GS Paper 3
Syllabus: Science and Technology
Context:
The Indian Computer Emergency Response Team’s (CERT-In’s) directive to virtual private network (VPN) providers to store user data on Indian servers has prompted many of them to shut their local servers.
What do CERT-In directives say:
VPN providers have specifically been directed to store validated customer names, their physical addresses, email IDs, phone numbers, and the reason a customer is using the VPN.
They also have to log the user’s “ownership pattern” and the dates when they use the VPN, along with a record of the time-stamp for when a user registered, and every IP address that the VPN assigns to the user.
Why are VPN companies leaving India?
VPN providers who provide “no-logging” services cannot do so if they comply with such rules, which is why they’re withdrawing servers to leave the Indian government’s jurisdiction. E.g. NordVPN, Surfshark and ExpressVPN
Impact of the move:
VPN providers install their servers in a country to achieve two purposes—to be close to their users and to increase the number of locations they can provide. Removing servers from India, in theory, affects the overall speed that a VPN can provide, though this will hardly make a difference for those using VPNs simply to browse the web by spoofing their location.
Government Intention:
The government wants to access VPN data for domestic regions as well as may ask companies to comply even if they have no physical presence in India, as their “computer systems” are operating within Indian cyberspace. But they add that the Information Technology Act of 2000 is meant to regulate Indian cyberspace and should not have extra-territorial reach.
Practice Questions
Q. What is “Virtual Private Network”? (UPSC CSE 2011)
(a) It is a private computer network of an organization where the remote users can transmit encrypted information through the server of the organization
(b) It is a computer network across a public internet that provides users access to their organization’s network while maintaining the security of the information transmitted
(c) It is a computer network in which users can access a shared pool of computing resources through a service provider
(d) None of the statements (a), (b) and (c) given above is a correct description of Virtual Private Network
Answer: C
Q. What is a virtual private network (VPN)? Discuss its applications and security issues associated with it. (10M)
