A few weeks ago, the Indian government ordered VPN companies to collect user data for five years on their servers and hand it over to the government. The order also applied to Cloud and Crypto companies. In response to the GoI, VPN providers such as NordVPN and ExpressVPN have announced they are removing their network so they can keep data safe and not share it with the government.
Now, as a next step, the government has ordered all its employees to stop using third-party non-government cloud platforms like Google Drive and Dropbox, as well as VPN services including NordVPN and ExpressVPN.
Prohibition on the use of third-party cloud storage
In addition to the order not to use third-party cloud storage and VPS, he also asked employers to refrain from using “unauthorized remote administration tools”such as TeamViewer, AnyDesk, Ammyy Admin, etc. use any “external email services for official communication”and conduct “confidential internal meetings and discussions”using “unauthorized third-party video conferencing or collaboration tools.”
In addition, he also asked not to use any external websites, apps, or cloud services to convert/compress the government document. The order also asks employees not to root or jailbreak their Android and iOS devices, respectively. The document also instructs government officials to use complex passwords, as well as update passwords once every 45 days and update the operating system and BIOS firmware with the latest updates and security fixes.
Finally, the document also requires that all government employees, including temporary, contracted/outsourced resources, strictly adhere to the guidelines mentioned in the document. The order will reportedly be released on June 10 after two changes to the original draft made by NIC. The document incorporates input from the Indian Computer Emergency Response Team (CERT-In) and has been approved by the Secretary of the Ministry of Electronics and Information Technology (MeitY).
Why Ban?
The Government of India required VPN companies to store data and transferred it, but since one of the main reasons why people or companies use VPN is to mask their online identity, VPN companies have removed servers from India to avoid transferring data. One of the main reasons was that the government wanted to monitor illegal activity on the Internet. However, this will violate the individual’s privacy and deprive them of their freedom on the Internet.
While services like Google Drive and DropBox are completely legal and many of us use them in our daily lives, the ban came as a surprise. While the exact reason for this ban is not clear at this point, judging by fragments of the circulated document, it looks like the government wants its employees to start using native services and not depend on services like Google Drive and Dropbox. Another reason could be security issues and the government does not want official documents and confidential documents to be stored in a third party application or service.
It will be interesting to see how companies like Google, Dropbox and other VPN companies react to this move.