The problems with foreign-owned VPNs

In recent months, foreign-owned VPN services have become commonplace. In fact, they are so rampant that US senators are urging a ban to keep federal workers from using them. Although the motives behind this are incredibly complex, there are two areas of concern.

First, certain European nations have a fantastically comprehensive set of privacy laws. As such, people often look for VPN services routed through these countries as a means of better privacy; this means that even if the US government were to subpoena a specific state, the obfuscated traffic would be protected by those European nations’ privacy laws, rendering the subpoena useless. Businesses and governments should review their guidelines for VPN use to be sure that privileged communications aren’t being sent to a black hole with nearly zero ways to gain access.

Secondly, potentially hostile states (we know who they are) may use VPNs for cyberespionage. This is extremely dangerous for federal workers, but would be equally damaging if a C-suite business executive uses such a service and compromises private information. Sadly, people are often unaware that hostile states may covet their data. Because foreign-owned VPN services are inherently risky, they should be avoided in almost all cases.

Securing VPN services

The best advice is to avoid using free VPN services where possible. The data regulation minefield that users are charging into is too unpredictable, and it could cause serious issues for both the individual and the organizations they belong to.

If they need VPN services, organizations likely have one in place. Checking with IT is the best first step and will give the most secure connection based on the organization’s cybersecurity policies. Because the communications will be headed to the organization, any privileged information will not be accessible to malicious actors or bad states. In the case of government agencies, if they need to obtain records for legal purposes, the records will be readily accessible without the need to request them from foreign nations. This is especially important with regard to nations that may have stringent privacy laws against keeping such information.

Organizations should develop policies related to noncorporate VPN services on business assets. They should also establish policies for nonbusiness assets that might be used for business purposes (e.g., a personal mobile phone). These policies, along with proper training, will educate employees on the dangers that other VPN services may pose to the organization.

Concluding thoughts

VPNs stand at the crossroads of a fierce debate between privacy of the individual and visibility for organizations. Ultimately, businesses and consumers will each decide which side of the debate they fall on, after they have educated themselves about the many dangers and benefits of these free VPN services. Ideally, businesses will provide better guidance to employees about VPN services already available, and consumers will understand that free VPN services can be useful, but can also expose details they’d rather keep secret.

With a strong security posture, both privacy and security can be achieved. Equally, employees and businesses can stay safe when employees are working remotely and privileged details can remain safely behind the corporate VPN.

Takeaways

• Businesses should identify where VPNs are appropriate and provide a policy for employees on VPN use.

• Foreign-owned VPNs should be heavily vetted when being used for business purposes.

• Users should understand if they have access to a secure, corporate VPN before using outside services.

• When possible, avoid using “free” VPN services, because nothing is completely free, and you may be “paying” with your data.

• Always review the VPN service’s privacy policy; this will help you understand how the VPN provider will use your data.