You can hardly use social media sites like YouTube without being bombarded by adverts for virtual private networks (VPNs). The supposed benefit of a VPN is that it preserves your privacy and obscures your location so nobody can monitor your online activities. Sensible people might use a VPN to safely access public wifi or to bamboozle the tracking tech used by advertisers. Naughty kids might use a VPN to bypass controls on the school’s wifi while naughty adults might use it to bypass geolocation controls over video streams. However, the VPN provider can see what each user is doing, begging serious questions about how well consumers are shielding their privacy when they select VPN providers they know nothing about. Tech Transparency Project (TTP), a campaign group that lobbies against the abuses of Big Tech, has conducted research into the ownership of the 100 most popular free VPN services on Apple’s US App Store and discovered that 20 are owned by Chinese companies. This means a lot of the internet usage of Americans is potentially visible to China’s state security services.
Per TTP’s news release:
TTP’s investigation found that one in five of the top 100 free virtual private networks in the U.S. App Store during 2024 were surreptitiously owned by Chinese companies, which are obliged to hand over their users’ browsing data to the Chinese government under the country’s national security laws. Several of the apps traced back to Qihoo 360, a firm declared by the Defense Department to be a “Chinese Military Company.” Qihoo did not respond to questions about its app-related holdings.
It is highly unlikely that customers of these services are aware of who is behind them.
The ownership of many appeared deliberately opaque, with several concealing their structure behind layers of offshore shell companies. TTP was able to determine the Chinese ownership of the 20 VPN apps being offered to Apple’s U.S. users by piecing together corporate documents from around the world. None of those apps clearly disclosed their Chinese ownership.
The 20 Chinese VPN apps have been downloaded over 70 million times from US app stores. One was advertised on Facebook and Instagram to users as young as 13. Another was promoted as a method to work around a potential ban of TikTok in the USA. The TikTok ban has been postponed by President Trump to give the Chinese owners of TikTok more time to secure an American buyer, but it is unclear what will happen if they fail to find one. The proposed ban on TikTok is ostensibly motivated by a desire to stop China harvesting data about the online habits of Americans. It would be ironic if the ban encourages many Americans to reveal more of their online activity to Chinese businesses.
The US is not alone in routing data through Chinese businesses. TTP found that 12 of the same Chinese VPN apps were also available in the Apple App Store for France. However you look at the issue, it is unclear how Apple would enforce its requirement that VPN providers “may not sell, use, or disclose to third parties any data for any purpose”. China has a national intelligence law which obliges Chinese companies to assist the work of its spy agencies.
Mounting concerns prompted a group of Republicans to introduce a new Congressional bill that would establish a task force to harden the USA’s resilience to cyber threats posed by China. Jen Easterly, the former Director of the USA’s Cybersecurity and Infrastructure Security Agency, recently talked about China preparing the groundwork for widespread disruption of US civilian services as part of their strategy for future wars.
Telecommunications going down, people falling ill due to polluted water, trains derailed — an everything, everywhere, all-at-once scenario
Some speculate that China will instigate an invasion or blockade of Taiwan before the end of this year, so they can capitalize on the peacekeeping demands placed upon Western countries if there were peace negotiations between Ukraine and Russia, and because of the global economic disruption provoked by Trump’s unpredictable tariffs on trade. Chinese infiltration of US communications networks and infrastructure should be evaluated with this risk in mind. Taiwan’s independence from the mainland government is predicated on a guarantee of US military intervention if China launches a full-on assault. It follows that China will want to damage the USA’s ability to respond in such circumstances. Such weapons would include the disruption of civilian communications and infrastructure, as well as surveillance of government and military staff. TTP is right to challenge the popular belief that VPNs guarantee privacy when so little is understood about who controls VPN providers.
TTP’s analysis of the Chinese firms behind popular VPN apps can be found here.
