Wed Jun 4

What is a VPN and how can I use one safely?

Written by Meena Jha, Head Technology and Pedagogy Cluster CML-NET, CQUniversity Australia

“This video is not available in your location”. It’s a message familiar to many people trying to watch global content online. But beneath this frustration lies a deeper question – how do we navigate digital borders safely and ethically?

As our digital lives expand, so too does our desire for access. Maybe you want to see the latest streaming shows before they arrive in your country. Maybe you’re a sports fan wanting to watch live broadcasts of international events. Or perhaps you need to log into your company’s secure intranet while at home or overseas.

Enter the virtual private network (VPN) – a technology that’s become as essential as antivirus software for many. With many commercial and free VPN providers on the market, interest in these services has grown in recent years ^[1].

How does a VPN work?

A VPN ^[2] is like a secure tunnel between your device and the internet. When you use a VPN, your internal traffic is scrambled into unreadable data ^[3] and routed through a remote server, which also masks your real IP address.

Think of it like this: instead of sending a postcard with your return address, you send it in an envelope to a trusted friend overseas who mails it on your behalf. To anyone looking at the envelope, it looks like the message came from your friend and not you.

This technique shields your identity, protects your data from snoopers, and tricks websites into thinking you are browsing from another location.

While often marketed as tools for online privacy ^[4], VPNs have grown popular for another reason: access.

Many people use VPNs to access geo-blocked content, secure their internet activity, work remotely – especially when handling sensitive data ^[5] – and protect against online tracking and targeted advertising.

VPNs are legal, if a bit grey

VPN services are offered by dozens of providers globally. Companies such as NordVPN, ProtonVPN, ExpressVPN and Surfshark offer paid subscriptions with strong security guarantees. Free VPNs also exist but come with caveats (more on this in a moment).

In most countries ^[7], including Australia ^[8], using a VPN is completely legal.

However, what makes it murky is what one might use it for. While using a VPN is legal, engaging in illegal activities while using one remains prohibited.

Streaming services like Netflix or Disney+ license content by region. Using a VPN to access a foreign catalogue may violate their terms of service and potentially be grounds for account suspension.

Australian law does not criminalise accessing geo-blocked content via VPN, but the copyright act does prohibit circumventing “technological protection measures” in certain cases.

The grey area lies in enforcement. Technically, copyright law does ban getting around certain protections. However, the latest advice does not mention ^[9] any cases where regular users have been taken to court for this kind of behaviour.

So far, enforcement has mostly targeted websites and platforms that host or enable large-scale copyright infringement; not everyday viewers who want to watch a show a bit early.

Beware of ‘free’ VPNs

Not all VPNs are created equal. While premium services invest in strong encryption and privacy protections, free VPNs often make money by collecting user data – the very thing you may be trying to avoid ^[10].

Risks of unsafe VPNs include data leaks, injection of ads or trackers into your browsing, and malware and spyware, especially in free mobile apps ^[11] that claim to provide a VPN service.

Using a poorly designed or dishonest VPN is like hiring a bodyguard who sells your location. It might give the impression of safety, but you may actually be more vulnerable than before.

Okay, so how do I choose a VPN?

With so many VPNs available, both free and paid, it can be hard to know which one to trust. If you are considering a VPN, here are five things to look for.

No-log policy ^[12]. A trustworthy VPN should have a strict no-log policy, meaning it does not store any records of your internet activity, connection time or IP address. This ensures even if the VPN provider is hacked, subpoenaed or pressured by a government, they have nothing to hand over.

Strong encryption standards. Encryption is what makes your data unreadable to anyone snooping on your connection, such as hackers on public WiFi or your internet provider. A somewhat technical thing to look out for is AES 256-bit encryption ^[13] – it’s extremely secure and is used by banks and governments.

Independent audits. Reliable VPN services voluntarily undergo third-party audits ^[14] to verify their privacy claims and the security of their infrastructure.

Kill switch. A kill switch is a critical safety feature that automatically blocks internet traffic if the VPN connection drops. This prevents your real IP address and data from being exposed, even momentarily.

Jurisdiction. VPNs are subject to the laws of the country they are based in. The countries in the Five Eyes intelligence alliance ^[15] (Australia, Canada, United Kingdom, United States and New Zealand) may legally compel providers to hand over user data. If a VPN service has a strict no-log policy and does not collect information about what you do online, then even under legal pressure, there is nothing to hand over. So, you are safe.

In an era of growing surveillance, cybercrime and corporate data collection, VPNs are essential tools for reclaiming your online privacy and data.

But like any tool, the effectiveness (and ethics) of VPNs depend on how you use them. Next time you fire up your VPN, ask yourself – am I just dodging a digital border, or actively protecting my online freedom?