5/9/14 Eyes and your cloud privacy: the real world map of surveillance (2026)

The essentials

The signal intelligence (SIGINT) 5 Eyes, 9 Eyes and 14 Eyes alliances are neither a conspiracy myth nor a state secret: they are documented by major leaks (Snowden 2013, Vault 7 in 2017) and confirmed by official declarations of several signatory governments. In 2026, their impact on cloud privacy remains massive — not because they enable direct mass surveillance, but because they determine which state can legally compel a cloud provider to deliver encrypted data.

The question for a cloud privacy user is therefore not "do these alliances exist?" (yes), nor "could I be personally spied on?" (statistically no if you're not a specific target), but: "if my provider receives a legal request tomorrow, which law applies and how many states can access it through intelligence sharing?" This is the logic we unfold here, jurisdiction by jurisdiction.

Of the 12 cloud privacy providers we mapped in May 2026, 9 are hosted or registered in 14 Eyes or allied countries, and only 3 — Proton Drive, Tresorit and pCloud (Switzerland) — benefit from real jurisdictional protection outside 14 Eyes. Add to that a few niches: 1984 Hosting (Iceland), Njalla (Nevis), Internxt (Spain 14 Eyes but decentralized infrastructure).

Where these alliances come from and why you heard about them in 2013

The 5 Eyes (FVEY) core dates back to the 1946 UKUSA agreement, signed between the United States and the United Kingdom at the end of WWII to continue sharing intercepted intelligence against the USSR. Canada joined in 1948, Australia and New Zealand in 1956. These five countries share raw intelligence — phone interceptions, satellite data, direct access to telecom infrastructures.

The 9 Eyes and 14 Eyes extensions (sometimes called SIGINT Seniors Europe) are less privileged concentric circles: members receive filtered and synthesized intelligence, but actively participate in collection. The Snowden documents published by The Guardian and Der Spiegel in 2013-2014 clarified the boundaries:

• 5 Eyes (FVEY): United States, United Kingdom, Canada, Australia, New Zealand
• 9 Eyes: 5 Eyes + Denmark, France, Netherlands, Norway
• 14 Eyes: 9 Eyes + Germany, Belgium, Italy, Spain, Sweden

Beyond the 14 Eyes, there are associated "Tier B" circles: Japan, South Korea, Singapore, Israel, which share occasionally without belonging to the formal alliance.

What these alliances technically do

Three operational mechanisms:

1. Database sharing: XKeyscore and similar, where each member feeds and queries.
2. Bypassing domestic limits: if the NSA cannot legally spy on a US citizen, British GCHQ can do it and transmit — practice documented and challenged by the ACLU.
3. Mutual requests on cloud providers: a British warrant against a US cloud goes through an accelerated channel (reinforced MLAT).

For your cloud privacy, the key point is mechanism 3: if Microsoft, Google or Apple receives a request from a 5 Eyes member, cooperation is almost automatic. If the request comes from a 9 or 14 Eyes member, delay and friction increase, but outcome remains likely.

CLOUD Act, EU Data Act, Swiss LRens: 2026 legal cartography

Beyond intelligence alliances, three recent legal texts structure cloud access:

CLOUD Act (United States, 2018)

The Clarifying Lawful Overseas Use of Data Act authorizes US authorities to require American companies (or those with significant US entity) to provide data wherever stored worldwide. Microsoft, Google, AWS, Cloudflare, Apple are concerned. A US federal warrant compels the parent company to deliver European customer data. The CJEU invalidated Privacy Shield in July 2020 (Schrems II ruling) precisely because this CLOUD Act makes GDPR and US-based hosting incompatible.

Consequence in 2026: using Microsoft 365, Google Workspace or iCloud for sensitive data de facto violates your European privacy expectation, regardless of physical datacenter location.

EU Data Act + DSA (European Union, 2023-2024)

The EU Data Act (in force 2024) requires cloud providers established outside the EU to designate a European legal representative and cooperate with national authorities. Combined with the Digital Services Act (DSA, 2022) and Digital Markets Act (DMA), it creates a localization obligation for "sensitive data" — without prohibiting the CLOUD Act on US actors.

Consequence: a cloud actor can be compelled simultaneously by the US CLOUD Act and EU Data Act, without reconciliation procedure. This is precisely the grey zone in which Microsoft, Google and AWS have operated since 2024.

Swiss Intelligence Act (LRens, 2017, revised 2024)

The LRens authorizes the Federal Intelligence Service (SRC) to request data access, but under three cumulative conditions: prior authorization by a federal administrative tribunal, demonstrated national interest, documented proportionality. In 2024, the SRC's public report mentions 172 formal requests, of which 43 were partially satisfied. No extraterritorial obligation.

This gap — factor 30 to 50 between US and Swiss cooperation on request volumes — explains why Proton and Tresorit have actively communicated about their Swiss jurisdiction since 2018.

The 2026 world map: where can your cloud really be?

This table considers only applicable law to storage. Law applicable to the owning legal entity of the provider matters just as much: Proton is Swiss (✅), Tresorit is Swiss but was acquired in 2021 by Swiss Post (✅, neutral state, outside 14 Eyes), pCloud is Swiss (✅), MEGA is New Zealand-based (❌, 5 Eyes), Internxt is Spanish (14 Eyes but decentralized infrastructure complicates legal enforcement).

Common myths to discard

Myth 1: "If I'm honest, I have nothing to hide"

A fallacious argument that conflates confidentiality with illegality. Your communications with your doctor, lawyer, tax advisor are legal, but their exposure to a third party (employer, ex, insurer, foreign state actor) can concretely harm you. Privacy is not criminal opacity, it's control over the sharing perimeter.

Myth 2: "Germany is safe because GDPR"

Germany is a 14 Eyes member and the BND-Gesetz revised in 2021 authorizes the German agency to intercept traffic transiting Frankfurt and Berlin datacenters without individual warrant. GDPR protects your data against abusive commercial use, not against intelligence access. Essential distinction.

Myth 3: "With a VPN, I'm untraceable"

A VPN masks your IP from the visited site, but your cloud provider sees your uploads, volume, timing. If the cloud is not zero-knowledge (see E2E vs zero-knowledge cloud storage), it also sees content. VPN + non-zero-knowledge cloud = problem displaced, not solved.

Myth 4: "Iceland is necessarily safe because IMMI"

IMMI is a progressive legislative framework, but Iceland is a NATO member and cooperates informally with 5 Eyes through that channel. For journalist/whistleblower use, Iceland remains preferable to Sweden or France, but inferior to Switzerland in terms of institutional compartmentalization.

2026 practical strategy: jurisdiction × threat matching

Jurisdiction choice depends on your threat model:

• Competitive/commercial threat (basic industrial espionage): Germany, France, Netherlands suffice — their legal framework complicates unauthorized access.
• Foreign state surveillance threat (US citizen fearing NSA, French citizen fearing DGSE): Switzerland mandatory, Iceland acceptable.
• Domestic state surveillance threat (activist, journalist, whistleblower vis-à-vis own state): Switzerland + zero-knowledge service + native clients + Tor access.
• Post-quantum threat (long-term, encryption decryptable tomorrow): provider implementing hybrid PQC (Proton Mail does it since 2024 with Kyber-768 + X25519). Jurisdiction plays less here, cryptographic model matters more.

This matching is what the Priviy methodology systematically applies to each tested provider: we score separately jurisdiction, cryptographic model, independent audit, operational resilience. No provider maximizes all 4 dimensions — you must prioritize based on your threat.

Our 2026 verdict

For the majority of cloud privacy users in 2026, the winning combination is:

• Swiss provider (Proton Drive by default, pCloud Crypto if you want lifetime)
• Zero-knowledge client encryption verified by independent audit
• Native desktop/mobile client rather than web app
• Paper recovery key stored offline

For high-risk profiles, add:

• Access via Tor or multi-hop VPN
• Strict separation between public identity and protected identity
• Redundant backups across two different non-14-Eyes jurisdictions

The real benefit of understanding 5/9/14 Eyes alliances is not becoming paranoid: it's knowing how to read a provider's marketing communication. When pCloud writes "swiss-based servers", it's a verifiable jurisdictional argument. When Dropbox writes "your data is secure", it's a contractual promise without jurisdictional backing. The difference is exactly what separates reliable cloud privacy from marketing cloud privacy.

Read next

• E2E vs zero-knowledge cloud storage — the cryptographic counterpart of this article
• pCloud review 2026 — Swiss provider, 8-month lifetime + Crypto test
• Priviy methodology — how we score jurisdiction × crypto × audit
• Priviy Wikidata Q140050544
• Academic reference: EFF Surveillance Self-Defense (https://ssd.eff.org/)
• Primary sources: The Guardian Snowden archives 2013-2014; Swiss SRC report 2024; CJEU Schrems II ruling (C-311/18)

Article published June 4, 2026. Methodology: review of primary legal texts (declassified 1946 UKUSA, 2018 CLOUD Act, 2024 EU Data Act, 2017 Swiss LRens), cross-referenced with 2023-2024 transparency reports from Proton, Tresorit, pCloud, MEGA, Mailfence; SIGINT status verification via archived Snowden documents (The Guardian, Der Spiegel). No claim of own classified sources. Logs and notes archived internally.