Using a VPN May Subject You to NSA Spying
Six Democratic lawmakers are pressuring the nation’s top intelligence official to publicly reveal whether Americans who use commercial VPN services risk being treated as aliens under U.S. surveillance law — a classification that would strip them of constitutional protections against warrantless government spying.
In a letter sent Thursday to Director of National Intelligence Tulsi Gabbard, the lawmakers say that because VPNs mask a user’s true location and because intelligence agencies presume that communications of unknown origin are foreign, Americans could inadvertently waive the privacy protections to which they are entitled under the law.
Several federal agencies, including the FBI, National Security Agency, and Federal Trade Commission, have recommended that consumers use VPNs to protect their privacy. But following this advice could inadvertently cost Americans the protections they seek.
The letter was signed by members of the progressive flank of the Democratic Party: Senators Ron Wyden, Elizabeth Warren, Edward Markey and Alex Padilla, as well as Representatives Pramila Jayapal and Sara Jacobs.
This concern applies specifically to Americans connecting to VPN servers located in other countries, which millions of people do regularly, whether to access region-restricted content like sports broadcasts abroad or simply because their VPN app has selected a foreign server by default. When they do this, their Internet traffic may become indistinguishable from that of a stranger.
As part of a controversial warrantless surveillance program, the U.S. government is intercepting large quantities of electronic communications belonging to people overseas. The program also sweeps up huge volumes of private messages belonging to Americans, which the FBI can search without a warrant, although it is authorized to target only foreigners abroad.
The program, authorized under Section 702 of the Foreign Intelligence Surveillance Act, is set to expire next month and is the subject of a bitter battle in Congress over whether it should be renewed without significant reforms to protect Americans’ privacy.
Thursday’s letter highlights declassified guidance from the intelligence community that establishes a default presumption at the heart of lawmakers’ concerns: Under NSA targeting procedures, a person whose location is unknown is presumed to be a non-U.S. person unless there is specific information indicating otherwise. Department of Defense procedures governing signals intelligence activities contain the same presumption.
Commercial VPN services work by routing a user’s Internet traffic through servers operated by the VPN company, which can be located anywhere in the world. A single server can simultaneously route traffic from thousands of users, all of whom appear to come from the same IP address. For an intelligence agency collecting bulk communications, an American connected to a VPN server, say in Amsterdam, is no different from a Dutch citizen.
The letter does not assert that Americans’ VPN traffic was collected under these authorities – such information would be classified – but asks Gabbard to publicly clarify what impact, if any, VPN use has on Americans’ privacy rights.
Among those pressing the issue is Wyden, who, as a member of the Senate Intelligence Committee, has access to classified details about the operation of these surveillance programs and has a well-documented history of using carefully worded public statements to call attention to surveillance practices that he is unable to openly discuss.
The letter also raises concerns about a second, broader surveillance authority: Executive Order 12333, a Reagan-era directive that governs much of the intelligence community’s foreign surveillance operations and allows for the mass collection of foreign communications with even fewer constraints than Section 702.
While Act 702 is a law subject to congressional oversight and requires approval from the Foreign Intelligence Surveillance Court, EO 12333’s surveillance operates under guidelines approved only by the United States Attorney General.
