Srinagar: Doda district, in the Chenab valley of the Union Territory (UT) of Jammu and Kashmir, has become the latest district to prohibit the use of Virtual Private Networks (VPNs), with the administration ordering a two-month blanket ban on the service.The order issued by the district administration cited cyber security, unlawful online activity and threats to public order as some of the key reasons for the restriction. District Magistrate Doda, Krishan Lal, issued the order on September 5 under Section 163 of the Bharatiya Nagarik Suraksha Sanhita (BNSS), 2023.The order has raised serious concerns among internet and privacy rights experts. Rudraksh Lakra, a Delhi-based lawyer and policy analyst, questioned the legal basis of the order and argued that Section 163 of the BNSS may not be the appropriate mechanism for imposing such a restriction.“Section 163 is a colonial-era relic, and its broad wording has repeatedly been abused,” Larka told The Wire. “The provision specifically governing blocking of online content is Section 69A of the Information Technology Act, 2000, which sets out narrower grounds for blocking and comes with procedural safeguards that Section 163 lacks,” he said. Further, it is contested whether even the IT Act Section 69A can be used to ban an entire platform.Larka also questioned whether a restriction covering an entire district for two months could satisfy the proportionality test. “The VPN ban applies across an entire district and lasts over two months, making it a blanket ban in both scope and duration. Restrictions of this kind raise serious constitutional concerns within the proportionality doctrine, because they invert the relationship between the right and the exception, treating the restriction as the norm and the right as the carve-out, rather than the other way around,” he said.In the order, the Doda administration mentioned that it had received reports of VPNs being misused by certain individuals and groups. But it did not mention who these “individuals and groups” are.DM Doda Krishan Lal’s order banning VPN use across the district under Section 163 BNSS, citing misuse to bypass cyber restrictions and access prohibited content. It says violators shall face legal action.According to the restriction order, VPNs were allegedly being used to get around lawful cyber restrictions and access prohibited applications, websites and digital content accessed by unidentified individuals and groups.Meanhile, the official order justified the move, saying that such activity could be exploited for unlawful and anti-national purposes and citing the possibility of inflammatory material being circulated, unrest being incited and activities prejudicial to law and order being coordinated through online platforms.Also read: Mapping the Rising Internet Shutdowns in India Since 2016But privacy experts say that VPNs are not used only to access restricted websites but also to protect internet users’ online privacy, particularly when using public networks. Businesses and professionals may also rely on VPNs for legitimate work and secure access to their systems, experts say.The order in Doda comes amidst heightened security concerns in the Chenab Valley. In last two months, the area has witnessed two major incidents; the killing of a civilian by police and the rape and murder of a minor girl in Kishtwar, at a time when internet services were partially banned.Also, Doda’s fresh VPN ban comes against the backdrop of a resurgence of militant activity in recent years. Doda and neighbouring Kishtwar have witnessed encounters, attacks on security forces and sustained counter-terror operations since 2024. But there is no visible link of these incidents with the order.Instead, the administration has described the restriction as an urgent preventive measure in the interest of public safety, cyber security and national security. The order applies across Doda and covers individuals, institutions, cyber cafés, businesses and Internet Service Providers across the district.The administration has made an exception for VPN services specifically authorised by them through an official communication. And anyone found violating the directions could face legal action, the order says.To ensure strict compliance with the order, the Senior Superintendent of Police, Doda, has been directed to implement it in letter and spirit.Following similar bans issued in late December 2025 and January 2026, authorities in J&K identified 140 to 150 people and initiated security proceedings, legal action or FIRs against dozens of people for “unauthorised” VPN use.“In the past, the VPN ban in J&K has been enforced through police checks of people’s phones, which is an even more disproportionate and unconstitutional measure. Inspecting the contents or settings of someone’s phone is especially intrusive: a phone holds a vast trove of personal and sensitive information, from private communications and photographs to location data,” Larka said.Also read: The ‘Special Status’ of Kashmir’s Internet Must GoHe stressed balancing the importance of the right to access information and navigate the internet against the importance of the state objective. “VPNs have been recognised as central to the exercise of human rights by the United Nations General Assembly and the Human Rights Council. They are particularly important for human rights defenders, civil society organisations, journalists, whistle-blowers and political dissidents,” Larka said.In places like J&K, which has faced one of the longest internet shutdowns in history and where “censorship has been central to military control”, Lakra says, “VPNs are sine qua non.”The Doda restriction order on VPNs is part of a pattern in Jammu and Kashmir used to manage the security of the region.The Kupwara administration had issued a similar prohibition in December last year citing the alleged misuse of VPNs for unlawful and anti-national activities. After months there is no official order whether the Kupwara order was later revoked or remains in force.In the same month, the Srinagar administration had also cited cyber security concerns while imposing restrictions on VPN use. Authorities argued that VPNs can conceal users’ IP addresses, bypass website restrictions and firewalls, and create encrypted connections that could make sensitive information vulnerable to cyber threats.For the government, the restrictions are a preventive step. For internet-rights advocates, however, a district-wide ban raises questions about proportionality, privacy and access to the internet.Lakra argued that invoking national security or public order concerns does not automatically justify restrictions on technology or online activity.Referring to the Supreme Court’s rulings in Ram Manohar Lohia (1960) and Kedar Nath Singh (1962), he said restrictions justified on public-order grounds must establish a sufficiently close connection between the expression or conduct being targeted and the anticipated harm. “ But invoking phrases like “anti-national” and “law and order” does not, on its own, meet the constitutional threshold for restricting speech. Where speech is restricted on public order ground, the state must show a proximate nexus between the expression and the anticipated harm,” he said.In Kedar Nath Singh v State of Bihar (1962), the supreme court held that “mere discussion” or “advocacy” of even radical views is protected speech. Accordingly, merely accessing prohibited material or disseminating “inflammatory” material does not establish a sufficient basis for restricting access to VPNs.He also pointed to the supreme court’s judgment in Anuradha Bhasin v Union of India (2020), in which the court examined the legal framework governing restrictions on internet access and stressed the need for restrictions to meet constitutional standards of necessity and proportionality.“In Anuradha Bhasin, the supreme court criticised the use of the general provisions of the Code of Criminal Procedure, 1973 the BNSS’s predecessor to impose internet restrictions, rather than relying on the specific legal framework that governs the particular restriction in question,” he said.Larka pointed to regulatory approaches in the US, Australia, South Africa, Canada and the European Union, saying these jurisdictions generally rely on targeted law-enforcement measures rather than blanket VPN restrictions. “As encryption has become more widespread, law enforcement in these countries has shifted toward metadata analysis and individualised, targeted measures aimed at specific persons or groups. The Doda administration could adopt a similarly calibrated approach,” he said.The Doda administration has not announced any distinction between VPN use for unlawful activity and its use for legitimate purposes. For the next two months, the message to residents is therefore simple, VPN use is prohibited unless it has been explicitly authorised by the government.