Every year more of public life runs on computing that belongs to someone else. We work with researchers, public institutions and communities on what that arrangement owes the people living under it.
And we build the alternative, so the argument does not stay on paper. Everything we ask of infrastructure, we publish a way to check.
Administration, health, education, the press and the ability of a community to organise itself now depend on computing infrastructure. Control of that infrastructure has concentrated into a small number of providers operating under law made elsewhere, while governments extend their reach over what those providers carry.
A public that has not said what it requires of the systems it depends on will be given whatever it is offered, and told that this is what sovereignty looks like. This is a statement of what it requires, written to be cited, applied and contested.
None of what follows is a forecast. It is the position from which this protocol is written, and it is why the articles are phrased as requirements rather than aspirations.
The US CLOUD Act allows authorities to compel any provider under US jurisdiction to produce data regardless of the country it is stored in. A European data centre operated by a company with US exposure does not remove that reach, and encryption at rest does not either.
The operative questions are who holds the keys, and who can be compelled to use them.The European chat-scanning regulation was rejected in its first form in March 2026 and has not gone away. The United Kingdom and others continue to press for lawful access arrangements that weaken end-to-end encryption for every user in order to reach some of them.
A capability built for one warrant exists for every subsequent one, including the ones granted by a later government."Sovereign cloud" increasingly describes a building inside your borders running a control plane that is not yours, operated by staff who answer elsewhere. The same substitution is under way in AI, where sovereignty has come to mean buying one supplier's accelerators and running their stack on them.
Ownership of the metal is not ownership of the system.In the first quarter of 2026, local opposition in the United States blocked or delayed 75 data-centre projects worth about $130 billion. Organised opposition groups doubled to 833 across 49 states, more than 300 state-level bills were filed in six weeks, and statewide moratorium proposals were introduced in 14 states.
The objections are utility bills, water, noise and land. They are the objections of people who were told after the decision.An article is written so that a person who did not draft it can hold a supplier, a government or their own institution to it. A requirement nobody can check is a preference, so nothing appears here without a test.
Sovereignty over infrastructure is a property of control. It is not established by the location of a building.
Geography is easy to relocate and easy to advertise. Authority is neither. A system sited in one country and governed from another has changed its address and nothing else.
Name who holds the keys, who decides what runs, and who can be overruled.
A system's identity is produced by that system and held by the party operating it. No register confers it and none may withdraw it.
An identity granted by an authority can be taken by that authority. Where identity is issued rather than held, every other guarantee in this protocol is conditional on the issuer's continued goodwill.
Name the party that could revoke a participant's identity. If one exists, the article is not met.
Every action on a system is decided by that system, under a policy its operator holds. A credential issued elsewhere is evidence about a party; it is never authority over a machine.
Identity services and authority are routinely conflated, and the conflation is where remote control enters. Knowing who somebody is settles nothing about what they may do here.
Does any externally issued credential grant a permission the local policy has not already written?
Stopping, powering down, isolating or erasing a system is reserved to its operator, and is conferred on no other party by any instrument.
These four powers are the difference between operating infrastructure and hosting it. A supplier that retains any of them retains the ability to end the service under pressure it did not choose and cannot refuse.
Can any remote party stop a system on the premises? A vendor kill switch is a kill switch.
A system remains governable by the people present when its connection to everything else is lost.
Disconnection is the ordinary condition of a rural clinic, a ship, a disaster response and a country under sanction. A system that becomes unmanageable offline has made continuity a service somebody else provides.
Cut the uplink. Is the system still administrable by the person standing in front of it, and does the absence of the network narrow what is permitted rather than widening it?
What a system declined is recorded beside what it did, and both are equally open to audit.
A record containing only actions taken cannot show restraint, and cannot show pressure that was resisted. Refusals are the part of the record an oversight body most needs and is least often given.
Ask for the refusals. A record that holds only permissions is an incomplete record.
The requirements of this protocol apply to every device in a system, including those with the least capability.
Sensors, meters, cameras and controllers are the devices most often deployed with no identity at all, and they are the origin of the readings everything else acts on. Exempting them relocates the weakness rather than removing it.
Can the smallest device sign what it reports? An unsigned sensor is an unaccountable input to every decision downstream.
A figure published about a system is measured, or is declared unmeasured. No figure is estimated into existence.
Energy, water, carbon and capacity figures are increasingly reported under legal obligation, and an estimate filed once becomes the baseline everything afterwards is measured against. An absent figure is recoverable. A plausible wrong one is not.
For each published figure, ask which instrument produced it. Where there is no instrument, say so.
A participant may leave with what is theirs, and the steps required to do so are published in advance.
Lock-in is rarely written into a contract. It accumulates in formats, in interfaces and in the absence of anyone having tried. A right to leave that has never been exercised is untested.
Count the steps to leave, and find someone who has taken them. If nobody has counted, the answer is not one.
Any component that asserts a property of the system — identity, integrity, authority, provenance — is published openly and may be examined independently.
A claim that cannot be inspected is a claim about the claimant's reputation. Efficiency, convenience and intelligence may be held privately without weakening anything this protocol requires. The parts that make assertions may not.
Can an independent party read the component that makes the claim, and reproduce what it asserts?
Software and tools commissioned with public money are released under an open licence, with the source, the build and the documentation needed to run them independently.
A public body that pays for software twice — once to have it built, again for permission to keep using it — has bought a dependency rather than an asset. Open release also lets the next institution reuse the work instead of paying to have it built a second time. Without it, public money buys the same software over and over.
Ask for the repository, the licence and the build instructions. Public funding without public release is a subsidy to a single supplier.
An institution depending on open software contributes to sustaining it, in funding, maintenance or staff time, in proportion to its dependence.
Public services now rest on open components maintained by very few people, frequently unpaid and often unknown to the institutions relying on them. Treating that work as free is why it keeps breaking. Contributing is not charity. It is maintenance on something you already depend on.
List the open components your services depend on, and name what you contributed to each in the last year. An empty answer belongs on the risk register.
Most of the disagreement in this field is a disagreement about words that each side believed were settled. These are the meanings this protocol uses, stated so that a reader can reject them explicitly rather than by accident.
Holding the authority to decide, and the means to refuse. A property of control, tested at the keys rather than at the border.
The party accountable for a system to the public it serves. Not necessarily its owner, and not necessarily the party that supplied it.
The power to stop, power down, isolate or erase. The set of powers that cannot be delegated upward without ending the operator's accountability.
Evidence produced by a system about its own state, gradeable by strength, and never asserting a property its hardware cannot support.
Departure with what is yours, by steps published in advance and demonstrably taken by someone.
Terms under which anyone may run, read, modify and redistribute the work, without asking and without a fee. A source file that may be read but not reused is disclosure, not an open licence.
The interest of the people a system serves, including those who did not choose it, cannot leave it, and were not asked.
Openness announced as a value can be revised by whoever announced it. Openness built into a structure cannot, because there is nobody left holding the power to withdraw it. The difference is the whole of our work.
The articles describe that construction. Build to them and the result ends up spread across many owners, because once nobody can halt anyone else's system there is no centre for control to collect in. We design that openness and we build to it ourselves. If a requirement turns out to be one nothing can meet, we would rather find that out in a machine room than argue it on paper.
A machine's identity is produced by the machine and held by whoever runs it. There is no roll to be struck from and no account to be closed, because none was ever issued.
No party holds the power to halt another's system. It follows that there is no operator of last resort, no chokepoint to regulate through, and nothing an acquirer could buy that would deliver control.
Participation is signed by keys the operator holds. Striking an entry from a directory removes a listing, never a system.
Leaving is an act the departing party performs alone, by steps published in advance. A right to exit that requires the other side's cooperation is a request.
What makes a claim is published under an open licence, so it can be examined, rebuilt and replaced by the people relying on it rather than trusted.
We hold no special position in anything built to these articles, and no power over anyone running one. Sooner or later somebody will ask us to make an exception. The design leaves us nothing to make it with.
The protocol has force where an institution puts it into the documents that decide procurement, and publishes what came back. A supplier answering twelve tests in writing is a different supplier from one answering a brochure.
Adopt the articles as your institution's statement of what it requires of the infrastructure it depends on.
Ask the twelve tests of every supplier, in writing, and record the answers as part of the evaluation rather than as background.
Publish the answers. A supplier's response to Article IV is of public interest to every other institution asking the same question.
State which articles your own systems do not yet meet, and what it would take. An institution that only tests others is not credible.
Where an article cannot be met by anything available, that is a finding. It belongs in the open, where somebody can build the answer.
Furcate OS implements these articles across a running site and is published openly. It is one implementation and not the protocol. Others are welcome, and competing ones are better.
Not a certification scheme, not a mark, not a trade body. Nobody can buy approval here and nobody can be sold it. The tests belong to whoever wants to run them.
The protocol is maintained by the people who have to live under its consequences: researchers, public institutions, municipalities, co-operatives, libraries, newsrooms, clinics, universities, community networks, and suppliers willing to be tested in public.
Small groups holding one article. They own its wording, its test, and the evidence that the test can be passed by something real.
Measurements and answers from actual institutions and actual sites, published with the method. A finding that contradicts the consensus is the most useful kind.
Working sessions where participants bring a system and a problem rather than a presentation. What is decided is published.
Open argument about the articles, the definitions and the terms. Positions are held in public so they can be contested in public.
Running the tests against other people's claims, and against our own on the same terms and in the same detail.
Carrying the articles into the languages, legal vocabularies and procurement frameworks where they will actually be used.
Public Protocol is an independent public-benefit organisation. We are not a trade body and not a consultancy, and we do not own a network. We keep the articles honest and publish the evidence under them. We bring together the people who have to live with the consequences. And we run the tests against anyone making a claim, starting with ourselves.
Almannaheill means public benefit. A félag til almannaheilla is an association constituted to serve it, governed by an act passed for that purpose in 2021, entered in a public register kept by the state, and required to declare what it exists to do in a founding instrument anyone can read. Once registered it must carry the designation in its name.
In 2010 the Icelandic parliament unanimously adopted a resolution directing the country to build the strongest available protections for freedom of expression, freedom of information and the protection of sources, and an institute was constituted the following year to carry it into law. A body whose work is to say publicly what infrastructure owes the public should be incorporated somewhere that has already decided that question.
Funding is published. No funder receives standing in the assembly, a seat in a working group, or any influence over the wording of an article or the design of a test. Where a funder is also a party being tested, that is disclosed on the finding.
Design and build open digital infrastructure to the articles. Maintain the articles and their tests. Publish field evidence. Convene the assembly. Review claims, and carry the articles into the languages and procurement frameworks where they get used.
The open tools public institutions already depend on. Article XII binds us before it binds anyone else: we publish what we rely on and what we contributed to it.
Certify, endorse, or sell a mark. Accept money that comes with influence over the text. Act for a supplier's interest, or hold a commercial stake in one.
An article changes when evidence changes it, and the change is published together with the evidence that caused it. An article whose test turns out to be unpassable by anything, ever, is either wrong or the most important thing in the document, and the assembly has to say which.
Every version is numbered and kept. Anyone who has cited an article can still find the words they cited, next to whatever replaced them.
A requirement that cannot be defended is removed rather than weakened into something that sounds agreeable and decides nothing.
Where something is known and not yet resolved, it is written on the page it belongs to, at the same weight as everything else.