TI-2026-061P — The Tunnel That Watched

Classification: MEDIUM · Trust-Transfer Surveillance · "Privacy" VPNs / "No-Log" Confidence: HIGH on the VPN trust model and the Onavo record; MEDIUM on the industry generalisations (free-VPN monetisation, no-log leaks, ownership). TLP:WHITE — public reporting, antitrust filings, public corporate structure. Series: The Fake Umbrella — Part P. P is for "Privacy." The one word so on-your-side that no one checks it — and the tool that uses your love of privacy to talk you into routing your entire life through a stranger. Facts are facts. They are good for some and bad for others. You decide.

The seed: the tunnel has an owner

A VPN — a "virtual private network" — is sold as a tunnel: your traffic goes in one end, invisible to the coffee-shop Wi-Fi and your internet provider, and comes out the other, safe. That much is true, and for specific problems (a hostile local network, a censoring government) it is genuinely useful. But look at the geometry of it, because the geometry is the whole letter: a VPN does not make your traffic invisible. It makes it invisible to everyone except the VPN. Every site you visit, every app that phones home, every request you make — all of it — now flows through one company's servers, in the clear to them, in one place.

So a "privacy VPN" does not remove the watcher. It moves it — from your ISP, whom you did not choose, to the VPN, whom you did — and asks you to believe the new watcher is better. The only thing protecting you from total surveillance by that new, single, all-seeing party is its promise not to look: the "no-log policy." And a promise you cannot verify, made by a company you may not be able to identify, whose "free" version has to make money somehow, is not a privacy guarantee. It is faith, sold as a product. Part P is what happens when the faith is misplaced — and the record shows it is misplaced a lot.

Exhibit A: the "privacy" VPN that was the surveillance

You do not have to theorise about the worst case. It already happened, at the largest possible scale, and it has a name: Onavo.

Facebook acquired Onavo and offered "Onavo Protect," a free VPN marketed to users as protection — a "data-saver" that would keep them safe and watch their usage for their benefit. What it actually did was use the VPN's total visibility into a user's traffic to tell Facebook which apps that user ran and how much — intelligence Facebook used to see rivals coming and to time acquisitions (the WhatsApp and Snapchat context is well documented). Apple threw Onavo out of the App Store in 2018 for violating its data-collection rules. Later US antitrust filings described a related effort, chillingly nicknamed "Project Ghostbusters," to intercept and decrypt competitors' traffic.

Read what that is. A product whose entire brand was privacy was, in function, one of the most invasive consumer-surveillance tools of its era — pointed at the very users it promised to protect, by the company least trusted with data on Earth, using the exact total-visibility property that every VPN has by design. Onavo is not the exception that proves VPNs are fine. It is the demonstration of what the VPN architecture lets a dishonest operator do — and how good the word "privacy" is at getting people to install it.

The economics, the promise, and the owner

Onavo was the extreme; the everyday version is quieter and structural.

• "Free" means you are the product. A VPN is expensive to run — servers, bandwidth, everywhere. A free one has to recoup that somehow, and repeatedly the "somehow" is the obvious one: logging your traffic and selling it, or injecting tracking. The user who installed a free "privacy" VPN to stop being tracked has often simply changed who tracks them, and paid with the very data they were trying to protect.
• "No-log" is unverifiable — and has been broken. The core promise cannot be checked by the user; you are trusting an assertion. And the assertion has failed publicly: several providers advertising "zero-log" policies have been caught retaining data, including a 2020 episode in which multiple "no-log" VPNs left databases of user logs — browsing, IPs, even credentials — exposed for anyone to find. The logs they swore did not exist were sitting on the open internet.
• You may not know who owns the tunnel. VPN ownership is often buried in holding companies. Most strikingly, Kape Technologies came to own several major consumer VPNs and popular "best VPN" review sites — a structure in which the same parent sells the product and grades it. The person carefully choosing "the most private VPN" from a recommendation may be trusting a company that owns both the recommendation and their traffic.

Three different failure modes — economic, epistemic, structural — and all of them route through the same soft word on the download button.

The seven questions

Who is this? Consumer "privacy" VPN providers — from Facebook's Onavo at the dishonest extreme to free-VPN operators, "no-log" providers with broken promises, and opaque owners like Kape.

Why did it attack? No attack — an interposition. The VPN inserts itself as the single point through which all your traffic must pass, then depends on trust for what it does there.

Who does it claim to be? Your privacy — the tool that hides you. The most on-your-side possible framing.

Whom is it related to? The data brokers and ad economy (061D — where a logging VPN's take goes) and the unverifiable-claim problem of "anonymized" fingerprinting (061F — "no-log" is "anonymized" in a tunnel).

Where is the money? Subscriptions for the honest ones; logging, selling, tracking, or competitive intelligence (Onavo) for the dishonest ones. When it is free, the money is you.

What is the official anchor? A privacy policy and a "no-log" claim — an unauditable promise, sometimes from an unidentifiable owner.

What if it is not who it claims? Sometimes it is exactly not — Onavo was surveillance wearing the word "protect." The finding is that the VPN architecture requires you to trust one all-seeing party, so the industry's honesty is only ever as good as its least honest, hardest-to-identify operator.

What if…

• What if VPNs genuinely protect me? Against a specific threat — a snooping local network, a censoring ISP, geoblocking — a reputable one genuinely does, and this dossier says so plainly. But it protects you by making the VPN the thing you now have to trust with everything, which is a real improvement only if that trust is well-placed and verifiable, and often it is neither.
• What if I pay for a reputable, audited one? Then you have made the trade sensibly — a paid provider with a published independent audit and a clear owner is the honest end of this market, and it is a legitimate tool for the right threat model. That good case is real; it is also the fig leaf the whole "privacy VPN" category hides behind, most of which is not that.
• What if a VPN stops ad tracking? Mostly it does not — the tracking that follows most people (cookies, fingerprints, logged-in accounts, the 061D/061F machinery) largely survives a VPN, because it does not depend on your IP. The word "privacy" implies a completeness the tool does not deliver.

Steelman: the strongest defence — and why it fails

Built at full strength:

"VPNs are a mainstream, legitimate privacy tool. They protect users on untrusted networks, defeat ISP surveillance and censorship, and reputable providers publish independent no-log audits and clear ownership. Blaming the whole category for Onavo (which Apple removed) or a few free bad actors is unfair — the good providers are exactly the privacy defence users need."

Where it breaks:

• "Reputable providers exist" concedes the category's problem. That the market must be navigated by distinguishing the honest few from the dishonest many is the finding: the architecture forces total trust in one party, and the word "privacy" is used to lower the scrutiny that trust demands. The audited good actor is the exception you have to know to look for.
• "Onavo was removed" understates it. Onavo ran at massive scale for years, doing the opposite of its promise, from the world's biggest data company, before it was stopped — and only by Apple, not by any property of VPNs. It is proof of what the design permits, not a reassurance that the design is safe.
• "No-log audits" help but don't verify continuously. A point-in-time audit is a real signal and better than nothing, but it is not the user watching the logs; the 2020 leaks and the general unverifiability mean "no-log" remains, ultimately, a claim you are trusting.
• The one true thing: a paid, independently-audited, clearly-owned VPN, used for the specific threats it actually addresses, is a legitimate and useful privacy tool — genuinely so, and recommended for those cases. Its honesty lives in the audit, the ownership, and the payment model. The moment those are absent — a free VPN, an unverifiable promise, a hidden owner — "privacy" is just the word that got you to route everything through someone you can't see, and Onavo is what the worst version of that looks like.

Verdict: paid, audited, transparent VPNs for specific threats are legitimate. The "privacy VPN" category as marketed — total trust in one unauditable party, sold with the word "privacy," monetised by surveillance at its (Onavo-scale) worst — is MEDIUM, and dangerous precisely because it recruits the privacy-conscious. "Privacy" is not a mitigation here. It is the bait. Confidence: HIGH on the model and Onavo; MEDIUM on the generalisations.

Read between the lines

This letter's word is special because it is not a euphemism for the act — it is the name of the exact thing being taken. "Analytics" hid tracking; "lawful" hid a wiretap; but "privacy" hides the sale of privacy itself, which is a kind of perfection. The move works because desire is a lever: the more you want privacy, the more motivated you are to install the thing that promises it, and the more completely you then hand your traffic to whoever made the promise. So the tool weaponises your own vigilance — it converts the very impulse that should make you cautious into the reason you comply. And the tell is who reaches for it: the person careful enough to seek out a "privacy VPN" is, by definition, someone with something to protect — a journalist, an activist, a dissident, a person hiding from an abuser — which means the "privacy" label does not just mislead the average user; it draws the highest-stakes users into concentrating their entire, most sensitive traffic in a single third party they cannot audit. The bait is precisely calibrated to catch the people who can least afford to be wrong.

The human layer

A dissident in a country that jails dissidents does the responsible thing: installs a VPN, because everyone told him a VPN is how you stay safe. He routes his email to comrades, his draft articles, his contacts, his real location — all of it — through the one tunnel he was told would hide him. And now the single most complete picture of his resistance does not sit scattered across services that each see a fragment; it sits, whole, in one company's logs — a company he chose from a review he trusted, owned by a parent he never heard of, in a jurisdiction he did not check, protected only by a "no-log" promise he has no way to test. If that promise holds and that company is honest, the tool worked and he is safer. If it does not — if the logs exist after all, if the owner cooperates with the wrong government, if the free tier sold him — then he did not protect himself; he assembled his own dossier and handed it to a stranger, because the button said "privacy" and he, of all people, needed to believe it. That is the quiet cruelty of Part P: it fails hardest for exactly the people who reached for it hardest, and it used their care as the hook.

Defense — trust the audit and the invoice, not the word

(1) Pay, and pick an audited, clearly-owned provider. If you need a VPN, a paid one with a published independent no-log audit and a transparent owner is the honest end of the market; a free "privacy" VPN should be assumed to monetise you until proven otherwise. (2) Match the tool to the real threat. A VPN defeats local-network and ISP snooping and censorship; it does not defeat account-based, cookie, or fingerprint tracking — so do not let "privacy" imply a completeness it lacks, and pair it with the right tools (Tor for anonymity, browser hardening for tracking). (3) Find out who owns the tunnel and the review. Before trusting a "best VPN" list, check whether the reviewer and the product share a parent (the Kape pattern); before trusting a VPN, find its ultimate owner and jurisdiction. (4) For the highest-stakes users: treat "no-log" as unverified by default, minimise what any single provider can see, and remember Onavo — that the product most eager to sell you "protection" has, at least once, been the surveillance itself.

Investigation metadata

Next — TI-2026-061Q: Q is for "QUANTUM" — the state programs (NSA QUANTUM/FoxAcid) that sit on the internet's backbone and inject exploits into ordinary connections, turning the network itself into the delivery mechanism.

Every other word in this series hid an act. This one is the name of the thing being sold off — privacy — used to talk you into pouring your whole life through a single stranger's pipe, on the strength of a promise you can't check, sometimes from an owner you can't name. And it works best on the people who care most, which is why a dissident's entire resistance can end up whole, in one company's logs, because the button said "protect." The tunnel is real. So is its owner. Facts are facts. They are good for some and bad for others. You decide.