New VPN Rules | 28 Jun 2022

Why in News?

Recently, Indian Computer Emergency Response Team (CERT-In) issued norms under which VPN providers have to record personal information of their customers, including the purpose of using the service, for five years.

• CERT-In is an organisation of the Ministry of Electronics and Information Technology with the objective of securing Indian cyberspace.

What is VPN?

• About:
  • VPN stands for "Virtual Private Network" and describes the opportunity to establish a protected network connection when using public networks.
  • VPNs encrypt internet traffic and disguise the user’s online identity. This makes it more difficult for third parties to track activities online and steal data. The encryption takes place in real time.

• Functioning:
  • A VPN hides the user’s IP address by letting the network redirect it through a specially configured remote server run by a VPN host.
    • This means that if a user is surfing online with a VPN, the VPN server becomes the source of data.
  • Internet Service Provider (ISP) and other third parties cannot see which websites the user visits or data sent and received online.
• Benefits:
  • Secures encryption:
    • A VPN connection disguises data traffic online and protects it from external access.
    • Unencrypted data can be viewed by anyone who has network access. With a VPN, the government, hackers and cyber criminals can’t decipher this data.
  • Access to regional content:
    • Regional web content is not always accessible from everywhere. Services and websites often contain content that can only be accessed from certain parts of the world. Standard connections use local servers in the country to determine your location.
    • With VPN location spoofing, one can switch a server to another country and effectively change location.
  • Secure data transfer:
    • VPN services connect to private servers and use encryption methods to reduce the risk of data leakage providing secured passage for data.
• Limitations:
  • Reduced Internet Speed: Since VPNs require your traffic to be routed via a VPN server, it could take longer to reach your destination website.
  • Not Anti-Virus Software: VPNs do not function like comprehensive anti-virus software. While they protect one’s IP and encrypt one’s internet history, a VPN connection does not protect one’s computer from outside intrusion.
    • Once the malware has found its way to a device, it can steal or damage the data, whether VPN is in service or not.
• Regulation:
  • Currently, a handful of governments either regulate or outright ban VPNs.
  • These include China, Belarus, Iraq, North Korea, Oman, Russia, and the UAE. Many other countries have internet censorship laws, which make using a VPN risky. 

What are the New Rules related to VPN?

• The Union Ministry of Electronics and Information Technology issued new norms for VPN companies to record personal information of their users including names, email id, phone number and IP address for a period of five years.
  • They also have to record usage patterns, purpose of hiring services and various other information.
• Apart from VPN companies, data centers, virtual service network providers, cloud service providers have also been asked to record and maintain similar data.
• Entities are also required to report cybersecurity incidents to CERT-In within six hours of becoming or being made aware of them.

Why has the government issued these rules?

• These rules will “enhance overall cyber security posture and ensure safe & trusted internet in the country”.
• It noted that the Indian Computer Emergency Response Team (CERT-In), which serves as a safeguard against cyber-attacks, has identified “gaps” in the way it analyses online threats due to which it has issued the new norms for reporting cyber incidents.
• In 2021, a Parliamentary Standing Committee, in a report to the Rajya Sabha, wanted the Ministry to block VPNs with assistance from internet service providers.

What are the related Issues?

• Customers will have to go through a stringent KYC process while signing up to use a VPN and will have to state the purpose of using the services.
  • With the new rules the government will basically have access to the personal information of the customers which makes the use of a VPN redundant.
• Many VPN providers are mulling the implications of the new rules and some have even threatened to pull back their service from the country.
  • In response to CERT-In rules, Nord VPN, one of the world’s largest VPN providers, has said it is moving its servers out of the country. Two other firms, Express VPN and Surfshark, said they will shut down their physical servers in India and cater to users in India through virtual servers located in Singapore and UK.

Source: TH