Zero stars: On the Sanchar Saathi app

The growing sophistication of cybercrimes, from “digital arrests” to anonymous, large-scale cross-border scams, has made tackling them both urgent and difficult. Cybercriminals have exploited a security gap wherein user accounts on instant messaging apps remain functional even after the associated SIM card has been removed, using this anonymity to conduct government impersonation fraud. The rampant use of spoofed or tampered IMEI numbers has also made tracking perpetrators nearly impossible for law enforcement. It is perhaps inevitable that the government seeks sharper tools to address these software and hardware vulnerabilities, which explains the Department of Telecommunications’ directives on November 28 and December 1. The first mandates “SIM binding” — ensuring that a user’s account is disabled if the physical SIM is removed. In the second, smartphone manufacturers must pre-install the Sanchar Saathi app to verify device authenticity in all new devices by March 2026. While the first directive is a security patch which could inconvenience WhatsApp/Internet messaging users, the second is reminiscent of the saying, the road to hell is often paved with good intentions. The solution to the problem of counterfeit handsets and spoofed IMEI numbers is a cure that could potentially be more damaging than the disease.

The explicit instruction in the directive that the app is “readily visible and accessible to the end users at the time of first use or device setup and that its functionalities are not disabled or restricted” would mean that this app will be given a higher security clearance within the phone’s operating system, allowing it more intrusive access to features such as camera, phone or SMS access. The potential for misuse of this app for state surveillance and being utilised by a malicious entity after compromise to target millions of users is very present and clear. This is no empty fear considering what the Union government has done with the use of Pegasus software to target the political opposition, journalists and activists. Notwithstanding Union Minister Jyotiraditya Scindia’s clarification that users could delete the app, the directive’s text mandating that it cannot be disabled suggests that it will function more as a Panopticon and less as a simple verification tool. As the Supreme Court’s K.S. Puttaswamy (2017) judgment established, any state intrusion into privacy must satisfy the tests of legality, necessity, and proportionality. The government already possesses less intrusive means to verify device genuineness. The Sanchar Saathi web portals, SMS-based checks, and USSD codes should suffice. By ignoring these less invasive alternatives, the directive on Sanchar Saathi fails the proportionality standard. It is little wonder that privacy-conscious manufacturers such as Apple have reportedly refused to comply with this order.

Overall Analysis

The editorial critically examines the government’s directive mandating the pre-installation of the Sanchar Saathi app on all smartphones by 2026. It opens by acknowledging the seriousness of modern cybercrimes — from digital arrests to cross-border scams — establishing that the government’s intention stems from a real security threat. However, it quickly shifts to arguing that the chosen solution may be excessive and counterproductive.

The first half highlights a genuine loophole exploited by criminals: messaging accounts staying active even after SIM removal, plus the widespread manipulation of IMEI numbers. The language is factual and technical, but the tone becomes cautionary as the writer notes that while one directive (SIM binding) is a simple inconvenience, the mandatory app installation “could be more damaging than the disease.” This metaphor signals the editorial’s shift into critique.

The second paragraph adopts a sharper, more alarmed tone. Phrases like “higher security clearance,” “intrusive access,” “potential for misuse,” and “Panopticon” evoke strong concerns about surveillance. The editorial underscores the risk by referencing the Pegasus spyware episode — a powerful rhetorical move reminding readers of past misuse of state-backed digital tools.

The piece then anchors its argument in constitutional principles, invoking the Puttaswamy judgment on privacy. By framing the issue around legality, necessity, and proportionality, the author indicates that the new directive fails all three tests. The government’s availability of less invasive alternatives further weakens the justification for such a step.

The closing lines adopt a warning tone: if privacy-focused companies like Apple resist the directive, it signals widespread concern. The editorial ends with the strong implication that the government’s approach, though well-intentioned, risks creating a mass-surveillance tool under the guise of security.

Important Vocabulary (5)

1. Spoofed – falsified or tampered to appear genuine.
2. Mandate – an official order or requirement.
3. Intrusive – excessively invasive or violating privacy.
4. Panopticon – a system where all individuals can be constantly observed, often without their knowledge.
5. Proportionality – the principle that actions must not exceed what is necessary to achieve a legitimate aim.

Conclusion & Tone

The editorial argues that while fighting cybercrime is essential, mandating a pre-installed verification app with deep system privileges is an overreach that threatens privacy and risks state surveillance. The government should rely on less invasive tools already available instead of imposing a high-risk solution on millions of users.

Tone: Critical, cautionary, and rights-focused, blending technical analysis with strong concerns about privacy and state overreach.