VIRTUAL PRIVATE NETWORK (VPN) AND INFORMATION TECHNOLOGY ACT, 2000 IN INDIA: A CRITICAL ANALYSIS by-Kavitha Christo Nelson
A carte blanche intellectual work of any human brain is a tribute to the technology where Information Technology posits a major role in today’s advancement. Whilst there is the loaded advantage of any technology there also lies a few cons which need to be addressed for the betterment of any nation and in concernment of the public at large with regards to national security. This article posits the pros and cons of VPNs and their adherence to the Information Technology Act,2000 in India and also critically analysis the purview of International versus India and a grave need towards focusing on laws on the use of VPNsin near future.
Internet – the world’s largest computer network, supports anyone in any part of the world to access any supportive mode of computer or mobile. The modernized world of the internet brings at a desk any kind of information and innovative technology where it happens the user to do things at ease and distributes the information at convenience. Any newbie to the internet would learn faster to access the internet as it’s easy to access information and transfer electronic documents or files on the internet than the traditional model. Whilst, the internet is a pleasurable pastime, internet surfing, accessing, and moving information with no or at minimal charge would deserve a basic code of regulations in the world of the Internet and globalization that mandates the essence of digital privacy.2
HISTORICAL BACKGROUND OF VPN:
Digital privacy is basic essential for any person who is a habitual user of the internet and for our present and next-generation where the due to the prying eyes rate of offenses and cyber-
1 Student, LLM, Alliance School of Law, Alliance University, Bangalore
2PALLEN, M. (1995). INTRODUCING THE INTERNET. BMJ: BRITISH MEDICAL JOURNAL, 311(7017), 1422–1424.
crime has been increasing day by day. The use of a Virtual Private Network (VPN) comes with built-in security and safety by online businesses and users to protect their confidential information with added pros and cons associated with it.
VPN connectivity in India is not barred or limited by any Internet Service Provider (ISP) or by any specific law relating to its restrictions and limitations. VPN connectivity gained popularity in India during the late 90s. The concept of VPN connecting to a more secured private connection and peer-to-peer tunneling protocol or PTTP was created by a Microsoft employee. While the rationale behind VPN connectivity was to extend its private network across public access hiding the user’s IP (Internet Protocol) address3 for better security and functionality, in reality, cyber threats, the infringement of privacy, and obstruction impose adverse effects on the use of VPN pose a technological challenge nowadays.
The Parliamentary Standing Committee on Home Affairs proposed to ban VPN services permanently in India, even though many Multinational and Indian companies have been using VPN services to have more secured networks and digital assets from hackers such are frequently misused by the dark web where the cybercriminals remain anonymous online.
The main purpose of VPN connectivity is a concept that was developed to have more secured internet connectivity for the transfer of confidential data and content from one user or business entity to multiple users and devices on the internet, the main intention of the VPN concept and connectivity had been highly misused by dark web or hackers using malware, spyware, etc., which gives access to a third party to anonymously seek through the confidential information posted online without their knowledge or consent.
While VPN connectivity can be obtained by any internet user for a nominal fee, there are no requisite restrictions or limitations that any Internet Service Providers impose, giving way for cyber threats, cyber-crimes, hacking, spamming, the obscenity of children and women, etc. causing financial, emotional disturbances to the public at large. Such VPN connection is used for geo-restricted content while on streaming services, which is unrestricted while using public WIFI connectivity.4
VPN providers support the users in blocking and protecting from malware, pop-up ads, and tracking hiding one’s IP address and identity. Though the VPN is meant to protect your
identity from cyber thieves, it gives access to websites and content that are blocked by the respective states, it also supports the user to show that they are located in any location that the user has selected while streaming services. In the US, although VPN is legal to use, VPN providers don’t completely restrict access to online activity from a government entity and would be sharing the user information with the government on an official request.5 Every country has its respective laws and regulations, while VPN use is banned and strictly monitored in some countries like China, Russia, and Cuba.6
In regard to the law, always face challenges to any new technology and law to be kindred to avoid any threats to the technologically advanced world. When we look into the internet perspective where the users and the information are accessed by every part of the user across the world would certainly deserve strict restrictions so as to hold the control to the par and the infringers are not to be excused rather reprimanded by the law for their illegal and unlawful act.
The article proposes to highlight the key pros and cons of using VPN connectivity and critically analyze how such cyber threats and control on VPN had been governed in international countries.
The article posits the questions:
1. Whether the VPN restrictions and regulations can be added as an essential section to ‘The Information Technology Act,2000’?
2. Whether the VPN restrictions or complete ban in India would benefit the Information Technology Multinational and merged Indian companies?
3. Whether the Anti-VPN plan and its restriction would have an impact on the work-from- home technological jobs in India?
The hypothesis of the article is to prove that any regulatory measure is taken into consideration towards combating new technology and technologically advanced cybercrimes, the existing laws would be mandated to cater to the emerging crimes with austere infringement laws would benefit in safeguarding the national security and as well the innocent public as well at large being falling into such cybercrime preys.
INTERNATIONAL PURVIEW ON THE USE OF VPN:
Any heated debate on, “whether the use of VPN is legal or illegal?” on a proximity take-up on the countries that have banned the use of VPN claiming it to be illegal or in relevancy the national safety of their country, data protection and to take the edge off the cybercrime. The countries are always on priority in relevance to any comparison within the USA, UK, Australia, Canada, and New Zealand posits it to be legal and valid together with few other European countries. This legality permits the use of VPNs for lawful purposes and business data protection while the same is illegal when such VPN is used for illegal activities online. The VPN connectivity connects to such IP addresses of countries where VPN is illegal and restricted.789
The countries that find VPNs completely illegal are Iraq, Belarus, North Korea, Venezuela, and Turkmenistan while countries like China, Russia, Iran, Oman, UAE, and Turkey completely heavily restrict the use of VPNs. Something worth bearing in mind is that even DarkWeb related websites have been blocked in Belarus and countries like China, Iran, UAE, and Russia use only government-approved VPNs whilst such are legally spied on heavy monitoring online surveillance and censorship in their respective nations and also imposed strict punishments towards such illegal use of VPN.10 In Russia, it was accused to have a magnitude of hacking and cybercrime preceding its warfare in 2021 with the aid of VPNs to hijack the accounts of US and UK officials. 11
INDIA’s PURVIEW ON THE USE OF VPN:
VPN was one thing that was common amongst the techies to students and then to all that supported everyone towards circumventing access to geo-restricted content, having more secured Public Wi-Fi hotspots, and internet censorship in India. At times, Indian citizens used VPNs to download movies that are already released in other countries like the US, UK, and Canada and to download pirated content or copyright-protected material from torrents sites but later gave way to more cybercrime and misuse of VPNs for downloading blacklisted
contents and pornography. Though the VPN doesn’t support illegal acts in a more legal way it is used as a security measure by most Indian netizens.
Regarding the Indian scenario, laws up to date, regarding the use of VPNs are though valid in the long run giving way to a drastic increase in cybercrime and threats to internet users likewise the national security in reference to data privacy, molestation, porn, and extortions in India. In relation to the info extracted by the Sensor Tower Service of Google and Apple Whilst India ranked fourth amongst other 85 countries in VPN installation penetration in the year 2021.12 In reference to the initiative of, ‘Atrocities and Crimes Against Women and Children’, report the Ministry of Information Technology (Meity), confirmed to block such VPNs that were reported for cybercrime, especially in regard to women and youngsters with the national security and integrity of India, public order and on for holding friendly relations with foreign nations.
Though secret message coding has been a practice with the homing pigeons during the King’s period and to the technologically advanced encrypted data that are transmitted on the internet to be decrypted by the user only with a secret code which was predominantly used by VPN users in India. Such officially legal VPN has seen a recent proposal ban by the Parliamentary Standing Committee on Home Affairs recommends the Indian Government coordinate with the Ministry of Electronics and Information Technology13(Meity) on the use of VPN with the aid and support of Internet Service Providers (ISPs) with an obligatory regulation to be imposed in relevance the identical.1415 With this initiative, the Indian Government banned over 6000 URLs, accounts, or websites within the year 2021.16
The Anti-VPN concept was developed to own secure, surveillance on the Indian netizens concerning their upload and download of data which might be otherwise a threat to national security if not monitored or controlled at its inception level. Though the intention of the Anti- VPN proposal is to stay the cybercrime rate at bay has created controversial debates about
websites-experts-say-ban-proposal-will-not-help-users-1866073-2021-10-18 13Ministry of Electronics and Information Technology, https://www.meity.gov.in/ 14Parliamentary Committee to government: Ban VPN services in India,
http://timesofindia.indiatimes.com/articleshow/85807939.cms?utm_source=contentofinterest&utm_medium=tex t&utm_campaign=cppst, dated September 1 2021.
15Explained: All about VPN and Why Parliamentary Committee wants to ban it, https://www.thehansindia.com/technology/tech-news/explained-all-about-vpn-and-why-parliamentary- committee-wants-to-ban-it-7046444
16 https://www.dnaindia.com/business/report-more-than-6000-accounts-websites-banned-in-2021-government- informs-parliament-2931891
VPN use and a ban in India in the future would have an impression or jeopardy on the Work- remotely mode of work.1718 Though another view that was brought up by the public on the use of TOR (‘The Onion Router’) which protects the cybercriminal to have anonymous access and such would be much more onerous to locate the ISPs and users than the use of VPN which might be trackable when weighed up with TOR regarding the cybersecurity concerns.
IMPACT ON COMPUTER INFRASTRUCTURE IN COVID-1919
The sudden epidemic ofthe Novel Covid virus relatively increased the concept of work- remotely worldwide where employees had to rely upon VPN for their secured data transfer whichindirectly increased the use of VPNs to approximately 150% more in a span of one year between March 2019 to March 2020.20 The security measures were initiated towards the Information Technology Risk Management practices.
In reference to NASA’s report on the use of their employee’s internal secured connectivity during the pandemic, the usage of NASA’s VPN and employee’s personal VPN increased more than double its usage prior to the pandemic.
In the interconnected world where there are Cross-Border Data Flows the emerging need to have controlled regulated data flow was mandated in regard to the territorial domestic boundaries of another country. The Chinese government took the initiative to ban the circulation of banned and offensive content in their Chinese cyberspace.21
In Pakistan, the country had regulated the use of VPNs while instructing the citizens to register the VPN within a deadline of June 2020 while those unregistered are meant for banned in Pakistan.
17Home Ministry wants to ban VPNs in India. Should you worry? https://www.thebridgechronicle.com/knowledge/home-ministry-wants-to-ban-vpn-in-india-should-you-worry 18 Use of VPNs in India spiking because of blocked websites, experts say ban proposal will not help users https://www.indiatoday.in/technology/features/story/use-of-vpns-in-india-spiking-because-of-blocked-websites- experts-say-ban-proposal-will-not-help-users-1866073-2021-10-18
19 1 1 (April 10, 2020) Federal Telework During the COVID-19 Pandemic: Cybersecurity Issues in Brief
20 “VPN USE SPIKES DURING CORONAVIRUS, BOOSTING BUSINESS, EXPOSING LIMITATIONS,” S&P GLOBAL, MARKET INTELLIGENCE, MARCH 18, 2020, https://www.spglobal.com/marketintelligence/en/news- insights/latest-news-headlines/vpn-use-spikesduring- coronavirus-boosting-business-exposing-limitations- 57599742.
21NEHA MISHRA, BUILDING BRIDGES: INTERNATIONAL TRADE LAW, INTERNET GOVERNANCE, AND THE
REGULATION OF DATA FLOWS, 52 VAND. J. Transnat’l L. 463 (2019).
JUDICIAL ANALYSIS ON THE USE OF VPN:
When there was a jurisdictional search warrant issue in regard to the IP address which was masked on VPN and people in the United States in the case of Levin vs United States22, a case of the DarkWeb which operated on the TOR (‘The Onion Router’) and posted child pornography, the United States came up with the warrants that authorized the network investigative technique enforcement to keep a bar on the cybercrime and criminal activities over the internet.23 Such a warrant and precedent caused opposition and despite such the law was amended in accordance to issue the warrant that permits the federal law enforcement agencies to access the computers beyond their jurisdictional limits in the U.S. Federal Rules of Criminal Procedure.
In reference to the U.S. Federal Rules of Criminal Procedure, other countries like the EU, France, Germany, Poland, and the UK also adopted and amended their respective legislations toward ethical hacking by Governmental agencies to reduce cybercrime.
In India, the use of VPNs and cybercrimes increased drastically where highlight a few instances were one actor in Tamil Nadu who had been lured and anonymously blackmailed with video conversations, and the Tamil Nadu police took the aid of a private cyber-security agency to investigate tracking the IP address and nail the culprit.24 While in another instance when a businessman was framed and accused of deceit in a deal, the cyber intelligence agency could find out that the businessman was himself corporate espionage and being framed when he pleaded not guilty to the police.25 In reference to the National Crime Record Bureau(NCRB) of the year 2019, the cybercrime rate was around 44546 cases which were double of 2018 record26.
PROS AND CONS OF USING VPN:
VPN – as just the name says Virtual Private Network supports the internet users in the more private or secured mode of work environment in regard to the transfer of data in an encrypted
23LINDSAY FREEMAN, LAW IN CONFLICT: THE TECHNOLOGICAL TRANSFORMATION OF WAR AND ITS CONSEQUENCES FOR THE INTERNATIONAL CRIMINAL COURT, 51 N.Y.U. J. INT’l L. & POL. 807 (2019).
24 https://economictimes.indiatimes.com/news/politics-and-nation/police-in-states-across-india-are-relying-on- private-firms-and-consultants-to-solve-cybercrime-cases/articleshow/72499885.cms?from=mdr
25 https://economictimes.indiatimes.com/news/politics-and-nation/police-in-states-across-india-are-relying-on- private-firms-and-consultants-to-solve-cybercrime-cases/articleshow/72499885.cms?from=mdr
26(CYBER CRIME IN INDIA, Jan 2022).
format which can be decrypted by the other party or receiver with the aid of secret passcode which is a beneficial supportive mode for the business firms and multi-national entities.
VPN servers create secured and cost-effective private network connectivity routing the internet traffic for the VPN users as anonymous users circumventing the content restrictions, and censorship website blocks preventing bandwidth throttling.
VPN access is more beneficial for the fair-use purpose where one might need to access the geo-restricted content where such is a mandatory requirement for their research purpose or for national security and integrity of any nation.
The most popular use of VPNs is amongst the online gamers who prefer the VPN connectivity as it protects against the DDoS (Distributed Denial-of-service) attacks and in hiding their IP address from their Admins who tentatively ban or block someone either intentionally or on a fallacy.
Some users use VPNs to have a discriminated online pricing of a product just by switching their location and IP address just to circumvent the credit/ debit card’s international transaction charges to their respective bank.
Any Pros would always possess their cons and a VPN is not an exception. First would be the legality of using VPN in any nation, while some are legal, others have marked it to be illegal and restricted in certain geographical locations.
The frequency of the data transferred on the internet becomes slower in VPN, and in any case of dropped internet connections, there are chances for the secured data privacy of one person can be leaked to such an anonymous user, where the mere purpose of using VPN becomes vain.
When the VPN server takes one to a world of private internet would always impose heavy costs when one has to opt for a quality VPN server, and on other hand, one has to prefer a computer with an appropriate operating system that would support the VPN.
As the VPN service is provided the users are heavily monitored by the VPN service providers for their regular activities, if found any breaching of national security or other cybercrime activities would be either reported to law enforcement officials or in some instances, they
would also extort money taking advantage of such illegal activities of their users as no VPN can guarantee cent percent anonymity to anyone.
CONCLUSION, SUGGESTIONS, AND RECOMMENDATIONS:
At the heart of this debate towards the demanding need for regulatory measures to hold on the restrictions on the usage of the VPN which was initially meant to be developed for a more protected or secured internet connectivity has turned out towards a threat to the internet users that connects the world to the DarkWeb. A sudden blackout on the internet imposing restrictions on the web users might restrict the public ability to work and also would have an impact worldwide economy, but a well-planned initiative with pros and cons along with the initiatives of the other international States could try to combat the economical aspect and would be beneficial in near future.
Though concerning the issues and threats of cybercrime and national security of India, the Anti-VPN or ban on the VPN is an excellent initiative though delayed but not too late for the future of India. Rather than a complete blanket ban on all VPNs, a more secured mode of VPN can be considered from Government- approved VPNs holding imposed legal filtering and regular online surveillance. The use of such government-approved VPNs might benefit the Indian employees when they are Work-remotely connected to work and the transfer of the data may not hamper the Multi-national Business firm’s digital assets in India and for the ethical hackers beneficial without imposing much impact on the guaranteed Right to Privacy under Article 21 of the Indian Constitution.
Towards the recommendation concerning cyber security, the initiative of the Indian government to have a more secured data transfer, encourage and educate about the cyber- security solutions to the public and especially in business solutions. Since cyber criminals are far more technologically advanced than our techies, the government needs to nimble the cybercriminals at their inception levels. As the reporting to police on any cyber-crime and a cyber threat from the public part is comparatively negligent or feared such reporting needs to be confidential and act more agile in finding solutions to minimalize and eradicate such cybercrime in the future.
To conclude, proving the proposed hypothesis to be true, just like the biblical saying, “not to pour new wine into old wineskins”27, as both the new wine and wineskins will be ruined, the same applies as the technology is time and again advancing the Indian Laws needs to be streamlined with modernized renovations to combat the cybercrime favoring the National security and public at large.
1. Pallen, M. (1995). Introducing The Internet. BMJ: British Medical Journal, 311(7017), 1422–1424. http://www.jstor.org/stable/29729634
3. 1 1 (April 10, 2020) Federal Telework During the COVID-19 Pandemic: Cybersecurity Issues in Brief
4. Lindsay Freeman, Law in Conflict: The Technological Transformation of War and Its Consequences for the International Criminal Court, 51 N.Y.U. J. INT’l L. & POL. 807 (2019).
5. Neha Mishra, Building Bridges: International Trade Law, Internet Governance, and the Regulation of Data Flows, 52 VAND. J. Transnat’l L. 463 (2019).
6. 1 i (2020) Cybersecurity at NASA: Ongoing Challenges and Emerging Issues for Increased Telework During Covid 19: Hearing Before the Subcommittee on Space and Aeronautics of the Committee on Science, Space, and Technology, House of
7. Representatives, One Hundred Sixteenth Congress, Second Session
8. Alana Maurushat, Australia’s Accession to the Cybercrime Convention: Is the Convention Still Relevant in Combating Cybercrime in the Era of Botnets and Obfuscation Crime Tools?, 33 U.N.S.W.L.J. 431 (2010).
10. Alfred C. Yen, Revisiting the Western Frontier, 60 IDEA 134 (2020).
11. Facebook Pays Teens to Install VPN that Spies on Them, TECHCRUNCH (Jan. 29, 2019), https://techcrunch.com/2019/01/29/facebook-project-atlas/
12. See Sarah Emerson, How Facebook and Google Win by Embedding in Political Campaigns, https://www.vice.com/en/article/ne5k8z/how-facebook-and-google-win- by-embedding-in-political-campaigns
13. Ben Depoorter, Intellectual Property Infringements & 3D Printing: Decentralized Piracy, 65 Hastings L.J. 1483 (2014).
14. Stacy-Ann Elvy, Paying for Privacy and the Personal Data Economy, 117 COLUM. L. REV.1369 (2017).
15. Simon K. Zhen, Combating Censorship in China: Forcing China’s Hand through the WTO and Collective Action, 53 CORNELL INT’l L.J. 731 (2020).
22. https://gadgets360.com/internet/news/vpn-hack-hijack-account-russian-hacker-us-uk- officials-advisory-2477578
23. https://www.indiatoday.in/technology/features/story/use-of-vpns-in-india-spiking- because-of-blocked-websites-experts-say-ban-proposal-will-not-help-users-1866073- 2021-10-18
24. Ministry of Electronics and Information Technology, https://www.meity.gov.in/
25. Parliamentary Committee to government: Ban VPN services in India, http://timesofindia.indiatimes.com/articleshow/85807939.cms?utm_source=contentofi nterest&utm_medium=text&utm_campaign=cppst, dated September 1 2021.
26. Explained: All about VPN and Why Parliamentary Committee wants to ban it, https://www.thehansindia.com/technology/tech-news/explained-all-about-vpn-and- why-parliamentary-committee-wants-to-ban-it-7046444
27. https://www.dnaindia.com/business/report-more-than-6000-accounts-websites- banned-in-2021-government-informs-parliament-2931891
28. Home Ministry wants to ban VPNs in India. Should you worry?
29. https://www.thebridgechronicle.com/knowledge/home-ministry-wants-to-ban-vpn-in- india-should-you-worry
30. Use of VPNs in India spiking because of blocked websites, experts say ban proposal will not help users
31. https://www.indiatoday.in/technology/features/story/use-of-vpns-in-india-spiking- because-of-blocked-websites-experts-say-ban-proposal-will-not-help-users-1866073- 2021-10-18
32. 1 1 (April 10, 2020) Federal Telework During the COVID-19 Pandemic: Cybersecurity Issues in Brief
33. “VPN Use Spikes During Coronavirus, Boosting Business, Exposing Limitations,” S&P Global, Market Intelligence, March 18, 2020, https://www.spglobal.com/marketintelligence/en/news-insights/latest-news-
headlines/vpn-use-spikesduring- coronavirus-boosting-business-exposing-limitations- 57599742.
35. Lindsay Freeman, Law in Conflict: The Technological Transformation of War and Its Consequences for the International Criminal Court, 51 N.Y.U. J. INT’l L. & POL. 807 (2019).
36. https://economictimes.indiatimes.com/news/politics-and-nation/police-in-states- across-india-are-relying-on-private-firms-and-consultants-to-solve-cybercrime- cases/articleshow/72499885.cms?from=mdr
37. https://economictimes.indiatimes.com/news/politics-and-nation/police-in-states- across-india-are-relying-on-private-firms-and-consultants-to-solve-cybercrime- cases/articleshow/72499885.cms?from=mdr
38. Lone, N. A. (Jan 2022). CYBERCRIME IN INDIA. ResearchGate, Vol-43 No.- 04(VIII)(October-December (2020)). Retrieved from https://www.researchgate.net/publication/357839318