India’s new IT rules risk scaring away tech companies

India’s cybersecurity rules which will start operating later this month have been criticized by a tech industry body.

The Internet and Mobile Association of India (IAMAI), which represents organizations such as Google and Facebook, has warned that the new rules will create an environment of fear rather than trust. He called for a one-year delay before the rules come into force, in a letter sent to India’s IT ministry seen by Reuters.

The new rules were set by India’s Computer Emergency Response Team (CERT) in April and require tech companies to report data breaches within six hours of noticing the incident and keep logs. information technology and communications for six months.

IAMAI proposed extending the six-hour window, noting that the global standard for reporting cybersecurity incidents is generally 72 hours.

CERT also asked cloud service providers, such as AWS, and virtual private network companies to retain customer names and IP addresses for at least five years, even if they stop using the company’s services. society.

IAMAI said the cost of complying with these guidelines could be enormous, and proposed penalties for violating them include jail time, which would lead entities to cease operations in India for fear of being wrong.

The government said the new rules were necessary because cybersecurity incidents were reported regularly, but the information needed to investigate them was not always readily available from service providers.

The new rules led ExpressVPN to pull its servers from India last Thursday. Users in the country will still be able to connect to VPN servers, but its Indian virtual servers will be physically located in Singapore and the UK.

The company said CERT’s new data law is incompatible with the purpose of VPNs, which are designed to keep users’ online activity private. “ExpressVPN refuses to participate in the Indian government’s attempts to limit internet freedom,” the company said in a press release.