phones taken during the October protests.

Section 17(1)(c) of the Digital Personal Data Protection Act provides an exemption for processing connected with investigating offences. That exemption leaves the rules for criminal investigation especially important for people seeking limits on how their information is used.

Two Supreme Court Cases Address the Gaps

IFF's petition, W.P. (C) 44/2019, challenges Section 69, the 2009 Interception Rules and the Home Ministry's authorisation of 10 central agencies to intercept, monitor and decrypt information. The petition remains pending.

A separate proceeding brought by the Foundation for Media Professionals, W.P. (Crl.) 395/2022, concerns searches and seizures of digital devices. In December 2023, the Centre told the Supreme Court that a committee would frame guidelines. According to IFF, those guidelines have not been placed before the Court. No next hearing date or deadline for their submission is given in the account.

The practical gap is particularly sharp for phones taken during preventive detention, when authorities hold someone to prevent an anticipated incident. Such a phone may not be evidence in a criminal investigation, yet its contents could still be copied without a published procedure explaining the reason, scope or duration of access.

IFF found no requirements in the reviewed procurement records for retention periods, deletion, audits or special handling of material belonging to journalists, lawyers or people not accused of offences. A documented chain of custody would record who handled a device or copy and when, helping courts and owners understand how the information was managed.

International Cases Show the Risks of Access

Amnesty International documented Serbian police using Cellebrite to unlock a journalist's phone before spyware was installed, as well as extraction from activists' devices. Unlocking and extraction give investigators access to stored information; spyware can provide continuing access after installation.

The Citizen Lab documented Cellebrite use against activists in Jordan and on Kenyan activist Boniface Mwangi's phone. Researchers have also described cases involving journalists or activists in Russia, Hong Kong, Botswana and Bangladesh.

Cellebrite has announced sales restrictions or withdrawals covering Hong Kong and China, Russia and Belarus, and relevant Serbian customers. Researchers have documented continued use after some announcements, including through resellers or systems operating offline. Controlling future sales and controlling equipment already in circulation involve different enforcement problems.

In India, IFF is seeking Delhi Police and Home Ministry records, including seizure documents, forensic workstation logs, Cellebrite licences, access records, any Section 69 orders, the NIA procurement file and the Home Minister's approval note.

The organisation has also called for disclosure of whether protest phones were connected to extraction tools, return of devices still held and certified deletion of copied data belonging to people not charged with offences. It wants use on phones belonging to people in preventive detention, journalists and lawyers suspended until binding rules exist, and the promised guidelines submitted to the Supreme Court.

Key Points

• The NIA awarded a Cellebrite contract worth Rs 4,97,99,515 after a Home Ministry exemption from Make in India procurement rules.
• IFF identified 15 Cellebrite listings across 11 tenders in 2026, plus 25 mobile extraction tenders that did not name brands.
• The NIA records contain conflicting licence periods and approval dates.
• The requested technology can unlock supported phones and copy extensive personal data, including some protected application storage.
• Rathee's allegation of an attempted extraction remains unverified, and Delhi Police have not publicly responded.
• Existing laws cover seizure, decryption and electronic evidence, but dedicated public rules for extraction, retention and deletion remain absent.
• Two Supreme Court proceedings concern relevant powers and device searches; the promised search and seizure guidelines have not been placed before the Court, according to IFF.