When you sign up for a VPN, you probably compare speeds, prices, and server counts. But there's a factor most people overlook entirely — one that can render your VPN's encryption meaningless: where the company is legally incorporated. The intelligence-sharing alliances known as Five Eyes, Nine Eyes, and Fourteen Eyes determine whether your VPN provider can be compelled to hand over your data to government agencies, and whether that data then gets shared across borders with a dozen other nations.
Understanding these alliances isn't paranoia. It's basic operational security in an era where mass surveillance is not a conspiracy theory — it's documented government policy.
The Origins: The UKUSA Agreement and Cold War Signals Intelligence
The Five Eyes alliance didn't start as a surveillance dragnet. It began in 1943, when British codebreakers at Bletchley Park and American cryptanalysts forged an intelligence-sharing agreement to crack Axis communications during World War II. After the war ended, both nations recognized the value of continuing this partnership against the Soviet Union, formalizing it as the UKUSA Agreement in 1946.
The original signatories — the United States and the United Kingdom — were soon joined by Canada (1948), Australia (1956), and New Zealand (1956). These five nations formed what intelligence professionals call the "Five Eyes" or FVEY, the most intimate intelligence-sharing arrangement in history. Each member nation operates signals intelligence (SIGINT) agencies that share intercepted communications with the others:
- United States — NSA (National Security Agency)
- United Kingdom — GCHQ (Government Communications Headquarters)
- Canada — CSE (Communications Security Establishment)
- Australia — ASD (Australian Signals Directorate)
- New Zealand — GCSB (Government Communications Security Bureau)
For decades, the alliance operated in near-total secrecy. The Australian government didn't even acknowledge its membership until 1973. The full scope of Five Eyes surveillance only became public knowledge in 2013, when Edward Snowden leaked classified NSA documents revealing programs like PRISM, XKeyscore, and Tempora — which collectively vacuumed up internet traffic on a global scale.
Nine Eyes and Fourteen Eyes: The Expanding Web
Beyond the core Five Eyes, two broader alliances extend the surveillance network across Europe:
Nine Eyes adds four nations: Denmark, France, the Netherlands, and Norway. These countries don't have the same depth of integration as Five Eyes members — they can't access raw intelligence feeds — but they participate in structured intelligence exchanges. Notably, Denmark's FE (military intelligence) was caught in 2021 helping the NSA spy on European leaders including Angela Merkel, demonstrating that Nine Eyes cooperation goes well beyond counterterrorism.
Fourteen Eyes (formally SIGINT Seniors Europe, or SSEUR) adds five more: Germany, Belgium, Italy, Spain, and Sweden. This tier involves even more limited sharing, but participation still means these nations' intelligence agencies maintain cooperative relationships with the NSA and GCHQ.
The practical implication is straightforward: any VPN provider based in a Fourteen Eyes country operates under legal frameworks that may compel data disclosure, and that data can flow laterally across the entire alliance.
How Intelligence Sharing Actually Works in Practice
A common misconception is that these alliances only matter for high-value targets — terrorists, spies, or state actors. The Snowden documents shattered that notion. Programs like the NSA's PRISM collected data directly from tech companies including Google, Apple, Facebook, and Microsoft. GCHQ's Tempora program tapped undersea fiber-optic cables, capturing entire streams of internet traffic flowing in and out of the UK.
The intelligence-sharing mechanism creates a critical loophole: nations can use allies to surveil their own citizens. If U.S. law restricts the NSA from directly monitoring American citizens without a warrant, GCHQ can collect that data and share it back. This arrangement has been documented repeatedly, and while legal reforms have addressed some aspects, the fundamental architecture remains intact.
In 2025, reporting revealed that Five Eyes agencies had expanded bulk collection to include metadata from messaging apps, VoIP services, and IoT devices — creating what analysts called a "digital fingerprint" capability that could identify individuals even when content was encrypted.
Why VPN Jurisdiction Matters More Than You Think
When a VPN provider operates in a Five Eyes country, it's subject to that country's legal framework. In the United States, this means National Security Letters (NSLs) and FISA court orders — both of which come with gag orders preventing the company from even disclosing the request. In the UK, the Investigatory Powers Act 2016 (the "Snoopers' Charter") gives GCHQ sweeping authority to compel data collection.
Consider a concrete scenario: You're a journalist using a US-based VPN to research sensitive topics. The FBI issues an NSL to your VPN provider. If the provider logs connection data — timestamps, IP addresses, bandwidth usage — they must hand it over. The gag order prevents them from telling you. That data can then be shared with GCHQ, ASD, or any Five Eyes partner.
This is why VPN jurisdiction is arguably more important than encryption protocols. AES-256 encryption means nothing if the entity holding the keys is legally compelled to surrender them.
The Panama Advantage: Why NordVPN's Jurisdiction Is Strategic
NordVPN is incorporated in Panama — a country with no membership in any Eyes alliance, no mandatory data retention laws, and no legal framework compelling companies to log or surrender user data to foreign intelligence agencies. This isn't an accident. It's a deliberate jurisdictional choice.
Panama has no bilateral intelligence-sharing agreements with the United States or any Five Eyes member that would apply to VPN providers. If the NSA wanted NordVPN's data, they'd need to navigate Panamanian courts — a process that has no legal mechanism for compelling a VPN provider to retroactively produce logs it doesn't keep.
NordVPN reinforces this jurisdictional advantage with a verified no-logs policy, audited multiple times by PricewaterhouseCoopers and Deloitte. Their RAM-only server infrastructure means that even if a server were physically seized, it would contain no persistent data — everything is wiped on reboot.
Protect Your Digital Life: NordVPN
Based in Panama — outside all 5/9/14 Eyes surveillance alliances — NordVPN combines jurisdictional privacy with independently audited no-logs policies and RAM-only servers. If VPN jurisdiction matters to you (and it should), this is the gold standard.
Warrant Canaries: The Dead Man's Switch for Transparency
Since gag orders prevent companies from disclosing government data requests, some VPN providers use a clever workaround: the warrant canary. This is a regularly published statement asserting that the company has not received any secret government subpoenas or national security letters. If the statement disappears, users can infer that a secret order has been received.
The legal theory is that while the government can compel silence, it cannot compel speech — meaning a company can't be forced to continue publishing a false statement. However, warrant canaries have limitations. Their legal standing remains untested in many jurisdictions, and some companies have quietly removed them without explanation, leaving users to speculate.
NordVPN publishes a warrant canary and transparency report, but more importantly, their Panamanian jurisdiction means they're unlikely to face the kind of orders that would trigger it in the first place. This is the difference between relying on a legal trick versus operating from a fundamentally stronger position.
Beyond the Eyes: Other Surveillance Partnerships
The Eyes alliances aren't the only intelligence-sharing frameworks. Israel maintains a special relationship with the NSA through a memorandum of understanding that allows sharing of raw, unfiltered SIGINT data — including data on American citizens. Japan and South Korea participate in Pacific-focused intelligence sharing. Singapore operates one of the most capable SIGINT programs in Southeast Asia.
The SIGINT Seniors Pacific (SSPAC) group mirrors the European arrangement but for the Asia-Pacific region, including France (via its Pacific territories), India, South Korea, Singapore, and Thailand. These less-publicized partnerships mean that even countries outside the traditional Fourteen Eyes may participate in intelligence exchanges.
The lesson is clear: the "safe" jurisdictions for privacy are fewer than most people think. Panama, the British Virgin Islands, Switzerland (despite being in Europe, it's not an EU or Eyes member), and a handful of others remain genuinely outside the global surveillance web.
Practical Implications: What You Should Actually Do
Understanding Eyes alliances isn't just academic. Here's how to apply this knowledge:
1. Choose a VPN outside Fourteen Eyes jurisdiction. Panama, the British Virgin Islands, and Switzerland are the strongest choices. Avoid US-based VPNs and UK-based services for privacy-critical use cases.
2. Verify no-logs claims with independent audits. Any VPN can claim "no logs." Look for providers that have undergone third-party audits by firms like Deloitte, PwC, or Cure53. NordVPN, Surfshark, and ExpressVPN have all completed such audits.
3. Check for RAM-only (diskless) servers. Even with a no-logs policy, traditional hard-drive-based servers can retain forensic artifacts. RAM-only infrastructure ensures that data cannot survive a server reboot or seizure.
4. Use multi-hop or Tor-over-VPN for high-risk scenarios. If you're in a profession where surveillance is a genuine threat — journalism, activism, legal work in authoritarian contexts — a single VPN hop may not be sufficient. NordVPN's Double VPN routes traffic through two servers in different countries.
5. Don't rely on VPNs alone. A VPN protects your IP address and encrypts traffic in transit. It doesn't protect against browser fingerprinting, malware, or social engineering. Layer your security: VPN + hardened browser + encrypted communications + operational awareness.
The Future: AI-Powered Surveillance and What Comes Next
The surveillance landscape is evolving rapidly. Five Eyes agencies are investing heavily in AI-powered analysis tools that can process metadata at scale — identifying patterns, predicting behavior, and flagging targets without ever decrypting content. The NSA's partnership with Palantir and GCHQ's work with machine learning contractors suggest that the next generation of surveillance won't need to break encryption; it will work around it entirely.
Proposed legislation in Australia and the UK would require tech companies to build backdoors into encrypted communications — a move that, if enacted, would undermine the security of every user on those platforms. The EU's ongoing "Chat Control" proposals aim to scan private messages for illegal content, creating infrastructure that could easily be repurposed for broader surveillance.
In this environment, choosing a VPN outside the Eyes alliances isn't a silver bullet — but it's one of the few concrete steps you can take to reduce your exposure to the most well-documented mass surveillance apparatus in human history. The Cold War alliance that began with codebreakers at Bletchley Park now processes more data in a day than those codebreakers handled in the entire war. Understanding who's watching — and from where — is the first step toward meaningful digital privacy.