Confused about which VPN is right, US senator asks the NSA for guidance

Details

Democratic Senator Ron Wyden has written to NSA Director General Joshua M. Rudd requesting updated, specific public guidance on VPN selection for Americans at elevated risk of foreign surveillance, including government personnel, journalists, defense contractors, and human rights defenders. While US agencies have previously recommended using VPNs, none have specified which architectures or services adequately protect against nation-state adversaries.\n\nThe letter asks technically detailed questions: whether single-hop commercial VPNs suffice (traffic is decrypted at one server, exposing metadata to rogue employees or attackers), whether multi-hop designs provide meaningful additional protection (sender IP and destination are split across separate servers), and whether features like random delays and cryptographic padding are necessary to defeat timing-analysis attacks.\n\nWyden specifically requested NSA evaluation of Apple Private Relay, Nym, and Tor — each with distinct privacy architectures and trust models. He also raised the limitation that VPNs do not encrypt all metadata, such as timestamps, enabling nation-states to build behavioral profiles even through encrypted tunnels.\n\nFor AI practitioners, this story is tangentially relevant via data security and infrastructure selection. AI systems increasingly process sensitive enterprise and personal data, and practitioners selecting secure access tools need to understand VPN limitations. No NSA response or timeline for guidance was announced.