Building Tunnels: Securing Internet Access as a Public Utility
In the contemporary digital ecosystem, many competing economic interests degrade the privacy and security of the internet-connected American. All levels of government—federal, state and local—are entrusted with protecting their citizens; however, none currently offer a robust, unambiguous solution for secure internet access. While technical guidance and recommended techniques for safe internet browsing are offered, a public, accredited internet access solution does not exist.
There is a strong case for a public Virtual Private Network (VPN). To address American citizens’ privacy and consumer protection concerns, the U.S. government should provide VPN technology as a public utility.
This article will provide an overview of the current digital landscape, describe the vital purpose of a secure VPN connection, highlight the unique absence of government consumer recommendations on VPN technology, inspect related precedents for opportunities and examine key security and privacy considerations.
Background and Landscape Overview
Most Americans accessing the internet in 2026 pay their monthly cellphone bill or internet service provider for access. According to Pew Research from November 2025, 96% of U.S. adults claimed to use the internet; of those, 78% claimed they subscribed to a broadband internet service at home, and 16% were “smartphone-only” internet users. Though millions rely on the internet connection for daily life, most are unaware of the technical minutiae of how paying their internet service provider or phone company enables the connection. In the abstraction of online connection, many are unaware of the privacy ceded to the providers and telecommunications companies that provide them access to the “internet superhighway.”
When the internet user pays their bill, they ensure their internet service provider or telecommunications company connects their cellphone or router to the World Wide Web. All communications between the devices transit through the network infrastructure of the provider or cellphone company, which is then delivered to the requested website. In 2021, a U.S. Federal Trade Commission (FTC) report identified many internet service providers that “collect and share far more data about their customers than many consumers may expect—including access to all of their Internet traffic and real-time location data—while failing to offer consumers meaningful choices about how this data can be used.” Privacy is a fundamental element of American society, which is challenged in every tunnel of the digital ecosystem.
Security and Privacy via VPN
Corporations and governments understand the need to establish secure connections for sensitive and proprietary business communications. For data security and policy compliance, corporations often require employees to use enterprise VPN technologies for access to the company network while off-site.
One of the primary U.S. federal government entities responsible for cybersecurity, the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (DHS/CISA), also acknowledged the criticality of a trusted VPN for online protection. Yet in one of its most consequential public releases on “Mobile Communications Best Practices,” CISA expressed skepticism regarding personal VPNs. The report wrote: “Personal VPNs simply shift residual risks from your internet service provider to the VPN provider, often increasing the attack surface. Many free and commercial VPN providers have questionable security and privacy policies. However, if your organization requires a VPN client to access its data, that is a different use case.” This skepticism toward commercial VPNs highlights the need for a trusted public solution.
Internet security experts, defense agencies, the FTC, the Federal Communications Commission (FCC) and businesses widely recommend using VPN technologies when accessing public internet at cafes, hotels, airports, universities, etc. However, problematically, many malicious VPNs exist online for download. A Google security report warned of fake VPNs that could surreptitiously “deliver dangerous malware payloads including info-stealers, remote access trojans and banking trojans that exfiltrate sensitive data such as browsing history, private messages, financial credentials and cryptocurrency wallet information.” The FBI pursues many criminal cases of illegitimate, free VPNs covertly operated by criminals that compromise Americans’ devices and victimize users. And while a broad market of legitimate commercial VPN technology is available for download, none are accredited, validated, managed, endorsed or assured by a government entity for the American consumer.
In recent years, the federal government has edged toward promoting commercial VPNs for consumer choice but has never endorsed a suite of products. However critical these programs are, they do not suffice for the average American consumer seeking to protect themselves online.
There is no lack of expertise in this arena. Although, the government’s proactive consumer protection in the cybersecurity product recommendation space is minimal. For example, the FTC, charged with consumer protection, is limited in its ability to provide specific product recommendations for VPNs, as its mission is to provide a fair and regulated marketplace that encourages competition while protecting the American consumer. Although the National Security Agency, DHS and FBI provide valuable insights for the public to protect themselves, their guidance does not recommend a specific product.
One promising, nascent development is the FCC’s Cyber Trust Mark Program, though, as of late 2026, it does not appear to include VPNs in its scope. The FCC’s burgeoning Cyber Trust Mark Program seeks to provide a cybersecurity labeling program to encourage more secure wireless consumer Internet of Things products.
Notably, even Congress has been left dissatisfied with the current state of VPNs, of which a public VPN service may have been a reasonable solution in retrospect.
In July 2022, then-U.S. Rep. Anna Eshoo (D-CA) and U.S. Sen. Ron Wyden (D-OR) published a letter that implored the chair of the FTC to “address abusive and deceptive data practices by hundreds of companies providing [VPN] services for individuals.” The initiative sought to protect citizens with concerns about their reproductive privacy while using VPNs. The two legislators highlighted malicious practices by the consumer VPN industry, including peddling misleading or false claims about their products, lack of accountability, commercialization of private data and distorting their relationship with law enforcement. The legislators’ request called on the FTC to leverage its authorities to protect citizens and to create a brochure on best practices and risks of VPN use. In fact, in 2018, the FTC produced a brochure on VPNs, though it offered more generalized advice. In principle, a federally sponsored public VPN utility would have congressional oversight and could have mitigated the concerns legislators expressed about the VPN industry.
Possibly influencing the legislators’ request for a brochure in 2022, the FTC published a brochure and blog in February 2018 for the “business person” looking to secure their online browsing from “prying eyes” with a VPN application. In lieu of providing a recommended list of personal VPN applications by name, the FTC offered research advice. The tips ranged from “research the VPN app before you use it,” “carefully review the permissions the app requests,” and check trusted outside reviews to determine if a particular application properly implements encryption.
Additionally, the advice included a suggestion to review the application’s terms of use and privacy policy to determine if the application shares information with third parties like advertisers. While valid recommendations for consideration and well-meaning, the brochure’s advice falls short of a tangible consumer solution. Especially in the crowded marketplace of deceptive advertising and sometimes indistinguishably fake products, telling an already unsure consumer to conduct more advanced product research—and taking a company’s own claim at face value—is unsatisfactory.
At present, when an American—especially someone without a cybersecurity background—opts to research VPN choices online, they are left with more questions than answers; the answers received are often highly manipulated too. In the case of VPNs, when the government does not clearly weigh in and provide an accessible list of reputable product choices, misinformation and disinformation dominate the ecosystem. Consumers doing online research are met with advertisements containing a mix of legitimate and spyware-loaded VPNs, paid consumer blogs and self-proclaimed anonymous security experts posting unvetted advice on message boards. In 2022, the University of Michigan published a study titled “Investigating the VPN Recommendation Ecosystem,” which revealed that VPN recommendation websites were heavily driven by profit, including paid rankings and reviews, and were in some cases owned by the VPN companies themselves.
At first glance, one may consider that government avoidance of promoting a list of preferred VPN vendors is to encourage fair competition in the marketplace. However, upon closer inspection, personal VPN products are seemingly one of the only consumer cybersecurity technologies not named across the vast number of citizen-focused cybersecurity public service announcements. In the aforementioned CISA report identifying “Mobile Communications Best Practices,” many cybersecurity products were named, without the inclusion of a single VPN client. Curiously, absent from the list of trusted American commercial security technologies are any named VPN applications, despite the large-caveated disclaimer regarding lack of product endorsement.
A Digital Public Utility Project
A public utility VPN service does not suggest the government needs to engineer its own VPN solution from scratch. Fortunately, a plethora of world-class, high-quality American networking and security technologies could be modified to offer this service. The federal government has experience with “government white-labeling” that could afford a swift solution to establish a public utility VPN service. White labeling is the process by which a product is built by one company, packaged, sold and then rebranded under a different name. The practice is known to promote high-quality service delivery, reduce time to market and minimize engineering costs.
White labeling is already a common practice in the federal government. For example, the U.S. military offers a tax preparation service called “MilTax” to military service members and their families during tax season. Additionally, the U.S. Department of Education has a history of partnering with private companies for servicing student loans. The Department of Education, while acting as the loan provider for American students, contracts with private providers, who alleviate the federal government of operating and servicing functions. In the context of providing an accountable, secure and public VPN, there is precedent for white-labeling existing enterprise commercial-off-the-shelf applications.
Plenty of premier American private-sector cloud service providers could provide the necessary network infrastructure for a public utility VPN sponsored by federal or state governments. Many of these cloud providers have experience providing tailored enterprise solutions that verifiably assure specific levels of security and privacy protections for their customers. Even if a state or federal government entity chose to architect its own VPN client solution to connect to these pre-established cloud service providers, the client solution could be developed as open-source software, thus benefiting from continuous testing and transparency.
Privacy and Security Assurances
A public utility VPN service with government sponsorship at any level should include clear assurances of user privacy safeguarded by law, including the Fourth Amendment. Americans are fortunate to have constitutional protections against unreasonable searches and seizures, and internet activity traversing through a public utility VPN tunnel should be no exception.
As a broader matter of public cybersecurity, tertiary benefits are afforded by adoption of a public VPN utility toward collective cyber-defense and “open internet” (var. “net neutrality”) initiatives. A body of research and commercial applications supports privacy-preserving techniques to collect and share cyber threat intelligence for public utilities that avoid exposing privacy-sensitive user data. Additionally, a public utility VPN could assist government efforts to measure and protect the open internet through collection of metrics that ensure the prohibition of blocking, throttling and paid prioritization.
Moreover, further research could examine the effects of legal procedures for Americans using a public utility who are victims of certain cyber attacks.
For instance, would an exploitation attempt by a cyber attacker against government-hosted VPN infrastructure escalate the severity of the offense, possibly creating a deterrent effect to the attacker? Or conversely, how would the government handle an investigation of a user’s alleged criminal activity while on the public VPN service? Would the public VPN service block certain websites or activity? Certainly, there are many complex ethical, legal, technical, economic and societal considerations that should be discussed in greater detail. Equally certain, these questions are not insurmountable to an engaged American public.
Conclusion
Just as Americans enjoy the relative safety of community roads, bridges, tunnels and highways, it is time to consider a public utility “tunnel” to the internet. The myriad of public service announcements, brochures and research on VPNs for too long have been unable to provide clear choice recommendations for American consumers. It should be emphasized that by choosing not to use a VPN, the personal risk is merely transferred to an internet service provider that is possibly interested in monetizing user data. In 2026, the American consumer deserves a safer choice to connect to the internet and a government that protects their interests in making that choice.
Max Freeman is an information warfare officer in the U.S. Navy Reserve. In his civilian career, Freeman serves as a security-focused technologist in the federal government. He is an industry-certified cybersecurity professional and actively maintains multiple certifications. Freeman holds a graduate degree in security studies from Georgetown University’s School of Foreign Service, and an undergraduate degree in computer science from George Mason University’s School of Engineering.
The views expressed in this article are those of the author and do not reflect the official policy or position of the Department of War or the U.S. government.
Comments