How a state-run app sparked a fresh fight over digital overreach

The report is from this week’s edition of CNBC’s “Inside India” newsletter which brings you timely, insightful news and market commentary on the emerging economic powerhouse. Subscribe here.

The big story

It all started this Monday.

The Indian government asked phone manufacturers to preload a state-run cybersecurity app with no option to disable it, mandating them to push it via software updates on handsets.

On Tuesday, there was backlash on social media and pressure from internet freedom activists, with the country’s chief opposition political party labelling the application a “snooping app.”

On Wednesday, the government rolled back the mandate for the Sanchar Saathi app, while defending it as a “citizen-centric tool that brings robust security features and fraud-reporting capabilities directly to users’ smartphones.”

While the state buckled under public pressure, it is not the not the first time the government has found itself in hot waters over charges of digital overreach, including compromising people’s privacy.

In 2023, security breaches were reported in the state-run covid vaccination app — whose introduction had also sparked privacy concerns. The health ministry initially denied the claim, but days later the country’s information and technology minister told local media that the root cause of the leak had been identified.

While internet freedom activists in the country welcomed the government’s move to roll back the Sanchar Saathi mandate, they said the battle was far from over.

Nikhil Pahwa, a digital rights activist, told CNBC that due to the amount of data leaked by the government and the numerous previous data linkage mandates, “they are unable to now contain the fraud.”

Experts say that government policies are often misdirected. If the government is serious about solving the issue of online fraud, “they need financial network controls and not a phone side app,” said Mishi Choudhary, a lawyer focused on internet advocacy issues, referring to Sanchar Saathi.

The government instead needs to address pathways used for fraud such as SIM Swap, mule bank, fake loan apps, cross-border call centers and remote access apps, she said.

According to local media reports, smartphone makers and operating system providers claimed that there was no prior consultation with the industry on the preinstallation mandate.

Reuters reported that Apple had resisted to comply with the directive and planned to convey its concerns around “security vulnerabilities” to authorities in New Delhi.

India’s telecommunications department, and its electronics and information technology ministry did not respond to CNBC’s requests for comments.

In March, Elon Musk’s X sued the Indian government over New Delhi’s order to remove content from its platform. Shrugging that aside, the government in May asked X to remove 8,000 accounts in the country, including those of international news organization and prominent users.

The platform said that Indian state ordered the company to block another 2,355 accounts in July, including that of news agency Reuters. Muddying waters, the government denied giving any “fresh blocking order” to X.

While the efforts to restrain certain accounts from operating in the country have been criticized by civil society and digital rights activists, an Indian court ruling rejecting X’s legal challenge against the government appears to have watered down the free-speech case.

Governments worldwide are wrestling with “how to assert control over vast and consequential datasets that private actors hold,” said Joe Jones, research and insight director at International Association of Privacy Professionals.

While these regulations are mostly justified from the prism of government-led work “to protect public safety and national security,” a government’s access to data leads to “privacy and cybersecurity concerns,” he added.

Unlike China, India’s internet and smartphone landscape is dominated by global companies. India accounts for one of the largest user bases for U.S. tech giants such as Meta and Google, and offers a growing consumer market for companies such as Apple. Digital mandates by India affect global businesses.

While the Sanchar Saathi mandate took the spotlight, another policy by India could put popular messaging app companies such as WhatsApp-owner Meta in a bind.

Under the SIM-binding regulations, introduced last week, messaging services will need to be continuously linked to a SIM card associated with a device, making it impossible to use the app without that specific, active SIM. The policy aims to curb cyber fraud.

“Accounts on instant messaging and calling apps continue to work even after the associated SIM is removed, deactivated or moved abroad, enabling anonymous scams, remote “digital arrest” frauds and government‑impersonation calls using Indian numbers,” the government said on Monday.

The messaging app companies will also have to ensure that the web service will be logged out periodically, after every 6 hours.

SIM-binding and forced periodic logouts could “impose material inconvenience and service disruption on ordinary users,” while offering “limited incremental benefit against sophisticated fraud networks,” Industry body Broadband India Forum said in a statement. Tech majors such as Google, Meta, Amazon and Samsung are part of BIF.

The industry body also criticized the telecommunications department for issuing directions of “far reaching impact” with short implementation timelines and without seeking public consultation or user-impact assessment.

SIM binding is a badly designed decision that will not solve the problem of online fraud but “it will make life of citizens harder,” said Choudhary.

Messaging services in India have been mandated to complete the implementation of SIM binding within 90 days. So far, there are no signs of a roll back on this front. 

Top TV picks on CNBC

Sanjay Mathur, ANZ’s chief economist for India and Southeast Asia, said he expects the Reserve Bank of India to cut rates by 25 basis points in December despite the stronger Q2 GDP data.

Vishrut Rana, Asia Pacific economist for S&P Global Ratings, said he expects India to achieve its $5 trillion GDP target in 2028, beating IMF estimates.

Gautam Shahi of Dua Associate said that based on how penalties are calculated, Apple, which is potentially staring at fines of up to $38 billion in an anti-trust case in India, may end up paying much less than feared.

Economy grew faster than expected in July-September. In a quarter partially affected by the 50% U.S. tariffs, the Indian economy grew faster than expected at 8.2%, year on year, in the quarter ending September, beating estimates.

Russian President Vladimir Putin in India: During the two-day visit, the two countries are set to extend their strategic and trade ties, likely deepening cooperation in defense and civil nuclear energy sector.

Industrial output declines. Industrial production grew by just 0.4% in October, a 14-month low, as manufacturing sector’s output moderated, while mining activity and electricity production fell 1.8% and 6.9%, respectively.

India’s Nifty 50 was up 0.11% Thursday as of 2:50 p.m. local time, while the BSE Sensex trading flat. The Nifty has gained nearly 10% so far this year.

On Thursday, the Indian rupee opened at a fresh low of 90.4 against the greenback, hitting a record low for a third straight day.

The benchmark 10-year Indian government bond yield was nearly flat at 6.535%.

— Nur Hikmah Md Ali

Coming up

Dec. 5: Reserve bank of India’s monetary policy meeting

Dec. 8: Wakefit Innovations IPO opens

Dec. 10: Nephrocare Health Services IPO opens

Each weekday, CNBC’s “Inside India” news show gives you news and market commentary on the emerging powerhouse businesses, and the people behind its rise. Livestream the show on YouTube and catch highlights here. 

SHOWTIMES:

U.S.: Sunday-Thursday, 23:00-0000 ET
Asia: Monday-Friday, 11:00-12:00 SIN/HK, 08:30-09:30 India 
Europe: Monday-Friday, 0500-06:00 CET