The Five Eyes Problem: Why Jurisdiction Decides Whether Your VPNA virtual private network encrypts traffic between your device and a provider-run server, hiding activity from local networks while shifting trust to the VPN operator.Glossary → Is Safe
Start with jurisdiction, not speed tests. When all your traffic runs through one provider, the legal environment around that company matters more than the app. A VPN can only promise what local law allows it to promise. That is the Five Eyes problem.
What the Five Eyes alliance means for VPN users
The Five Eyes are the US, UK, Canada, Australia, and New Zealand. The intelligence-sharing arrangement dates to the post-WWII UKUSA signals agreement and has expanded into a broad framework for mutual surveillance assistance. Each country runs its own domestic programs. The US has FISA courts and National Security Letters. The UK has RIPA and the Investigatory Powers Act. Australia passed the Assistance and Access Bill in 2018. The shared infrastructure means a request that originates in one country can reach providers in another with minimal friction.
For VPN users, this matters because a provider incorporated in any Five Eyes country is reachable by the full set of intelligence tools available in that jurisdiction. That includes secret orders with gag provisions, compelled technical assistance, and infrastructure-level access that the provider may never be allowed to disclose. A shell company in Panama does not help if the staff, payments, and servers live in Virginia.
Why no-logs claims are not enough
A no-logs policy describes what a company says it does today. It does not describe what a government can force it to do tomorrow. One provider may mean no browsing history but still retain connection timestamps, bandwidth totals, account identifiers, and support tickets. Another may genuinely keep nothing, until it receives an order to start. A third may route analytics through outside tools that collect data the provider itself does not touch.
The only way to evaluate a no-logs claim is to read the audit scope, not the marketing summary. An audit of one server image at one point in time does not prove the company cannot or does not watch users across its network. Check who did the audit, what they tested, and whether the methodology is published.
What actually reduces risk
Technical design limits what a seizure or order can produce. RAM-only servers mean less survives a power cut. Open-source clients mean the tunnel can be verified. Anonymous payment options mean the billing record does not identify the user. Short or zero data retention means less exists to hand over. None of these make a company immune to legal orders, but they reduce what gets exposed when pressure arrives.
Before trusting a provider, verify the operating entity and any parent company or recent acquirer. Read the full audit report. Check whether the provider owns its hardware or rents opaque cloud instances. Look for public cases where authorities attempted to obtain user data, and what happened. A provider that has faced real legal pressure without exposing users tells you more than one that has never been tested.
Scope what a VPN can actually do
A VPN helps against ISP-level logging, hostile local networks, and some forms of tracking. It is not an anonymity system. The provider sees your real IP and your DNS queries. If you need stronger separation, add compartmented identities, a hardened browser, private payment methods, and Tor where the threat model calls for it. The safest VPN is the one you understand well enough not to overtrust.
Sources
- UKUSA Agreement declassified documents: U.K. National Archives
- Australia Assistance and Access Bill 2018: legislation.gov.au
- EFF on National Security Letters: eff.org
Frequently Asked Questions
What are the Five Eyes?
The US, UK, Canada, Australia, and New Zealand. They share signals intelligence under agreements dating to the post-WWII UKUSA pact. Each runs mature domestic surveillance programs and cooperates on foreign targets.
Can a no-logs policy override jurisdiction risk?
No. A no-logs claim describes company policy, not legal immunity. A government order can compel future logging, infrastructure access, or quiet cooperation regardless of what the privacy page says. Jurisdiction defines what a provider can be forced to do. Policy only covers what it chooses to do.
Are all Five Eyes VPNs unsafe?
Not automatically. A Five Eyes provider with RAM-only servers, published audits, anonymous signup, and a clean incident record can still be a reasonable choice. But the legal starting point is worse, so the provider has to work harder to earn trust.