VPN may soon get banned in India

[Abhinav]

They have not completely banned VPN but made it useless by stripping off the basic thing it offers- Privacy.

The government made it compulsory to log and store user's data for 5 years or more even when the user has cancelled his subscription or closed his account. This data should be shared promptly whenever asked by GOI.

You are also required to share your details like validated real name, contact number, physical address, reason to use it, etc. Those who don't comply could potentially face up to a year in prison.

Most VPNs offer a no-logging policy, a public promise against logging, collecting or sharing customer usage and browsing data. Leading services like ExpressVPN and Surfshark operate only with RAM-disk servers and other log-less technology, meaning the VPNs would be theoretically incapable of monitoring for URLs listed in the directive. If VPNs in India are required under the new directive to keep customer registration data -- or to monitor and report social media usage -- many could potentially run afoul of the law simply by continuing to operate.

India Orders VPN Companies to Collect and Hand Over User Data

A new government order will force virtual private networks to store user data for five years or longer.

www.cnet.com

 

[Bapun]

According to a report by WIRED, several VPN providers also echoed the same concern regarding the new directive. For example, Harold Li, vice president of ExpressVPN, stated that the company will never log user information or activity, and will change its operations and infrastructure “to preserve this principle if and when necessary".

Additionally, Surfshark told WIRED that the VPN provider can’t now comply with India’s logging rules since it uses RAM-only servers that automatically overwrite user-related data, while ProtonVPN stated that even though it is monitoring the directives, it remains committed to its no-logs policy and to protecting the privacy of its users.

Similarly, Nord Security said that it would remove the servers from India if no other options are available. It should be noted that Nord Security is the developer of Nord VPN, which is one of the most popular VPN services in India.

VPN Providers May Not Comply with New CERT-In Directives, End Up Leaving India

VPN service providers in India have two months to comply with the new laws and begin data collection of users

www.news18.com

VPN Providers Threaten to Quit India Over New Data Law

The country has ordered companies operating VPNs to collect user data and hand it over to officials—but they’re refusing to do so.

www.wired.co.uk

 

[Bapun]

Corporate VPN | Corporate VPNs needn’t maintain logs of customers: CERT-In

In a list of clarifications to its April 28 mandate, being currently finalised Computer Emergency Response Team (CERT-In) is likely to say that the directive to store customer information applies only to those VPNs that offer services to general internet subscribers.

economictimes.indiatimes.com

 

[d5aqoep]

Corporate VPN | Corporate VPNs needn’t maintain logs of customers: CERT-In

In a list of clarifications to its April 28 mandate, being currently finalised Computer Emergency Response Team (CERT-In) is likely to say that the directive to store customer information applies only to those VPNs that offer services to general internet subscribers.

economictimes.indiatimes.com

Paywall

 

[Bapun]

Virtual private network service providers that are not ready to comply with the new guidelines have the only option to exit from India, minister of state for electronics and IT Rajeev Chandrasekhar said on Wednesday.

Follow rules or exit the country, minister tells VPN service providers

The minister, while releasing FAQs on the recent directive on reporting of cyber breach incidents, said that every well meaning company or entity understands that a safe and trusted internet is going to help it.

www.hindustantimes.com

 

[Bapun]

At a press conference where FAQs on the April 29 directions were released, Minister of State (MoS) in MeitY Rajeev Chandrasekhar reasoned not taking a public consultation as it "has no effect on citizens".

The Ministry of Electronics and Information Technology (MeitY) refused details on consultations taken over the April 29 directions of the Indian Computer Emergency Response Team (CERT-In) citing 'affect' to national security.

RTI: MeitY refuses details on consultation process of CERT-In directions citing national security

This development comes even as several industry associations and lobbying groups urged CERT-In to launch a larger consultation process regarding the directions for public reply

www.moneycontrol.com

 

[Bapun]

With a recent data law introduced in India requiring all VPN providers to store user information for at least five years, ExpressVPN has made the very straightforward decision to remove our Indian-based VPN servers.

Rest assured, our users will still be able to connect to VPN servers that will give them Indian IP addresses and allow them to access the internet as if they were located in India. These “virtual” India servers will instead be physically located in Singapore and the UK.

ExpressVPN Ensures Privacy for India VPN Users | ExpressVPN Blog

ExpressVPN has removed its VPN servers from India, but users will still be able to connect to servers with Indian IP addresses.

www.expressvpn.com

ExpressVPN shuts India servers as it refuses to comply with government diktat

ExpressVPN has not only refused to comply with India’s new directive, but it has called the law “overarching.”

www.indiatoday.in

 

[Prithi Deb]

Surfshark VPN shuts down India servers

Prior to Surfshark, ExpressVPN removed its servers from India following the cybersecurity directive released by the Indian Computer Emergency Response Team (CERT-In). This may not be the last one, as at least one more VPN provider in NordVPN too is contemplating removing its India servers.

indianexpress.com

“In response to the new Indian data regulation laws, Surfshark is shutting down its servers in India. The new laws require VPN providers to record and keep customers’ logs for 180 days as well as collect and keep excessive customer data for five years,” the company said in a blog post on Tuesday. “Surfshark proudly operates under a strict ‘no logs’ policy, so such new requirements go against the core ethos of the company”.

 

[Bapun]

Govt bans VPN, cloud services for employees

The National Informatics Centre (NIC), which is under the Ministry of Electronics and Information Technology, said it had put out the guidelines to improve the “security posture” of the government.

economictimes.indiatimes.com

 

[Prithi Deb]

India orders VPN companies to collect user data

India's most recent move will force VPN providers to hand data over to its governing bodies.

nordvpn.com