- Security researchers found Russian network fingerprints on 12 free VPNs available on Google and Apple's app stores, and Chinese traces on six
- Five of these VPNs are also thought to have ties with a Shanghai-based firm believed to have links with the Chinese military
- While network fingerprints don’t necessarily signal Chinese or Russian ownership, experts advise caution
Twelve free VPN services available on the official Google Play and Apple App Store may have links with Russia, and six with China.
These are the findings from security researchers at Comparitech, who analyzed 24 VPNs and found Russian and Chinese network fingerprints on a total of 12 apps. Two of them (Turbo VPN, VPN Proxy Master) also include Chinese or Russian SDKs (software development kits) that, according to experts, "are clear indicators that the SDK was intentionally bundled into the app."
Experts build on the work of the team at the Tech Transparency Project, which in April uncovered that millions of free VPN users across 20 apps may have sent their data to China without knowing it. On that occasion, experts found that Turbo VPN and VPN Proxy Master, alongside three additional services (Thunder VPN, Snap VPN, and Signal Secure VPN), have ties with a Shanghai-based firm believed to have links with the Chinese military.
Despite these traces not necessarily signaling Russia or China's ownership, experts advise current users to exercise caution regarding their data privacy.
"China and Russia both force domestically-owned VPNs to register with the government and adhere to local laws, which may impact user privacy. For this reason, no Chinese or Russian VPN can offer a trustworthy 'no-logs' service, which is the only type of VPN we recommend," wrote researchers.
Which apps are impacted?
The impacted VPN apps can be divided into three groups:
- Six communicate with Chinese domains: Signal Secure VPN (Android), Turbo VPN (Android), VPN Proxy Master (Android), Snap VPN (Android), Now VPN (iOS), and Ostrich VPN (iOS)
- Eight Android apps communicate with Russian IP addresses: QuarkVPN, VPNify, Signal Secure VPN, Turbo VPN, VPN Proxy Master, Snap VPN, VPN Free, and Proxy Master
- Four iOS apps communicate with Russian domains: NowVPN, WireVPN, FastVPN Super, VPN - Fast VPN Super with Apple.com domains hosted in Russia, but only the latter two have other third-party Russian domains.
Four Android VPN apps (Signal Secure VPN, Turbo VPN, VPN Proxy Master, and Snap VPN) have links with both Chinese and Russian domains.
All in all, "Apple doesn’t list any of the VPN apps that, on their Android versions, communicate with third-party Russian domains. Based on this, Apple appears to be more strict about removing Russia-linked VPNs than China-linked ones," experts wrote.
What does it mean for your privacy?
While the best VPN services promise to boost online privacy by encrypting your online communications and working with strict no-log policies, both China and Russia impose greater control and data retention requirements on domestic VPNs.
As mentioned earlier, the traces that researchers found don't necessarily indicate Chinese and Russian ownership. Yet, "it may be an indicator of potential ties, especially when combined with other signals," such as a Chinese or Russian SDK, publisher metadata, or similar behavior.
On a practical level, it means that the app may route some data or logs via servers located either in China or Russia. Foreign SDKs, especially, could signal deeper control or development origin, according to experts.
As a rule of thumb, you should avoid unverified free VPN apps, regardless of their ownership, as they can make you vulnerable to all sorts of privacy and security risks – from invasive ad-tracking to malware and even foreign surveillance.
If you're looking for a secure freebie, I recommend checking our up-to-date free VPN guide, with Privado VPN, Proton VPN, and Windscribe VPN being today's top picks. If you're willing to go premium, NordVPN is TechRadar's top-rated service at the time of writing.
You might also like
You must confirm your public display name before commenting
Please logout and then login again, you will then be prompted to enter your display name.