What is a VPN? And how does it protect you against mass surveillance?
Everyone on the internet has an IP address linked to them. This means it can be used to identify you, track you, and map your life online.
Everybody with an internet subscription has been allocated an IP address by their internet service provider (the company that you bought your telephone subscription or broadband connection from). This is part of the internet’s basic structure. Every website you visit also has an IP address, and it’s the IP addresses that ensure the traffic goes to the right place when it’s sent back and forth. This is good (you want the internet to work), but it also means we each carry a digital ID card everywhere that can be used to map our internet behavior.
How your ISP monitors your life online
The first problem with your IP address is that your ISP (internet service provider) can use it to register all the websites you visit. In fact, the internet service providers in many countries are actually forced to do this logging by law. The idea is that it should be possible to reveal details about internet traffic and information about who is behind a particular IP address in case a government authority asks for it (for example if the police require it during an investigation). But unfortunately it doesn’t stop there.
Your internet service provider uses your IP address to log all the websites you visit. Depending on the country you’re in, that information may be sold on to other organizations. The solution: a trustworthy VPN.
The big problem isn’t that your ISP can see what websites you’ve visited, but that they register them using your IP address, save them, and in many cases share the information. And not only when the police knock on their door with information about a suspected crime. Depending on what country you’re in, it’s more or less likely that in practice they give the government continuous access to traffic regardless of whether or not a crime has been committed. Or quite simply sell your online behavior to make money.
Your IP address: a tool for tech giants to identify you.
It isn’t only the internet service providers who use your IP address to log what you’re doing online. Your IP address can also be collected by others. Today you’ve barely arrived on a website before third-party cookies and other tracking technologies from big tech companies and data brokers leap into action, and these are used to identify you, track you from one site to another, and build a profile of your internet behavior. Your IP address is often used to identify and register the fact that it’s you visiting again.
We can’t be sufficiently clear here: Your IP address equates to sticking up your hand and shouting “Here I am.” Therefore the only way to conceal your IP address and to discard your digital ID card, is to use a credible VPN (or the Tor Network). But what’s actually happening when a VPN protects you against identification? And what tracking methods can it not help against?
This is how a VPN encrypts your traffic and hide your IP address
When you use a VPN (virtual private network), your internet traffic is first sent to a VPN server before it travels on to the site you want to visit. The traffic to the VPN server is encrypted in what’s known as a VPN tunnel, which means that no outsider can see it. For example, if you use Mullvad VPN, all of your traffic is sent to one of Mullvad’s servers and then Mullvad forwards it to where you want to go. It is a bit like when businesses call you from a switchboard, you only see one phone number, rather than the person’ direct dial. This means that the website you visit will see one of Mullvad’s IP addresses (“Mullvad’s switchboard number”) instead of your own. This means your internet supplier only sees that you visit Mullvad, over and over again.
The websites you visit only see one of Mullvad’s IP addresses. And for your internet supplier, it looks like you visit Mullvad over and over again. Nowhere else.
If you use the internet with a VPN switched on and connected, it means that your internet supplier can’t log your traffic, even less share it with anyone else. It also means that all the third-party actors with technology integrated into the various websites you visit can’t sniff out your IP address and use it to track you from one site to another. In other words, if you use a trustworthy VPN service, you block one of the very simplest and most common ways to identify you online.
Does the encrypted VPN tunnel mean that your VPN supplier can’t see your traffic either? No. When you use a VPN service, you switch your trust from your ISP to your VPN provider. However! The big difference between internet service providers and VPN providers is that – unlike the internet service providers– VPN providers aren’t obliged by law (in Sweden and many other countries) to register and log your traffic. That’s why VPN services are able to handle the traffic with your privacy in focus. The problem is that they don’t all do that – so it’s important to think carefully about your choice when it’s time to pick a VPN service.
If your VPN service is handled in a competent, transparent, and honest way, you’ve taken a good decision for your privacy when you switched your trust from your ISP to a VPN provider. Here we go through the things to think about before choosing a VPN service.
You can also use your VPN to change geographic location – and circumvent censorship.
A free internet is also an internet free of censorship. One where you have the freedom to express yourself as you want. One where you have the freedom to communicate with whomever you wish. One where you actually have the right to free information. Your own situation depends very much on your geographical location. You may live in a state that censors particular content, or in a country that has completely forbidden foreign websites and influences.
Since you can use a VPN to change your geographical location, in many cases you can circumvent this type of restriction and censorship. For example you can access media published in a specific country and only intended for its inhabitant, or vice versa. You can get out of a country that doesn’t permit its inhabitants to see a particular type of content. Here you can read more about how we work to contribute to an internet free of censorship.
A free internet is an internet where everyone has the right to free information. You can also use a VPN to change geographical location, access websites that are blocked, and circumvent censorship.
Does the encrypted VPN tunnel make you more secure against bad hackers?
Many VPN services sell themselves by talking up security threats on the internet and how you can protect yourself with their VPNs. They argue that the VPN encryption helps you shut out bad hackers and other evil-minded people who, for example, want to steal passwords and payment information. Above all they claim that it’s much safer to go online with a VPN using a public Wi-Fi network – for example when you’re at work or in a hotel or café. Well, let’s put it like this. They’re painting a bit of an exaggerated picture.
This used to be a relevant argument, when the number of websites that weren’t encrypted was much more widespread. When traffic was sent back and forth openly, making it possible for anybody to see the traffic and – still worse – manipulate it to access things like passwords and what you wrote in emails and conversations. Thankfully today encryption has gained ground, you can look at the address bar yourself when you visit a website. If the address has an S at the end of the http, so it says https:// and if the little padlock beside it is closed, then your connection to the site is encrypted. Nowadays this is the case for most sites.
There are other ways to identify you besides your IP address. There are third-party cookies, browser fingerprints, and many other techniques. This was why we developed Mullvad Browser.
A VPN isn’t the entire solution for privacy. Here’s the kind of monitoring it can’t protect you against.
First, let’s state the obvious: If you have targeted monitoring aimed at you, for example if the government is using advanced spy tools such as Pegasus, then a VPN won’t help. If somebody hacked your hardware, a VPN won’t help either. If you’re a political dissident or a government-critical journalist in an authoritarian country being targeted by those in power, well a trustworthy VPN is a good first step but probably not the only one you need to take.
What about mass surveillance of entire populations? Does a VPN help you all the way? Is a VPN the only thing you need to use to go online without every step you take being registered? Many VPN services make it seem like this is the case, but that isn’t true. Today, mass surveillance is so widespread and utterly absurd that a VPN isn’t enough to achieve personal privacy online. The VPN services claiming this are not telling the truth. For example, today’s data collection uses several methods to identify you (in addition to registering your IP address) when you visit a website. You can be identified via third-party cookies, browser fingerprints, and other types of technology. This is why we’ve developed Mullvad Browser together with The Tor Project.
What should you think about when choosing a VPN provider? Take a look here.
How bad is today’s data collection really? Let’s put it this way: it’s worse than you think.