Senator Wyden Urges NSA to Update VPN Guidance Over Foreign Spying Risks

US Senator Ron Wyden is pressing the National Security Agency (NSA) to update its federal cybersecurity guidance, warning that standard consumer VPNs may not provide enough protection against sophisticated foreign spying operations.

Wyden cited a newly released Congressional Research Service (CRS) memo describing “traffic analysis.” By comparing the timing and volume of encrypted data entering and leaving a single VPN server, foreign intelligence services may infer a user’s web activity without breaking the encryption.

Most consumer VPNs use a single-hop architecture, sending traffic through one provider’s server before it reaches its destination. An adversary monitoring the internet backbone or compromising that server may be able to connect incoming and outgoing traffic.

The CRS memo states that “encryption strength alone does not protect users from an advanced, persistent threat conducting bulk data traffic collection.” It points to multi-hop tools including the Tor Browser, NymVPN, and Apple iCloud Private Relay as alternatives that distribute a user’s footprint across multiple servers, often in different jurisdictions.

Wyden asked NSA Director Gen. Joshua M. Rudd to clarify whether the agency recommends multi-server systems over standard commercial VPNs. His letter specifically mentioned government personnel, defense contractors, journalists, and human rights defenders facing advanced foreign threats.