Indian government proposals that the government says are aimed at improving cybersecurity have come under fire as some digital rights advocates, and firms in the VPN space, argue they could be open to abuse.
Under legislation scheduled to take effect on 27 June, VPN providers are required to retain user data and IP addresses for at least five years – even after clients stop using the service.
India ranks among the top 20 countries in VPN adoption. Many users are businesses (the new rules do not, apparently, apply to corporate VPNs) but, as Reuters points out, there are also activists, journalists, lawyers and whistleblowers who use VPNs to access blocked websites, secure their data and protect their identity. The new rules could, it has been suggested, threaten their online privacy, anonymity and freedom of speech.
Security is another driver for the new laws. Data breaches are a major issue in India, and the new rules, issued by the Indian Computer Emergency Response Team (CERT-In) in April, also require companies to report data breaches within six hours of noticing them, and maintain IT and communications logs for six months.
Technology firms are worried about the compliance burden and reporting timeline, but for some observers this is part of a more worrying wider trend through which governments worldwide are imposing greater control on the flow of information online, attempting to control dissent and monitor the activities of citizens.
The new rules have already driven one major player to change its business model. ExpressVPN, one of the world’s largest providers of VPN services, has now removed its virtual private network (VPN) servers from India, pointing out that “the new data law initiated by CERT-In, intended to help fight cybercrime, is incompatible with the purpose of VPNs, which are designed to keep users’ online activity private”.
ExpressVPN customers will still be able to connect to VPN servers that will provide them with Indian IP addresses, though these servers will be located in Singapore and the UK.
