VPN services prohibited for government employees, Google Drive & Dropbox use also banned

• Image Credit: Internet

• Jun 18, 2022 | Dhupali Das

It should be noted that in July 2020, the Indian government banned CamScanner, along with numerous other Chinese apps, claiming national security concerns.

Digital Desk: Advising them not to keep "any internal, restricted, or confidential government data files on any non-government cloud service such as Google Drive or Dropbox", the Centre has issued a directive barring its staff from accessing third-party virtual private networks (VPN). They are also forbidden from utilizing any anonymization services provided by firms such as Nord VPN, ExpressVPN, and Tor.

The government's announcement comes only days after VPN service providers such as ExpressVPN, Surfshark, and NordVPN announced that they would no longer operate in the country. Their decision came after the Indian Computer Emergency Response Team (Cert-In) issued a guideline on how VPN businesses should work in the country.    

The instructions were issued by the National Informatics Centre (NIC), which is part of the Ministry of Electronics and Information Technology, to improve the government's "security posture."

According to NIC's internal document titled "Cyber Security Guidelines for Government Employees," "these guidelines have been compiled to sensitize government employees and contractual/outsourced resources and build awareness amongst them on what to do and what not to do from a cyber security perspective."

In addition, the agency has instructed government personnel not to "unlock the device" or "root" their phones or utilize any external mobile app-based scanner services like CamScanner for scanning "internal documents."

It should be noted that in July 2020, the Indian government banned CamScanner, along with numerous other Chinese apps, claiming national security concerns.

"The government's security posture can be strengthened by implementing uniform cyber security principles in government offices across the country. All government personnel must follow the principles outlined in this paper, including temporary, contractual, and outsourced resources. The respective CISOs/Department heads may take action if there is non-compliance," stated the internal document.

On April 28, India's national cyber security agency Cert-In demanded that VPN providers keep track of their customer's information, including names, addresses, and the reason for using the VPN service.

At a recent news conference on the Cert-In guidelines, Minister of State for Electronics and IT Rajeev Chandrasekhar stated that the government would adopt a "zero-tolerance" approach on anonymity being used as a cover for online crimes.