Proton VPN Removes India Servers; Calls CERT-In Mandates For VPNs ‘Regressive’

Proton, the Swiss company behind Virtual Private Network (VPN) service provider Proton VPN, on Thursday (September 22) said that it is removing its physical servers from India in response to the country’s “regressive new surveillance law”. 

The company was referring to the new mandate that requires VPN providers to collect and hold user data for up to five years.

With this, Proton has joined other companies like ExpressVPN, Surfshark, and NordVPN in pulling servers out of the country in response to the new mandate. Proton said it would put in place a technical countermeasure for Indian users to continue using its network which doesn’t subject it to the law’s logging requirements.

The company, in a statement, said that it has invested in time, resources, and effort to combat such surveillance, enabling users to freely use the internet. Hence, this step underscores Proton’s mission to protect privacy and freedom online and defend the rights of users, it added. 

In May this year, the Indian Computer Emergency Response Team (CERT-In), under the Ministry of Electronics and Information Technology (MeitY), released a set of directives mandating that VPNs, along with Virtual Private Server (VPS) providers, cloud service providers and such other entities, collect and store various user data like names, IP addresses, email addresses, and more for up to five years.

This not only sparked a debate among the legal experts but also made the service providers question the basic reason for their existence. 

Proton in its statement said that it “condemns” CERT-In’s latest order and added that the company cannot comply with the rules due to its strict no-logs policy. Proton also said that it would not act in ways that try to undermine user privacy and free expression. 

However, Proton has unveiled new Proton VPN  “Smart Routing” servers as a remedy, which will allow people to connect to Indian IP addresses from a remote server. Proton’s new Indian servers are based in Singapore, which means users can keep an Indian IP address and access the Indian internet securely. Since these servers are physically located outside the jurisdiction of the Indian government, they are not subject to the new logging rules.

“Government surveillance and censorship is a growing threat around the world and we are deeply concerned about any trends towards restricting privacy and freedoms for citizens, especially this latest move from India,” said Andy Yen, founder and CEO of Proton, adding that the company has no intention of ever complying with this or any other mass surveillance law.

“Proton is committed to protecting our users, fulfilling our mission to build a better internet where privacy is the default,” Yen added.

Proton said that in countries like Hong Kong, Belarus, and Myanmar, it has fought actively for freedom of expression to maintain secure internet access and protect journalists and activists. The company claims to have raised over $1 Mn for such causes.

Speaking to Inc42, several legal experts had earlier raised concerns on the new rules saying that they can lead to state-sponsored mass surveillance. They stressed the need for having a privacy law in place before introducing such mandates.

However, the government has refused any changes in the law, and asked the VPN service providers to either follow the rules or exit India.

Earlier, NordVPN, ExpressVPN, and Surfshark also condemned such a move by the Indian government.