Mullvad: States Race to Out-Surveil Each Other, and the NSA Still Leads

VPN provider Mullvad argues that democratic and authoritarian governments alike are locked in a competition over who can conduct the most sweeping mass surveillance, and that the United States and its Fourteen Eyes partners remain the clear frontrunners. The company draws a sharp line between targeted surveillance—justified by reasonable suspicion, proportionality, and independent court oversight—and indiscriminate bulk collection, which it calls a human-rights violation that is also ineffective against the threats used to justify it.

Much of the piece rests on Edward Snowden’s 2013 disclosures, which Mullvad contends remain the best available picture of US capabilities more than a decade later. Section 702 of FISA lets agencies like the NSA, FBI, and CIA collect data without a warrant under the pretext of tracking foreign targets, but in practice sweeps up Americans too. The PRISM program pulled email, photos, chats, and cloud data from major tech firms including Google, Microsoft, Apple, and Facebook—often via near-direct system access—while Upstream tapped the physical internet backbone through telecom carriers like AT&T and router makers that built monitoring into their hardware. The XKeyscore database gave analysts searchable access to ‘nearly everything a typical user does on the internet,’ from inbox contents to browsing history, without sign-off from a court or even a supervisor.

Mullvad frames all of this as the founding rationale for its business: it launched in 2009 in response to expanding surveillance law and positions privacy protections as a check on state power that exists precisely because governments change and abuse authority. The takeaway for a technical reader is less new revelation than a reminder that the post-Snowden legal architecture—including the periodically renewed Section 702—remains largely intact, with the surveillance capacity it enables still operational today.