Last month, the government unveiled new regulations that force virtual private networks to store and share their users’ data. And it has now told VPN companies to either follow the rules or get the hell out of the country. Here’s why this should make you unhappy.
Think of it as an encrypted tunnel that lets you browse the internet in total privacy. When you sign up for a VPN service, it first jumbles up all your data so no one can read it. And it hides your device’s unique IP address—rerouting it via one of its servers so it can’t be traced back to you. There are free VPN services and the paid variety. They are widely used by both individuals and companies.
Why use a VPN? Here are a number of good reasons:
Point to note: The government has long been itching to ban VPNs, arguing that bad actors—like terrorists and child traffickers—use them to avoid detection.
Data point to note: As of 2021, there were more than 270 million VPN users in India. The use of VPNs on smartphones jumped from 3.28% in 2020 to 25.27% in the first six months of 2021. And we are the second largest market for VPNs in the world.
A “national directive” issued by the government in April ordered VPNs to capture and store the following information for five years:
Even getting a VPN subscription will require a strict Know Your Customer verification—similar to getting a bank account. And any VPN violating these rules will face a fine plus jail term of one year.
Also this: The companies have to keep this information even after the user has cancelled their subscription. And they have to share it with the government on demand—though officials say they will not seek this information "on a continuing basis" and will do so only in case of cybersecurity incidents.
Key point to note: These rules also apply to data centres and cloud service providers. But in the case of VPNs, they only apply to individual users-–not to companies that use them for internal security.
The date to note: The rules will go into effect in June.
There are a number of reasons why both VPN companies and privacy advocates are unhappy with the new rules.
One: It takes the ‘private’ out of VPN. The whole aim of a VPN is to protect user privacy—and they were created specifically to allow you to browse the internet without being tracked. This also means that many of these products are not designed to comply with these requirements, as Cnet notes:
“Most VPNs offer a no-logging policy, a public promise against logging, collecting or sharing customer usage and browsing data. Leading services like ExpressVPN and Surfshark operate only with RAM-disk servers and other log-less technology, meaning the VPNs would be theoretically incapable of monitoring for URLs listed in the directive. If VPNs in India are required under the new directive to keep customer registration data—or to monitor and report social media usage—many could potentially run afoul of the law simply by continuing to operate.”
Point to note: A number of global VPN companies have already indicated that they will not alter their products to comply with the rules. For example, Nord VPN said: “We are committed to protecting the privacy of our customers, therefore, we may remove our servers from India if no other options are left.” While ExpressVPN has made it clear it will never log user information or activity—and will adjust its “operations and infrastructure to preserve this principle if and when necessary.”
Quote to note: When asked about the objections raised by VPN companies, the junior Information Technology minister Rajeev Chandrasekhar bluntly said:
“If you don’t have the logs, start maintaining the logs. If you are a VPN that wants to hide and be anonymous about those who use VPNs to do business in India and do not want to go by these rules, then frankly pull out of India. That is the only opportunity you have.”
Two: VPNs offer freedom from government surveillance—which is why the most repressive governments ban them, including China, Russia, Iran and Iraq. And as Internet Freedom Foundation’s Apar Gupta points out, VPNs have to be viewed “in the larger perspective of the absence of privacy protection or data protection framework in India, as well as the wide-ranging surveillance powers which the Indian state enjoys.”
And as another leading legal expert says:
“By requiring VPNs to exhaustively maintain detailed records, they fundamentally undermine the privacy of users who seek to browse the internet without having state or private corporations monitoring their actions. The rules wrongly presume that those seeking anonymity have something to hide.”
The government’s pushback: Cyber-security is the primary justification for these new rules—and the government insists this information is necessary to investigate cybercrimes. This is why the rules also require companies to report any cybersecurity incident within six hours. Point to note: India has been hit by a number of significant data breaches in recent years and was the third-most affected country worldwide in 2021.
But many experts don’t think going after VPNs will work:
“This is just going to make life difficult for the general, law-abiding citizen who’s just using VPN to get by. Someone who is a ransomware operator, that person is not going to be deterred by certain directives. They anyway have access to specialised service providers.”
The bottomline: is best summed up by researcher Srinivas Kodali, who says: “According to the rules, they are going to only demand these logs when they actually need them for part of an investigation. But in India, you never know how they will be abused.”
Medianama has a comprehensive guide to the new cyber regulation rules—including those that cover VPNs—and why most of them are “a joke.” Cnet focuses specifically on VPNs. Wired reports on the reactions of VPN companies. The Internet Freedom Foundation has a good guide to why VPNs matter.
If the BJP loses ground in Karnataka, it will have serious implications for the party, Modi, and Hindutva.
Read MoreBird flu is not new but its recent unprecedented spread is raising fears of a deadly mutation.
Read MoreWhy is the BJP looking weak and beleaguered in a key swing state.
Read MoreThe lesser known problem of recycling solar panels.
Read More