Privacy Project Nym Is Building an ‘NSA-Proof’ VPN

The current generation of virtual private networks (VPNs) has a problem, according to Nym CEO Harry Halpin.

“They basically say, ‘Trust us, we’re not going to log or copy your data’,” he said onstage at Web Summit, “but actually they can. You just have to trust them.” Independent audits can be faked, he added, or are “not particularly trustworthy themselves.”

“Two or three large VPN companies actually run most user-facing VPNs,” he explained, adding that because they’re centralized, “you’re not really making your connection private in any meaningful sense—you’re just trusting some other company with all of your network data.”

Nym is aiming to solve that problem with its own decentralized VPN (dVPN), which was designed to be “NSA-proof.”

“A few years ago, I worked for the French government after Snowden, and they said, ‘Can we make a VPN that even the NSA can’t crack?’” Halpin said. The project was subsequently spun out into a startup that, he joked, has produced “the world’s most private and slowest VPN.”

Where a traditional VPN routes traffic through another computer, Halpin explained, “we take your traffic and we encrypt each packet separately, and send each packet through a different network of computers.” Each packet is routed separately, and mixed with other packets so the order is jumbled.

On top of that, NymVPN mixes fake traffic in with the packets, and is fully decentralized, “so there’s no single server or even single company that controls the VPN, and any payments are unlinkable,” Halpin said. “That’s all quite new tech, and it does make things slower,” he added.

In order to make NymVPN suitable for mainstream users, the service offers two security tiers that users can flip between: a high-security, slower “5-hop” option using Nym’s mixnet, and a less secure but faster “2-hop” option with onion encryption for “people that just want to stream cat videos,” Halpin said.

The slower mixnet mode, Halpin said, is intended for “people who are in a high-security, high-privacy situation,” like Nym security consultant Chelsea Manning, who was jailed after leaking classified documents to WikiLeaks. Manning joined Nym after having “more or less thought of the same concept while in jail,” Halpin said.

Manning explained that together with a colleague working at privacy-centric browser Brave, she originally mapped out a plan to upgrade privacy project Tor and whistleblower platform SecureDrop. “We knew that even then, thinking into the 2020s and the 2030s, we were going to have to innovate and develop a mixnet, and add decoy traffic into the network,” she said. Manning then teamed up with Halpin and economist Claudia Diaz to develop the reward system underpinning Nym.

“If we’re successful and we’re able to fund this venture, we should be able to develop the most secure consumer-level tool that’s ever been conceived of,” she said.

With NymVPN now available for public testing on a free 30-day trial, the two are planning the next steps for the network. Future plans include creating a standard for hardware acceleration on the network, setting the stage for the integration of technologies like secure enclaves, Manning said.

“Right now, we have to choose between privacy and speed, but we would like everyone to be anonymous, totally private by default, and for that to be the same speed as a normal VPN,” Halpin said.

And has the NSA been in touch?

“I’m not aware of that,” said Manning. “I’m sure that they’re interested.”

Edited by Andrew Hayward