Banning Virtual Private Networks (VPNs) – Explained, pointwise

Introduction

A parliamentary standing committee on Home Affairs has urged the central government to block Virtual Private Networks (VPNs) in India.

The recommendations come months after the central government liberalized the Other Service Providers (OSPs) sector by recommending the official use of VPNs, to facilitate the remote working ability for India’s massive outsourced IT industry.

Is an outright ban on VPNs justified? The question merits a detailed discussion of various underlying issues.

So, let’s begin.

What is a VPN?

Devices connecting to the Internet are all assigned an Internet Protocol (IP) address. This allows law enforcement agencies, service providers, etc., to identify the device and its location, thereby identifying the user.

A virtual private network (VPN) is an internet tool that masks a person’s actual Internet Protocol (IP) address, so the online actions are virtually untraceable. It provides online privacy and anonymity by creating a private network from a public internet connection.

VPN services establish secure and encrypted connections to provide greater privacy than even a secured Wi-Fi hotspot.

They can be used to hide a user’s browser history, Internet Protocol (IP) address, and geographical location, as well as web activity and devices being used. So you could be sitting next to a person in New Delhi, but your location could appear to be, say, Dublin or New York to any app application that you’re using.

Examples of VPNs: ExpressVPN, NordVPN, Surfshark, etc.

What is the scale of VPN usage in India?

Virtual Private Network (VPN) adoption jumped manifold in India in the first half of 2021 as companies moved to secure communication networks as more employees are working from home.

Of India’s 1.38 billion population, VPN installation penetration went up from only 3.28% of the population in 2020 to 25.27% in the first six months of 2021.

Why the committee has recommended a ban?

The parliamentary standing committee on home affairs recommended the ban, citing the “technological challenge” posed by VPNs. It said the Dark Web and VPNs can bypass cybersecurity walls and allow criminals to remain anonymous online. It also noted that VPNs can be easily downloaded and many websites providing such facilities are advertising them.

Further, it is well known that cybercrime has been, and continues to be on the rise, with VPNs becoming an increasingly valuable tool to blackhat hackers and cybercriminals. 

Hence, the committee recommended that the home ministry coordinate with the ministry of electronics and information technology (MeitY) to “identify and permanently” block such VPNs with the help of Internet Service Providers (ISPs).

What are the potential implications of a ban?

Impact on industry: Almost any business that requires employees to access sensitive information, or even software that needs to stay within the company’s network, uses VPN. Corporates use VPNs to create an internal network that can be accessed by their employees even when they aren’t within the office premises, which is a very important use case under the current work-from-home conditions. Without VPNs, competitors can use third-party trackers and target important employees online to extract confidential business data.

Negative effect on telecom efficiency: Other countries with state capabilities that have tried banning VPNs have seen a big negative effect on overall telecom efficiency. For example, Iran’s internet is slow due to its attempts to inspect internet traffic for anything that might be going through a VPN.

Impact on privacy: Data and online activity can be easily tracked by Internet Service Providers (ISPs) in India. The ISP owns the internet connect, and can even reset the internet configuration remotely. The ISP has the capability to reduce speeds to some websites or can slow some down as well. It can deny access to certain websites and can track browsing history to show relevant ads to users. VPN is the only tool that’s easily available that can help one prevent this breach of privacy.

Impact on whistleblowers & journalists: VPNs are also immensely useful to people like whistleblowers, journalists. In order to ensure the privacy and security of not just themselves, but also that of their sources, journalists rely on encryption and VPNs to enable secure communication. In addition to anonymity, this technology permits them to access content in foreign jurisdictions, which is subjected to geo-restrictions.

Impact on Freedom of choice: VPNs give internet users access to content that the government doesn’t want them to see. VPNs give users a choice. A ban would compromise this freedom.

Future censorship: A ban would open the door to increased censorship in the future, including blocks to popular apps such as WhatsApp, Facebook, and Twitter that a VPN would be able to circumvent.

What are the issues/concerns associated with the ban?

Compromise security: The misuse of VPNs is a valid concern, but industry and the government use the technology extensively for secure communications. Moreover, according to the National Cyber Security Coordinator, India faces around 375 cyberattacks on a daily basis. In such circumstances, banning VPNs will bring a major segment of the Indian Information Technology Enabled Services (IT-ITes) sector to a standstill and lead to massive employment challenges.

Against governance: If India banned VPNs, it would join the ranks of countries such as Russia, China, Belarus, Venezuela, Turkey, and the Gulf states. All these countries are not role models in terms of governance or freedom.

Attempts to block VPNs often fail: Attempts to block VPNs are not trivial efforts. Even the People’s Republic of China, with a vast and well-trained bureaucracy dedicated to maintaining the Great Firewall, can only block VPNs with low reliability. China is still among the top 10 markets for technology.

Against fundamental rights: In Anuradha Bhasin vs Union of India (2020), the Supreme Court ruled that when access to the internet is crucial to continue a trade or profession, then the same is protected under Article 19(1)g of the Indian Constitution.

A ban is not necessary: VPN does not grant complete anonymity. So, a ban would do little to help fight crime. It’s already possible for law enforcement backed with a court order to piece together criminal activity online from multiple sources, such as from the server logs of VPN providers, ISPs, and website and app operators.

What should govt do, instead of a ban?

Banning technology is not the solution. Banning the wrong use of technology is the correct way to look at it.

Government should consider any such proposal only after seeking legal opinion and further opening up a public consultation process. The process should be inclusive of criminologists, technologists, industry, and civil society organisations, especially those with a focus on digital rights.