India will not change upcoming cybersecurity rules that force social media, technology companies and cloud service providers to report data breaches swiftly, despite growing industry concerns, the government said on Wednesday.
The Indian Computer Emergency Response Team issued a directive in April asking tech companies to report data breaches within six hours of “noticing such incidents” and to maintain IT and communications logs for six months.
They also mandated cloud service providers such as Amazon and virtual private network (VPN) companies to retain names of their customers and IP addresses for at least five years, even after they stop using the company’s services. India’s junior IT minister Rajeev Chandrasekhar said there will be no changes despite the worries, saying tech companies have an obligation to know who is using their services.
India has tightened regulation of Big Tech firms in recent years, prompting pushback from the industry and in some cases even straining trade ties between New Delhi and Washington. New Delhi has said the new rules were needed as cybersecurity incidents were reported regularly but the requisite information needed to investigate them was not always readily available from the service providers.
But the rules have caused widespread discontent. In a closed-door meeting this week, many social media and tech company executives discussed strategies to urge New Delhi to put the rules on hold, according to a source with direct knowledge.
The source said European authorities require data breaches to be reported within about 72 hours, adding that it was difficult to report incidents in six hours.
Chandrasekhar, however, said India was being generous, as some countries mandate immediate reporting.
The rules are set to be enforced from end of June. After they were announced, NordVPN, one of the world’s largest VPN providers, said it may remove its servers from India.
Privacy activists have said the rules contradict the idea of VPN, which is to safeguard identity of individuals such as whistleblowers from surveillance.
“If you don’t want to go by these rules, and if you want to pull out, then frankly … you have to pull out,” Chandrasekhar told reporters. Virtual private network (VPN) service providers are up in arms against a new directive of The Indian Computer Emergency Response Team or Cert-In, a wing of the Ministry of Electronics and Information Technology, that mandates they must maintain all customer data for five years. VPN service providers have said the new directive would mean a total loss of privacy for the users–one of the most important unique selling points of such services. Any and all devices connected to the internet are a part of a large network of computers, servers and other devices spread across the world. To identify each device connected to the internet, service providers globally assign a unique address to each such device called the internet protocol address or IP address. It is this IP address that helps websites, law enforcement agencies and even companies track down individual users and their accurate location. A virtual private network, when switched on, essentially creates a safe network within the larger global network of the internet and masks the IP address of the user by rerouting the data. Acting as a tunnel, a VPN takes data originating from one server and masks it in a different identity before delivering it to the destination server. In essence, a VPN creates several proxy identities for your data and delivers it safely without disturbing the content of the data.
You must be logged in to post a comment.