ExpressVPN to shut down servers in India; rejects govt’s new rule to collect use

In a blogpost on Thursday, the company said it “refuses to participate in the Indian government’s attempt to limit internet freedom”.

According to the ministry of electronics and information technology order of 28 April, VPN companies are mandated to collect and store validated names, email addresses, contact numbers and IP addresses allotted to their subscribers for five years and share it with relevant government authorities as and when required.

British Virgin Islands-based Express Technologies-owned ExpressVPN alleged that the new laws were “overreaching” and will open up the “window for potential abuse”.

“The damage by potential misuse of this kind of law far outweighs benefits that lawmakers claim will come from it,” the company said.

Express VPN said it will not collect browsing history, connection logs, time-stamp, traffic destination or session durations that could be used to identify an individual or their online activity.

However, it said the shutting down of its India servers will have no impact on its customers. “Our users will be able to connect to VPN servers that will give Indian IP addresses and allow them to access the internet as if they were located in India.” Express’ virtual India servers will be located in Singapore and the UK, it added.

In May, Rajeev Chandrasekhar, the minister of state for electronics and IT, said that VPN firms have to follow the rules, else they can move out of India.

NordVPN has also threatened to pull out servers from India if it was forced to collect and share user data. Switzerland’s ProtonVPN has also expressed concerns over the new rules and said it was committed to its no-logs policy.

“Indian users who want to hide their identity and choose how they appear on a browser require access to overseas and not Indian servers. Removing Indian servers will not impact them,” said Amit Jaju, senior managing director, Ankura Consulting Group.

Jaju said it is more likely to impact an Indian living abroad who uses VPN servers in India to access services.

However, VPN companies can figure out a way around it by setting up a gateway in India and route the traffic through it on a server located in another country.

“VPN service providers have been navigating rules around the world,” Jaju added.

“Pulling servers out of India might have to do with the possibility of the Indian government being in a position to demand user data for customers outside India, say, someone in the US, who is accessing a server located in India,” said Karan Saini, a cyber security researcher.