The story so far: Last week, the Telecom Regulatory Authority of India (TRAI) sought inputs on whether it would be possible to have “selective” app bans instead of internet shutdowns, in order to reduce the impact that a wholesale communications lockdown can entail.
Does India have a history of Internet shutdowns?
Internet shutdowns are imposed in States and districts across India from time to time in order to prevent the rapid spread of provocative content during communally charged periods. The Indian government considers Internet shutdowns a legitimate tool of maintaining law and order.
Shutdowns can be prolonged, with access to education, work, banking, and information strained. As such, the government has sought to stay the course on imposing restrictions but not at the scale of a shutdown. In Jammu and Kashmir as well as in Manipur, authorities and courts have gradually loosened long-term restrictions by allowing wired internet connections and limited wireless internet access.
How would the TRAI move work?
The approach suggested by TRAI would require telecom operators and messaging app firms like WhatsApp to cooperate with each other and stop access to services during a shutdown. The telecom regulator has sought inputs on licensing messaging apps in India, which may require firms to be subjected to surveillance and blocking requirements.
Has the TRAI considered app regulation before?
In 2015 and 2018, the TRAI had held consultations on regulating messaging apps, a process that led to wide-ranging protections for net neutrality — the concept that all internet traffic should be treated equally. Telecom operators had then called for regulation because they argued that messaging apps provide the same service without going through the stringent security and surveillance regulations that telecom operators go through. Telcos were also wary of their revenues being undercut by online calls and messages, which were cheaper than calling and SMS rates then. However, from 2016 onwards, the Department of Telecommunication (DoT) and the TRAI have rejected this argument, holding that telcos cannot discriminate between categories of data used by consumers.
Since then, regulating messaging apps has become more a matter of security and policing. Seeking a deterrent against communal misinformation and provocative content spreading online, the Ministry of Electronics and Information Technology added a requirement of ‘traceability’ to the IT Rules, 2021, wherein one can find the original sender of a forwarded message. However, civil society groups and tech firms said that such requirements were impossible without breaking end-to-end encryption.
What about VPNs?
It is possible to block websites and certain apps by ordering telecom operators to do so. However, Virtual Private Networks (VPNs) make these blocks trivial to bypass. VPNs tunnel a user’s internet traffic through another server. While these tools are mostly used for completely innocuous purposes, the government has been showing a growing distrust of VPNs. This is because VPNs are often encrypted, leaving the government with little visibility into what goes on in users’ connections.
VPN firms usually route data through servers located in another country, and frequently cycle the IP addresses these servers use to evade detection and blocking. Some VPN firms promise that they do not maintain logs of their customers’ usage. Since the government has not publicly stated what procedural safeguards it exercises when intercepting web traffic of users, these services are used by both privacy-conscious users and, the government argues, terrorists and cybercriminals. When the Indian Computer Emergency Response Team (CERT-in) published directions in 2022 requiring VPN firms to retain records of users from India, most large VPN providers stopped offering servers physically located in India. However, these firms continued serving users in India, allowing people to connect to foreign servers through an encrypted connection and access blocked sites.
Can VPNs be blocked?
Blocking VPNs is not straightforward, as companies operating them tend to frequently change the IP addresses associated with their servers. While VPN services’ websites may be blocked, the installation files can be found elsewhere online. The Manipur High Court was informed as much by telecom operators, who said that blocking VPNs was technically unfeasible.
However, Internet rights activists say that blocking VPNs would be a damaging move for online privacy. “VPNs … help secure digital rights under the Constitution of India specially for journalists, whistle-blowers and activists,” the Internet Freedom Foundation wrote in 2021. “The encrypted nature of information transfer over VPNs allows them to not only secure confidential information but also to safeguard their own identity, thus protecting them from surveillance and censorship.”
