Senator Ron Wyden Asks NSA for Public VPN Guidance to Counter Foreign Surveillance

A prominent US senator is asking the National Security Agency to provide guidance to the general public on best practices for using virtual private networks to secure their communications from spying by foreign adversaries.

VPNs funnel all of a user’s Internet traffic through an encrypted connection to a remote server. The design provides strong assurances that no one between the user and the server can read the encrypted contents. VPNs also allow users to hide their IP addresses from the destination servers they communicate with. While US agencies have previously recommended use of VPNs, none have given recommendations on which ones provide adequate protection.

It’s all in the nuances

There are a host of limitations that can undo many of the protections users may think their VPN provides them. For instance, the encrypted tunnel often terminates once a single server decrypts the traffic and sends it on to its final destination. That means the decrypted traffic or the sending and destination IP addresses may be available for snooping by rogue employees or attackers who hack the server. VPNs also don’t encrypt certain types of metadata, such as time stamps, allowing nation-states to build profiles that can be useful in intelligence gathering.

With so many nuances, the existing recommendations to use a VPN don’t provide enough information for people to make informed decisions. Sen. Ron Wyden (D-Ore.) is asking the NSA to provide specific recommendations.

“Americans facing advanced foreign threats—including government personnel, defense contractors, journalists, and human rights defenders—deserve clear, honest advice about how best to protect their communications from surveillance by foreign adversaries,” Wyden wrote in a letter sent Wednesday to Gen. Joshua Rudd, the director of the NSA. “To that end, I request that you update NSA’s existing public guidance on VPN configurations to address this issue.”

Specific questions touch on some fairly technical details, including the general architecture of a VPN service. They include the adequacy of single-hop VPNs, which, as noted earlier, use a single server to decrypt traffic sent by the user and send it to its destination. It also asks about multi-hop architectures, in which the traffic is funneled through two or more servers, allowing the first to see only the IP address of the sender and the terminating server to see only the destination address. The letter also inquires about the use of random delays and cryptographic padding to thwart attacks that detect timing patterns or the size of messages. Wyden further asks about the adequacy of specific services such as Apple Private Relay, Nym, and Tor.

The questions are:

1. Are standard, single-hop commercial VPNs sufficient to protect Americans’ sensitive digital footprints from foreign adversaries monitoring internet backbones?

2. Does the NSA recommend multi-hop tools such as Apple Private Relay, Tor, or Nym over standard VPNs for Americans facing heightened surveillance threats?

3. What technical features, such as random delays, padding, and cover traffic, are needed to defend against sophisticated surveillance, and how does the NSA assess multi-hop systems like Apple Private Relay compared with Tor and Nym?

Nym is an open source VPN client written in Rust, a memory-safe programming language that’s resistant to attacks exploiting buffer overflows or other types of memory-corruption bugs. Nym can route traffic through a decentralized “mixnet,” which provides random time delays and the reordering of messages. The VPN can also provide a multi-hop architecture.

Apple Private Relay provides multi-hop browsing using two servers, one operated by Apple and the other by a third-party content provider. Tor is a privacy service that encrypts traffic and sends it through three servers before decrypting it and sending it to its final destination.

Each of the services comes with pros and cons. The hops provided by Nym and Tor, for example, are operated by volunteers, some of whom may be nation-state spies trying to use their vantage point to gather intelligence. Apple Private Relay relies on content delivery networks like Cloudflare and Akamai that not everyone trusts. Its protection is also limited to the Safari browser running on Apple devices.

A memo issued by the Congressional Research Service provides an overview of the options but provides no criteria for determining which ones are best. That leaves many people unable to make informed choices about what’s best for their threat model.

“There’s no trustworthy standardization” for assessing various VPN services, Micah Sherr, a Georgetown University professor specializing in network security, said in an interview. “The VPN ads you get in YouTube commercials can be incredibly misleading. It’s extremely difficult for ordinary users to determine whether they need a VPN, what a VPN actually buys them, and which one to use.”

Wyden requested that the NSA provide answers no later than October 14.