VPN is needed to keep business going, banning could hurt industry: experts

Their take: VPNs are used to keep business networks secure; Legal safeguards to catch criminals and miscreants already exist

The Parliamentary Standing Committee on Home Affairs' recent suggestion to permanently block the use of virtual private networks (VPN), if taken forward and formalised, will not be in the best interests of businesses, who have benefitted immensely from the use of this technology over the course of the pandemic. 

A VPN, as described by Kaspersky, is "a means to encrypt internet traffic and disguise a user's online identity. This makes it more difficult for third parties to track their activities online and steal data. The encryption takes place in real time, and hides the user's IP address".

As a result, the technology is used by people for all kinds of purposes--from accessing the movies and shows available on Netflix UK, for example, to securing their business, financial and sensitive transactions online. There is, of course, another set of people who misuse the technology for cybercrimes or stalking, but technologists and experts argue that banning VPNs would be like the proverbial throwing out the baby with the bath water. 

"From a Nasscom perspective, we are clear that as a technology, VPN is something that is required to maintain business communication, in addition to maintaining privacy and data security. We agree with MeitY's response to the Home Affairs Parliamentary Committee, there are enough rules in the IT Act to penalise any misuse," said Ashish Aggarwal,  Vice President, Policy at industry body National Association of Software and Services Companies. 

The report at the heart of this contention was tabled by the standing committee on August 10, and states: "The Committee notes with anxiety the technological challenge posed by Virtual Private Network (VPN) services and Dark Web that can bypass cyber security walls and allow criminals to remain anonymous online. As of date, VPN can easily be downloaded, as many websites are providing such facilities and advertising them. The Committee, therefore, recommends that the Ministry of Home Affairs should coordinate with the Ministry of Electronics and Information Technology to identify and permanently block such VPNs with the help of internet service providers."

The report was filed by the Standing Committee detailing the actions taken by the government on a March report on atrocities against women and children. 

"VPN is used across various industries. It is also used by the Government. It has been particularly instrumental in enabling remote working. Government has also recognised this by enabling different types of secure VPN in the liberalised OSP (Other Service Provider) regime in telecom recently," said Aggarwal. 

One of the provisions of the liberalised OSP guidelines last year, that enabled most technology services and business process management companies to work from home during the pandemic, was allowing the use of private VPNs. 

A ban would open the door to increased censorship in the future, including blocks to popular apps such as WhatsApp, Facebook and Twitter that a VPN would be able to circumvent, said Simon Migliano, Head of Research at Internet research firm Top10VPN.

“I should also point out that as a VPN does not grant complete anonymity, a ban would do little to help fight crime. It’s already possible for law enforcement backed with a court order to piece together criminal activity online from multiple sources, such as from the server logs of VPN providers, ISPs, and website and app operators,” he added. 

It notes the Ministry of Electronics and Information Technology's response to the issue of VPNs being misused. MeitY told the Standing Committee that blocking is either done in compliance of a court order or in pursuance of the recommendation of an inter-ministerial committee specified under Rules prescribed under the Information Technology Act. 

"If the request for blocking of such VPNs is received under section 69A of the IT Act, MeitY can initiate the process as specified in the Rules notified under section 69A of the IT Act," the MeitY submission says further. However, the Committee finds the response "incomplete". 

Pointing out that Standing Committee recommendations do not become the law, and follow a fair and extensive discussion, a government official said. 

"Banning a technology is not the solution," the official said. "Banning the wrong use of technology is the correct way to look at it," they added. 

Based on data from marketing analysis portal Finbold, it is projected that the number of VPN downloads globally are expected to surpass one billion in 2021 driven by the work-from-home trend due to the pandemic, an increase in cyber-attacks, and the service's overall rising popularity.

During the first half of 2021, about 25.27 per cent of the Indian population used VPNs. Another report from Global VPN provider Atlas VPN’s found that in the first half of 2021, VPN installations in India touched 348.7 million, an increase of 671 per cent over 2020.

"We acknowledge the concerns of the Standing Committee and are aligned to make online communications safer for women and children. However, the proposal to ban VPNs will harm individual liberty and privacy, and are likely to be held unconstitutional. Thus, we call on the MHA to consider any such proposal only after seeking legal opinion and further opening up a public consultation process that is inclusive of criminologists, technologists, industry and civil society organisations, specially those with a focus on digital rights," said digital rights organisation Internet Freedom Foundation. 

• Global VPN downloads likely to touch 1 bn in 2021
• VPN installs in India reached 348.7 mn in H12021
• VPNs used to keep business networks secure
• Legal safeguards exist in order to catch criminals and miscreants