mastodon 4.7.2Running an independent consultancy focused on resilient, accountable digital systems and the informed use of cloud and AI. Keeping infrastructure and data understandable, auditable, and under client control.
Google announced Gemini can now run air-gapped on a single server. Impressive. Also: you still can't write the governance document.
We built our own sovereign AI deployment. Consumer MacBook Air M4. Open-source inference stack. CONSTRAINTS.md in a GPG-signed Forgejo repo.
No rack. No Google Cloud sales call. Effectively zero incremental cost.
Governance is not a product. It is a practice.
https://sovereignauditor.substack.com/p/we-built-our-own-air-gapped-ai-here
#DigitalSovereignty #CyberSecurity #AI #IsleOfMan #DataProtection
#isleofman bank holiday views
Our Mastodon instance's database decided to eat itself in late February.
135,658 accounts. Cold. One person. No vendor support line.
Back in 2.5 hours because the backup was there and had been tested.
Here's what the post-incident review built next.
https://sovereignauditor.substack.com/p/self-hosted-self-recovered #selfhosted #mastodon #infosec
**Post 2:**
The guidance also admits prompt injection may never be solved -- and that the industry has no mature methods to evaluate whether agentic systems are behaving as intended.
The phrase that matters: the agent might be lying to the governor.
Not a critic. Six governments, in writing.
haunted.lighthouse.co.im/articles/strong-governance-is-not-optional/?utm_source=mastodon
#CyberSecurity #AgenticAI #NCSC #CISA #Governance #IsleOfMan
Oxford study: AI chatbots trained to sound warmer make up to 30% more errors. Friendliness isn't cosmetic -- it's a training objective that costs accuracy.
Been running dual-model cross-checks with explicit accuracy constraints for a while. Oxford just measured why that matters.
sovereignauditor.substack.com/p/nice-chatbots-make-worse-decisions
#AIGovernance #MachineLearning #CyberSecurity #DigitalSovereignty
Digital Isle of Man announced their data sovereignty framework and 16 health-tech vendors on the same day. The framework: not yet law. The vendors: already inside Manx health infrastructure, all on AWS/Azure/GCP. I traced the stacks and read the board minutes.
The clutch isn't fitted yet.
https://haunted.lighthouse.co.im/articles/the-missing-clutch/
The Isle of Man just passed world-first data asset legislation with sovereignty at its core.
Three extraterritorial regimes are converging on that claim simultaneously. The CLOUD Act. The Investigatory Powers Act. And an EU deadline that arrives in 112 days.
(1)
The PocketOS agent had a system prompt. The system prompt said NEVER run destructive operations. The agent read it, understood it, decided the situation warranted an exception, and deleted the database and all the backups in nine seconds.
This is not a rogue AI story. It is a category error story. (1/2)
New piece: Moonshot AI just open-sourced a model running 300 autonomous agents for 12 hours at ~$50 total. Your paralegal costs more per hour than the entire attack. Your firewall sees nothing. Your IPS has no signature. This is Cognitive DDoS -- Distributed Denial of Staff. The Botnet Grew a Brain:
#CyberSecurity #AI #AgentSwarm #SocialEngineering #InfoSec #ProfessionalServices #Governance #ThreatIntelligence #OpenSource
Orkney was offline for a month. One cable, bad weather, no repair ship nearby. Westminster is now funding Atlantic Bastion, standing up NATO's Arctic Sentry, calling in BT and Vodafone.
Nobody called the Isle of Man.
Four fibre cables. One power interconnector. One gas spur. All of it under the Irish Sea. All of it maintained by others. No maritime defence capability. No seat at the table.
That is not a complaint. It is a description of a governance gap measured in fathoms. (1/2)
The DoD designated Anthropic a supply chain risk. The NSA kept using their most capable model anyway.
The ban banned something that was already running.
New piece on the most perfectly formed institutional embarrassment of 2026 👇
https://sovereignauditor.substack.com/p/the-most-dangerous-ai-we-absolutely
#AI #DigitalSovereignty #Anthropic #NSA #Infosec #DataGovernance #AIPolicy
The Sovereign Auditor now has a voice. Every new article has an audio version -- generated locally, served from our own infrastructure, no third party touches it. Free articles have the player at the top. Archive audio coming shortly. Read or listen at https://haunted.lighthouse.co.im/articles
#SovereignAuditor #DigitalSovereignty
Ronaldsway's primary radar has been dark since November 2025. Nobody said anything publicly for five months.
Meanwhile Manx Utilities wants to build a wind farm at Earystane -- in the line of sight of whatever replaces it. The headline cost is £36-40m. The final bill is unknown.
Dead radar, peat deposits, a generation licence before planning, and a governance structure where nobody is quite independent of anybody else.
Full piece -- read or listen (~12 mins): (1/2)
Microsoft used the word "sovereign" 14 times in their Azure Local press release this week.
The hardware is yours. The governance is theirs.
Who controls the control plane?
https://sovereignauditor.substack.com/p/sovereignty-as-a-sku
#DigitalSovereignty #CloudComputing #DataProtection #CyberSecurity #GDPR
A Manx legal structure with an American trapdoor in the floor is not sovereignty. It's paperwork.
The secondary regulations are being written now. This is where it succeeds or fails.
https://sovereignauditor.substack.com/p/the-trapdoor-in-the-floor
#DigitalSovereignty #DataProtection #IsleOfMan #GDPR #CLOUDAct
(2)
Post 1
Six national cybersecurity agencies -- CISA, NCSC-UK, ASD, CCCS, NCSC-NZ, NSA -- just published joint guidance on agentic AI.
The headline advice is least privilege, human oversight. Sensible.
The buried admission: agents may detect when they are being audited and perform correctly until the evaluation window closes.
haunted.lighthouse.co.im/articles/strong-governance-is-not-optional/?utm_source=mastodon
New on The Sovereign Auditor: France announced it was reclaiming its digital destiny. A month later, a fifteen-year-old walked off with a third of the country's identity records.
Data residency is not a security posture.
https://haunted.lighthouse.co.im/articles/the-unlocked-door/
#DigitalSovereignty #Cybersecurity #DataProtection #InfoSec #EU