The push for answers regarding warrantless government surveillance of virtual private networks (VPNs) is gaining crucial momentum. Press freedom advocates are now publicly demanding transparency from US lawmakers over how intelligence agencies monitor the traffic of citizens trying to protect their digital privacy.
The Freedom of the Press Foundation (FPF) has stepped into the fray, warning that millions of Americans, as well as journalists relying on VPNs to protect sources and bypass censorship, could be inadvertently swept up in foreign spying operations. The urgent call to action follows recent revelations that the US intelligence community may be targeting citizens who use commercial privacy tools.
VPN users may lose constitutional protections
In March, six Democratic lawmakers wrote to Director of National Intelligence Tulsi Gabbard, questioning whether the use of a VPN strips Americans of their constitutional privacy protections. According to reports, this inquiry has now sparked broader concerns about government overreach.
Under Section 702 of the Foreign Intelligence Surveillance Act (FISA) and Executive Order 12333, intelligence agencies have sweeping authority to monitor foreign communications without a warrant. However, because a VPN routes traffic to a remote location before connecting to the web, a user’s true location is hidden.
As the lawmakers’ letter highlighted, the government takes the position that data of unknown origin should be treated as foreign and is therefore “subject to few privacy protections.”
Journalists and privacy advocates sound alarm
For the FPF, this default assumption that unknown traffic belongs to a non-US person is a massive red flag. By treating all VPN users as “foreign,” the government could be exposing Americans to unchecked monitoring.
“Journalists use virtual private networks every day to bypass censorship, to protect their location information, and to defend their traffic against network eavesdropping,” noted FPF’s Deputy Director of Digital Security, Dr. Martin Shelton, and FPF’s Senior Adviser and Advocacy, Caitlin Vogus, in a blog post.
“And not just journalists, VPNs are privacy tools used by millions of Americans,” they added.
Because VPN providers typically mix the data of hundreds or thousands of users on a single server, intelligence officials could potentially:
- Monitor web traffic to trace connections
- Send legal requests to web service providers
- Learn more about users connecting from a given IP address
Future quantum threats add urgency
The FPF also highlighted a growing threat to digital privacy. While premium VPNs provide encryption that secures web traffic from internet service providers, intelligence agencies are reportedly still collecting large amounts of encrypted data.
The foundation warned that this data could be stockpiled for “harvest now, decrypt later” attacks. In this scenario, attackers copy encrypted traffic today with the hope of reading it tomorrow using more powerful quantum computers.
According to the FPF, Google security researchers have warned that the industry should prepare for this potential risk “as soon as 2029.”
Advocates push for surveillance reform
To prevent intelligence agencies from exploiting foreign surveillance powers, the FPF is urging Congress to implement strict safeguards before deciding whether to reauthorize Section 702 of FISA.
Their key demands include:
- Closing the “backdoor search loophole” to force warrants for searching Americans’ communications
- Ending the “data broker loophole” that lets agencies buy sensitive citizen data
- Passing the proposed Government Surveillance Reform Act
Advocates argue that these changes are essential for protecting digital privacy rights. Until then, the FPF says the public deserves clarity: “It’s therefore crucial that the American public has answers about how our intelligence community monitors our VPN traffic.”
The debate highlights a broader tension between national security interests and digital privacy rights as VPN usage continues to grow among ordinary Americans seeking to protect their online activities.