In a recent move, VPN users in Tanzania may be compelled to disclose their actual IP addresses and online activities under a new directive. The Tanzania Communications Regulatory Authority (TCRA) has issued a public notice demanding that both individuals and organizations reveal their VPN usage and all associated information to the authority by the end of October 2023.
This directive, aimed at cracking down on users accessing prohibited content, has raised concerns among digital rights advocates from the Tanzania Digital Right Coalition (TCRC). They fear this rule could severely impact the rights to privacy, freedom of speech, and access to information for Tanzanians. The TCRC is now urging the government to reconsider its decision and engage in constructive dialogue.
In an open letter published on October 14, the TCRC's 23 members expressed their concerns, stating, "TCRA's decision to limit the use of VPNs in Tanzania has far-reaching implications for the digital rights and freedoms of Tanzanian citizens."
Under the new directive, both private users and businesses must disclose their VPN usage and provide information such as their IP address. Failure to comply with these rules carries a fine of at least 5 million Tanzanian shillings (approximately $2,000) and/or a minimum 12-month jail sentence.
While the directive aims to prevent users from accessing content prohibited by law, the request for data contradicts the core purpose of VPNs and why people use them. VPNs, or virtual private networks, are security software that encrypts data leaving the user's device and disguises their real IP address. While this IP obfuscation provides access to geo-restricted content, it also safeguards online anonymity.
The TCRC emphasizes,
"VPNs play a crucial role in safeguarding online privacy, enabling secure communication, and granting access to information and services that may otherwise be restricted or censored. Furthermore, VPNs are essential tools for many businesses, researchers, and individuals to access online resources securely and conduct their activities without undue interference."
For example, Tanzanians can only access certain social media platforms like Clubhouse through a secure VPN service. VPNs enable citizens to "participate in global conversations, share their perspectives, and engage with a diverse range of ideas," according to experts.
The new directive could deprive users of significant opportunities. Moreover, "limiting this access not only stifles freedom of expression but also hinders opportunities for cultural exchange, learning, and networking," they add.
Experts caution that some of Tanzania's human rights, especially freedom of expression and access to information, are at risk. Data privacy, another fundamental human right, is also in jeopardy as individuals and businesses are forced to disclose details about their online activities. The extensive data collection could pose security risks, as personal information may be misused by both the government and cybercriminals.
Likewise, internet shutdowns, which restrict the internet and limit global connectivity, could impede Tanzania's potential growth in the global digital economy.
The TCRC is now calling on the Tanzanian government and TCRA to reverse their decision to restrict VPN usage. Instead, they advocate for engagement with civil societies, businesses, and citizens in "constructive dialogues" to address authorities' concerns while upholding users' digital rights.
The TCRC wrote:
"We urge them [authorities] to respect and protect the rights of Tanzanian citizens to access information, communicate securely, and express themselves freely online. We stand ready to collaborate with all stakeholders to find solutions that balance national security concerns with the protection of digital rights. We remain committed to promoting a free, open, and secure digital environment for all Tanzanian citizens."