VPN companies promise a no-log policy. So, people, who want to be anonymous and care for their privacy, use VPNs. But it is going to change in India. A new order by the Indian Government requires VPN companies to collect and store users’ data for five years or more. If a company fails to comply with the directives, strict action will be taken. The new rules will come into action starting July 27th.
CERT-in (Computer Emergency Response Team) has asked data centers, crypto exchanges, and VPN companies to store user data. This data will be used in the investigation of cybersecurity incidents.
Companies are asked to keep the following information:
- Name, email address and phone number
- The customer’s purpose for using the VPN service
- The IP addresses allotted to the customer and the IP address the customer used to sign up with the service
- The “ownership pattern” of the customer
Hackers always use VPNs to launch cyberattacks on government institutions. In these incidents, investigations are stuck at the end of the VPN because they don’t know who used that temporary VPN session. Several fake social media accounts are created and accessed using VPN to hide the original IPs. Online piracy and Money Laundering people also use VPNs to hide their online activities. CERT-in incidents. If VPN service providers keep the mentioned information, it can be used to unmask cybercriminals in most incidents.
If you look from a cyber incident perspective, the directive feels good. But it also compromises the privacy of Internet users who mainly use VPNs to keep their internet activity private. The new directive actually kills the main selling point of VPN. If VPN companies start logging the information, what’s the point of using them.
