ExpressVPN removes India-based servers, says Centre's rules 'overreaching'

Virtual private network service provider ExpressVPN announced removal of all its India-based VPN servers, rejecting the directions given by CERT-In

Virtual private network service provider ExpressVPN announced removal of all its India-based VPN servers, rejecting the directions given by the Indian Computer Emergency Response Team (CERT-In) and calling them "overreaching." 

In a statement, ExpressVPN said, "With a recent data law introduced in India requiring all VPN providers to store user information for at least five years, ExpressVPN has made the very straightforward decision to remove our India-based VPN servers."

“Rest assured, our users will still be able to connect to VPN servers that will give them Indian IP addresses and allow them to access the internet as if they were located in India. These ‘virtual’ India servers will instead be physically located in Singapore and the UK,” the company added.

Calling the new rules "incompatible with the purpose of VPNs," the company said, “ExpressVPN refuses to participate in the Indian government’s attempts to limit internet freedom."

"As a company focused on protecting privacy and freedom of expression online, we will continue to fight to keep users connected to the open and free internet with privacy and security, no matter where they are located.”

CERT-In's new directions, issued in late April, said that service providers will have to store the names, IP addresses of its users, along with usage patterns and other data. 

The government's new rule met widespread criticism from most major VPN firms. Netherland-based Surfshark also said that it was exploring the possibility of legally challenging directions.

Reacting to the criticism, MoS IT Rajeev Chandrasekhar said that if VPN service providers do not want to follow the new directions, they are "free to leave India."

In late May, Chandrasekhar said that the new directions would have no impact on business viability.

"There can be both good and bad work happening through the Internet. Safe and trusted platform we have come up with cyber security regulations. The only restriction is that VPN is misused for criminal activities, VPN operators will have to cooperate and produce the data of the person committing the criminal activity," he said.