Two days and two government orders and the digital world in India is all up abuzz. First came the order around SIM binding for WhatsApp and other messaging apps. Now, there is a fresh directive to smartphone companies to install, and it is mandatory, a government app called Sanchar Saathi. The app, which is built presumably to track stolen phones, is going to be part of all phones sold in India. It will also be installed on all phones already out in hands of people through a software update.
The government says that the app must be installed on all phones in India by phone companies within 90 days and that a compliance report must be submitted in another 30 days, which means within 120 days from now. The move has, predictably, caused an uproar among Indian phone users, particularly on social media where emotions always run high. While those supporting the government move on Sanchar Saathi call it a pro-user decision, those opposed to it are calling a move that will start digital surveillance of all phone users in India.
Irrespective of getting into that debate, we decided to take a look at the app itself. We tried to see what all information and permissions that Sanchar Saathi demands on phones. While the app is available on both Android and iPhone, it seems to be doing a lot more on Android. This could be because of the locked nature of iOS and iPhone, whereas Android can be a bit more generous in how it allows different apps access to phone’s hardware and data.
Sanchar Saathi needs camera access
Sanchar Saathi is an app that needs a lot of access to do perform its function, which is reading IMEI number as well as tracking the phone in case it is stolen. To do everything that the app is supposed to do, on Android — as per its Version 1.5 — it needs access to:
— Call and SMS Logs
— Make and Manage phone calls
— Send SMS
— Gallery app and files kept on phone
— Camera app with full functionality
It also needs access to following Android processes:
— android.permission.FLASHLIGHT
— run foreground service
— control vibration
— run at startup
— Google Play license check
— have full network access
— view network connections
— prevent phone from sleeping
— show notifications
What app these permissions mean? Just to get an idea about the app and what it can do or not do, we ran the app through MOB-SF APK analyser. The overall report for the app was in GREEN — which means good enough for phones — but there were some concern areas that were highlighted. For example, the apps ability to access camera or call logs was deemed dangerous. Here are some details:
Does this make Sanchar Saathi dangerous?
Not at all. Apps demand different permissions from a phone for their functionality. And an app like Sanchar Saathi, which is effectively a tracking app that aims to keep an eye on stolen devices, can be fairly intrusive. That is its functionality, and purely on the basis of functionality it cannot be deemed dangerous.
But it is also clear that the kind of phone information and data access the app demands can be double-edged sword. It can be used to track a stolen phone. Or it can be used to simply track a phone and how that phone is being used.
A bigger issue probably is how the government is pushing it. Instead of making the app a tool that anyone can use if they want, the government is making the app mandatory. Even deleting or disabling the app will not be possible once it is on your phone. The government is also, by using phone makers to pre-load the app, making Sanchar Saathi almost like a core OS app on both iPhone and Android. Core OS apps, which come pre-installed, can have significantly more privilege on a phone compared to apps that you can install and uninstall from app store. Most importantly, once an app is core part of the phone, it can be updated or modified to even do things it was not originally meant to do. Essentially it becomes a matter of trust. And that probably is the nub of the matter: do you trust your government or not?
