Govt looks at stricter rules for VPN providers: Office in India, appoint compliance officials, Pg1

Key Highlights:

• The Indian government is developing a new legal framework to impose stricter regulations on Virtual Private Network (VPN) providers.
• This framework may mandate VPN companies to establish a local office in India and appoint compliance officers to liaise with the government.
• Penal consequences, including potential jail terms for non-compliance, are under consideration.
• The move follows the Indian Computer Emergency Response Team (CERT-In) directives from 2022, which required VPN providers to store customer data, but faced non-compliance.
• The primary motivation is to prevent users from bypassing government-blocked apps and online content.

Detailed Insights:

• The proposed legal framework aims to address the limitations of the 2022 CERT-In directives, which were largely ineffective as many VPN providers refused to comply and removed their physical servers from India.
• VPN services allow users to mask their IP addresses and access geo-blocked content, which the government views as undermining its content blocking efforts.
• The new rules are expected to mirror some requirements placed on large social media companies under India’s IT Rules, 2021, such as appointing resident compliance officers.
• India has significantly increased its content blocking orders, issuing over 24,000 in 2023, a substantial rise from 12,000 in 2022.
• VPN providers like Proton VPN, NordVPN, ExpressVPN, and Surfshark had previously relocated their servers outside India, routing traffic via other countries like Singapore, in response to the 2022 data retention mandates.

Key Concepts Involved:

• Virtual Private Network (VPN): A service that creates a secure, encrypted connection over a public network, allowing users to browse anonymously and access geo-restricted content.
• Indian Computer Emergency Response Team (CERT-In): The national agency responsible for cybersecurity incident response, issuing guidelines and directives to strengthen India's cyber infrastructure.
• IT Rules, 2021: Officially the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, these regulations govern social media intermediaries and digital news publishers in India, including requirements for compliance officers and content moderation.