John Mason
John Mason
Last updated:

In this article, I’ll share the differences between different alliances (4 Eyes, 9 Eyes and 14 Eyes) as well as how it affects your anonymity when using a VPN.

This article will discuss available VPNs in relation to the 5 Eyes, the 9 Eyes and the 14 Eyes government surveillance alliances.

Encryption is the only way to protect private communications. While there are encrypted messaging systems that can be used for direct correspondence, virtual private networks (VPNs, also based on encryption) are the best tools for hiding internet activity, such as which websites are visited. Again, there are valid reasons to do so: to protect the privacy of religion, sexual orientation and sensitive medical conditions; all of which can be inferred from visited websites.

Background

During the second world war, US and UK intelligence agencies worked closely on code-breaking. After the war, the UK center at Bletchley Park evolved into the Government Communications Headquarters (GCHQ). The American service evolved into the National Security Agency (NSA). In 1946, the working relationship between the two countries was formalized in the UKUSA agreement. It worked on signals intelligence (SIGINT); that is, the interception and analysis of adversarial telecommunications.

In order to provide global coverage for communications interception, Australia, New Zealand and Australia joined the UK and the USA – and became known as the Five Eyes.

However, such is the NSA’s global dominance of intelligence gathering, other countries have sought to cooperate in return for specific ‘threat’ information from the NSA. This has led to other SIGINT groupings: the 9 Eyes and the 14 Eyes.

The operation of these intelligence agencies was long kept secret. As global communications have increased – and as perceived threats have grown (first in the Cold War between east and west and more recently in the ‘war on terror’), the 5 Eyes in particular began to secretly use technology to gather everything for later analysis. GCHQ, for example, had a secret project called Mastering the Internet. None of this was publicly known.

In 2013, NSA whistleblower Edward Snowden leaked thousands of top secret NSA and GCHQ documents showing, for the first time, the extent to which national governments spy on everybody. It is always done in the name of ‘national security’, and both the relevant agencies and their governments insist on their right to do so.

5 Eyes

5 Eyes Alliance Flags

  1. United States
  2. United Kingdom
  3. Canada
  4. Australia
  5. New Zealand

The Five Eyes or FVEY Alliance is an extension of the UKUSA Agreement, the official name given in 1946 to what had begun as an informal agreement between the UK and USA in 1941. While it was originally a treaty to share critical signals intelligence, after the second world war, over the cold war and the war on terror, the agreement grew to include Canada, Australia and New Zealand; and also grew in scope as technology advanced. Snowden’s revelations brought to light how these agreements are being used to collect and share data on countries’ own citizens, and how laws protecting people from being spied on by their own government can be circumvented by allowing a cooperative foreign power to do it and then share the data.

When choosing a VPN – especially for a citizen of a 5 Eyes country – the best option for privacy is to be found outside of the Eyes alliances. Many VPN providers store data, and as with all things online no security measures are impregnable. VPN users must be aware that if their VPN service is registered in a 5 Eyes country, it falls under the jurisdiction of that country’s surveillance agency – complete with all the legal rights and tools to access any data held by or stored on that network.

It’s also important to remember the significance of allies and cooperative countries; nations which are not explicitly part of the 5, 9 or 14 Eyes groups can still be cooperative with requests for data. America’s Pacific allies, like Singapore, South Korea and Japan have a close relationship with the 5 Eyes, and Israel is known to work closely with the NSA. The British Overseas Territories, as well, have legal obligations to the UK and may be required to share intelligence or surveillance information even if they operate independently.

VPNs under the jurisdiction of 5 Eyes countries:

  • Celo (Australia)
  • VPNAUS (Australia)
  • VPNSecure (Australia)
  • Blockless (Canada)
  • GetFlix (Canada)
  • SurfEasy (Canada)
  • TunnelBear (Canada)
  • UnoTelly (Canada)
  • RogueVPN (Canada)
  • VPN Land (Canada)
  • WindScribe (Canada)
  • Betternet (Canada)
  • VPNUK (UK)
  • Flow VPN (UK)
  • HideMyAss (UK)
  • LibertyShield (UK)
  • My Expat Network (UK)
  • OverPlay (UK)
  • TorVPN (UK)
  • TotalVPN (UK)
  • TVWhenAway (UK)
  • VPN.sh (UK)
  • WorldVPN (UK)
  • ZoogVPN (UK)
  • TGVPN (UK)
  • AceVPN (USA)
  • Anonymizer (USA)
  • BTGuard (USA)
  • Cloak (USA)
  • CryptoHippie (USA)
  • FlyVPN (USA)
  • FrostVPN (USA)
  • GoTrusted (USA)
  • HideIPVPN (USA)
  • Hotspot Shield (USA)
  • IPinator (USA)
  • IPVanish (USA)
  • LibertyVPN (USA)
  • LiquidVPN (USA)
  • MyIP.io (USA)
  • MyVPN.Pro (USA)
  • Newshosting (USA)
  • OctaneVPN (USA)
  • Private Internet Access (USA)
  • PrivateTunnel (USA)
  • Spotflux (USA)
  • Norton WiFi Privacy (USA)
  • RA4W VPN (USA)
  • SlickVPN (USA)
  • SunVPN (USA)
  • SuperVPN (USA)
  • TorGuard (USA)
  • Tunnelr (USA)
  • UnSpyable (USA)
  • VikingVPN (USA)
  • VPN Master (USA)
  • VPN Unlimited (USA)
  • VPNJack (USA)
  • VPNMe (USA)
  • WiTopia (USA)
  • CrypticVPN (USA)
  • Hide My IP (USA)
  • Unseen Online (USA)
  • AnonVPN (USA)
  • FoxyProxy (USA)
  • NetShade (USA)
  • IntroVPN (USA)
  • GhostPath (USA)
  • disconnect.me (USA)
  • Speedify (USA)

9 Eyes

9 Eyes Alliance

5 eyes, plus:

  1. Denmark
  2. France
  3. Netherlands
  4. Norway

The 9 Eyes alliance is an extension of 5 Eyes, including the original 5 – USA, UK, Canada, Australia and New Zealand – as well as Denmark, France, The Netherlands and Norway. While 9 Eyes countries don’t have such an intimate level of cooperation and mutual information sharing as the core 5 Eyes countries, there is still extensive data sharing, especially to the US.

Whereas FVEY allows a mutual access to citizens’ data across the participating countries, the 9 Eyes countries have a less equal role. Programs like RAMPART-A, reported in Denmark’s Dagbladet Information and The Intercept, provide the NSA access to key communication networks and allow it to intercept almost all forms of digital communication – telephone, fax, e-mail, internet chats and VoIP services, including data from VPNs originating in the participating country.

In exchange, the foreign partner is granted access to resources, equipment and assistance from the NSA to surveil the data entering and leaving the country. This is granted on condition that the 9 Eyes agencies will not collect any data on US citizens, leaving the NSA with the ‘better deal’, but more importantly meaning that citizens of the participating countries can expect to have their data accessible to both their own government and those of the 5 Eyes alliance.

While 9 Eyes countries have a somewhat more restrictive relationship than the 5 Eyes countries do, there is still extensive cooperation and data sharing, and it’s a safe bet that any information that Denmark, France, Norway or The Netherlands have access to is also accessible to the NSA. It’s especially important for VPN users to be aware that RAMPART-A and similar schemes allow for the collection of VPN data, greatly compromising the privacy and security of VPNs based in these countries.

VPNs under the jurisdiction of 9 Eyes countries:

  • BeeVPN (Denmark)
  • CitizenVPN (Denmark)
  • Unlocator (Denmark)
  • ActiVPN (France)
  • ProXPN (NL)
  • ShadeYou (NL)
  • VPN4All (NL)
  • WASEL Pro (NL)
  • WifiMask (NL)
  • RootVPN (NL)
  • GooseVPN (NL)
  • Opera’s integrated browser VPN (Norway)

14 Eyes

14 Eyes Alliance

9 eyes, plus:

  • Germany
  • Belgium
  • Italy
  • Spain
  • Sweden

The 14 Eyes alliance is another layer of the Eyes groups, including all previous countries of the 5 and 9 Eyes as well as Germany, Belgium, Italy, Spain and Sweden. 14 Eyes is one more step removed from the close cooperation of the 5 and 9 Eyes alliances, to the point that a Belgian telecommunications company has been targeted in a cyber attack by GCHQ.

Although the 14 Eyes countries have a more distant working relationship, the alliance is more officially recognized than the 9 Eyes group, and Snowden’s documents identify the alliance as SIGINT Seniors Europe, or SSEUR. The exact nature of the agreement between the participating countries is less clear than the 9 Eyes alliance, but it is known that at least Sweden and Germany have access to the NSA’s XKEYSCORE, an internet data analysis and surveillance tool.

Sweden has even informally been called ‘the Sixth Eye’. Its importance to the NSA derives from the amount of eastern European and Russian traffic that passes through the country.

Even if the 14 Eyes countries do not, in general, have as close ties to the NSA as the 9 Eyes countries do, users in the participating countries should still regard their data as vulnerable and, if not directly shared with the US, at least likely to be easily obtained by 5 Eyes countries. 14 Eyes governments are very likely to be compliant with requests made by the NSA and other surveillance agencies, so a VPN from a 14 Eyes country will not offer full protection, especially if the VPN provider stores browsing data.

VPNs under the jurisdiction of 14 Eyes countries:

  • ChillGlobal (Germany)
  • GoVPN (Germany)
  • internetz.me (Germany)
  • Steganos (Germany)
  • Zenmate (Germany)
  • Avira Phantom VPN (Germany)
  • traceless.me (Germany)
  • AirVPN (Italy)
  • AzireVPN (Sweden)
  • FrootVPN (Sweden)
  • Integrity.st (Sweden)
  • IPredator (Sweden)
  • Mullvad (Sweden)
  • OVPN.com (Sweden)
  • PrivateVPN (Sweden)
  • PRQ (Sweden)

Why does 5 / 9 / 14 Eyes matter to VPN users?

For anyone considering the use of a VPN, the privacy of their actions online is clearly a concern. While a VPN can certainly help to preserve browsing privacy and protect your data from advertisers and malicious agents, they are not the be-all and end-all of online anonymity. While a VPN offers a good deal of privacy and protection from external agents, VPN providers can still access and store your data and browsing details internally. Any VPN provider in a 5, 9 or 14 Eyes jurisdiction can be legally compelled to provide whatever stored data they have to their country’s intelligence agencies, and often have frameworks in place to bypass the need to ask – frameworks which can also be exploited by malicious third parties.

This is perhaps especially important for users in 5 Eyes countries; the UK’s Investigatory Powers Act 2016 gives sweeping powers to government agencies, granting the rights to access to users’ personal data without warrant; and ISPs in the United States have recently been given the right to record and sell user activity to any third party. Awareness of which jurisdiction a VPN provider falls under is vital for any VPN user with concerns about protecting their data.

VPN providers that are located in non-14 Eyes countries

With so many VPN services on the market, it can be time-consuming and frustrating to sift through feature-lists and review scores only to find that what seems like the ideal VPN is based in a 14 Eyes country. thebestvpn.com has informative reviews on some of the best VPN providers which are registered outside of the 14 Eyes and EU compliant partners:

Conclusion

Anyone considering their VPN options hardly needs to be told to “be careful”; anyone seriously considering a VPN must already be motivated by care and caution over their online privacy. No VPN is going to be perfect; many high-performance services are likely to be based within the Eyes security alliances, and even many of the countries outside of those jurisdictions are compliant and cooperative with the intelligence agencies’ demands. This doesn’t mean it’s a lost cause or there’s no point trying to protect yourself, however. As with all things related to online security, while you cannot eliminate all threats, the more threats you can mitigate the better.

For the best possible protection, it is recommended to choose not only a VPN outside of the Eyes alliances, but to choose one that does not keep activity logs on its users – and even then, to only connect to servers which themselves are outside of the 5, 9 and 14 Eyes’ jurisdictions. For many users, following these guidelines at all times will be impractical, but as long as users stay aware of these best practices, as well as where and whether their browsing data is being stored and who can gain access to it, the right VPN can go a long way to restoring online privacy.

  • +

1 comment

Leave a Reply

Your email address will not be published. Required fields are marked *

*

  1. A friend send me your article read on transients, great job John, very nice summary!
    Few remarks:
    – Wathever Mullvad (Sweden) is in the 14 eyes, it’s kind of exception cause you don’t need ID to register, no email, nothing. And you can pay in bitcoin and maybe other anonymous money. So and as for all other VPN including the one outside global Watch, if you surf without providing your real ID (by google account, Facebook, tweeter and other…) and if you hide you computer fingerprint, you should be anonymous by using it.
    – As I said, If you aren’t hiding your computer fingerprint and log somewhere with your real ID, technically you aren’t anymore anonymous, even so if you use a non-eye country VPN.
    – In my case for using a Non-eye country VPN for the last 12 years I saw the price rising up in the time. From around 33 bucks to start slow evo to 49, jump at 69$ a bit after Snowden breaknews and this year it just jump again from 69 to 99€ for the same yearly plan.
    Maybe You guys are making them to famous, or maybe the service protection cost are rising up cause there is more and more gov pressure on them…