Sen. Wyden asks NSA to update public guidance on commercial VPN security, questioning single-hop VPNs

Sen. Ron Wyden (D-Ore.) has asked NSA Director Gen. Joshua Rudd to revise public guidance on commercial VPNs, arguing single-hop VPNs offer little protection against sophisticated foreign adversaries and pressing the agency to assess multi-hop options such as…

Sen. Ron Wyden (D-Ore.) sent a letter Wednesday to NSA Director Gen. Joshua Rudd urging the agency to update public guidance on commercial VPN security, in a story reported by CyberScoop on Sept. 2, 2026 and by Ars Technica on Sept. 3, 2026. Wyden argues consumer VPNs are marketed as privacy shields but are insufficient against state adversaries: a single-hop VPN decrypts traffic at its termination server, metadata such as timestamps can enable nation-state profiling, and sophisticated adversaries able to compel or compromise the single provider can defeat the protection. The letter cites a Congressional Research Service paper finding that multi-hop and mixnet architectures mitigate single-provider compromise, and it references a September NSA advisory on a China-sponsored campaign against telecom, government and military networks; Wyden asks the NSA to update the VPN configuration guidance it issued after the China-linked telecom intrusions. Aimed at at-risk users including government personnel, officials, contractors and journalists, the letter poses unclassified questions asking the NSA to assess multi-hop architectures, random delays and cryptographic padding, and to evaluate specific services such as Apple Private Relay, Tor and Nym against mixnets. CyberScoop adds that the letter follows earlier Wyden letters to federal agencies in March and July.

• Sen. Ron Wyden (D-Ore.) sent a letter to NSA Director Gen. Joshua Rudd asking the NSA to update public guidance on commercial VPN security; reported by CyberScoop on 2026-09-02 and by Ars Technica on 2026-09-03.
• Wyden argues single-hop VPNs provide little protection against sophisticated adversaries that can compel or compromise the single provider; the letter cites decrypted traffic at single-hop termination servers and metadata such as…
• The letter cites a Congressional Research Service paper finding that multi-hop and mixnet architectures mitigate single-provider compromise.
• The letter references a September NSA advisory on a China-sponsored campaign against telecom, government and military networks, and asks the NSA to update the VPN configuration guidance issued after the China-linked telecom intrusions.
• Wyden asks the NSA to assess multi-hop architectures, random delays and cryptographic padding, and to evaluate Apple Private Relay, Tor and Nym versus mixnets.
• The letter targets at-risk users including government personnel, officials, contractors and journalists.
• The questions posed to the NSA are unclassified, per CyberScoop.
• CyberScoop reports the letter follows earlier Wyden letters to federal agencies in March and July.