Senator Urges NSA to Revise VPN Guidance on Foreign Surveillance Risks
Senator Ron Wyden, a Democrat from Oregon, is urging the National Security Agency (NSA) to revise its cybersecurity guidance to alert Americans that standard commercial virtual private network (VPN) services may not shield them from advanced foreign surveillance threats. According to a Congressional Research Service (CRS) analysis requested by Wyden, foreign intelligence agencies monitoring internet traffic could potentially link a VPN user to specific websites by analyzing the timing and volume of encrypted data entering and exiting the VPN server. This method, known as traffic analysis, does not require breaking the encryption, which means that a user's online behavior could be exposed even if the underlying data remains unreadable.
Major intelligence powers, including the United States and China, have sought extensive visibility into global internet traffic through domestic legal authorities and covert access to the infrastructure that carries it, such as telecommunications networks and undersea fiber-optic cables. The CRS report emphasizes that encryption strength alone does not protect users from sophisticated threats that conduct bulk traffic collection.
VPNs are often utilized to secure connections on public Wi-Fi, mask internet addresses, and prevent internet service providers from directly monitoring online activities. However, the report highlights concerns primarily regarding single-hop VPNs, which route a user's traffic through one provider's server before reaching its final destination. If an adversary can monitor or compromise that server, they may be able to correlate the incoming and outgoing traffic, exposing user activity.
Wyden argues that this vulnerability should be clearly communicated to government personnel, contractors, journalists, and others who may be targets of espionage. In a letter to NSA Director General Joshua Rudd, he stated, "Americans facing advanced foreign threats deserve clear, honest advice about how best to protect their communications from surveillance by foreign adversaries." Wyden has requested unclassified responses from the NSA by October 14.
The NSA, which serves as the primary foreign electronic eavesdropping and hacking entity within the U.S. intelligence community, has been approached for comments regarding this issue. The CRS report also notes that services like Tor, Nym, and Apple’s iCloud Private Relay can complicate traffic analysis by distributing information about a user and their destination across multiple servers, although none guarantee complete anonymity.
Current guidance from the NSA and the Cybersecurity and Infrastructure Security Agency primarily focuses on preventing hackers from exploiting vulnerabilities in remote-access VPN products to infiltrate government or corporate networks. Recommendations include promptly installing security updates, enforcing multifactor authentication, and minimizing exposed features.
In a response released by the Office of the Director of National Intelligence (ODNI) in July, VPNs were described as beneficial for basic cybersecurity. Consumers were advised to scrutinize a provider's encryption, privacy, and data-retention policies. However, it remains unclear whether the ODNI assessed whether conventional VPNs could expose users to surveillance or if they compared single-hop services with other options.
Wyden's request comes in light of findings that Chinese state-owned telecom providers have retained footholds in U.S. networks, which could facilitate the hacking and surveillance he seeks to address with the NSA. A bipartisan House China Committee investigation reported last month that three Chinese carriers maintained equipment, data center space, and network connections in the U.S., despite federal crackdowns.
