When the Indian Computer Emergency Response Team issued its cybersecurity directions on April 28, 2022, it triggered an immediate exodus. Within months, leading virtual private network (VPN) providers—including NordVPN, ExpressVPN, and Surfshark—shut down their physical server infrastructures across Mumbai and Chennai. At the center of this clash lies a fundamental question for VPN regulation in India UPSC aspirants and constitutional scholars alike: Can a democratic state mandate the systematic de-anonymization of network traffic without gutting the constitutional right to privacy?

For General Studies Paper 2 (Governance, Constitution, and Fundamental Rights) and General Studies Paper 3 (Internal Security and Cyber Warfare), this issue highlights the delicate tension between state security apparatuses and modern privacy rights. Understanding the intersection of the CERT In VPN guidelines, statutory authority under the Information Technology (IT) Act, and the landmark Puttaswamy judgment proportionality test is essential for answering high-scoring analytical questions.

The Technical and Legal Paradox of Mandated VPN Logging

To grasp the policy friction, we must look at how commercial VPNs actually work. A standard VPN establishes an encrypted tunnel between an end-user device and a remote server operated by the provider. Outgoing packets are encapsulated using protocols like WireGuard or OpenVPN, masking the subscriber's real public IP address from Internet Service Providers (ISPs), public Wi-Fi sniffers, and network observers.

Industry-standard VPN architectures operate on diskless, RAM-only servers. Under this paradigm, volatile memory wipes completely upon reboot, making persistent user logging technically impossible by design. A minimal WireGuard or OpenVPN server configuration intentionally suppresses logging to guarantee subscriber anonymity:

# Standard Zero-Knowledge WireGuard Configuration
[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = [SERVER_PRIVATE_KEY]

# Logging is explicitly disabled at the kernel/daemon level
# No persistent database hooks for client session mapping
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = [CLIENT_PUBLIC_KEY]
AllowedIPs = 10.0.0.2/32

The directions issued by CERT-In under Section 70B(6) of the Information Technology Act, 2000, completely upend this engineering model. The directive mandates that Data Centres, Virtual Private Server (VPS) providers, and VPN services must register and maintain the following subscriber information for a minimum of five years:

• Validated names of subscribers, physical addresses, verified email IDs, and contact numbers.
• The exact period of hire, including start and end timestamps.
• The public IP addresses assigned to the user during registration, alongside the dynamic IPs allotted during sessions.
• The ownership pattern, physical location, and stated "purpose" for which the consumer is hiring the encrypted connection.

Core Paradox: Forcing a zero-knowledge system to construct state-mandated logging infrastructure transforms a defensive privacy technology into an centralized honeypot, ripe for catastrophic systemic exploitation by malicious actors.

Constitutional Scrutiny: Evaluating the Directives Against Article 21

The state's statutory power to maintain national security frequently collides with the individual protections guaranteed by the Constitution of India. The primary battleground here is the Right to Privacy Article 21, as recognized by the nine-judge bench in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017).

In Puttaswamy, the Supreme Court ruled that informational privacy and digital identity are inseparable extensions of human dignity. Any state-sanctioned encroachment upon this zone of personal autonomy must survive the rigorous Puttaswamy judgment proportionality test, which demands four cumulative conditions:

1. Legality (Existence of a Clear Law)

The state must point to an explicit statutory backing. While the Union Government relies on Section 70B of the IT Act, 2000, critics argue that Section 70B is an operational provision meant for reporting cybersecurity incidents, not an omnibus legislative blank check empowering an administrative body to institute mass surveillance without parliamentary debate.

2. Legitimate State Aim

The measure must pursue a pressing public objective. The state easily satisfies this component: tracking financial fraud, preventing child sexual abuse material (CSAM), mitigating ransomware attacks, and identifying terror financing pathways that hide behind multi-hop proxies.

3. Suitability (Rational Nexus)

The chosen administrative method must bear a clear, rational relationship to the stated objective. Here, the guidelines face serious technical skepticism. Advanced cyber syndicates and state-backed Advanced Persistent Threat (APT) groups rarely subscribe to mainstream, commercial VPNs using credit cards and KYC-verified emails. Instead, they exploit decentralized routing, botnets, compromised endpoints, and onion routing (Tor). Consequently, blanket data collection primarily ensnares ordinary journalists, dissidents, corporate workers, and privacy-conscious citizens rather than malicious actors.

4. Necessity and Proportionality (Least Intrusive Measure)

This is where the CERT-In mandate encounters its toughest constitutional obstacle. The state must demonstrate that no less intrusive, equally effective measure was available. Indiscriminate, bulk metadata retention covering every customer for five years—without any requirement for prior individualized suspicion, reasonable cause, or judicial authorization—is the antithesis of a narrow, proportional measure.

Comparative International Jurisprudence: How Other Democracies Handle VPNs

To contextualize cybersecurity governance India within broader international standards, consider how different legal systems navigate the boundary between national security and online anonymity:

The European Union (The Rights-Centric Model)

Under the General Data Protection Regulation (GDPR) and established Court of Justice of the European Union (CJEU) precedent—notably in landmark cases like Digital Rights Ireland (2014) and Tele2 Sverige (2016)—blanket, undifferentiated data retention mandates imposed on telecommunications and internet providers have been struck down repeatedly. The CJEU ruled that general and indiscriminate retention of traffic and location data violates fundamental human rights, confirming that access to such data can only be permitted for fighting serious crime and must remain subject to prior review by a court or independent administrative body.

Authoritarian Frameworks (Total State Interception)

Conversely, jurisdictions like China, Russia, and Iran employ complete digital containment. In China, only state-licensed VPNs that connect directly to the Ministry of Public Security's surveillance apparatus are legally permitted; unapproved tools are suppressed by the Great Firewall. Russia's communications regulator, Roskomnadzor, maintains a centralized registry banning VPN services that refuse to blacklist state-censored domains.

By enforcing compulsory registration and logging while stopping short of an outright ban, India has established a distinct middle ground. However, this hybrid approach pushes commercial providers toward "virtual servers" (anchoring Indian IP addresses to physical nodes based safely outside the country, in places like Singapore or Frankfurt), blunting domestic regulatory leverage.

Strategic Policy Pathways: Balancing National Security and Digital Liberties

Reconciling state-mandated cyber defense with fundamental constitutional guarantees requires transitioning from blunt, dragnet data collection toward institutional, rights-respecting mechanisms. Prospective civil servants should evaluate the following structural reforms:

• Targeted Interception via Independent Judicial Warrants: Replace indiscriminate mass retention with targeted logging orders. If investigative agencies establish probable cause against a specific target before a judicial authority, providers can be ordered to monitor those specific sessions within defined technical parameters.
• Harmonization with the Digital Personal Data Protection Act (DPDPA): Align CERT-In operational mandates with the data minimization principles codified under India's data protection laws. Retaining sensitive metadata for five years directly undermines the principle that personal data should only be held as long as strictly necessary.
• Clear Exemption for Corporate and Enterprise Infrastructure: While CERT-In clarified in operational FAQs that internal enterprise VPNs are exempt, ambiguity persists for remote-first workforces, open-source networking tools, and privacy-focused startups. Formalizing these boundaries through clear statutory rules provides vital regulatory certainty.
• Adoption of Privacy-Preserving Cryptographic Auditing: Instead of holding unencrypted client logs on domestic servers, explore zero-knowledge proofs and cryptographic escrow systems. These systems allow law enforcement to verify compliance during formal investigations without maintaining centralized repositories of citizen activity.