Sanchar Saathi:  Telecom Safety App  or Surveillance Surveillance Tool in Disguise?

By Suresh Unnithan & Nanditha Subhadra

In a nation of over 1.2 billion mobile subscribers, the Indian government’s push to preload the Sanchar Saathi app on every new smartphone has ignited a firestorm of debate. Launched in January 2025 by the Department of Telecommunications (DoT) as a “citizen-centric” tool to combat telecom fraud and device theft, the app was thrust into the spotlight on November 28, 2025, when the ministry mandated its pre-installation on all devices sold or updated in India. What began as a well-intentioned cybersecurity initiative has morphed into a symbol of state overreach, with opposition leaders, cyber experts, and everyday users decrying it as a potential gateway to mass surveillance. Comparisons to the notorious Pegasus spyware—Israel’s infamous tool for covert phone hacking—have flooded social media, amplifying fears that this “safety” app could quietly erode personal privacy.

The Pulse of Public Fear

The apprehensions are visceral and widespread. Opposition voices, from Congress heavyweights to digital rights advocates, paint Sanchar Saathi as a “snooping app” designed not to protect but to monitor. Congress general secretary KC Venugopal labeled it a “dystopian tool to monitor every Indian,” arguing it violates Article 21 of the Constitution, which safeguards the right to privacy as a fundamental aspect of life and liberty. Priyanka Gandhi Vadra went further, slamming the mandate as an “excuse to go into every citizen’s telephone,” warning that it blurs the line between fraud prevention and dictatorial control. In Parliament’s Winter Session, Congress MP Randeep Singh Surjewala raised alarms about real-time geo-tracking, access to WhatsApp chats, SMS records, financial transactions, and even private photos, questioning under what legal authority the government can force such an app onto 1.2 billion devices.

Cybersecurity experts echo these concerns, highlighting the app’s “invasive permissions” as a red flag. The Internet Freedom Foundation, a prominent digital rights group, decried the mandate as turning every smartphone into a “vessel for state-mandated software that the user cannot meaningfully refuse, control, or remove.” On platforms like X (formerly Twitter), users have likened it to authoritarian tactics in China and Russia, where state apps like Russia’s Max messenger are pre-installed for  similar “security” pretexts but enable metadata harvesting—tracking who you call, when, and where, even if end-to-end encryption shields message content.

The fear isn’t abstract; it’s rooted in India’s history of surveillance scandals, including the 2021 Pegasus revelations where opposition leaders’ phones were allegedly targeted. With Sanchar Saathi’s broad data access, critics fear a “backdoor” for similar abuses, especially since the app centralizes sensitive IMEI (International Mobile Equipment Identity) and location data, creating a single point of vulnerability for hacks or misuse. As a senior journalist points out , “The Govt’s Sanchar Saathi app mandate is a blatant assault on our privacy & freedom!” Even phone makers like Apple have pushed back, reportedly seeking a “middle path” to avoid compromising their ecosystem’s integrity.

Technical Features and Privacy Pitfalls

At its core, Sanchar Saathi is billed as an empowerment tool, not a spy gadget. Available as a free Android and iOS app (or via web at sancharsaathi.gov.in), it bundles several user-facing features aimed at telecom security:

These sound benign, but the app’s permissions—outlined in its Google Play listing—tell a more concerning story. To function, it demands access to:

• SMS and Phone: Read/send messages, access call logs, and phone status/identity.
• Storage and Media: Read, modify, or delete files (e.g., for scanning IMEI-related docs).
• Camera: Take photos/videos (potentially for ID verification during reports).
• Network and Device: Monitor connections, run at startup, read device ID, and control vibration (for alerts).
• Location (Implicit): Via network state for tracing blocked devices.

Government officials insist the app remains “inactive until registered” and collects no personal data without explicit user opt-in. Communications Minister Jyotiraditya Scindia reiterated in the Lok Sabha: “Sanchar Saathi se na snooping sambhav hai, na snooping hoga” (Neither snooping is possible nor will it happen), emphasizing its role in fraud protection. Users can reportedly delete it post-setup, softening the November 28 order’s “non-disable” clause. Yet, experts argue these safeguards are illusory: Pre-installation ensures universal exposure, and permissions could be quietly expanded via updates, turning a dormant app into a data harvester.

Spyware or Safety Net?

The Pegasus specter looms large in public discourse, with hashtags like #SancharSaathiPegasus trending on X. Developed by Israel’s NSO Group, Pegasus is a zero-click spyware that infiltrates iOS and Android devices via undisclosed vulnerabilities—no app download or user action required. Once embedded, it grants full access: live microphone feeds, camera spying, encrypted message decryption (e.g., WhatsApp), geolocation tracking, and data exfiltration to remote servers. It was weaponized against journalists, activists, and politicians globally, including in India, where a 2021 investigation revealed targets like ministers and opposition figures.

Sanchar Saathi, by contrast, is no Pegasus clone—it’s an overt, user-consented app, not a stealth implant. It doesn’t exploit zero-days or hide in the background; activation requires registration, and its features are limited to reporting and blocking, not proactive eavesdropping. Congress MP Karti Chidambaram’s “Pegasus plus plus” quip notwithstanding, the app lacks Pegasus’s surgical espionage toolkit. Where Pegasus thrives on secrecy and elite targeting, Sanchar Saathi scales to mass adoption, potentially creating a broader but blunter surveillance net through aggregated metadata.

That said, the similarities are chilling enough to fuel paranoia. Both rely on deep device access—Pegasus for covert ops, Sanchar for “safety” features that could double as surveillance vectors. A data breach in Sanchar’s centralized CEIR could expose IMEI-location pairs nationwide, akin to Pegasus’s targeted leaks but on steroids. As one analyst noted, “This is raising fears… about likely surveillance,” given the app’s ability to “monitor calls and messages” under the guise of fraud detection. Unlike Pegasus’s for-profit model, Sanchar’s state backing raises stakes: If misused, it could normalize “Big Brother” oversight in a democracy already grappling with digital authoritarianism.

A Call for Clarity Amid the Chaos

The BJP has mounted a robust defense, with spokesperson Sambit Patra insisting the app “cannot read messages, listen to calls, or extract personal data” and is purely optional. Scindia’s parliamentary assurance—that it’s for empowerment, not intrusion—aims to douse the flames, but the damage is done. The lack of prior stakeholder consultations, independent audits, or transparent code reviews has only deepened distrust.

As India hurtles toward a fully digital economy, Sanchar Saathi’s saga underscores a timeless tension: Security versus liberty. For now, users can delete the app, but the precedent of mandatory state software lingers like a shadow. Will this be a misfire corrected through dialogue, or the thin end of a surveillance wedge? Only time—and perhaps a Supreme Court challenge—will tell. In the meantime, one X user summed it up wryly: “Married men don’t need Sanchar Saathi; they already have a jeevan saathi that’s more effective in snooping.” Laughter may mask the unease, but the conversation demands more than quips—it demands accountability.