Study Exposes Hidden Ownership, Security Flaws, and VPN Risks

Martin Muno of DW writes that many organizations relying on virtual private networks (VPNs) to safeguard access to information, encrypt data, and mask user identities are exposed to major security flaws, highlighting the VPN risks involved.

A recent report from the Open Technology Fund (OTF) that examined the ownership and security practices of major VPN providers found troubling connections to Chinese nationals. Although their corporate registrations were often in jurisdictions like Singapore, some are likely subject to Chinese data control laws.

The report also revealed that a small cluster of companies dominates the global VPN market through white-label arrangements, obscuring true ownership and accountability.

According to OTF, eight providers operating sixteen VPN applications with over 700 million downloads contained critical flaws.

Apps such as Turbo VPN, VPN Proxy Master, and XY VPN utilized weak tunneling protocols and hard-coded passwords, potentially enabling the interception of users’ data.

Several services also collected location information in violation of their stated privacy policies. In contrast, the report found no serious issues with paid VPNs, such as ProtonVPN, Mullvad, Lantern, or Psiphon.

One of the study’s authors suggests that anyone who wants to be on the safe side should use the Tor browser, stating, “Tor does have limitations like anything, but if privacy is your primary concern, Tor is the king of the hill.”

For legal teams advising clients on cybersecurity or compliance, the study’s findings reveal significant due diligence concerns leading to VPN risks. Clients should verify provider transparency, avoid free or opaque VPNs, and consider open-source or independently audited options to ensure optimal security.

The report concludes that while VPNs offer essential tools for digital privacy, they can also expose users to serious legal and security risks.