No federal agency has ever told Americans which virtual private networks, tools that encrypt internet traffic and route it through a remote server, are actually safe enough to trust. A prominent US senator is now asking the National Security Agency to fill that gap, requesting concrete guidance for the general public on which products provide adequate protection against foreign adversaries. Federal agencies have previously recommended VPN use, but the recommendation has always stopped short of naming specific products that clear the bar.
A VPN works on two fronts. It encrypts the contents of a connection so that anyone intercepting the traffic in transit sees scrambled data rather than readable content. It also masks the user's IP address, meaning the website or service being accessed sees the VPN server's address instead of the user's own.
Where the protection actually ends
The encrypted tunnel has a stopping point. The protection closes once a single remote server decrypts the traffic and forwards it to its final destination. At that point, the content and the IP addresses on both ends of the connection are exposed. A rogue employee at the server operator, or an attacker who has broken into that server, can see what the VPN was supposed to protect.
Metadata is a separate exposure. VPNs do not encrypt all types of background information. Time stamps, the records of when a connection is made, pass through unprotected. A nation-state collecting those records across many sessions can build a behavioral profile of a user without reading the content of a single message. That kind of pattern analysis is a standard intelligence method. Strong content encryption does not stop it.
A VPN provider can truthfully advertise encrypted connections without disclosing that the encryption terminates at the exit server, or that time stamps travel unprotected. The resulting gap between what is marketed and what is actually secured is precisely what an NSA recommendation would need to address.
The NSA has not responded publicly to the senator's request. No timeline for a response has been announced.