IFF has examined procurement records for the Delhi Police Crime Branch’s Cyber Lab and the Delhi Government’s Forensic Science Laboratory at Rohini. We have also obtained a Home Ministry letter of 7 January 2026 recording the Union Home Minister’s approval of a one-year Make in India exemption for 422 forensic items for the National Forensic Sciences University and every Central Forensic Science Laboratory. The specifications require tools that can use login tokens stored on seized phones or computers to enter more than a hundred cloud services. They also require the extraction of keys protecting Signal and Proton Mail, brute-force attacks on passcodes and facial recognition, including a feature to sort photographs by “Age, gender, race, emotion and more”.On 6 November 2026, the Rohini laboratory concluded a ₹4.59 crore contract for two units of MSAB XRY Pro through a bid open to a single seller. In September, it had sought to renew and add licences for Oxygen Forensic Detective, two days after US prosecutors announced charges against the company’s chief executive over the alleged concealment of its Russian ownership. London’s Metropolitan Police has paused its use of the tool, and both Delhi bids have since been cancelled. No Indian statute specifically regulates the forensic search of a seized phone, and the Union has yet to file the guidelines it promised the Supreme Court in December 2023. We are publishing the documents, filing Right to Information applications and writing to the Central Vigilance Commission.BackgroundOn 10 October 2026, Jagriti Trisha, a reporter with BOOM Live, was filming protesters being put on a bus in Delhi when the police snatched her phone and forced her onto the bus. Reporters Without Borders (RSF) has listed around forty journalists detained on 10 and 11 October while covering protests against the revision of the electoral rolls. The protests took place at Jantar Mantar in Delhi and in other cities. Most of the journalists were detained in Delhi, and the others in Mumbai, Ahmedabad and Pune. Several reported that their phones, cameras and memory cards had been “confiscated, damaged or even destroyed”. The Wire’s list names nearly thirty journalists, most of them in Delhi. On 11 October, Senior Advocate Menaka Guruswamy told the Supreme Court that around 7,000 people were reported to have been detained in the city. On 12 October, we asked the Delhi Police to return the phones and publish the seizure records. A month later, it has done neither.A phone seized by the Delhi Police may be examined at the Crime Branch’s Cyber Lab, which operates under its Cyber Cell, or at the Delhi Government’s Forensic Science Laboratory at Sector 14, Rohini, which examines exhibits sent by the police. Extraction tools have been available to the Delhi Police since at least 2020. In December 2020, MediaNama reported that the Delhi Police held tools from Cellebrite, MSAB, Oxygen Forensics and Compelson at the National Cyber Forensic Laboratory in Dwarka. That facility belongs to the Home Ministry’s Indian Cyber Crime Coordination Centre and is managed by the Delhi Police. In March 2022, police officials in Telangana, Karnataka, Punjab and Uttar Pradesh told MediaNama that such tools were used “in all investigative cases”. A senior Punjab Police officer said: “Data which is not necessary for investigation is also preserved along with the data which is useful in the investigation.” In July 2025, The Wire reported that the Home Ministry had approved a Delhi Police request to exempt foreign forensic tools from the Make in India clause, and named the vendors. The government has not published that approval.The Crime Branch Cyber Lab and the Rohini Forensic Science Laboratory sit in separate administrative chains. The procurement records do not establish whether any particular seized phone was examined.IFF has been tracking these purchases through public procurement records for the past few months. We examine bid specifications and, where available, the supporting orders and contracts. Our first report, published on 7 November, examined the Home Minister’s approval of a Make in India exemption for the National Investigation Agency’s purchase of Cellebrite’s Premium tool, as recorded in a Home Ministry letter and the agency’s bid. This report examines other tools and focuses on Delhi.The records include the Home Ministry order of 20 March 2025 attached to the Delhi Police’s ₹4.18 crore bid for the Crime Branch’s Cyber Lab, and the accompanying 108-page request for proposal. We have examined the specifications and contract for the Rohini laboratory’s purchase of two units of a Swedish phone-unlocking tool, as well as its specifications for Oxygen Forensic Detective, which it already holds. We have also obtained a Home Ministry letter of 7 January 2026 attached to a National Forensic Sciences University bid.The tools described in these records can copy a device’s contents and use its stored login tokens to access online accounts. A token allows an app to keep a person signed in without asking for the password each time. Software can then process the copied data to recognise faces, classify images and transcribe audio. In 2020, the American research group Upturn documented more than 2,000 law enforcement agencies in the United States that had bought such tools. It found that “no agency turned over any policies that specifically control the use of cloud data extraction tools”. That year, Privacy International warned that the “seeming wild west approach to highly sensitive data carries the risk of abuse, misuse and miscarriage of justice”. It added that users of services such as Google and Apple “do not know this technology exists and it is being used against them in a vacuum of legal safeguards”. India has no statute specifically governing the forensic search of a seized phone.The Supreme Court is considering this gap in Foundation for Media Professionals v. Union of India, in which IFF provides legal assistance to the petitioner. On 7 November 2023, Justices Sanjay Kishan Kaul and Sudhanshu Dhulia told the Union that it “must have better guidelines” on the seizure of digital devices, and asked the Additional Solicitor General to work on the issue. On 14 December 2023, the Union assured the Court that its agencies would follow the CBI (Crime) Manual, 2020 until guidelines were framed, and said it would return within six weeks. Nearly three years later, the guidelines have not been filed. Laboratories have continued to buy extraction tools, and the specifications examined here draw on vendors’ product descriptions.The table records these purchases and their status on the procurement portal as of 11 November 2026.AnalysisThe March 2025 exemption for the Delhi PoliceThe Home Ministry’s order of 20 March 2025 bears file number E.No.14013/06/2024-UTP-I and is signed by an Under Secretary. It is addressed to the Commissioner of Police, Delhi, and refers to a Delhi Police file of 24 January 2025 that sought a Make in India exemption for nineteen forensic products for the Cyber Cell’s Cyber Lab. It conveys “the approval of the Competent Authority” under clause 14 of the Public Procurement (Preference to Make in India) Order. The ministry’s Integrated Finance Division concurred in February 2025, and the competent authority approved the proposal on 17 March 2025. Clause 14, in the current revision of the Order, permits a department to exempt an item only “with the approval of their Minister-in-charge”. The order does not identify the competent authority, and the Delhi Police bid enters the Integrated Finance Division in that field. By comparison, the ministry’s January 2026 letters granting exemptions to the NIA and the National Forensic Sciences University name the Home Minister as the approving authority.The nineteen products are listed by brand. The fourteen software entries cover Magnet Witness (formerly DVR Examiner), MD-Video, Amped FIVE and Authenticate, Foclar Impress and Mandate, Recon ITR and Lab, Magnet Axiom, Belkasoft Evidence Centre, Magnet Outrider, OSForensics, Oxygen Forensic Detective, MSAB XRY and MOBILedit, along with two entries covering the three Cellebrite products we have written about earlier. The five hardware entries are PC-3000 data recovery systems, a Visual NAND Reconstructor, an EDAS FOX forensic server, a FRED forensic workstation and network storage with 300 terabytes of raw space. The order sets three conditions: “Standardization of the Cyber Forensic Labs”; compliance with the General Financial Rules, the Make in India exemption rules and Central Vigilance Commission guidelines; and “Following all codal formalities, due procedure and norms while executing the procurement”.Five days later, bid GEM/2025/B/6087335 was published on the Government e-Marketplace (GeM). It cites this order as the authority for marking the Make in India preference “No”. The bid describes eleven items in generic terms. Nine are extraction and analysis tools, including “Mobile Phone Imaging and Data Extraction Software” and “All in one Extraction and Analysis of data from mobile phones computers laptops drones IoT Devices wearable and cloud services software”. The other two are five forensic servers and the storage array. The estimated value was ₹4,18,02,189. The procurement portal records seven bidders and an award to 3rd Eye Techno Solutions Private Limited for ₹4,98,04,850, about nineteen per cent above the estimate. The award record does not identify the brands supplied.Exemptions for 422 forensic itemsA second approval appears in the papers that the National Forensic Sciences University (NFSU) attached to its bid of 14 October 2026 for mobile forensic software at its Delhi campus. The letter, No. 23011/14/2024-WS-III, was issued by the Home Ministry’s Women Safety Division on 7 January 2026 and signed by an Under Secretary. It conveys “the approval of the Competent Authority i.e. Hon’ble Union Home Minister for exemption from Public Procurement (Preference to Make in India) Clause, for procurement of 422 items (Hardware 274; Software 129; Hardware and Software – 19) pertaining to various divisions of forensic sciences”. The exemption is “tender specific” and lasts for “a maximum period of one year which may be reviewed any time”. The university must first check GeM for each item’s availability. The letter’s second paragraph states, in full: “The above order would also be applicable to all the Central Forensic Science Laboratories.”The letter covers NFSU and all Central Forensic Science Laboratories. Hardware, software and combined entries add to 422. IFF’s count of 118 digital and multimedia entries is a subject grouping within that total.We do not have the Minister’s note, and this account rests on the ministry’s letter. The NIA’s separate approval covered one Cellebrite tool and, according to the ministry, was given on a note dated 17 January 2026, ten days after this letter.The enclosed nineteen-page list covers forensic science broadly, including laboratory instruments such as spectrometers, DNA sequencers and microscopes. By our count, 118 entries fall under “Digital Forensics and Multimedia Forensics”. These include Cellebrite Pathfinder at an approximate cost of ₹7 crore, Cellebrite Inseyets On-Prem Pro with three client licences at ₹7.5 crore and Cellebrite Inseyets Offline at ₹6 crore, as well as Cellebrite Guardian, Autonomy, Responder, Smart Search and Premium. The list also includes Magnet Axiom Cyber, Magnet Atlas, Magnet One and Magnet Witness, MSAB XRY, Oxygen Forensics, five MOBILedit entries, Belkasoft, Passware, ADF Triage, Cyber Triage and Axon Investigate.Maltego Professional and Intelligence X, both open-source intelligence tools, are listed at ₹60 lakh each, and Sensity at ₹2.5 crore. The forensic accounting list adds DarkOwl, described as a “Darknet Intelligence and Dark Web Data Tool”, at ₹1.5 crore and a “Chain Analysis Tool (Crypto Investigation)” at ₹2 crore. The hardware pages include two GPU servers at ₹5 crore each, and a spectrum analyser, a non-linear junction detector and a telephone line analyser from REI, an American maker of counter-surveillance equipment. They also list Cellebrite’s UFED for PC and UFED Touch 3 with “Chinex Support”, the company’s add-on for phones built on Chinese chipsets.For many entries, the remarks column states “Exemption was upto Oct 2025, Hence now added in the list” or that an “exemption was there upto October 2025”. Oxygen Forensics and MSAB XRY carry the latter remark, which records an earlier exemption. The approval rests on the university’s letter of 9 December 2025, which certifies, “based on a thorough market survey and vendor analysis”, that “no equivalent indigenous alternatives with required specifications are currently available”. The letter states that the items are needed to examine exhibits, for teaching and research, and for “services to be imparted to various law enforcement agencies”.The ministry’s letter sets no conditions on how the tools may be used and makes no reference to the Supreme Court’s consideration of device seizures. The approval concerns procurement, but its scope is wide. On the ministry’s own record, one decision of the Home Minister lifted the Make in India preference for foreign extraction, cloud, dark-web and open-source intelligence tools for every Central Forensic Science Laboratory and for NFSU, which trains police officers and examines exhibits for them. The approval became public only when the university attached it to a bid. That bid records the approval inaccurately. It names the Under Secretary who signed the letter as the competent authority and gives the approval date as 7 September 2026.Cloud access through seized devicesPages 40 to 91 of the Crime Branch’s request for proposal set out the technical specifications. The “all-in-one” tool must “Extract and analyse data from multiple sources: mobile devices, their backups, more than 100 cloud services and call data records”. It must “be able to access complete iCloud Data from all associated devices with unique Apple ID” and “acquire information from Google Services, Like Geo locations visited, browsing history etc. and visualize locations on online and offline maps”. The specification requires support for the listed cloud services “for extraction with user credentials and/or Tokens found in user handsets”. A later entry confirms that data is acquired “using Tokens (and user credentials when tokens are not available)”.A token represents a login already completed. It usually permits access without the password or a second authentication step, as Privacy International has explained. The listed services include Airbnb, Box, Discord, DJI Cloud, Dropbox, Facebook, Firefox, Grindr, Instagram, JioChat, Mega, Microsoft Outlook, OkCupid, OnlyFans, OneDrive, Slack, Telegram, TikTok, Tinder, Twitter, Viber and VKontakte. They also include Google Calendar, Chrome, Contacts, Drive, Keep, Location History, Mail, My Activity and Photos; iCloud services ranging from backups and call history to Safari history; Samsung Cloud and Samsung Secure Folder backups; and WhatsApp backups stored on Google and iCloud.The specifications seek both device extraction and access to cloud data using recovered tokens or credentials. Requested features do not guarantee a successful extraction.The tool must include “a special module at no additional cost to detect tokens on suspect Computers”. This module must find “the WhatsApp QR token” in the WhatsApp desktop application, “the Amazon Alexa tokens in Web browsers” and “the Google Refresh token” in Chrome, Safari, Firefox, Thunderbird, Opera, WhatsApp Desktop, WhatsApp Web, Telegram Desktop and TamTam. The specification states: “These tokens further must be imported to the tool to gain access to respective cloud services.” A separate mobile extraction tool “should also allow selective extraction of only cloud tokens from the phone while doing Full File System extraction”. The requirements extend to smart home devices. Amazon Alexa and Google Home data is to be extracted “using a username and password or token”. Ring doorbell data must include “account and device information, locations, event history, cache, cookies, logs, and camera snapshots”.The Rohini laboratory requires similar capabilities. Its specification for Oxygen Forensic Detective, signed by a four-member committee on 10 August 2026, requires “extraction of data from over 106 cloud services using the built-in Cloud Extractor”. The tool must “extract credentials from Apple iOS and Android devices as well as Windows, macOS, and Linux computers”, including “Google, LinkedIn, Zoom tokens, and lots of passwords to various apps that can be immediately used for cloud data extraction”. Four methods of obtaining WhatsApp data are listed, including “WhatsApp cloud Extraction” and “WhatsApp QR Extraction”.The laboratory’s specification for MSAB XRY Pro, signed on 10 July 2026, requires the “acquisition, decoding, storage, and analysis of cloud-based data from private domains such as social media, instant messaging, file storage systems, and other cloud services”. The tool “must enable extraction using both application tokens recovered during Android/iOS forensic acquisition and user credentials (ID and password)”.Access through a token does not require a legal request to the company running the service. When a court directs Google or Meta to produce data, the company examines the order and a disclosure record exists. A laboratory using a token taken from a seized device sends no such request. The account holder may not learn of the access unless the service sends a security alert. A token may remain valid after the device is returned, so the access can continue.Encrypted apps and locked phonesServices such as Signal and Proton Mail attract users because their encryption limits what the provider can disclose. The Crime Branch’s specifications seek access through the device, where encryption keys are stored. The all-in-one tool must have the “Ability to extract encryption keys from the Android Keystore to decrypt Briar, ProtonMail, Silent Phone, and Signal apps” on certain Huawei devices. It must also “decrypt the ProtonMail app data (contacts and emails) by allowing to get the encryption keys from data acquired using Android Full File System method”. A module supplied as an “.apk” file is installed on an unlocked phone and meant “to run on the suspect phone”. It must extract data from applications including WhatsApp, Signal, Silent Phone, Discord, Telegram, Twitter, Viber, Wickr Pro and Zoom. The mobile extraction tool must capture chats through automatic screenshots of applications “like WhatsApp, Signal, Instagram and Snapchat”, and permit text searches across those screenshots.The Rohini laboratory’s MSAB specification, written more than a year later, covers newer applications. The tool “must support the collection of data from applications such as Signal Private Messenger, Session, Silent Phone, Simplex, and Proton Mail, which utilize keystore-based security mechanisms”. Session and SimpleX are messengers designed to work without a phone number or other user identifier.The documents also describe how to open locked phones. In 2020, the officer then heading the Delhi Police’s cyber crime unit told MediaNama that “Locked devices put a great restriction on us”. The Crime Branch’s specifications seek an “In-built Passware module” and “Password Dictionaries” created by “collecting the passwords found from Browsers, Apps and WiFi Connections etc.”. Passwords saved for one service can then be tried against the device. The all-in-one tool must use “Distributed processing, GPU Acceleration using ATI and NVIDIA cards” and “bypass screen locks” on specified Huawei and Honor devices. Where an “Enterprise Server” is installed at headquarters, the mobile extraction tool must be able “to fetch the exploit from Enterprise Server to unlock Android and iOS devices”.The Rohini laboratory’s MSAB specification requires “unlimited device unlocks and data extractions” and “brute-force attacks on encrypted backups”. It requires decryption of “user data even when the device is in a BFU (Before First Unlock) state”, which is the state of a phone that has been switched on but not yet unlocked. The tool must “identify, brute-force, extract, and decrypt secured containers such as Samsung Secure Folder, Xiaomi Second Space, Huawei Private Space”. It must support “distributed brute-force operations, enabling the use of multiple machines to process long and complex password attempts”, through “a client-server architecture, where the server application manages and distributes brute-force tasks across available clients until a successful password match is identified”.The process described in these specifications requires no cooperation from the phone’s owner. Several computers can work together to find a passcode. Once investigators gain access, they can copy the phone’s contents, decrypt protected folders, read messaging applications and use tokens to enter online accounts. The specifications identify no legal authority for these steps.Facial recognition and image classificationThe Crime Branch’s all-in-one tool “must support a full facial recognition capability using the images in the device”. Investigators must be able to “Create a unique set of reference images to identify in the extraction”, “Conduct searches for specific faces in one or more extractions” and “Adjust the percentage of resemblance”. They can therefore search the copied contents of several phones for the same person. The tool must also “categorize human faces using built-in facial recognition technology” and “categorize the Photographs based on Age, gender, race, emotion and more”.The mobile extraction tool must use machine learning “to automatically identify media files related to 20+ key categories like Cars, Credit cards, Documents, Drugs, Faces, Photo ID, Flags, Food, Gatherings, Screenshots, Handwriting, Maps, Money, Nudity, Tattoos, Weapons and Suspected CSA (Child Sexual Abuse)”. The tool for internet artefacts must have “15+ AI Categories to automatically identify and bifurcate images related to drugs, weapons, nudity, weapons, militants, vehicles, screen captures, documents, ID Cards, Human Faces, License Plates, Building, Child Abuse, Tattoos, Invoices, etc”. The tool for Apple computers must support “image categorization such as Porn, Weapons, Drugs, Extremism, Gore, Alcohol, Swim/Underwear, Documents, ID, Currency, CSAM, Chat, and Vehicles”.These lists appear to come from vendors’ product descriptions. Categories for child abuse material and narcotics have an evident investigative use. Categories such as “Gatherings”, “Flags”, “Extremism” and “militants” could also be used to classify photographs on a protester’s phone, and the documents impose no limits on their use. The mobile extraction tool must allow investigators to “enrich the extracted data sources, and quickly reveal evidence based on available public data on Facebook, Instagram, and Twitter”. A phone’s contents can then be matched with its owner’s public posts.The Rohini laboratory’s Oxygen specification requires image classification into eighteen categories, beginning with “pornography, extremism, graphic violence”. For the “facial categorization feature”, the tool “should be able to identify faces wearing glasses, hats, and protective masks”. Optical character recognition must cover more than fifteen regional languages, including Hindi, Urdu, Bengali, Punjabi, Tamil and Telugu. The speech-to-text engine must “transcribe spoken language from audio and video files” in more than fifty languages. The MSAB specification requires speech-to-text processing in Hindi and six other languages, along with “semantic analysis capability in order to categorize the meaning of specific words, such as categories of abuse”. These functions allow investigators to search transcribed voice notes and text in images, and to identify or classify faces.The Crime Branch tender requires comparison of a reference face with images from more than one extraction. The phones shown are schematic. The graphic does not report an actual search.GeM now has a standard category called “Mobile Device Forensic Extraction Software”. As reproduced in the NFSU bid, its analysis features include “Face Detection and Visual Similarity Grouping”, “Cross-Case Entity Correlation”, “Location Pattern Analysis” and “Communication Pattern Analysis”. Our tracker records use of this category between 21 September and 6 November 2026 by the Home Departments of Gujarat, Odisha, Kerala, Bihar, Tamil Nadu, Chhattisgarh and Daman and Diu, and by three NFSU campuses. Face detection and the correlation of data across cases are standard entries on a government procurement form.Single seller procurement at RohiniOn 28 September 2026, twelve days before the Jantar Mantar protests, the Rohini laboratory published a bid for two units of MSAB XRY Pro. The Swedish manufacturer describes the product as “Our most advanced extraction tool”, able to “Brute-force locked BFU (Before First Unlock) devices” and “Leverage the latest brute-force and extraction exploits”. The purchase was in preparation by May, months before the protests. The bid marks “Single Tender Applicable” as “Yes” and gives this reason: “It will not be in public interest to procure the goods through advertised tender enquiry. Sufficient reasons for the same have been recorded in writing by the competent authority.” Themis Forensics Private Limited was the only seller permitted to participate.Themis Forensics is a registered micro or small enterprise at Pushkar Enclave, Paschim Vihar, Delhi. Its website names no products, partners or clients, and its “Products” and “Services” pages have no listings. The procurement portal records its registration as a seller in 2023. We could find no other award to the company on that portal. The bid’s item category is the brand name, “MSAB XRY PRO”, which excludes competing products. Although the bid lists “Digital Forensic Platform Software (V2)” among the relevant existing GeM categories, the item was created as a custom entry under the brand name. The Make in India preference is marked “No”, and no authority is recorded for the exemption. In the contract, “IFD Concurrence” reads “No”. Administrative approval is attributed to the Principal Director and financial approval to the head of department.The bid closed on 19 October, nine days after the first detentions, and one bid was received. The contract, generated on 6 November 2026, provides for two units at ₹2,29,36,000 each, a total of ₹4,58,72,000. It records Sweden as the country of origin, requires delivery at Rohini by 4 February 2027 and includes five days of training for ten staff members. The specification requires extraction from iPhones running iOS versions up to 26.2, processing of three devices at once on a single licence and unlimited unlocks.The justification quoted in the bid comes from a rule governing a different procedure. The phrase “it will not be in public interest to procure the goods through advertised tender enquiry” appears in Rule 162(iii)(b) of the General Financial Rules, 2017. Rule 162 governs limited tender enquiries, sent to a few known suppliers without advertisement. Single-source purchases fall under Rule 166. That rule permits them where “only a particular firm is the manufacturer of the required goods”, in an emergency, or where machinery or spare parts must be standardised for compatibility with existing equipment.The annexures to the bid seek to justify the purchase under the first of these grounds. A “Proprietary Article Certificate” on MSAB’s letterhead, dated 25 May 2026, certifies through the company’s Singapore entity that “MSAB is the sole manufacturer of the above-mentioned product and no other make or model in the world is meeting the following specifications and features”. It lists five features and adds: “No other company manufactures products with the same name and specifications as offered by us.”The laboratory’s own Rule 166 certificate, dated 10 June 2026, is signed by the head of its cyber forensic division, an Assistant Director. It states that “The indented goods are manufactured by M/s MSAB XRY Pro”, which names the product as its own manufacturer, and that “No other company manufactures product with same Name and specifications other than MSAB XRY Pro”. It lists three features and attributes them to “Digital Intelligence”, a name found nowhere else in the bid papers. Of the four entries prescribed under Rule 166, the certificate includes two. It omits the entries for the concurrence of the finance wing and the approval of the competent authority.A third document, MSAB’s letter of 28 July 2026, states that Themis Forensics “is authorized to sell our software license for all our products including XRY Pro”. It does not say that Themis is the only authorised seller. In July 2025, The Wire reported that another firm, Pelorus Technologies, had been described as MSAB’s “national distributor for India”. The bid papers do not explain the restriction to Themis.MSAB certified in May that no other product would meet the requirements, and the laboratory did so in June. The technical committee signed the specification on 10 July, a month after the laboratory had certified that no other product could meet it. MSAB authorised Themis on 28 July. The specification was uploaded to GeM on 22 September, and the bid published six days later admitted that seller alone. The bid’s disclaimer prohibits brand-specific clauses “except in case of Single Bid / Proprietary Article Certificate (PAC) Buying”. Both certificates list features, but neither records a comparison with competing products. The laboratory’s certificate relies on the fact that no one else makes a product of the same name. We have asked the laboratory whether this meets Rule 166 and are putting the question to the Central Vigilance Commission.The laboratory’s proprietary certificate predates the signed technical specification by 30 days. The contract total is ₹4,58,72,000 for two units.Oxygen Forensic Detective in Delhi laboratoriesOn 25 September 2026, three days before the MSAB bid, the Rohini laboratory published bids for the renewal of four licences and for two new licences of Oxygen Forensic Detective. The renewal bid identifies the existing licences by dongle numbers 186075, 186077, 186079 and 186081. The new-licence bid was reserved for government sellers. Their specifications, signed on 20 August and 10 August 2026 respectively, are nearly identical and quoted above. The renewal bid confirms that the laboratory already holds four licences.Two days earlier, on 23 September, the United States Department of Justice had announced charges of conspiracy to commit wire fraud against Oxygen Forensics chief executive Lee Reiber and Oleg Davydov, a Russian national from Moscow whom prosecutors describe as one of five people controlling the company. The complaint alleges that Oxygen told US government agencies it was American-owned while Russian officials at the company “repeatedly overruled” its chief executive. According to the complaint, the American and Russian arms “sold the same software, developed by the same team, and were owned by the same people”. Prosecutors also claim that the software was written by developers at MKO Systems, a Moscow company owned by the same five people. Customers of the Russian arm included the Federal Security Service. American customers included the Secret Service, Homeland Security Investigations and the Department of Defense. The complaint records that US procurement officials “would not have awarded or renewed contracts for the forensic software had they known” it was Russian-owned.The Justice Department stated that “The complaint does not allege that the software contained malicious code” or that it was used to gain unauthorised access to customers’ data. The charges remain allegations and have not been tested at trial.Natalia Krapiva of Access Now told CyberScoop that civil society had warned for years that Oxygen “was owned and built from Russia”. MediaNama had described it as a Russian firm as early as 2020. On 2 October, The Register reported that London’s Metropolitan Police, which signed a three-year Oxygen contract in December 2023, had “paused our use of the tool while we carry out a full review”. Latvia’s State Police has suspended the software, and Romanian authorities have begun ending their use of it.The Rohini bids were published two days after the charges were announced. Their closing dates were 10 October for the renewal and 13 October for the new licences, and each bid allowed a single automatic seven-day extension if no bid was received. The portal showed them open until 17 and 20 October. By 8 November, both were marked cancelled, and no reason has been published. We do not know whether the cancellations were prompted by the American charges, our questions or another cause. The laboratory retains four licences, and the public record does not establish whether any phone seized in October was examined with them. Our tracker shows that Himachal Pradesh’s forensic directorate was still evaluating bids for a three-year Oxygen subscription this autumn.The two bids and their later cancellation are distinct from the four existing licences. No reason for the cancellation has been published.The Crime Branch’s specifications closely resemble those for Oxygen. The Home Ministry’s March 2025 order includes Oxygen Forensic Detective among the exempted tools. The bid’s GeM disclaimer treats as void any clause “Mentioning specific Brand or Make or Model or Manufacturer or Dealer name”. Yet the all-in-one tool specification opens with the same sentence as Rohini’s Oxygen specification. Both reproduce the ungrammatical requirement for “a License dongle to without a need to install a fixed license locked on single computer”. The Crime Branch requires the “Jet Imager technique”, and Jet-Imager is the name of an Oxygen module. The handsets listed as supported include “teXet TM-5073”, “DEXP BS650” and “Digma LINX Atom 3G”, brands sold mainly in Russia. The cloud services include VKontakte and TamTam.Other passages reproduce vendors’ language. The annexures require imports from “a project folder originally exported by Amped Replay”, “GrayKey images” and images created by “the KAPE (Kroll Artifact Parser and Extractor) utility”. They name an “In-built Passware module”, the “DV200” training course and the “EDAS FOX” server, whose description is followed by a passage headed “Why each of these specifications is essential”. Parts of the scope chapter speak in a vendor’s voice: “Our software reduces evidence processing time” and “Our software bypasses system-level passwords”. The mobile extraction tool must decode “warrant return packages from Facebook, Google, Snapchat, Instagram, Apple iCloud, Discord and TextNow”. These are the data bundles that American companies produce in response to US court warrants. These passages suggest that much of the tender was assembled from material written for other markets.The Crime Branch’s eleven-item tender was awarded for ₹4.98 crore, but the award record does not identify the products supplied. We cannot establish whether its all-in-one tool is Oxygen Forensic Detective. If it is, the police have procured software that US prosecutors allege was developed in Russia, and the specification requires it to extract and use cloud credentials from seized phones. The bid’s only stated safeguard against malicious code is a certificate that the seller must upload, which states that the software contains no embedded code that would “Tap information resident or transient in the equipment/network”. The Delhi Police has not identified the product it received or said whether it reviewed its use after the charges.Legal authority and safeguardsSection 69 of the Information Technology Act, 2000 deals most directly with decrypting information stored on a device. It permits the government to “direct any agency of the appropriate Government to intercept, monitor or decrypt” information in a computer resource. The 2009 rules require a reasoned order from the Union or State Home Secretary, subject to committee review. Since January 2019, IFF has challenged this procedure in Writ Petition (Civil) No. 44 of 2019, which is pending. We argue that executive authorisation without judicial oversight fails the standard laid down in Puttaswamy. The procurement documents do not indicate that a Section 69 order is obtained before a seized phone is unlocked.The Bharatiya Nagarik Suraksha Sanhita, 2023 provides for the production and seizure of devices. Section 94 permits a court or the officer in charge of a police station to require production of a document or thing, expressly including “electronic communication, including communication devices, which is likely to contain digital evidence”. Section 105 requires a search or seizure to be “recorded through any audio-video electronic means preferably mobile phone”. In its October 2025 judgment on the summoning of advocates, the Supreme Court directed that a lawyer’s digital device may be produced under Section 94 only before the jurisdictional court. It may be opened only in the presence of the lawyer and client, who may be assisted by a technical expert of their choice. This protects the confidences of clients who are not under investigation. Other seized phones also contain communications involving people who are not under investigation.None of these provisions refers to tokens. A Section 94 production order concerns an existing document or thing. Using a token from a phone to access a server, usually abroad, raises a separate question, because no provision of Indian law expressly authorises investigators to enter an online account in this way. The tenders do not address this question or the subsequent use of extracted data. The Crime Branch’s five servers and 300-terabyte storage array, and Rohini’s systems, will hold copies of phones, computers and linked accounts. The documents prescribe no retention period or rules governing access. They mention only the tools’ own audit logs as a safeguard. Revoking a token depends on the account holder or service provider knowing it has been taken.The Digital Personal Data Protection Act, 2023 offers little protection here. Its main provisions come into force in May 2027, and Section 17(1)(c) exempts processing “in the interest of prevention, detection, investigation or prosecution of any offence” from most obligations. The right to privacy under Article 21, as recognised in Puttaswamy, remains applicable. The guidelines sought by the Supreme Court in Foundation for Media Professionals must give effect to that protection.In Riley v. California in 2014, the US Supreme Court held that “a cell phone search would typically expose to the government far more than the most exhaustive search of a house”. Its answer to what police must do before searching a phone seized on arrest was “accordingly simple”: “get a warrant”. The US government itself conceded in that case that the power to search a phone on arrest could not extend to remotely stored files.What the procurement papers record, against what IFF is seeking. These are IFF’s proposals, not a statement of current legal duties.Who is affectedPeople whose phones were taken in Delhi on 10 and 11 October and during subsequent detentions do not know whether their devices were sent to either laboratory. The public record gives no answer, and the owners have not been told. Returning a handset would not, by itself, delete a laboratory’s copy of its contents or invalidate tokens taken from it. The intrusion also affects everyone who communicates with the phone’s owner. A journalist’s device may identify confidential sources. A lawyer’s device may contain client communications, which is why the Supreme Court laid down safeguards for it. A protester’s phone may hold the WhatsApp chats of a housing society, messages from a doctor and photographs of people standing nearby. Cloud extraction extends access to email, location history, photographs and contacts in a Google account, and to WhatsApp backups containing other people’s messages. Searching faces across extractions could allow investigators to look for someone photographed at one gathering in the phones of people detained at another.Sorting photographs by “race” and identifying “Gatherings” and “Flags” can help build profiles of constitutionally protected associations and beliefs. Attending a gathering or holding a flag is not an offence. We can see no investigative purpose in recording the race of people in someone’s photographs. Whatever their origin in vendors’ product descriptions, the Delhi Police adopted these features as tender requirements. If used on phones taken during the October detentions, they would be applied to devices seized without warrants, during detentions that counsel have told the Supreme Court were illegal.A handset, a forensic copy and recovered tokens have separate lifetimes. The public record does not establish whether the October devices were examined.Defects in the procurement recordsWe are placing several defects in the Crime Branch tender before the Central Vigilance Commission. The tender makes a “presentation and/or demonstration” of the quoted software compulsory during technical evaluation. Its GeM disclaimer treats as void any clause “Seeking sample with bid or approval of samples during bid evaluation process”, except where trials are allowed. The list of those categories linked from the bid includes simulators, bullet-proof helmets, pontoon boats and snow boots, but no forensic software.The performance security clause states that a concessional rate “will be applicable upto 31.3.2023”, two years before the bid was issued. It refers to three per cent while fixing security at five per cent in the same clause. The Integrity Pact names Independent Monitors appointed by an order of 1 March 2018. The award was about nineteen per cent above the estimate.Rohini’s single-seller bid relies on wording from a rule governing a different procedure. Neither its certificate nor the contract records the concurrence of the finance wing. No authority is recorded for setting aside the Make in India preference. Its certificate names the product as its own manufacturer. The ministry’s letters attribute the NIA and NFSU exemptions to the Union Home Minister. At Rohini, a Delhi Government body buying the same class of tool during the same period, an Assistant Director signed the certificate and the Principal Director is the highest authority named.ActionWe are filing applications under the Right to Information Act, 2005 with the Delhi Police, the Forensic Science Laboratory at Rohini and the Ministry of Home Affairs, seeking:Delhi Police file of 24 January 2025 seeking the exemption, and the name and designation of the competent authority who approved it.The names of the products supplied under the Crime Branch contract and reports of any trials.The competent authority’s recorded reasons for restricting the MSAB XRY Pro bid to one seller, and the file approving the laboratory’s Proprietary Article Certificate of 10 June 2026.The reasons for cancelling the two Oxygen bids and any review of Oxygen Forensics following the US charges.Any standing orders or protocols at either laboratory governing cloud acquisition, tokens, facial categorisation, data retention and access.The number of devices and cloud accounts from which data has been extracted since 2023.Whether any device seized between 10 October 2026 and the date of this post was sent to either laboratory; andThe Women Safety Division file approving the exemption of 7 January 2026 in the Home Minister’s name, and details of every purchase made under it.IFF lawyers already represent the petitioners in Foundation for Media Professionals v. Union of India and will seek to place the specifications for cloud extraction, keystore decryption and facial categorisation before the Supreme Court. These show the capabilities the promised guidelines must regulate. We are writing to the Central Vigilance Commission about the demonstration requirement, the expired concession on performance security, the Integrity Pact panel of 2018, the single-seller bid at Rohini and the Make in India exemption granted without a recorded authority.We call upon the Union Government, the Government of Delhi and the Delhi Police to:Require a judicial warrant before a seized device is unlocked, copied or used to enter a cloud account. The warrant should identify the device, the data sought and the period covered, and should build on the Supreme Court’s safeguards for lawyers’ devices.Disclose whether phones seized during the October detentions were examined with these tools, delete every copy and revoke every token taken from anyone who has not been charged.File the guidelines promised to the Supreme Court in December 2023, which should prohibit facial categorisation by race and the use of classifiers for gatherings and flags on devices seized at protests.Publish a privacy impact assessment for every forensic procurement by the police or a laboratory, and have each specification reviewed independently of the vendor.If your phone was taken during the October protests in Delhi and has been returned, please do not reset it. Traces of extraction may remain and could be the only evidence of what was done. From another device, change the passwords for accounts used on the phone and sign out of all other sessions through each service’s security page, which revokes the tokens. Write to legal@internetfreedom.in. Amnesty International’s Security Lab and Access Now’s Digital Security Helpline may be able to examine phones for signs of extraction. We are collecting cases and will help.This article was originally published on the Internet Freedom Foundation.