NSA Urged to Release Public Guidance on Which VPNs Actually Protect Against Government Spying

Senator Ron Wyden is calling on the NSA to offer the American public concrete guidance about which virtual private networks will genuinely safeguard their communications from snooping by state actors—a step that existing government counsel has failed to take.

Why VPNs alone aren't enough#

The protective power of a VPN often comes with major caveats. While these services encrypt traffic through a private tunnel to a remote server, that protection can evaporate once the data leaves the VPN's infrastructure. A VPN operator with access to decrypted traffic, or a hacker who compromises the server, could potentially observe unencrypted messages and the origin-destination IP address pairs. Beyond that, VPNs typically don't shield certain metadata—timestamps and message sizes, for instance—that state intelligence services can use to piece together revealing patterns about users' behavior.

Current government advice to simply "use a VPN" glosses over these complexities, leaving ordinary people unable to make truly informed choices about their security.

The senator's specific ask#

In a letter to NSA Director General Joshua M. Rudd this week, Wyden wrote that "Americans facing advanced foreign threats—including government personnel, defense contractors, journalists, and human rights defenders—deserve clear, honest advice about how best to protect their communications from surveillance by foreign adversaries."

Wyden is requesting detailed NSA recommendations on several technical design choices:

• Single-hop versus multi-hop architecture: Whether a basic VPN that routes traffic through one server offers adequate protection, or if routing through multiple servers (where the first sees only the sender's IP and the last sees only the destination) is necessary.
• Timing and padding defenses: The value of random delays and cryptographic padding in blocking attacks that rely on message size or timing patterns.
• Specific services: Whether tools like Apple Private Relay, Nym, and Tor meet the bar for security against sophisticated adversaries.

The letter signals that Wyden believes both government workers and at-risk civilians need more than platitudes—they need actionable technical standards from the agency best positioned to understand what state-level threats actually look like.