The Five Eyes (also known as 5 Eyes or FVEY) alliance can be traced to informal discussions between the U.S. and the UK during World War II, in which the countries agreed to share intelligence about intercepted foreign communications. This was formalized in 1946 as the UKUSA pact. (You can read the original UKUSA files, made available to the public in 2010.)
Canada, Australia, and New Zealand were formally included in the pact in 1955. Since then, the remit of communication-sharing between the five Cold War allies has expanded exponentially to include mass data collection and online surveillance of private citizens globally. The number of countries involved has also increased, necessitating the Nine and Fourteen Eyes alliances.
Read more: Am I being spied on? Here’s how you might be
What is the Five Eyes alliance?
A secret for decades, the existence of the Five Eyes alliance became public in 2005 and it is now a recognized body. (It was so secret that despite Australia being included in the UKUSA pact since 1955, the Prime Minister of Australia was not aware of its existence until 1973.) The name Five Eyes is shorthand for the AUS/CAN/NZ/UK/US Eyes Only classification level.
The goal of the alliance has always been to share foreign intelligence gathered by interception of signals (known as signals intelligence, or SIGINT). This includes communications intelligence and electronic intelligence (i.e., signals from radars and missile systems).
The communications aspect of SIGINT has evolved significantly since the Cold War, however, and now includes everything from phone calls and texts to emails and internet search histories.
Five Eyes countries
The Five Eyes countries are:
- U.S.
- UK
- Canada
- Australia
- New Zealand
Each of the Five Eyes countries has a different approach to internet surveillance and the collection of data. Five Eyes countries are not allowed to spy on their own citizens and have an agreement not to spy on each other, but Edward Snowden’s revelations in 2013 showed just how widespread the practice was.
Internet surveillance by Five Eyes countries
There are concerns that due to the secretive nature of the Five Eyes alliance, there is no oversight of legal compliance. The Electronic Frontier Foundation (EFF) says, “The danger is that, by forging broad agreements between these five countries, all will end up taking advantage of the lowest privacy standards of each.”
Internet surveillance in the U.S.
In the U.S., SIGINT is gathered by the National Security Agency (NSA). Currently, the NSA can surveil Americans’ internet browsing and search history without a warrant under the Patriot Act reauthorization bill.
The NSA operated PRISM, a surveillance program designed to collect information from U.S. internet companies. PRISM is one of the programs that used XKeyscore, the NSA database revealed by Snowden. He also brought to light the massive NSA database of U.S. telephone records, and in 2020 the U.S. Court of Appeals found that the NSA had violated the Foreign Intelligence Surveillance Act.
Internet surveillance in the UK
The Government Communications Headquarters (GCHQ) gathers SIGINT on behalf of the UK. The Investigatory Powers Act 2016 (also known as the Snoopers’ Charter) enables police and security services to seize data from communication service providers without a warrant, and providers must collect and retain metadata for one year.
In May 2021 the European Court of Human Rights found that the GCHQ had violated the right to privacy. The Guardian wrote that the GCHQ’s “bulk interception of online communications violated the right to privacy and the regime for collection of data was unlawful.”
Internet surveillance in Canada
The Communication Security Establishment (CSE) is responsible for SIGINT in Canada, and although their mandate prevents them from targeting the private communications of Canadians, it is lawful to collect metadata, which is not considered private.
While the CSE is not allowed to target Canadians, in the past it has unintentionally collected data on its own citizens, although it was not found to be unlawful. Untargeted Canadians have their identities masked before intel is shared with the Five Eyes. Despite Canada’s place in the alliance, the CSE has denied that Canada has access to PRISM.
Internet surveillance in Australia
Australia requires service providers to retain data relating to the service they provide for at least two years. Providers are not required to retain the content of a communication but can be compelled to retain and reveal information regarding a communication’s origin and destination, and date and time.
Australia has also introduced a new “hacking” bill, which lets police take over or spy on people through their online accounts and devices.
Internet surveillance in New Zealand
The Government Communications Security Bureau (GCSB) is New Zealand’s SIGINT agency, which is prevented from collecting information on New Zealanders by the Intelligence and Security Act 2017. Currently, a warrant is required for all communications, including metadata.
The Snowden documents revealed that the GCSB worked to implement a mass metadata surveillance system in 2012-2013, despite denials from the government about the existence of such a program.
Nine Eyes countries
The Nine Eyes countries include the Five Eyes countries and:
- Denmark
- France
- Norway
- Netherlands
In more recent years, expanded alliances such as the Nine Eyes and Fourteen Eyes have been established. These countries gather SIGINT and share information on foreign threats and strategies, theoretically increasing the safety of these countries. The Nine Eyes operates in a similar way to the Five Eyes.
Fourteen Eyes countries
The Fourteen Eyes countries include the Nine Eyes countries and:
- Belgium
- Germany
- Italy
- Spain
- Sweden
The Fourteen Eyes, also known as SIGINT Seniors Europe, or SSEUR, was formed during the Cold War. Initially, it included nine countries but after the September 11 attacks on the U.S., it grew to 14, with a focus on counterterrorism.
Am I at risk of Five Eyes surveillance?
It is unclear how the digital privacy of individuals is affected by these alliances. Lawfare suggests that it’s impossible to know the extent of the surveillance while we “remain in the dark about the overall nature and scope of intelligence sharing among the Five Eyes.”
You should always assume that everything you do online has the potential to be intercepted or tracked, and take appropriate steps to protect your privacy.
Using a VPN when accessing the internet could make your digital footprint smaller. ExpressVPN is based in the British Virgin Islands, whose laws afford users greater privacy and anonymity than those of the U.S. and Europe. Jurisdiction should be one of many factors when choosing a VPN.
Protect your online privacy and security
30-day money-back guarantee
We take your privacy seriously. Try ExpressVPN risk-free.
What is a VPN?
