For years, virtual private networks have been marketed as the digital equivalent of a privacy curtain — a way to shield your browsing activity from prying eyes, whether those belong to your internet service provider, a hacker on public Wi-Fi, or a government agency. Millions of people pay monthly subscriptions for VPN services, trusting that encrypted tunnels will keep their data safe. But a growing body of evidence suggests that using a VPN doesn’t just fail to protect you from the National Security Agency. It may actually make you more interesting to it.
That’s the unsettling reality laid bare by documents and legal interpretations that have surfaced over the past decade, and which continue to shape how the U.S. intelligence community treats encrypted internet traffic. As Wired reported, the very act of using a VPN can serve as a trigger for the NSA to collect, retain, and analyze your communications — even if you’re an American citizen on American soil.
The logic, from the intelligence community’s perspective, is straightforward. When the NSA encounters encrypted traffic, it often can’t immediately determine whether the person behind it is a U.S. person or a foreigner. And under the legal frameworks governing signals intelligence, particularly Executive Order 12333 and Section 702 of the Foreign Intelligence Surveillance Act, that ambiguity matters. A lot.
Here’s how it works in practice. The NSA is generally prohibited from targeting Americans for surveillance without a warrant. But when data is collected in bulk — say, from an internet backbone or a major fiber-optic cable — analysts must make determinations about who is a domestic user and who isn’t. VPN traffic, by its very design, obscures the user’s true IP address and location. If an analyst can’t tell whether a communication belongs to an American, the agency’s internal rules have historically allowed that data to be retained for further examination. The encryption itself becomes the justification.
This isn’t speculation. It’s rooted in NSA procedures that were partially revealed through the Edward Snowden disclosures in 2013 and subsequently confirmed through declassified documents and oversight reports. According to Wired, the NSA’s minimization procedures — the rules that are supposed to protect Americans’ privacy in the course of foreign intelligence collection — contain a significant exception for encrypted communications. If a communication is encrypted, the agency may retain it for a longer period, on the theory that it needs more time to determine whether it has intelligence value and whether the parties involved are foreign targets.
So the tool designed to protect your privacy may paradoxically be the thing that strips it away.
This tension has not gone unnoticed by privacy advocates and legal scholars. The Electronic Frontier Foundation has long argued that the NSA’s treatment of encrypted traffic creates a perverse incentive structure: the more people try to protect their communications, the more likely those communications are to be swept up and stored. It’s a Catch-22 that undermines the very premise of commercial VPN services.
And the problem extends beyond VPNs. The same logic applies to other privacy tools. Tor, the anonymity network originally developed by the U.S. Naval Research Laboratory, has been a particular target. Documents from the Snowden archive revealed an NSA program called XKeyscore that flagged users who searched for or downloaded Tor software. Simply visiting the Tor Project’s website could mark a user for additional scrutiny. Using encrypted email services like PGP carried similar risks.
The commercial VPN industry, now estimated to be worth more than $50 billion globally, has largely sidestepped this conversation. Marketing materials emphasize protection from hackers, ISP tracking, and geo-restricted content. Few mention the possibility that their product could attract government attention. Some VPN providers have begun publishing transparency reports and undergoing independent audits, but these measures address a different set of concerns — namely, whether the VPN company itself is logging user data. They don’t address what happens to that traffic once it leaves the VPN server and traverses infrastructure that the NSA can access.
The legal architecture enabling this surveillance has evolved but remains largely intact. Section 702 of FISA, which authorizes the collection of foreign intelligence from non-U.S. persons located outside the country, was reauthorized by Congress in April 2024 after a contentious debate. Civil liberties organizations pushed hard for reforms, including a requirement that the government obtain a warrant before querying the Section 702 database for information about Americans. That effort failed. The reauthorization, signed into law as part of the Reforming Intelligence and Securing America Act, actually expanded the definition of electronic communications service providers who can be compelled to assist with surveillance, a provision that alarmed privacy groups and some members of Congress from both parties.
Senator Ron Wyden, the Oregon Democrat who has been one of the most persistent critics of warrantless surveillance, warned at the time that the expanded definition could sweep in a vast range of businesses and individuals. His concerns were echoed by organizations including the American Civil Liberties Union, which called the reauthorization a missed opportunity to impose meaningful limits on the government’s ability to spy on Americans’ communications.
But the VPN-specific issue sits in an even murkier legal space. Executive Order 12333, signed by President Ronald Reagan in 1981 and amended several times since, governs the bulk of NSA surveillance activities — far more than FISA does. Unlike FISA, E.O. 12333 operates almost entirely outside of judicial oversight. The Foreign Intelligence Surveillance Court reviews and approves procedures under Section 702, but it has no comparable role in overseeing 12333 collection. That means the rules about how encrypted traffic is handled, how long it can be retained, and under what circumstances it can be analyzed are largely set by the executive branch itself, with limited congressional visibility and virtually no public accountability.
Privacy researchers have tried to quantify the scope of the problem, but the classified nature of the programs makes precise measurement impossible. What’s known is that the NSA has access to enormous volumes of internet traffic through programs like UPSTREAM, which taps into the fiber-optic cables that carry the bulk of the world’s internet communications. Data flowing through these cables includes traffic from VPN users whose connections route through U.S. infrastructure — which, given the centrality of American networks to global internet architecture, is a substantial share.
The irony is thick. The U.S. government actively promotes the use of VPNs and encryption tools abroad, funding projects that help dissidents in authoritarian countries circumvent censorship. The State Department and agencies like the Broadcasting Board of Governors have spent millions supporting technologies like Tor and Signal for use by journalists and activists in countries like Iran, China, and Russia. Yet domestically, the intelligence community treats the same technologies as indicators of suspicious activity worthy of additional scrutiny.
Some security experts argue that the focus on VPNs misses the bigger picture. Bruce Schneier, the cryptographer and security technologist, has written extensively about the concept of “security theater” — measures that provide the appearance of security without the substance. In his view, commercial VPNs offer meaningful protection against certain threats, particularly unsophisticated attackers and commercial data collection, but they were never designed to withstand a nation-state adversary with the resources of the NSA. Expecting them to do so, he has argued, reflects a fundamental misunderstanding of the threat model.
That’s a fair point. But it doesn’t absolve the intelligence community of the policy contradiction. If the government wants citizens to use strong encryption — and official guidance from agencies like the Cybersecurity and Infrastructure Security Agency explicitly recommends it — then penalizing them for doing so by subjecting their communications to enhanced collection and retention is, at minimum, incoherent.
Recent developments have only intensified these concerns. In December 2024, following the disclosure of the Salt Typhoon cyberattacks attributed to Chinese state-sponsored hackers, senior U.S. officials including those at CISA publicly urged Americans to use encrypted messaging apps and VPNs to protect their communications. The Salt Typhoon intrusions targeted major U.S. telecommunications providers, potentially compromising the communications of millions of Americans. The government’s response was to recommend the very tools that its own intelligence apparatus treats as surveillance triggers.
Nobody in an official capacity has acknowledged this contradiction publicly.
The technical realities make the situation even more complex. Modern VPN protocols like WireGuard and OpenVPN use strong encryption that the NSA likely cannot break in real time for most traffic. But encryption isn’t the only attack surface. Metadata — who connected to what server, when, for how long, and how much data was transferred — is often available even when content is encrypted. The NSA has been candid, at least in classified settings revealed by Snowden, about the intelligence value of metadata. As former NSA Director Michael Hayden once said: “We kill people based on metadata.”
VPN providers can also be compromised. In 2019, researchers discovered that several popular VPN apps available on mobile app stores were operated by companies with ties to Chinese firms, raising questions about whether user data was being funneled to foreign intelligence services. And in 2020, a major breach of Pulse Secure VPN appliances, widely used by corporations and government agencies, was attributed to Chinese hackers. The VPN itself became the attack vector.
For the average consumer, this creates an almost impossible calculus. Using a VPN provides real benefits: it prevents your ISP from logging your browsing history, protects your data on untrusted networks, and can circumvent geographic content restrictions. But it may also flag your traffic for collection by the world’s most capable signals intelligence agency. Not using a VPN leaves your data exposed to a different set of threats. There is no option that provides complete protection against all adversaries simultaneously.
The policy debate, such as it is, has largely stalled. Congressional attention to surveillance issues tends to spike around FISA reauthorization deadlines and then fade. The intelligence committees in both chambers receive classified briefings on NSA activities, but members are limited in what they can disclose publicly, and the political dynamics of appearing “soft” on national security discourage aggressive oversight. The Privacy and Civil Liberties Oversight Board, an independent executive branch agency created to review counterterrorism programs, has produced detailed reports on Section 702 and other authorities, but its recommendations have been only partially implemented.
Meanwhile, the VPN industry continues to grow. Demand surges during periods of heightened privacy awareness — after major data breaches, during political controversies over government surveillance, and in response to ISP data-selling practices enabled by the rollback of FCC broadband privacy rules in 2017. Consumers are spending more money than ever on tools that promise digital privacy. Whether those tools deliver on that promise depends entirely on which adversary you’re worried about.
And that’s the uncomfortable truth at the center of this issue. Privacy isn’t binary. It’s contextual. A VPN that effectively shields you from a coffee shop hacker or an ISP selling your browsing data to advertisers may simultaneously make you more visible to an intelligence agency operating under legal authorities that treat encryption as a reason to look closer rather than look away. The technology works. The policy doesn’t.
Until the legal framework governing signals intelligence is reformed to explicitly prohibit the retention and querying of Americans’ encrypted communications without a warrant, the paradox will persist. Your VPN protects you from many things. The NSA may not be one of them.
WebProNews is an iEntry Publication