[boomboomsubban]

>Whhich specific part of the bill allows "VPN users" to be punished with "20 year jail sentences"? Does the bill even ban VPNs

The bill allows communication technology to be investigated for vague security concerns, and then allows punishing those that are deemed threats.

This means they could investigate and punish some VPN provider, and someone could wake up one day and suddenly be committing a crime by connecting to the same VPN as the day before (I think? They may need their subscription to renew before a crime, I only skimmed the law). Sure there'd be an announcement, but it could still end in a potential 20 year sentence for connecting to a VPN.

It could even be a vague connection, like Russia is using this third party VPN provider to undermine democracy, so despite really doing nothing wrong we're banning the VPN.

You can certainly argue it's unlikely the law would be applied this way, or that users aren't at great risk of being targeted. But the headline claim is broadly true.