Privacy: VPN providers leave India

A new regulation for VPN providers has come into force in India, banning anonymous use of the services – effectively depriving them of all advantages. VPN providers are reacting and leaving the country.

No more anonymous use

At the heart of the new regulation, issued by the Indian Computer Emergency Response Team, is the mandatory storage of various personal data of all VPN users by VPN companies based in India. The names of users, the IP address assigned to them, the time of VPN use, the IP address used when registering for the VPN service, an email address, and a postal address and phone number are to be stored. This data must be stored for five years. The regulation was originally supposed to apply as of June. After an extension of the transition period, it came into force on Monday.

Ultimately, the regulation means turning away from anonymous VPN use. Users who have to provide all this data are transparent in their entire surfing behavior for VPN providers as well as for the state, which can request the data from them. The purpose of VPN use, however, is usually precisely to turn off the usually given traceability of one’s activities in favor of better privacy protection. In short, VPN services are used for the sake of anonymity, which has now been banned in India. What’s more, anyone who uses a VPN service based in India will henceforth be surfing less anonymously than all those who use the Internet without a VPN – because then, at least, their postal address, e-mail address, name and telephone number do not have to be disclosed immediately, even though they can regularly be ascertained with technical effort.

VPN services refuse

Major VPN providers have responded to the decree by leaving India. NordVPN, ExpressVPN, Tunnelbear and Proton have announced they will pull their hardware out of India in time to avoid the obligation to apply the new rules. Proton CEO Andy Yen had told the Wall Street Journal that the Indian requirements undermine Internet freedom and put activists and whistleblowers at risk. These groups of people in particular often resort to VPN services to escape political persecution. Yen went on to say that he felt it was very sad that the world’s largest democracy had chosen this path. He added that Proton will not submit to such regulations, which are similar to the totalitarian regimes in China and Russia, and participate in mass surveillance.

Internet freedom in India is on the decline

According to Freedom House, the Internet in India is only “partially free.” Internet blocking is sometimes imposed in the country, which is home to the second most Internet users on Earth after China. In addition, thousands of websites are blocked by the state. VPN services are also important here: they make it possible to circumvent such blocks. Overall, it can be observed that Internet freedom in India has continued to decline in recent years. The decree of the Indian Computer Emergency Response Team is now helping to reduce this further. Meanwhile, the institution, which is part of the Ministry of Electronics and Information Technology, has justified the move with its task of coordinating emergency measures in the event of cybersecurity incidents – for which it needs appropriate data, which in many cases has not been available so far and is not easy to obtain.

Whether the regulation will actually have a drastic impact on Internet users in India is still unclear. Although the major services have withdrawn from the country, many have announced that they will continue to be available to people from India – without collecting data. However, it is not yet clear to what extent this will be feasible.