<!-- SPDX-FileCopyrightText: 2008-2026 Hack23 AB -->
<!-- SPDX-License-Identifier: Apache-2.0 -->
<p align="center">
<img src="https://hack23.com/icon-192.png" alt="Hack23 Logo" width="192" height="192">
</p>
<h1 align="center">๐ต๏ธ Citizen Intelligence Agency</h1>
<p align="center">
<strong>Swedish Political Intelligence Platform โ democratic transparency, evidence-based analysis, and OSINT-powered accountability for the Riksdag, the Government, and Swedish public agencies.</strong><br>
<em>๐ต๏ธ Political intelligence ยท ๐ Radical transparency ยท ๐ 50+ years of evidence ยท ๐ก๏ธ ISMS-aligned ยท โ๏ธ Independent & non-partisan</em>
</p>
<p align="center">
<a href="https://hack23.github.io/cia/"><img src="https://img.shields.io/badge/๐_Maven_Site-hack23.github.io%2Fcia-006B3F?style=for-the-badge" alt="Maven Site"/></a>
<a href="https://hack23.com/cia-features.html"><img src="https://img.shields.io/badge/โจ_Features-hack23.com-00338D?style=for-the-badge&logoColor=FECC00" alt="Features"/></a>
<a href="https://deepwiki.com/Hack23/cia"><img src="https://img.shields.io/badge/๐_DeepWiki-Architecture_Wiki-7B1FA2?style=for-the-badge" alt="DeepWiki"/></a>
<a href="https://github.com/Hack23/cia/releases"><img src="https://img.shields.io/badge/๐ฆ_Releases-GitHub-181717?style=for-the-badge&logo=github" alt="Releases"/></a>
</p>
<p align="center">
<a href="#"><img src="https://img.shields.io/badge/Owner-CEO-0A66C2?style=for-the-badge" alt="Owner"/></a>
<a href="#"><img src="https://img.shields.io/badge/Classification-Public-success?style=for-the-badge" alt="Classification"/></a>
<a href="#"><img src="https://img.shields.io/badge/Source-Java_21-blue?style=for-the-badge&logo=openjdk" alt="Java Source"/></a>
<a href="#"><img src="https://img.shields.io/badge/Runtime-Java_27-brightgreen?style=for-the-badge&logo=openjdk" alt="Java Runtime"/></a>
<a href="#"><img src="https://img.shields.io/badge/Review-Annual-orange?style=for-the-badge" alt="Review Cycle"/></a>
</p>
[](https://scorecard.dev/viewer/?uri=github.com/Hack23/cia)
[](https://bestpractices.coreinfrastructure.org/projects/770)
[](https://github.com/Hack23/cia/attestations)
[](https://app.fossa.io/projects/git%2Bgithub.com%2FHack23%2Fcia?ref=badge_shield)
[](https://github.com/Hack23/cia/blob/master/LICENSE.txt)
[](https://github.com/Hack23/cia/releases)
[](https://deepwiki.com/Hack23/cia)
[](https://cla-assistant.io/Hack23/cia)
[](https://github.com/Hack23/cia/actions/workflows/codeql-analysis.yml)
[](https://github.com/Hack23/cia/actions/workflows/release.yml)
[](https://github.com/Hack23/cia/actions/workflows/scorecards.yml)
[](https://github.com/Hack23/cia/actions/workflows/dependency-review.yml)
[](https://github.com/Hack23/cia/actions/workflows/zap-scan.yml)
[](https://github.com/Hack23/cia/actions/workflows/site-generation.yml)
[](https://github.com/Hack23/cia/actions/workflows/javadoc-generation.yml)
[](https://github.com/Hack23/cia/actions/workflows/validate-json-schemas.yml)
[](https://github.com/Hack23/cia/actions/workflows/validate-view-documentation.yml)
[](https://sonarcloud.io/summary/new_code?id=Hack23_cia)
[](https://sonarcloud.io/summary/new_code?id=Hack23_cia)
[](https://sonarcloud.io/summary/new_code?id=Hack23_cia)
[](https://sonarcloud.io/summary/new_code?id=Hack23_cia)
[](https://sonarcloud.io/summary/new_code?id=Hack23_cia)
[](https://sonarcloud.io/summary/new_code?id=Hack23_cia)
[](https://sonarcloud.io/summary/new_code?id=Hack23_cia)
[](https://sonarcloud.io/summary/new_code?id=Hack23_cia)
[](https://github.com/Hack23/ISMS-PUBLIC)
[](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
[](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md)
[](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md)
[](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Privacy_Policy.md)
[](CRA-ASSESSMENT.md)
[](THREAT_MODEL.md)
[](SECURITY_ARCHITECTURE.md)
---
## ๐ฏ Mission
> **Strengthen Swedish democracy through systematic transparency.**
The **Citizen Intelligence Agency (CIA)** is an independent, volunteer-driven, open-source-intelligence (OSINT) platform that puts **rigorous, evidence-based political intelligence** in the hands of every citizen, journalist, researcher, and policymaker. It monitors **Sweden's Riksdag (Parliament), the Government (Regeringskansliet), and public agencies (Myndigheter)** โ applying structured intelligence techniques (ACH, SWOT, MITRE ATT&CK, STRIDE, political-risk scoring) to the full open-data corpus going back to 1971.
We deliver:
- ๐ **Financial performance metrics** for politicians and government bodies
- โ ๏ธ **Risk assessment analytics** โ 50 behavioral detection rules across politicians, parties, committees, ministries and decisions
- ๐ **Political trend analysis** โ temporal, comparative, pattern-recognition, predictive, network and decision intelligence frameworks
- ๐ **Politician scoreboards & rankings** with multi-decade longitudinal coverage
- ๐ **Performance comparisons** โ party effectiveness, committee productivity, ministry oversight
- ๐ **Transparency insights** โ every metric traces back to a primary parliamentary source
The platform is **strictly independent, non-partisan, and Apache 2.0 licensed**, operated under the public **[Hack23 ISMS](https://github.com/Hack23/ISMS-PUBLIC)** with full **ISO 27001:2022 / NIST CSF 2.0 / CIS Controls v8.1** alignment. It does not collect end-user PII, does not run ads, and does not push narratives.
---
## ๐ Hack23 Civic Tech Ecosystem
CIA is the **canonical data backbone** for Hack23's growing portfolio of democratic-transparency platforms. Each repository is independently auditable, ISMS-aligned, and cross-linked through open data products and the public ISMS.
| Project | Role | Stack | Status |
|:--------|:-----|:------|:------:|
| ๐ต๏ธ **[Citizen Intelligence Agency (this repo)](https://github.com/Hack23/cia)** | Sweden โ full data backbone, 110 DB views, 50 risk rules, JSON export specifications | Java 26 / Spring / Vaadin / PostgreSQL 18 | [](https://scorecard.dev/viewer/?uri=github.com/Hack23/cia) |
| ๐ณ๏ธ **[Riksdagsmonitor](https://github.com/Hack23/riksdagsmonitor)** ยท [riksdagsmonitor.com](https://riksdagsmonitor.com) | Sweden โ public news & dashboards, AI agentic newsroom (14 languages), consumes CIA exports nightly | TypeScript / Vite / Chart.js / D3 / GitHub Actions Agentic Workflows | [](https://scorecard.dev/viewer/?uri=github.com/Hack23/riksdagsmonitor) |
| ๐๏ธ **[EU Parliament Monitor](https://github.com/Hack23/euparliamentmonitor)** ยท [euparliamentmonitor.com](https://euparliamentmonitor.com) | European Parliament โ political intelligence, AI newsroom (14 languages) | TypeScript / Vite / GitHub Actions Agentic Workflows | [](https://scorecard.dev/viewer/?uri=github.com/Hack23/euparliamentmonitor) |
| ๐ค **[European Parliament MCP Server](https://github.com/Hack23/European-Parliament-MCP-Server)** | EP Open Data MCP server โ 60+ tools, OSINT analytics for AI agents | TypeScript / Model Context Protocol | [](https://scorecard.dev/viewer/?uri=github.com/Hack23/European-Parliament-MCP-Server) |
| ๐ก๏ธ **[Hack23 ISMS-PUBLIC](https://github.com/Hack23/ISMS-PUBLIC)** | The apex Information Security Management System โ 32+ public policies governing all repositories | Markdown / Mermaid / GitHub-native | โ |
| ๐ **[Hack23 Homepage](https://github.com/Hack23/homepage)** ยท [hack23.com](https://hack23.com) | Corporate site, blog, agent biographies, [feature showcase](https://hack23.com/cia-features.html) | TypeScript / Static | โ |
> **Data flow:** CIA โ JSON export specs (`json-export-specs/`) โ Riksdagsmonitor consumes via `update-cia-csv-data.yml` โ AI newsroom publishes daily articles in 14 languages, every claim traceable to a `dok_id` in the CIA corpus.
---
## โจ Features at a Glance
Explore the [comprehensive feature showcase](https://hack23.com/cia-features.html) on hack23.com:
- ๐ Interactive political dashboards ([๐ฌ๐ง English](dashboard.md) ยท [๐ธ๐ช Svenska](dashboard_sv.md))
- ๐ Politician scoreboards and ranking systems
- ๐ 50 risk rules ยท 110 database views ยท 6 analytical frameworks
- ๐ Transparency metrics across **49 Maven modules** (1,300+ Java files)
- โ๏ธ Accountability measures spanning Riksdag, Government, agencies
- ๐ฑ Data-driven insights backed by official Swedish open data
- ๐ต๏ธ Full OSINT pipeline โ Riksdagen API, Valmyndigheten, World Bank, ESV
- ๐ Defense-in-depth security, OpenSSF Scorecard 7.2/10, **zero critical CVEs for 5+ years**
For the conceptual model, see **[ARCHITECTURE.md](ARCHITECTURE.md)** and **[MINDMAP.md](MINDMAP.md)**.
---
## ๐ Intelligence Metrics (v1.36.0)
| Category | Count | Description |
|:---------|:-----:|:------------|
| ๐ง **Analysis Frameworks** | **6** | Temporal ยท Comparative ยท Pattern Recognition ยท Predictive ยท Network ยท Decision Intelligence |
| โ ๏ธ **Risk Rules** | **50** | 24 politician ยท 10 party ยท 4 committee ยท 4 ministry ยท 5 decision ยท 3 other |
| ๐๏ธ **Database Views** | **110** | 77 regular + 33 materialized โ see [DATABASE_VIEW_INTELLIGENCE_CATALOG.md](DATABASE_VIEW_INTELLIGENCE_CATALOG.md) |
| ๐ **OSINT Data Sources** | **4** | Riksdagen ยท Valmyndigheten ยท World Bank ยท ESV |
| ๐ฐ **Intelligence Products** | **10+** | Scorecards ยท Coalition analysis ยท Risk assessments ยท Trend reports ยท Decision tracking |
| ๐งฉ **Maven Modules** | **49+** | Multi-module, layered architecture |
| ๐ค **Custom Copilot Agents** | **6** | task-agent ยท stack-specialist ยท ui-enhancement-specialist ยท intelligence-operative ยท business-development-specialist ยท marketing-specialist |
| ๐ง **Copilot Skills** | **80+** | Security ยท Compliance ยท Testing ยท Architecture ยท Intelligence ยท UI/UX ยท Cloud (see [`.github/skills/`](.github/skills/)) |
> **Coverage policy:** per the [Hack23 Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md), we maintain **โฅ 80 % line coverage** and **โฅ 70 % branch coverage** across all modules. Live JaCoCo: [hack23.github.io/cia/jacoco/](https://hack23.github.io/cia/jacoco/).
---
## ๐ Authoritative Data Sources
CIA's analyses are powered exclusively by **authoritative Swedish government and international open data**:
| Source | Scope | Module |
|:-------|:------|:-------|
| ๐๏ธ **[Swedish Parliament Open Data](http://data.riksdagen.se/)** | Members, committees, motions, propositions, votes, documents | [`service.external.riksdagen`](service.external.riksdagen/) |
| ๐ณ๏ธ **[Swedish Election Authority โ Valmyndigheten](http://www.val.se/)** | Election results, voter turnout, electoral statistics | [`service.external.val`](service.external.val/) |
| ๐ **[World Bank Open Data](http://data.worldbank.org/)** | Global economic, governance and demographic indicators | [`service.external.worldbank`](service.external.worldbank/) |
| ๐น **[Ekonomistyrningsverket โ ESV](https://www.esv.se/psidata/)** | Government finances, budget execution, agency spending | [`service.external.esv`](service.external.esv/) |
> All data is processed under **GDPR Art. 6(1)(e)** (public interest) and **Art. 9(2)(e)/(g)** (manifestly made public / substantial public interest) for the political opinions of public officials. **No end-user PII is collected.**
---
## ๐๏ธ Architecture & Documentation Map
> **Full system architecture (C4 Context / Container / Component / Dynamic views) lives in [`ARCHITECTURE.md`](ARCHITECTURE.md)** (v1.1, 2026-04-20).
### Current state
| Document | Focus | Description |
|:---------|:------|:------------|
| ๐๏ธ [Architecture](ARCHITECTURE.md) | C4 model | Current system structure |
| ๐ [Data Model](DATA_MODEL.md) | Data | Database schema, entity relationships |
| ๐ [Flowcharts](FLOWCHART.md) | Process | Data processing workflows |
| ๐ [State Diagrams](STATEDIAGRAM.md) | Behavior | System state transitions |
| ๐บ๏ธ [Mindmaps](MINDMAP.md) | Concept | Component relationships |
| ๐ผ [SWOT Analysis](SWOT.md) | Business | Strategic assessment |
| ๐ก๏ธ [Security Architecture](SECURITY_ARCHITECTURE.md) | Security | Defense-in-depth implementation |
| ๐ฏ [Threat Model](THREAT_MODEL.md) | Security | STRIDE / MITRE ATT&CK analysis |
| ๐ก๏ธ [CRA Assessment](CRA-ASSESSMENT.md) | Compliance | EU Cyber Resilience Act conformity |
| ๐ [ISMS Compliance Mapping](ISMS_COMPLIANCE_MAPPING.md) | ISMS | 32 ISMS policies โ CIA controls |
| ๐ฐ [Financial Security Plan](FinancialSecurityPlan.md) | Cost | AWS security cost & ROI |
| ๐ [Business Continuity Plan](BCPPlan.md) | Resilience | RTO / RPO targets |
| ๐ผ [Business Product Document](BUSINESS_PRODUCT_DOCUMENT.md) | Business | Data-product strategy |
| โ๏ธ [CI/CD Workflows](WORKFLOWS.md) | DevOps | Automation processes |
| ๐งช [Unit Test Plan](UnitTestPlan.md) | Testing | Strategy & coverage |
| ๐ [E2E Test Plan](E2ETestPlan.md) | Testing | End-to-end testing |
| ๐
[End-of-Life Strategy](End-of-Life-Strategy.md) | Lifecycle | Maintenance and EOL planning |
| ๐ [Documentation Naming Convention](DOCUMENTATION_NAMING_CONVENTION.md) | Standards | Naming standards |
### Future state (2026 โ 2037)
| Document | Focus |
|:---------|:------|
| ๐ [Future Architecture](FUTURE_ARCHITECTURE.md) | Future C4 model |
| ๐ [Future Data Model](FUTURE_DATA_MODEL.md) | Enhanced data architecture |
| ๐ [Future Flowcharts](FUTURE_FLOWCHART.md) | AI-driven workflows |
| ๐ [Future State Diagrams](FUTURE_STATEDIAGRAM.md) | Adaptive transitions |
| ๐บ๏ธ [Future Mindmaps](FUTURE_MINDMAP.md) | Capability evolution |
| ๐ผ [Future SWOT](FUTURE_SWOT.md) | Strategic opportunities |
| ๐ก๏ธ [Future Security Architecture](FUTURE_SECURITY_ARCHITECTURE.md) | PQC / AI-augmented controls |
| ๐ฏ [Future Threat Model](FUTURE_THREAT_MODEL.md) | AI / PQC threat landscape |
| โ๏ธ [Future Workflows](FUTURE_WORKFLOWS.md) | ML-enhanced CI/CD |
---
## ๐ Intelligence & Analytics Documentation
CIA's intelligence operations (INTOP) and OSINT capabilities are documented and version-controlled. Every framework, rule, and view has a public source of truth.
### Intelligence changelog
| Document | Focus | Description |
|:---------|:------|:------------|
| ๐ **[Intelligence Evolution Changelog](CHANGELOG_INTELLIGENCE.md)** | Unified | Comprehensive tracking of intelligence capabilities, views, risk rules, frameworks |
### Core intelligence documentation
| Document | Focus | Highlights |
|:---------|:------|:-----------|
| ๐ฏ [Data Analysis โ INTOP / OSINT](DATA_ANALYSIS_INTOP_OSINT.md) | Frameworks | 6 frameworks (Temporal, Comparative, Pattern, Predictive, Network, Decision) |
| ๐ด [Risk Rules โ INTOP / OSINT](RISK_RULES_INTOP_OSINT.md) | Rules | 50 behavioral detection rules across 6 categories |
| ๐๏ธ [Database View Intelligence Catalog](DATABASE_VIEW_INTELLIGENCE_CATALOG.md) | Views | 110 views (77 regular + 33 materialized) |
| ๐ [Data Quality Monitoring Dashboard](DATA_QUALITY_MONITORING_DASHBOARD.md) | Quality | OSINT, DB-health, view-validation metrics |
| ๐บ๏ธ [Intelligence Data Flow Map](INTELLIGENCE_DATA_FLOW.md) | Pipeline | Framework-to-view relationships |
| ๐๏ธ [Liquibase Intelligence Analysis](LIQUIBASE_CHANGELOG_INTELLIGENCE_ANALYSIS.md) | Schema | Database schema evolution from intelligence perspective |
| โ๏ธ [Drools Risk Rules](DROOLS_RISK_RULES.md) | Engine | Drools rules engine documentation |
### Intelligence automation
| Tool | Purpose | Location |
|:-----|:--------|:---------|
| **Intelligence Changelog Generator** | Auto-detection of view / rule / framework changes | [`generate-intelligence-changelog.sh`](.github/scripts/generate-intelligence-changelog.sh) |
| **GitHub Actions Workflow** | On-demand changelog generation | [`generate-intelligence-changelog.yml`](.github/workflows/generate-intelligence-changelog.yml) |
```bash
# Generate intelligence changelog from recent changes
.github/scripts/generate-intelligence-changelog.sh
# Compare specific commits
.github/scripts/generate-intelligence-changelog.sh <prev_commit> <current_commit>
```
### Documentation navigation by role
<table>
<tr>
<td width="50%" valign="top">
#### ๐ For Data Analysts
1. **Start:** [Data Analysis Frameworks](DATA_ANALYSIS_INTOP_OSINT.md)
2. **Then:** [Database View Catalog](DATABASE_VIEW_INTELLIGENCE_CATALOG.md)
3. **Reference:** [Intelligence Data Flow Map](INTELLIGENCE_DATA_FLOW.md)
#### ๐๏ธ For Database Administrators
1. **Start:** [Schema Maintenance Guide](service.data.impl/README-SCHEMA-MAINTENANCE.md)
2. **Then:** [Data Quality Dashboard](DATA_QUALITY_MONITORING_DASHBOARD.md)
3. **Reference:** [Database View Catalog](DATABASE_VIEW_INTELLIGENCE_CATALOG.md)
4. **Track:** [Intelligence Changelog](CHANGELOG_INTELLIGENCE.md)
</td>
<td width="50%" valign="top">
#### ๐ต๏ธ For Intelligence Operatives
1. **Start:** [Intelligence Data Flow Map](INTELLIGENCE_DATA_FLOW.md)
2. **Then:** [Data Analysis Frameworks](DATA_ANALYSIS_INTOP_OSINT.md)
3. **Deep dive:** [Risk Rules](RISK_RULES_INTOP_OSINT.md)
#### ๐ For Product Managers
1. **Start:** [Business Product Document](BUSINESS_PRODUCT_DOCUMENT.md)
2. **Then:** [Data Analysis Frameworks](DATA_ANALYSIS_INTOP_OSINT.md)
3. **Explore:** [Database View Catalog](DATABASE_VIEW_INTELLIGENCE_CATALOG.md)
</td>
</tr>
</table>
---
## ๐ Security, Privacy & ISMS Compliance
> Full controls in **[`SECURITY_ARCHITECTURE.md`](SECURITY_ARCHITECTURE.md)** ยท threat analysis in **[`THREAT_MODEL.md`](THREAT_MODEL.md)** ยท CRA conformity in **[`CRA-ASSESSMENT.md`](CRA-ASSESSMENT.md)** ยท ISMS-PUBLIC โ CIA mapping in **[`ISMS_COMPLIANCE_MAPPING.md`](ISMS_COMPLIANCE_MAPPING.md)** (32 policies, 100+ controls).
### Security through transparency
> *"Our commitment to transparency extends to our security practices โ demonstrating that true security comes from robust processes, continuous improvement, and a culture where security is integrated into every business decision."*
> **โ James Pether Sรถrling, CISSP, CISM, CEO/Founder, Hack23 AB**
<table>
<tr>
<td width="50%" align="center">
<h3>๐ Public ISMS Repository</h3>
<p>Complete Information Security Management System</p>
<a href="https://github.com/Hack23/ISMS-PUBLIC">
<img src="https://img.shields.io/badge/ISMS-PUBLIC-0066CC?style=for-the-badge&logo=github&logoColor=white" alt="ISMS Public Repository">
</a>
</td>
<td width="50%" align="center">
<h3>๐ Information Security Policy</h3>
<p>The apex policy governing every Hack23 repository</p>
<a href="https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md">
<img src="https://img.shields.io/badge/Security-Policy-DC143C?style=for-the-badge&logo=shield&logoColor=white" alt="Information Security Policy">
</a>
</td>
</tr>
</table>
### Classification (per [Hack23 Classification Framework](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md))
| Dimension | Level | Note |
|:----------|:------|:-----|
| ๐ **Confidentiality** | ๐ข Public | Open civic-transparency platform; all source data intentionally disclosed |
| โ
**Integrity** | ๐ High | Automated validation, GPG-signed commits, SLSA 3 build provenance, Javers auditing |
| โฑ๏ธ **Availability** | ๐ก Moderate | Multi-AZ AWS deployment with RDS Multi-AZ, ALB, automated patching |
| ๐ท๏ธ **Privacy** | ๐ Personal (public officials only) | GDPR Art. 6(1)(e/f) ยท Art. 9(2)(e)/(g); **no end-user PII**, no accounts forced, no ads, no tracking |
| โฑ๏ธ **RTO / RPO** | 1โ4 h / 1โ4 h | Automated backups, multi-region disaster recovery |
| ๐ฐ **Business impact** | ๐ข Negligible (financial) ยท ๐ High (reputational) ยท ๐ก Moderate (regulatory) | Open-source, volunteer-driven |
### Compliance frameworks
- โ
**ISO 27001:2022** โ Annex A controls implemented (see [ISMS_COMPLIANCE_MAPPING.md](ISMS_COMPLIANCE_MAPPING.md))
- โ
**NIST CSF 2.0** โ 6 functions aligned (Govern ยท Identify ยท Protect ยท Detect ยท Respond ยท Recover)
- โ
**CIS Controls v8.1** โ implementation tracked
- โ
**GDPR** โ public-interest / legitimate-interest grounds for public-official data; political opinions under Art. 9(2)(e)/(g)
- โ
**EU Cyber Resilience Act (CRA)** โ self-assessment in [`CRA-ASSESSMENT.md`](CRA-ASSESSMENT.md)
- โ
**OpenSSF Best Practices** โ [Project #770](https://bestpractices.coreinfrastructure.org/projects/770)
- โ
**AWS Well-Architected** โ Security pillar aligned
### Defence-in-depth highlights
- ๐ **Authentication & authorization** โ Spring Security 5.8.16, MFA, role-based access control, login blocking, Passay password policies
- ๐งฑ **Network security** โ AWS VPC with private subnets, NACLs, NAT Gateway, VPC Flow Logs, AWS WAF (OWASP rule set), VPC Endpoints
- ๐ **Cryptography** โ TLS 1.3 (HTTPS-only, HSTS), AES-256 encryption at rest (KMS-managed keys), Bouncy Castle 1.84
- ๐ **Audit & integrity** โ Javers data auditing, pgaudit, CloudTrail, immutable Git history, GPG-signed commits
- ๐ต๏ธ **Threat detection** โ AWS GuardDuty, Security Hub, CloudWatch alarms, CodeQL, OWASP Dependency-Check, ZAP DAST scans
- ๐ก๏ธ **Supply chain security** โ SHA-pinned actions, Dependabot, secret scanning, dependency review, SLSA 3 attestations, FOSSA license analysis
- ๐ค **AI governance** โ agent operations governed by [Hack23 AI Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/AI_Policy.md) (OWASP LLM + EU AI Act alignment)
### Public security evidence
| Evidence | Status | Link |
|:---------|:------:|:-----|
| ๐ **OpenSSF Scorecard** | 7.2 / 10 | [scorecard.dev](https://scorecard.dev/viewer/?uri=github.com/Hack23/cia) |
| ๐ก๏ธ **CodeQL Scanning** | โ
Active | [Security tab](https://github.com/Hack23/cia/security/code-scanning) |
| ๐จ **Dependabot** | โ
Active | [Vulnerability alerts](https://github.com/Hack23/cia/security/dependabot) |
| ๐ **Secret Scanning** | โ
Active | GitHub Advanced Security |
| ๐ **SonarCloud Security** | โ
Active | [Security hotspots](https://sonarcloud.io/project/security_hotspots?id=Hack23_cia) |
| ๐ก๏ธ **SLSA Provenance** | Level 3 | [Attestations](https://github.com/Hack23/cia/attestations) |
| ๐ **FOSSA License Compliance** | โ
Active | [License report](https://app.fossa.io/projects/git%2Bgithub.com%2FHack23%2Fcia) |
| ๐ **CII Best Practices** | โ
Passing | [Project #770](https://bestpractices.coreinfrastructure.org/projects/770) |
| ๐ก๏ธ **Zero critical CVEs** | โ
5+ years | Continuously verified |
---
## ๐ Runtime & Build Environment
<div align="center">
| JDK Version | Status | Notes |
|:------------|:-------|:------|
|  | **Source Level (LTS)** | Maven `maven.compiler.source` / `target` = 21 |
|  | Compatible (LTS) | Previous production runtime |
|  | Compatible | Previous production runtime |
|  | **Current Runtime** | Active production runtime |
</div>
### Development environment
| Component | Version | Purpose |
|:----------|:-------:|:--------|
| **Java JDK** | 27 (Temurin) | Runtime โ [Adoptium](https://adoptium.net/) |
| **Java Source** | 21 | Source compatibility โ Maven compiler |
| **Maven** | 3.10.0+ | Build automation โ [Maven](https://maven.apache.org/install.html) |
| **Node.js** | 24+ | Copilot MCP servers, Playwright testing |
| **PostgreSQL** | 18 | Database with `pgaudit`, `pgcrypto`, `pg_stat_statements` |
For the canonical setup, see [`copilot-setup-steps.yml`](.github/workflows/copilot-setup-steps.yml) and [`End-of-Life-Strategy.md`](End-of-Life-Strategy.md).
### Quick start
```bash
# Build the project (skipping tests)
mvn clean install -DskipTests
# Build with tests
mvn clean install
# Run only unit tests (skip integration & XML adapter tests)
mvn test -Dtest='!**ITest*,!**/XmlDateTypeAdapterTest,!**/XmlTimeTypeAdapterTest,!**/XmlDateTimeTypeAdapterTest'
# Tests with JaCoCo coverage
mvn clean test jacoco:report
# OWASP dependency-check
mvn dependency-check:check
# Run the main module
cd citizen-intelligence-agency
mvn spring-boot:run
```
> ๐ก **Database changes** must follow [`service.data.impl/README-SCHEMA-MAINTENANCE.md`](service.data.impl/README-SCHEMA-MAINTENANCE.md). Never manually edit `full_schema.sql` โ always regenerate via `pg_dump`.
---
## ๐ง Technology Stack
| Category | Technologies |
|:---------|:-------------|
| **Core Framework** | [Spring Framework 5.x](https://spring.io/projects/spring-framework) |
| **Security** | [Spring Security 5.8.16](https://spring.io/projects/spring-security) ยท [Bouncy Castle 1.84](https://www.bouncycastle.org/) ยท [Passay 2.0.0](https://www.passay.org/) |
| **Persistence** | [Hibernate](https://hibernate.org/orm/) ยท [JPA / Jakarta](https://jakarta.ee/specifications/persistence/) ยท [PostgreSQL 18](https://www.postgresql.org/) ยท [Liquibase](https://www.liquibase.org/) |
| **Transactions** | [Narayana](https://narayana.io/) (XA / 2PC) integrated with Spring `JpaTransactionManager` |
| **Auditing** | [Javers](https://javers.org/) โ change tracking & versioning |
| **Rules Engine** | [Drools](https://www.drools.org/) โ 50 behavioral risk rules |
| **Messaging** | [ActiveMQ Artemis](https://activemq.apache.org/components/artemis/) ยท [Spring JMS](https://spring.io/projects/spring-framework) |
| **Web / UI** | [Vaadin 8.14.4](https://vaadin.com/) ยท Vaadin Sass / Themes ยท [Jetty 12.1.8 EE8](https://eclipse.dev/jetty/) |
| **Monitoring** | [JavaMelody](https://github.com/javamelody/javamelody) ยท [AWS SDK CloudWatch](https://aws.amazon.com/cloudwatch/) |
| **Testing** | [JUnit](https://junit.org/) ยท [Mockito](https://site.mockito.org/) ยท [Spring Test](https://docs.spring.io/spring-framework/docs/current/reference/html/testing.html) ยท [Selenium WebDriver](https://www.selenium.dev/) ยท [Playwright](https://playwright.dev/) |
| **Utilities** | [Apache Commons](https://commons.apache.org/) ยท [Google Guava](https://guava.dev/) ยท [SLF4J](http://www.slf4j.org/) ยท [Logback](https://logback.qos.ch/) ยท [Jackson](https://github.com/FasterXML/jackson) |
| **Build** | [Apache Maven 3.10.0+](https://maven.apache.org/) โ 49+ modules |
| **CI / CD** | [GitHub Actions](https://github.com/Hack23/cia/actions) ยท [SonarCloud](https://sonarcloud.io/project/overview?id=Hack23_cia) ยท [CodeQL](https://github.com/Hack23/cia/security/code-scanning) ยท [OWASP ZAP](https://www.zaproxy.org/) ยท [Dependabot](https://github.com/Hack23/cia/security/dependabot) ยท [Step Security Harden-Runner](https://github.com/step-security/harden-runner) |
For the full stack and current versions, see [`techstack.yml`](techstack.yml) and the per-module Maven sites at [hack23.github.io/cia/](https://hack23.github.io/cia/).
---
## โ๏ธ AWS Cloud Architecture
CIA's reference deployment is provisioned via **CloudFormation** (`cia-dist-cloudformation/`) and follows the [AWS Well-Architected Security Pillar](https://aws.amazon.com/architecture/well-architected/).
| Layer | Service | Purpose |
|:------|:--------|:--------|
| ๐ **Networking** | [VPC](https://aws.amazon.com/vpc/) ยท NAT Gateway ยท NACLs ยท VPC Endpoints ยท [WAF](https://aws.amazon.com/waf/) ยท VPC Flow Logs | Isolated, segmented, web-attack-protected network |
| ๐ **IAM & Crypto** | [IAM](https://aws.amazon.com/iam/) ยท [KMS](https://aws.amazon.com/kms/) ยท [ACM](https://aws.amazon.com/certificate-manager/) ยท [Secrets Manager](https://aws.amazon.com/secrets-manager/) | Least privilege ยท key management ยท TLS ยท rotated secrets |
| ๐ **DNS / SSL** | [Route 53](https://aws.amazon.com/route53/) ยท [ACM](https://aws.amazon.com/certificate-manager/) | Domain & certificate management |
| โ๏ธ **Compute** | [EC2](https://aws.amazon.com/ec2/) ยท [ALB](https://aws.amazon.com/elasticloadbalancing/application-load-balancer/) | Stateless application tier |
| ๐พ **Data** | [RDS PostgreSQL Multi-AZ](https://aws.amazon.com/rds/) ยท [S3](https://aws.amazon.com/s3/) (KMS-encrypted, lifecycle-policied) | Persistence + artifact storage |
| ๐ **Observability** | [CloudWatch](https://aws.amazon.com/cloudwatch/) ยท CloudTrail ยท [Config](https://aws.amazon.com/config/) | Metrics ยท logs ยท audit ยท compliance drift |
| ๐ก๏ธ **Threat Detection** | [GuardDuty](https://aws.amazon.com/guardduty/) ยท [Security Hub](https://aws.amazon.com/security-hub/) | ML-based threat detection ยท centralized findings |
| ๐ **Operations** | [Systems Manager](https://aws.amazon.com/systems-manager/) ยท [Resilience Hub](https://aws.amazon.com/resilience-hub/) | Automated patching ยท DR posture |
> ๐ **CloudFormation diagram:** 
For full security-control mapping, see [`SECURITY_ARCHITECTURE.md`](SECURITY_ARCHITECTURE.md) and [`FinancialSecurityPlan.md`](FinancialSecurityPlan.md).
---
## ๐ฆ Deployment Options
### 1๏ธโฃ AWS CloudFormation
1. Download the [CloudFormation template](cia-dist-cloudformation/src/main/resources/cia-dist-cloudformation.json)
2. Create a stack in the AWS CloudFormation console
3. Upload the template, configure parameters, acknowledge IAM, launch
4. Access the application via the URL in the stack outputs
### 2๏ธโฃ Debian / Ubuntu (24.04+)
```bash
# 1. Add PostgreSQL PGDG repository (required for PostgreSQL 18 on Ubuntu 24.04)
sudo install -d /usr/share/postgresql-common/pgdg
sudo curl -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc --fail https://www.postgresql.org/media/keys/ACCC4CF8.asc
echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" | sudo tee /etc/apt/sources.list.d/pgdg.list
sudo apt-get update
# 2. Install prerequisites
sudo apt-get install openjdk-21-jdk postgresql-18 postgresql-contrib-18 postgresql-18-pgaudit postgresql-18-pgvector
# 3. Configure PostgreSQL (see "PostgreSQL 18 Configuration Guide" below)
# 4. Install the CIA Debian package
wget https://github.com/Hack23/cia/releases/download/2025.1.2/cia-dist-deb-2025.1.2.all.deb
sudo dpkg -i cia-dist-deb-2025.1.2.all.deb
# 5. Access at https://localhost:28443/cia/
```
---
## ๐ PostgreSQL 18 Configuration Guide
A reference configuration with SSL, prepared transactions, and the required extensions.
### 1. Enable prepared transactions and extensions
Edit `/etc/postgresql/18/main/postgresql.conf`:
```ini
max_prepared_transactions = 100
shared_preload_libraries = 'pg_stat_statements, pgaudit, pgcrypto'
pgaudit.log = ddl
pg_stat_statements.track = all
pg_stat_statements.max = 10000
```
### 2. IPv6 loopback access
Edit `/etc/postgresql/18/main/pg_hba.conf`:
```ini
host all all ::1/128 md5
```
### 3. SSL certificates
```bash
# Generate passphrase, key and self-signed certificate (10-year validity)
openssl rand -base64 48 > passphrase.txt
openssl genrsa -des3 -passout file:passphrase.txt -out server.pass.key 2048
openssl rsa -passin file:passphrase.txt -in server.pass.key -out server.key && rm server.pass.key
openssl req -new -key server.key -out server.csr \
-subj "/C=UK/ST=Postgresqll/L=Docker/O=Hack23/OU=demo/CN=127.0.0.1"
openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.crt
rm passphrase.txt server.csr
```
### 4. Deploy SSL artefacts
```bash
cp server.crt /var/lib/postgresql/18/main/server.crt
cp server.key /var/lib/postgresql/18/main/server.key && rm server.key
chmod 600 /var/lib/postgresql/18/main/server.key
chmod 644 /var/lib/postgresql/18/main/server.crt
chown -R postgres:postgres /var/lib/postgresql/18/main/
echo "ssl_cert_file = '/var/lib/postgresql/18/main/server.crt'" \
>> /etc/postgresql/18/main/postgresql.conf
echo "ssl_key_file = '/var/lib/postgresql/18/main/server.key'" \
>> /etc/postgresql/18/main/postgresql.conf
```
### 5. CIA user trust certificate
```bash
mkdir -p /opt/cia/.postgresql
cp server.crt /opt/cia/.postgresql/root.crt
chmod 700 /opt/cia/.postgresql/root.crt
chown -R cia:cia /opt/cia/.postgresql/root.crt
rm server.crt
```
### 6. Performance tuning
For optimal performance with CIA's 110 views and 93 tables:
| Setting | 4 GB RAM | 8 GB RAM | 16 GB+ RAM (production) |
|:--------|:--------:|:--------:|:-----------------------:|
| `shared_buffers` | 1 GB | 2 GB | 4 GB |
| `effective_cache_size` | 3 GB | 6 GB | 12 GB |
| `maintenance_work_mem` | 256 MB | 512 MB | 1 GB |
| `work_mem` | 16 MB | 32 MB | 50 MB |
```sql
-- 8 GB RAM example โ adjust to your hardware
ALTER SYSTEM SET shared_buffers = '2GB';
ALTER SYSTEM SET effective_cache_size = '6GB';
ALTER SYSTEM SET maintenance_work_mem = '512MB';
ALTER SYSTEM SET work_mem = '32MB';
-- Checkpoints, WAL
ALTER SYSTEM SET checkpoint_completion_target = 0.9;
ALTER SYSTEM SET wal_buffers = '16MB';
ALTER SYSTEM SET max_wal_size = '4GB';
ALTER SYSTEM SET min_wal_size = '1GB';
-- SSD-optimised query planner
ALTER SYSTEM SET random_page_cost = 1.1;
ALTER SYSTEM SET effective_io_concurrency = 200;
-- Connections
ALTER SYSTEM SET max_connections = 200;
-- Apply
SELECT pg_reload_conf();
```
> ๐ For full performance tuning, monitoring and advanced configuration, see [`service.data.impl/README-SCHEMA-MAINTENANCE.md`](service.data.impl/README-SCHEMA-MAINTENANCE.md).
### 7. Database setup
```bash
sudo su - postgres
psql
postgres=# CREATE USER eris WITH password 'discord';
postgres=# CREATE DATABASE cia_dev;
postgres=# GRANT ALL PRIVILEGES ON DATABASE cia_dev TO eris;
```
> โ ๏ธ The credentials above are for local development only. Use custom credentials and update `/opt/cia/webapps/cia/WEB-INF/database.properties` for any non-development deployment.
---
## ๐ค GitHub Copilot โ Custom Agents & Skills
CIA uses **GitHub Copilot custom agents and skills** as first-class development assets, governed by the [Hack23 AI Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/AI_Policy.md).
| Surface | Catalog | Count |
|:--------|:--------|:-----:|
| ๐ค **Custom agents** | [`.github/agents/README.md`](.github/agents/README.md) | **6** |
| ๐ง **Skills library** | [`.github/skills/README.md`](.github/skills/README.md) | **80+** |
| โ๏ธ **Workflows** | [`.github/workflows/`](.github/workflows/) | 14 |
| ๐ **MCP servers** | [`.github/copilot-mcp-config.json`](.github/copilot-mcp-config.json) | github ยท filesystem ยท memory ยท sequential-thinking ยท playwright |
| ๐ **Setup contract** | [`.github/workflows/copilot-setup-steps.yml`](.github/workflows/copilot-setup-steps.yml) | Java 27 ยท Maven 3.10.0 ยท PostgreSQL 18 |
### Available agents
| Agent | Specialty |
|:------|:----------|
| ๐ **[Task Agent](.github/agents/task-agent.md)** | Product quality, GitHub issue management, ISMS compliance |
| ๐ ๏ธ **[Stack Specialist](.github/agents/stack-specialist.md)** | Java 26 ยท Spring ยท Vaadin ยท Hibernate / JPA ยท PostgreSQL |
| ๐จ **[UI Enhancement Specialist](.github/agents/ui-enhancement-specialist.md)** | Vaadin ยท WCAG 2.1 AA ยท data visualization ยท privacy-by-design UI |
| ๐ต๏ธ **[Intelligence Operative](.github/agents/intelligence-operative.md)** | Political science ยท OSINT ยท structured analysis ยท Swedish politics |
| ๐ผ **[Business Development Specialist](.github/agents/business-development-specialist.md)** | Strategic planning ยท partnerships ยท sustainable revenue ยท market expansion |
| ๐ข **[Marketing Specialist](.github/agents/marketing-specialist.md)** | Digital marketing ยท content strategy ยท community building |
### Skills library highlights
The [skills library](.github/skills/) contains **80+ skills** across security-by-design, ISMS compliance, testing, architecture, intelligence, UI/UX, cloud, and product management. Highlights:
- ๐ **Security**: secure-code-review ยท threat-modeling ยท secrets-management ยท input-validation ยท crypto-best-practices ยท cis-controls ยท iso-27001-controls ยท ai-governance ยท ci-cd-security
- โ
**Compliance**: hack23-information-security-policy ยท hack23-isms-compliance ยท gdpr-compliance ยท compliance-frameworks ยท classification-framework-enforcement ยท open-source-policy
- ๐งช **Testing**: unit-testing-patterns ยท integration-testing ยท e2e-testing ยท playwright-ui-testing ยท testing-strategy-enforcement ยท code-quality-checks
- ๐๏ธ **Architecture**: hack23-future-architecture-standards ยท data-pipeline-engineering ยท api-integration ยท mcp-server-development ยท mcp-gateway-configuration ยท mcp-gateway-security
- ๐ต๏ธ **Intelligence & OSINT**: political-science-analysis ยท osint-methodologies ยท intelligence-analysis-techniques ยท swedish-political-system ยท electoral-analysis ยท legislative-monitoring ยท risk-assessment-frameworks ยท behavioral-analysis ยท strategic-communication-analysis ยท cia-data-integration ยท european-parliament-api
- ๐จ **UI / UX**: accessibility-wcag-patterns ยท advanced-data-visualization ยท data-visualization-principles ยท ui-ux-design-system ยท seo-best-practices
For the full taxonomy and agent โ skill matrix, see [`.github/skills/README.md`](.github/skills/README.md) and [`.github/agents/README.md`](.github/agents/README.md).
---
## ๐ Blog Posts & Technical Analysis
### โญ Simon Moon โ Architecture Chronicles
System Architect [Simon Moon](https://github.com/Hack23/homepage/blob/master/.github/agents/simon-moon.md) provides deep architectural analysis of CIA through the lens of pattern recognition:
- ๐๏ธ [CIA Architecture: The Five Pentacles](https://hack23.com/blog-cia-architecture.html) โ Five container types crystallised from the parliamentary domain
- ๐ [CIA Security: Defense Through Transparency](https://hack23.com/blog-cia-security.html) โ Five defensive layers; OpenSSF Scorecard 7.2/10; zero critical CVEs over 5+ years
- ๐ [CIA Future Security: The Pentagon of Tomorrow](https://hack23.com/blog-cia-future-security.html) โ Post-quantum cryptography & AI-augmented detection
- ๐ฐ [CIA Financial Strategy: $24.70/Day Democracy](https://hack23.com/blog-cia-financial-strategy.html) โ AWS-optimised cost architecture
- โ๏ธ [CIA Workflows: Five-Stage CI/CD & State Machines](https://hack23.com/blog-cia-workflows.html) โ DevSecOps automation
- ๐บ๏ธ [CIA Mindmaps: Conceptual Sacred Geometry](https://hack23.com/blog-cia-mindmaps.html) โ Hierarchical organisational patterns
### ๐ป George Dorn โ Code Analysis
Developer [George Dorn](https://github.com/Hack23/homepage/blob/master/.github/agents/george-dorn.md) provides hands-on code analysis based on actual repository inspection:
- ๐ [CIA Code Analysis](https://hack23.com/blog-george-dorn-cia-code.html) โ 49 modules, 1,300+ Java files, OpenSSF Scorecard 7.2/10
> *Full collection of 50+ blog posts on cybersecurity, ISMS policies and architectural patterns: [Hack23 Security Blog](https://hack23.com/blog.html).*
---
## ๐ Project Classification (per ISMS Classification Framework)
> See the descriptive [Classification table](#classification-per-hack23-classification-framework) above for confidentiality, integrity, availability, privacy and RTO/RPO levels with rationale. The formal badges below cover project type, Business Impact Analysis (BIA) and strategic position.
### ๐ฏ Project type
[](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md#project-type-classifications)
[](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md#project-type-classifications)
### ๐ฐ Business impact analysis matrix
| Impact | Financial | Operational | Reputational | Regulatory |
|:-------|:---------:|:-----------:|:------------:|:----------:|
| ๐ **Confidentiality** | ๐ข Negligible | ๐ข Negligible | ๐ข Low | ๐ข Low |
| โ
**Integrity** | ๐ข Negligible | ๐ High | ๐ High | ๐ก Moderate |
| โฑ๏ธ **Availability** | ๐ข Negligible | ๐ High | ๐ข Low | ๐ข Low |
### ๐ก๏ธ Security investment & strategic position
[](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md#security-investment-returns)
[](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md#security-investment-returns)
[](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md#competitive-differentiation)
[](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md#competitive-differentiation)
[](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md#porters-five-forces)
---
## ๐ Maven Site Documentation
The complete Maven-generated project documentation is published at **[hack23.github.io/cia](https://hack23.github.io/cia/)**:
| Resource | Link |
|:---------|:-----|
| ๐ Project reports & module sites | [Maven Site Home](https://hack23.github.io/cia/) |
| ๐๏ธ Hibernate entity model (hbm2doc) | [Entity Model](https://hack23.github.io/cia/service.data.impl/hbm2doc/entities/index.html) |
| ๐ Javadoc API reference | [Javadoc](https://hack23.github.io/cia/apidocs/index.html) |
| ๐ฆ Visual package dependencies | [Package graph](https://hack23.github.io/cia/apidocs/package-dependencies.svg) |
| ๐งช JaCoCo test coverage | [Coverage](https://hack23.github.io/cia/jacoco/) |
| ๐๏ธ Architecture overview | [Architecture](https://hack23.github.io/cia/architecture.html) |
| ๐พ Liquibase database documentation | [DB docs](https://hack23.github.io/cia/service.data.impl/dbDoc/index.html) |
### Key module sites
| Module | Description | Site |
|:-------|:------------|:-----|
| **citizen-intelligence-agency** | Main web application | [link](https://hack23.github.io/cia/citizen-intelligence-agency/) |
| **service.data.impl** | Data access & entity model | [link](https://hack23.github.io/cia/service.data.impl/) |
| **service.impl** | Core service implementation | [link](https://hack23.github.io/cia/service.impl/) |
| **service.api** | Service API definitions | [link](https://hack23.github.io/cia/service.api/) |
| **service.external.riksdagen** | Swedish Parliament integration | [link](https://hack23.github.io/cia/service.external.riksdagen/) |
| **service.external.worldbank** | World Bank integration | [link](https://hack23.github.io/cia/service.external.worldbank/) |
| **service.external.val** | Swedish Election Authority | [link](https://hack23.github.io/cia/service.external.val/) |
| **service.external.esv** | ESV financial data | [link](https://hack23.github.io/cia/service.external.esv/) |
| **web-widgets** | UI widget components | [link](https://hack23.github.io/cia/web-widgets/) |
---
## ๐ค Contributing
Contributions welcome under Hack23's secure-development standards.
1. Fork the repo and create a descriptive feature branch
2. **GPG-sign every commit** ยท enable **MFA** on your GitHub account
3. Run quality checks locally: `mvn clean install` (must pass tests + SonarCloud quality gate)
4. Submit a pull request with a comprehensive description; address review feedback
5. Sign the [CLA](https://cla-assistant.io/Hack23/cia)
6. Never introduce security vulnerabilities; follow [`CONTRIBUTING.md`](CONTRIBUTING.md), [`CODE_OF_CONDUCT.md`](CODE_OF_CONDUCT.md), and the [Hack23 Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
---
## ๐ Reporting Security Issues
For coordinated vulnerability disclosure, follow [`SECURITY.md`](SECURITY.md). The process aligns with the [Hack23 Vulnerability Management Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Vulnerability_Management.md) and the [Incident Response Plan](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Incident_Response_Plan.md).
---
## ๐ Related Documents (single index)
### ๐๏ธ Architecture & design
- [๐๏ธ Architecture](ARCHITECTURE.md) ยท [๐ Future Architecture](FUTURE_ARCHITECTURE.md)
- [๐ง Mindmap](MINDMAP.md) ยท [๐ Future Mindmap](FUTURE_MINDMAP.md)
- [๐ Data Model](DATA_MODEL.md) ยท [๐ Future Data Model](FUTURE_DATA_MODEL.md)
- [๐ Flowcharts](FLOWCHART.md) ยท [๐ Future Flowcharts](FUTURE_FLOWCHART.md)
- [๐ State Diagrams](STATEDIAGRAM.md) ยท [๐ Future State Diagrams](FUTURE_STATEDIAGRAM.md)
- [๐๏ธ Entity Model (hbm2doc)](https://hack23.github.io/cia/service.data.impl/hbm2doc/entities/index.html) ยท [๐ Javadoc](https://hack23.github.io/cia/apidocs/index.html) ยท [๐ฆ Package graph](https://hack23.github.io/cia/apidocs/package-dependencies.svg)
- [๐ Maven Site](https://hack23.github.io/cia/) ยท [๐ DeepWiki](https://deepwiki.com/Hack23/cia)
### ๐ก๏ธ Security & compliance
- [๐ Security Architecture](SECURITY_ARCHITECTURE.md) ยท [๐ Future Security Architecture](FUTURE_SECURITY_ARCHITECTURE.md)
- [๐ฏ Threat Model](THREAT_MODEL.md) ยท [๐ฎ Future Threat Model](FUTURE_THREAT_MODEL.md)
- [๐ ISMS Compliance Mapping](ISMS_COMPLIANCE_MAPPING.md) ยท [๐ฐ Financial Security Plan](FinancialSecurityPlan.md)
- [๐ CRA Assessment](CRA-ASSESSMENT.md) ยท [๐ Security Policy](SECURITY.md) ยท [๐ Business Continuity Plan](BCPPlan.md)
### ๐ Operations & development
- [โก Workflows](WORKFLOWS.md) ยท [๐ Future Workflows](FUTURE_WORKFLOWS.md)
- [๐
End-of-Life Strategy](End-of-Life-Strategy.md) ยท [๐งช Unit Test Plan](UnitTestPlan.md) ยท [๐ E2E Test Plan](E2ETestPlan.md)
- [๐ค Contributing](CONTRIBUTING.md) ยท [๐ Code of Conduct](CODE_OF_CONDUCT.md) ยท [๐ Doc naming](DOCUMENTATION_NAMING_CONVENTION.md)
### ๐จ Features & dashboards
- [โจ CIA Features (hack23.com)](https://hack23.com/cia-features.html)
- [๐ Dashboard (English)](dashboard.md) ยท [๐ Politisk Dashboard (Svenska)](dashboard_sv.md)
### ๐ค AI & development tools
- [๐ค Copilot Instructions](.github/copilot-instructions.md) ยท [๐ฅ Custom agents](.github/agents/README.md) ยท [๐ง Skills library](.github/skills/README.md)
### ๐ ISMS-PUBLIC policies governing this repository
- [๐ก๏ธ Information Security Policy (apex)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md)
- [๐ ๏ธ Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
- [๐ท๏ธ Classification Framework](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md)
- [๐ฏ Threat Modeling](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Threat_Modeling.md)
- [๐ Vulnerability Management](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Vulnerability_Management.md)
- [๐จ Incident Response Plan](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Incident_Response_Plan.md)
- [๐ Network Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Network_Security_Policy.md)
- [๐ Access Control Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Access_Control_Policy.md)
- [๐ Cryptography Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Cryptography_Policy.md)
- [๐พ Backup & Recovery Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Backup_Recovery_Policy.md)
- [๐ค AI Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/AI_Policy.md)
- [๐ Secrets Management Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secrets_Management_Policy.md)
- [๐ฆ Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md)
- [๐ Privacy Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Privacy_Policy.md) ยท [๐ก๏ธ Data Protection Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Data_Protection_Policy.md)
- [๐ Information Security Strategy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Strategy.md) ยท [๐ Security Metrics](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Security_Metrics.md)
[](https://github.com/Hack23/ISMS-PUBLIC)
---
## ๐ข About Hack23
**Hack23 AB** (Org.nr 559534-7807) โ Swedish cybersecurity & open-source-intelligence consultancy.
- ๐ Website: [www.hack23.com](https://www.hack23.com) ยท ๐ฐ [Blog](https://hack23.com/blog.html)
- ๐ผ [LinkedIn โ Hack23 AB](https://www.linkedin.com/company/hack23/)
- ๐จโ๐ป Founder: [James Pether Sรถrling, CISSP, CISM](https://www.linkedin.com/in/jamessorling/)
- ๐ก๏ธ [Public ISMS](https://github.com/Hack23/ISMS-PUBLIC) ยท ๐ต๏ธ [Citizen Intelligence Agency](https://github.com/Hack23/cia) ยท ๐ณ๏ธ [Riksdagsmonitor](https://github.com/Hack23/riksdagsmonitor) ยท ๐๏ธ [EU Parliament Monitor](https://github.com/Hack23/euparliamentmonitor) ยท ๐ค [European Parliament MCP Server](https://github.com/Hack23/European-Parliament-MCP-Server)
---
## ๐ License
Copyright ยฉ 2008โ2026 **Hack23 AB** (Org.nr 559534-7807). Licensed under the **Apache License 2.0** โ see [`LICENSE.txt`](LICENSE.txt).
[](https://app.fossa.io/projects/git%2Bgithub.com%2FHack23%2Fcia?ref=badge_large)
---
**๐ Project Classification:** see the [Project Classification](#-project-classification-per-isms-classification-framework) section above for the full BIA matrix and strategic position. Summary: **Data Analytics Platform (OSINT)** ยท Operations ยท Confidentiality ๐ข Public ยท Integrity ๐ High ยท Availability ๐ก Moderate ยท Aligned with **ISO 27001:2022 ยท NIST CSF 2.0 ยท CIS Controls v8.1 ยท AWS Well-Architected**.
---
<p align="center"><em>๐ต๏ธ Empower citizens ยท ๐ Strengthen democratic accountability ยท ๐๏ธ Illuminate the political process</em></p>