Lawmakers Warn VPN Use May Let NSA Spy on You

A group of Democratic members of Congress is asking the nation’s top intelligence official to clarify whether Americans who use certain privacy tools online could be giving up key constitutional protections.

Six lawmakers have sent a letter to Director of National Intelligence Tulsi Gabbard requesting that she publicly explain how US surveillance rules apply to people in the United States who route their internet activity through virtual private networks, or VPNs, that connect through servers located overseas. Their concern is that when someone’s internet traffic appears to originate outside the United States, intelligence agencies might classify that person as a foreign user under surveillance laws.

The issue is tied to Section 702 of the Foreign Intelligence Surveillance Act, which allows US intelligence agencies to collect communications from individuals located abroad without obtaining a warrant. The law is scheduled to come up for renewal next month.

According to declassified procedures governing the program, agencies such as the National Security Agency and the Pentagon treat a user as non-American if their location cannot be determined. Lawmakers worry that Americans who connect through foreign VPN servers could fall into that category if their true location is unclear.

The letter raising these questions was signed by Senators Ron Wyden, Elizabeth Warren, Edward Markey, and Alex Padilla, along with Representatives Pramila Jayapal and Sara Jacobs. They are asking Gabbard to clarify whether using a VPN that routes traffic through another country could affect the privacy protections Americans normally receive under US law.

The lawmakers also pointed to similar concerns related to Executive Order 12333, which authorizes broader intelligence collection overseas. In their request, they asked the intelligence chief to explain whether VPN use could change how Americans are treated under these surveillance authorities and whether there are steps people can take to maintain their legal privacy protections.