IT Ministry orders VPN providers, crypto players to store user data for five years

[Mr.J]

The Ministry of Electronics and Information Technology’s Computer Emergency Response Team (CERT-in) on Thursday directed Virtual Private Network providers, data centers, and crypto exchanges to preserve a wide range of data on their customers for five years, in what it said was an effort “to coordinate response activities as well as emergency measures with respect to cyber security incidents”.

“Data Centres, Virtual Private Server (VPS) providers, Cloud Service providers and Virtual Private Network Service (VPN Service) providers, shall be required to register” customers’ names, customers’ ownership patterns, their contact information, and the purpose for which they are hiring these services.

We have reached out to the IAMAI’s Blockchain and Crypto Assets Council for comment on the implications for the crypto industry.

The order on the whole is purportedly aimed at ensuring that CERT-in can respond to cyber incidents within six hours of discovering them. The range of data it is asking IT organizations to preserve and provide upon request, though, appears unusual.

What’s more, the consequences of not providing this information are governed by Section 70B(7) of the IT Act, which provides for upto one year of imprisonment.

We have reached out to CERT-in to find out if these requirements apply only to Indian companies or also to foreign firms that serve Indian customers.

The new directions will go into force from late June 2022, unless the window for complying gets extended, which usually happens for such directions.

The vulnerabilities that CERT-in requires organizations to report extends to twenty items, ranging from run-of-the-mill data breaches, fake mobile apps, attacks on server infrastructure to “Unauthorised access to social media accounts,” which all have differing levels of impact on an organization’s services and different levels of seriousness.

Interestingly, most VPN’s usually have a ‘no logs policy’ or keep user data only temporarily. To that extent, this order, if taken to its logical conclusion, will probably push many out of the legal domain in India. Other issues will also be raised probably, where they quote storage costs as a factor, and the liability of misuse from such stored data. That not storing user data is exactly the opportunity many VPN’s sought to fill is of course another issue that they will need to find an answer to now, to continue to operate legally in India.

IT Ministry orders VPN providers crypto players to store user data

The ministry directed VPN providers, data centers, and crypto exchanges to preserve a wide range of data on their customers for five years

entrackr.com

As usual gobarmind is focusing on important stuff: attacking tools used by whistleblowers and journalists. F*** rising inflation and unemployment.

 

[vaibhavyagnik]

VPN protect identity and data, be it from a terrorist a whistle blower or just a person trying to bank online safely. You cannot catch the terrorist without affecting everyone else. That is how it is. Personally, I would rather catch the terrorist

 

[devagya]

who uses indian based VPN anyways, Some business might do that but they're public anyways, other than that I don't see how government will impose random rules on non indian companies like mullvad or PIA. they might try banning their ips in classic indian gov fashion but thats about it.

As usual gobarmind is focusing on important stuff: attacking tools used by whistleblowers and journalists. F*** rising inflation and unemployment.

don't agree with daddy gov going after privacy or banning stuff, but this idea that gov can only do one thing at a time is flawed, gov has multiple ministries, each has its own job, its not like going after vpns is taking away resources or priority away from other issues like inflation or employment.

 

[burntwingzZz]

look guys , even financial institution have to provide their ipsec passwords to the government

 

[lockhrt999]

Laws like these don't catch terrorists. More often than not, these will be used to target journalists and opposition party leaders.

 

[Mr.J]

VPN protect identity and data, be it from a terrorist a whistle blower or just a person trying to bank online safely. You cannot catch the terrorist without affecting everyone else. That is how it is. Personally, I would rather catch the terrorist

Bogeyman of terrorism is used by government to control the population. USA did it with many times with PATRIOT Act and other laws. Our government is doing the same.

don't agree with daddy gov going after privacy or banning stuff, but this idea that gov can only do one thing at a time is flawed, gov has multiple ministries, each has its own job, its not like going after vpns is taking away resources or priority away from other issues like inflation or employment.

Does it look like governement is focusing on anything other than punishing their opponents?

 

[nRiTeCh]

Immaturity, anxiety, insecurity ticking in and many more bla bla bla...
Imaging if India becomes the next super power, 70% will shift to another planets.. As govt. will even ask for micro-nano data like who in antartica shitted, what color, what particles etc..

 

[iPwnz]

Acche Din.

 

[valar007]

Why would they want this: "the purpose for which they are hiring these services." ? Are they gonna actively scan and reach out if one has deviated from this and take action?

One step forward, two steps back

 

[Ramadhir Singh]

I here by declare the death VPN.
In this rate, soon resturantes will be directed to remove chiken from dum biriyani.

Personally, I would rather catch the terrorist

everybody knows him but noone dares to catch him

look guys , even financial institution have to provide their ipsec passwords to the government

Thats why Amex is out of India.. we are marching towards stone age.

Acche Din.

Not yet.
The day when the only password allowed is "JaiShreeRam1234" - that would be the day.

 

[t3chg33k]

who uses indian based VPN anyways, Some business might do that but they're public anyways, other than that I don't see how government will impose random rules on non indian companies like mullvad or PIA. they might try banning their ips in classic indian gov fashion but thats about it.

don't agree with daddy gov going after privacy or banning stuff, but this idea that gov can only do one thing at a time is flawed, gov has multiple ministries, each has its own job, its not like going after vpns is taking away resources or priority away from other issues like inflation or employment.

It vaguely mentioned as being applicable to VPN providers operating in India which might apply to Indian users or servers. If it is the latter, then it would mostly mean losing out on Indian servers. If it is the former, then it becomes more problematic as that means differentiating between users which might cause some companies to probably not operate with Indian accounts or payment methods to avoid legal issues.

 

[Arun K]

I don't think it would apply to VPNs in which is based outside India. I checked Surfshark website , it mentions this law (the page is specific to India) and says "Surfshark is located in the Netherlands, where it’s illegal to store user data. So, you can rest assured that all your browsing history will not be logged in any way."

 

[gourav]

I don't think it would apply to VPNs in which is based outside India. I checked Surfshark website , it mentions this law (the page is specific to India) and says "Surfshark is located in the Netherlands, where it’s illegal to store user data. So, you can rest assured that all your browsing history will not be logged in any way."

They'll probably block foreign VPNs and their IP addresses at ISP level to get around this.

 

[Kafkaesque]

I would love to see a graphical comparison of how much data each and every government ask for to put things into the light.

 

[Kaleen Bhaiya]

I am just pondering upon how much space it will take for a user who relies heavily on VPN to store his data for 5y. That's for one user, multiply with many.
The govt knows they cannot force foreign service providers to store data in India or elsewhere as it violates their policy. They would probably end up banning them.

‘Why would I even bother’: Experts, VPN users unhappy with mandate to store users’ data for 5 years

The guidelines mandate service providers such as VPS, VPN, intermediaries, and data centres to retain user data for five years, and report cyber incidents within six hours.

indianexpress.com

 

[bssunilreddy]

Normally anything can be monitored by govt agencies even whatsapp chats for example so don't worry about our rights being trampled because we live in such atmosphere. Don't ask about terrorists coming from abroad what about those harbored by local parties like anti social elements. No offence here. Just saying.

Just look at this for once: Pak Missile Misfire: IAF Probe Blames More Than One Official; ‘Severe Punishment’ to be Meted Out

On the very same day evening when BJP won or results were announced that it won in 4 states.
Now tell me whose responsible for this?

India Says Reviewing Policy After Misfiring of Missile Into Pakistan

Indian missile misfire prompted Pakistan for retaliatory strike Read more at: https://www.deccanherald.com/national/indian-missile-misfire-prompted-pakistan-for-retaliatory-strike-1091827.html

I think what led to the above action might be this. Anybody who can use any VPN or any other of software by which they received orders to such above things.

Then should we chant Hare Ram or Jai Sri Ram if Pakistan retaliated.

 

[iPwnz]

To be completely straight-forward it's obvious and we all know that this has become a direct order by the govt to track and trace anyone, like any single one of us, who has ANYTHING to do against the govt's policies, it doesn't matter whether it's a simple social media criticsm, a blog post against a policy or serious terrorist act. The present regime want to group them all into one and arrest us all under the NSA and you will not be granted bail. Authoritarian is what this govt is and has almost become like a dictatorship now. We are not far off from being China or Russia censorship level.

 

[kiran6680]

I am just pondering upon how much space it will take for a user who relies heavily on VPN to store his data for 5y. That's for one user, multiply with many.
The govt knows they cannot force foreign service providers to store data in India or elsewhere as it violates their policy. They would probably end up banning them.

‘Why would I even bother’: Experts, VPN users unhappy with mandate to store users’ data for 5 years

The guidelines mandate service providers such as VPS, VPN, intermediaries, and data centres to retain user data for five years, and report cyber incidents within six hours.

indianexpress.com

Amazon S3 Glacier API Pricing | Amazon Web Services

Find storage, retrieval, and request pricing details for Amazon S3 Glacier API.

aws.amazon.com

3.6 USD per TB per month.

Heavy user would, say make 100,000 url requests, of which 50,000 unique URLs per day. VPN store the time, url against the user id : compressed it should be 80 bytes per visit on an average, so 8 MB data per day, 3 GB per year. Storing it for 5 years would cost $ 3*5*12*3.6/1000 = 65 cents per user per year. VPN service charges, say $20 per year so they might increase it to 21 for Indian users.

Now retrieving the data is a pain from these long term archivals like glacier, so if govt keeps data demand from VPNs to a minimum, cost may only rise from $ 20 to 21.

The real impact of such laws is on the future. If anyone successfully raises voice against govt, gets some followers, catch him and top lieutenants. No need to improve govt, just keep fooling people by temple, mosque, kabristan, beef etc.

 

[bssunilreddy]

To be completely straight-forward it's obvious and we all know that this has become a direct order by the govt to track and trace anyone, like any single one of us, who has ANYTHING to do against the govt's policies, it doesn't matter whether it's a simple social media criticsm, a blog post against a policy or serious terrorist act. The present regime want to group them all into one and arrest us all under the NSA and you will not be granted bail. Authoritarian is what this govt is and has almost become like a dictatorship now. We are not far off from being China or Russia censorship level.

If this is authoritarian govt then why the people in 4 states choose them instead of the other. Do we need another 10 big scams to occur so that we can all be happy & jumpy about it.

In the south there are one or two pro kongress govts who say they are anti bjp but align with local kongress. Why this beating around the bush and not come clean about their agendas.

Anything they do should not be answerable either to the people or others is their agenda. Just push it on say " It's just because of bigger billionaires agenda" not their doing. In the end we loose any good that is happening or happened and just shut our mouths that's all.
This is called the "real authoritarian regime" but smaller ones. Fool the people & make money , again fool & play the cards so well during or before elections. This goes on and on and on.

 

[bssunilreddy]

Amazon S3 Glacier API Pricing | Amazon Web Services

Find storage, retrieval, and request pricing details for Amazon S3 Glacier API.

aws.amazon.com

3.6 USD per TB per month.

Heavy user would, say make 100,000 url requests, of which 50,000 unique URLs per day. VPN store the time, url against the user id : compressed it should be 80 bytes per visit on an average, so 8 MB data per day, 3 GB per year. Storing it for 5 years would cost $ 3*5*12*3.6/1000 = 65 cents per user per year. VPN service charges, say $20 per year so they might increase it to 21 for Indian users.

Now retrieving the data is a pain from these long term archivals like glacier, so if govt keeps data demand from VPNs to a minimum, cost may only rise from $ 20 to 21.

The real impact of such laws is on the future. If anyone successfully raises voice against govt, gets some followers, catch him and top lieutenants. No need to improve govt, just keep fooling people by temple, mosque, kabristan, beef etc.

Should we all be worried about increasing VPN costs or crypto currency BS. Let's assume we have about 4billion dollars of crypto with our miners which are usually organized by bollywood biggies & others. Small timers miners are or contribute to less than 10 percent.

If at all crypto crashes and RBI says this is a means of exchange and pulls it in to the economy then don't prices go up because of any crash. This is why RBI is not considering this as a means of exchange and wants to have governance on it.

It's like who ever wants to do can do and when anything goes bad push it on the " authoritarian regime" right.

VPNs come here when the issue of crypto mining comes. That's why they are asking for data because normal people like us work with the govt not robots boys.

Like this above scenario is connected to one another.