As online age verification laws become more common in the United States, Americans are increasingly turning to virtual private networks to avoid being forced to show their papers just to go online.For journalists, however, a VPN is more than just a way to access Instagram without having to show their ID. Although VPNs aren’t a universal fix for every digital threat that reporters face (and not all VPNs are created equal), they’re an important tool that journalists rely on to do their jobs.That makes recent attempts to ban VPNs to stop age-verification evasion a growing threat to press freedom. Utah recently became the first state to enact a limited VPN ban to enforce its age-check law, and other states are considering following suit.Banning VPNs would make it harder for journalists to protect themselves, their newsgathering, and their confidential sources. To help lawmakers and the public understand what’s at stake, here are three critical ways VPNs actually protect journalists in the U.S.1. VPNs allow journalists to conduct sensitive online researchThe Digital Security Training team at Freedom of the Press Foundation (FPF) recommends that journalists conducting sensitive online research — like visiting websites controlled by the people they’re investigating — use a VPN.A journalist’s internet connection is associated with an IP address that’s broadcast to every website they visit. That IP address may also reveal that it’s associated with a news organization. The operator of the website, in turn, can see every IP address that visits it. If a reporter is not using a VPN, a website operator could notice that an IP address associated with a news organization is visiting its website and become suspicious that they’re under investigation.This concern is not hypothetical. In 2017, CyberScoop reported that a New York politician and his son, suspected (and later convicted) of corruption, were tipped off to a New York Times investigation when IP addresses from the Times’ office showed up in web server logs of a company the men were accused of illegally aiding.However, if a journalist uses a VPN to conduct their online research, the IP address recorded by the website visitor will be that of the VPN, and not an IP address associated with the journalist’s home or workplace. Bottom line: Using a VPN can prevent a journalist’s online research from exposing their investigations.2. VPNs help journalists avoid being linked with their confidential sourcesJournalists often rely on confidential sources to report on national security matters, government wrongdoing, or abuses of authority. Journalists must be able to protect confidential sources’ identities, or many will be unwilling to speak to them.During leak investigations, the government may seek records from a journalist’s internet service provider in an attempt to identify their confidential sources. Records kept by an ISP about the websites a journalist has visited could expose a confidential source, if, for instance, a journalist has visited a company or government website associated with a source or visited a source’s personal website.A journalist’s ISP would also be able to see their peer-to-peer connections, such as when the journalist makes a voice or video call to a source using Signal or WhatsApp. This means an ISP could have data revealing that a journalist and source (or at least someone with the source’s IP address) had been in contact through a voice or video call.A VPN, however, can protect journalists and their sources from government demands to ISPs seeking records about online research or peer-to-peer connections that can link them to their sources. Using a VPN, a journalist can ensure that the websites they visit would not be visible to their ISP, meaning the ISP would have no useful records to turn over in the event of a government demand. And while Signal and WhatsApp have built-in features that can hide your IP address when making video and voice calls, using a VPN would also prevent an ISP from having information about a journalist’s peer-to-peer connections.3. VPNs protect journalists from some kinds of cyberattacksIn addition to surveillance by our own government, American journalists can also be the targets of other attempts to eavesdrop on their work, including through cyberattacks by foreign governments or groups who may be working on their behalf.VPNs are one tool journalists can use to help prevent certain kinds of cyberattacks. In particular, VPNs can help protect against attacks that use unsecure WiFi connections to secretly monitor web traffic associated with a journalist’s device.These kinds of attacks could target journalists using public WiFi, such as while working remotely from a coffee shop, library, or government building. But attackers can also exploit flaws in a legitimate, known WiFi router to intercept a journalist’s connections. Using this kind of network monitoring, bad actors could gather information about what websites a journalist is visiting.A VPN helps protect against these kinds of attacks by encrypting the traffic between the journalist’s device and a secure external server. This prevents an attacker from being able to see the data being sent and received. Even in the absence of a malicious attack, using a VPN will also prevent the network administrator — such as the government entity offering the public WiFi in a government building — from logging the websites being visited by a device associated with a journalist.One important note for journalists: VPNs do not provide protection against other kinds of attacks, such as those that use phishing to trick a user into installing malware or providing information to a third party. But some VPNs offer optional DNS-based content blocking that may provide some limited protection against recognized malware, trackers, ads, and more. In addition to using a VPN, journalists should continue to keep their devices up to date and use two-factor authentication, along with strong passwords and a password manager.Protecting an important tool for the free pressLawmakers must reject VPN bans to ensure that American journalists can rely on this important privacy tool, and that all Americans remain free to access information online.The VPN bans being considered in the U.S. today seem to be mostly limited to stopping people from using VPNs to access certain social media platforms or adult websites. But even limited bans set a dangerous precedent. Russia and Iran, for instance, also started by claiming that VPN bans were necessary to protect children. Now, VPNs are banned far more widely in those countries, and the state has near-total control of what its citizens can see online.American lawmakers must not start down a similar path. Freedom of the press and freedom of speech are increasingly under fire. The norms that have historically protected them are eroding, and legal protections are being weakened. Now is not the time to outlaw the tools that can keep our freedoms secure.
