The Digital Security Digest, by Freedom of the Press Foundation (FPF), is a weekly newsletter with security tips that keep you, your sources, and your devices safe. If someone shared this newsletter with you, please subscribe here.

Lawmakers question Gabbard about spying on VPN users

Virtual private networks help protect your IP address from the websites you visit by encrypting and tunneling your traffic over the web to remote locations, perhaps even in other countries. But does using a VPN subject you to warrantless government spying? Six legislators penned a letter to Director of National Intelligence Tulsi Gabbard urging her to disclose more information about how the use of VPNs may affect Americans’ privacy rights.

The intelligence community’s authority to target Americans’ communications is regulated under the Foreign Intelligence Surveillance Act, and would ordinarily require a warrant signed by a FISA judge. However, the lawmakers underscore that using a VPN makes the known location of a user unclear and potentially subject to foreign intelligence collection. The letter argues that some federal guidelines suggest VPN users are subject to foreign intelligence surveillance under FISA Section 702 and Executive Order 12333, which authorize the warrantless targeting of foreigners abroad. The more permissive EO 12333 also allows bulk surveillance of foreign communications. Read more.

What you can do

Back in 2013, National Security Agency whistleblower Edward Snowden, now an FPF board member, first made his revelations of sweeping government surveillance powers. Since then, FPF has highlighted the dangers of creeping government spying and abuses of authority. Those lessons apply here. We do have to understand that foreign intelligence surveillance incidentally scoops up massive amounts of domestic data. And, this should serve as a reminder that intelligence actors from other countries around the world are also collecting data.

  • Start with a risk assessment. Journalists use VPNs all the time, including for remote access to internal newsroom resources and for conducting research when they don’t want to leak their IP address. This is part of the job, so don’t let surveillance stop you from pursuing your goals. All the same, a VPN is just one tool you could use, and you will have to give some thought about how you’d like to pursue your goals. This just means thinking through the “crown jewels” — the most sensitive data you’d like to protect at any given moment — and who you’re protecting them from. This process will help you decide whether a VPN is a reasonable way to address your needs. Read our guide to risk assessment for journalists.
  • If a VPN is part of your tool kit, we have recommendations. If your reporting depends on protecting your IP address from specific websites, or preventing your home internet service provider from seeing your web traffic, a VPN may help. Beyond that, its usefulness may vary. Read our guide to choosing a VPN.

Updates from our team

  • We’ve put together a series of guides to help journalists better understand the risks of artificial intelligence and set boundaries around which AI systems and tools make sense to use, adjust, or avoid. The guides look at the most common ways in which you, and your sensitive data, are likely to interact with AI. The three-part series covers stand-alone AI tools, AI enhancements to existing tools, and AI agents and operating system integrations.
  • FISA Section 702 is up for renewal, so I bet you want to hear more. Watch a panel discussion that my colleagues recently participated in on reforming the law to constrain loopholes that enable excessive surveillance. And make sure to contact your lawmakers and urge them to reform Section 702.
  • Relatedly, our executive director, Trevor Timm, wrote our most recent advice column on NSA surveillance. Give it a read.
  • A final reminder for J-school educators: Do you want to learn more about teaching digital security? We’re putting together a project to help journalism school instructors integrate digital security education into their curricula. Please help us understand your interest and availability. To be considered, please fill out this quick intake survey by April 8.

Our team is always ready to assist journalists with digital security concerns. Reach out here, and stay safe and secure out there.

Best,
Martin

–

Martin Shelton
Deputy Director of Digital Security
Freedom of the Press Foundation