Privacy Threats and the Counterproductive Refuge of VPNs

​The recent vote by Congress, approved by President Trump, to eliminate the FCC rules that constrain the ability of internet service providers (ISPs) to track Internet users’ data has left a lot of people worried about their online privacy. Indeed, the average person’s search history does not merely reflect their consumer desires but also exposes their most personal secrets, worries, and anxieties and their health, relationship, and financial struggles. Virtual private networks (VPNs), which hide a user’s Internet behavior by funneling their transmissions through a third party, have been touted as way for average people to protect themselves from being tracked by their ISP. VPNs don’t work, however, but not for the reason one might think. They represent a technical fix for a problem that ultimately requires a technological solution.
 
Much of the public’s imagination for solving collective problems like privacy is stunted by the belief that technology can and will come to our rescue. Even though most people would recognize that technologies are more than merely the gadgets in our pockets or on our desks upon reflection, they nevertheless act as if they were not tightly intertwined into larger technical, cultural, and political systems. We look to solar panels to save us from climate change, presuming them to be unquestionably “green” despite their resource intensity and the all the pollution that results from their production and disposal. We ignore that rebound effects and consumer behavior often cancel out technical improvements in efficiency. The trust put in VPNs to solve the problem of Internet privacy reflects a similar ignorance of the broader sociopolitical context of communication technologies.
 
In fact, VPN services belong to a class of technical fixes to collective problems already well studied by sociologists: inverted quarantines. Consider the response by citizens to the prospect of nuclear attack during the Cold War, namely building backyard bunkers. Another is how people will buy bottled water to protect themselves from perceived contaminants in their municipal supply. VPNs are like digital bunkers. Users put themselves in a protective digital cocoon to protect just themselves (hopefully) from online privacy threats.
 
Inverted quarantines are deceptively alluring solutions to collective problems, having three main limitations. First, they are individualistic and, hence, class-based solutions. Simply put, the level of protection one receives depends upon a willingness and ability to pay. VPN protection will run a person anywhere from five dollars month for a basic proxy to several times that amount in monthly fees and a several hundred dollar VPN router for those wanting a premium level of privacy. Just as bottled water frames access to clean drinking water as a marker of status, the perceived need to rely on VPNs transforms privacy from a right to a luxury good available mainly to the middle and upper classes.
 
The second limitation of inverted quarantines is that they are often imaginary refuges. For instance, some studies have found that bottled water is often no cleaner and tastes little better than many cities’ municipal supply; some even have higher levels of certain contaminants. Likewise, the tragic irony of the bunker building mania of the 1950s was that backyard shelters provided a cruel illusion of safety: no family had any hope of surviving the aftermath of a nuclear war--even if they were lucking to make it through the initial blast. Indeed, observers have pointed out that VPNs come with significant costs in terms of access speed, and many sites (like Netflix) will not provide access to their content if you’re using one. Most importantly, VPN services only protect a user’s privacy insofar as they can be trusted not to gather and store personal data.
 
There are a lot of reasons to suspect that many VPN services will begin to collect data. As for-profit companies they are only committed to a user’s rights as long as not respecting them is unprofitable and illegal. As Internet scholar Lawrence Lessig noted, the pressure to reduce people’s online privacy comes more from the market than from governments. Little would prevent VPN companies from being like other tech firms, such as Facebook, altering privacy agreements quietly whenever it suited them. Hence, citizens should avoid falling prey to naïve optimism about the intentions of these companies. Unfortunately, the general tendency is to see them as saviors. Indeed, whenever net neutrality rules are at risk, large corporate firms like Facebook and Google get framed as warriors for civil liberties. Citizens forget that these firms’ belief in net neutrality has little to do with freedom but the bottom line: Google and Facebook maximize their earning potential when users are free to consume as much content they desire (and hence provide them with the more data to mine and analyze). Unsurprisingly, sites most likely to take a financial hit from users being increasingly worried about who is tracking their behavior, like pornography sites, are some of the few firms to express much concern about changes to FCC rules.
 
The biggest undesirable unintended consequence from VPN-based inverted quarantine solutions to Internet privacy is that they act as political anesthetics. Users who can afford them will be tempted to say, “I’m protected. What do I care about FCC rules?” Viewing other cases of inverted quarantine leaves little reason for optimism. Citizens who can afford expensive water filters or sidestep other environment concerns by buying organic food or expensive non-toxic alternatives to consumer products, even though they may care deeply about the environment, end up less strongly advocating for new EPA or FDA regulations. The issue may matter to them, but it nevertheless has less salience: they won’t vote someone out of office for undoing environmental legislation. Likewise, citizens who protect themselves with VPNs will not feel as strong of a motivation to remove from office the politicians who voted to eliminate FCC regulations.
 
VPN services are at best a temporary solution. At worst they will distract Americans from the heart of the problem: a corporate dominate Internet. Shoddy Band-Aid technical fixes don’t address the fact that the current Internet is built on advertising. The entire economic basis of the contemporary online world presents a conflict of interest with regard to users’ right to privacy. Corporate firms will not stop trying to dig ever deeper into users’ private lives without changes to the Internet as a sociotechnical system. No doubt it is hard to imagine what a completely public alternative might look like but that shouldn’t stop people from starting to dream up different designs. We might start with the creation of municipal service providers, perhaps combined with community run mesh networks. In any case, the economic arrangement through which Internet access is provided is socially constructed: things could be otherwise. In the same way that many societies have considered goods like healthcare or electricity to be too important to leave completely up to for-profit firms and the market, information access and privacy could become treated more as a public good than a privatized, ad-driven commodity.