© The Indian Express Pvt Ltd
Tags:
Journalism of Courage
ExpressVPN has removed its servers from India, becoming the first major virtual private network (VPN) provider to do so in the aftermath of the recent cybersecurity rules introduced by the country’s cybersecurity agency. The rules require VPN providers to store user data for a period of five years. ExpressVPN said it “refuses to participate in the Indian government’s attempts to limit internet freedom”.
In a blog post, the British Virgin Island-based company said that with the introduction of the new cybersecurity rules by the Indian Computer Emergency Response Team (CERT-In), it has made a “very straightforward decision to remove our Indian-based VPN servers”. While ExpressVPN is the first to pull its services from India, other VPN providers like NordVPN have also taken a similar stance.
The company’s decision comes after Minister of State for Electronics and Information and Technology Rajeev Chandrashekhar warned VPN companies that if they do not adhere to the norms, they are free to exit the country. Last month, he had said, “If you’re a VPN that wants to hide and be anonymous about those who use VPNs and you don’t want to go by these rules, then if you want to pull out (from the country), frankly, that is the only opportunity you will have. You will have to pull out.”
The guidelines, released by CERT-In on April 26, asked VPN service providers along with data centres and cloud service providers, to store information such as names, e-mail IDs, contact numbers, and IP addresses (among other things) of their customers for a period of five years. The government said it wants these details to fight cybercrime, but the industry argues that privacy is the main selling points of VPN services, and such a move would be in breach of the privacy cover provided by VPN platforms.
ExpressVPN described the cybersecurity rules as “broad” and “overreaching”.
“The law is also overreaching and so broad as to open up the window for potential abuse. We believe the damage done by potential misuse of this kind of law far outweighs any benefit that lawmakers claim would come from it,” ExpressVPN said.
It added that while CERT-In’s rules are intended to fight cybercrime, they are “incompatible with the purpose of VPNs, which are designed to keep users’ online activity private”.
Indian users of ExpressVPN will still be able to use its service via “virtual” India servers located in Singapore and the UK.
“We will never collect logs of user activity, including no logging of browsing history, traffic destination, data content, or DNS queries. We also never store connection logs, meaning no logs of IP addresses, outgoing VPN IP addresses, connection timestamps, or session durations,” the company said.
