NSA Surveillance Can Penetrate VPNs (2024)

The National Security Agency has a system that allows it to collect pretty much everything a user does on the Internet, according to a report published by The Guardian on Wednesday, apparently even when those activities are done under the presumed protection of a virtual private network (VPN).

The Guardian's information comes from whistleblower Edward Snowden, the former NSA contractor now seeking asylum in Russia from U.S. authorities for revealing classified documents about the NSA's intelligence-gathering capabilities to the media. The news organization's report suggests that Snowden's claim that he could wiretap anyone from his desk, dismissed by U.S. lawmakers as false, was essentially accurate.

Described in a 2008 presentation, the system, called XKeyscore, can reportedly track email addresses, logins, phone numbers, IP addresses and online activities — files, email contents, Facebook chats, for example — and can cross-reference this information with other metadata.

Even after weeks of revelations about the scope and breadth of NSA data gathering, news that XKeyscore can penetrate VPNs comes as a something of a shock.

"This is huge: XKeyscore slides also suggest NSA regularly decrypts encrypted VPN traffic," said security researcher Ashkan Soltani via Twitter.

[ Want to be a Web photographer? Read Google's Photo Sphere Community Wants You. ]

Responding to Soltani, CDT senior staff technologist Joseph Lorenzo Hall expressed skepticism that the NSA can break all VPN encryption. But Soltani contends the NSA at least has the capability to crack weak cipher implementations on Windows machines common in the Middle East, such as PPTP and MS-Chap. He points to a 2012 post from security researcher Moxie Marlinspike that states, "PPTP traffic should be considered unencrypted."

Whether or not the NSA is able to crack more robust implementations remains to be seen. Given the resources available to the NSA, the issue may be how much the NSA wants to break a given code rather than its ability to do so. After all, in cases where codes cannot be broken, people can be. As Danish developer Poul-Henning Kamp argues in ACM Queue, politics trumps cryptography.

The White House, trying to contain discontent with its surveillance programs, chose Wednesday to release formerly classified documents about the NSA's domestic phone surveillance program as a Senate Judiciary Committee meeting convened to address the oversight of Foreign Intelligence Surveillance Act programs.

The documents, published by the Office of the Director of National Intelligence, detail the collection of telephone metadata under Section 215 of the Patriot Act.

Senate Judiciary Committee chair Sen. Patrick J. Leahy (D-Vt.) said in a statement that if the government's collection of phone records is not effective, the program should be discontinued. He suggested that NSA chief Gen. Keith Alexander's prior claim that Section 215 surveillance programs have led to the disruption of 54 terrorist plots is not supported by the classified documentation he was provided.

A 2008 presentation states, "Over 300 terrorists [have been] captured using intelligence generated from XKeyscore."

Gen. Alexander contended with skeptical hecklers Wednesday at the Black Hat USA 2013 security conference in Las Vegas, where he defended NSA surveillance as necessary for national security.

In prepared remarks presented during the Judiciary Committee meeting, Stewart A. Baker, a partner in the Washington office of Steptoe & Johnson, LLP, and former assistant secretary for policy at the Department of Homeland Security, dismissed worries about civil liberties concerns.

"[I]t appears that law enforcement has been gaining access to our call metadata for as long as billing records have existed — nearly a century," he said. "If this were the road to Orwell's 1984, surely we'd be there by now, and without any help from NSA's 300 searches."

Baker advocates protecting privacy by, paradoxically, embracing big data and subjecting government employees to more effective surveillance.

"We need systems that audit for data misuse, that flag questionable searches, and that require employees to explain why they are seeking unusual data access," he said. "That's far more likely to provide effective protection against misuse of private data than trying to keep cheap data out of government hands. ... A proper system for auditing access to restricted data would not just improve privacy enforcement, it likely would have flagged both Bradley Manning and Edward Snowden for their unusual network browsing habits."

Jameel Jaffer, deputy legal director of the American Civil Liberties Union Foundation, offered testimony in the opposite direction. He called for Congress to amend the Foreign Intelligence Surveillance Act "to prohibit suspicionless, 'dragnet' monitoring or tracking of Americans' communications," to require more disclosure about Foreign Intelligence Surveillance Court opinions, and to ensure that government surveillance activities are subject to reasonable judicial scrutiny.

NSA Surveillance Can Penetrate VPNs (2024)

FAQs

Can the NSA see through VPN? ›

Can NSA see through VPN? No. Your data is encrypted, so your ISP can't see its contents. This includes DNS requests, which are sent through the VPN tunnel and resolved by the VPN provider.

Does a VPN stop NSA tracking? ›

You're not paranoid for assuming the NSA is spying on your Internet connection–you're just paying attention. If you'd like to stop intelligence agencies from snooping in on you, the first step is to use a powerful VPN. By encrypting your connection, you block out all third-party surveillance with a single mouse click.

Can government track you through VPN? ›

Can police track online purchases made with a VPN? There is no way to track live, encrypted VPN traffic. That's why police or government agencies who need information about websites you visited have to contact your internet service provider (ISP for short), and only then your VPN provider.

How do I stop the NSA from spying on me? ›

There's no way to block NSA surveillance completely. Even if you ditched your mobile phone and avoided using heavily-tracked web services like Facebook and Google, you'd still be on surveillance cameras that capture your face, license plate scanners, and credit databases, among other things.

Can the NSA tap your phone? ›

The NSA can still access your phone records

The USA FREEDOM Act, passed in 2015, puts the onus on telecommunication providers to hold on to phone records, after which they can be requested by the NSA rather than the spy agency keeping tabs on them directly.

Can NSA see encrypted messages? ›

NSA can see through encryption, including your private e-mail's, says report. More documents from former security contractor Edward Snowden show that the National Security Agency has been secretly working to gain a back door into all encryption technologies, The New York Times reports.

Can feds bypass VPN? ›

Can the FBI see through a VPN? If the VPN company is located in the US, and the server is located in the US, the FBI can get a warrant for their logs. But if either is located outside the US they can't. (The overseas server used by an American VPN company usually isn't “connected” to the company in any way.)

Can you still be tracked if you use a VPN? ›

VPNs are useful for many things, and when used properly, can protect you from being tracked in several ways: Websites can't track you using your real IP address. Your internet service provider (ISP) can't track what you do on the internet. Your government can't track what you do on the internet via your ISP.

What does a VPN not hide? ›

A VPN does not hide your browsing activity from the websites and apps you visit. Using a VPN hides your browsing activity from your ISP and WiFi administrator, but it doesn't hide that activity from the website or app you're using – they can still see exactly what you do on their service.

Can I be caught using VPN? ›

Many VPN users will turn to a VPN to help remain anonymous so that they can effectively engage in illegal or legally gray area streaming activities. A VPN service will hide copyright infringement activities, but it won't protect users who are caught even after using a VPN service.

Can the NSA spy on US citizens? ›

According to The Register, the FISA Amendments Act of 2008 "specifically authorizes intelligence agencies to monitor the phone, email, and other communications of U.S. citizens for up to a week without obtaining a warrant" when one of the parties is outside the U.S.

Can the NSA watch you? ›

Through backdoors

Allegedly, the NSA can access your devices through built-in backdoors. So, they could easily hear you through your mic, just as they could see you through your built-in, internet-connected cameras. They can also track where you are or where you go if you have your location services enabled.

How long does NSA keep data? ›

How long can the NSA keep information on Americans? The NSA can generally keep intercepted domestic communications for up to five years.

Can NSA listen when phone is off? ›

So the NSA can listen to your conversations and use your camera when you powered off your phone? Sounds crazy but it is possible — in a way. The most likely way is with a type of invisible spying app. Spying apps aren't anything new; everyone from corporations to hackers to jealous exes use them.

Can the NSA see me through my Iphone? ›

According to security researcher Jacob Appelbaum, a new batch of leaked documents showcases how the NSA is able to easily break into iPhones, allowing the agency to gather SMS messages, contact lists, location data, photos, videos, and more. The NSA can even reportedly activate your camera and microphone remotely.

Can NSA listen to FaceTime? ›

"If you talk about FaceTime and iMessaging, those are both encrypted by Apple, and therefore the government cannot intercept them," Clarke said. "And Apple says it's designed the systems in such a way that even Apple can't decrypt them.

Can NSA access Whatsapp? ›

Whatsapp's parent company, Facebook, has been shown to give the NSA direct, unilatateral access to their servers through something called the PRISM Program. While Facebook denies this, it has been proven by leaked documents. This does not, however, mean that the NSA can decrypt Whatsapp messages.

Does the NSA collect all text messages? ›

Under the Freedom Act, bulk data about U.S. phone calls and text messages remains in the hands of telecom companies. The NSA is only permitted to collect very specific data, such as call records of surveillance targets and their contacts or of those suspected of terrorism, according to the New York Times.

Can the NSA see Tor? ›

The NSA creates "fingerprints" that detect http requests from the Tor network to particular servers. These fingerprints are loaded into NSA database systems like XKeyscore, a bespoke collection and analysis tool which NSA boasts allows its analysts to see "almost everything" a target does on the internet.

Can police intercept VPN? ›

With a VPN on, the user's online activities and data are encrypted. But, if the VPN software has security flaws and vulnerabilities, the police (or any other third party, for that matter) can use them to “break into” the VPN and see what data is being sent and received. So technically, the policy could track a VPN.

Can anything bypass a VPN? ›

You can often bypass a VPN block by switching servers or going to a different VPN provider. The organization blocking your access may have focused on only the more popular VPNs when choosing what to block, so you may be able to gain access using a less popular service.

Can an email be traced if I use a VPN? ›

Instead of sending your emails using your own IP address, the VPN will assign you a different IP address thus meaning that the sender of the email cannot truly be identified. VPN providers also have brilliant security features and encryption to ensure that your email data remains untouched and private.

How do you know if your IP address is being monitored? ›

There's just no way of knowing who is running your IP address through any type of IP lookup service. It could be your bank, your real estate agent, or a tech-savvy teenager who's also a hacker. It is possible to be traced by someone—a stalker, an investigator or even a criminal—via your IP address.

Can your internet provider see what you do with a VPN? ›

Your ISP can't see your browsing history when you use a VPN. Everything you do stays private when you connect to a VPN server. Premium VPNs, like PIA, reroute your traffic through their own DNS servers, which conceals your DNS requests from your ISP.

Does a VPN stop your phone from being tracked? ›

By connecting you to the internet through a secure and encrypted tunnel, a VPN keeps all your web activity private, and it stops anyone from tracking your phone or how you use it.

Does a VPN stop Google tracking? ›

Do VPNs Hide My Browsing History From Google? Yes, VPNs hide your browsing history from Google, but only partially. Google doesn't see your real IP address when you're connected to a VPN, so personalized search results tied to your IP address will not appear. However, that's not the only way Google identifies users.

Who can see my internet activity? ›

If you're not careful, almost anyone can see your internet activity. Wi-Fi admins can see your activity through router logs, while websites, apps, ISPs, search engines, and advertisers all have means of tracking what you do online. Your devices and browsers keep records of what you do on them too.

How do hackers get caught if they use a VPN? ›

If a VPN has IP leaks, DNS leaks, or WebRTC leaks, this could result in your online habits being tracked by your ISP. It will also allow online services and websites to detect your actual IP address. As a result, a leaky VPN is the easiest way to get caught out.

Why do criminals use VPNs? ›

Europol said the service was "a popular choice for cybercriminals, who could use its services to carry on committing their crimes without fear of detection by authorities." A VPN, or virtual private network, allows internet users to browse the web while keeping their identities and locations hidden.

Does NSA have access to everything? ›

The NSA is allowed to intercept, collect, and analyze electronic communications. The NSA also can monitor any computer in the world with access to certain international cables or wireless networks.

What is the NSA allowed to do? ›

Pursuant to EO 12333, NSA is authorized to collect, process, analyze, produce, and disseminate signals intelligence information and data for foreign intelligence and counterintelligence purposes to support national and departmental missions, and to provide signals intelligence support for the conduct of military ...

Does the NSA watch your webcam? ›

Government security agencies like the NSA can also have access to your devices through built-in back doors. This means that these security agencies can tune in to your phone calls, read your messages, capture pictures of you, stream videos of you, read your emails, steal your files … whenever they please.

Can NSA agents carry guns? ›

They wear uniforms and carry firearms. In addition to law enforcement duties, NSA officers frequently participate in counterterrorist operations and administer weapons training to NSA employees. NSA officers perform other duties to fulfill the NSA's mission.

How much data does the NSA collect? ›

An intelligence agency report released on Tuesday revealed that the organization harvested over 434 million call and text records in 2018. That's a decrease on 2017 when the NSA collected more than 534 million records from providers such as AT&T and Verizon.

Does NSA look at search history? ›

INTERNET HISTORY, EMAILS, TEXT MESSAGES AND iCLOUD

Security clearance background investigators do not check your browsing history, read your emails, surveil your every move, bug your telephones, or photograph you commuting to work.

What does the NSA look for in a background check? ›

Security clearance information

The background investigation will: Review your previous and current employment history, including contact with your current employer. Verify your education, residential history and financial background. Interview your friends, neighbors, supervisors and coworkers.

What can the NSA see? ›

This includes emails, text messages, phone calls (both cell phone and landline), Google Maps searches, Facebook posts — anything that can be monitored online is a possible target.

Does a VPN make you anonymous? ›

Website cookies will still store basic information from your last visit. A VPN will encrypt your traffic, making it an ideal privacy tool. Online anonymity, however, is leaving absolutely no trace of your presence. This feat is virtually impossible, partially due to the sheer amount of online trackers.

Can the NSA read https? ›

Basically, the NSA is able to decrypt most of the Internet. They're doing it primarily by cheating, not by mathematics. Now, your question is "So is HTTPS still a solution for secure web-browsing?" The answer is, as safe as it ever was, unless your opponent is the NSA.

How long does the NSA keep browsing history? ›

The full contents of intercepted Internet traffic can only be stored for up to a few days, depending on the collection site, while the associated “metadata” (who communicated with whom online) is stored up to 30 days. Telephone metadata is smaller and is stored for five years.

Can NSA see FaceTime? ›

"If you talk about FaceTime and iMessaging, those are both encrypted by Apple, and therefore the government cannot intercept them," Clarke said. "And Apple says it's designed the systems in such a way that even Apple can't decrypt them.

Can police track VPN and Tor? ›

Here's how it works: the police go to your ISP and ask for information such as your IP address. But if you're using a VPN, your ISP can't see your information — it's encrypted. Instead, they'll see that you're using a VPN and direct the police to your VPN provider.

Can the FBI track me on Tor? ›

In conclusion, while TOR can provide a high level of anonymity, it's not completely foolproof. There are ways that law enforcement and other agencies can track down users on the TOR network, such as traffic analysis, exploiting vulnerabilities in the TOR software, monitoring exit nodes and using Honeypot nodes.

Can anyone track me if I use Tor? ›

Although they can't see your browsing activity or Tor encrypted data, your ISP can still see that you're using Tor. You can also be identified if you log in to an online account or provide details to a website while using Tor.

Can you still be spied on with a VPN? ›

A premium quality VPN encrypts data and hides your IP address by routing your activity through a VPN server; even if someone tries to monitor your traffic, all they'll see is the VPN server's IP and complete gibberish. Beyond that, you can only be tracked with information you provide to sites or services you log into.

Can you get caught on VPN? ›

VPNs provide some amount of privacy and anonymity, but in case the VPN keeps logs, you still are at risk of getting caught. Besides, hacking, stalking, or cyberbullying is simply awful.

Can I be tracked if someone use VPN? ›

However, a VPN keeps your browsing activity safe. Even those who can see that you use a VPN (i.e., your ISP, websites you visit, or even hackers) can't access your data, real location, or any sensitive information.

Top Articles
Latest Posts
Article information

Author: Frankie Dare

Last Updated:

Views: 5824

Rating: 4.2 / 5 (53 voted)

Reviews: 84% of readers found this page helpful

Author information

Name: Frankie Dare

Birthday: 2000-01-27

Address: Suite 313 45115 Caridad Freeway, Port Barabaraville, MS 66713

Phone: +3769542039359

Job: Sales Manager

Hobby: Baton twirling, Stand-up comedy, Leather crafting, Rugby, tabletop games, Jigsaw puzzles, Air sports

Introduction: My name is Frankie Dare, I am a funny, beautiful, proud, fair, pleasant, cheerful, enthusiastic person who loves writing and wants to share my knowledge and understanding with you.