HIDE, BUT SEEK

On April 28, India’s cybersecurity watchdog Computer Emergency Response Team (CERT-In) issued a set of rules—called Cyber Security Directions— which require companies offering Virtual Private Networks (VPNs) to store in their servers a wide range of data on their subscribers, including names, addresses, contact numbers, email addresses, IP addresses, ownership patterns and purpose of hiring the services, for a period of five years.

- Kaushik Deka

The directive made it mandatory for VPN service providers to report cyber security breach incidents within six hours of noticing them. Failure to comply can invite a jail term of one year or a fine of up to Rs 1 lakh, or both. Corporate and enterprise VPNs have been exempted from the regulations, expected to come into effect on June 27.

In response, ExpressVPN, a popular VPN service provider owned by British Virgin Islands-based Express Technologies, announced its exit from India. Calling it an assault on the right to privacy, activists and legal experts have labelled it as a government ploy to step up surveillance. The government claims the move would protect vulnerable citizens from cybercrimes.

Establishing an encrypted connection between computers and the internet and providing a private route for data, a VPN service protects users by preventing their IP addresses from being tracked by websites, law enforcement agencies, cybercriminals and others. Most users subscribe to VPN services to access company networks securely, remain anonymous, access geo-restricted content, get around internet curbs and so on.