VPN service providers Surfshark, Windscribe, and NordVPN may follow ExpressVPN in moving servers out of India

Apple announced a lot of new privacy features for its devices at WWDC 2021, here is a quick rundown.

After ExpressVPN, virtual private network (VPN) service providers Surfshark, Windscribe and NordVPN may voluntarily remove or be forced to remove their Indian servers because of the April 29 cybersecurity-related directions of the Indian Computer Emergency Response Team (CERT-In), Moneycontrol has learnt.

Netherlands-based Surfshark said that they are ‘ready’ to remove their Indian servers, if they see no relief regarding the directions. Windscribe told Moneycontrol that they will keep the servers until hosting providers refuse service to the organisation. Apart from Surfshark and Windscribe, Panama-based NordVPN, also reiterated that they may remove the servers from India.

VPN service providers have criticised the April 29 directions due to its requirements of maintaining logs of customers including names, IP addresses for a period of five years.

“As of now, we are not shutting down our servers in India, but we're always ready to pull the plug if the environment we have operations in becomes unfavourable,” Surfshark said in a statement to Moneycontrol. Earlier, the VPN service provider had said that they were mulling over taking legal action against the directions.

“However, even without physical servers in India, VPN users will be able to use our services by connecting to any other chosen location,” Surfshark added. Last week, while announcing that they had removed their servers from the country, ExpressVPN clarified that Indian users can still access their service through other servers.

Yegor Sak, founder of Windscribe said, “We will keep the servers there unless/until the local hosting providers refuse to provide service to us in the country.

Decision after 'couple of weeks'

Maintaining the line that NordVPN had earlier stated regarding removal of servers from the country, Laura Tyrylyte, head of public relations at Nord Security, said that they will wait for ‘a couple of weeks’ before taking a decision in this regard.

“The directive will come into effect on the 27th of June. If the current Indian government's position will not change in the next couple of weeks, we will remove our servers. That said, we don’t see any reason to remove our infrastructure earlier than necessary. We also aim to reach out to our customers and inform them about upcoming changes prior to removal,” Tyrylyte told Moneycontrol.

It is unlikely that ExpressVPN or other VPN service providers like Surfshark who have removed or may remove their India servers in the future, will be outside the ambit of the CERT-In directions because they have removed or will remove their presence in India.

In the FAQs on the April 29 directions that was released in May, CERT-In had clarified that the directions "are applicable to any entity whatsoever, in the matter of cyber incidents and cyber security incidents".

Won’t stop service in country

On being asked whether, NordVPN will consider shutting down their service for Indian users if they still came under the ambit of the CERT-In directions after when/if they remove their Indian servers, Tyrylyte said, “We have no way to accurately identify customers from India therefore blocking is currently not under consideration.”

She continued, “We will remove our servers as there will be no other way to stay in India while preserving the privacy of our customers and integrity of our service.”

The April 29 CERT-In directions has garnered a lot of controversy and has been facing a lot of criticism as many of its provisions, apart from having privacy concerns, will put additional compliance requirements for all body corporates.

Last week, The Software Alliance, which represents organisations such as Microsoft, Amazon Web Services, wrote to the Ministry of Electronics and Information Technology (MeitY) requesting delayed implementation of the directions. Earlier, 11 lobby groups and trade bodies representing major companies across the world wrote to CERT-In requesting the same.

However, the Union government has been steadfast regarding its stance on the CERT-In directions. Last week, Union minister Rajeev Chandrasekhar told Moneycontrol that the April 29 directions are ‘essential’ and ‘non-negotiable’.