Senator Urges NSA to Issue Clear VPN Security Guidance

A prominent U.S. senator is urging the National Security Agency (NSA) to provide the public with clear guidance on VPN security and best practices for protecting communications from espionage by foreign adversaries.

A virtual private network (VPN) routes a user’s internet traffic through an encrypted connection to a remote server. This encryption can prevent third parties positioned between the user and the VPN server from reading the contents of the connection. VPNs can also conceal a user’s IP address from the websites and online services they access.

Although U.S. government agencies have previously recommended using VPNs, they have not clearly identified which VPN providers or configurations offer adequate protection.

Why VPN security depends on the details

Several limitations can reduce the privacy and security users expect from a VPN. In many cases, an encrypted VPN tunnel ends at a single server, which decrypts the traffic before forwarding it to its final destination. As a result, the VPN provider—or a rogue employee or attacker who compromises its systems—may be able to access unencrypted traffic, connection details, or source and destination IP addresses.

VPNs also do not hide every type of metadata. Information such as connection times, traffic volume, and communication patterns may remain visible. Nation-state surveillance agencies can analyze this data to build profiles and identify relationships between users, services, and online activity.

Existing public recommendations for VPN use are highly technical and nuanced, making it difficult for people to evaluate their options. Sen. Ron Wyden (D-Ore.) has asked the NSA to publish more specific and practical recommendations.

“Americans facing sophisticated foreign threats, including government officials, defense contractors, journalists, and human rights activists, deserve clear and honest advice about how best to protect their communications from surveillance by foreign adversaries,” Wyden wrote in the letter. The letter was sent Wednesday to NSA Director Gen. Joshua Rudd. “To that end, we ask that you update the NSA’s existing public guidance on VPN configuration to address this issue.”

NSA asked to evaluate single-hop and multi-hop VPNs

Wyden’s request includes questions about the technical architecture of VPN services, including whether single-hop VPNs provide sufficient protection. In a single-hop configuration, one server decrypts the user’s traffic and sends it to its destination, potentially giving the provider access to sensitive connection information.

The letter also asks the NSA to assess multi-hop VPN architectures. These systems route traffic through two or more servers. The first server typically sees the user’s IP address but not the final destination, while the last server sees the destination address but may not know the user’s original IP address.

Wyden also wants the agency to evaluate privacy techniques such as random connection delays and cryptographic padding. These measures are designed to make it harder for attackers to identify users by analyzing timing patterns, traffic volume, and message sizes.

In addition, the senator is asking the NSA to clarify the security and privacy protections offered by services and technologies including Apple Private Relay, Nym, and Tor. Clear guidance could help government employees, journalists, activists, businesses, and other high-risk users make more informed decisions about VPN security and online privacy.