A schoolchild in India has been arrested for allegedly stalking, threatening, and harassing a 20-year-old woman on social media with police claiming to have used cyber-forensic tools to bypass his VPN account.
The incident in question played out in the Indian capital New Delhi over just a few hours on Wednesday 7th April.
The victim, who is currently undertaking a course to qualify as an air hostess contacted police after receiving a number of sexually explicit and obscene messages on Instagram. According to reports of the case, these included demands that she engage in a sexual relationship with him.
She reported these messages to the police, no doubt concerned given India's long and troubling track record of high-profile harassment, sexual assault, and rape cases against young women and even underage girls. She told police that she felt “extremely harassed” by the messages.
Police looked into the messages and also discovered that the culprit had sent the victims a series of emails using a ‘spoofed email account'.
This is where the case gets interesting.
Email and VPN analysis
According to R Sathiyasundaram, deputy commissioner of police at Jagat Puri Police Station in New Delhi, they analysed the details of the email and found that they were being sent by someone protecting themselves with a VPN.
This is when the account of the case gets vague. No details of the VPN are given.
The Deputy Police Commissioner simply says they examined the collected information and with the help of technical surveillance and cyber-forensic tools, the identity of the person sending the emails was discovered.
Police arrested a 17-year-old schoolboy, who is a resident of the Krishna Nagar region of the city. They claim to have recovered a mobile phone which was being used to operate both the email account and Instagram account responsible for the harassing messages.
It seems that the Indian police have got their man (or boy) and he will rightly face criminal charges for his actions. There is no excuse for sending such messages to an innocent woman or for using a VPN to try and cover his tracks. No VPN we are aware of would condone the use of their service in this way.
But the case throws up several troubling questions.
The Indian police claim that they arrested the youngster within 5 hours of the complaint being made. In that time, they claim to have analysed emails and social media messages, identified a VPN, and bypassed that information to identify the user who was then arrested.
The VPN is not named, which is no surprise since no VPN worth its salt should have security that can be bypassed that quickly and by regular police officers too.
This throws up two possibilities.
Either the culprit wasn't using a VPN but another less secure tool which can be easily bypassed, or he was using a VPN which routinely logs user information and is more than happy to hand that information over to the Indian authorities if requested.
It is difficult to vouch for the reliability and veracity of this story given the limited information that is available. Here at VPNCompare we are sceptical based on our knowledge of VPNs.
But either way, the lesson for VPN users in India is clear.
Be sure to choose an international VPN that has a robust no user logs policy and will not reveal all of your internet activity in a matter of hours to any Indian authority who might request it.
There are lots of VPNs around that can offer a genuine no user logs guarantee. Our guide to the Best VPNs for India is good place to start.
If this schoolboy had used a VPN, he might have got away with his actions. Perhaps it's reassuring to know that people stupid enough to treat women like this, are also stupid enough not to choose a decent VPN too.