Millions of Americans have followed official advice from the Department of Defense, the FBI, the Federal Trade Commission, and the National Security Agency (NSA) to protect their online privacy by using a Virtual Private Network (VPN). This advice, often summarized as "Use a VPN," has led consumers to spend billions of dollars annually on these services. However, a recent memo from Congress's research staff, highlighted in a letter from Senator Ron Wyden to the NSA director on September 2nd, reveals that even encrypted VPN traffic can inadvertently disclose a user's browsing history.

The core issue lies not in breaking encryption, but in analyzing traffic patterns. This method, known as traffic analysis, can reveal the origin, destination, timing, and volume of data packets. By correlating these elements, a user's browsing history, including the specific websites visited and the times of access, can be reconstructed and linked to their identity. This technique was reportedly solved by a lab for American intelligence officers as early as 1995.

How VPNs Function and Their Limitations

When a VPN is activated, all internet traffic is first routed through a company's server before reaching its intended destination. This process masks the user's actual IP address, replacing it with the VPN server's address. This is particularly effective on public Wi-Fi networks, preventing individuals on the same network from intercepting sensitive data like passwords.

However, the VPN company itself then holds the record of the user's internet activity. While some VPN providers, like the Swedish company Mulvad, reportedly store no customer data—as evidenced by a 2024 search by Swedish police that yielded no customer information—the fundamental vulnerability of traffic analysis remains.

The process can be visualized as two data streams: one from the user's device to the VPN server, and another from the VPN server to the target website. Both streams carry encrypted traffic, meaning the content is unreadable to anyone intercepting them. However, the timing and size of data bursts transmitted across both streams can be recorded. A data burst leaving the user's device and a subsequent burst of the same size leaving the VPN server heading to a website can be matched, thereby linking the user's device to that specific website. This matching process, performed over an extended period, can reconstruct a user's browsing history without ever decrypting the traffic.

The memo suggests that a VPN relying on a single server offers minimal protection against entities capable of subpoenaing the VPN company or breaching its systems. Even with sealed messages, the record of which sites were accessed and when remains visible to anyone monitoring both data streams. This information can be critical for various individuals, from reporters identifying sources to defense contractors tracking project access, or even for individuals reviewing their own late-night searches.

The "Harvest Now, Decrypt Later" Threat

A significant concern highlighted by the memo is the "harvest now, decrypt later" strategy employed by adversaries. This involves recording encrypted traffic with the expectation that future advancements in computing power will eventually allow for decryption. Consequently, data captured today could compromise privacy for years to come.

The potential for adversaries to record traffic is amplified by the presence of foreign intelligence services within telecommunications networks. In September 2025, the NSA and allied agencies issued a warning about Chinese state operators infiltrating backbone routers of major carriers, the infrastructure responsible for inter-network traffic. This indicates that the means to intercept traffic at a large scale already exist.

VPNs and Warrantless Surveillance

Adding another layer of concern, six members of Congress, including Senator Wyden, wrote to the Director of National Intelligence in March regarding the implications of VPN use for protection against warrantless surveillance by the U.S. government. The NSA's declassified targeting rules presume individuals whose location is unknown to be non-U.S. persons, whose traffic can be collected in bulk without a warrant. Since a primary function of a VPN is to obscure a user's location, the members questioned whether following government advice to use a VPN could inadvertently strip Americans of their protection against warrantless surveillance by their own government.

The response received in July stated that VPNs are useful for "basic hygiene" but cautioned that VPN companies can log browsing activity. Senator Wyden's recent letter argues that this response addressed the company's logging practices but overlooked the vulnerability of the data streams themselves.

Onion Routing and Tor

The solution to traffic analysis was developed in 1995 by three researchers at the Naval Research Laboratory. Their goal was to enable U.S. intelligence officers to use the internet from hostile environments without their traffic identifying them. While encryption secured the content, the traffic patterns remained a giveaway. Their solution, termed "onion routing," involved routing traffic through multiple relays, with each relay only knowing the preceding and succeeding hop. This layered approach ensured that no single point in the path simultaneously held both the user's identity and their destination.

To prevent the network from being exclusively used by spies, the technology was made public, leading to the creation of Tor (The Onion Router). The intention was for intelligence traffic to be indistinguishable within the broader public internet traffic. Despite the development of this solution 31 years ago by the Navy's own lab, the NSA continues to recommend VPNs that rely on a single server.

The Silent Failure of VPNs

Unlike other safety products that provide observable indicators of function or failure (e.g., squealing brakes, functioning locks, or smoke alarms), VPNs can fail silently. The vulnerabilities lie in the unseen data streams. The entities best positioned to verify the effectiveness of these VPNs are the same agencies now being asked to provide written assurances.

A VPN subscription offers certain benefits: websites log a rented IP address instead of the user's, and on public Wi-Fi, the encryption of content provides a layer of security. The user's internet provider also loses the record of visited sites.

However, the subscription does not guarantee complete privacy. The list of visited sites is transferred to the VPN company, making it vulnerable to subpoenas or breaches. The timing and volume of traffic remain visible to anyone monitoring the data streams, allowing for the reconstruction of browsing history. Furthermore, the "harvest now, decrypt later" threat means that current data could be compromised in the future.

The question of whether using a VPN to mask location qualifies an individual as "foreign" under NSA rules, potentially subjecting them to warrantless surveillance, remains unanswered.

Alternative Solutions

For users concerned about traffic pattern concealment, alternative solutions exist. Tor offers a free, multi-hop routing system. Apple's Private Relay, included with iCloud, provides privacy for Safari browsing. Some paid services route traffic through two of their own servers instead of one.

Senator Wyden has given the NSA until October 14th to publicly answer three questions regarding VPN effectiveness. The outcome of this inquiry could lead to a revision of advice from four government agencies or, if the answers remain classified, leave the public without definitive information on the security of their VPN usage.