India’s VPN ban in Kashmir ‘adds to psychological pressure’, say residents

Government orders a sweeping ban on VPNs for two months in the disputed region, citing ‘threats to national security’.

Basit Banday*, employed with an IT firm based in the southwestern Indian city of Pune, handles sensitive healthcare data of his company’s clients, ensuring they are safe from leaks and cyberattacks.

Until late last year, the 27-year-old Kashmiri Indian was able to do that using a virtual private network (VPN), which allows a user to mask their internet protocol (IP) address by routing web traffic through a remote server in a manner that makes it undetectable to telephone data or internet service providers (ISPs).

But that changed on December 29 when the Indian government ordered a sweeping ban on the use of VPNs for two months in Indian-administered Kashmir, citing “threats to national security” and alleged “misuse” of the services to “incite unrest”.

The government claimed the use of VPN in Kashmir has the potential to be exploited for “unlawful and anti-national activities”, including dissemination of inflammatory material, misinformation, and other activities that threaten public order.

“It was further observed that VPNs enable encrypted data transmission, mask IP addresses, bypass firewalls and website restrictions, and may expose sensitive information to potential cyber threats,” said one of the almost identical orders, issued by the chief administrator in every Kashmir district.

Banday now fears he may lose his job or will be forced to relocate to Pune, more than 2,000km (1,242 miles) away from his home in Pulwama district.

“VPN is extremely important and mandatory for any IT organisation. Even applications such as corporate email cannot be accessed without connecting to the VPN. It also restricts access to external platforms, allowing only authorised organisation systems and thereby limiting exposure to the outside world.”

Banday’s fears are compounded by a security crackdown that followed the government order.

Multiple videos shared on social media by Indian media outlets and individual users showed policemen in riot gear gesturing to pedestrians or those driving vehicles to stop, and asking for their mobile devices. If the devices were locked, people were instructed to unlock them as officers shuffled through them.

Police said they have taken action against more than 100 people across the region since December 29 for violating the ban orders, adding that “security proceedings” were initiated against the “violators”. Those who were initially “identified” for violations were let go only after their “antecedents” were verified to confirm they had no connections with a “terrorist”, the term the government uses for Kashmiri rebels.

“Genuine users were released after detailed device analysis with a strict warning to refrain from VPN usage in the future,” a statement issued by the police said on January 2.

An estimated 20 percent of India’s 800 million internet users use VPNs. Surfshark, a cybersecurity company based in Amsterdam, estimates that India has the world’s largest number of VPN users, with a market size worth $17bn.