Wyden Asks the NSA to Say a Single-Hop VPN Is Not Enough
A sitting US senator has asked the National Security Agency to say out loud what privacy researchers have been saying for years: an ordinary commercial VPN does not protect you from a state adversary. On 2 September 2026 Ron Wyden wrote to NSA director Gen. Joshua Rudd, arguing that federal advice still treats a single-hop VPN as adequate protection, and asked for unclassified answers by 14 October. The request is narrow and technical, and it goes straight at the weakest assumption in how VPN services are usually sold.
What the letter says
Wyden's argument rests on a Congressional Research Service analysis, which he quotes directly: a single-hop VPN, however strongly encrypted, offers essentially no protection against an adversary who can compel or infiltrate that one provider. The encryption is not the weak point. The single point of concentration is. Everything you do passes through one company, in one jurisdiction, running one set of servers, and an adversary who reaches that company sees the other end of every connection.
Against that, the letter names architectures built to remove the single point: multi-hop routing and mixnets. Wyden asks the NSA to assess how well they work in practice, naming Tor, Nym and Apple Private Relay, and to say how multi-hop proxy systems compare with mixnet designs.
The attack does not require breaking encryption
The mechanism the CRS describes is traffic correlation, and it is worth understanding because it explains why "military-grade encryption" is not an answer to it. An observer who can watch both sides of a VPN server does not need to decrypt anything. They match the timing and the volume of encrypted data going in against the timing and volume coming out, and the pattern links a user to a destination. Encryption hides content. It does not hide the shape of traffic.
That kind of observation is not available to your neighbour or to a cafe network. It is available to an organisation that can watch large parts of the internet at once, or that can put itself inside a provider. Which is exactly the threat model Wyden is writing about.
What current official guidance actually covers
The gap the letter points at is not that the government said something wrong. It is that the existing advice answers a different question. Published NSA and CISA material on VPNs is largely about keeping remote-access VPN appliances from being hacked: patching them, hardening them, retiring outdated products. That is guidance for a network administrator protecting a corporate gateway.
It is not guidance for a person choosing a consumer VPN to keep a foreign intelligence service out of their communications. Wyden's phrasing is that Americans facing advanced foreign threats, including government personnel, defence contractors, journalists and human rights defenders, deserve clear, honest advice about how best to protect their communications from surveillance by foreign adversaries. Right now those people are reading advice written for a different problem.
Where this leaves an ordinary user
It would be easy to read this as "VPNs are useless", and that is not what the letter says. A single-hop VPN still does the jobs it has always done: it takes your traffic away from the local network and the internet provider, it stops websites from reading your home address off your IP, it gets around blocks based on where you appear to be. Against an advertiser, a network operator or a censor, that is real.
What changes with the threat model is the provider itself. When the adversary can compel or compromise the company, the thing that mattered, one operator seeing both ends, becomes the thing that fails. That is why multi-hop routing exists, and why Tor and mixnets are built the way they are: no single operator is supposed to see both who you are and what you asked for. The cost is speed, and for most people most of the time that trade is not worth making.
Why the question is being asked now
Wyden has spent years pulling at the same thread: what the government knows about surveillance of Americans, and what it tells them. We have covered his earlier warnings, including the point that using a VPN can weaken the legal protections a US user has under foreign intelligence law. This letter is the technical half of the same argument: if the official position is that a commercial VPN is enough, then either that position needs evidence, or it needs updating.
