The Indian government’s proposal to mandate smartphone manufacturers to preload a government cybersecurity app aimed at enhancing phone theft protection faced criticism due to privacy concerns. This led to the reversal of the compulsory deployment of the Sanchar Saathi app.
Agam Chaudhary, Founder and CEO of Two99, told Khaleej Times that while the app was well-intentioned, its implementation was flawed. “Preinstalled apps often run in the background without user consent,” he noted. “They remain on devices with privileged access, risking concealed data collection and system-level control that users cannot easily manage. In cybersecurity, user control is synonymous with safety. Less control means a more vulnerable ecosystem.”
Stay informed with the latest updates. Follow KT on WhatsApp Channels.
Another specialist mentioned it was wise not to enforce the app’s installation. “Sanchar Saathi is beneficial for preventing SIM fraud, stolen phones, and scam calls,” stated Obaidullah Kazmi, Founder & CTO of CREDO Technology Services. “However, security tools handling sensitive data require transparency and trust. The brief mandate incited valid public concern, and retracting it was sensible.”
Initiated by India’s Department of Telecommunications, Sanchar Saathi helps users block lost phones, verify device authenticity, and identify SIM card registrations. It integrates with national databases to combat SIM fraud and reduce mobile identity-linked cybercrime.
Permissions
Morey Haber, Chief Security Advisor at BeyondTrust, detailed that the app demanded extensive permissions, including access to call logs, SMS sending capability during registration, camera access, stored images, and device storage.
“Apps with such access can generate rich metadata, even if their privacy policies suggest limited use,” he explained. “This issue has been controversial for social media platforms like TikTok.”
Syed Aizad, Lead Security Researcher at Acronis TRU, emphasized that app installation should be user-driven. “User autonomy and privacy necessitate voluntary installations,” he argued. “Mandatory apps pose security risks, diminish trust, and infringe on user control.”
Now, Indian citizens and residents can choose whether to download the app. As per the telecom ministry, 14 million users have downloaded it, reporting 2,000 fraud incidents daily.
Risks
Experts argue the concern lay not with the app itself but with the access level required and its potential misuse if preinstalled.
Morey warned that the system might be exploited by third parties to gather call data, phone numbers, SMS content, derive locations, and correlate device identifiers. “If an app is preinstalled with system privileges, it poses higher risks, as it might gain permissions that regular apps do not, making its monitoring harder for users,” he noted. “This doesn’t mean Sanchar Saathi is currently doing this, but the technical potential exists and should be regulated by design, law, and independent oversight, beyond just government assurances.”
Abu Bakker, Founder/CEO of iTAG Technologies, explained why preloading the app was risky. “Manufacturers or carriers often install these apps in the system partition, granting them privileged access,” he said. “These apps often bypass security checks of platforms like Google Play or Apple App Store. Preloaded apps can be the weakest security link. Trusted by the OS by default, they can act as a ‘Trojan Horse.’ If compromised, hackers inherit their privileges, bypassing standard security measures.”
Agam added that historically, any broadly deployed, deeply integrated app becomes a prime target for cybercriminals. “A vulnerability doesn’t affect one person; it impacts an entire nation’s devices,” he said. “Threat actors seek the easiest path. A mandatory system app with elevated rights can become that path.”
