VPNs And Privacy: Using Virtual Private Networks May Put Your Data At Risk : All Tech Considered With Internet providers able to track and sell your browsing data, people who want to keep their activity hidden are turning to virtual private networks. But VPNs can themselves be insecure.
NPR logo

Turning To VPNs For Online Privacy? You Might Be Putting Your Data At Risk

  • Download
  • <iframe src="https://www.npr.org/player/embed/543716811/544259829" width="100%" height="290" frameborder="0" scrolling="no" title="NPR embedded audio player">
  • Transcript
Turning To VPNs For Online Privacy? You Might Be Putting Your Data At Risk

Turning To VPNs For Online Privacy? You Might Be Putting Your Data At Risk

  • Download
  • <iframe src="https://www.npr.org/player/embed/543716811/544259829" width="100%" height="290" frameborder="0" scrolling="no" title="NPR embedded audio player">
  • Transcript

ROBERT SIEGEL, HOST:

This March, the federal government rolled back rules that would have prevented Internet service providers from tracking your online activity. Well, now Comcast, AT&T and the like are allowed to take that personal data and sell it with much less fear of regulatory action. From KERA in Dallas, Lauren Silverman reports that more people in the U.S. are downloading something called a virtual private network, hoping that will keep their activity hidden.

LAUREN SILVERMAN, BYLINE: Picture a virtual private network like a dark, secret tunnel you use to go from your computer to a website. While you're inside the tunnel - say, clicking on Instagram photos or checking your bank account - third parties can't see what you're doing. The data is encrypted.

LORAINE KANERVISTO: I hadn't ever felt like I needed to use a VPN in the past, but the more I read about how much power my Internet service provider is getting, the less inclined I am to share that data with them.

SILVERMAN: Loraine Kanervisto is a software engineer in Seattle. She says there are lots of reasons people around the world use VPNs - to hide location, access a work network, even to avoid government censorship. But she downloaded a VPN on her computer and cell phone because she doesn't want her Internet service provider spying on her.

She's not alone. NPR reached out to six popular VPN companies, and all have seen double-digit increases in purchases since Congress repealed internet privacy rules. Ryan Dochuk is co-founder of the VPN called TunnelBear.

RYAN DOCHUK: Before, where there was services that might collect a chunk of your browsing habits like Google or Facebook, this change allows U.S. ISPs to collect 100 percent of your web browsing and sell it to third parties.

SILVERMAN: The ISPs handle customer privacy in different ways. Some say you have to opt in for them to sell your data. Nuala O'Connor with the Center for Democracy & Technology says the policies can be confusing, so you need to do your research, especially because ISPs can see a lot more than the websites you browse.

NUALA O'CONNOR: The Internet is in everything - increasingly in your house, in your smart water meter, in your refrigerator, in your toothbrush. The Internet service provider to your home knows a whole bunch of stuff about you.

SILVERMAN: O'Connor says it's possible the government or private companies could use that information to deny services like health insurance, even water.

O'CONNOR: You can think of water rationing in certain parts of the country being enforced via your smart water meter or your, you know, other devices. So it's a level of intrusion into the home and into your daily lives that we think people should be really mindful of and guard against.

SILVERMAN: Which brings us back to virtual private networks. Many of them promise anonymous browsing for free or just a few dollars a month. They claim not to share your data. Closer inspections revealed there are cracks, even trap doors hidden inside.

NICK FEAMSTER: If you're not careful with choosing your VPN service provider, the medicine might be worse than the illness, (laughter) so to speak.

SILVERMAN: Nick Feamster is a professor of computer science at Princeton. He says tens of millions of people have downloaded VPNs, and many don't realize they're not as secure as they claim. In the first major review of VPN providers, researchers tested nearly 300 free VPN apps. What they found was alarming. Nearly 40 percent injected malware. And, as so-author Narseo Rodriguez says...

NARSEO RODRIGUEZ: To our surprise, basically we found that 20 percent of applications were actually not encrypting any traffic at all.

SILVERMAN: Not encrypting it at all.

RODRIGUEZ: At all, yeah.

SILVERMAN: Meaning that pitch-black tunnel you were promised is nothing more than a see-through straw. Before Loraine Kanervisto chose her VPN, she did her homework. But she admits...

KANERVISTO: Essentially I'm paying this company with the hopes that they are delivering on what they're advertising. It is a gamble.

SILVERMAN: The safest option, according to Nick Feamster with Princeton, is to set up your own VPN server or use the privacy software Tor. Most people won't do that. So for now, think of a VPN as a supplemental tool, not a privacy solution. Lauren Silverman, NPR News.

Copyright © 2017 NPR. All rights reserved. Visit our website terms of use and permissions pages at www.npr.org for further information.

NPR transcripts are created on a rush deadline by Verb8tm, Inc., an NPR contractor, and produced using a proprietary transcription process developed with NPR. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of NPR’s programming is the audio record.