The Five Eyes Alliance

A surveillance partnership that operates above the law.

State of Surveillance Editorial Team

TL;DR: The Five Eyes alliance (US, UK, Canada, Australia, New Zealand) is the world's most powerful intelligence-sharing partnership. Member countries agree to share all signals intelligence by default. The crucial loophole: they can spy on each other's citizens and share that data back, bypassing domestic privacy laws. The NSA can't legally surveil Americans without a warrant, but GCHQ can, and then share the results. Edward Snowden called it "a supra-national intelligence organisation that does not answer to the known laws of its own countries."

What Is Five Eyes?

Five Eyes (often abbreviated FVEY) is an intelligence alliance comprising five English-speaking countries:

Country Agency Role
United States NSA (National Security Agency) Largest contributor; operates XKeyscore, PRISM
United Kingdom GCHQ (Government Communications Headquarters) Operates Tempora; taps undersea cables
Canada CSEC (Communications Security Establishment) Northern surveillance focus
Australia ASD (Australian Signals Directorate) Asia-Pacific intelligence
New Zealand GCSB (Government Communications Security Bureau) Pacific region surveillance

These countries are parties to the UKUSA Agreement, a treaty for joint cooperation in signals intelligence that dates back to World War II.

Origins: From WWII to Today

The alliance began informally during World War II when British and American codebreakers shared intelligence at Bletchley Park. The paperwork caught up in stages, and the five-country membership took another decade to settle:

  • 1943: The BRUSA Agreement, signed on 17 May, formalized codebreaking cooperation between the US War Department and Britain's Government Code and Cypher School[8]
  • 1946: The UKUSA Agreement was signed on 5 March, by the UK's London Signals Intelligence Board and the US State-Army-Navy Communication Intelligence Board, committing both sides to share signals intelligence[7]
  • 1948: Canada is brought into the agreement[7]
  • 1955: A revised text designates Canada, Australia, and New Zealand as "UKUSA-collaborating Commonwealth countries"[7]
  • 1956: Australia and New Zealand join in full[7]
  • 1971: ECHELON, the satellite interception network built out from collection begun in the late 1960s, is formally established[10]
  • 2013: Snowden revelations exposed the full scope of Five Eyes operations

For decades, the alliance operated in complete secrecy, including from the politicians nominally in charge of it. Australia's prime minister was not told the agreement existed until 1973. Its existence was not disclosed to the public until 2005, and the full text was released only on 25 June 2010, 64 years after it was signed.[7]

How Intelligence Sharing Works

The core principle of Five Eyes is simple: share everything by default.

What They Share

  • SIGINT (Signals Intelligence): Intercepted communications, phone calls, emails, texts, internet traffic
  • MILINT (Military Intelligence): Defense-related information
  • HUMINT (Human Intelligence): Information from human sources
  • GEOINT (Geospatial Intelligence): Satellite imagery and mapping data
  • Methods and techniques: How they collect and analyze intelligence

Key Surveillance Programs

Program Operated By What It Does
PRISM NSA (US) Collects data from major tech companies (Google, Microsoft, Apple, Facebook, etc.)
XKeyscore NSA (US) Searches and analyzes global internet traffic; shared with Five Eyes partners
Tempora GCHQ (UK) Taps undersea internet cables; stores communications for 30 days
ECHELON All Five Eyes Global interception network for satellite, radio, and telephone communications

ECHELON: The Cold War Listening Network

ECHELON is the oldest piece of the machinery and the part that first made the alliance visible. From 1970, GCHQ ran a satellite intercept station at Morwenstow in Cornwall covering the Atlantic and Indian Oceans, and the NSA built a counterpart at Yakima, Washington, for the Pacific.[10] Reporting by Duncan Campbell describes the globe divided into zones of responsibility, with Britain's taking in Africa and Europe as far east as the Urals, Canada covering the northern latitudes and polar regions, and Australia covering Oceania.[9]

Denial lasted a long time. The first government admission came in March 1999, when Martin Brady, director of Australia's Defence Signals Directorate, told the Nine Network that his agency "does co-operate with counterpart signals intelligence organisations overseas under the UKUSA relationship". The European Parliament set up a Temporary Committee on the ECHELON Interception System in July 2000 and published its report in July 2001, stating that the network was being used to intercept not only military communications but private and business ones. The NSA's own use of the ECHELON codename was confirmed only in 2015, in internal newsletters published from the Snowden archive.[10]

The Surveillance Loophole

This is the part that matters for ordinary citizens.

Every Five Eyes country has laws restricting what its intelligence agencies can do to their own citizens. The NSA needs a warrant to surveil Americans. GCHQ faces restrictions on monitoring Britons. In theory, these laws protect privacy.

In practice, the Five Eyes arrangement creates a loophole:

  • The NSA can't legally mass-surveil Americans
  • But GCHQ can surveil Americans
  • GCHQ then shares that data with the NSA
  • The NSA now has American communications without violating American law

This works in all directions. Canadian intelligence can surveil Britons and share with GCHQ. Australian intelligence can surveil Canadians and share with CSEC. Each country can "subcontract" surveillance of its own citizens to its partners.

Is This Legal?

Technically, yes. The surveillance doesn't violate the collecting country's laws (they're monitoring foreigners). The receiving country didn't conduct the surveillance itself. Both countries claim their hands are clean.

But the effect is the same as if domestic agencies had conducted mass surveillance on their own citizens, they just did it through partners.

In 2013, Canadian federal judge Richard Mosley ruled that CSIS had been "illegally enlisting FVEY allies in global surveillance dragnets, while keeping domestic federal courts in the dark." The agencies were using the alliance to circumvent judicial oversight.

The deeper problem is how little law there is to break. Privacy International's assessment is blunt: "There is no domestic legislation governing intelligence-sharing, meaning that many of these arrangements lack legal basis and therefore democratic legitimacy."[2] The same analysis points to the "third party rule" written into intelligence-sharing agreements, which forbids passing inter-agency information to outsiders and, in Privacy International's words, ousts "the possibility of oversight".[2]

What This Means for You

If you're a citizen of a Five Eyes country, your communications may be collected by a partner nation and shared with your own government, all without the legal protections that would apply if your government collected the data directly.

Data That Can Be Collected

  • Emails and attachments
  • Phone calls and SMS messages
  • Internet browsing history
  • Social media activity
  • Location data from mobile devices
  • Video calls and VOIP communications
  • Encrypted communications (metadata even if content is protected)

How Long Is Data Kept?

  • UK (Tempora): Content stored for 3 days, metadata for 30 days
  • UK (ISP retention): Since 2016, ISPs must store browsing history for 2 years
  • US (NSA): Varies by program; some data retained indefinitely

Who Can Access It?

In the UK alone, dozens of government agencies can request communications data without a warrant, including:

  • Intelligence agencies (GCHQ, MI5, MI6)
  • Police forces
  • HM Revenue & Customs
  • Department for Work and Pensions
  • Food Standards Agency
  • Gambling Commission

Data shared through Five Eyes can flow to any of these entities.

Nine Eyes and Fourteen Eyes

Five Eyes has expanded into larger alliances with different levels of access:

Nine Eyes

The original Five Eyes plus:

  • Denmark
  • France
  • Netherlands
  • Norway

These countries share intelligence with Five Eyes but don't have full access to all collected data.

Fourteen Eyes

The Nine Eyes plus:

  • Germany
  • Belgium
  • Italy
  • Spain
  • Sweden

A document from the Snowden archive gives this group an official name: SIGINT Seniors Europe, or SSEUR.[1] Members contribute to the surveillance network but have even more limited access than Nine Eyes countries.

What This Means for Privacy

If you're in any of these 14 countries, your government may share surveillance data with the alliance, even if your country has strong privacy laws domestically.

Third-Party Partners

Outside the numbered circles sit the "third parties", countries that feed the alliance without belonging to it. Norway signed on in 1952, Denmark in 1954, and West Germany in 1955.[1] Israel, Singapore, South Korea, and Japan all collaborate with Five Eyes while remaining formally non-members, and Snowden documents identified Singapore, one of the world's largest telecommunications hubs, as a key third party.[1] Since 2018, an arrangement sometimes called Five Eyes Plus Three has added France, Germany, and Japan to information sharing aimed at China and Russia.[1]

Third-party status does not mean second-hand data. A memorandum of understanding agreed in March 2009, and published by The Guardian in September 2013, shows the NSA handing the Israeli Sigint National Unit raw signals intelligence: "unminimized transcripts, gists, facsimiles, telex, voice and Digital Network Intelligence metadata and content", unfiltered material likely to contain the calls and emails of American citizens. The memorandum lets the Israeli side keep "any files containing the identities of US persons" for up to a year, and says of itself that it is "not intended to create any legally enforceable rights".[11]

Strain in the Alliance

The partnership is not frictionless. In November 2025, Washington Monthly reported, citing CNN, that the United Kingdom had suspended intelligence sharing with the United States in the Caribbean over US strikes on boats off South America that London regards as unlawful.[12] Days later, writing in Lawfare, Mitchell Gallagher of Wayne State University argued that the alliance has to take on new members and change its approach to keep pace with challenges such as cybersecurity, and named Japan as the most plausible candidate for admission.[13]

Protecting Yourself

Complete protection from Five Eyes surveillance is difficult. These agencies have vast resources and operate with minimal oversight. But you can make mass collection harder:

Encryption

  • Messaging: Use Signal or WhatsApp (end-to-end encrypted)
  • Email: Use ProtonMail or Tutanota (encrypted email providers based outside Five Eyes)
  • Browsing: Use HTTPS everywhere; consider Tor for sensitive browsing
  • Storage: Encrypt local files with VeraCrypt or similar

VPNs: Know the Limits

A VPN can hide your traffic from your ISP, but:

  • VPNs based in Five Eyes countries may be compelled to provide data
  • Consider VPNs based in Switzerland, Panama, or other privacy-friendly jurisdictions
  • No VPN protects you if the endpoint is monitored (like major websites)

Metadata

Even with encrypted content, metadata (who you communicate with, when, how often) is harder to protect. Intelligence agencies often find metadata as valuable as content.

The Bottom Line

Five Eyes is the world's most comprehensive intelligence-sharing alliance. It has operated for 80 years, most of that time in complete secrecy.

The alliance creates a legal loophole that renders domestic privacy protections largely meaningless. When your government can't legally surveil you, it asks a partner to do it instead. The data flows back, and no laws are technically violated.

Edward Snowden's description remains accurate: Five Eyes is "a supra-national intelligence organisation that does not answer to the known laws of its own countries." It operates above the legal frameworks citizens believe protect them.

For 600 million people living in Five Eyes countries, and the billions more in Nine and Fourteen Eyes nations, this means that privacy depends not on legal protections, but on whether you're interesting enough to monitor.

References

  1. Wikipedia, Five Eyes
  2. Privacy International, Five Eyes
  3. Yale Law School, Five Eyes Documents
  4. Britannica, Five Eyes
  5. Global Information Society Watch, Five Eyes Surveillance Practices
  6. Comparitech, Guide to Five, Nine, and Fourteen Eyes
  7. Wikipedia, UKUSA Agreement
  8. Wikipedia, 1943 BRUSA Agreement
  9. Duncan Campbell, Inside Echelon, Heise Online, 25 July 2000
  10. Wikipedia, ECHELON
  11. The Guardian, NSA shares raw intelligence including Americans' data with Israel, 11 September 2013
  12. Washington Monthly, Five Eyes Become Three Blind Mice, 20 November 2025
  13. Lawfare, The Five Eyes Alliance Can't Afford to Stay Small, 23 November 2025