<!-- SPDX-FileCopyrightText: 2008-2026 Hack23 AB -->
<!-- SPDX-License-Identifier: Apache-2.0 -->
<p align="center">
<img src="https://hack23.com/icon-192.png" alt="Hack23 Logo" width="192" height="192">
</p>
<h1 align="center">🕵️ Citizen Intelligence Agency</h1>
<p align="center">
<strong>Swedish Political Intelligence Platform — democratic transparency, evidence-based analysis, and OSINT-powered accountability for the Riksdag, the Government, and Swedish public agencies.</strong><br>
<em>🕵️ Political intelligence · 🔍 Radical transparency · 📊 50+ years of evidence · 🛡️ ISMS-aligned · ⚖️ Independent & non-partisan</em>
</p>
<p align="center">
<a href="https://hack23.github.io/cia/"><img src="https://img.shields.io/badge/🌐_Maven_Site-hack23.github.io%2Fcia-006B3F?style=for-the-badge" alt="Maven Site"/></a>
<a href="https://hack23.com/cia-features.html"><img src="https://img.shields.io/badge/✨_Features-hack23.com-00338D?style=for-the-badge&logoColor=FECC00" alt="Features"/></a>
<a href="https://deepwiki.com/Hack23/cia"><img src="https://img.shields.io/badge/📚_DeepWiki-Architecture_Wiki-7B1FA2?style=for-the-badge" alt="DeepWiki"/></a>
<a href="https://github.com/Hack23/cia/releases"><img src="https://img.shields.io/badge/📦_Releases-GitHub-181717?style=for-the-badge&logo=github" alt="Releases"/></a>
</p>
<p align="center">
<a href="#"><img src="https://img.shields.io/badge/Owner-CEO-0A66C2?style=for-the-badge" alt="Owner"/></a>
<a href="#"><img src="https://img.shields.io/badge/Classification-Public-success?style=for-the-badge" alt="Classification"/></a>
<a href="#"><img src="https://img.shields.io/badge/Source-Java_21-blue?style=for-the-badge&logo=openjdk" alt="Java Source"/></a>
<a href="#"><img src="https://img.shields.io/badge/Runtime-Java_27-brightgreen?style=for-the-badge&logo=openjdk" alt="Java Runtime"/></a>
<a href="#"><img src="https://img.shields.io/badge/Review-Annual-orange?style=for-the-badge" alt="Review Cycle"/></a>
</p>
[](https://scorecard.dev/viewer/?uri=github.com/Hack23/cia)
[](https://bestpractices.coreinfrastructure.org/projects/770)
[](https://github.com/Hack23/cia/attestations)
[](https://app.fossa.io/projects/git%2Bgithub.com%2FHack23%2Fcia?ref=badge_shield)
[](https://github.com/Hack23/cia/blob/master/LICENSE.txt)
[](https://github.com/Hack23/cia/releases)
[](https://deepwiki.com/Hack23/cia)
[](https://cla-assistant.io/Hack23/cia)
[](https://github.com/Hack23/cia/actions/workflows/codeql-analysis.yml)
[](https://github.com/Hack23/cia/actions/workflows/release.yml)
[](https://github.com/Hack23/cia/actions/workflows/scorecards.yml)
[](https://github.com/Hack23/cia/actions/workflows/dependency-review.yml)
[](https://github.com/Hack23/cia/actions/workflows/zap-scan.yml)
[](https://github.com/Hack23/cia/actions/workflows/site-generation.yml)
[](https://github.com/Hack23/cia/actions/workflows/javadoc-generation.yml)
[](https://github.com/Hack23/cia/actions/workflows/validate-json-schemas.yml)
[](https://github.com/Hack23/cia/actions/workflows/validate-view-documentation.yml)
[](https://sonarcloud.io/summary/new_code?id=Hack23_cia)
[](https://sonarcloud.io/summary/new_code?id=Hack23_cia)
[](https://sonarcloud.io/summary/new_code?id=Hack23_cia)
[](https://sonarcloud.io/summary/new_code?id=Hack23_cia)
[](https://sonarcloud.io/summary/new_code?id=Hack23_cia)
[](https://sonarcloud.io/summary/new_code?id=Hack23_cia)
[](https://sonarcloud.io/summary/new_code?id=Hack23_cia)
[](https://sonarcloud.io/summary/new_code?id=Hack23_cia)
[](https://github.com/Hack23/ISMS-PUBLIC)
[](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
[](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md)
[](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md)
[](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Privacy_Policy.md)
[](CRA-ASSESSMENT.md)
[](THREAT_MODEL.md)
[](SECURITY_ARCHITECTURE.md)
---
## 🎯 Mission
> **Strengthen Swedish democracy through systematic transparency.**
The **Citizen Intelligence Agency (CIA)** is an independent, volunteer-driven, open-source-intelligence (OSINT) platform that puts **rigorous, evidence-based political intelligence** in the hands of every citizen, journalist, researcher, and policymaker. It monitors **Sweden's Riksdag (Parliament), the Government (Regeringskansliet), and public agencies (Myndigheter)** — applying structured intelligence techniques (ACH, SWOT, MITRE ATT&CK, STRIDE, political-risk scoring) to the full open-data corpus going back to 1971.
We deliver:
- 📊 **Financial performance metrics** for politicians and government bodies
- ⚠️ **Risk assessment analytics** — 50 behavioral detection rules across politicians, parties, committees, ministries and decisions
- 📈 **Political trend analysis** — temporal, comparative, pattern-recognition, predictive, network and decision intelligence frameworks
- 🏆 **Politician scoreboards & rankings** with multi-decade longitudinal coverage
- 📉 **Performance comparisons** — party effectiveness, committee productivity, ministry oversight
- 🔍 **Transparency insights** — every metric traces back to a primary parliamentary source
The platform is **strictly independent, non-partisan, and Apache 2.0 licensed**, operated under the public **[Hack23 ISMS](https://github.com/Hack23/ISMS-PUBLIC)** with full **ISO 27001:2022 / NIST CSF 2.0 / CIS Controls v8.1** alignment. It does not collect end-user PII, does not run ads, and does not push narratives.
---
## 🌍 Hack23 Civic Tech Ecosystem
CIA is the **canonical data backbone** for Hack23's growing portfolio of democratic-transparency platforms. Each repository is independently auditable, ISMS-aligned, and cross-linked through open data products and the public ISMS.
| Project | Role | Stack | Status |
|:--------|:-----|:------|:------:|
| 🕵️ **[Citizen Intelligence Agency (this repo)](https://github.com/Hack23/cia)** | Sweden — full data backbone, 110 DB views, 50 risk rules, JSON export specifications | Java 26 / Spring / Vaadin / PostgreSQL 18 | [](https://scorecard.dev/viewer/?uri=github.com/Hack23/cia) |
| 🗳️ **[Riksdagsmonitor](https://github.com/Hack23/riksdagsmonitor)** · [riksdagsmonitor.com](https://riksdagsmonitor.com) | Sweden — public news & dashboards, AI agentic newsroom (14 languages), consumes CIA exports nightly | TypeScript / Vite / Chart.js / D3 / GitHub Actions Agentic Workflows | [](https://scorecard.dev/viewer/?uri=github.com/Hack23/riksdagsmonitor) |
| 🏛️ **[EU Parliament Monitor](https://github.com/Hack23/euparliamentmonitor)** · [euparliamentmonitor.com](https://euparliamentmonitor.com) | European Parliament — political intelligence, AI newsroom (14 languages) | TypeScript / Vite / GitHub Actions Agentic Workflows | [](https://scorecard.dev/viewer/?uri=github.com/Hack23/euparliamentmonitor) |
| 🤖 **[European Parliament MCP Server](https://github.com/Hack23/European-Parliament-MCP-Server)** | EP Open Data MCP server — 60+ tools, OSINT analytics for AI agents | TypeScript / Model Context Protocol | [](https://scorecard.dev/viewer/?uri=github.com/Hack23/European-Parliament-MCP-Server) |
| 🛡️ **[Hack23 ISMS-PUBLIC](https://github.com/Hack23/ISMS-PUBLIC)** | The apex Information Security Management System — 32+ public policies governing all repositories | Markdown / Mermaid / GitHub-native | — |
| 🌐 **[Hack23 Homepage](https://github.com/Hack23/homepage)** · [hack23.com](https://hack23.com) | Corporate site, blog, agent biographies, [feature showcase](https://hack23.com/cia-features.html) | TypeScript / Static | — |
> **Data flow:** CIA → JSON export specs (`json-export-specs/`) → Riksdagsmonitor consumes via `update-cia-csv-data.yml` → AI newsroom publishes daily articles in 14 languages, every claim traceable to a `dok_id` in the CIA corpus.
---
## ✨ Features at a Glance
Explore the [comprehensive feature showcase](https://hack23.com/cia-features.html) on hack23.com:
- 📊 Interactive political dashboards ([🇬🇧 English](dashboard.md) · [🇸🇪 Svenska](dashboard_sv.md))
- 🏆 Politician scoreboards and ranking systems
- 📈 50 risk rules · 110 database views · 6 analytical frameworks
- 🔍 Transparency metrics across **49 Maven modules** (1,300+ Java files)
- ⚖️ Accountability measures spanning Riksdag, Government, agencies
- 📱 Data-driven insights backed by official Swedish open data
- 🕵️ Full OSINT pipeline — Riksdagen API, Valmyndigheten, World Bank, ESV
- 🔐 Defense-in-depth security, OpenSSF Scorecard 7.2/10, **zero critical CVEs for 5+ years**
For the conceptual model, see **[ARCHITECTURE.md](ARCHITECTURE.md)** and **[MINDMAP.md](MINDMAP.md)**.
---
## 📊 Intelligence Metrics (v1.36.0)
| Category | Count | Description |
|:---------|:-----:|:------------|
| 🧠 **Analysis Frameworks** | **6** | Temporal · Comparative · Pattern Recognition · Predictive · Network · Decision Intelligence |
| ⚠️ **Risk Rules** | **50** | 24 politician · 10 party · 4 committee · 4 ministry · 5 decision · 3 other |
| 🗄️ **Database Views** | **110** | 77 regular + 33 materialized — see [DATABASE_VIEW_INTELLIGENCE_CATALOG.md](DATABASE_VIEW_INTELLIGENCE_CATALOG.md) |
| 🌍 **OSINT Data Sources** | **4** | Riksdagen · Valmyndigheten · World Bank · ESV |
| 📰 **Intelligence Products** | **10+** | Scorecards · Coalition analysis · Risk assessments · Trend reports · Decision tracking |
| 🧩 **Maven Modules** | **49+** | Multi-module, layered architecture |
| 🤖 **Custom Copilot Agents** | **6** | task-agent · stack-specialist · ui-enhancement-specialist · intelligence-operative · business-development-specialist · marketing-specialist |
| 🧠 **Copilot Skills** | **80+** | Security · Compliance · Testing · Architecture · Intelligence · UI/UX · Cloud (see [`.github/skills/`](.github/skills/)) |
> **Coverage policy:** per the [Hack23 Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md), we maintain **≥ 80 % line coverage** and **≥ 70 % branch coverage** across all modules. Live JaCoCo: [hack23.github.io/cia/jacoco/](https://hack23.github.io/cia/jacoco/).
---
## 📚 Authoritative Data Sources
CIA's analyses are powered exclusively by **authoritative Swedish government and international open data**:
| Source | Scope | Module |
|:-------|:------|:-------|
| 🏛️ **[Swedish Parliament Open Data](http://data.riksdagen.se/)** | Members, committees, motions, propositions, votes, documents | [`service.external.riksdagen`](service.external.riksdagen/) |
| 🗳️ **[Swedish Election Authority — Valmyndigheten](http://www.val.se/)** | Election results, voter turnout, electoral statistics | [`service.external.val`](service.external.val/) |
| 🌍 **[World Bank Open Data](http://data.worldbank.org/)** | Global economic, governance and demographic indicators | [`service.external.worldbank`](service.external.worldbank/) |
| 💹 **[Ekonomistyrningsverket — ESV](https://www.esv.se/psidata/)** | Government finances, budget execution, agency spending | [`service.external.esv`](service.external.esv/) |
> All data is processed under **GDPR Art. 6(1)(e)** (public interest) and **Art. 9(2)(e)/(g)** (manifestly made public / substantial public interest) for the political opinions of public officials. **No end-user PII is collected.**
---
## 🏗️ Architecture & Documentation Map
> **Full system architecture (C4 Context / Container / Component / Dynamic views) lives in [`ARCHITECTURE.md`](ARCHITECTURE.md)** (v1.1, 2026-04-20).
### Current state
| Document | Focus | Description |
|:---------|:------|:------------|
| 🏛️ [Architecture](ARCHITECTURE.md) | C4 model | Current system structure |
| 📊 [Data Model](DATA_MODEL.md) | Data | Database schema, entity relationships |
| 🔄 [Flowcharts](FLOWCHART.md) | Process | Data processing workflows |
| 🔄 [State Diagrams](STATEDIAGRAM.md) | Behavior | System state transitions |
| 🗺️ [Mindmaps](MINDMAP.md) | Concept | Component relationships |
| 💼 [SWOT Analysis](SWOT.md) | Business | Strategic assessment |
| 🛡️ [Security Architecture](SECURITY_ARCHITECTURE.md) | Security | Defense-in-depth implementation |
| 🎯 [Threat Model](THREAT_MODEL.md) | Security | STRIDE / MITRE ATT&CK analysis |
| 🛡️ [CRA Assessment](CRA-ASSESSMENT.md) | Compliance | EU Cyber Resilience Act conformity |
| 🔐 [ISMS Compliance Mapping](ISMS_COMPLIANCE_MAPPING.md) | ISMS | 32 ISMS policies → CIA controls |
| 💰 [Financial Security Plan](FinancialSecurityPlan.md) | Cost | AWS security cost & ROI |
| 📋 [Business Continuity Plan](BCPPlan.md) | Resilience | RTO / RPO targets |
| 💼 [Business Product Document](BUSINESS_PRODUCT_DOCUMENT.md) | Business | Data-product strategy |
| ⚙️ [CI/CD Workflows](WORKFLOWS.md) | DevOps | Automation processes |
| 🧪 [Unit Test Plan](UnitTestPlan.md) | Testing | Strategy & coverage |
| 🌐 [E2E Test Plan](E2ETestPlan.md) | Testing | End-to-end testing |
| 📅 [End-of-Life Strategy](End-of-Life-Strategy.md) | Lifecycle | Maintenance and EOL planning |
| 📝 [Documentation Naming Convention](DOCUMENTATION_NAMING_CONVENTION.md) | Standards | Naming standards |
### Future state (2026 → 2037)
| Document | Focus |
|:---------|:------|
| 🚀 [Future Architecture](FUTURE_ARCHITECTURE.md) | Future C4 model |
| 📊 [Future Data Model](FUTURE_DATA_MODEL.md) | Enhanced data architecture |
| 🔄 [Future Flowcharts](FUTURE_FLOWCHART.md) | AI-driven workflows |
| 🔄 [Future State Diagrams](FUTURE_STATEDIAGRAM.md) | Adaptive transitions |
| 🗺️ [Future Mindmaps](FUTURE_MINDMAP.md) | Capability evolution |
| 💼 [Future SWOT](FUTURE_SWOT.md) | Strategic opportunities |
| 🛡️ [Future Security Architecture](FUTURE_SECURITY_ARCHITECTURE.md) | PQC / AI-augmented controls |
| 🎯 [Future Threat Model](FUTURE_THREAT_MODEL.md) | AI / PQC threat landscape |
| ⚙️ [Future Workflows](FUTURE_WORKFLOWS.md) | ML-enhanced CI/CD |
---
## 🔍 Intelligence & Analytics Documentation
CIA's intelligence operations (INTOP) and OSINT capabilities are documented and version-controlled. Every framework, rule, and view has a public source of truth.
### Intelligence changelog
| Document | Focus | Description |
|:---------|:------|:------------|
| 📜 **[Intelligence Evolution Changelog](CHANGELOG_INTELLIGENCE.md)** | Unified | Comprehensive tracking of intelligence capabilities, views, risk rules, frameworks |
### Core intelligence documentation
| Document | Focus | Highlights |
|:---------|:------|:-----------|
| 🎯 [Data Analysis — INTOP / OSINT](DATA_ANALYSIS_INTOP_OSINT.md) | Frameworks | 6 frameworks (Temporal, Comparative, Pattern, Predictive, Network, Decision) |
| 🔴 [Risk Rules — INTOP / OSINT](RISK_RULES_INTOP_OSINT.md) | Rules | 50 behavioral detection rules across 6 categories |
| 🗄️ [Database View Intelligence Catalog](DATABASE_VIEW_INTELLIGENCE_CATALOG.md) | Views | 110 views (77 regular + 33 materialized) |
| 📊 [Data Quality Monitoring Dashboard](DATA_QUALITY_MONITORING_DASHBOARD.md) | Quality | OSINT, DB-health, view-validation metrics |
| 🗺️ [Intelligence Data Flow Map](INTELLIGENCE_DATA_FLOW.md) | Pipeline | Framework-to-view relationships |
| 🗄️ [Liquibase Intelligence Analysis](LIQUIBASE_CHANGELOG_INTELLIGENCE_ANALYSIS.md) | Schema | Database schema evolution from intelligence perspective |
| ⚙️ [Drools Risk Rules](DROOLS_RISK_RULES.md) | Engine | Drools rules engine documentation |
### Intelligence automation
| Tool | Purpose | Location |
|:-----|:--------|:---------|
| **Intelligence Changelog Generator** | Auto-detection of view / rule / framework changes | [`generate-intelligence-changelog.sh`](.github/scripts/generate-intelligence-changelog.sh) |
| **GitHub Actions Workflow** | On-demand changelog generation | [`generate-intelligence-changelog.yml`](.github/workflows/generate-intelligence-changelog.yml) |
```bash
# Generate intelligence changelog from recent changes
.github/scripts/generate-intelligence-changelog.sh
# Compare specific commits
.github/scripts/generate-intelligence-changelog.sh <prev_commit> <current_commit>
```
### Documentation navigation by role
<table>
<tr>
<td width="50%" valign="top">
#### 📊 For Data Analysts
1. **Start:** [Data Analysis Frameworks](DATA_ANALYSIS_INTOP_OSINT.md)
2. **Then:** [Database View Catalog](DATABASE_VIEW_INTELLIGENCE_CATALOG.md)
3. **Reference:** [Intelligence Data Flow Map](INTELLIGENCE_DATA_FLOW.md)
#### 🗄️ For Database Administrators
1. **Start:** [Schema Maintenance Guide](service.data.impl/README-SCHEMA-MAINTENANCE.md)
2. **Then:** [Data Quality Dashboard](DATA_QUALITY_MONITORING_DASHBOARD.md)
3. **Reference:** [Database View Catalog](DATABASE_VIEW_INTELLIGENCE_CATALOG.md)
4. **Track:** [Intelligence Changelog](CHANGELOG_INTELLIGENCE.md)
</td>
<td width="50%" valign="top">
#### 🕵️ For Intelligence Operatives
1. **Start:** [Intelligence Data Flow Map](INTELLIGENCE_DATA_FLOW.md)
2. **Then:** [Data Analysis Frameworks](DATA_ANALYSIS_INTOP_OSINT.md)
3. **Deep dive:** [Risk Rules](RISK_RULES_INTOP_OSINT.md)
#### 📈 For Product Managers
1. **Start:** [Business Product Document](BUSINESS_PRODUCT_DOCUMENT.md)
2. **Then:** [Data Analysis Frameworks](DATA_ANALYSIS_INTOP_OSINT.md)
3. **Explore:** [Database View Catalog](DATABASE_VIEW_INTELLIGENCE_CATALOG.md)
</td>
</tr>
</table>
---
## 🔐 Security, Privacy & ISMS Compliance
> Full controls in **[`SECURITY_ARCHITECTURE.md`](SECURITY_ARCHITECTURE.md)** · threat analysis in **[`THREAT_MODEL.md`](THREAT_MODEL.md)** · CRA conformity in **[`CRA-ASSESSMENT.md`](CRA-ASSESSMENT.md)** · ISMS-PUBLIC ⇄ CIA mapping in **[`ISMS_COMPLIANCE_MAPPING.md`](ISMS_COMPLIANCE_MAPPING.md)** (32 policies, 100+ controls).
### Security through transparency
> *"Our commitment to transparency extends to our security practices — demonstrating that true security comes from robust processes, continuous improvement, and a culture where security is integrated into every business decision."*
> **— James Pether Sörling, CISSP, CISM, CEO/Founder, Hack23 AB**
<table>
<tr>
<td width="50%" align="center">
<h3>📋 Public ISMS Repository</h3>
<p>Complete Information Security Management System</p>
<a href="https://github.com/Hack23/ISMS-PUBLIC">
<img src="https://img.shields.io/badge/ISMS-PUBLIC-0066CC?style=for-the-badge&logo=github&logoColor=white" alt="ISMS Public Repository">
</a>
</td>
<td width="50%" align="center">
<h3>🔒 Information Security Policy</h3>
<p>The apex policy governing every Hack23 repository</p>
<a href="https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md">
<img src="https://img.shields.io/badge/Security-Policy-DC143C?style=for-the-badge&logo=shield&logoColor=white" alt="Information Security Policy">
</a>
</td>
</tr>
</table>
### Classification (per [Hack23 Classification Framework](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md))
| Dimension | Level | Note |
|:----------|:------|:-----|
| 🔒 **Confidentiality** | 🟢 Public | Open civic-transparency platform; all source data intentionally disclosed |
| ✅ **Integrity** | 🟠 High | Automated validation, GPG-signed commits, SLSA 3 build provenance, Javers auditing |
| ⏱️ **Availability** | 🟡 Moderate | Multi-AZ AWS deployment with RDS Multi-AZ, ALB, automated patching |
| 🏷️ **Privacy** | 🟠 Personal (public officials only) | GDPR Art. 6(1)(e/f) · Art. 9(2)(e)/(g); **no end-user PII**, no accounts forced, no ads, no tracking |
| ⏱️ **RTO / RPO** | 1–4 h / 1–4 h | Automated backups, multi-region disaster recovery |
| 💰 **Business impact** | 🟢 Negligible (financial) · 🟠 High (reputational) · 🟡 Moderate (regulatory) | Open-source, volunteer-driven |
### Compliance frameworks
- ✅ **ISO 27001:2022** — Annex A controls implemented (see [ISMS_COMPLIANCE_MAPPING.md](ISMS_COMPLIANCE_MAPPING.md))
- ✅ **NIST CSF 2.0** — 6 functions aligned (Govern · Identify · Protect · Detect · Respond · Recover)
- ✅ **CIS Controls v8.1** — implementation tracked
- ✅ **GDPR** — public-interest / legitimate-interest grounds for public-official data; political opinions under Art. 9(2)(e)/(g)
- ✅ **EU Cyber Resilience Act (CRA)** — self-assessment in [`CRA-ASSESSMENT.md`](CRA-ASSESSMENT.md)
- ✅ **OpenSSF Best Practices** — [Project #770](https://bestpractices.coreinfrastructure.org/projects/770)
- ✅ **AWS Well-Architected** — Security pillar aligned
### Defence-in-depth highlights
- 🔐 **Authentication & authorization** — Spring Security 5.8.16, MFA, role-based access control, login blocking, Passay password policies
- 🧱 **Network security** — AWS VPC with private subnets, NACLs, NAT Gateway, VPC Flow Logs, AWS WAF (OWASP rule set), VPC Endpoints
- 🔒 **Cryptography** — TLS 1.3 (HTTPS-only, HSTS), AES-256 encryption at rest (KMS-managed keys), Bouncy Castle 1.84
- 📜 **Audit & integrity** — Javers data auditing, pgaudit, CloudTrail, immutable Git history, GPG-signed commits
- 🕵️ **Threat detection** — AWS GuardDuty, Security Hub, CloudWatch alarms, CodeQL, OWASP Dependency-Check, ZAP DAST scans
- 🛡️ **Supply chain security** — SHA-pinned actions, Dependabot, secret scanning, dependency review, SLSA 3 attestations, FOSSA license analysis
- 🤖 **AI governance** — agent operations governed by [Hack23 AI Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/AI_Policy.md) (OWASP LLM + EU AI Act alignment)
### Public security evidence
| Evidence | Status | Link |
|:---------|:------:|:-----|
| 🔍 **OpenSSF Scorecard** | 7.2 / 10 | [scorecard.dev](https://scorecard.dev/viewer/?uri=github.com/Hack23/cia) |
| 🛡️ **CodeQL Scanning** | ✅ Active | [Security tab](https://github.com/Hack23/cia/security/code-scanning) |
| 🚨 **Dependabot** | ✅ Active | [Vulnerability alerts](https://github.com/Hack23/cia/security/dependabot) |
| 🔐 **Secret Scanning** | ✅ Active | GitHub Advanced Security |
| 📊 **SonarCloud Security** | ✅ Active | [Security hotspots](https://sonarcloud.io/project/security_hotspots?id=Hack23_cia) |
| 🛡️ **SLSA Provenance** | Level 3 | [Attestations](https://github.com/Hack23/cia/attestations) |
| 📋 **FOSSA License Compliance** | ✅ Active | [License report](https://app.fossa.io/projects/git%2Bgithub.com%2FHack23%2Fcia) |
| 🏆 **CII Best Practices** | ✅ Passing | [Project #770](https://bestpractices.coreinfrastructure.org/projects/770) |
| 🛡️ **Zero critical CVEs** | ✅ 5+ years | Continuously verified |
---
## 🚀 Runtime & Build Environment
<div align="center">
| JDK Version | Status | Notes |
|:------------|:-------|:------|
|  | **Source Level (LTS)** | Maven `maven.compiler.source` / `target` = 21 |
|  | Compatible (LTS) | Previous production runtime |
|  | Compatible | Previous production runtime |
|  | **Current Runtime** | Active production runtime |
</div>
### Development environment
| Component | Version | Purpose |
|:----------|:-------:|:--------|
| **Java JDK** | 27 (Temurin) | Runtime — [Adoptium](https://adoptium.net/) |
| **Java Source** | 21 | Source compatibility — Maven compiler |
| **Maven** | 3.10.0+ | Build automation — [Maven](https://maven.apache.org/install.html) |
| **Node.js** | 24+ | Copilot MCP servers, Playwright testing |
| **PostgreSQL** | 18 | Database with `pgaudit`, `pgcrypto`, `pg_stat_statements` |
For the canonical setup, see [`copilot-setup-steps.yml`](.github/workflows/copilot-setup-steps.yml) and [`End-of-Life-Strategy.md`](End-of-Life-Strategy.md).
### Quick start
```bash
# Build the project (skipping tests)
mvn clean install -DskipTests
# Build with tests
mvn clean install
# Run only unit tests (skip integration & XML adapter tests)
mvn test -Dtest='!**ITest*,!**/XmlDateTypeAdapterTest,!**/XmlTimeTypeAdapterTest,!**/XmlDateTimeTypeAdapterTest'
# Tests with JaCoCo coverage
mvn clean test jacoco:report
# OWASP dependency-check
mvn dependency-check:check
# Run the main module
cd citizen-intelligence-agency
mvn spring-boot:run
```
> 💡 **Database changes** must follow [`service.data.impl/README-SCHEMA-MAINTENANCE.md`](service.data.impl/README-SCHEMA-MAINTENANCE.md). Never manually edit `full_schema.sql` — always regenerate via `pg_dump`.
---
## 🔧 Technology Stack
| Category | Technologies |
|:---------|:-------------|
| **Core Framework** | [Spring Framework 5.x](https://spring.io/projects/spring-framework) |
| **Security** | [Spring Security 5.8.16](https://spring.io/projects/spring-security) · [Bouncy Castle 1.84](https://www.bouncycastle.org/) · [Passay 2.0.0](https://www.passay.org/) |
| **Persistence** | [Hibernate](https://hibernate.org/orm/) · [JPA / Jakarta](https://jakarta.ee/specifications/persistence/) · [PostgreSQL 18](https://www.postgresql.org/) · [Liquibase](https://www.liquibase.org/) |
| **Transactions** | [Narayana](https://narayana.io/) (XA / 2PC) integrated with Spring `JpaTransactionManager` |
| **Auditing** | [Javers](https://javers.org/) — change tracking & versioning |
| **Rules Engine** | [Drools](https://www.drools.org/) — 50 behavioral risk rules |
| **Messaging** | [ActiveMQ Artemis](https://activemq.apache.org/components/artemis/) · [Spring JMS](https://spring.io/projects/spring-framework) |
| **Web / UI** | [Vaadin 8.14.4](https://vaadin.com/) · Vaadin Sass / Themes · [Jetty 12.1.8 EE8](https://eclipse.dev/jetty/) |
| **Monitoring** | [JavaMelody](https://github.com/javamelody/javamelody) · [AWS SDK CloudWatch](https://aws.amazon.com/cloudwatch/) |
| **Testing** | [JUnit](https://junit.org/) · [Mockito](https://site.mockito.org/) · [Spring Test](https://docs.spring.io/spring-framework/docs/current/reference/html/testing.html) · [Selenium WebDriver](https://www.selenium.dev/) · [Playwright](https://playwright.dev/) |
| **Utilities** | [Apache Commons](https://commons.apache.org/) · [Google Guava](https://guava.dev/) · [SLF4J](http://www.slf4j.org/) · [Logback](https://logback.qos.ch/) · [Jackson](https://github.com/FasterXML/jackson) |
| **Build** | [Apache Maven 3.10.0+](https://maven.apache.org/) — 49+ modules |
| **CI / CD** | [GitHub Actions](https://github.com/Hack23/cia/actions) · [SonarCloud](https://sonarcloud.io/project/overview?id=Hack23_cia) · [CodeQL](https://github.com/Hack23/cia/security/code-scanning) · [OWASP ZAP](https://www.zaproxy.org/) · [Dependabot](https://github.com/Hack23/cia/security/dependabot) · [Step Security Harden-Runner](https://github.com/step-security/harden-runner) |
For the full stack and current versions, see [`techstack.yml`](techstack.yml) and the per-module Maven sites at [hack23.github.io/cia/](https://hack23.github.io/cia/).
---
## ☁️ AWS Cloud Architecture
CIA's reference deployment is provisioned via **CloudFormation** (`cia-dist-cloudformation/`) and follows the [AWS Well-Architected Security Pillar](https://aws.amazon.com/architecture/well-architected/).
| Layer | Service | Purpose |
|:------|:--------|:--------|
| 🌐 **Networking** | [VPC](https://aws.amazon.com/vpc/) · NAT Gateway · NACLs · VPC Endpoints · [WAF](https://aws.amazon.com/waf/) · VPC Flow Logs | Isolated, segmented, web-attack-protected network |
| 🔐 **IAM & Crypto** | [IAM](https://aws.amazon.com/iam/) · [KMS](https://aws.amazon.com/kms/) · [ACM](https://aws.amazon.com/certificate-manager/) · [Secrets Manager](https://aws.amazon.com/secrets-manager/) | Least privilege · key management · TLS · rotated secrets |
| 🌍 **DNS / SSL** | [Route 53](https://aws.amazon.com/route53/) · [ACM](https://aws.amazon.com/certificate-manager/) | Domain & certificate management |
| ⚙️ **Compute** | [EC2](https://aws.amazon.com/ec2/) · [ALB](https://aws.amazon.com/elasticloadbalancing/application-load-balancer/) | Stateless application tier |
| 💾 **Data** | [RDS PostgreSQL Multi-AZ](https://aws.amazon.com/rds/) · [S3](https://aws.amazon.com/s3/) (KMS-encrypted, lifecycle-policied) | Persistence + artifact storage |
| 📊 **Observability** | [CloudWatch](https://aws.amazon.com/cloudwatch/) · CloudTrail · [Config](https://aws.amazon.com/config/) | Metrics · logs · audit · compliance drift |
| 🛡️ **Threat Detection** | [GuardDuty](https://aws.amazon.com/guardduty/) · [Security Hub](https://aws.amazon.com/security-hub/) | ML-based threat detection · centralized findings |
| 🔄 **Operations** | [Systems Manager](https://aws.amazon.com/systems-manager/) · [Resilience Hub](https://aws.amazon.com/resilience-hub/) | Automated patching · DR posture |
> 📐 **CloudFormation diagram:** 
For full security-control mapping, see [`SECURITY_ARCHITECTURE.md`](SECURITY_ARCHITECTURE.md) and [`FinancialSecurityPlan.md`](FinancialSecurityPlan.md).
---
## 📦 Deployment Options
### 1️⃣ AWS CloudFormation
1. Download the [CloudFormation template](cia-dist-cloudformation/src/main/resources/cia-dist-cloudformation.json)
2. Create a stack in the AWS CloudFormation console
3. Upload the template, configure parameters, acknowledge IAM, launch
4. Access the application via the URL in the stack outputs
### 2️⃣ Debian / Ubuntu (24.04+)
```bash
# 1. Add PostgreSQL PGDG repository (required for PostgreSQL 18 on Ubuntu 24.04)
sudo install -d /usr/share/postgresql-common/pgdg
sudo curl -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc --fail https://www.postgresql.org/media/keys/ACCC4CF8.asc
echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" | sudo tee /etc/apt/sources.list.d/pgdg.list
sudo apt-get update
# 2. Install prerequisites
sudo apt-get install openjdk-21-jdk postgresql-18 postgresql-contrib-18 postgresql-18-pgaudit postgresql-18-pgvector
# 3. Configure PostgreSQL (see "PostgreSQL 18 Configuration Guide" below)
# 4. Install the CIA Debian package
wget https://github.com/Hack23/cia/releases/download/2025.1.2/cia-dist-deb-2025.1.2.all.deb
sudo dpkg -i cia-dist-deb-2025.1.2.all.deb
# 5. Access at https://localhost:28443/cia/
```
---
## 🐘 PostgreSQL 18 Configuration Guide
A reference configuration with SSL, prepared transactions, and the required extensions.
### 1. Enable prepared transactions and extensions
Edit `/etc/postgresql/18/main/postgresql.conf`:
```ini
max_prepared_transactions = 100
shared_preload_libraries = 'pg_stat_statements, pgaudit, pgcrypto'
pgaudit.log = ddl
pg_stat_statements.track = all
pg_stat_statements.max = 10000
```
### 2. IPv6 loopback access
Edit `/etc/postgresql/18/main/pg_hba.conf`:
```ini
host all all ::1/128 md5
```
### 3. SSL certificates
```bash
# Generate passphrase, key and self-signed certificate (10-year validity)
openssl rand -base64 48 > passphrase.txt
openssl genrsa -des3 -passout file:passphrase.txt -out server.pass.key 2048
openssl rsa -passin file:passphrase.txt -in server.pass.key -out server.key && rm server.pass.key
openssl req -new -key server.key -out server.csr \
-subj "/C=UK/ST=Postgresqll/L=Docker/O=Hack23/OU=demo/CN=127.0.0.1"
openssl x509 -req -days 3650 -in server.csr -signkey server.key -out server.crt
rm passphrase.txt server.csr
```
### 4. Deploy SSL artefacts
```bash
cp server.crt /var/lib/postgresql/18/main/server.crt
cp server.key /var/lib/postgresql/18/main/server.key && rm server.key
chmod 600 /var/lib/postgresql/18/main/server.key
chmod 644 /var/lib/postgresql/18/main/server.crt
chown -R postgres:postgres /var/lib/postgresql/18/main/
echo "ssl_cert_file = '/var/lib/postgresql/18/main/server.crt'" \
>> /etc/postgresql/18/main/postgresql.conf
echo "ssl_key_file = '/var/lib/postgresql/18/main/server.key'" \
>> /etc/postgresql/18/main/postgresql.conf
```
### 5. CIA user trust certificate
```bash
mkdir -p /opt/cia/.postgresql
cp server.crt /opt/cia/.postgresql/root.crt
chmod 700 /opt/cia/.postgresql/root.crt
chown -R cia:cia /opt/cia/.postgresql/root.crt
rm server.crt
```
### 6. Performance tuning
For optimal performance with CIA's 110 views and 93 tables:
| Setting | 4 GB RAM | 8 GB RAM | 16 GB+ RAM (production) |
|:--------|:--------:|:--------:|:-----------------------:|
| `shared_buffers` | 1 GB | 2 GB | 4 GB |
| `effective_cache_size` | 3 GB | 6 GB | 12 GB |
| `maintenance_work_mem` | 256 MB | 512 MB | 1 GB |
| `work_mem` | 16 MB | 32 MB | 50 MB |
```sql
-- 8 GB RAM example — adjust to your hardware
ALTER SYSTEM SET shared_buffers = '2GB';
ALTER SYSTEM SET effective_cache_size = '6GB';
ALTER SYSTEM SET maintenance_work_mem = '512MB';
ALTER SYSTEM SET work_mem = '32MB';
-- Checkpoints, WAL
ALTER SYSTEM SET checkpoint_completion_target = 0.9;
ALTER SYSTEM SET wal_buffers = '16MB';
ALTER SYSTEM SET max_wal_size = '4GB';
ALTER SYSTEM SET min_wal_size = '1GB';
-- SSD-optimised query planner
ALTER SYSTEM SET random_page_cost = 1.1;
ALTER SYSTEM SET effective_io_concurrency = 200;
-- Connections
ALTER SYSTEM SET max_connections = 200;
-- Apply
SELECT pg_reload_conf();
```
> 📚 For full performance tuning, monitoring and advanced configuration, see [`service.data.impl/README-SCHEMA-MAINTENANCE.md`](service.data.impl/README-SCHEMA-MAINTENANCE.md).
### 7. Database setup
```bash
sudo su - postgres
psql
postgres=# CREATE USER eris WITH password 'discord';
postgres=# CREATE DATABASE cia_dev;
postgres=# GRANT ALL PRIVILEGES ON DATABASE cia_dev TO eris;
```
> ⚠️ The credentials above are for local development only. Use custom credentials and update `/opt/cia/webapps/cia/WEB-INF/database.properties` for any non-development deployment.
---
## 🤖 GitHub Copilot — Custom Agents & Skills
CIA uses **GitHub Copilot custom agents and skills** as first-class development assets, governed by the [Hack23 AI Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/AI_Policy.md).
| Surface | Catalog | Count |
|:--------|:--------|:-----:|
| 🤖 **Custom agents** | [`.github/agents/README.md`](.github/agents/README.md) | **6** |
| 🧠 **Skills library** | [`.github/skills/README.md`](.github/skills/README.md) | **80+** |
| ⚙️ **Workflows** | [`.github/workflows/`](.github/workflows/) | 14 |
| 🔌 **MCP servers** | [`.github/copilot-mcp-config.json`](.github/copilot-mcp-config.json) | github · filesystem · memory · sequential-thinking · playwright |
| 📋 **Setup contract** | [`.github/workflows/copilot-setup-steps.yml`](.github/workflows/copilot-setup-steps.yml) | Java 27 · Maven 3.10.0 · PostgreSQL 18 |
### Available agents
| Agent | Specialty |
|:------|:----------|
| 📋 **[Task Agent](.github/agents/task-agent.md)** | Product quality, GitHub issue management, ISMS compliance |
| 🛠️ **[Stack Specialist](.github/agents/stack-specialist.md)** | Java 26 · Spring · Vaadin · Hibernate / JPA · PostgreSQL |
| 🎨 **[UI Enhancement Specialist](.github/agents/ui-enhancement-specialist.md)** | Vaadin · WCAG 2.1 AA · data visualization · privacy-by-design UI |
| 🕵️ **[Intelligence Operative](.github/agents/intelligence-operative.md)** | Political science · OSINT · structured analysis · Swedish politics |
| 💼 **[Business Development Specialist](.github/agents/business-development-specialist.md)** | Strategic planning · partnerships · sustainable revenue · market expansion |
| 📢 **[Marketing Specialist](.github/agents/marketing-specialist.md)** | Digital marketing · content strategy · community building |
### Skills library highlights
The [skills library](.github/skills/) contains **80+ skills** across security-by-design, ISMS compliance, testing, architecture, intelligence, UI/UX, cloud, and product management. Highlights:
- 🔒 **Security**: secure-code-review · threat-modeling · secrets-management · input-validation · crypto-best-practices · cis-controls · iso-27001-controls · ai-governance · ci-cd-security
- ✅ **Compliance**: hack23-information-security-policy · hack23-isms-compliance · gdpr-compliance · compliance-frameworks · classification-framework-enforcement · open-source-policy
- 🧪 **Testing**: unit-testing-patterns · integration-testing · e2e-testing · playwright-ui-testing · testing-strategy-enforcement · code-quality-checks
- 🏗️ **Architecture**: hack23-future-architecture-standards · data-pipeline-engineering · api-integration · mcp-server-development · mcp-gateway-configuration · mcp-gateway-security
- 🕵️ **Intelligence & OSINT**: political-science-analysis · osint-methodologies · intelligence-analysis-techniques · swedish-political-system · electoral-analysis · legislative-monitoring · risk-assessment-frameworks · behavioral-analysis · strategic-communication-analysis · cia-data-integration · european-parliament-api
- 🎨 **UI / UX**: accessibility-wcag-patterns · advanced-data-visualization · data-visualization-principles · ui-ux-design-system · seo-best-practices
For the full taxonomy and agent ↔ skill matrix, see [`.github/skills/README.md`](.github/skills/README.md) and [`.github/agents/README.md`](.github/agents/README.md).
---
## 📝 Blog Posts & Technical Analysis
### ⭐ Simon Moon — Architecture Chronicles
System Architect [Simon Moon](https://github.com/Hack23/homepage/blob/master/.github/agents/simon-moon.md) provides deep architectural analysis of CIA through the lens of pattern recognition:
- 🏛️ [CIA Architecture: The Five Pentacles](https://hack23.com/blog-cia-architecture.html) — Five container types crystallised from the parliamentary domain
- 🔐 [CIA Security: Defense Through Transparency](https://hack23.com/blog-cia-security.html) — Five defensive layers; OpenSSF Scorecard 7.2/10; zero critical CVEs over 5+ years
- 🚀 [CIA Future Security: The Pentagon of Tomorrow](https://hack23.com/blog-cia-future-security.html) — Post-quantum cryptography & AI-augmented detection
- 💰 [CIA Financial Strategy: $24.70/Day Democracy](https://hack23.com/blog-cia-financial-strategy.html) — AWS-optimised cost architecture
- ⚙️ [CIA Workflows: Five-Stage CI/CD & State Machines](https://hack23.com/blog-cia-workflows.html) — DevSecOps automation
- 🗺️ [CIA Mindmaps: Conceptual Sacred Geometry](https://hack23.com/blog-cia-mindmaps.html) — Hierarchical organisational patterns
### 💻 George Dorn — Code Analysis
Developer [George Dorn](https://github.com/Hack23/homepage/blob/master/.github/agents/george-dorn.md) provides hands-on code analysis based on actual repository inspection:
- 🔍 [CIA Code Analysis](https://hack23.com/blog-george-dorn-cia-code.html) — 49 modules, 1,300+ Java files, OpenSSF Scorecard 7.2/10
> *Full collection of 50+ blog posts on cybersecurity, ISMS policies and architectural patterns: [Hack23 Security Blog](https://hack23.com/blog.html).*
---
## 📊 Project Classification (per ISMS Classification Framework)
> See the descriptive [Classification table](#classification-per-hack23-classification-framework) above for confidentiality, integrity, availability, privacy and RTO/RPO levels with rationale. The formal badges below cover project type, Business Impact Analysis (BIA) and strategic position.
### 🎯 Project type
[](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md#project-type-classifications)
[](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md#project-type-classifications)
### 💰 Business impact analysis matrix
| Impact | Financial | Operational | Reputational | Regulatory |
|:-------|:---------:|:-----------:|:------------:|:----------:|
| 🔒 **Confidentiality** | 🟢 Negligible | 🟢 Negligible | 🟢 Low | 🟢 Low |
| ✅ **Integrity** | 🟢 Negligible | 🟠 High | 🟠 High | 🟡 Moderate |
| ⏱️ **Availability** | 🟢 Negligible | 🟠 High | 🟢 Low | 🟢 Low |
### 🛡️ Security investment & strategic position
[](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md#security-investment-returns)
[](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md#security-investment-returns)
[](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md#competitive-differentiation)
[](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md#competitive-differentiation)
[](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md#porters-five-forces)
---
## 📖 Maven Site Documentation
The complete Maven-generated project documentation is published at **[hack23.github.io/cia](https://hack23.github.io/cia/)**:
| Resource | Link |
|:---------|:-----|
| 📋 Project reports & module sites | [Maven Site Home](https://hack23.github.io/cia/) |
| 🗄️ Hibernate entity model (hbm2doc) | [Entity Model](https://hack23.github.io/cia/service.data.impl/hbm2doc/entities/index.html) |
| 📋 Javadoc API reference | [Javadoc](https://hack23.github.io/cia/apidocs/index.html) |
| 📦 Visual package dependencies | [Package graph](https://hack23.github.io/cia/apidocs/package-dependencies.svg) |
| 🧪 JaCoCo test coverage | [Coverage](https://hack23.github.io/cia/jacoco/) |
| 🏗️ Architecture overview | [Architecture](https://hack23.github.io/cia/architecture.html) |
| 💾 Liquibase database documentation | [DB docs](https://hack23.github.io/cia/service.data.impl/dbDoc/index.html) |
### Key module sites
| Module | Description | Site |
|:-------|:------------|:-----|
| **citizen-intelligence-agency** | Main web application | [link](https://hack23.github.io/cia/citizen-intelligence-agency/) |
| **service.data.impl** | Data access & entity model | [link](https://hack23.github.io/cia/service.data.impl/) |
| **service.impl** | Core service implementation | [link](https://hack23.github.io/cia/service.impl/) |
| **service.api** | Service API definitions | [link](https://hack23.github.io/cia/service.api/) |
| **service.external.riksdagen** | Swedish Parliament integration | [link](https://hack23.github.io/cia/service.external.riksdagen/) |
| **service.external.worldbank** | World Bank integration | [link](https://hack23.github.io/cia/service.external.worldbank/) |
| **service.external.val** | Swedish Election Authority | [link](https://hack23.github.io/cia/service.external.val/) |
| **service.external.esv** | ESV financial data | [link](https://hack23.github.io/cia/service.external.esv/) |
| **web-widgets** | UI widget components | [link](https://hack23.github.io/cia/web-widgets/) |
---
## 🤝 Contributing
Contributions welcome under Hack23's secure-development standards.
1. Fork the repo and create a descriptive feature branch
2. **GPG-sign every commit** · enable **MFA** on your GitHub account
3. Run quality checks locally: `mvn clean install` (must pass tests + SonarCloud quality gate)
4. Submit a pull request with a comprehensive description; address review feedback
5. Sign the [CLA](https://cla-assistant.io/Hack23/cia)
6. Never introduce security vulnerabilities; follow [`CONTRIBUTING.md`](CONTRIBUTING.md), [`CODE_OF_CONDUCT.md`](CODE_OF_CONDUCT.md), and the [Hack23 Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
---
## 🔒 Reporting Security Issues
For coordinated vulnerability disclosure, follow [`SECURITY.md`](SECURITY.md). The process aligns with the [Hack23 Vulnerability Management Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Vulnerability_Management.md) and the [Incident Response Plan](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Incident_Response_Plan.md).
---
## 📚 Related Documents (single index)
### 🏛️ Architecture & design
- [🏗️ Architecture](ARCHITECTURE.md) · [🚀 Future Architecture](FUTURE_ARCHITECTURE.md)
- [🧠 Mindmap](MINDMAP.md) · [🚀 Future Mindmap](FUTURE_MINDMAP.md)
- [📊 Data Model](DATA_MODEL.md) · [🚀 Future Data Model](FUTURE_DATA_MODEL.md)
- [🔄 Flowcharts](FLOWCHART.md) · [🚀 Future Flowcharts](FUTURE_FLOWCHART.md)
- [🔄 State Diagrams](STATEDIAGRAM.md) · [🚀 Future State Diagrams](FUTURE_STATEDIAGRAM.md)
- [🗄️ Entity Model (hbm2doc)](https://hack23.github.io/cia/service.data.impl/hbm2doc/entities/index.html) · [📋 Javadoc](https://hack23.github.io/cia/apidocs/index.html) · [📦 Package graph](https://hack23.github.io/cia/apidocs/package-dependencies.svg)
- [📖 Maven Site](https://hack23.github.io/cia/) · [📚 DeepWiki](https://deepwiki.com/Hack23/cia)
### 🛡️ Security & compliance
- [🔐 Security Architecture](SECURITY_ARCHITECTURE.md) · [🚀 Future Security Architecture](FUTURE_SECURITY_ARCHITECTURE.md)
- [🎯 Threat Model](THREAT_MODEL.md) · [🔮 Future Threat Model](FUTURE_THREAT_MODEL.md)
- [🔐 ISMS Compliance Mapping](ISMS_COMPLIANCE_MAPPING.md) · [💰 Financial Security Plan](FinancialSecurityPlan.md)
- [📋 CRA Assessment](CRA-ASSESSMENT.md) · [🔒 Security Policy](SECURITY.md) · [📋 Business Continuity Plan](BCPPlan.md)
### 🔄 Operations & development
- [⚡ Workflows](WORKFLOWS.md) · [🚀 Future Workflows](FUTURE_WORKFLOWS.md)
- [📅 End-of-Life Strategy](End-of-Life-Strategy.md) · [🧪 Unit Test Plan](UnitTestPlan.md) · [🌐 E2E Test Plan](E2ETestPlan.md)
- [🤝 Contributing](CONTRIBUTING.md) · [📜 Code of Conduct](CODE_OF_CONDUCT.md) · [📝 Doc naming](DOCUMENTATION_NAMING_CONVENTION.md)
### 🎨 Features & dashboards
- [✨ CIA Features (hack23.com)](https://hack23.com/cia-features.html)
- [📊 Dashboard (English)](dashboard.md) · [📊 Politisk Dashboard (Svenska)](dashboard_sv.md)
### 🤖 AI & development tools
- [🤖 Copilot Instructions](.github/copilot-instructions.md) · [👥 Custom agents](.github/agents/README.md) · [🧠 Skills library](.github/skills/README.md)
### 📋 ISMS-PUBLIC policies governing this repository
- [🛡️ Information Security Policy (apex)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md)
- [🛠️ Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)
- [🏷️ Classification Framework](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md)
- [🎯 Threat Modeling](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Threat_Modeling.md)
- [🔍 Vulnerability Management](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Vulnerability_Management.md)
- [🚨 Incident Response Plan](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Incident_Response_Plan.md)
- [🌐 Network Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Network_Security_Policy.md)
- [🔑 Access Control Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Access_Control_Policy.md)
- [🔒 Cryptography Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Cryptography_Policy.md)
- [💾 Backup & Recovery Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Backup_Recovery_Policy.md)
- [🤖 AI Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/AI_Policy.md)
- [🔐 Secrets Management Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secrets_Management_Policy.md)
- [📦 Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md)
- [🔒 Privacy Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Privacy_Policy.md) · [🛡️ Data Protection Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Data_Protection_Policy.md)
- [📊 Information Security Strategy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Strategy.md) · [📈 Security Metrics](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Security_Metrics.md)
[](https://github.com/Hack23/ISMS-PUBLIC)
---
## 🏢 About Hack23
**Hack23 AB** (Org.nr 559534-7807) — Swedish cybersecurity & open-source-intelligence consultancy.
- 🌐 Website: [www.hack23.com](https://www.hack23.com) · 📰 [Blog](https://hack23.com/blog.html)
- 💼 [LinkedIn — Hack23 AB](https://www.linkedin.com/company/hack23/)
- 👨💻 Founder: [James Pether Sörling, CISSP, CISM](https://www.linkedin.com/in/jamessorling/)
- 🛡️ [Public ISMS](https://github.com/Hack23/ISMS-PUBLIC) · 🕵️ [Citizen Intelligence Agency](https://github.com/Hack23/cia) · 🗳️ [Riksdagsmonitor](https://github.com/Hack23/riksdagsmonitor) · 🏛️ [EU Parliament Monitor](https://github.com/Hack23/euparliamentmonitor) · 🤖 [European Parliament MCP Server](https://github.com/Hack23/European-Parliament-MCP-Server)
---
## 📜 License
Copyright © 2008–2026 **Hack23 AB** (Org.nr 559534-7807). Licensed under the **Apache License 2.0** — see [`LICENSE.txt`](LICENSE.txt).
[](https://app.fossa.io/projects/git%2Bgithub.com%2FHack23%2Fcia?ref=badge_large)
---
**📋 Project Classification:** see the [Project Classification](#-project-classification-per-isms-classification-framework) section above for the full BIA matrix and strategic position. Summary: **Data Analytics Platform (OSINT)** · Operations · Confidentiality 🟢 Public · Integrity 🟠 High · Availability 🟡 Moderate · Aligned with **ISO 27001:2022 · NIST CSF 2.0 · CIS Controls v8.1 · AWS Well-Architected**.
---
<p align="center"><em>🕵️ Empower citizens · 🔍 Strengthen democratic accountability · 🏛️ Illuminate the political process</em></p>