IC Technology & Cyber — 2026-09-04

Senator Wyden Presses NSA to Update Commercial VPN Security Guidance Citing Foreign Surveillance Risks

BLUFNSA revision of public VPN guidance by Wyden's October 14 deadline is unlikely, leaving at-risk users without official advisories addressing the traffic-analysis vulnerability CRS identified.

Sen. Ron Wyden, D-Ore., wrote to NSA Director Gen. Joshua Rudd on Wednesday urging updated public guidance on commercial VPN security, arguing standard single-hop VPNs do not adequately protect users from sophisticated foreign surveillance 1234. A Congressional Research Service analysis Wyden requested found that foreign intelligence services could identify VPN users through traffic analysis, matching the timing and volume of encrypted data without breaking the encryption 2. Wyden pointed to multi-hop and mixnet alternatives such as Tor, Nym and Apple's iCloud Private Relay as offering greater protection, and asked Rudd for unclassified answers by October 14 12. The request follows a July letter in which the Office of the Director of National Intelligence described VPNs as useful for basic cybersecurity and urged consumers to review providers' privacy practices 2.

Analysis
NSA's revision of its VPN guidance by Wyden's October 14 deadline is unlikely, given the agency's history of slow, interagency-vetted updates and no indication that Director Rudd's office treats single-hop VPN traffic-analysis risk as urgent; the letter builds public pressure rather than compelling action, after March and July exchanges produced no guidance change. Confidence in this judgment is high, resting on NSA's consistent posture across two prior rounds of inquiry and its stated focus on remote-access exploitation over consumer VPN architecture. Reporting itself traces to a single CyberScoop disclosure of the letter, with other outlets converging on those details rather than independently corroborating them. The push may function more as political positioning ahead of broader privacy-surveillance debates than a genuine bet on NSA rewriting its technical guidance, and absent that rewrite, agencies and at-risk personnel get no official steer toward multi-hop tools, leaving current advisories silent on the traffic-analysis exposure CRS identified.

4 sources

Wyden seeks upgraded NSA security guidance on commercial VPN use - CyberScoop
Senator asks NSA to update Americans about VPN spying risks - Nextgov/FCW
US Senator demands NSA update VPN guidance over foreign spying risks - TechRadar
Senator Wyden urges NSA to update VPN guidance amid foreign surveillance concerns - SC Media