India's Home Minister Cleared Rs 4.98 Crore Cellebrite Buy for NIA

By Amara Osei

Union Home Minister Amit Shah personally approved a one-time exemption from India's Make in India procurement rules so the National Investigation Agency (NIA) could buy a Cellebrite Premium Tool with a three-year licence for Rs. 4,98,15,000 — roughly $590,000. A Ministry of Home Affairs letter dated 20 January 2026, made public by the Internet Freedom Foundation (IFF), records the approval and names the minister as the authority that waived the domestic-preference rule.

The decision matters for two reasons. First, it puts the country's most senior security politician on record behind a phone-cracking purchase. Second, it lands in a legal vacuum.

"The NIA's purchase carries the most senior approval on record, but it is part of a wider pattern," IFF wrote, listing 15 procurement listings naming Cellebrite products across 11 tenders published in 2026 alone.

What do the documents actually say?

The letter, signed by Vinod Kumar Dubey, Assistant Commissioner (Procurement) in the ministry's Police Modernisation Division, is addressed to the NIA's Director General. It traces a clear paper trail:

• An NIA note dated 20 August 2025 requesting the purchase.
• Concurrence from the ministry's Integrated Finance Division on 13 January 2026.
• The Home Minister's approval note dated 17 January 2026.
• A one-time exemption from the Public Procurement (Preference to Make in India) Order, 2017 and its 19 July 2024 revision.

The NIA then published a bid on the Government e-Marketplace (GeM). The waiver field names "Shri Amit Shah, Hon'ble Home Minister of India." GeM now shows the contract awarded to Nextechno Gen Private Limited for Rs. 4,97,99,515 — Rs. 15,485 below the estimate. An SFIO contract bid dated 25 March 2026 lists Israel as the country of origin.

IFF has not seen the minister's note itself and has requested it under the Right to Information Act.

The paper trail runs from an August 2025 agency note to a January 2026 ministerial sign-off, with the vendor named and the discount down to the rupee.

Why did the purchase need an exemption?

The NIA's stated reason is that "no other Company is manufacturing the software with the same name and specifications." A Proprietary Article Certificate issued under Rule 166 of the General Financial Rules names Cellebrite DI Ltd. of Petah Tikva, Israel, as sole proprietor and adds that "No other make or model is acceptable."

IFF's rebuttal is blunt. "This is true of every branded product, and it does not answer the question the order actually asks, which is whether an Indian product could perform the same function… Nothing in the record we have seen shows that anyone tested whether one could."

The exemption rests on brand identity, not on any demonstrated test of an Indian alternative.

What is the tool required to do?

The two-page technical specification attached to the NIA's bid sets exacting targets. The tool must extract a full filesystem copy from Android devices made by Samsung, Huawei, Xiaomi, Motorola, LG, Nokia, ZTE, OnePlus, Alcatel, Pixel, Realme, Vivo and Oppo — once a device has been unlocked at least once since boot, a state known as After-First-Unlock (AFU).

Key requirements from the specification:

• Forensically sound extraction, with bit-by-bit copies of device storage.
• Support for full-disk encryption (FDE) and file-based encryption (FBE).
• Brute-force unlocking — automated passcode guessing — including "cold" brute-force on iPhone chips A8 through A13.
• Full filesystem extraction from iPhone 11 through 14 (A13 to A16 chips), and support for unlocked iPhone 15 or later.
• Decryption of Samsung Secure Folder, Huawei Private Space and Xiaomi Second Space.
• Selective extraction at the level of individual installed apps, and ongoing updates for new OS versions and chips.

A full filesystem extraction reaches deleted files, hidden files and system logs — material invisible to standard extraction, as the Czech forensics provider MOBILedit documents. For context: Google reported in April 2025 that Android phones reboot after three days locked, hardening them against exactly this kind of access.

Delhi Police has held Cellebrite tools since at least 2020, alongside MSAB's XRY, Oxygen Forensics' Detective and MOBILedit. "All the forensic tools through which data can be extracted, they are available," Anyesh Roy, then deputy commissioner heading the Cyber Crime Cell, said at the time.

The specification demands the ability to recover deleted data from both major mobile platforms — capability, not just access.

What is the legal gap?

"India has no statute, rule or published protocol governing the forensic extraction of a person's phone," IFF states. In Puttaswamy (2017), the Supreme Court held that privacy intrusions must be backed by law, pursue a legitimate aim and be proportionate. IFF argues copying an entire phone fails the first test.

The existing provisions, IFF says, do not fill the gap:

• BNSS Sections 105 and 106 cover seizure and its video recording — not unlocking or extraction.
• Section 63 of the Bharatiya Sakshya Adhiniyam presumes extraction was lawful rather than establishing legality.
• IT Act Section 69 requires a written Home Secretary order before decryption; IFF knows of none covering phones taken in October.
• The DPDP Act's Section 17(1)(c) exempts offence-investigation processing from data protection rules.

IFF's 2019 petition challenging Section 69 and the 10-agency interception notification — the NIA and Delhi Police among them — remains pending. Guidelines on digital device seizure, promised to the Supreme Court in December 2023, have not been filed.

The reported context sharpens the concern. Dhruv Rathee has claimed police apparently failed to clone his iPhone because it ran a newer iOS than the tool supported, citing hours of charging during custody. At October's Jantar Mantar protests, students and journalists alleged police confiscated phones and, in some cases, denied holding them despite contradicting GPS data.

IFF now seeks seizure memos, extraction logs, licence details and the minister's note via RTI, and asks that device use against detainees, journalists and lawyers be suspended until binding rules exist.

A Rs 4.98 crore extraction tool is now licensed for three years, with no statute defining when a phone may be cracked.