I’ve been writing about India’s demands to VPN providers to keep and provide data to the Indian Government on what Indian VPN users are doing, and how VPN operators are thinking twice about being in the country as a result. The Indian Government has even said do what we want you to do or get out. Well, ExpressVPN has decided to get out:
In a blog post, the British Virgin Island-based company said that with the introduction of the new cybersecurity rules by the Indian Computer Emergency Response Team (CERT-In), it has made a “very straightforward decision to remove our Indian-based VPN servers.” While ExpressVPN is the first to pull its services from India, other VPN providers like NordVPN have also taken a similar stance.
The guidelines, released by CERT-In on April 26, asked VPN service providers along with data centers and cloud service providers, to store information such as names, e-mail IDs, contact numbers, and IP addresses (among other things) of their customers for a period of five years. The government said it wants these details to fight cybercrime, but the industry argues that privacy is the main selling points of VPN services, and such a move would be in breach of the privacy cover provided by VPN platforms.
ExpressVPN described the cybersecurity rules as “broad” and “overreaching.” “The law is also overreaching and so broad as to open up the window for potential abuse. We believe the damage done by potential misuse of this kind of law far outweighs any benefit that lawmakers claim would come from it,” ExpressVPN said. It added that while CERT-In’s rules are intended to fight cybercrime, they are “incompatible with the purpose of VPNs, which are designed to keep users’ online activity private.” Indian users of ExpressVPN will still be able to use its service via “virtual” India servers located in Singapore and the UK. “We will never collect logs of user activity, including no logging of browsing history, traffic destination, data content, or DNS queries. We also never store connection logs, meaning no logs of IP addresses, outgoing VPN IP addresses, connection timestamps, or session durations,” the company said.
I really don’t get why India is so hell bent on this rather stupid and ill advised VPN law. If they really wanted to make a difference in terms of cybercrime, they would spend more time cracking down on its internal cybercrime and world-leading fraudulent call center and scamming activities. But they won’t because the scammers and fraudsters clearly have the Indian Government in their pockets. In the meantime, expect to see more VPN providers do some version of what Express VPN has done. Which means that the Indian Government won’t be winning this fight.