i2Coalition Launches ‘VPNs at Risk’ to Mark Global Encryption Day

Virtual private networks (VPNs) are a fundamental layer of a secure Internet, and therefore are worth protecting. That’s why, to mark Global Encryption Day, i2Coalition is launching VPNs at Risk, a new report explaining how virtual private networks support secure communications and how policies affecting them can have consequences far beyond consumer VPN applications.

“VPNs are part of the security architecture people and businesses depend on every day,” said Christian Dawson, Executive Director of i2Coalition. “When policymakers consider restrictions, we need to understand what those measures will actually do, whether they will address the harm in question, and who else they will affect. Protecting people should include protecting the tools that keep their communications secure.”

VPNs are among the most widely used and widely misunderstood security technologies on the Internet. They are often described as consumer privacy tools, applications for remote workers, or technologies that allow users to access services from another location. At their core, though, VPNs are secure networking technologies. They create encrypted connections across untrusted networks, allowing individuals and organizations to communicate more securely over the public Internet. This enterprise-grade technology also helps everyday Internet users protect their communications as they work, travel, bank, shop, and connect across networks they do not control.

Governments have legitimate policy objectives around cybersecurity, national security, criminal investigations, child protection, public safety, copyright enforcement, and online content access. As with other technologies, some capabilities provided by VPNs can complicate network attribution, allow users to circumvent restrictions, or make particular enforcement mechanisms less effective. However, restricting or banning VPNs can make lawful users, including children, less safe online. Proposed measures therefore need careful scrutiny of their effectiveness and wider consequences.

Drawing on case studies from India, the United Kingdom, Pakistan, France, Brazil, Iran, and Russia, VPNs at Risk examines approaches ranging from customer-data retention and provider licensing to court-ordered blocking, distribution restrictions, and interference with VPN traffic. It explains why measures directed at a particular provider’s business practices can have different consequences from blocking shared protocols or infrastructure.

VPNs at Risk is a living document, tracking legislation and their outcomes as they come into force. This also includes the results of legislative rollback, with several cases of a government changing course in favor of a more open Internet.

The report calls on policymakers to identify specific harms, require evidence that proposed measures can achieve their objectives, and consider consequences for lawful users, enterprise security, competition, and shared Internet infrastructure. It also urges early consultation with technical experts, industry, and civil society, as well as careful attention to the distinct roles and capabilities of Internet intermediaries.

Global Encryption Day, observed on October 21, brings together advocates, technologists, businesses, and Internet users to promote and defend strong encryption. The release of VPNs at Risk contributes to that broader conversation by explaining the role secure networking plays in privacy, cybersecurity, and a resilient Internet.

Internet at Risk: An Educational Series

VPNs at Risk is the latest in our Internet at Risk education series, joining the Encryption at Risk and DNS at Risk reports, which are available at internetatrisk.org. This series connects explanations of Internet technologies with the practical consequences of policies affecting them, helping policymakers understand where intervention occurs and who else may be impacted.

About i2Coalition

The Internet Infrastructure Coalition (i2Coalition) brings together companies that build and operate Internet infrastructure to support policies that protect an open, secure, and resilient Internet. Its Internet at Risk series provides educational resources on technologies and infrastructure at the center of public policy debates. Learn more at https://i2coalition.com/ and https://internetatrisk.org/.