WHY SANCHAR SAATHI WAS ENFORCED AND WITHDRAWN

December 17, 2025

THE HIDDEN ECONOMICS AND FUTURE OF SECURITY

Parneet Sachdev
Chairman of Real Estate Regulatory Authority and a leading author

In a decade shaped by digital fraud, the Union government’s latest directive to smartphone manufacturers, to preinstall its cybersecurity application Sanchar Saathi on every new device sold in India and prevent users from deleting it—marks a profound shift in the architecture of digital governance. True, the government has made a hasty withdrawal! Yet, there is a deep economic paradigm and the future may well see the right to privacy in trouble.

Sanchar Saathi app, launched earlier this year, is impressive technology. By August 2024, the app had crossed 5 million downloads, and by September had enabled the blocking of 3.728 million stolen or lost mobile devices and helped trace another 2.276 million across India (Ministry of Communications). At a time when India loses an estimated Rs 1,200–1,400 crore annually to handset theft and grey-market reselling of cloned devices, this app has immense value. IMEI, the International Mobile Equipment Identity, is the phone’s fingerprint. When a stolen device’s IMEI is blocked, its value collapses in the black market. This is what Sanchar Saathi does and the government wanted the app to be in every phone-permanently.

SIM BINDING AND IMSI-HOW THEY INVADE YOUR LIFE
The real devil lay in the second part of the withdrawn directive. The Department of Telecommunications (DoT) had ordered platforms like WhatsApp, Telegram and Signal to implement “SIM binding”—a system under which these apps will stop functioning if the SIM card used at the time of initial registration is removed from the device. And that was not all. Under the new regime, they would have needed to access the International Mobile Subscriber Identity (IMSI), a unique number stored inside every SIM card that identifies a subscriber globally. While IMEI identifies the device, IMSI identifies the person using the device.

Accessing IMSI would change the power equation between citizen, state and private corporations.
Understanding what access to IMSI entails is crucial. With IMSI, an application can, in principle, determine the exact SIM being used at any point, making impersonation harder. But IMSI-based tracking is also associated globally with far more intrusive technologies such as IMSI catchers, popularly known as “Stingrays” that mimic mobile towers and allow police agencies to identify, locate or intercept communications within a geographical radius. A 2018 study by Privacy International found that at least 25 countries, including the United States, Israel, the United Kingdom, Germany, and Australia, use IMSI-catcher technology for law enforcement, though under varying degrees of judicial oversight (Privacy International, 2018). Courts in several jurisdictions, including the U.S. Court of Appeals for the Seventh Circuit, have held that warrantless use of IMSI catchers may violate the Fourth Amendment right against unreasonable search and seizure. In Germany, the Federal Constitutional Court placed strict proportionality requirements on their deployment.
STATUTORY FRAMEWORK AND THE WORLD
India has no equivalent statutory framework governing IMSI access, nor any judicial precedent comparable in clarity. The Supreme Court in Justice K.S. Puttaswamy v. Union of India (2017) declared privacy a fundamental right under Article 21. Preinstalling a non-removable state app on every smartphone, effectively bypasses consent and creates a presumption of state presence inside personal devices (Carnegie India Cyber Policy Lecture, 2022).
Globally, the trend toward mandatory security apps is mixed. China requires smartphone vendors to preinstall anti-fraud apps such as National Anti-Fraud Center. Russia introduced a 2020 law (“FZ-425”) requiring certain apps including the state-developed Gosuslugi Services app to come preloaded on all smartphones sold in the country. The EU’s General Data Protection Regulation (GDPR) explicitly requires free, informed, revocable consent and regulators in France and Germany have repeatedly fined device manufacturers for unremovable bloatware that processes personal data without consent (CNIL 2021). India now sits at an inflection point between these competing models.
THE CRITICAL ECONOMIC DIMENSION
India sells roughly 160–170 million smartphones every year (IDC Quarterly Mobile Tracker 2024). Mandating preinstallation means rewriting software images for dozens of models, retesting firmware etc. A process might cost manufacturers between $1.40 and $2.80 per device. This could impose roughly Rs 1,800–3,500 crore annually in compliance overheads on the industry. Apple and Samsung, which guard their software ecosystems tightly, are likely to face the highest costs of integration.
Yet, the state’s concerns are not imaginary. India has become one of the world’s largest markets for digital identity fraud. In 2023–24 alone, complaints registered on the National Cybercrime Reporting Portal crossed 1.2 million, up 113 per cent in two years (Ministry of Home Affairs Annual Report 2024). Telecom fraud accounts for nearly 47 per cent of reported cases. Scam call centres in India, Nepal, Myanmar and Cambodia have used SIM swapping and IMEI reprogramming to siphon off more than Rs7,000 crore from Indian consumers in 24 months, according to the Indian Cyber Crime Coordination Centre (I4C). The Reserve Bank of India in its Financial Stability Report (December 2023) noted that digital payments fraud rose 30.8 per cent year-on-year.
Seen against this backdrop, Sanchar Saathi is designed to be a shield: track the phone, block the IMEI, verify the SIM, cut off fraudulent connections. The problem arises when infrastructure built for safety begins expanding into surveillance without adequate checks.
There is also a direct fiscal implication for the government. If mass deployment of Sanchar Saathi reduces handset theft by even 25 per cent, the savings to law enforcement agencies—measured in reduced investigation hours and recovery operations—could exceed Rs400–500 crore annually, according to estimates derived from NCRB time-cost analyses. RBI estimates that every Rs1 spent on digital fraud prevention yields Rs 8–12 in avoided losses (RBI Payments Vision 2025). At the macroeconomic level, improving trust in digital payments—now accounting for 86 per cent of retail transactions in value (NPCI 2024)—has a strong multiplier effect on productivity, formalization and financial inclusion.
However, IMSI-linked messaging could unintentionally expose socially vulnerable groups—whistleblowers, journalists, domestic violence survivors—whose safety depends on the ability to change SIM cards or compartmentalize identities.

WHAT ELSE IS COOKING
Even as privacy activists rejoice at the governments backtracking Reuters reports that the country is back at it. The government is said to be considering a telecom industry proposal with another draconian requirement. This one would require smartphone makers to enable always-on satellite-based location tracking (Assisted GPS). The measure would require location services to remain on at all times, with no option to switch them off. The telecom industry also wants phone makers to disable notifications that alert users when their carriers have accessed their location. Apple, Google and Samsung are said to oppose the move.

The India Cellular & Electronics Association (ICEA), reportedly wrote in a confidential letter this summer that the proposal has no precedent anywhere in the world. They warned that it could compromise military personnel, judges, corporate executives and journalists.In a statement sent to Engadget, the Electronic Frontier Foundation (EFF) sounded the alarm on the proposal. “Requiring phones to have A-GPS enabled all the time would be a horrifying decision by the Indian government with significant impacts on the privacy of everyone in the country,” EFF Senior Staff Technologist Cooper Quintin said. “With this change, the phone company and law enforcement get your exact location at any time, potentially even without legal due process.”Only Economics is not destiny.

It must be balanced against constitutional morality. India’s challenge today is not to choose between privacy and security but to design a system where one need not be sacrificed for the other. Until then, the debate will continue and the world will watch the direction in which India’s digital state is moving. A secure society is indispensable. But so is a free one.
(Views expressed are the author’s own).