5, 9 and 14 Eyes: Who Belongs, What Gets Shared and What It Means for a VPN

These names describe three nested groups of countries whose signals-intelligence agencies exchange intercepted data. Only the innermost circle rests on a publicly acknowledged treaty; the wider rings are known chiefly from documents Edward Snowden leaked. For VPN users the practical point is narrower: what matters is the law of the country where the provider is registered, because that law decides what the company can be forced to keep and surrender.

Who sits in each circle

The nickname comes from a classification marking stamped on papers reserved for the five founding agencies, of the "AUS/CAN/NZ/UK/US EYES ONLY" kind. The NSA has declassified the founding UKUSA papers, and the five governments admit the partnership openly. No published treaty exists for the two outer rings, so any membership list is a reconstruction from leaked files and reporting on them. An internal GCHQ document quoted by The Guardian noted that Germany resented being left out of the 9-Eyes group.

What the leaks showed about sharing

Access narrows as the circle widens

Inside the core five, agencies pool nearly everything: raw intercepts, funding, technical systems and staff. The Guardian's November 2013 analysis of the Snowden files describes this layering, notes that partners beyond the core five get a more restricted exchange, and mentions a further tier, sometimes called 41 Eyes, that adds the wider allied coalition in Afghanistan.

Partner status buys no immunity

According to Der Spiegel's 2013 report on a leaked NSA paper, the agency stated that it "can, and often do[es], target the signals of most 3rd party foreign partners". Third-party partners are not shielded from NSA targeting.

Why agencies lean on each other

The intelligence agencies themselves face tight limits on watching their own citizens and far looser ones on foreigners. Critics argue the exchange lets each partner collect what the others may not, then hand it over. A Canadian Federal Court judge, Richard Mosley, lent the claim weight in 2013: he rebuked CSIS for asking Five Eyes partners to intercept Canadians abroad without telling the court.

What the alliances mean for a VPN company

A provider falls under the laws of the state where it is registered: data-retention orders, production orders for stored data, gag orders. In the US, FISA Section 702 lets the government compel American service providers to assist in collecting communications of foreigners abroad. The alliance adds a single step: data one agency has already lawfully obtained may be passed onward to partner agencies. A foreign agency, meanwhile, has no authority to serve orders on a company outside its own country.

What they do not mean

Sitting outside all fourteen states does not put a provider outside surveillance. Every country keeps its own interception rules, and Privacy International documents a further "Tier B" of focused cooperation, including states outside the fourteen. The exit server obeys the law where the hardware stands, while the account, payment and logs policy stay with the company's home country; moving your exit node does not move the jurisdiction. Cable taps and exchange points are indifferent to incorporation anyway; there your shield is the tunnel's encryption and a no-logs policy that limits what any agency can obtain.

How VPNRadarLab weighs the alliance

The alliance counts as one small criterion inside the privacy sub-score; the exact scale sits in the VPN jurisdiction hub. If you want a ready shortlist, the ranking of VPNs based outside the 14 Eyes covers 204 providers, 137 of them with enough published data to make the main ranking.

FAQ

Is Switzerland in the 14 Eyes?

No. It belongs to none of the three circles, but Privacy International lists it among the "Tier B" states with focused cooperation on computer network exploitation.

Are the Five Eyes still active?

Yes. All five governments acknowledge the partnership in public.

Should a 14 Eyes base rule a VPN out?

No. Read the logging policy first, check whether an independent auditor has tested it, and only then look at the flag. A company that never states where it is registered gives you nothing to judge; treat it as you would a Five Eyes base.

The short version

The acknowledged core is Five Eyes, the group of five states sharing raw intelligence; Nine Eyes and Fourteen Eyes are looser rings reconstructed from the Snowden leaks, and even partners can be targeted by the NSA. A VPN company's obligations come from its home law; the alliances mainly determine where already-collected data may travel. Read the policy, look for an audit, then check the registration country.