调查：印度内政部长签字豁免自家采购规则，多家机构买入以色列公司 Cellebrite 手机破解工具
总部在德里的数字权利组织互联网自由基金会（IFF）11月7日发布调查：印度内政部长 Amit Shah 今年1月签字豁免了印度政府自己的「印度制造」采购优先规则，让多家政府机构得以购买外国取证技术，其中包括以色列公司 Cellebrite 的手机数据提取产品。IFF 的调查依据是政府采购记录本身。
两封内政部信函是调查的核心证据。1月7日的一封信显示，Shah 批准了一项为期一年的广泛豁免，涉及至少422项外国取证设备；1月20日的另一封信记录，Shah 于1月17日批准国家调查局（NIA）购买 Cellebrite 的高端产品 Premium Tool，三年许可证，合同金额约4.98亿卢比（约合53万美元），中标方为 Nextechno Gen 私人有限公司。IFF 在422项豁免清单中辨认出118项数字与多媒体取证产品，包括 Cellebrite 的 Pathfinder、Inseyets On-Prem Pro 与 Inseyets Offline。
买家不止联邦机构。IFF 统计，2026年内印度各级机构共发布15条点名 Cellebrite 产品的采购记录、分布在11个招标中，买家包括国家调查局、严重欺诈调查办公室、军事事务部，以及 Kerala、Karnataka、Himachal Pradesh 三个邦的警察与法医部门，其中包括反对党印度国大党执政的邦。德里警方至少自2020年起就持有 Cellebrite 工具，2025年3月又经同一豁免路径为其刑侦部门添置了三套。政府招标的技术规格写明，这类软件要能绕过手机密码、提取完整文件系统、用从被扣设备中取得的登录凭证访问100多项云服务，并进入 Samsung Secure Folder、Huawei Private Space 与 Xiaomi Second Space 等受保护空间。
IFF 指出的问题核心是法律空白：印度没有任何一部法律、规则或公开规程说明，被扣押的手机在什么情况下可以被强制解锁、可以复制哪些数据、副本可以保存多久、谁可以查看。刑事法律里关于扣押财物与电子证据的条款没有覆盖这些问题；信息科技法第六十九条的解密权本身也在最高法院受到挑战，IFF 2019年提起的诉状至今未决。最高法院2017年已把隐私确认为一项基本权利。
调查的紧迫性来自今年10月的一次扣押。10月10日，德里警方在一场抗议活动前拘留了视频创作者 Dhruv Rathee，扣押了他本人和他父母的手机近一天。Rathee 后来在一个播客节目中说，他相信警方曾试图用 Cellebrite 复制他手机的内容，但因为手机系统版本较新而没有成功。IFF 明确标注：这一说法没有得到独立证实，德里警方也没有公开回应。IFF 已向德里警方与内政部提交信息公开申请，要求披露许可证、访问记录与提取日志，并表示它没有见过 Shah 签字豁免的那份批件本身，已另行申请调阅。
Cellebrite 是一家以色列数字取证公司。取证研究者曾在塞尔维亚、约旦、肯尼亚与俄罗斯记录到该公司的工具被用于记者与活动人士的设备。IFF 的问题是：在没有任何法律管住使用环节的情况下，这类工具正通过豁免通道进入印度各级警察与调查机构。
（来源：互联网自由基金会）
Investigation: India's Home Minister Waived His Own Government's Procurement Rules as Agencies Bought Cellebrite Phone-Cracking Tools
The Internet Freedom Foundation (IFF), a Delhi-based digital-rights group, published an investigation on November 7 showing that India's Home Minister, Amit Shah, signed off in January on exemptions from the government's own "Make in India" procurement rules, clearing the way for government agencies to buy foreign forensic technology, including phone-extraction products made by the Israeli firm Cellebrite. The IFF investigation is drawn from the government's own procurement records.
Two Home Ministry letters are its core evidence. A letter dated January 7 records a wide-ranging, one-year waiver covering at least 422 foreign forensic items. A letter dated January 20 records that Shah approved on January 17 a proposal for the National Investigation Agency (NIA) to buy Cellebrite's most powerful product, the Premium Tool, on a three-year licence; the contract, worth about 498 million rupees (about $529,947), was awarded to Nextechno Gen Private Limited. From the 422-item exemption list, the IFF identified 118 digital and multimedia forensics items, including Cellebrite's Pathfinder, Inseyets On-Prem Pro and Inseyets Offline.
The buyers go beyond federal agencies. The IFF counted 15 procurement listings naming Cellebrite products across 11 tenders published in India in 2026, with buyers including the NIA, the Serious Fraud Investigation Office, the Department of Military Affairs and the police and forensic departments of Kerala, Karnataka and Himachal Pradesh, including states governed by the opposition Congress party. The Delhi Police has held Cellebrite tools since at least 2020, and the Home Ministry cleared three more for its Crime Branch in March 2025 through the same exemption route. Government tender specifications require such software to bypass passcodes, extract full file systems, use login tokens recovered from seized devices to access more than 100 cloud services, and enter protected spaces such as Samsung Secure Folder, Huawei Private Space and Xiaomi Second Space.
The legal gap the IFF identifies is that India has no statute, rule or published protocol governing when a seized phone may be forcibly unlocked, what may be copied, how long the copy may be kept or who may read it. Existing seizure powers do not address those questions; the decryption power in Section 69 of the IT Act is itself under challenge in a petition the IFF filed in the Supreme Court in 2019, which remains pending. The Supreme Court recognised privacy as a fundamental right in 2017.
The urgency, the IFF says, came from a seizure in October. On October 10, the Delhi Police detained YouTuber Dhruv Rathee ahead of a protest and held his phone and his parents' phones for most of a day. Rathee later said on a podcast that he believes police attempted to copy his iPhone's contents using Cellebrite and that the attempt appeared to fail because his phone ran a newer version of iOS. The IFF notes that his account has not been independently verified and the Delhi Police has not responded publicly. The IFF has filed information requests with the Delhi Police and the Home Ministry seeking licences, access records and extraction logs, and says it has not seen the minister's exemption note itself, which it has also sought.
Cellebrite is an Israeli digital-forensics company whose tools forensic researchers have documented being used against journalists and activists in Serbia, Jordan, Kenya and Russia. The IFF's question is how such tools are entering policing across India through exemption routes while no law governs their use.
（Source: Internet Freedom Foundation）
来源：互联网自由基金会
发布：GSM·美国（发布链接）
图片来源：图：印度内政部所在的德里北区大楼（North Block）。照片：CC BY-SA 4.0，经 Wikimedia Commons。 / Photo: North Block in New Delhi, home of India's Ministry of Home Affairs. CC BY-SA 4.0, via Wikimedia Commons.
GSM Global · 本篇英文版 English edition of this story
