A journalist covering a sensitive story doesn't have the same threat model as someone trying to watch foreign sports coverage. The stakes are different: exposed sources, intercepted communications, and seized material carry consequences beyond an inconvenient error message.
A VPN fits into that context, but not as a catch-all solution. It addresses one layer of the problem — network exposure — and does little about the rest. Knowing precisely what it protects, and what it doesn't, is more useful than a general assurance that it helps.
What a VPN Does for Network Traffic
A VPN creates an encrypted connection between your device and a server operated by the VPN provider. All your traffic travels through this tunnel before reaching the internet. Two things follow from this: your ISP sees only that you're connected to a VPN server, not which sites you visit or what you send; and sites you connect to see the VPN server's IP address, not your own.
For a journalist, this matters most when working from networks you don't control. A hotel connection in an unfamiliar country, a conference venue's Wi-Fi, or a public network in a location where surveillance is plausible — these are environments where encrypting your traffic at the device level has direct value.
Protecting Research from Network Observers
Research often involves visiting sources, documents, agencies, and forums that, taken together, reveal what you're investigating. On an unencrypted connection, an ISP or local network administrator sees every domain you query and IP address you contact. They can't read HTTPS content, but the pattern of connections — the metadata — can sketch the outline of a story.
A VPN shifts that visibility. Your ISP sees connections to a VPN server. The research pattern is no longer visible to anyone observing the network between you and the internet.
This protection stops at the VPN server, though. Traffic between the VPN server and the sites you visit is outside the tunnel. And the VPN provider itself can see your activity unless the provider genuinely retains no logs — which leads to the question of what to look for in a provider.
Logging Policies and Provider Jurisdiction
A VPN provider that keeps detailed connection logs can be compelled to hand them over. A provider that retains nothing has nothing to disclose. The difference is significant for anyone doing sensitive work.
Independently audited no-logs claims carry more weight than self-reported ones. Equally important is the legal jurisdiction the provider operates under. Providers incorporated in countries with broad mandatory data-retention laws face requirements that may conflict with user privacy regardless of their stated policy.
Some journalists prefer services that eliminate the user-record problem entirely. A no-login VPN that accepts cryptocurrency — where no account is created and no payment identity is attached — leaves no record to subpoena even if a court order arrives. Services like TaoFlow are built on that premise.
What a VPN Cannot Protect
A VPN operates at the network level. It does nothing for threats that don't involve network observation:
- If you access sensitive material while logged into a personal account, that account's metadata and activity remain visible to the service provider.
- Browser fingerprinting, cookies, and persistent identifiers can track you across sessions regardless of VPN use.
- If your device is compromised with malware, the VPN tunnel carries the compromised traffic just as well as legitimate traffic.
- For communication with sources, a VPN is not a substitute for end-to-end encrypted tools. Signal for source conversations; SecureDrop for receiving documents — these are purpose-built for that layer. A VPN does not provide equivalent protection for communications.
The distinction matters because conflating network-layer protection with device or application-layer security creates a false sense of coverage.
DNS Leaks and Practical Configuration
One failure mode worth knowing: DNS leaks. When your device queries a domain name, that query normally goes to a DNS resolver — often your ISP's. If a VPN client doesn't route DNS queries through the tunnel, those queries continue going to your ISP resolver even while your other traffic is encrypted. Your ISP can then see the domains you're looking up.
Most modern VPN clients prevent this by default, but it's worth verifying. Many clients include a built-in leak test; external leak-check tools are also available. Run one after connecting to confirm DNS queries are going through the tunnel.
What This Means for You
If you're a journalist, researcher, or anyone handling sensitive source material:
Use a VPN on networks you don't control, particularly when accessing sensitive material or communicating in any form from an untrusted environment. It reduces what network observers — ISPs, hotel operators, local surveillance infrastructure — can see about your activity.
Choose a provider with a verified no-logs policy and consider jurisdiction carefully. A provider that can't hand over logs because it doesn't keep them is meaningfully different from one that promises not to.
Pair a VPN with end-to-end encrypted communication tools. A VPN protects the traffic between your device and the VPN server. It doesn't protect the content of messages that pass through applications without end-to-end encryption.
Check for DNS leaks. Confirm after connecting that DNS queries are routing through the tunnel, not reaching your ISP's resolver directly.
Don't extend the VPN's protection to things it doesn't cover. Logged-in accounts, device security, and communication tool choices are separate layers that require separate attention.
A VPN is a specific tool for a specific problem. For journalists and researchers, that problem — keeping network observers from seeing what you're looking at — is a real one worth solving. The tools for the other layers are different, and none of them can be skipped.