Using a VPN can subject you to NSA spying

Six Democratic legislators pressure the nation’s top intelligence official to publicly disclose whether Americans using commercial VPN services risk being treated as foreigners under US surveillance laws – a classification that would strip them of constitutional protections against warrantless government spying.

In a letter sent to the director of national intelligence on Thursday Tulsi Gabbardthe lawmakers say that because VPNs hide a user’s true location, and because intelligence agencies suspect that communications of unknown origin are foreign, Americans can inadvertently waive the privacy protections they are entitled to under the law.

Several federal agencies, including the FBI, the National Security Agency, and the Federal Trade Commission, have recommended which consumers use VPNs to protect their privacy. But following that advice may inadvertently cost Americans just the protections they seek.

The letter was signed by members of the Democratic Party’s progressive wing: Senators Ron Wyden, Elizabeth Warren, Edward Markey and Alex Padilla, along with Representatives Pramila Jayapal and Sara Jacobs.

The concern centers on how intelligence agencies handle Internet traffic routed through commercial VPN servers, which can be located anywhere in the world. Millions of Americans use these services regularly, whether to access region-restricted content such as overseas sports broadcasts or to protect their privacy on public Wi-Fi networks. Because VPN servers aggregate traffic from users in many countries, a single server — even one located in the United States — can carry communications from foreigners, potentially making it a target for surveillance by authorities that allow the government to secretly enforce service from US service providers.

Under a controversial warrantless surveillance program, the US government intercepts large amounts of electronic communications belonging to people overseas. The program also sweeps enormous volumes of private messages belonging to Americans, which the FBI can search without a warrant, even though it is authorized to target only foreigners abroad.

The program, authorized under Section 702 of the Foreign Intelligence Surveillance Act, is will expire next month and became the subject of a fierce battle in Congress on whether to renew it without significant reforms to protect Americans’ privacy.

Thursday’s letter points to declassified intelligence community guidelines that establish a default presumption at the heart of lawmakers’ concerns: Under the NSA’s targeting proceduresa person whose whereabouts are unknown is presumed to be a non-US person unless there is specific information to the contrary. Department of Defense procedures control signals intelligence activities contain the same presumption.

Commercial VPN services work by routing a user’s Internet traffic through servers operated by the VPN company, which may be located anywhere in the world. A single server can carry traffic from thousands of users at the same time, all appearing to originate from the same IP address. To an intelligence agency that collects communications in bulk, an American connected to a VPN server in, say, Amsterdam looks no different than a Dutch citizen.

The letter does not allege that Americans’ VPN traffic has been collected under these authorities — that information will be classified — but asks Gabbard to publicly explain what impact, if any, VPN use has on Americans’ privacy rights.

Among those pressing the question is Wyden, who as a member of the Senate Intelligence Committee has access to classified details about how these surveillance programs operate and a well documented history to use carefully worded public statements to draw attention to surveillance practices he cannot openly discuss.

The letter also raises concerns about a second, broader surveillance authority: Executive Order 12333A Reagan-era directive that governs many of the intelligence community’s foreign surveillance operations and allows the bulk collection of foreigners’ communications with even fewer restrictions than Section 702.