India VPN directions: Will pulling servers from India be enough?

ExpressVPN has refused to comply with the Indian government’s demands that VPN providers retain details of subscribers, and pulled its servers from India. But interestingly, the firm says it will still provide a way for people around the world to connect to servers that appear to be Indian; only that these servers will be located outside India.

“ExpressVPN refuses to participate in the Indian government’s attempts to limit internet freedom. As a company focused on protecting privacy and freedom of expression online, we will continue to fight to keep users connected to the open and free internet with privacy and security, no matter where they are located,” ExpressVPN said in a blog post.

“With virtual locations, the registered IP address matches the country you have chosen to connect to, while the server is physically located in another country. Virtual locations are used, where necessary, to provide faster, more reliable connections,” the company added, indicating that users will still have a way to connect to foreign servers.

ExpressVPN and other providers like NordVPN continue to serve Indian users while cautioning that they may no longer be able to maintain servers within India. But the government may not stop there — the VPN rules (part of a larger cybersecurity directive) don’t just apply to VPN companies with a server presence in India.

In a response to Entrackr, the IT Ministry said, “The directions apply to any VPN Service provider offering services to the users in India”. This has not been reported before. ExpressVPN therefore appears to be in defiance of Indian law even after pulling its servers out of India (or it will be, when the directions come into force later this month). In an FAQ published online, the government was not this explicit on responding to a similar question of jurisdiction.

So this raises the question of whether pulling servers from India will be enough. It’s not clear if this means that the government will block foreign VPN providers, but their non-compliance to these directions (which was a given, as asking such firms to retain user data was a non-starter), may serve as a key justification.