Pune-based VPN service provider SnTHostings.com has written to the ministry of electronics and information technology (MeitY), asking it to recall a set of cybersecurity directions that come into force on June 27.
In the letter, SnTHostings.com said asking VPN service-providers to collect personally identifiable data violates the right to privacy of users and completely changes the true nature of services provided by VPNs.
The directions issued by the Indian Computer Emergency Response Team (CERT-In) require service providers such as SnTHostings to maintain logs of all information and communication technologies systems for a period of 180 days.
These norms have been a fragile issue, not just for SnTHostings but also other VPNs. Express VPN, NordVPN and Surfshark have said they will remove their servers from India. The directions were driving business outside India,
In a letter, Founder and CEO of SnTHostings Harsh Jain said, “Firstly, many service providers do not maintain such data because they respect the privacy of their users. As stated above, mandating them to start collecting such data for unstated reasons violates the privacy of users. Secondly, the directions didn’t offer any explanation on why data must be stored for such an arbitrarily long period of time. It would come with significant additional costs on service providers.”
MeitY held a round of consultation with stakeholders to explore the possibility of setting up a portal to report cybersecurity incidents as mandated in the CERT-In directions. The ministry also said it was open to providing support to startups and small companies to comply with the directions. Small companies told the ministry they would require 300 days to comply with the directions.
