Ownership-Control Criterion

Ownership-Control Criterion (n.) — The test that jurisdiction follows ownership, not registration country or deployment geography.

Applied to any infrastructure claiming to be sovereign, the criterion asks a single question: who ultimately owns the operating entity, and which states can lawfully compel that owner? Everything else — where the servers stand, where the subsidiary is registered, where the staff hold passports, where the data is "resident" — is operational detail that no court order cares about.

The criterion exists because the alternatives are systematically gamed. Registration-country claims ("our EU entity is incorporated in Frankfurt") fail because the US CLOUD Act reaches data in the possession, custody, or control of US-owned providers regardless of where a subsidiary is registered or where the data is stored. Deployment-geography claims ("your data never leaves Europe") fail for the same reason: data residency constrains latency, not jurisdiction. Operational-independence claims ("the sovereign region is run by European staff under European supervision") fail because staffing arrangements do not survive a lawful order to the parent company.

Only ownership survives. An entity whose ultimate ownership and control sit inside EU jurisdiction is reachable only by EU law. Anything else is reachable by someone else's — and infrastructure reachable by someone else's law is, in the evergray environment, someone else's infrastructure.

Development

Developed May 2026 in cloud sovereignty analysis surrounding the Tech Sovereignty Package, as the formal test underlying Sovereignty Washing: washing is precisely the practice of satisfying the gamed criteria (registration, geography, staffing) while failing the real one (ownership). The criterion follows Ahonen's Razor discipline: it is a problem-definition tool, deliberately silent on attribution and remedy.

Stated as a positive commitment rather than a test, this is the first of the seven stars.

Implications

Procurement language is the battlefield. A tender that specifies "data residency in the EU" invites washing; a tender that specifies "ultimate ownership and control within EU jurisdiction" excludes it in four words. The Digital Sovereignty Package audit applies the criterion to the EU's own flagship programme. It applies to identity as forcefully as to compute — see The Wallet Is the Point. And ownership does not only determine whose courts can reach a workload; it determines whose war the building is in — see Every Rack Is a Target. Read as a governance test rather than a jurisdictional one, the same question — who can rewrite the rules, and can anyone outside verify it — is the content-neutral ground on which a public office decides which platforms it will use in its own name: see What You Won't Give Up Is What You Are.

First public appearance

First used publicly on Bluesky (@jpahonen.eurosky.social); the origin thread will be linked here permanently.