<!-- Sweden 2040 — English edition, version 3.5, 18 August 2026. The Swedish original is authoritative: public/whitepapers/sverige-2040.md Working material and build: Life-Atlas/publications, sverige-2040/en/bygg_en.sh Companion short story: the-note-nobody-read.

Every source key, figure and date is bound to the Swedish original by tools/oversattning.py, which ships with a fixture that makes it fail.

Outstanding, in falling order of weight — same list as the Swedish: 1. Chapters 7-16 are a catalogue rather than an escalation. ~3,000 words should go. The mechanism is proven by chapter 9. 2. Chapter 19 should become a note before chapter 1. 3. Chapter 13 carries two subjects: mandated access, and whether a signal gets through. The second belongs in chapter 9 or 12. 4. Chapter 16 lacks the Swedish municipal statutes (LEH, NIS2, CER). 5. Chapter 1 lacks the 48-hour readying requirement. 6. Part II has no influence operations at all.

Gates run on the assembled file, never on chapters alone. -->

Sweden 2040 — the same attack, two countries

Part I — The starting point

1. The calculation that took an afternoon

Sweden measures its preparedness in things it owns and not in decisions it can take, and that difference determines what happens under fifteen years of pressure. A country that knows what it has can answer the question how much. A country that knows what works can answer the question what do we do now, which is the only question anyone asks during an attack.

Take the simplest example imaginable. Karlstad municipality has 104,089 inhabitants, and the municipality has 761 public shelters with 85,540 places in total. Fifty-five per cent of the population has a public shelter within three hundred metres of home, sixty-nine per cent within five hundred metres, 81.5 per cent within one kilometre. Outside the five-hundred-metre line stand 31,832 people. [EGEN-1]

The figures come from two open sources — the public shelter register and Statistics Sweden's population grid of one square kilometre — and the calculation took an afternoon. It requires no authorisation, no procurement and no secrecy decision. The method, with endpoints and parameters, is in the source list under [EGEN-1] so that anyone who disagrees can redo it.

Five objections to the calculation are valid and belong here, not in a footnote. The distance is as the crow flies: rivers, railways and motorways are not in the model, so actual walking time is longer and the coverage above is an upper bound. The population is assumed to be evenly distributed within each square kilometre. The calculation never asks whether there is room left once everyone within the distance has arrived. The number of places is the registered number, not the working one — the register reports capacity, not condition.

The fifth is the most serious, and it came from a reader who works in civil protection. A public shelter is not a room you run to. It is a space used for other purposes in peacetime, which has to be cleared, equipped and readied before it protects anyone. A distance to a point in the register is therefore not a distance to a public shelter. It is a distance to a place that can become a public shelter, if someone has time to make it one, and the calculation set out above measures the first and calls it the second.

Two of the five objections are this text's own subject, and they strike the text's opening figure harder than they strike the state. The figure measures nominal availability. That is precisely the error the rest of this text accuses the state of making, and anyone who wants to dismiss the argument should start here — I have left the way in open deliberately, because a calculation that hides its own weakness is worth no more than the register it criticises.

Sweden has 290 municipalities. This calculation has been done for one of them.

Nationally, Sweden knows that there are around 64,000 public shelters with room for some seven million people [SKYDD-1], a stock the government itself describes as uniquely large. What Sweden does not know is how many of them can be used. In February 2024 the supervisory authority had two shelter inspectors for the 64,000 objects, with the ambition of getting round the stock in five years, and assessed its own need at around forty [SKYDD-8].

This text follows two Swedens from 2026 to 2040. Both are attacked. One of them keeps the ability to take decisions while it is happening.

2. The point of divergence

Both countries accepted the same goal, and they took it from the same document.

In Utgångspunkter för totalförsvaret 2025–2030 the Swedish Armed Forces and the Swedish Civil Contingencies Agency established what preparedness is dimensioned against: total defence shall function through at least three months of major war in Europe, and civil activity shall maintain the essential societal functions "primarily with its own resources" for at least two weeks, on the assumption that electricity and electronic communications may fail [SV-6].

Two weeks on own resources. That is the measure, and it is shared.

Sweden A and Sweden B also took the same decisions on everything that is usually discussed. The same defence appropriations — over 170 billion extra for military defence and 37.5 billion for civil defence up to 2030 [SV-3], with the target of 3.5 per cent of GDP in 2030 [SV-4]. The same NATO membership from 7 March 2024 [SV-21]. The same conscription, built up towards 10,000 called up for enlistment a year in 2030 [SV-3]. The same public shelter act, adopted by the Riksdag on 29 April 2026 and in force from 1 June [SKYDD-3]. The same stockpiles, the same concrete, the same brigades.

The point of divergence lies in which follow-up question they put to the shared goal.

Sweden B asked what the goal requires us to have. That is a legitimate question and it has an answer that can be bought, built and counted. Sweden B therefore built further on the order Sweden already has: a hardened centre, one authoritative register per domain, and on top of the registers a national interface that reaches the whole population at once, in the same form, without intermediaries.

The measure of what such an interface can do is Ukrainian, and it is documented. On 15 October 2025 the Ukrainian state's app had over 23 million users and delivered over 70 public services and 33 digital documents [UKR-4]. Beneath it lay an interoperability layer that since 2019 has connected over 150 state registers and mediated more than 14 billion data exchanges, and between 2022 and 2024 the country rose from thirtieth to sixteenth place on the UN's index for digital government [UKR-5]. That happened during a war. What reach a Swedish interface has in 2040 is an assumption in the scenario; the Ukrainian figures are not. The only Swedish leg already decided in reality is identity: member states are to provide a European identity wallet before the end of 2026, and service providers with an identification obligation must accept it [ATK-13].

Sweden B also placed a copy of the state abroad, under the state. Estonia's data embassy in Luxembourg holds critical state databases at Tier 4 security level, stands wholly under Estonian control and can run the most critical services and not merely store them [TVILL-10]; the agreement was signed on 20 June 2017 [TVILL-11]. It is Finland's method with Ukraine's interface and Estonia's second centre, and it is cheaper, faster and historically demonstrated. It does not require the country's 290 municipalities [SKYDD-11] and their regions to agree on anything.

Sweden A asked what the goal requires us to be able to decide. Then it worked backwards through the chain: which decisions must be taken during the two weeks, which insights those decisions require, which information the insights require, and last — last — which data the information requires.

Sweden A traded away nothing of what Sweden B built. The stockpiles, the concrete, the conscription, the hardened centre, the rails and the data embassy exist in both countries, unchanged. Sweden A added three things that fell out of the backwards calculation.

The first is registers that report functional condition instead of nominal capacity. The chain is short enough to write out: the goal requires decisions over two weeks on own resources [SV-6], the decisions read which facility is to be sustained, staffed and prioritised, the insight requires condition and not numbers, the information is a condition field, and the data falls out of an inspection that is already carried out. All 349 public shelters on Gotland were inspected, and not a single one passed without an injunction [SKYDD-18]. The information existed, then. There was simply nowhere to write it.

The second is a plant description that the owner maintains itself, as an annex to the supply agreement. One thing must be said outright here, because it is easily written up as a difference and is none: that industry's conversion is regulated in advance at all is Swedish policy that precedes the point of divergence and that both countries implemented — the preparedness sector Industry, Construction and Trade was decided on 26 June 2025 [SV-16] and the supply agreements were proposed on 9 June 2025 [SV-17]. A's addition is the annex and the legal clearing of dual-use, nothing else. The chain: the same goal, the decision reads which workshop is to convert to what, the insight requires tolerances, materials, certifications and throughput — and the state gets the right to ask the question, not a copy of the answer.

The third is a Nordic query interface. The chain goes one step outwards: the decisions in the first week read what each of us can do now, every country has the answer about itself and no country has the answer about the others, and the unit that can cross a border is therefore the question and not the register. Joint ownership is precisely the point at which Nordic cooperation has broken down every time over twenty years [NORD-15].

That is the whole difference. It is smaller than it sounds.

Sweden A also did two things that do not follow from the follow-up question, and they are declared here rather than discovered in chapter 11. They are the renunciation of a general access route and the citizen-borne node. Neither is an answer to the question of which decisions must be taken during two weeks; both are choices of the other sovereignty — citizen custody in relation to the state — which the next section defines as the opposite architecture with the opposite failure mode. The first is moreover an active repeal: the act that brought number-independent communications services under the obligation to retain data and to adapt their systems entered into force on 1 March 2026 and applied in both countries before the sequence begins [ATK-24]. The bill for that choice is in chapter 13 and is paid in a currency that no calculation of decision-making capacity prices [ATK-42]. This text calls it a second divergence, and it is not derived.

It is also more expensive and slower than it sounds, and Sweden A failed at several parts of it. Chapters 12 and 18 are about that.

Three things Sweden A did not do belong here already, because the opposite is the commonest form of dishonesty in the preparedness debate. Sweden A produced not one extra shell, transformer or shelter place within the threat window. Nor did Sweden A build any interface of its own — the rails are Sweden B's, and A inherited them unchanged. Nor did Sweden A collect more data than Sweden B. It collected less, and about something else.

The reason for the last is documented. The Riksdag's own follow-up of three preparedness sectors reports agencies describing "very high pressure" to report to several recipients at once, and finds that the reporting burden holds back capability development [SV-11]. That burden is no argument against the rails. It explains them: the report is demanded for what never became an entry in a register, and the faster the rails are, the more prose is demanded about what the rails cannot carry. A country can measure its preparedness to death. That is the strongest objection to this text's thesis, it comes from the Riksdag, and it determines what Sweden A's additions must look like if they are not to become yet another reporting cycle.

2b. Two sovereignties, and they are opposites

The word sovereignty does double duty in this debate, and the slippage between the two meanings is the text's most serious risk. They are therefore defined here, once, and every chapter in Part III names which of them applies.

State sovereignty over data means that the state controls registers about the population and can reach them independently of foreign suppliers and jurisdictions. The failure mode is concentration: what the state can always read an attacker can eventually read, and what sits in one place can be knocked out in one place.

Citizen sovereignty in relation to the state means that the person controls data about themselves and can deny the state access. The failure mode is inaccessibility: what only the individual can unlock is inaccessible when the individual is unconscious, and a rationing scheme, an evacuation or an emergency payment that requires consent from every single person becomes slow in exactly the situation where slowness costs lives.

The two are not degrees on a scale. They are opposite architectures, and a country needs both in different domains. Choosing the wrong architecture for a domain is more expensive than choosing too little of either.

The cost must be said outright, because it strikes this text's own sympathies. Citizen-borne custody makes rationing of medicines, evacuation and emergency payment harder — and those are precisely the functions that most visibly held Ukraine's home front up. Every time the text argues for citizen custody it pays that price.

3. How this text is built

A counterfactual text can be used to prove anything at all. The author chooses the outcomes, the country whose policy they dislike loses, and the reader can check nothing, because the future has no sources.

The rules are therefore written out here, in advance, so that I can be held to them.

One point of divergence. Sweden A and Sweden B differ in a single follow-up question, put in 2026 to a goal both accepted. Everything else that separates them in 2040 must be derivable from that question through a chain I write out. Where I cannot derive it, I say that I cannot. One of the differences cannot be derived, and it has already been named: chapter 2 declares it a second divergence — a choice about rights, taken for reasons other than preparedness, with a bill of its own that is paid in chapter 13. It does not ride along with the derived chain, and it should not be read as though it did.

No villains. Sweden B is governed by competent people who take defensible decisions. Sweden B is moreover the historically demonstrated method: Finland, generally reckoned Europe's best-prepared country, has around 50,500 public shelters with room for some 4.8 million people [SKYDD-12] and built that with law and concrete, not with data. Chapter 18 makes Sweden B's case on its own merits, including the four objections that would sink this text if they hold.

Sweden A is not spared. It is attacked just as hard, loses people and infrastructure, and several of the things it built worked worse than those who built them had counted on. Those cases are in the text.

Everything that is scenario is marked. Every figure is either taken from a source with a key in the list, or explicitly an assumption in the scenario. The two are never mixed in the same sentence without it being stated which is which. Invented figures written in the language of numbers are the commonest form of dishonesty in this genre.

Every claim carries its key. The key in square brackets leads to the list at the end of the text, where every entry has a publisher, a date and a link — except the entries marked EGEN, which are my own calculations and therefore have no publisher to link to. They are set out instead with input data and arithmetic operation, so that anyone who disagrees can redo them and arrive at something else. This is not academic ornament. A text that asks the reader to recalculate its figures must say where they are, otherwise it is just another register reporting nominal capacity.

Reality carries what can be documented. The attack sequence in Part II is built on incidents that have already occurred between 2022 and 2026, and the scenario structure is not mine: the Swedish Armed Forces and MSB themselves define the seven dimensioning type situations the sequence follows [SV-6]. The extrapolation is mine. The underlying material is not.

It is still 2026. Nothing in Part III has happened. The text is about decisions taken this year, by people who are in post this year.

Part II — The attack

The attack sequence below is a scenario. The underlying material is not. Every mechanism described has already been used against northern Europe between 2022 and 2026, and the scenario structure I follow is not mine: in Utgångspunkter för totalförsvaret 2025–2030 the Swedish Armed Forces and MSB define seven dimensioning type situations — hybrid threats, host nation support, a limited attack on northern Sweden, an attack on Gotland, long-range attack, reinforcement of the alliance's northern flank, reinforcement in the Baltic states — and write out that they can occur simultaneously [SV-6]. The same document establishes what preparedness is dimensioned against: total defence shall function through at least three months of major war in Europe, and civil activity shall manage the essential societal functions "primarily with its own resources" for at least two weeks, on the assumption that electricity and electronic communications may fail [SV-6].

Two weeks on own resources. That is the measure. Keep it in mind throughout Part III.

4. Phase one: the grey zone that was not a war

What is decisive about the grey zone is not that it is hard to detect. It is hard to answer, and the reason is legal rather than technical.

Prove it with the most thoroughly investigated case in the Baltic Sea. On Boxing Day 2024 Estlink 2 was severed together with four telecommunications cables. Finland boarded the vessel Eagle S, arrested the crew and brought a prosecution. On board, according to the investigation, was advanced transmitting and receiving equipment for electronic intelligence gathering. On 3 October 2025 Helsinki District Court dismissed the entire case. The court found that the loss of the anchor was due to a technical fault rather than intent, and — more importantly — that it lacked jurisdiction: under article 97(1) of the Law of the Sea Convention this is a "navigational incident" falling under the exclusive jurisdiction of the flag state, and Finland's implementation of article 113 covers only Finnish vessels and citizens outside territorial waters. The Finnish state was ordered to pay the defendants' legal costs, around 195,000 euros [BALT-1][BALT-2]. Estlink 2 was out of service for six months and did not return to commercial operation until 20 June 2025 [BALT-5].

No part of that outcome was about a lack of information. Finland knew which vessel it was, who owned it, where it was going and what was on board. The knowledge existed. The legal order was not sufficient.

The pattern repeats. After the damage to the cable between Latvia and Gotland in January 2025 Sweden boarded the vessel Vezhen — and the prosecutor concluded that the anchor had been dropped by accident and released the vessel [BALT-9]. The Swedish investigation into Yi Peng 3 found no decisive evidence of deliberate damage [BALT-4]. NewNew Polar Bear, which the Finnish police in May 2025 explicitly identified as the cause of the Balticconnector damage, made its way to Russian waters without anyone being charged, and Finland is not permitted to know what investigative measures the Chinese and Hong Kong authorities are taking [BALT-3].

Anyone writing about this has to be honest in both directions: not every cable break in the Baltic Sea is sabotage. Two of the most widely discussed cases have been tried and judged to be accidents. The point is not that everything is an attack. The point is that an attacker who chooses methods whose normal cause is carelessness gets impunity thrown in, and that this works however good the defender's sensors are.

Around this the scale is growing. CSIS counted Russian attacks in Europe at three during 2022, twelve during 2023 and thirty-four during 2024. The methods break down into explosives and arson 35 per cent, blunt and sharp objects including anchors 27 per cent, electronic attack 15 per cent [BALT-8]. Reported disruptions of satellite navigation in Swedish airspace rose from 55 during 2023 to 733 so far during 2025, counted to 4 September that year [BALT-15]. Andreas Holmgren, head of aviation at the Swedish Transport Agency, said outright on 4 September 2025 what the analyses showed: "We can establish that the disruption originates in Russian territory." [BALT-15] Researchers at Gdynia Maritime University and the German DLR triangulated the sources to around one kilometre's accuracy — Okunevo in Kaliningrad, next to the headquarters of the 218th independent electronic warfare regiment, and Baltiysk [BALT-14].

In the scenario the curve continues. The difference from today is not the methods but the endurance: the same tools, year after year, against a society that grows used to them.

One thing more, which the text must not skirt. In its assessment for 2025–2026 the Swedish Security Service judges that Sweden is not currently the principal target of Russian sabotage and influence operations in Europe [BALT-10]. A scenario that places Sweden at the centre therefore does so for dramaturgical reasons, not for intelligence reasons. That must be stated, because the alternative is to let the reader believe the authorities are saying something they are not.

5. Phase two: the limited kinetic

The scenario's second phase follows the line the Swedish Armed Forces and MSB draw themselves: long-range attack and limited attack, targeted and deliberately kept below the level that unambiguously triggers article 5.

The form is already visible. Over five days at the end of September 2025 Copenhagen airport was closed for around four hours, then Aalborg and Billund, with reports from Sønderborg, Esbjerg and Skrydstrup. Prime Minister Mette Frederiksen called it the most serious attack on Danish critical infrastructure to date. Drones in formation were observed over Schleswig-Holstein, including Thyssenkrupp's naval facilities. Danish authorities received over 500 drone reports in twenty-four hours. No perpetrator was publicly identified. The chronology is compiled from Danish official communications and news reporting, not from a single official account, and it should be read with that reservation [BALT-11].

The Norwegian security service was equally direct in the other direction. Senior adviser Eirik Veum established on 1 October 2025 that none of the observations over Norwegian airports and critical infrastructure had so far been confirmed as having any connection to state actors [BALT-16]. The uncertainty is not a gap in the reporting. The uncertainty is the weapon.

Where the grey zone measures its outcome in disruption, the kinetic phase measures it in restoration time, and restoration time is physical. Estlink 2 was down for six months. The repair cost is put at up to 60 million euros. Svenska kraftnät has 2,900 kilometres of line and 40 substations to build in ten years, Gotland's reinforced connection is not in operation until 2030, and 45 per cent of the investment goes purely to replacing plant that has reached the end of its technical life [EL-3][EL-8]. High-voltage transformers of 330–750 kV have, according to the Danish DIIS, production cycles of 12–18 months [UKR-9].

That sets a limit no model shifts. Nothing in Sweden A produces a single extra transformer, shell or shelter place within the threat window. That sentence belongs in the text, because the opposite is the commonest form of dishonesty in the preparedness debate: letting an information system appear to be an answer to a physical shortage.

The difference between the two Swedens in this phase is therefore not that A has more equipment. Nor is it who gets the question out. The question goes out within hours in both countries, in the same form across the whole country, without intermediaries. The difference is what comes back. Sweden B gets an answer about numbers, because numbers are what the registers hold: the register of around 64,000 public shelters reports nominal capacity and not condition [SKYDD-1]. Sweden A gets an answer about condition — which of the existing facilities can actually be used, for how long, and for whom. What proportion of them is unusable when the phase begins is information the source material does not contain. The only documented figure in the vicinity is that all 349 inspected public shelters on Gotland received an injunction, not a single one passed without a remark [SKYDD-18].

6. Phase three: the threat that was never triggered

The hardest form is the one that never comes.

A standing invasion threat ties up resources for years without any day arriving on which the preparedness may be released. It is the only phase in which the two Swedens differ for structural reasons rather than by luck, and the reason is endurance: two weeks on own resources is what dimensions the system, but a threat that lasts six years does not ask the question about two weeks. It asks whether a society can carry heightened alert as its normal state without using up the people who constitute it.

Here three forces work against every country that is subjected to it.

Habituation. FOI's own research finds that the symbolic value of public shelters exceeds their actual protective value, and that the perceived need for protection declines as the population grows used to the war [SKYDD-16]. Preparedness that is not used ceases to be experienced as preparedness.

The reporting burden. The Riksdag's follow-up of three preparedness sectors (RFR 2024/25:3) reports agencies describing "very high pressure" to report to MSB, the Government Offices and the Swedish Armed Forces, and finds that this holds back capability development [SV-11]. Under a protracted threat that burden grows in step with the anxiety. A country can therefore measure its preparedness to death, and that is the closest this text comes to a warning aimed at its own thesis.

The wearing down of what is not visible. In its assessment of May 2026 the Agency for Civil Defence finds that capability has developed in every sector but that the pace "needs to increase without delay", and names the shortcomings: planning for endurance, physical protection and repair of critical infrastructure, support to military defence, staffing, prioritisation of scarce resources and the capability of private actors [SV-8]. Five of the six are about people and things. One is about being able to prioritise — which is a question of knowing what exists and in what condition.

In Sweden B the six years run like this: the stockpiles are there, the concrete is there, the conscription is there. The question goes out on the rails and the answer comes back within twenty-four hours, complete and uniform, without anyone compiling it. The answer counts facilities and heads. What proportion of what is counted still works is not an entry in any register, and so the report remains for precisely that — it is that burden the Riksdag's follow-up measures [SV-11].

In Sweden A they run the same way, on the same rails, which A inherited unchanged. The difference lies in what goes through them: the question "what works right now" has a recipient and a field to answer in, and therefore needs no report to be answered. That is the whole difference. It is smaller than it sounds, and it is harder to build than it sounds, and chapters 12 and 18 are devoted to both.

Part III — The Domains

7. Knowledge

Form of sovereignty: state custody of the state's data about its own facilities, with a boundary drawn at the person. The register must be able to answer whether a task can be performed at a site, without answering who performs it. Where that boundary falls is the chapter's hardest question, and it is not settled.

Knowledge is the only infrastructure that leaves the building at five o'clock.

A stock can be filled in advance, concrete can be poured, a transformer stays where it is put. The ability to run the facility sits in people who can fall ill, be wartime-assigned or be recruited by someone else, and it decays without leaving a visible ruin behind it.

Gotland supplies the proof. All 349 public shelters on the island were inspected, and not a single one passed without an injunction. The typical faults were defective sealing strips, unlubricated hinges, missing tools and wrongly drilled cable penetrations [SKYDD-18]. None of that is visible to the person who owns the building. It is visible to the person who has learned to look. In February 2024 the supervisory authority had two such inspectors for 64,000 objects and assessed its own need at around forty [SKYDD-8].

The concrete, then, was not the scarce commodity on Gotland. The eye was.

Sweden has already written the problem down. In its fifth aggregated assessment from May 2026, the Swedish Agency for Civil Defence names six cross-sectoral shortcomings, and personnel supply is one of them [SV-8]. The Swedish Armed Forces have over time named the shortage of officers as one of the army's most decisive challenges [SV-14], and the Riksdag's follow-up of three preparedness sectors reports significant recruitment difficulties over the past five years [SV-11].

During 2025, 8,136 conscripts began basic training against a target of at least 10,000 a year by 2030, and the number of wartime-assigned personnel rose to 75,400 [SV-14][SV-4], heading towards some 130,000 people in 2035 [SV-4]. Every person in that growth had a civilian job the day before. A wartime organisation that grows draws on the same population that runs the waterworks.

The event. In the scenario's third phase, heightened alert is declared and parts of the wartime organisation are called up, without any facility being destroyed. Both Swedens then discover the same thing: a plant left undamaged is not the same as a plant that can be run.

Sweden B. Here Sweden B is strong, and stronger than texts of this kind usually admit. B has an authoritative register per domain and therefore knows how many qualified plant operators, licensed doctors and certified inspectors the country has. On top of the registers lies B's real asset: a national interface that reaches the whole population at once, in the same form, without intermediaries.

Ukraine supplies the measure of what such an interface can do. In October 2025 the Ukrainian state's app had over 23 million users and delivered over 70 public services and 33 digital documents [UKR-4]. In April 2025 the users amounted to 60 per cent of the population, and beneath the app lay an interoperability layer which since 2019 has connected over 150 state registers and brokered more than 14 billion data exchanges [UKR-5]. Between 2022 and 2024 the country rose from thirtieth to sixteenth place in the UN's index for digital government [UKR-5]. That happened during a war.

Sweden B, then, has no telephone list. B has the rails.

The call-up reaches every wartime-assigned person within hours, in the same interface she already uses for everything else she has to do with the state. The confirmation travels back the same way, and the national picture emerges without a case officer compiling it. No municipality deviates, no region counts differently. Speed, coverage, uniformity — three things a federated arrangement does not deliver, and Sweden A never built anything to compete with them. A inherited the interface unchanged.

The question in the sixth year is nevertheless not how many.

It is who can run this particular facility this particular week, and there the interface ends. An interface delivers what is already a record. A document is a record, which is the whole reason the Ukrainian app can issue thirty-three of them [UKR-4]. A qualification is a record. That a named task can be performed at a named site this week is not a record anywhere, in any register, in either country.

The Swedish Medical Association's 2025 survey measures precisely that distance. About a third of doctors state that their employer has concrete plans for work in an acute crisis or wartime situation. Seventeen per cent both have such an employer and know well what they are expected to do. Seven per cent answered yes to all three questions: plans exist, the role is known, an exercise has been carried out [VARD-12].

An interface reaches every one of them in an afternoon. Seven per cent is what Sweden knows about what they do once they are reached [VARD-12].

Sweden B's failure mode is therefore neither ignorance nor delay. B answers quickly, completely and uniformly. The failure mode is that a fast and uniform answer carries more weight in a command room than a slow one, without therefore being an answer to the question that was asked. Over two weeks on own resources — the floor Swedish planning itself sets for the most important societal functions [SV-6] — nobody has time to discover the difference.

The second cost is architectural. An interface that reaches everyone rests on a handful of registers whose loss is total, and the concentration lies beneath the window, not in it. An attack on Ukraine's state registers was attributed to the GRU and made public on 19 December 2024. From the beginning of December, citizens could already not sell cars, bring legal actions or register marriages, and the registers were reported to be working again only on 20 January 2025 [UKR-6]. The attack hit the registers, not the interface. The effect was total all the same, because an interface only delivers what a register holds. That is the whole point of the failure mode: a hardened window onto a wrecked room shows nothing.

Sweden A. The addition is called the knowledge audit, and it is not a system. Sweden A built no interface of its own, because A already had B's. The addition is what travels along the rails. For every facility within the preparedness sectors, three questions were asked: which named tasks must be performed here for the plant to deliver, how many people can perform each of them today, and how long it takes to get the second person here. The answer is generated where the work is done, out of the rosters and qualification systems already in use, and it is machine-readable instead of written. No competence database covering the population was built.

The method already exists in Sweden, in one clinic. A research and development project at Akademiska sjukhuset mapped the need for supplies, medicines and staff out of patient records and simulation systems, day by day and hour by hour, and found that eight moderately to severely burned patients require, over the first two weeks, 17,000 examination gloves, 597 litres of Ringer's acetate and 5,546 intensive care hours [VARD-14].

Note the unit in the last figure. It does not state a number of nurses. It states hours of a particular competence, and it is the only one of the three items that cannot be bought in when the need arises [VARD-14].

Sweden A did not get more operators out of this, and A was not faster than B. B was just as fast, on the same rails, within the same twenty-four hours. A got something else within that day: which facilities had fallen below one person per critical task, and could move the few people the country had to where their absence stopped something. Prioritisation of scarce resources is one of the six shortcomings the Swedish Agency for Civil Defence names [SV-8].

The margin between the countries is therefore not speed. It is the content of an answer that arrived just as fast in both.

What it cost. Four things, none of them solved.

The first attempt died of its own response rate. In the scenario, the first knowledge audit was designed as an annual survey through the national interface — the reporting mechanism the Riksdag's follow-up warns about [SV-11], now with a response rate no paper survey has reached. In the scenario it took three years to discover that the answers described the roster and not the work, precisely because nothing in the material looked broken. That is an assumption in the scenario.

The boundary at the person cost time every time, and the interface made it dearer. The Swedish Security Service's assessment for 2025–2026 names disposable agents, recruited online for single assignments, as one method [BALT-10]. A channel that reaches every wartime-assigned person directly is at the same time the most complete list of them ever compiled. Sweden A therefore answers at role level: this facility has more than one person who can do the task, not who they are. Every urgent case became one telephone call longer. That is a cost, not a solution.

The knowledge audit produced no knowledge. Naming a shortfall does not fill it. The officer shortage is a shortfall with lead times measured in years [SV-14], and the physical lead times around it do not move either: 12–18 months for high-voltage transformers, and six to eight months of approval and procurement delays in Ukraine's rebuilding of the grid [UKR-9].

Where the work had never been written down, the audit was wrong in the flattering direction. A task performed by a single person who has never documented it looks, in every system, either like a task nobody performs or like a task the roster covers. In the scenario Sweden A discovered this at the facility where it mattered.

Ukraine. The experience from there is that the interface held while the competence beneath it disappeared. In 2022 the country's national e-health system had thirty-six million registered patients and over 1.6 billion record entries, and the central component held [UKR-17]. Beneath it were over forty regional medical information systems, of which four to six are expected to survive — because of financial losses, destroyed infrastructure and the evacuation of qualified IT specialists [UKR-17].

The third cause is the interesting one. The systems did not die because the data was lost. They died because the people who could run them left the country.

PrivatBank moved four petabytes from 3,500 servers in under 45 days [UKR-2], a speed that presupposes people who knew their own server estate without having to look. Kyivstar was penetrated through a compromised employee account, and according to the SBU's head of cyber security the attack of 12 December 2023 destroyed the core of a telecoms operator [UKR-7]. Competence is the way in as much as it is the defence.

The mechanism. A state measures competence as a stock of qualifications and heads, which is nominal capacity in exactly the same sense as the place count in the public shelter register is. A national interface does not change that. It delivers the nominal capacity faster and to more people. The difference is invisible in peacetime, because in peacetime the second person is always somewhere. Under a standing threat the second person is wartime-assigned, and the register reports that nothing has changed.

Part of the knowledge cannot be proved in advance. Svenska kraftnät writes that island operation cannot be fully exercised for real, that the function cannot be guaranteed with one hundred per cent certainty, and that it is a matter of running a weak grid, which is complicated and risky [EL-7]. No knowledge audit removes that uncertainty. It records that the uncertainty exists and where, which is more than a certificate of qualification says.

FOI makes the same case at the level of the state: as a small state with dependencies on the EU and NATO, Sweden must retain an independent national capability for threat assessment [SV-20]. That capability is not a system. It is people who have done the work long enough to be wrong in useful ways, and it is least of all something that can be procured in the year it is needed.

What would falsify this. If the mechanism holds, competence measured functionally should predict outcomes better than a head count, even when both travel through the same interface. The first counter-observation: that after 2030 the Swedish Agency for Civil Defence reports personnel supply as solved without anything having changed in what is recorded about competence, that is, through volume alone [SV-3][SV-4]. In that case this chapter has quarrelled about the wrong noun. The second: that a mobilisation in the Nordic region allocates people just as accurately in a country that sends stock figures through its national interface as in a country that sends task-by-site data through the same interface. If that comparison holds, Sweden A's addition is ornament on rails Sweden B had already laid, and no part of the chapter can be saved by pointing out that the data was nicer anyway.

8. Production

Form of sovereignty: private custody as against the state. The workshops are privately owned, the state cannot hold their facility data, and what decides the matter is therefore not who owns the description but what has been agreed before the question is asked.

A country does not convert its industry during an attack. It converts it on the terms written down before the attack, or not at all.

The event in the scenario's second phase is banal in form and merciless in pace. After the drone attacks on combined heat and power plants and ports, both countries need a narrow range of things quickly: switchgear components, pumps and gaskets, backup power, field medical supplies, drones and counter-drone measures. None of it is exotic. All of it is normally made by companies that make something else, and both Swedens are to manage the first two weeks mainly on their own resources [SV-6].

Sweden B had the apparatus in place, and it was not improvised. On 26 June 2025 the government decided to establish the preparedness sector Industry, Construction and Trade with the Swedish Agency for Economic and Regional Growth as the sector-responsible authority, in force from 22 July 2025, which raised the number of preparedness sectors from ten to twelve [SV-16]. On 9 June 2025 the inquiry into the supply preparedness of the business sector proposed a system of supply agreements between companies and the state, a construction and repair preparedness office located at the Swedish Agency for Economic and Regional Growth, and an extended mandate for RISE to maintain a capability for production conversion during crisis, heightened alert and war [SV-17]. Convertible industry is therefore not this text's invention. It is Swedish policy, formulated before the point of divergence, and Sweden B implemented it as it was written.

The outcome followed accordingly. The question went out on the rails and reached the whole list at once and in the same form, and the conversions that had been planned worked: the companies on the list had agreements, contact routes and an authority that knew what they could do [SV-17]. What did not work was the margin — the subcontractor two steps down, the workshop that changed owners in 2034, the machine that was sold when the order failed to arrive in 2031.

The mechanism behind that has been written out by the supervisory side itself. The Swedish Agency for Civil Defence notes that in several areas public authorities are subject to requirements and given funding to a greater extent than private actors, "which creates a gap", and that capability-raising preparedness measures are often not commercially viable and therefore risk not being taken by private actors without legal requirements or public funding [SV-9]. An agreement binds the party that signed it. It does not describe the shop floor, and it ages at the same rate as the machine park does.

That money was not the binding constraint is visible in the Swedish Armed Forces' own accounts. The authority carried 780 million kronor unspent from 2024 into 2025, ended 2025 with 366 million unspent on materiel and facilities "on account of delivery delays", and under-used an appropriation by 423 million "on account of delays from industry" [SV-15]. Absorption was the problem, not the appropriation. A Sweden given more money in 2036 would have had the same answer from the same industry.

Sweden A dismantled none of this. The same sectors, the same supply agreements, the same office, the same institute. The addition lay in what the agreement required as an annex: a machine-readable description of what the facility can actually do — tolerances, materials, certifications, throughput — maintained by the owner, not by the state. The standards already existed. ISO 23247 parts 1–4 were published in 2021 and part 5 is dated 2026 [TVILL-2]; IEC 63278-1, which defines the Asset Administration Shell for industrial assets, is dated December 2023 [TVILL-3]. Both datings are taken from the publishers' catalogue and preview pages, not from the adopted standard text, and should be read as probable rather than verified against the original. Sweden A therefore built no national machine register. The state got the right to ask a question, not a copy of the answer.

Here runs a boundary the reader is entitled to see without having to look for it in chapter 19: machine-readable descriptions of real facilities are WINNIIO's field of work, and what I argue for in this chapter therefore lies within what I work with. The same applies to the condition field in chapter 12. The reason it stands nonetheless is that the argument rests on standards others have written and on sources anyone can read, and it falls or holds independently of who builds. The falsification conditions below are written so that they can bring it down.

The second addition was legal and was made in peacetime. Ukraine's decisive instrument was not a technology but a law: the cloud law 2075-IX was adopted on 17 February 2022, a week before the invasion, and government decision no. 263 of 12 March 2022 permitted public registers and encrypted backups to be placed outside the country under martial law [UKR-1]. The path was cleared before it needed to be used. Sweden A did the equivalent for dual-use: export control classification, certification, product liability and the question of who owns the design when a civilian workshop manufactures a military component were settled in 2027, not in the week the answer was needed.

What it cost. Three things worked less well than those who built them reckoned with.

Take-up was thin. The standards were specifiable, not established, and the description was voluntary for everyone except those holding supply agreements [SV-17]. Most small workshops never produced one. What proportion of the Swedish stock of facilities had a machine-readable description in 2035 is an assumption in the scenario, not an established figure.

The strongest counter-argument comes from the one occasion when Europe bet on open, modular infrastructure at scale. During the first quarter of 2025 the five largest RAN suppliers controlled 93 per cent of sales while the Open RAN challengers together had around 7 per cent and roughly 2.5 billion dollars in annual revenue, against the some 5 billion dollars a year that Ericsson and Nokia spend on research and development [EL-16]. Openness as a market strategy lost to scale. The difference from the supply agreements is real but limited: the description would not compete any supplier out of the market, it would describe a facility that was already somebody's. That is an argument, not a result, and it should be read as such.

Concentration was the third cost. Sweden's most damaging infrastructure incident in recent years was a ransomware attack on a single HR supplier, discovered on 24 August 2025, which reached around 200 of the country's 290 municipalities [EL-15]. A consolidated description of Swedish manufacturing capacity would be the most useful targeting material anyone has compiled about Swedish industry. Sweden A therefore divided the custody, and paid for it in tempo: a question that passed three custodians took longer than an answer that came back on the rails within the day.

Here lies the chapter's most important objection, and it strikes the proposal made in this chapter. Reprogrammability is a second-order problem. The first-order problem is chemistry and machine tools. On 21 November 2024 the Nordic defence ministers backed initiatives to increase Nordic ammunition production [NORD-3] — a declaration of intent, not a factory. High-voltage transformers of 330–750 kV have production cycles of 12–18 months, and over 150 large autotransformers were ordered with around 1.5 billion dollars in public and international financing [UKR-9]. No description shortens a propellant line or a four-axis machining centre with a delivery time. No established figure for European shell production exists in the source list, and therefore no such figure appears here.

Where the mechanism actually bites is at the other end of the range. In 2025 Ukraine's ministry of defence planned to procure around 4.5 million FPV drones, which matched the entire capacity of the national industry, and set aside over 110 billion hryvnia; by the end of 2024 over 1.5 million drones had been procured, 96 per cent paid to Ukrainian manufacturers and suppliers, up from a few thousand in 2023 [UKR-14]. The adaptation happened through a large number of small manufacturers and workshops with feedback loops measured in days, not through a central model. What made the pace possible was that the products are built from commodity goods with short tooling chains. The transformer has none.

The mechanism generalised is therefore narrow and should be kept narrow. Conversion speed is determined by how much of the answer already exists when the question is asked, not by how fast someone can find it out. Sweden B put the question on the rails and had answers from every company with a supply agreement within the day [SV-17]. The answer was the range that stood in the agreement on the day the agreement was written. The subcontractor two steps down was not in the agreement, and the machine sold in 2031 was still in it. The agreement bound the party that signed; it never bound the shop floor [SV-9]. What never became an item in the agreement was instead requested in report form, and that is the burden the Riksdag's own follow-up found to hold back capability development when the pressure becomes high enough [SV-11]. Sweden A put the same question to the facility. The difference is invisible in 2030 and decisive in the sixth year.

What would falsify this can be named in advance. If a Swedish civilian workshop between now and 2032 converts to a defence-relevant product in weeks without any prior machine-readable description, and this turns out to be the normal case rather than the exception, the description layer is not load-bearing and Sweden B's supply agreements suffice. If the supply agreements under SOU 2025:68 are signed and the conversion office delivers without any facility description existing, the same applies [SV-17]. If take-up, on the other hand, remains negligible while the suppliers keep the interfaces closed, in the way Open RAN demonstrated [EL-16][TVILL-3], Sweden A's addition never existed in practice, and this chapter describes a country that did not happen.

9. Electricity

Form of sovereignty: state custody of the state's own data. The electricity system is the domain of the state and the system operators, the centre is the right answer, and the transmission grid already reads its own frequency and its own flows in real time and computes inertia on top of that reading. The one point where the opposite sovereignty intrudes lies below the meter, in the question of who is to get power when there is not enough for everyone.

Electricity is this chapter's hardest test of the text's thesis, and the test should stand before everything else.

Since 2015 the Nordic transmission system operators have had real-time estimation of rotational energy in their operating systems and forecast inertia a week ahead in order to dimension fast frequency reserve. In a joint document dated 28 August 2025, Energinet, Fingrid, Svenska kraftnät and Statnett establish that there is no need to define a minimum inertia requirement for the Nordic synchronous system over the coming two years. The dimensioning fault is the loss of Oskarshamn 3 at up to 1,450 MW, the frequency must not fall below 49.0 Hz, the design level is 150 GWs, the stability level 120 GWs, and the analyses show that stability is challenged around 90 GWs [EL-6].

Read it as it stands, not as it sounds. The rotational energy is an estimate and not a measurement — the source calls it an estimate, and a forecast a week ahead cannot rest on anything other than which generation is planned to be in operation [EL-6]. The levels 150, 120 and 90 GWs are thus comparison figures for a calculated quantity, and the dimensioning fault, a loss of 1,450 MW, is an assumption about what can happen and not an observed condition [EL-6]. The quantity that is genuinely read is the frequency, and it is also the one that carries the sharpest threshold: 49.0 Hz [EL-6].

That is where the real boundary between plan and condition runs in the power system, and it runs not between authority and citizen but straight through the control room. The difference from the public shelter register remains nonetheless, and it lies in the feedback. The calculation of rotational energy rests on a physical quantity that is read continuously, so an assumption that drifts away from reality shows up in the frequency. The register of public shelters has no such reading beneath it at all. The electricity system has one, and has had it since 2015 [EL-6].

The event in this chapter is a winter week in the scenario's second phase. Drones hit switchgear stations and combined heat and power plants in southern Sweden at the same time as a direct current link drops out, and parts of the country have to be held up as islands until the transmission grid is reassembled. How many facilities are hit is an assumption in the scenario, not a figure I have, and I invent none.

The geography behind the event, by contrast, is not assumed. Svenska kraftnät's final report to the government on transfer targets states that capacity SE3→SE4 rises from 5,600 MW during 2021–2023 to 6,200 MW in 2030 and then stands still through 2035, 2040 and 2045 [EL-5]. As long as those targets stand, that is the quantity of surplus from Norrland that can reach Skåne, however much is built in the north. A table of targets is, however, a political decision and not physics: it can be rewritten, and the ceiling is therefore a planning assumption rather than a limit in nature. Whatever Sweden B and Sweden A do with data, that ceiling is the same in both countries.

Sweden B sees the event coming, in the sense that counts. The control room has the frequency and the flows read off and the estimate of rotational energy on top of them, and has had them all along [EL-6]. Three things nevertheless bind Sweden B, and none of them is a lack of information.

The first is the regulatory framework. On 7 October 2025 Svenska kraftnät cancelled the procurement of the strategic reserve for the winter of 16 November 2025 to 15 March 2026 and left Sweden without a strategic reserve. Up to 800 MW was sought, all three bids received came from existing generation and all exceeded the EU price cap. Malin Stridh noted that the regulatory framework "in principle makes it impossible" to procure a strategic reserve, and the head of operations Pontus de Maré called the situation worrying and pointed to manual load shedding — a measure never used before [EL-4].

The second is physics. The grid development plan 2026–2035, published on 15 December 2025, plans around 2,900 kilometres of new line and around 40 new substations over ten years, plus reinvestment in over 1,100 kilometres of line and about half of the roughly 200 substations. Investment in facilities rises from 9 billion kronor in 2025 to 20 billion a year in 2026 and 2027, and 45 per cent of it goes solely to replacing what has reached the end of its technical life [EL-3]. High-voltage transformers of 330–750 kV have production cycles of 12–18 months, longer for what has not been ordered in advance [UKR-9].

The third is that island operation cannot be tested. Svenska kraftnät writes itself that the most central precondition is local generation capable of black start from a dead grid, that generation and consumption must be balanced completely and continuously, that island operation cannot be fully exercised for real, that the function cannot be guaranteed with one hundred per cent certainty, that the scope is local and regional islands within individual communities or municipalities, and that it requires very hard prioritisation of who gets electricity [EL-7].

The last clause in that sentence is the chapter's hinge. The hardest element of island operation is not electrotechnical. It is a decision about who is to get power, taken under time pressure, in a situation where the mistake cannot be corrected afterwards.

Sweden has an arrangement for precisely that decision, and it has a name. Styrel is the systematic method for identifying and prioritising socially important electricity users ahead of manual load shedding. The Swedish Energy Agency, MSB and Svenska kraftnät stand behind it, county administrative boards, municipalities, electricity network companies and individual operations make the prioritisation together, the legal basis is ordinance (2011:931) with the Swedish Energy Agency's regulation STEMFS 2013:4, and the planning is redone in rounds — the most recent covered 2023–2025 [EL-19].

Styrel is Sweden B's strongest card in this entire text, and it should lie face up. The arrangement exists, it is decided, it is nationwide, and it has been practised as a planning process in three rounds. Anyone who claims that Sweden cannot determine who gets power when there is not enough for everyone is wrong, and has been wrong since 2011.

A limit to Styrel should nonetheless be written out, because this chapter's event lies outside it. Styrel concerns manual load shedding [EL-19] — a decision taken by people, executed on order and measured in hours. The sequence described above, switchgear stations and combined heat and power plants dropping out at the same time as a direct current link goes, is not such a sequence. The frequency moves faster than any decision, and what acts first is automation nobody has time to consult. Styrel determines who gets power in the week that follows. It determines nothing in the first seconds.

What Styrel ranks is operations. A priority class says that a waterworks comes before a shopping centre; it says nothing about whether the waterworks' backup power starts that morning. That is the whole difference this chapter turns on, and it does not become smaller because the arrangement is good — it becomes visible only in the moment the arrangement is to be executed.

Before Sweden A is allowed to answer, the strongest counter-fact should stand unabridged. On 28 April 2025 the Spanish and Portuguese grid fell, described by ENTSO-E as the most serious interruption event in the European power system in over twenty years and the first ever of its kind [EL-2]. The expert panel's final report of 20 March 2026, produced by 49 members from system operators, regional coordination centres, ACER and national regulatory authorities, identifies an interplay of factors: oscillations, deficiencies in voltage and reactive power control, differences in practice for voltage control, rapid generation reductions and generator losses in Spain, and uneven stabilisation capability [EL-1].

That was Europe's most instrumented domain, observed in real time, and it fell all the same. The causes were control design and operating practice, not missing data [EL-1]. A text which claims that the difference between two countries lies in what the data describes must be able to say outright that the largest real test in Europe during this period points the other way.

What Sweden A did is therefore less than the reader expects. Sweden A built no model of the transmission grid of its own. Since 2015 the real-time estimate and the weekly forecast have sat with the system operators themselves, together with the readings and the knowledge of the facilities [EL-6]. Whether Svenska kraftnät in addition runs something the authority itself would call a twin of the transmission grid, I do not know — the material I have concerns inertia requirements and reserve dimensioning, not model architecture [EL-6], and that gap is left open rather than filled. The addition lies on the other side of the meter: which facilities are connected, which of them have working local generation, and in which order they are to be carried in an island. That information does not live with Svenska kraftnät. It lives with municipalities, regions, waterworks and operators.

What proportion of them have working backup power is a figure I do not have. It is not in my source material, and its absence is itself the information: Sweden B enters the event with Styrel's priority classes sitting in a register [EL-19], out with every affected recipient at once and in the same form across the whole country — and without established knowledge of which of the prioritised facilities can actually receive the priority. A priority class is a claim about a plan, not a measurement of a facility. The class reaches everyone; the condition of the facility the class points at reaches no one.

There is an established example of precisely that fault, and it comes from the supervisory authority. The Swedish Post and Telecom Authority registered 334 incident cases during 2025, of which 327 were assessed as reportable and 28 as security incidents, five of them with an impact on societal functions. The authority notes that outages arose where a redundant cable either did not work, was missing, or was laid so close to the ordinary cable that both were damaged [EL-10].

The register said redundant. The reality was the same trench. It is the same fault the public shelter register makes, in a different industry, and it was discovered afterwards by a supervisory authority instead of in advance by whoever kept the record [EL-10]. Sweden A recorded routing as an actual condition of the facility instead of as a property of the plan. Sweden B entered the word redundancy once, at registration, and never read it again. The interface then spread that word faster and to more people than any earlier arrangement could have, in the same form to every recipient who needed to know something about the cable, and that is the very point: an incorrect record that travels on rails travels fast [EL-10].

The mechanism generalised: every property entered as a statement about a plan — redundancy, capacity, priority class, preparedness level — is a claim and not a measurement, and it ages without anyone noticing. Properties measured where they exist age too, but visibly.

What it cost Sweden A should be written out in four points. Sweden A added not a single megawatt within the threat window, and the strategic reserve was missing in both countries for a reason that lies in the EU's price rules and that no data effort touches [EL-4]. Sweden A's model of island operation could never be validated, because the system operator itself says that full-scale island operation cannot be exercised for real [EL-7] — which means that the order of priority rests on assumptions no exercise confirms, and that whoever acts on it with unbroken confidence is worse off than whoever knows he is guessing. The data collection moreover began as yet another reporting obligation, that is, the mechanism the Riksdag's own follow-up found to hold back capability development [SV-11], and was moved out to the facilities only after several years. In the scenario, parts of the register are out of date in the sixth year; what proportion is an assumption and not a figure I have.

A fifth price becomes visible only when the arrangement is to be executed. The order of priority is a ranking between operations that all have reason to come first, and that list becomes contested the moment it becomes real. Sweden A moved the task out to the facilities and learned which of them could receive the priority, but who ought to get it remained a political decision that no measurement settles. Better material made the choice sharper, not easier, and whoever had to wait was as short of power as before.

Ukraine settles the weight of the objection. The country's available generation was 38 GW before the war, of which 19 GW was lost during the first year of the war; capacity fell further to 12 GW after the attacks in the spring of 2024, after which 3 GW was restored by the winter of 2024/25 and 17.6 GW was expected to be available in October 2025 [UKR-8]. Between October 2025 and the beginning of April 2026 more than 9 GW was damaged, of which more than 4 GW was restored, against a severe winter need of around 18 GW; over 150 large autotransformers were ordered for around 1.5 billion dollars, and permit and procurement procedures took six to eight months [UKR-9]. The endurance lay in the repair cycle, in hands and cranes and transformers on order, not in prediction.

One feature of the Ukrainian conversion nevertheless points in Sweden A's direction: the stated resilience target is decentralised units of 5–100 MW, that is, many small islands instead of a few large ones [UKR-10]. Many small islands make the prioritisation question bigger, not smaller.

Sweden also delivers steel on time when steel is enough. The Aurora Line, 400 kV over 380 kilometres between Messaure and Pyhänselkä, was taken into operation on 12 November 2025 ahead of the original schedule, increases transfer by up to 800 MW towards Finland and 900 MW back, and received over 131 million euro in EU support [EL-9]. Gotland's robust supply arrives in 2030 with two 220 kV cables, and Svenska kraftnät writes itself that more serious disturbances and heightened alert require more robustness than that redundancy provides [EL-8]. Both countries have it. Neither has more.

What would falsify the chapter is named and checkable. If Svenska kraftnät in the coming years carries out a regional island operation or executes an order for manual load shedding — a measure never used before [EL-4] — and the prioritisation works from the existing class lists without anyone needing to know the facilities' actual condition, then the addition is superfluous and Sweden B is right. If the supervisory reports instead once again find redundant cables in the same trench [EL-10], the mechanism holds.

10. Food

Form of sovereignty: civic custody vis-à-vis the state. The custodian here is neither the state nor the citizen but the farm, the mill and the wholesaler, and that arrangement holds in both countries — neither nationalised the food chain. The failure mode is therefore shared, and its name is inaccessibility: the state sees only what it has asked for, and every gram of visibility is bought with a report written by someone who would rather have been out driving the combine harvester.

Sweden produces food for fourteen million people and still cannot say who gets it in a crisis [MAT-1].

The Swedish Food Agency and the Swedish Board of Agriculture put Swedish agriculture, aquaculture and fisheries at 3,530 kilocalories per person per day on average across 2013–2023, net of losses at every stage up to the consumer, which in a normal year is theoretically enough for around fourteen million people. Götaland accounted for around 78 per cent of the calories produced [MAT-1]. The research group behind the report Räcker maten? ("Is there enough food?") reaches the same conclusion by a different method: roughly 150–200 per cent of the population's calorie requirement and 200–250 per cent of its protein requirement [MAT-11].

The figure that governs the debate says something else, because it measures something else. The roughly 50 per cent is the share of the total retail value of food that is of Swedish origin, not a measure of productive capacity. The researchers behind the review write that the figure says nothing about how much food is produced in Sweden and can be used to feed the population during a crisis; when LRF, the federation of Swedish farmers, recalculated it in 2021 on energy content, the import share came out a few percentage points lower [MAT-12].

The calorie measure is not the answer either. The same research group writes out what decides the matter instead: infrastructure, energy supply, access to input goods, storage and logistics [MAT-11]. That is four questions of condition and one of flow, and none of them is answered by a measure of production.

The event. The attack in Part II never touched the food directly. It touched the input goods, and it did so slowly enough that no date could be pointed to.

The surface is set out in the state's own statistics. Sweden has no domestic production of mineral fertiliser at all. Of the nutrients in 2021, 87 per cent of the nitrogen, 46 per cent of the phosphorus and 24 per cent of the potassium came through foreign trade, and 1.2 million tonnes of fertiliser product were imported in 2024, with Germany and Finland accounting for 62 per cent of the volume [MAT-2]. Plant protection products are not manufactured in Sweden at all. Sugar beet seed is 97 per cent imported and oilseed 70 per cent, while cereal seed is 3 per cent imported [MAT-3]. Ninety-one per cent of motor fuels came through foreign trade in 2024 [MAT-4].

The mechanism behind the figures has been established in interviews with Swedish farmers. The low degree of self-sufficiency in agricultural inputs is a larger problem than the low degree of self-sufficiency in food. The farmers judge that production would fall by about half without diesel; in a first year of crisis it is possible to cut back on tillage and still get a tolerable harvest, while the following years yield very little once the soil's accumulated nutrients from earlier fertilising are spent [MAT-14]. Parliament's own follow-up identifies the same single point: the machinery runs almost exclusively on diesel, and without fuel production stops. It also notes that cereal self-sufficiency stood above 100 per cent in 2019, but at 80 per cent in the drought year of 2018 [MAT-13].

An attack on input goods therefore has a built-in delay. In the first year the statistics look almost normal. In the second year the bill arrives, and it arrives at once across the whole country.

Sweden B. Sweden B did the obvious thing and did it early: it built stockpiles, on the Finnish model.

Finland holds state security stockpiles of grain for human consumption equivalent to six months of normal consumption, extended during 2022 by a further 2.5 months, plus certified seed and protein crops; the protective stockpiling system covers 174 listed products under agreements between the state and companies [MAT-7][MAT-9]. The funding sits outside the annual budget fight: the security of supply fund has a balance of around 2 billion euros and revenue from a levy charged mainly on electricity consumption [MAT-10]. Switzerland sizes its compulsory stockpiles for three to four months of normal consumption at a total cost of around 13 Swiss francs per person per year, of which food makes up roughly 40 per cent of the stock value — around 5 francs, or about 60 kronor per person per year [MAT-7].

Sixty kronor per person per year [MAT-7]. That is the cheapest measure in this entire text, and it has been demonstrated historically. Sweden had it and sold it. The state food stockpiles were wound up entirely at the turn of the year 2001. They had been sized for four weeks of blockade plus five months of plant raw materials for industry, cost around 175 million kronor a year to run in the early 1990s, and the wind-up brought in around 1.1 billion [MAT-5]. When the inquiry looked in 2024, there was no preparedness stockpiling left at all [MAT-6].

In this chapter Sweden B wins the first months outright. A stockpile answers the question of how much without anyone needing to know anything about condition, and it answers even when the network is down and nothing has been possible to ask for six months.

The stockpiling decision is not taken alongside the rails either; it goes out and is carried out through them. The Finnish protective stockpiling system covers 174 listed products under agreements between the state and companies [MAT-7], and a list of agreements is a data item. It reaches every bound counterparty at the same time and in the same form, and a stock balance comes back the same way without anyone having to compile it. That is the fastest and most uniform part of this entire domain, and it belongs to Sweden B.

Two things limit the answer, and both are stated in Swedish government documents. The inquiry that proposed the stockpiles warns itself that stockholding can reduce the motivation to take alternative measures and thereby help to delay more long-term solutions [MAT-6]. The second limitation is physical, and it lies where the threat picture is clearest. The four northernmost counties have in practice no cultivation of grain for food purposes, no storage capacity intended for food grain and no mills at all; what is grown there goes exclusively to animal feed. The Swedish Board of Agriculture wants to prioritise these counties for preparedness stockpiling and notes that mobile mills must be secured. A market survey in December 2024 found that most of the interested companies could not manage to rotate such stocks, and that one was prepared to invest [MAT-8].

A stockpile of bread grain in Norrbotten is therefore not bread. It is sacks.

Distribution also has a legal machinery, and it has been in place since 1978. The Requisition Act (1978:262) applies in its central parts as soon as the realm goes to war, and the government may bring it into force before that in the event of danger of war or of extraordinary circumstances caused by war outside Sweden's borders. It allows the state to take real property into use by right of use and to requisition other property, to order a storage facility to keep property and to take means of transport into service, and the power of decision can be delegated to municipalities, regions and state agencies [MAT-21]. The Rationing Act (1978:268) regulates scarcity from above: the government may prescribe that a commodity may not be sold, transferred or acquired other than on conditions set by a public authority, with ration certificates, prohibitions on disposal and an over-consumption charge as its instruments [MAT-22]. Both acts are in force and both were last amended during 2024 [MAT-21][MAT-22].

An objection to the rest of this chapter lies in the same statutory text and should come first, not be hidden. Sections 31–34 of the Rationing Act give the state the right to demand information about holdings and trade [MAT-22]. The right to know therefore exists as well, and the claim that Sweden can distribute but does not know what exists is therefore not true as it stands.

The true version is narrower and sharper. The right to know is triggered by the same conditions as the right to distribute — war, danger of war, or scarcity and significant danger of scarcity [MAT-22]. The third limb requires no war, which makes the power wider than it looks. What it gives, however, is a snapshot requested during an ongoing crisis, by an apparatus that has to request it, from recipients who have to answer — and it presupposes that someone already knows who is to be asked. What is missing is not the power. It is the standing peacetime picture to start from, and the crisis-time boards and the distribution order that once carried out the rationing and were then wound up.

A requisition decision is moreover directed at a facility and presupposes that someone knows the facility works — the mill, the cold chain, the store that is approved for food and is not feed storage. The powers are extensive, though not unlimited: regulations under both acts are time-limited and requisition triggers an obligation to compensate. Knowledge of what can be distributed is what decides what the power is worth.

Sweden A. Sweden A built the same stockpiles. Nothing of the Finnish model was traded away, and it should be said plainly that the stockpiles were the heaviest and the cheapest of everything done in this domain.

The difference lies in which questions were asked after the stockpiling decision. During the two weeks on own resources that both size against [SV-6], the decisions in the food chain are few and known in advance. Where does the diesel that exists go first, which mills can be run on the electricity that remains, which storage is approved for food and is not feed storage, how many days of the harvest window remain in that particular county. The growing season has lengthened by almost 30 days on average since the early 1900s, and it ranges from close to eight months in south-western Skåne to around three months at the highest-lying mountain stations [MAT-17]. The window is long in the south and short in the north, and the decision about where the machines are to stand has to be taken while it is open.

Sweden A did not need to invent the model. CIBUSmod 25.09 is a published, open and spatially disaggregated biophysical model of the Swedish food system, with a baseline for 2016–2020 of 145,000 tonnes of mineral nitrogen [MAT-18]. What was missing was never the model. It was the current condition to feed into it.

What it cost. It went worse than those who built the system reckoned.

Sweden A did not manufacture a single gram of mineral fertiliser [MAT-2]. The chemistry does not change because someone knows where it is missing, and in the second year of a blockade on input goods it is the chemistry that decides.

The reporting burden struck here first. Parliament's follow-up of three preparedness sectors, food supply among them, records agencies describing very high pressure to report to several recipients at once and concludes that this hampers the development of capability [SV-11]. The burden does not contradict the rails. It explains them. Tonnage is a data item, and in both countries the question of tonnage got a complete answer within the day, in the same form across the whole country. The question that had no recipient was a different one: which mill actually started up that week, and which storage was approved for food and was not feed storage. It never became a data item, and so it was requested as prose. Sweden A's answer was to put the task on the facility instead of on the case officer, which worked for anyone who already had a system to ask. What share of farms never became machine-readable is an assumption in the scenario, not a measured figure.

The two measures usually offered as resilience did not deliver harvest. A Bayesian meta-analysis of 195 paired observations from 40 studies in ten temperate oceanic countries found increased soil carbon content from no-till cultivation, reduced tillage and leys in the crop rotation. The yield effect was not significant for any of the measures, and the authors write that the results do not support the claim that regenerative methods can raise soil carbon and yield at the same time in a temperate oceanic climate [MAT-16]. Agroforestry carries a measurable cost. A meta-analysis of 13 publications, 22 European sites and 267 observations found cereal yield in alley cropping at 96 per cent of the sole crop's at tree planting, falling 2.6 per cent a year over the stand's first 21 years, with 71 per cent as the average relative yield [MAT-15]. Sweden A bought shelter, carbon and lee-side growth. It did not buy yield, and a text that claims otherwise is sales material.

The last item is the chapter's cleanest example of this text's thesis. I have not been able to find any Swedish national survey data on the spread of precision agriculture, which is not the same thing as saying it does not exist. The figure in circulation — 81 per cent of the area in 2024, up from 78 per cent in 2023 — is Danish, not Swedish, and the Danish survey gives cost, lack of knowledge and technical difficulty as the obstacles, while itself calling for a comparable Swedish study [MAT-20]. A country that wants to know whether its farms can vary their input goods under scarcity thus quotes its neighbour's figure, and if its own figure exists it is not easy to find. That is not a gap in the dataset. It is a gap in the question.

That Sweden B is the actual Sweden shows in the strategy. Food Strategy 2.0, presented on 21 March 2025, sets out three focus areas and no quantified targets, and uses neither the word self-sufficiency nor the word preparedness [MAT-19].

The mechanism. A stockpile answers how much and holds that answer without power, without a network and without anyone writing anything. A register of condition answers what still works, and that is the question that arises when the stockpile is to be distributed, transported and milled. They solve different faults, at different stages. The stockpile carries the first months; condition decides the second year, when the nutrients in the soil are gone and every litre of diesel has to be weighed against another litre of diesel.

What would falsify this. If a real supply disruption before 2040 is solved by the existence of tonnage, without anyone needing to know which mills started up or which storage was approved for food, then the binding constraint was quantity and this chapter is wrong. If the Swedish Board of Agriculture's mobile mills and prioritised northern stockpiles come into place through contracts, so that northern Sweden can bake its own bread without any new information being collected, then procurement was enough where I have proposed measurement [MAT-8]. If a Swedish survey of precision agriculture — one that already exists or one that is carried out — shows uptake on a par with the Danish figure, then the gap was a search error and not a capability shortfall [MAT-20].

11. Care and the body

The form of sovereignty in this chapter: civic custody vis-à-vis the state, with a state backbone underneath. Both are needed, and they solve different problems.

Sweden exercised this and got the answer in writing.

In September 2024 Casualty Move 24 was held, Sweden's first host nation exercise after joining NATO. More than 150 participants from 16 countries, a scenario in which patients are evacuated from northern Finland and the Baltic states through Sweden as a transit country, with two hubs and coordination through a multinational medical coordination centre. The exercise found two things. Military and civilian health care use different terms for injuries, and the different medical record systems are reported not to match one another. [VARD-5][VARD-6]

NATO's own doctrine had said so in advance. AJP-4.10 paragraph 2.23 establishes that medical documentation in a multinational environment requires common standards for language, key information and format in order to be interoperable across the whole area of operations and in all national contingents [VARD-2]. Paragraph 2.24 adds that national legal requirements for the protection and sharing of medical information differ. The time frame all of this has to fit inside is 10-1-2: life-saving intervention within ten minutes, advanced resuscitation within one hour, surgery that preserves life, limb and function within two at the latest [VARD-1].

The volume has been set out by the Defence Commission: 20,000–30,000 dead and wounded civilians and soldiers if fighting were conducted on Swedish territory over a few weeks [VARD-10]. The National Board of Health and Welfare's design injury profile for adults gives 26 per cent head and neck, 18 per cent thorax, 50 per cent extremities, around 5 per cent burns and around 60 per cent acute psychological reactions. Twenty-three per cent of the injured are children under 18 [VARD-9].

Set five per cent burns against the capacity. Sweden has two burns centres, in Uppsala and Linköping, and each can handle eight severely burned patients in a mass casualty event [VARD-14]. Sixteen places. The national alert plan alerts directly between region and centre at one to two patients and triggers national coordination at three or more [VARD-15].

This is not an information problem. Sixteen places do not become more because someone knows there are sixteen. The chapter would end here were it not for the next fact.

The input goods. The same work that gives the sixteen places also counts what the places consume. Eight moderately to severely burned patients require, over the first two weeks, 17,000 examination gloves, 597 litres of Ringer's acetate and 5,546 intensive care hours — mapped day by day and hour by hour from medical records and simulation systems [VARD-14].

The third item decides, and it must be read carefully. Spread over eight patients and fourteen days, 5,546 hours works out at 49.5 care hours per patient per day [EGEN-2]. That is an average and describes no single day. Consumption over the course of a burn injury is not even, and anyone who sizes against an average sizes against a day that never occurs. The figure is good for one thing only: showing the order of magnitude, which is that a single burns patient consumes more care time per day than a day contains hours. How that time is distributed between people and across the phases of the course of treatment, the average says nothing about, and anyone who reads a staffing rota out of it repeats the error once more.

The difference between the three items is the whole point. Ringer's acetate can be stored and can be driven here. So can gloves. Consumption is determined by dressing changes and catheters, that is by the patient and not by the size of the staff — fewer hands do not give proportionally fewer gloves, but dressing changes that do not happen. Care hours can neither be stored nor ordered at six months' notice like a transformer [UKR-9]. They exist only as people who are already on duty somewhere else, with a competence that takes years to build and cannot be improvised within fourteen days.

It is the same analysis chapter 10 makes about agricultural input goods, and it lands on a different answer. There the chemistry bound, and knowing where the mineral fertiliser was missing changed nothing [MAT-2]. Here competence binds — and competence is the only one of the three that can actually be moved to where it is needed. The move does require that someone knows where it is and what it can do, which is a question of condition and not of numbers. A country that knows it has sixteen burns places does not thereby know who could staff a seventeenth.

The blood. Sweden has 26 blood establishments spread across six health care regions. Approved donors exist only in local registers at each blood establishment. There is no national register, and the regions cannot see one another's. A donor can therefore as a rule not give blood in another region without being assessed as new [VARD-16]. The system for guest donation covers around half of the country's regions. Hospital stocks correspond to one to three weeks of normal consumption, and of 26 blood establishments 17 take part in disaster exercises. Sweden has no national crisis plan for blood supply [VARD-18].

There are 195,081 active donors. The National Board of Health and Welfare judges that the number needs roughly to double, to around 400,000. Sixty-four per cent of the population say they are willing to give blood. Three per cent do [VARD-17].

Read the two paragraphs together. Sweden knows who may give blood. The knowledge sits in 26 separate registers that cannot see one another, and the consequence is that a Gothenburger in Umeå counts as unknown. During two weeks on own resources, with patient flows arriving from Finland and the Baltic states, that is not an administrative inconvenience. It is an asset that exists being out of reach.

Note what this piece of evidence does to my own thesis. It is a federation failure, not a centralisation failure. The simplest solution is a national donor register — more centre, not less. Anyone arguing for distributed custody has to be able to answer why this particular problem is not solved with a register, and the answer is not that registers are wrong. The answer is that a register solves the question of access and leaves the question of condition unsolved: a national donor register says who may give, not who can get to a blood bus when the underground has stopped.

The medical record. Here lies the most widespread misconception about Swedish preparedness. 1177 Journalen is often described as the citizen's own medical record. Inera, which operates the service, is clear that it is not: it holds no central copy but is a window into the care providers' own systems and reads data directly out of them. Each care provider decides for itself what is shown and when. If the care provider's system is down, encrypted by ransomware or physically destroyed, the citizen sees nothing [VARD-24].

That is the crux. Sweden has built visibility without building possession.

Ukraine tried both. In 2022 the country's national e-health system had thirty-six million registered patients and more than 1.6 billion record entries. During the full-scale war the central database held — while the supplier layer beneath it collapsed: of forty medical record systems before the war, four to six are expected to survive [VARD-20]. The WHO has verified more than 3,000 attacks on health care in Ukraine [VARD-21].

That result speaks against a pure federation thesis and should be stated as such. A hardened national backbone survived. The distributed layer did not. Anyone arguing about architecture has to take that seriously.

The conclusion that holds is therefore not either–or. It is that the three layers solve different faults: the national backbone makes data accessible when a care provider falls, the citizen-carried node makes it accessible when the network falls, and paper makes it accessible when everything falls. Sweden has built the first halfway, the second not at all, and dismantled the third.

The citizen-carried node is the part I work on myself. Life Atlas is building one: an encrypted baseline that the person carries — resting values, medication, blood values, what is normal for that particular body — readable without a network. It is meant to stand beside components that are not mine, because on its own it solves nothing.

It does not belong on the list of what can be derived from the question of which decisions have to be taken. The function — a baseline readable without a network — is derivable. The form of custody is not. Chapter 2 therefore declares it part of the second division: a choice about where custody lies vis-à-vis the state, a choice about rights with a bill of its own, not a consequence of the follow-on question.

It has three weaknesses that are unresolved, not merely unaddressed.

The unconscious patient. Trauma care works in minutes. A key that only the patient holds is unavailable in precisely those cases where the medical record changes the outcome. Every serious system therefore needs a central emergency override — at which point there is a central register again, with extra steps.

Those excluded are the sick. Those with the most clinically valuable history are the ones least able to manage it. Age, cognitive decline, disability.

Custody is a surface for coercion. A hardened central register with mandatory access logging cannot be deceived person by person. The phones in citizens' pockets can. A grey zone campaign that already recruits disposable agents online has a new surface to work against.

None of the three is solved today. To write otherwise would be to do the very thing Part I promised not to do.

What then separates Sweden A from Sweden B in this chapter? Not the number of intensive care beds, not the sixteen burns places, not the 20,000–30,000 casualties. The difference is what happens in hour six.

In Sweden B the question reaches every blood establishment and every doctor within the hour, in the same form across the whole country, and back come twenty-six answers that cannot be added together. Approved donors exist only in local registers at each blood establishment, there is no national register, and the regions cannot see one another's [VARD-16]. A fast interface over twenty-six unconnected registers gives twenty-six fast answers.

In Sweden A the question goes out on the same rails and just as fast. Twenty-six answers come back there too. What comes in addition to them is which medical record systems are up and which patients carry their own baseline in through the door. How large that share turns out to be is an assumption in the scenario and not a figure I have.

The difference is therefore the content of an answer that came equally fast in both countries.

That is a margin. Under 10-1-2, margins are all there is.

12. The map

Form of sovereignty: state custody over the state's own data. Here the centre is the right answer, and the only question is what the centre contains.

Sweden already has a national roadmap for digital twins, and its end goal falls in the year this text is about.

The national coordination hub for digital twins, funded by Formas, has published a vision with milestones in 2030, 2035, 2040 and 2045: the foundation of Sweden's twin infrastructure laid by 2030, full-scale implementation in many municipalities by 2035, complete technical and organisational realisation by 2040, and a national ecosystem by 2045 [TVILL-16].

The question in this text is therefore not whether Sweden ought to do this. Sweden has decided to do this. The question is whether the plan holds, and there are strong reasons to think it does not.

In RiR 2025:8, published on 29 April 2025, the Swedish National Audit Office examined 1,094 strategic digitalisation projects at 136 agencies over 2013–2024, with a combined budget of around 40 billion kronor. Around half were marked by large delays and cost overruns. Thirty-one projects were shut down without delivering results, at a cost of 1.6 billion. At least 120 of 722 completed projects did not fulfil their purpose [TVILL-13].

It is Sweden's own audit office saying that the Swedish state cannot manage projects of this class. A text that proposes a national twin programme without answering RiR 2025:8 is not an analysis.

Internationally the outcome is no better. The United Kingdom's National Digital Twin Programme started in 2018 under the Treasury, was run by the Centre for Digital Built Britain, and CDBB "completed its five-year mission and closed its doors" in September 2022 — with the Gemini Principles and an information management framework as its delivery, not with a national twin [TVILL-5]. The programme has since changed home twice. Virtual Singapore was announced on 16 June 2015 with completion "expected by 2018" and is reported complete only around 2022 — four years of slippage in the best-funded, least federated, single-jurisdiction effort yet made [TVILL-9]. Gaia-X, Europe's federated data infrastructure, is called "too ambitious" by its own former chief executive and a "paper monster" by Nextcloud's founder; Scaleway left in 2021 citing bureaucracy [TVILL-12].

Destination Earth is the exception that shows the condition. More than 300 million euros, its third phase confirmed on 1 February 2026 for June 2026 to June 2028, run by ECMWF, ESA and EUMETSAT on EuroHPC. It works because it has a narrow, physically bounded mission — climate and extreme weather — and does not try to represent a society [TVILL-7][TVILL-8].

That points to what Sweden A actually did, and it is much less than "a twin of Sweden".

Stefano Moroni argues in Computational Urban Science 2025 that the limits of city-scale twins are structural and do not stem from a lack of data: complex urban systems are "unpredictable in detail, not because we lack certain data, but because of their intrinsic nature", and dispersed knowledge "cannot be collected and re-unified because, as a coherent and integrated whole, it does not and cannot exist". [TVILL-17] He is right, and the objection strikes every ambition to model a society.

It does not, however, strike the narrower task: knowing what condition the physical things are in. A public shelter is not a complex urban system. It is a room with a door, a filter and a date of last inspection.

That is where Sweden B's real shortcoming lies, and it is stated in the state's own documents. The shelter register covers all of the roughly 64,000 objects and Sweden publishes a national public shelter map. The register reports nominal capacity, not functional condition. Sweden knows where the public shelters are. Sweden does not know which of them work. The Swedish Civil Contingencies Agency (MSB) had two inspectors during 2024 and assessed the need at around forty [SKYDD-1][SKYDD-8].

Sweden has answered precisely this, and the answer must be included. Parliament adopted a new act on public shelters and protected spaces on 29 April 2026, in force on 1 June, and the inquiry behind it costed the reform at 745–778 million kronor a year, around 3.8 billion over five years [SKYDD-1][SKYDD-3]. Among other things, the act places a duty on municipalities to supply information about spaces.

Two months before this text, then. No one can say what it has achieved, and no honest text claims otherwise.

What can be said is what kind of answer it is. A duty to supply information is a duty to report. The duty goes out to all 290 municipalities in the country at once, in the same form, and it comes back complete [SKYDD-3][EL-15]. The fault is not in the transport. It is in the cycle and in the content: what comes back describes a condition that was true on the day someone wrote about it, and the next time it becomes true is the next time someone writes. Reporting is precisely the mechanism that parliament's own follow-up found hampers the development of capability when the pressure gets high enough [SV-11] — not because it is slow to send, but because it is expensive to produce. Sweden A made the same demand for information and placed it on the facility instead of on the report: an inspection that is carried out anyway records the condition where it is carried out, and the question can then be asked without anyone writing anything at all.

The difference sounds small. It decides whether the information still exists in the sixth year of a threat, when no one has the energy to fill in forms any more.

That is the whole thesis in a single register. The data exists. It describes the wrong thing.

The cost picture in government bill 2024/25:34 says what Sweden chose. Within the annual addition to civil defence of 8,500 million kronor up to 2030, the preparedness area Supply of base data receives 50 million kronor a year, and Knowledge and research 30 million. Electronic communications and post receive 1,633 million, energy supply 1,048 [SV-2].

Sweden has therefore already looked at exactly the category this text is about, given it a name in legislation, and allocated it six per mille of the civil defence addition.

Sweden A did not change that figure very much. It changed what the fifty million measured: functional condition instead of nominal capacity, and a duty to answer machine-readably instead of in report form. The difference does not show in 2030. It shows in the sixth year of a threat, when the question "what works" is asked for the thousandth time and no one has the energy to write yet another report about it.

Sweden A bore two costs for that, and got neither of them back.

The targeting material. NIST IR 8356, published on 14 February 2025, treats twin technology as a source of both traditional and novel cybersecurity problems [TVILL-18]. That report names the class. It does not remove it, and this particular risk cannot be mitigated away, because it arises at the same moment the information becomes useful.

The shelter register is open. The calculation of public shelter coverage in Karlstad in this text was made against the agency's own map service and Statistics Sweden's population grid squares, retrieved on 9 August 2026, and required no authorisation: 761 public shelters with location and place counts came out in an afternoon [EGEN-1]. A field for functional condition in that register is the same information with one addition, and the addition is which of the doors do not close. Gotland shows what that addition would contain. All 349 public shelters on the island were inspected, and not a single one passed without an injunction [SKYDD-18].

Sweden A limited the damage where damage can be limited: no node holds more than its own domain, and no question is answered without the answer being logged. A log is a note that someone read, not an obstacle to reading, and a domain boundary reduces what a single intrusion yields without reducing what the information is worth to whoever collects it over time. The cost was therefore concrete. The condition field was not placed in the open layer. The citizen who wanted to know whether her own public shelter worked got the answer on a dated card at the door instead of on the map — on site, not from home. The openness that motivated the whole change was withdrawn on exactly the field that was the reason for making it, and it did not come back.

The field. The second cost is that a change in a register moves at the register's own pace, and that pace is set by how many people are standing in rooms.

A field for nominal capacity is filled in for all of the roughly 64,000 objects [SKYDD-1]. A field for functional condition is empty until someone has been there. In February 2024 the agency had two shelter inspectors and assessed the need at around forty, and the 100 million kronor allocated stood against a refurbishment assessed at around 4 billion [SKYDD-8]. For 2025, 2,000 new inspections and 10,000 supervisions were planned [SKYDD-7]. Fifty million a year for the supply of base data [SV-2] moves none of those figures.

The consequence is uncomfortable, and it is the whole price. During the first years after the change, Sweden A's register answers do not know about the great majority of public shelters, while Sweden B's register answers with a number for every one of them. The worse answer looks better. How many years it takes before that relationship reverses is an assumption in the scenario and not a figure I have.

What the change of field costs in kronor I do not know. None of the sources prices a change to the shelter register, and I therefore do not write out any figure for it.

Anyone objecting that this is a small change after all, and that small changes go quickly, has no support in RiR 2025:8. The audit reports its outcome for the whole population of 1,094 projects at 136 agencies: around half with large delays and cost overruns, at least 120 of 722 completed projects failing to fulfil their purpose [TVILL-13]. No breakdown of the outcome by project size appears in the audit. There is therefore no evidence that the small project escapes the large project's outcome, and in the scenario Sweden A is behind its own plan for the same reasons all the others were behind theirs.

One objection remains that is not a cost but an argument about architecture, and it should stand on its own.

Sweden's most damaging infrastructure incident in recent years was not physical. It was a ransomware attack on a single HR supplier, Miljödata, discovered on 24 August 2025, which reached around 200 of Sweden's 290 municipalities. Roughly seven in ten municipalities, through one supplier [EL-15].

The vulnerability was concentration. That is the reason Sweden A's architecture is federated rather than pooled — not for ideological reasons, but because 24 August 2025 showed what a shared dependency costs. The objection therefore strengthens the architecture. It does not pay either of the two bills above.

13. The lock

Form of sovereignty: citizen custody vis-à-vis the state. The reason here is not privacy but structural strength — a way in that the state can always take stands open also when someone else takes it. Positioning and time are the opposite case, state custody over the state's own infrastructure, and that is written out below where it applies.

Sweden's own cryptography authority wrote the objection down in advance. It has a date, a reference number and a sender, and it went unanswered.

On 17 January 2025 the Swedish Armed Forces submitted its consultation response on the draft referral to the Council on Legislation concerning data retention to the Ministry of Justice, reference FM2024-28855:2. The agency states that it responds "utifrån sin sakkunskap genom uppdraget att leda och samordna signalskyddstjänsten" [on the basis of its expertise, through its mandate to lead and coordinate the signals protection service], and then writes: "Försvarsmakten bedömer att kravet på anpassningsskyldighet av nummeroberoende interpersonella kommunikationstjänster inte kommer att kunna uppfyllas utan att införa sårbarheter och bakdörrar som kan komma att nyttjas av tredje part." [The Swedish Armed Forces assesses that the requirement for an adaptation obligation on number-independent interpersonal communications services cannot be met without introducing vulnerabilities and backdoors that may come to be exploited by third parties.] [ATK-25]

The next sentence decides how the response is to be read. "Försvarsmakten har inga synpunkter på utkastet till lagrådsremiss i övrigt." [The Swedish Armed Forces has no other comments on the draft referral to the Council on Legislation.] [ATK-25] The agency thus had no other objection to the whole bill. The backdoor was the only thing it commented on, and the agency's crypto strategist took part in the drafting.

The act entered into force on 1 March 2026. Number-independent interpersonal communications services are brought under the retention and adaptation obligations, and the Swedish Security Service may decide on more extensive retention in the event of a serious threat to national security [ATK-24]. Around the Swedish act sits a European architecture pulling in the same direction: ProtectEU, presented on 1 April 2025, tasks the Commission with producing a technology roadmap on encryption that is to identify solutions making encrypted data lawfully accessible to law enforcement, with the expert group's delivery during 2026 [ATK-29]. The High-Level Group on access to data delivered 42 recommendations to the Council on 13 June 2024, where recommendations 22–24 push the lawful access by design line [ATK-27].

There is a record of what happens to such mechanisms, and it is over twenty years old. [ATK-31]

In Greece around a hundred telephones were tapped from August 2004, among them the prime minister's, his wife's and those of the defence and foreign ministers. The attackers had not broken any encryption. They had subverted the interception mechanism itself — the subsystem for remote-controlled interception in the operator's exchanges — by patching 29 separate blocks of code. The matter was discovered on 24 January 2005 through undelivered SMS traffic, the operator was fined 76 million euros in December 2006, and the perpetrators were never identified [ATK-31]. Nothing was broken. The system worked as designed, and someone else supplied the authorisation.

The same thing was repeated in the country that legislated for interception capability first. The American CALEA of 1994 requires operators' networks to be interceptable; Chinese state-sponsored attackers compromised interception systems at AT&T, Lumen and Verizon [ATK-32]. The scale is reported as nine American operators as of 27 December 2024, over 100,000 hijacked routers in a single operator network and metadata on over a million users, with a dwell time of over a year — and with access to the "almost complete list of phone numbers under court-authorized wiretapping", that is, the map of whom the state itself was surveilling [ATK-33]. Matt Blaze sums up the outcome: "CALEA should be regarded as a cautionary tale, not a success story, for backdoors." [ATK-32]

One thing should not be written the way it often is. The joint agency advisory on the campaign, AA25-239A of 27 August 2025, I have not been able to read in the original — the agency's website denied access — and according to the summary that could be reached, the advisory does not mention interception systems at all. The link to the interception infrastructure comes from press reporting in October 2024, not from the agency advisory, and it should not be attributed to the agencies [ATK-34].

The other half of the lock is time. Sweden's national cybersecurity centre states that the transition to quantum-safe cryptography is to be complete by the end of 2035, but by the end of 2030 "in situations where encryption is essential in order not to disclose information for ten years or more" [KVANT-9]. The 2026 recommendations carry the assessment that within ten to twenty years quantum computers will have the capacity to break parts of the cryptography that is in general use today [KVANT-8]. The state has thus itself written down the premise for collect now and decrypt later: material collected during the 2020s is measured against a ten-year secrecy requirement, and the retention obligation extends the lifetime of precisely that material.

The two threats do not meet, and to write that they do would be convenient and wrong.

A mandated access path attacks a function in a service. It requires legislation, it requires the provider to cooperate, and it sits where data is already readable — which is the whole reason quantum-safe algorithms do not protect against it. Harvest now, decrypt later attacks something else: the key exchange in a recorded stream. It requires no law, no provider and no consent, and it works the same way against a service that was never covered by any adaptation obligation. Anyone with storage space and patience can do it.

What actually unites them is narrower than a shared threat model, and it is enough: both move the reading away from the decision in time. What is protected today is read by someone else later, and whoever decides on the protection today never gets to know by whom.

Three quantities are to be kept apart in the rest of this chapter. The adaptation obligation determines how much there is to take. The migration rate determines how much remains readable for whoever waits. The retention obligation determines how long what is already readable remains. Sweden decided on all three in the same year, in different ministries, without anyone having to see them together.

Sweden B ran the migration better than Sweden A, and the reason is structural. A cryptographic migration is fundamentally an inventory problem, but not over keys. The question is where which algorithm and which protocol version are actually used — in libraries, in certificate chains, in firmware, in the interfaces towards every counterparty. A key pair can be replaced. An algorithm built into a plant delivered in 2019 cannot, and it is not visible until someone looks for it. A hardened centre with an authoritative register per domain knows this, and Sweden B therefore got the core of the state migrated to its own timetable. The order of magnitude of the remaining task is visible in measurement data: in February 2026 over 60 per cent of human-generated TLS traffic to one large edge network used quantum-safe key exchange, while only around 10 per cent of origin servers could benefit from it [KVANT-17]. The market migrated the browser leg. The state's task is the other leg, and Sweden B was better equipped for that task than Sweden A.

Sweden B, by contrast, kept the adaptation obligation as a general mechanism in every service, and with it a surface for pressure that works the same way whoever is pressing. In the scenario it is that path which is used during phase two: not a cryptographic breakthrough, but a supply chain into the function the law required to exist. What share of the traffic was exposed is an assumption in the scenario, not an established figure.

One thing is to be declared before the three are listed, in the same words chapter 2 uses. The first of them does not follow from the consequent question of which decisions must be taken over two weeks on one's own resources [SV-6]. It is the second division — a choice about where custody lies vis-à-vis the state, not an answer to a preparedness question — and it should stand under its own name, its own date and its own bill. The act on retention and adaptation obligations entered into force on 1 March 2026 and applied in both countries before the sequence begins [ATK-24]. Sweden A therefore did not refrain from introducing something. The country repealed something that already existed, and an act of repeal requires a majority prepared to carry the bill for it.

Sweden A did three things differently, and two of them cost immediately.

The first: Sweden A did not build a general access path where a targeted one was enough, and treated the Armed Forces' response as a technical input rather than as one consultation response among others. The price stands in the opposing side's strongest document, and it should stand with figures. The European police chiefs' joint declaration of 21 April 2024, with 32 signatories, states that 92 per cent of Facebook's and 85 per cent of Instagram's reports to British police would disappear on a planned rollout of end-to-end encryption, and that the current flow protects around 1,200 children per month and yields around 800 arrests per month [ATK-42]. The figures are British and forward-looking: a forecast of what would be lost in the United Kingdom, not a measurement of what a Swedish choice cost. What Sweden A's abstention cost in Swedish children I have no figure for, and anyone who gives one has invented it.

The second: Sweden A discovered that its own architecture migrated more slowly. One key pair per citizen is as many inventory items as there are citizens, and no agency owns the list; a citizen-carried node without a central list cannot be re-keyed by a decision. Sweden A lagged Sweden B in that leg throughout the period. It is the same weakness chapter 11 reported, set against a different task. It is also the second division's second bill: the citizen-carried node is, like the forgoing of a general access path, a choice about where custody lies vis-à-vis the state and not a consequence of the consequent question. Chapter 2 declares it as such, and chapter 11 and chapter 19 point to the same declaration.

The third is uncomfortable for every sovereignty argument, including this one. Sweden's own guidance permits only standardised algorithms in large-scale international use and names FIPS 203, 204 and 205 [KVANT-9], published by an American standards body on 13 August 2024; the fourth signature standard is, in August 2026, still not published [KVANT-1]. The same guidance moreover recommends that most organisations follow the plan rather than make their own analyses of quantum computing developments [KVANT-8]. Sweden A followed both pieces of advice. Cryptographic sovereignty was not on the table for either country.

Positioning is the second lock, and there state custody applies. Reported disruptions of satellite navigation in Swedish airspace rose from 55 during 2023 to 733 so far during 2025, counted to 4 September that year [BALT-15], and the European aviation safety agency names the Swedish flight information region among the areas where disruptions have increased since February 2022 [EL-18]. There is already a fielded countermeasure against one of the two forms of disruption, and it should be mentioned before anything speculative. Galileo's authentication of the navigation message, OSNMA, was declared operational during 2025 and gives protection against spoofing, that is, against false signals purporting to be genuine [KVANT-20]. Against jamming it gives no protection: an authenticated signal drowned in noise is still drowned. The division is the whole point — cryptography decides whether the signal is true, never whether it gets through. The temptation is to solve the remainder with quantum sensors. That level of maturity is written out: a field validation in June 2026 of a portable quantum magnetometer for positioning without satellite signal reached 2.24 metres of radial error over a walking distance of just over 500 metres in roughly 360 seconds [KVANT-16]. Analysts at CSIS describe quantum sensors as "fragile but advancing quickly", with drift without constant recalibration, magnetometers that give false tracks near power systems and gravimeters that lose stability in turbulence [KVANT-15]. Half a kilometre and six minutes is not Gotland in February.

Quantum key distribution does not solve it either. The British NCSC writes that the agency will not endorse the use of the technology for government or military applications, and that it does not provide authentication [KVANT-4]; the EU's coordinated roadmap for the migration does not mention it once [KVANT-2], nor is it mentioned anywhere in the sixteen-page Swedish guidance [KVANT-8] — while Sweden funds national quantum communication infrastructure with 30 million kronor in a project running to October 2026 [KVANT-14]. NATO commits in its quantum strategy to supporting both quantum-safe cryptography and quantum key distribution, without setting any end dates [KVANT-18]. The question is contested on the merits: Renner and Wolf answer the agencies' objections and hold that some of them are unfounded and others solvable within the foreseeable future [KVANT-19].

Sweden A's answer on positioning was therefore not quantum navigation. It was the same question the rest of this text asks: which facilities depend on satellite signal for time, which have their own holdover, and how long it lasts. The fallback path without power and network exists in that part — local clocks with a known drift margin. It does not exist for the cryptographic keys. A key rotation that presupposes a network has no manual equivalent in either of the two countries, and that is an unresolved gap, not an unaddressed one.

The mechanism generalised: every mandated access path is an asset with two owners, the one who orders it and the one who eventually takes it, and the timescales decide who gets there first. A mechanism lives for decades, an intrusion can run for over a year without being discovered [ATK-33], and the secrecy requirement is measured by the state itself in ten years [KVANT-9]. A decision on access in 2026 is therefore a decision about 2036, whether or not anyone says so.

What would falsify this. If the Commission's technology roadmap [ATK-29] delivers, during the 2030s, an access mechanism that survives independent adversarial review, the chapter's main argument falls — and there is a measurement to test it against, since the assessor in the British Safety Tech Challenge found that none of the prototypes met the evaluation framework [ATK-30]. If no cryptographically relevant quantum computer appears, the harvesting argument shrinks to a question of metadata; the expert basis is thin and uncertain, with a 28–49 per cent probability within ten years and 51–70 within fifteen, based on 26 respondents [KVANT-10]. If Europe passes a decade with mandated access in every service without a single documented takeover of the mechanism, the generalisation from Athens and from the American operators is too strong.

Part IV — The federation

14. None of them can do it alone

Form of sovereignty: state custody over the state's own data, in five copies. Across a Nordic border what is shared is the answer to a question, never the register the answer is drawn from — five states have never managed to own anything jointly for very long [NORD-15].

The Nordic region has signed almost everything except what binds, and that is not carelessness. It is the only form of cooperation five states with five defence decisions and five budget processes have been able to get through their parliaments [NORD-5].

The document layer is dense. NORDEFCO rests on a memorandum of understanding signed by all five countries on 4 November 2009, and its machinery consists of a policy steering committee and a military coordination committee whose work runs in three tracks — not of a headquarters [NORD-5]. Vision 2030 was signed in Tórshavn on 30 April 2024 and covers eight areas, from host nation support to military mobility and total defence [NORD-2]. The chiefs of defence of Denmark, Finland, Iceland, Norway and Sweden signed the Nordic defence concept on 20 September 2024, which sets out overarching principles for being able to act together in peace, crisis and armed conflict [NORD-4]. The defence ministers signed a revised memorandum of understanding on 6 May 2025 in Rovaniemi, the first revision since Finland and Sweden joined NATO [NORD-6]. On the civil side, the Haga III declaration from Oslo of 27–28 November 2024 commits five ministries to expanded and coordinated Nordic crisis preparedness cooperation with a whole-of-society approach [NORD-8].

Then comes the tempo. The directors-general of the corresponding Nordic agencies within the Haga cooperation meet at least once a year, with a rotating chair [NORD-9]. That is the speed at which Nordic civil preparedness can be steered jointly. A year is a reasonable cycle for harmonising regulatory frameworks. It is not a cycle that can answer a question during an ongoing sequence.

Air defence shows the same pattern in sharper form. The air force chiefs of Denmark, Finland, Norway and Sweden signed a memorandum of understanding at Ramstein on 16 March 2023 on linking their air forces into a combined force of around 250 modern combat aircraft, with an integrated command structure as the goal [NORD-10]. The figure is the most quoted in the Nordic deterrence story. It is also a summation of four national fleets, not a standing joint force. When the Nordic air force chiefs met on Bornholm on 15 May 2025 the structure was still four operational lines of effort — joint command and planning, flexible basing, expanded air picture cooperation and joint exercise activity [NORD-11]. A framework with exercises and a shared radar picture, not a command with delegated decision authority.

The record is harder than that. Nordic joint procurement has collapsed repeatedly over two decades: the Nordic standard helicopter project of 1998–2001 fell when the participants chose different models, Norway and then Denmark left the Viking submarine project, the Swedish-Finnish AMOS mortar system failed, and in December 2013 Norway left both the artillery project and the joint truck procurement within the space of a few days. Finland in 1992, Norway in 2008 and Denmark in 2016 all chose against Swedish combat aircraft [NORD-15]. Every time the cooperation reached the point where it became industrially binding, it broke.

The command boundary came last. On 5 December 2025 Finland, Sweden and Denmark were transferred from Joint Force Command Brunssum to Joint Force Command Norfolk, whose area of responsibility thereby covered Denmark, Finland, Iceland, Norway, Sweden and the United Kingdom in addition to the Atlantic [NORD-12]. The Baltic states remained under Brunssum. Karsten Friis warns that a de facto boundary within NATO may arise in the Baltic Sea between Norfolk and Brunssum, and lists four further risks: national rather than integrated procurement, a Nordic beauty contest for American attention, overload from parallel integration processes, and diverging deterrence doctrines [NORD-16].

The event. In the scenario there occurs what the seam is made not to handle: a sequence lying on both sides of it at once. A power interconnector and cable break in the eastern part of the Baltic Sea [BALT-4], drone activity against airports in two Nordic countries within the same twenty-four hours [BALT-11] [BALT-16], and a shadow fleet vessel that passes out of one area of responsibility into another while the decision on boarding is being prepared [BALT-12] [BALT-18]. The sequence is an assumption in the scenario. The components are not — they have all occurred between 2022 and 2026 [BALT-4], and they are treated in Part II. The drone sequence in September 2025 rests there on compiled news reporting and agency communications, not on a consolidated official account [BALT-11]. The question asked in the first hours is the same in both countries. What can each of us do now, and with what.

Sweden B answers well, and that is not a courtesy. The only quantified success in this domain comes from presence, not from sensors. NATO launched Baltic Sentry on 14 January 2025 with frigates, maritime patrol aircraft and a small fleet of naval drones integrated with national surveillance assets [BALT-6]. Between January 2025 and January 2026 the response time to suspected incidents was cut from 17 hours to one hour, with a marked reduction in sabotage against undersea infrastructure, and twelve boardings were carried out under national authority [BALT-7]. Sweden B contributes hulls, flying hours and crews, and that is exactly the right contribution. No data model would have cut that response time.

Sweden B's limit lies in what the country can tell its neighbours, not in how fast it can tell them. The figure goes out on the rails: the same figure the same day, in the same form to every recipient, without anyone compiling it on the way. What the country can state is what it owns — number of units, number of sites, number of tonnes. The neighbour has to take that figure on trust, because it describes nominal capacity and not condition [SKYDD-1], and because it therefore cannot be checked from outside: a figure for what has been built says nothing about what works in the week the question is asked. The deficiency lies in the content, not in the transport. It is the same deficiency the chapter on the public shelter register found, now moved across a national border, where it is harder to correct.

A caveat has to come in here, and it is the chapter's most important. The claim that only numbers cross a border is false if it is said of military units. NATO has an arrangement for reporting condition across a border against a common criterion, it is called the NATO Defence Planning Process, and it has five steps carried out over four years. In step two the requirements are established in a consolidated list, in step three they are allocated as Capability Target packages to the member countries, and in step five the outcome is reviewed. The nations complete a Defence Planning Capability Survey every two years, which collects national plans and measures against NATO's Capability Targets, military capability and where applicable civil capacity, together with defence investments. The review is multilateral and is conducted in the Defence Policy and Planning Committee, and agreements are reached by consensus minus one — a country cannot veto decisions on its own targets. The result is a Capability Report approved by the North Atlantic Council and endorsed by the defence ministers [NORD-20].

Two things are to be kept apart here, since they measure different quantities. The survey in the planning process collects plans, measures and investments against set targets [NORD-20] — that is, intent and holdings, not condition. What measures condition is the evaluation programme, and it runs on the unit's own rhythm and not inside the four-year cycle [NORD-21]. To merge them into one machine would be the same error the chapter accuses the register of.

The condition part moreover applies to Sweden, and it applied long before NATO accession. The defence research institute wrote in 2013 that Swedish units are evaluated under NATO's programme for evaluation and feedback of operational capability, and gave three reasons: to be able to take part in NATO exercises, to stand in international readiness, and "to give support to, and receive support from, other nations" [NORD-21]. The third reason is precisely the cross-border function this chapter claimed was missing. The report also reproduces individual evaluation questions with their paragraph numbers — whether the unit can issue orders through a reliable and interoperable command and control system, whether the staff uses the correct tactical symbols — and names the governing documents [NORD-21]. The questions are about what the unit can do, not about what it has.

That is not a footnote. It is a working machine for a large part of what this text calls for, it has measured Swedish units for over a decade, and a reader who has sat in an evaluation staff would dismiss the chapter in five minutes if it did not stand here.

The claim holds nonetheless, but only in the narrower form that is the true one. Condition reporting across a Nordic border exists — for units. Three things make it insufficient for what this text is about. It covers military capability and civil capacity to the extent it is requested, not the waterworks' backup power or the food-safety approval of the stores. It runs in two-year cycles inside a four-year process, while the question in the chapter's event is asked in the first hours. The result moreover lands in NATO's planning chain and with defence ministers [NORD-20]. An objection to the last point should stand here: since 5 December 2025 Sweden, Finland and Denmark have shared operational command with Norway and Iceland under Joint Force Command Norfolk [NORD-12], and unit status therefore also goes to a joint operational commander. That is not the neighbour's own situational picture, but nor is it only the planning chain.

One more caveat, about the evidence itself. The report that shows the Swedish application is from 2013 [NORD-21], that is, ten years before membership. It establishes that Sweden has been evaluated against NATO's criteria for a long time; it is weaker evidence for exactly how it is done today.

The conclusion comes out different from the one the text first drew, and better. What is needed is not to invent condition reporting across a border. It exists. What is needed is to extend a proven construction — the criterion written once and centrally, the assessment made locally, the review multilateral — from units to the civil functions that are not covered, and from a four-year cycle to the tempo an event has. That is a smaller task than building something new, and a harder one, since it requires that someone be allowed to say no to another state's self-assessment.

Sweden A answered the same question about function, and four things went wrong. The country built no joint Nordic database — that would have broken every lesson of the Nordic procurement collapse [NORD-15] — but a way of answering a question from a neighbour about its own condition, by machine, without anyone writing a report. The first problem was that the interface required counterparties. During the first years there was only one party, which made the investment a national capacity with zero cross-border value. The second: an honest answer about functional condition is an answer about weakness, and therefore intelligence. Sweden A was forced to make the answers progressively coarser towards recipients outside the narrowest circle, which reduced their value in exactly the situation where they were needed most widely. The third: the seam between Norfolk and Brunssum is a command relationship [NORD-12]. No amount of shared information moves it, and Sweden A had no mechanism that did.

The fourth is the weightiest. On 3 October 2025 the Helsinki District Court dismissed the charges against the master and two officers of the tanker Eagle S, on the grounds that Finnish criminal law could not be applied because of limits arising from the Law of the Sea Convention; the prosecutor appealed on 9 October [NORD-14]. The technical attribution was in practice complete. The binding constraint was jurisdiction. A country that answers the question of what happened faster does not thereby acquire the right to do anything about it.

The mechanism. What can cross a Nordic border is a question and an answer. What cannot cross is custody of the register the answer is drawn from, since joint ownership is precisely the point at which Nordic cooperation has broken every time over twenty years [NORD-15]. NB8 is the clearest case: eight countries, formal cooperation since 1992, a rotating coordinator, no permanent structure and no binding instruments [NORD-19]. Sweden's own research agency identified as early as 2018 the sharing of surveillance data as one of only five viable areas of cooperation, in a study that at the same time named differing alliance affiliations as what set the limits of Nordic cooperation [NORD-18]. That limit no longer exists in that form: Finland and Sweden are NATO members, and the memorandum of understanding was revised in 2025 for the first time since [NORD-6]. The conclusion that holds is that the federation's unit is the answer, not the database — and that this unit does not replace frigates, jurisdiction or a command with the right to take decisions.

What would falsify this. Three observations would show that the mechanism is wrong. If the next measurement of response time in the Baltic Sea improves in step with sensor coverage rather than with the number of vessels and flying hours, then presence was not the decisive variable and the chapter's weighting is misallocated [BALT-7]. If a joint Nordic register of functional condition is in fact established and used during a live sequence before 2035, then the Nordic procurement collapse is a historical anomaly and not a structural limit [NORD-15]. If a Nordic crisis after 2030 is delayed mainly because no one knew the condition, rather than by jurisdiction, mandate or command boundary, then this chapter underestimates the role of information — and the Eagle S ruling was the exception, not the rule [NORD-14].

15. A federation of sovereign nodes

Form of sovereignty: state custody over the state's data, five times over — with citizen custody only in the layer that follows people across a border. The two are conflated in almost every Nordic federation proposal, and that conflation is the reason most of them do not survive contact with a lawyer.

The Nordic region does not need a common register. The Nordic region needs a common question. The difference between those two sentences is this whole chapter, and it is less technical than it sounds.

Take the week in the scenario when it counts. In the scenario it is early spring 2037, the standing invasion threat is in its second year, and four things occur within ninety hours: a cable is cut in the Bothnian Sea, a drone wave forces a Finnish region to move patients westward, a Swedish port rail line is knocked out, and a supplier shared by five countries stops responding. None of the events is new. Attacks on undersea infrastructure in the Baltic Sea are documented and have prompted a standing NATO operation since January 2025 [BALT-7]. That all four occur within ninety hours is an assumption in the scenario, not a forecast.

The questions asked that week are strikingly simple. Which berths can receive. Which blood services are answering. Which public shelters work in the municipality the people are moved to. Every country already has the answer about itself. No country has the answer about the others.

Sweden B solves it with the rails and with people, and it works better than critics of central steering would like to believe. Within each country there is a national interface that reaches the whole population at once, in the same form, without intermediaries. Across the borders the structure exists: Finland, Sweden and Denmark were transferred on 5 December 2025 from Joint Force Command Brunssum to Joint Force Command Norfolk, whose area of responsibility thereafter covers Denmark, Finland, Iceland, Norway, Sweden and the United Kingdom — the five Nordic countries thereby acquired a joint operational command [NORD-12]. The civil counterpart exists too. Haga III, adopted at the ministerial meeting in Oslo on 27–28 November 2024, commits the five preparedness ministries to coordinated crisis preparedness with an all-hazards perspective and to civil-military cooperation together with Nordefco [NORD-8]. What the arrangement lacks is neither will nor channels within the countries. It lacks a path for a question across a border.

Presence moreover turned out to be what measurably worked. NATO Marcom reports that Baltic Sentry between January 2025 and January 2026 cut the response time to suspected events from seventeen hours to one, with a significant reduction in sabotage against undersea infrastructure, and a NATO source states twelve boardings under national mandates during the same year [BALT-7]. Ships and aircraft did that, not data models. A text that argues for architecture has to begin by admitting it.

The arrangement has two thin points, and both are documented in open sources. One is the tempo. The directors-general of the Nordic preparedness agencies meet at least once a year, with a rotating chair, and Denmark chairs during 2026 [NORD-9]. An annual meeting does not steer a sequence that moves over ninety hours, and that is where the absence of a path across the border becomes measurable.

The other is the format. The Nordic-Baltic Eight — Denmark, Estonia, Finland, Iceland, Latvia, Lithuania, Norway and Sweden — have cooperated formally since 1992, adopted their name on 30 August 2000 and lack a permanent structure; the coordinator role rotates annually, with Estonia from 1 January 2026 [NORD-19]. Karsten Friis moreover warns that a de facto boundary within NATO may arise in the Baltic Sea between the areas of responsibility of Norfolk and Brunssum [NORD-16]. An informal format without a secretariat and a command seam in the middle of the sea is a poor combination in precisely the week someone wants to exploit both.

Here the strongest objection to my own proposal should stand, and it is European. Gaia-X was exactly this: federated, sovereign data infrastructure at scale, built from 2019. The outcome is described as a failure by named participants — the former chief executive Francesco Bonfiglio called it "too ambitious", Nextcloud's Frank Karlitschek called it a "paper monster" in 2024, Scaleway left in November 2021 citing bureaucracy, the day-one member Agdatahub was liquidated after 4.8 million euros in funding, and the European cloud market share fell by three quarters in three years [TVILL-12]. Europe has thus already tested the thesis and got documents instead of systems.

Estonia is the second counterargument, and it is sharper because Estonia is usually invoked in support. X-Road is a state mandate over state registers, with state e-identification as a condition of access. That description has no entry of its own in this text's source list, and that should be said outright; what can be documented is the successor. Ukraine's Trembita, which started in 2019, had by June 2025 connected more than 150 state registers and had brokered over 14 billion data exchanges [UKR-5].

What is decisive is what Estonia did when the question became war. The country did not extend custody out to its citizens. It built a second centre. The agreement on the world's first data embassy was signed on 20 June 2017 by prime ministers Jüri Ratas and Xavier Bettel, with operation from the beginning of 2018, and Ratas described it as "fundamentally a double guarantee to our data and services" [TVILL-11]. The facility in Luxembourg holds critical state databases at Tier 4 security level, stands wholly under Estonian control, uses KSI technology for integrity protection and can not only store backups but also run the most critical services [TVILL-10].

It is a copy of the state, abroad, under the state, and it is the strongest form of Sweden B described anywhere in this text. No one should be able to read the section as though this were something Sweden A came up with. The data embassy is B's answer, and A inherited it unchanged, as A inherited the stores, the concrete, conscription and the rails [TVILL-10] [TVILL-11].

The objection nonetheless stands on the merits, but it points in a different direction than one first thinks. It is no argument against a question interface across a border, since Estonia built both. It is an argument against the second division: whoever wants to move custody out to the citizen must answer why the country with the most to lose instead moved it to a second centre, abroad, under the state.

Trembita answers something too. Federated access did not save the Ukrainian registers. An attack attributed to the GRU was made public on 19 December 2024, citizens had from the beginning of December been unable to sell a car, bring a lawsuit or register a marriage, and the ministry of justice announced only on 20 January 2025 that the registers were working again; the security specialist Karla Wagner observed that "centralization and single points of failure are a well-known anti-pattern" [UKR-6]. The attack hit the registers, not the interface. The effect was total all the same, since an interface only delivers what a register holds — a hardened window onto a room that has been knocked out shows nothing. A layer that federates access leaves custody concentrated, and the fault came through exactly there.

The conclusion that holds is therefore narrow. Sweden A built no Nordic register, and never proposed one.

It built an interface with three properties. A question format for a small number of questions that every country already answers within itself, where the answer is produced in the answering country and logged there. Refusal as the default state, with granting per question, per event and with a time limit. Beneath the interface a fallback path without a network: the same questions by radio and on paper, with slower answers and poorer coverage, since an interface presupposes a connection.

What it cost should be written out, and the first item is time. Nordic binding commitments have collapsed for twenty years at the point of industrial obligation: the Nordic standard helicopter of 1998–2001, Norway's and then Denmark's withdrawal from the Viking submarine project, the Swedish-Finnish Amos mortar, and Norway's withdrawal from both the artillery and the truck procurement within the space of days in December 2013 [NORD-15]. Sweden A did not change that history. In the scenario the interface covers, in 2040, a handful of question types, not the large ones — the condition of the grid and food logistics were negotiated for years without result. The number of question types is an assumption in the scenario.

The second item is the trust layer, which Sweden A did not control. eIDAS Article 45 is described by the Electronic Frontier Foundation as a ceiling rather than a floor, since it prevents browsers from requiring more security than the ETSI-approved requirements [ATK-8]. Twelve industry actors, among them Cloudflare, Mozilla, the Linux Foundation and Mullvad, jointly warned that "an error of judgment or deliberate action by one member state will affect citizens in all other member states" [ATK-9]. The implementing act on QWACs was formally adopted on 17 December 2025 [ATK-11], and member states are to provide an EUDI wallet before the end of 2026 [ATK-13]. Sweden A did not solve that. It kept the Nordic questions outside the web's chain of trust, which gave one more identity path to maintain and one more surface on which to get things wrong.

The third item is the hardest. An interface lays no cable. Estlink 2, 650 megawatts between Finland and Estonia, was damaged on 25 December 2024 and was back in commercial operation only on 20 June 2025 — around six months [BALT-5]. On 5 February 2026 the Commission adopted a cable security toolbox and set aside 347 million euros for strategic submarine cable projects, of which a call of 20 million euros for European repair capacity [BALT-13]. The money went to ships, not to situational pictures. Sweden A knew faster which cable was cut and who had a vessel. The vessel still came when it came.

The mechanism generalised: the unit of federation should be the question, not the register. A register that five states can read is a register an adversary eventually reads, and a register no one may read is unusable in the week it is needed. A question that every state can answer, refuse and log leaves custody where responsibility already lies in law. That is not a technical nicety but a political one: FOI's review of Nordic operational defence cooperation found five areas that actually held — established contacts and secure communications, simplified access and alternative basing, exchange of exercises, sharing of surveillance data and joint operations [NORD-18]. The review is from 2018, and it named differing alliance affiliations as what set the limits — a caveat that ceased to apply when Finland and Sweden became NATO members [NORD-18] [NORD-6]. Four of the five require that no one give up anything permanently.

What falsifies the thesis is named and observable before 2040. If the Nordic countries have by 2032 agreed on at most a couple of question types under Haga or Nordefco [NORD-9], the interface thesis is dead in practice, and the honest answer is the one Estonia has already given and which both countries in this text inherited: a second centre, abroad, under the state, placed outside a contested Baltic Sea area — and stop there [TVILL-10]. If, by contrast, a joint Nordic register in some domain is built and survives an attack that knocks out five federated nodes, this chapter is wrong in its main thrust. Both outcomes can be read off without waiting for 2040.

Part V — What can still be done

16. What Sweden A did 2026–2030

Form of sovereignty: state custody of the state's own data. The chapter is about facilities and not about people — doors, filters, pipes, stores — and there the state is the right custodian. Citizen custody appears at a single point, and it is excellent when it comes.

Sweden A built no new agency, started no programme and applied for no new appropriations during these four years. Nor did it build an interface: the interface already existed, and Sweden A inherited it unchanged. It changed the content of forms that were already being filled in, by people who were already employed, within appropriations that had already been decided. The reason is a single figure: the Swedish Armed Forces carried 780 million kronor in unspent funds from 2024 into 2025, and ended 2025 with 366 million unused on materiel and facilities because of delivery delays [SV-15]. A country that cannot spend the money it has already been given may not propose anything that requires it to hire its way out of the problem.

The event that opens the period is a law. On 29 April 2026 the Riksdag adopted the act on public shelters and protected spaces, in force on 1 June. The law creates a second, weaker category — protected spaces — which gives limited protection relative to public shelters, and it clarifies the division of responsibility for evacuation and billeting [SKYDD-3]. The inquiry behind the reform costed it at 745–778 million kronor a year, roughly 3.8 billion over five years [SKYDD-1].

A category that has just been created must be found before it can be used. That is the task these four years are about.

Sweden B's outcome. The inventory becomes better than it was, and it becomes better for the right reasons. The voluntary inventory of possible protected spaces carried out in 2023 got responses from 57 per cent of the municipalities and 62 per cent of the regions, and arrived at places for around 1,445,555 people [SKYDD-2]. The duty to report under the new law is of a different kind: it is not voluntary, it goes out to every municipality at once and in the same form, and it has a date behind it — the government's commission from July 2026 has the municipal support part reported by 11 December 2026 at the latest and the rest by 11 June 2027 [SKYDD-4]. That the response rate therefore rises towards completeness is a judgement in the scenario and not a figure from a source. Sweden B gets a more complete register than it had in 2023, it comes back quickly and uniformly, and that is a real improvement which nobody should talk away.

The register still describes the same thing as before: what exists. The fault lies not in the transport but in the content — an interface delivers what a register holds, and this register holds places and not condition. What therefore has to be described in prose alongside the register is expensive to produce, not slow to send: the Riksdag's own follow-up of three preparedness sectors reports agencies describing very high pressure to report to several recipients at once, with the conclusion that the burden holds back capability development [SV-11].

Sweden A's outcome, and what it cost. The same law, the same commission, the same money, the same rails. The difference was where the answer was produced. Sweden A defined the task as a field in the inspection report already in use, not as a report someone writes afterwards.

The evidence that it can be done lies in an old newspaper article. All 349 public shelters on Gotland, with capacity for around 33,600 people, were inspected — and not a single one passed without an injunction. The faults were substandard sealing strips, unlubricated hinges, missing tools and badly drilled cable penetrations [SKYDD-18]. The condition was thus known, facility by facility, by a human being standing in the room. It never became a piece of information anyone could ask for.

Four capabilities, with their costs and their fallback routes.

The condition field. The inspection records condition where it is carried out. Fallback route without power and network: the injunction stays on paper in the facility's own binder, and a dated card by the door states the most recent inspection and the outstanding fault. The facility carries its own condition.

What it did not solve belongs first. In February 2024 the agency had two shelter inspectors for 64,000 objects and put the need at around forty [SKYDD-8]. For 2025, 2,000 new inspections and 10,000 supervisions were planned [SKYDD-7]. Sweden A changed none of those figures. A better field in the report does not make the inspection faster, and 50 million kronor a year for the supply of base data [SV-2] does not buy thirty-eight trained inspectors. Sweden A entered 2030 with roughly the same backlog as Sweden B.

The division that follows is one the text has so far avoided, and it belongs here, because a text that asks its readers to redo its figures may not skip its own most expensive calculation. Sixty-four thousand objects at two thousand inspections a year is thirty-two years until every public shelter has been visited once [EGEN-3]. The calculation uses the inspections and not the ten thousand supervisions [SKYDD-7], and both the reason for the choice and its price belong in writing. The reason: a supervision tests whether the owner is discharging their obligation, whereas the inspection yields the physical fact about the facility's condition. The price: counted across all twelve thousand visits the figure becomes 5.3 years instead of thirty-two [EGEN-3], which in practice is the agency's own five-year ambition. If the boundary between supervision and inspection is less sharp in reality than in the regulations, this objection is therefore considerably weaker than it sounds — and a reader should be able to see that without looking up the source.

The calculation must also be applied to the text's own scenario, since otherwise it is only a number. The second year of the attack is 2037, eleven years after the law came into force. At two thousand inspections a year, around 22,000 objects have been visited by then, that is roughly thirty-four per cent of the stock [EGEN-3]. Sweden A enters the week this whole text is built around with a condition field filled in for a little over a third of the public shelters. That is an advantage, but it is a one-third advantage, and every chapter that speaks about what Sweden A knows is to be read against that figure. The agency's own ambition is a five-year cycle [SKYDD-8], which requires 12,800 inspections a year — a little over six times the rate planned for 2025 [EGEN-3].

That number applies to both countries, and it is the chapter's hardest. A condition field filled at that rate is not a picture of the stock. It is a picture of the objects visited earliest, and it ages before it is complete. The 2027 record of a ventilation plant in Malmö is fourteen years old by the time the last property in Kiruna gets its first visit, and nothing in the construction tells the reader which record is which.

It is the same objection the text directs at the register, now directed at the text's own proposal, and it has no answer that is not more people. Sweden A's addition makes the information cheaper to carry once it has been collected. It does not make it faster to collect the first time, and the first time is thirty-two years long.

The machine-readable answer. The municipality's part of the inventory was met by the system answering the question, not by someone composing the answer afterwards. Fallback route: a printed extract per municipality, updated once a year, held by the county administrative board and the rescue service. It is the same logic as the more than five million copies of In case of crisis or war distributed to households between 18 and 29 November 2024 [SV-18].

It worked unevenly. Municipalities without systems of their own reported by hand anyway, and in the scenario that applies to a significant share of the municipalities at the end of the period. The share is an assumption in the scenario, not a documented figure.

The knowledge audit. The 30 million for knowledge and research [SV-2] measured something other than before. The Swedish Medical Association's 2025 survey found that around a third of doctors state that their employer has concrete plans for crisis or war, that 17 per cent both had such an employer and knew what they were expected to do, and that 7 per cent answered yes to all three questions: the plan exists, the role is known, the exercise has been carried out [VARD-12]. Sweden A made the third figure the one it reported. Fallback route: the role is printed on a card in the wallet and posted at the workplace.

The cost was political and immediate. Sweden A's first measurement looked worse than Sweden B's, because Sweden B went on reporting the number of people trained [VARD-12]. A number that falls because the measure became more honest is hard to defend in a budget process.

The convertible industry. Sweden A did not invent this. On 9 June 2025 the inquiry into the supply preparedness of the business sector proposed supply agreements between companies and the state, a construction and repair preparedness office at the Swedish Agency for Economic and Regional Growth, and an extended mandate for RISE to maintain a capacity for production conversion during crisis, heightened alert and war [SV-17]. Sweden A implemented the proposal on time instead of letting it sit. Fallback route: the conversion instruction exists as a binder at every facility and is exercised once.

Here the mechanism is not enough, and that belongs in writing. A converted production line without electricity produces nothing. Svenska kraftnät states that island operation presupposes local generation capable of black start, that the capability cannot be guaranteed to a hundred per cent, that it cannot be fully exercised for real, and that its scope is local and regional islands within individual towns or municipalities [EL-7]. Sweden A did not solve that. No data measure does.

One more thing Sweden A did not get through in time. The Agency for Civil Defence notes that in several areas requirements and funding are placed on the public agencies to a greater degree than on private actors, that preparedness-raising measures are often not commercially viable, and that they therefore risk not being taken without statutory requirements or public funding [SV-9]. Sweden A chose statutory requirements, which in the scenario took until the end of the period — an assumed duration, not a documented fact.

One more limit belongs here, but it is not A's. The data embassy belongs to Sweden B: it is a second centre, abroad, under the state. Estonia's solution in Luxembourg holds critical state databases at security level Tier 4, stands entirely under Estonian control and can run the most critical services and not merely store them [TVILL-10]; the agreement was signed on 20 June 2017 [TVILL-11]. Sweden A inherited it unchanged, as A inherited the stores, the concrete, conscription and the rails. That it presupposes a network by definition is therefore not an entry in A's column but a limit both countries share, and the fallback route is the same in both: the printed extract above, nothing else.

The price, in total. Sweden A came out of the period with the same shortage of inspectors as Sweden B, with a knowledge measure that looked worse every time it was reported, and with a significant share of the municipalities reporting by hand anyway — that share is an assumption in the scenario. What became cheaper was a single thing: knowing the condition of a facility without asking anyone about it.

The mechanism. The cheapest piece of information is the one that falls out of work being done anyway. Every piece of information that requires a work step of its own has a half-life, and that half-life is shortest when the pressure is highest — which is precisely when the information is needed.

What would falsify it. If the number of public shelters with a filled-in condition field at the end of the period is lower than the number of inspections carried out since the law came into force [SKYDD-3], the burden has not disappeared but moved, and Sweden A has built one more binder.

17. What can still be done

Form of sovereignty: state custody for the facilities, citizen custody for the body. The points below are sorted by which of the two applies.

The window for the cheapest of the above is open for months, not years — and that is not the same as the field being filled in a few months' time. Chapter 16 arrived at thirty-two years for a complete pass at the current rate [EGEN-3]. What is open for months is the opportunity to add the field before the cycle starts over; what takes decades is filling it. Anyone who confuses the two is selling a fast solution to a slow problem, and that is precisely what the text accuses others of.

The law came into force on 1 June 2026 [SKYDD-3]. The first inventory cycle under it has not yet been completed. A field can be added to a report before a cycle at a cost that shows up in no appropriation; after three cycles it costs a conversion. In July 2026 the government also commissioned the Agency for Civil Defence to strengthen public shelter preparedness, with the municipal support part reported by 11 December 2026 at the latest and the rest by 11 June 2027 [SKYDD-4]. That is where the window lies, with dates.

Four measures that fit within existing appropriations and existing staff. None of them requires a new interface — the interface exists, and the question throughout is what goes through it.

Do the calculation for the other 289. The Karlstad calculation used two openly available services — the public shelter register and Statistics Sweden's population grid squares — and required no authorisation; the result was that 31,832 people in the municipality live more than 500 metres from the nearest public shelter [EGEN-1]. Sweden has 290 municipalities [SKYDD-11], and one of them has been counted. Fallback route: the result is a map and a table that can be printed and put up in a municipal command centre.

Build the blood donor register nationally. Sweden has 26 blood establishments, approved donors exist only in local registers, the regions cannot see each other's, and the system for guest donation lacks the technical capacity for many simultaneous queries in crisis or war [VARD-16]. The number of active donors was 195,081 in 2023, and the National Board of Health and Welfare judges that it needs to be around 400,000 [VARD-17]. This is centralisation, and it should be done. It is the point at which Sweden A adopts Sweden B's architecture outright, because architecture is chosen per domain and not per conviction. The argument in this text does not require that everything be federated — it requires that the choice be justified domain by domain. Fallback route: the local paper registers remain, which is exactly what applies today.

Inventory the cryptography before the migration. Sweden's national cybersecurity centre states that the transition to quantum-safe cryptography needs to be complete by the end of 2035, and in certain sensitive cases already by the end of 2030 [KVANT-8][KVANT-9]. A migration presupposes a list of what is used where. That list is free in hardware and expensive in calendar time. There is no fallback route and none is needed: a list is a document.

Give the knowledge measure an owner. Seven per cent [VARD-12] is a figure that can be tracked annually without new collection, because the survey is already being carried out.

Three things that cannot be done with any of this.

In RiR 2025:4 the Swedish National Audit Office established that central government's steering of the build-up of civil defence has not been sufficiently effective, citing an unclear division of responsibility, vague mandates and short-term funding [SV-10]. A field in a form does not solve an unclear mandate. Give the field two owners and it is filled by neither.

Concrete does not come out of data. The inquiry recommended 2,500–5,000 new public shelter places a year for five years, and by April 2026 none had been built [SKYDD-20]; that item is classed as probable rather than verified and should be established against a primary source before it is used as fact. The warning system has around 4,200 sound transmitters in 236 of 290 municipalities, and roughly half the population lives within earshot [SKYDD-11]. Fifty-four municipalities without a siren do not become fewer because someone knows that they are fifty-four.

The four northernmost counties have in practice no cultivation of bread grain, no storage capacity for food grain and no mills at all; mobile mills would have to be secured for them [MAT-8]. That is an investment in equipment, not in information.

What would falsify this whole section. If the first inventory cycle under the new law [SKYDD-3] yields a more complete and fresher picture of the condition of the public shelters than the inspections do, the objection to reporting as a mechanism is wrong. The right conclusion would then be to expand the reporting and leave the report form alone. That observation can be made before the commission's final reporting date has passed [SKYDD-4], by anyone who compares the two.

Part VI — The objections

18. Where I am wrong

Six objections to this text are stronger than the text. They are put here on their own merits, in the form their best advocates would use, and none of them is answered with a travesty.

One. Sweden's own audit office says the fault is steering, not information.

The Swedish National Audit Office examined the build-up of civil defence in 2015–2024 and concluded that central government's steering has not been sufficiently effective. The shortcomings it names are an unclear division of responsibility, unclear notice of what is to be achieved by whom and when, and short-term funding. The recommendations are about clarity and predictable money [SV-10]. None of them is an information system.

The objection in its strongest form: this text proposes a technical solution to a constitutional and organisational problem. A country that does not know who is allowed to decide is not helped by knowing what works. The right to decide, not the situational picture, is the binding constraint, and the money ought to go there.

What I can answer: nothing that overturns it. Steering is the larger failing and it should be remedied first. The only thing I can claim is that the two do not compete for the same resource — a clearer division of responsibility requires legislation and political will, not fifty million kronor a year — and that a clear division of responsibility without information about condition produces fast decisions on the wrong basis. Anyone who thinks that a weak answer is right that it is weak.

Two. Both halves of Sweden B have already been demonstrated, and neither of them needed a condition register.

Europe's best-prepared country built around 50,500 public shelters with room for roughly 4.8 million people, for the most part private concrete shelters compelled by a rescue act that requires shelters in buildings above a certain size [SKYDD-12]. The same country maintains an emergency stockpile system covering 174 listed products in agreements between the state and companies, and grain for six months of normal consumption, extended by a further two and a half months during 2022 [MAT-7]. The method is law, concrete and agreements. The method is not data.

The other half is Ukrainian and equally demonstrated. On 15 October 2025 the state's app had more than 23 million users and delivered more than 70 public services and 33 digital documents [UKR-4]. Beneath it lay an interoperability layer that since 2019 has connected more than 150 state registers and brokered more than 14 billion data exchanges [UKR-5]. That happened during a war.

The objection in its strongest form: Sweden B is not Finland alone, but Finland's stores and concrete plus an interface of the Ukrainian kind. Two countries have thus each demonstrated one half of B, one of them in the middle of an attack, without either needing a register of functional condition to do it. Sweden should copy what has been demonstrated instead of trying what has not. To call stores and concrete "preparedness counted in inventory" is a condescending description of the only thing that demonstrably works.

On the Ukrainian half I have nothing to answer, since the text does not dispute it. The interface is B's, it is documented, and both countries in the scenario live on it.

The Finnish half forces me to correct myself first. Finland's follow-up was a condition survey, not a count of places, and earlier versions of this chapter described it as the opposite. The survey revised the total upwards — the earlier figure of 54,000 public shelters for 4.4 million people was revised to 50,500 shelters for 4.8 million — and it reported the spread behind the average: shelter places for 60–80 per cent of the population in most of the wellbeing services counties, Helsinki with 34 per cent more places than inhabitants, South Ostrobothnia lowest at 48 per cent. Around 85 per cent of the stock was built after 1971 [SKYDD-13].

The correction goes the objection's way and not mine. Finland produced information about the condition of the stock nationally without building any of what this text advocates. That the information can be produced without the architecture is precisely what the objection claims, and it claims it with Finland's own material.

What remains of my answer is narrower, and it should not be made larger than it is. A survey is a point in time. A field in a register is a condition that travels with the object between the points in time. What Finland produced was a picture of the situation on one occasion, and the value of that picture lies in the spread — a national figure conceals a range from 48 to 134 per cent of the population, and it is the range, not the average, that someone evacuates by [SKYDD-13]. Whether the survey is repeated at any fixed periodicity I have no information about; the source does not say, and no interval is therefore written out here. The difference between what Finland did and what the text proposes is thus a difference in endurance, not in capability. That is a considerably smaller difference than the one I previously claimed existed, and the reader should deduct accordingly from the chapter's claims.

Three. No national twin programme has delivered.

The United Kingdom's programme closed after five years with principles and frameworks as its result, not with a national twin [TVILL-5]. Virtual Singapore was announced on 16 June 2015, and the press release put completion at 2018. I have no sourced date for when the platform actually stood ready, so I cannot put a figure on the delay [TVILL-9]. Gaia-X is called overambitious by its own former chief executive [TVILL-12]. Sweden's own audit office moreover examined 1,094 strategic digitalisation projects at 136 agencies with a combined budget of around 40 billion kronor: roughly half were marked by major delays and cost overruns, 31 were shut down without result at a cost of 1.6 billion, and at least 120 of 722 completed projects did not fully reach their goals [TVILL-13].

The objection: nought for three internationally, and at home the audit office says the state cannot manage projects of this class. What mechanism makes Sweden different?

What I can answer: no mechanism makes Sweden different, which is why the text does not propose a national twin programme. It proposes that one field be replaced in a register that already exists, is run by an agency that already exists, and is filled by inspections that are already carried out. The difference between that and Gaia-X is orders of magnitude. If the reader nonetheless believes it will grow into a forty-billion programme, that fear is well founded, because that is exactly how the forty billion came about.

Four. The centralised alternative has measured its benefit, and the measurement came out in its favour.

This objection is the best documented in the chapter, and it lay in my own source material without making it into the text.

A systematic review went through 24 articles with 63 analyses of what follows when medical records are shared between care providers. 68.3 per cent of the analyses reported benefit, 7.9 per cent harm. Among the studies with a strict design, all seven reported benefit, and none of them harm. The outcome was positive in 77.8 per cent of the cost analyses and in 90 per cent of the analyses of care quality [ATK-46].

Denmark shows the same thing in another currency. A unique ten-digit personal identity number, electronic since 1968, causes of death registered since 1943, hospital contacts since 1977 and prescriptions since 1995, with over 99 per cent list coverage, gives exact individual-level linkage between all data sources and lifelong follow-up with correct censoring on emigration or death. On top of that sit around 100 clinical quality databases [ATK-45].

The objection in its strongest form: the shared record is not an untested risk to be weighed against an untested benefit. It is one of the most evaluated information architectures in the public sector, the evaluations fall one way, and in the strictest part of the material — the seven studies with a strict design — there is not a single finding of harm [ATK-46]. The text proposes instead that custody be pushed out to nodes and that access take place through a query rather than through a pooled database. That is an architecture whose benefit nobody has measured, set against one whose benefit has been measured. The burden of proof therefore does not lie where the text places it. It lies on me.

What I can answer, and the figure stands afterwards. The review measures what shared records do for care when nobody takes them. It does not measure what happens when someone does, because that outcome occurs too seldom in the studied population to end up in a harm column. There are cases where it did occur. A Finnish psychotherapy practice was breached in 2018 and 2019, the matter was made public on 21 October 2020, around 36,000 patients were affected, around 30,000 were blackmailed individually, the company went bankrupt in February 2021 and the perpetrator was convicted on 30,000 counts, one per victim [ATK-37][ATK-38]. The peer-reviewed account speaks of substantial reported harm, from psychological suffering to tragic suicides [ATK-38]. How many these were the source does not state, and it contains no information on care avoidance. No figure is therefore put on either here.

That is a weaker answer than the objection, and it should be said outright. A systematic review of 63 analyses stands against a handful of individual cases, and anyone who weighs cases against a review weighs wrongly unless he writes out that he is doing so. My claim is therefore not that the benefit figure is uncertain. My claim is that it measures a different outcome space than the one the text worries about, and that anyone who builds further on the review takes on at the same time the assumption that the harm outcome remains as rare when the architecture becomes mandatory, nationwide and thereby worth a state attacker's time. What would settle that question stands at the end of the chapter.

Five. Federated solutions fail in the field.

This one is the hardest. A direct comparison between federated analysis and the alternative showed that the federated route took eighteen months to reach operational capability where the alternative took about one month, and that both gave directionally identical results. The conclusion in plain words: distributed analysis has not delivered results in time in practice [ATK-47]. A systematic review of the trade-off points the same way and names the mechanisms: centralised models give better harmonisation, better searchability and faster workflows, while federated ones suffer from limited data interoperability, harder harmonisation of retrospective collections, dissimilar quality policies between the participating nodes and authentication institution by institution, which lengthens the time to access [ATK-48].

The objection: during a pandemic or an attack, eighteen months of coordination tax is not a privacy protection. It is people dying while the governance converges.

What I can answer: that study measures federated analysis — computing on data that remains with many parties. The text proposes federated custody with a central query: a node answers yes or no about its own condition, which is an order of magnitude simpler than cross-matching medical record data across national borders. That is a correct answer and it is also a convenient distinction, and the reader should weigh that it comes from someone whose conclusion it rescues.

The review's second point, however, survives the distinction. Dissimilar quality policies between the nodes [ATK-48] are not a problem that disappears because the question is simple. A node that answers yes or no about its own condition answers by its own yardstick, and a register filled by as many yardsticks as there are answering nodes looks uniform without being so. That is the same fault the text accuses the nominal register of, moved one step outwards. The consequence for the proposal is that the criterion for what counts as working must be written once, binding and centrally, while the assessment is made locally — and anyone who believes a written definition alone is enough against this has not read chapter 12.

Six. What I propose to give up has a price in people.

Thirty-two European police chiefs signed a joint declaration on what full end-to-end encryption costs: 92 per cent of Facebook's and 85 per cent of Instagram's reports to British police disappear, out of a flow that today protects around 1,200 children a month and leads to around 800 arrests [ATK-42]. The volume behind that flow is in the receiving organisation's own statistics: 21.3 million reports and 61.8 million files during 2025, with online grooming of children up 158 per cent on 2024 and child trafficking up 323 per cent [ATK-44].

The objection: "the architecture is risky" is no answer to twelve hundred children a month.

What I can answer: nothing that makes that figure smaller. The text claims that a back door built to protect them is also opened by others, and rests on the fact that Sweden's own cryptography authority says precisely that [ATK-25]. It is a trade-off between two real harms, not between a harm and a principle, and a text that pretends otherwise is propaganda. Anyone who weighs it differently than I do is not doing so out of ignorance.

The fourth and the sixth objections do not bear on the thesis of nominal versus functional condition. Both bear on what chapter 2 declares as a second division — the refusal of a general access route and the citizen-carried node — and a choice that expressly is not derived from the text's own follow-on question must be falsifiable on its own. The condition already stands in chapter 13 and is repeated here: if Europe passes a decade with a mandated access route in every service without a single documented takeover of the mechanism, then the generalisation from Athens [ATK-31] and from the nine American operators [ATK-33] is too strong, and the choice chapter 2 declares as a second division was wrong. Athens was discovered on 24 January 2005 and the perpetrators were never identified [ATK-31]. The American case was reported as of 27 December 2024, with a dwell time of over a year [ATK-33]. Two cases are a pattern only once a third arrives. If it fails to arrive in ten years, whoever weighed it differently has won the question on the merits, and the bill that was paid in children [ATK-42][ATK-44] was paid in vain.

The same condition applies to the fourth objection, read the other way. If the shared record's benefit figure [ATK-46] still stands after a decade of nationwide and mandatory sharing in Europe, without a documented mass disclosure of the kind that struck the Finnish practice [ATK-37], then the caution the text is built on was too expensive — and the price was paid by those who did not get the benefit.

What would show that I am wrong

A counterfactual text without falsification conditions is a creed. Here is mine. The conditions for the second division stand above; what follows bears on the thesis.

The thesis says that registers reporting nominal condition produce worse decisions under pressure than registers reporting functional condition. It would be disproved if any of the following turns out to be the case between now and 2040:

• The duty to report under the new public shelter act [SKYDD-3] yields within five years a

current picture of the functional condition of the stock, without the reporting burden increasing measurably for the municipalities. The reporting route was then enough, and the addition was unnecessary.

• A Swedish crisis occurs in which the situational picture existed, was correct and was

available, and the decisions were still wrong or late. The information was then never the binding constraint and chapter 18:1 was right all along.

• A country that has built condition registers of the kind the text advocates is struck and

fares measurably worse than a comparable country that has not.

• A recurring condition survey of the Finnish kind [SKYDD-13] turns out to keep a picture of

the stock's condition as fresh as a standing field would, at lower cost. The difference in endurance that chapter 18:2 rests on is then not worth its price.

The third condition is the most honest and the hardest, since it presupposes a catastrophe and a control group. Nobody should wish for that experiment. Writing out what would settle the question is nonetheless the least that can be asked of anyone who spends twenty thousand words arguing the opposite.

19. What WINNIIO and Life Atlas are building

A factual section, for the reader who wants to know where the argument comes from.

WINNIIO works with digital twins of real facilities — industry, buildings, infrastructure — and with the methodology for how such twins are built so that they can be replaced. The methodology is called SMILE, is published with a DOI and a version number, and its load-bearing rule is that the work begins in the benefit and ends in the data, never the other way round. It is the same chain the point of division in chapter 2 is formulated along: which decisions the goal requires, which insights the decisions require, which information the insights require, and last which data the information requires.

Life Atlas is building the citizen-carried node — an encrypted baseline the person carries, readable without a network, with the individual as sole key holder. The first users are on their way in. The node belongs in the second division, the one chapter 2 declares under its own name and on its own account: the choice of where custody of the information lies in relation to the state. It does not, therefore, belong to the list of additions the text derives from its own follow-on question. I say that outright because it describes how the argument is built, not because it is a hedge: the part of the argument where my own work lies is precisely the part that expressly is not derived from the follow-on question. It stands beside the chain instead of riding along with it, and it carries its own cost — the function, a baseline readable without a network, is derivable; the form of custody is a choice. The architecture is local first, every component replaceable, including our own.

Four things the text argues for we are not building, and they are no less important for that: the state backbone that makes data reachable when a care provider falls over, the Nordic interoperability between five sovereign countries, the paper reserve that works without power and network when everything else is down, and the national interface that reaches the whole population at once, in the same form, without intermediaries. Chapters 11 and 15 argue for the first three. The fourth is Sweden B's, and it is the only one of the four that already stands demonstrated somewhere: on 15 October 2025 the Ukrainian state's app had more than 23 million users and delivered more than 70 public services and 33 digital documents [UKR-4], on top of an interoperability layer that since 2019 has connected more than 150 state registers and brokered more than 14 billion data exchanges [UKR-5]. Both of the two Swedens in this text rest on that interface; it is not something either of them opts out of, and not something we build. None of the four is a product we sell, and the argument stands independently of who builds them.

What makes this text possible is none of the above. It is that the public shelter register and the population statistics lie open, that the calculation takes an afternoon, and that the method is in the source list under [EGEN-1] so that anyone who disagrees can redo it and arrive at something else.

Sweden has 290 municipalities. The calculation in chapter 1 has been done for one of them, in an afternoon, by a person with authorisation to nothing. Two hundred and eighty-nine remain.

Källor

173 källor citerade i texten. Varje post har den nyckel som står i brödtexten, påståendet den bär, och var den kan hämtas. Källor som samlats in men inte citerats är utelämnade.

Svenskt totalförsvar

[SV-2] Within the 8 500 MSEK annual civil-defence uplift by 2030, the line 'Försörjning av grunddata' receives 50 MSEK/year and 'Kunskap och forskning' 30 MSEK/year, while 'Elektroniska kommunikationer och post' receives 1 633 MSEK and 'Energiförsörjning' 1 048 MSEK. Totalförsvaret 2025–2030, proposition 2024/25:34, Tabell 12.2 Tillskott till civilt försvar 2025–2030 · Regeringen (Försvarsdepartementet) · 2024-10-15 <https://www.regeringen.se/contentassets/5c98b885c2cc40d58aa3693d34d915d3/totalforsvaret-20252030-prop.-20242534.pdf>

[SV-3] The 2024 defence decision gives the military defence over 170 bn SEK extra and civil defence 37.5 bn SEK extra to 2030; defence expenditure reaches 2.6 percent of GDP in 2028; six beredskapssektorer are prioritised; conscript intake shall reach 10 000 per year by 2030 and about 12 000 during 2032–2035. Nytt totalförsvarsbeslut för ett starkare Sverige · Regeringen · 2024-10-15 <https://www.regeringen.se/pressmeddelanden/2024/10/nytt-totalforsvarsbeslut-for-ett-starkare-sverige2/>

[SV-4] The government's Försvarsbeslutet 2025–2030 page states a target of 3.5 percent of GDP by 2030 (2.8 percent 2026, 2.6 percent 2028), a wartime organisation of about 130 000 personnel by 2035 plus reserves, at least 10 000 conscripts per year by 2030 rising to 12 000 for 2032–2035, and 26 000 Home Guard soldiers by 2030. Försvarsbeslutet 2025–2030 · Regeringen · 2024-10-15 <https://www.regeringen.se/regeringens-politik/totalforsvar/forsvarsbeslutet-20252030/>

[SV-6] Försvarsmakten and MSB's 'Utgångspunkter för totalförsvaret 2025–2030' (FM2025-19772:2, MSB 2025-08877, 8 September 2025) defines seven dimensioning typsituationer that may occur simultaneously — 1 Hybrida hot, 2 Värdlandsstöd, 3 Begränsat anfall mot norra Sverige, 4 Anfall mot Gotland, 5 Fjärrangrepp, 6 Förstärkning av alliansens norra flank, 7 Förstärkning av alliansen i Baltikumområdet — and states that total defence shall be able to function for at least three months of a large war in Europe, with civil operations able to sustain the important societal functions on mainly their own resources for at least two weeks. Utgångspunkter för totalförsvaret 2025–2030 (Bilaga 1) · Försvarsmakten och MSB · 2025-09-08 <https://www.mcf.se/siteassets/dokument/om-msb/vart-uppdrag/regeringsuppdrag/besvarade-regeringsuppdrag/2025/utgangspunkter-for-totalforsvaret-2025-2030.pdf>

[SV-8] Myndigheten för civilt försvar's fifth aggregated assessment (MCF0106, May 2026) concludes that civil defence capability has developed in all sectors, but that 'takten i utvecklingen av det civila försvarets förmåga behöver öka skyndsamt'; cross-cutting shortfalls are named as planning for endurance, physical protection and repair of critical infrastructure, support to the military defence, personnel supply, prioritisation of scarce resources, and private actors' capability. The main report and annexes 1–14 are classified. Förmågan inom det civila försvaret 2026 – kompletterande öppen rapport (MCF0106) · Myndigheten för civilt försvar (MCF) · 2026-05 <https://www.mcf.se/contentassets/0c836465399c40cb8f6d78132c899d8b/kompletterande-oppen-rapport.pdf>

[SV-9] MCF states that many preparedness agencies have raised their own capability through the large sums allocated, but that 'inom flera områden åläggs myndigheterna krav och tillförs finansiering i högre utsträckning än privata aktörer, vilket skapar ett gap', and that capability-raising preparedness measures 'är ofta inte marknadsmässiga' and therefore risk not being taken by private actors absent legal requirements or public financing. Förmågan inom det civila försvaret 2026, avsnitt 3.4 Privata aktörers förmåga · Myndigheten för civilt försvar (MCF) · 2026-05 <https://www.mcf.se/contentassets/0c836465399c40cb8f6d78132c899d8b/kompletterande-oppen-rapport.pdf>

[SV-10] Riksrevisionen's audit RiR 2025:4 (published 13 March 2025, covering 2015–2024) concludes that 'den statliga styrningen av uppbyggnaden av det civila försvaret inte har varit tillräckligt effektiv', citing unclear division of responsibility, vague mandates, short-term financing and structural reform arriving only in October 2022; earmarked civil-defence funding was absent 2015–2017 and about 400 MSEK per year from 2018. Den statliga styrningen av det civila försvarets uppbyggnad (RiR 2025:4) · Riksrevisionen · 2025-03-13 <https://www.riksrevisionen.se/granskningar/granskningsrapporter/2025/den-statliga-styrningen-av-det-civila-forsvarets-uppbyggnad.html>

[SV-11] The Riksdag's own follow-up of three beredskapssektorer (energiförsörjning, livsmedelsförsörjning och dricksvatten, transporter), RFR 2024/25:3, found much progress but reported that agencies experience 'very high pressure' to report to MSB, Regeringskansliet and Försvarsmakten which hampers capability development, significant recruitment difficulties over the past five years, absence of legislative preparatory materials creating uncertainty, and a request from all agencies for clearer ambition levels. Uppföljning av det civila försvaret – erfarenheter från tre beredskapssektorer (2024/25:RFR3) · Sveriges riksdag, Försvarsutskottet · 2024-10 <https://www.riksdagen.se/sv/dokument-och-lagar/dokument/rapport-fran-riksdagen/uppfoljning-av-det-civila-forsvaret-erfarenheter_hc0wrfr3/html/>

[SV-14] Försvarsmaktens årsredovisning 2025 reports that 8 136 conscripts began grundutbildning in 2025 across 26 locations, 93 percent of the 2024 intake completed training, and that the number of war-placed personnel in the war organisation rose to 75 400 in 2025 from 60 700 in 2024 and 59 500 in 2023; the army's most decisive challenges are stated as shortage of available qualified materiel and infrastructure, and over time a shortage of officers. Försvarsmaktens årsredovisning 2025 · Försvarsmakten · 2026-02 <https://www.forsvarsmakten.se/globalassets/02-om-forsvarsmakten/myndighetsinformation/dokument/arsredovisningar/2025/forsvarsmaktens-arsredovisning-2025.pdf>

[SV-15] The same annual report shows Försvarsmakten carried 780 MSEK of unspent funds from 2024 into 2025 and closed 2025 with 366 MSEK unspent on materiel and installations 'med anledning av leveransförseningar', and underspent one appropriation by 423 MSEK 'med anledning av förseningar från industrin'. Försvarsmaktens årsredovisning 2025, finansiell redovisning · Försvarsmakten · 2026-02 <https://www.forsvarsmakten.se/globalassets/02-om-forsvarsmakten/myndighetsinformation/dokument/arsredovisningar/2025/forsvarsmaktens-arsredovisning-2025.pdf>

[SV-16] On 26 June 2025 the government decided to create two new beredskapssektorer effective 22 July 2025 — Industri, byggande och handel (sector-responsible agency Tillväxtverket, with Boverket and Sveriges geologiska undersökning as preparedness agencies) and Utrikeshandel (Kommerskollegium, with Tullverket) — raising the number of preparedness sectors from ten to twelve. Nya beredskapssektorer ska stärka Sveriges civila försvar · Regeringen · 2025-06-26 <https://regeringen.se/pressmeddelanden/2025/06/nya-beredskapssektorer-ska-starka-sveriges-civila-forsvar/>

[SV-17] The final report of Utredningen om näringslivets försörjningsberedskap, SOU 2025:68 'Nya samverkansformer, modern byggnads- och reparationsberedskap', presented 9 June 2025, proposes a new system of försörjningsavtal between companies and the state, a byggnads- och reparationsberedskapskontor placed at Tillväxtverket, and an expanded mandate for RISE to maintain production-conversion capability during crisis, heightened readiness and war. Utredning föreslår nya åtgärder för att stärka näringslivets beredskap och motståndskraft (SOU 2025:68) · Regeringen / Statens offentliga utredningar · 2025-06-09 <https://www.regeringen.se/pressmeddelanden/2025/06/utredning-foreslar-nya-atgarder-for-att-starka-naringslivets-beredskap-och-motstandskraft/>

[SV-18] MSB presented the new edition of 'Om krisen eller kriget kommer' on 8 October 2024; over five million copies were distributed to Swedish households between 18 and 29 November 2024, the first update since 2018, adding sections on totalförsvarsplikt, psychological resilience, cyber security and shelter. En broschyr för allvarstid – ny upplaga av 'Om krisen eller kriget kommer' · Regeringen · 2024-10-08 <https://www.regeringen.se/pressmeddelanden/2024/10/en-broschyr-for-allvarstid--ny-upplaga-av-om-krisen-eller-kriget-kommer/>

[SV-20] FOI report FOI-R--5616--SE 'Det ekonomiska försvarets hotbilder: En kunskapsöversikt' (Jenny Ingemarsdotter, Ester Veibäck, Kristina Hellström, 31 March 2025, 68 pp.) examines the consequences for national threat assessment when the threat picture widens from armed attack to a broader geoeconomic hybrid-war context, and argues that Sweden as a small state with EU and NATO dependencies must retain independent national capacity for threat analysis. Det ekonomiska försvarets hotbilder: En kunskapsöversikt (FOI-R--5616--SE) · Totalförsvarets forskningsinstitut (FOI) · 2025-03-31 <https://foi.se/rapportsammanfattning?reportNo=FOI-R--5616--SE>

[SV-21] Sweden became a NATO member on 7 March 2024; the Defence Cooperation Agreement with the United States was signed on 5 December 2023 and entered into force on 15 August 2024, giving US forces access to agreed facilities and areas listed in an annex, subject to Swedish consent and Swedish law. Avtal om försvarssamarbete med USA (DCA) · Regeringen · 2024-08-15 <https://www.regeringen.se/regeringens-politik/militart-forsvar/avtal-om-forsvarssamarbete-med-usa-dca/>

Befolkningsskydd och skyddsrum

[SKYDD-1] Sweden has approximately 64,000 skyddsrum with places for 7 million people; the government proposed a new Act on shelters and 'protected spaces' (skyddade utrymmen) entering force 1 June 2026, and the underlying inquiry costed the reform at SEK 745–778 million per year, roughly SEK 3.8 billion over five years; the inquiry also found roughly 80 'specialskyddsrum' with places for just over 96,000 people, and estimated the need for volunteer local preparedness groups at just over 11,000 people against about 3,500 today. Regeringens proposition 2025/26:142 · Ett starkare skydd för civilbefolkningen vid höjd beredskap — Regeringskansliet / Försvarsdepartementet · 2026-02-19 <https://www.regeringen.se/contentassets/9809490635144f9d85ac282d9d780c5d/ett-starkare-skydd-for-civilbefolkningen-vid-hojd-beredskap-prop.-202526142.pdf>

[SKYDD-2] MCF's 2023 inventory of potential 'skyddade utrymmen' (tunnels, basements, garages) identified places for approximately 1,445,555 people, but only 57 per cent of Sweden's municipalities and 62 per cent of its regions contributed data to the reporting. Regeringens proposition 2025/26:142, avsnitt 4.3 Skyddade utrymmen · Regeringskansliet / Försvarsdepartementet · 2026-02-19 <https://www.regeringen.se/contentassets/9809490635144f9d85ac282d9d780c5d/ett-starkare-skydd-for-civilbefolkningen-vid-hojd-beredskap-prop.-202526142.pdf>

[SKYDD-3] The Riksdag approved the new Act on shelters and protected spaces on 29 April 2026, with entry into force 1 June 2026; the Act creates a second, weaker category of 'skyddade utrymmen' giving limited protection relative to skyddsrum, and clarifies the division of responsibility for evacuation (utrymning) and quartering (inkvartering). Ett starkare skydd för civilbefolkningen vid höjd beredskap · Betänkande 2025/26:FöU12 — Sveriges riksdag, Försvarsutskottet · 2026-04-29 <https://www.riksdagen.se/sv/dokument-och-lagar/dokument/betankande/ett-starkare-skydd-for-civilbefolkningen-vid-hojd_hd01f%C3%B6u12/>

[SKYDD-4] In July 2026 the government tasked Myndigheten för civilt försvar with strengthening shelter preparedness, restating that 'I Sverige finns idag cirka 64 000 skyddsrum med plats för ungefär 7 miljoner personer, som alla ska kunna användas vid höjd beredskap'; the municipal-support component is to be reported by 11 December 2026 and the remainder by 11 June 2027. Bättre skydd för civilbefolkningen genom stärkt skyddsrumsberedskap · Regeringskansliet · 2026-07 <https://www.regeringen.se/pressmeddelanden/2026/07/battre-skydd-for-civilbefolkningen-genom-starkt-skyddsrumsberedskap/>

[SKYDD-7] For 2025, SEK 100 million was allocated to inspecting and upgrading shelters; MSB planned to start 2,000 new control visits (kontroller) and ensure 10,000 new supervisions (tillsyner) during 2025, and of the roughly 80 large special shelters, work had begun on 25 — a project running over two to three years. Så går arbetet med upprustningen av landets skyddsrum · Myndigheten för civilt försvar (MCF) via Mynewsdesk · 2025-03-31 <https://www.mynewsdesk.com/se/mcf/pressreleases/saa-gaar-arbetet-med-upprustningen-av-landets-skyddsrum-3378378>

[SKYDD-8] In February 2024 MSB had two shelter inspectors for a stock of 64,000 shelters it aimed to inspect on a five-year cycle, judged it needed around 40, and the head of MSB's shelter unit and minister Carl-Oskar Bohlin both said the SEK 100 million allocated would not cover a total upgrade estimated at roughly SEK 4 billion. 64 000 skyddsrum ska inspekteras – MSB har två kontrollanter · SVT Nyheter · 2024-02-05 <https://www.svt.se/nyheter/inrikes/64-000-skyddsrum-ska-inspekteras-msb-har-tva-kontrollanter>

[SKYDD-11] Sweden's outdoor warning system (utomhusvarning, 'Hesa Fredrik') consists of about 4,200 ljudsändare; they exist in 236 of the country's 290 municipalities; approximately 50 per cent of the population lives within an area covered by the outdoor warning system; and in recent years the outdoor signal has been used on average about once a year. Viktigt meddelande till allmänheten – en översyn av VMA-systemet (Ds 2022:1) · Justitiedepartementet / Sveriges riksdag · 2022 <https://www.riksdagen.se/sv/dokument-och-lagar/dokument/departementsserien/viktigt-meddelande-till-allmanheten-en-oversyn_hab41/html/>

[SKYDD-12] Finland has around 50,500 civil defence shelters with space for about 4.8 million people; about 85 per cent are private reinforced-concrete shelters in individual buildings; under the Rescue Act shelters must be built in buildings of at least 1,200 m² used as dwellings or workplaces (1,500 m² for industrial buildings); shelters must be emptied and made usable within 72 hours; and they protect against 'explosions and splinters, collapse of buildings, blasts, radiation and substances hazardous to health'. Civil defence shelters would be used during military threat · Ministry of the Interior, Finland (Sisäministeriö) · 2025 <https://intermin.fi/en/rescue-services/preparedness/civil-defence-shelters>

[SKYDD-13] A Finnish national condition survey found shelter places for 60–80 per cent of the population in the majority of wellbeing services counties, with Helsinki at 34 per cent more places than population and South Ostrobothnia lowest at 48 per cent of population; about 85 per cent of Finnish shelters were built after 1971; the previous count of 54,000 shelters for 4.4 million people was revised to 50,500 shelters for 4.8 million. Finland has civil defence shelters for about 4.8 million people · Ministry of the Interior, Finland · 2023-02-09 <https://intermin.fi/en/-/finland-has-civil-defence-shelters-for-about-4.8-million-people>

[SKYDD-16] FOI concluded from the first months of the Ukraine war that air-raid alarms and civilian shelters played an important role, but that 'skyddsrummen har i detta avseende ett symbolvärde som är större än själva skyddet i sig', that the perceived need for shelter declines over time as people habituate to war, and that without functioning rescue services capable of clearing rubble and rescue 'blir skyddsrummen bokstavligt talat dödsfällor' — citing the bombing of the Mariupol theatre. Civilbefolkningens roll i framtida krig – Perspektiv på befolkningsskydd och civilt försvar i ljuset av Ukraina (FOI Memo 7843) · Totalförsvarets forskningsinstitut (FOI) · 2022-04 <https://www.foi.se/rest-api/report/FOI%20Memo%207843>

[SKYDD-18] All 349 skyddsrum on Gotland — covering 23,357 square metres with capacity for about 33,600 people, concentrated in Visby, Fårösund and Slite — were inspected and not a single one was approved without a deficiency order (föreläggande); typical faults were substandard sealing strips, unlubricated hinges, missing tools and improperly drilled cable penetrations. A 2022 report put the island at roughly 350 shelters with 35,000 places against just over 61,000 inhabitants. Inga skyddsrum klarade inspektionen · Hela Gotland (Gotlands Media) · 2017-09-21 <https://www.helagotland.se/nyheter/besiktigade-skyddsrum-gt/artikel/inga-skyddsrum-klarade-inspektionen/j8qw1ypj>

[SKYDD-20] The Bohlin inquiry, delivered 7 November 2022 as a 692-page report, recommended building 2,500–5,000 new shelter places per year for five consecutive years at an annual state cost of SEK 745–778 million, roughly SEK 3.8 billion (2022 values); as of April 2026 no new shelters had been constructed despite the recommendation being over three years old, and Gotland is singled out as particularly exposed. Utredning visar: tusentals skyddsrum saknas i Sverige · Forum Betong · 2026-04-07 <https://www.forumbetong.se/2026/04/07/tusentals-skyddsrum-saknas-visar-utredning/> Förbehåll: probable

Gråzon och Östersjön

[BALT-1] On 3 October 2025 the Helsinki District Court (case R 706-2025-12270) dismissed all charges against the Eagle S captain and two officers over the 25 December 2024 severing of Estlink 2 and four data cables, holding that under UNCLOS Art. 97(1) the incident was an 'incident of navigation' subject to exclusive flag-state jurisdiction, and that Finland's implementation of UNCLOS Art. 113 covers only Finnish vessels and nationals outside territorial waters. Anchoring Criminal Jurisdiction at Sea: The Helsinki District Court's Eagle S Judgement and its impact for the protection of submarine cables and pipelines · EJIL:Talk! (blog of the European Journal of International Law) — Tom Ruys and Christos Bamnios · 2025-10 <https://www.ejiltalk.org/anchoring-criminal-jurisdiction-at-sea-the-helsinki-district-courts-eagle-s-judgement-and-its-impact-for-the-protection-of-submarine-cables-and-pipelines/>

[BALT-2] The Helsinki District Court found the Eagle S anchor loss resulted from a technical fault rather than deliberate action, dismissed the case for lack of jurisdiction, and ordered the Finnish state to pay the defendants' legal costs of approximately EUR 195,000; Estlink 2 was out of service for over seven months with repair costs up to EUR 60 million; five cables were broken in total. Finnish Court Dismisses Case against Eagle S · Alleged Sabotage of Cables in the Baltic Sea — Submarine Networks · 2025-10 <https://www.submarinenetworks.com/en/nv/insights/finnish-court-dismisses-case-against-eagle-s>

[BALT-3] Finnish police (National Bureau of Investigation) stated on 9 May 2025 that 'the damage was caused by the anchor of the vessel Newnew Polar Bear flying the flag of Hong Kong', and that the investigation continues through a Finnish–Estonian joint investigation team with Chinese and Hong Kong authorities; Finland does not receive information on what investigative measures those authorities take. Cooperation in Balticconnector case to continue · Poliisi / Finnish Police (National Bureau of Investigation) · 2025-05-09 <https://poliisi.fi/en/-/cooperation-in-balticconnector-case-to-continue>

[BALT-4] Chronology of Baltic subsea incidents with outcomes: Nord Stream 1 & 2 (26 Sep 2022, Sweden confirmed deliberate explosives, Swedish/Danish investigations closed 2024); Balticconnector + telecoms cables (7–8 Oct 2023, NewNew Polar Bear); Lithuania–Sweden and Finland–Germany cables (17–18 Nov 2024, Yi Peng 3, Swedish inquiry found no conclusive evidence of deliberate damage); Estlink 2 + four telecoms lines (25 Dec 2024, Eagle S, case dismissed Oct 2025); Latvia–Gotland cable (26 Jan 2025, Vezhen, Swedish prosecutor ruled accidental); Finland–Estonia cables (30–31 Dec 2025, Fitburg); Lithuania–Latvia telecoms cable (2 Jan 2026, no evidence linking boarded ship). FACTBOX | Summary of suspected underwater cable/pipeline sabotage incidents in the Baltic Sea · Baird Maritime · 2026 <https://www.bairdmaritime.com/marine-projects/marine-infrastructure/factbox-suspected-underwater-cable-sabotage-in-the-baltic-sea>

[BALT-5] Estlink 2, the 650 MW Finland–Estonia HVDC link damaged on 25 December 2024, returned to commercial use on Friday 20 June 2025 — roughly six months out of service. Fingrid states 'the fault temporarily reduced the electricity transmission capacity between the countries by 650 megawatts.' EstLink 2 electricity transmission link returns to commercial use · Fingrid (Finnish transmission system operator) · 2025-06-20 <https://www.fingrid.fi/en/news/news/2025/estlink-2-electricity-transmission-link-returns-to-commercial-use/>

[BALT-6] NATO launched Baltic Sentry on 14 January 2025 at the Baltic Sea NATO Allies Summit in Helsinki, co-hosted by Rutte, President Stubb and PM Michal, deploying frigates, maritime patrol aircraft and a small fleet of naval drones. Rutte: 'Ship captains must understand that potential threats to our infrastructure will have consequences, including possible boarding, impoundment, and arrest.' NATO launches 'Baltic Sentry' to increase critical infrastructure security · NATO · 2025-01-14 <https://www.nato.int/en/news-and-events/articles/news/2025/01/14/nato-launches-baltic-sentry-to-increase-critical-infrastructure-security>

[BALT-7] NATO Allied Maritime Command (Lt Cdr Tim Pietrack) reported that between January 2025 and January 2026 Baltic Sentry cut response time to suspicious incidents from 17 hours to one hour, with a significant reduction in malicious sabotage against Baltic undersea infrastructure; a NATO military official cited 12 boardings under national authorities by allied nations in the past year. NATO Says Baltic Sentry Helped Slash Russian Undersea Infrastructure Sabotage, Cut Response Time to One Hour · UNITED24 Media (reporting NATO MARCOM) · 2026-06-18 <https://united24media.com/world/nato-says-baltic-sentry-helped-slash-russian-undersea-infrastructure-sabotage-cut-response-time-to-one-hour-19954>

[BALT-8] CSIS recorded Russian attacks in Europe rising from 3 (2022) to 12 (2023) to 34 (2024). Target breakdown 2022–2025: transportation 27%, government 27%, critical infrastructure 21%, industry 21%. Methods: explosives/incendiaries 35%, blunt/edged instruments including anchors 27%, electronic attack 15%, weaponised illegal immigrants 8%, firearms 2%. Inclusion required at least three credible sources for direct or indirect Russian government involvement; most cyber operations were deliberately excluded. Russia's Shadow War Against the West · Center for Strategic and International Studies (CSIS) — Seth G. Jones · 2025-03-18 <https://www.csis.org/analysis/russias-shadow-war-against-west>

[BALT-9] Atlantic Council issue brief (Elisabeth Braw, 26 November 2025) documents that in the Vezhen case 'the prosecutor couldn't prove that the bulker's crew had intentionally released the anchor'; that China blocked boarding of Yi Peng 3 until 20 December 2024 and then permitted only a limited supervised inspection; and that NewNew Polar Bear escaped to Russian waters with no charges. Counter-measures listed include CTF Baltic (October 2024), Baltic Sentry (January 2025), the Nordic Warden AI system, and the EU Action Plan on Cable Security (February 2025). How the Baltic Sea nations have tackled suspicious cable cuts · Atlantic Council · 2025-11-26 <https://www.atlanticcouncil.org/in-depth-research-reports/issue-brief/how-the-baltic-sea-nations-have-tackled-suspicious-cable-cuts/>

[BALT-10] Säkerhetspolisen's lägesbild 2025–2026 states: 'Ryssland bedriver hybrida aktiviteter som påverkansoperationer och sabotage riktade mot Europa'; 'Sedan den ryska invasionen av Ukraina är agerandet mer riskbenäget och opportunistiskt även utanför konfliktområdet'; a stated method is 'förbrukningsagenter' (disposable agents) recruited online for single tasks. Säpo also assesses that Sweden is currently not the primary target for Russian sabotage and influence operations in Europe. Ryssland, Kina och Iran · Säkerhetspolisen 2025–2026 — Säkerhetspolisen (Swedish Security Service) · 2025 <https://www.sakerhetspolisen.se/om-sakerhetspolisen/publikationer/sakerhetspolisens-lagesbilder/sakerhetspolisen-2025-2026/ryssland-kina-och-iran.html>

[BALT-11] Chronology of the September–October 2025 drone wave: Copenhagen Airport closed ~4 hours on 22 September (PM Frederiksen: 'the most serious attack on Danish critical infrastructure to date'); Aalborg and Billund closed 24–25 September, with reports at Sønderborg, Esbjerg and Skrydstrup; drone formations over Schleswig-Holstein including Thyssenkrupp marine facilities on 26 September; Ørland Main Air Station (Norway) 27 September; Munich Airport suspended operations twice within 24 hours 2–3 October. Over 500 drone reports were received nationally in Denmark within 24 hours in late September. As of late September Danish authorities had not publicly identified any perpetrator. 2025 Danish drone incidents / 2025 European drone sightings · Wikipedia (aggregating Danish police, Forsvarsministeriet, Reuters and DR reporting), 2025-2026 (news) <https://en.wikipedia.org/wiki/2025_Danish_drone_incidents> Förbehåll: probable

[BALT-12] On 31 December 2025 at 04:53 local time Elisa detected a fault on a Helsinki–Tallinn fibre cable in Estonia's EEZ; Finnish forces boarded the 132-metre St Vincent and Grenadines-flagged Fitburg (St Petersburg to Haifa, 14 Russian, Georgian, Azerbaijani and Kazakhstani crew). All 14 were detained; two arrested and two given travel bans. Investigation categories: aggravated criminal damage, attempted aggravated criminal damage, aggravated interference with telecommunications. Finnish Customs said the cargo was Russian-origin steel products subject to EU sectoral sanctions. Ship seized in Finland suspected of cable damage was carrying sanctioned Russian steel · Euronews · 2026-01-01 <https://www.euronews.com/2026/01/01/ship-seized-in-finland-suspected-of-cable-damage-was-carrying-sanctioned-russian-steel>

[BALT-13] On 5 February 2026 the European Commission adopted a Submarine Cable Security Toolbox of risk-mitigating measures, published a list of Cable Projects of European Interest, and amended the Connecting Europe Facility – Digital Work Programme to allocate EUR 347 million to strategic submarine cable projects, including a EUR 20 million call for European repair capacity opening the same day. Commission increases submarine cable security with €347 million investment and new toolbox · European Commission, DG CONNECT (Shaping Europe's digital future) · 2026-02-05 <https://digital-strategy.ec.europa.eu/en/news/commission-increases-submarine-cable-security-eu347-million-investment-and-new-toolbox>

[BALT-14] Researchers at Gdynia Maritime University (Jarosław Cydejko), the German Aerospace Center (Ralf Ziebold) and open-source analysts triangulated Baltic GNSS jamming to roughly one-kilometre precision using monitoring stations around Gdansk Bay in spring 2025, locating sources at Okunevo in Kaliningrad (near the 218th Independent Electronic Warfare regiment HQ, with GT-01 Murmansk-BN systems and 32-metre antennas visible in 2018 satellite imagery) and at Baltiysk, home of the Russian Baltic Fleet. An Estonian-directed jammer appeared to relocate from southwest to northwest of St Petersburg. Researchers home in on origins of Russia's Baltic GPS jamming · Defense News · 2025-07-02 <https://www.defensenews.com/global/europe/2025/07/02/researchers-home-in-on-origins-of-russias-baltic-gps-jamming/>

[BALT-15] Andreas Holmgren, head of aviation at the Swedish Transport Agency (Transportstyrelsen), said on 4 September 2025: 'We have done analyses over a longer period and collected data. We can conclude that the interference is originating from Russian territory.' Reported GNSS interference incidents in Swedish airspace rose from 55 in 2023 to 733 so far in 2025. Holmgren: 'This is a security risk for civil aviation, not least given the extent, duration and nature of the interference.' Sweden Accuses Russia of Widespread GPS Jamming Over Baltic Sea · The Moscow Times (reporting Transportstyrelsen) · 2025-09-04 <https://www.themoscowtimes.com/2025/09/04/sweden-accuses-russia-of-widespread-gps-jamming-over-baltic-sea-a90427>

[BALT-16] PST senior adviser Eirik Veum said on 1 October 2025 that of the drone observations reported over Norwegian airports and critical infrastructure — including Gardermoen, Ørland air station and the Sleipner platform — 'ingen av observasjonene er foreløpig bekreftet å ha tilknytning verken til statlige aktører' (none of the observations have so far been confirmed as linked to state actors), and no link had been established to similar observations in other countries. PST knytter foreløpig ikke droneobservasjoner til statlige aktører · Aftenposten (reporting Politiets sikkerhetstjeneste, Norway) · 2025-10-01 <https://www.aftenposten.no/norge/i/73b8wo/pst-knytter-foreloepig-ikke-droneobservasjoner-til-statlige-aktoerer>

[BALT-18] Russia operates approximately 591 shadow-fleet vessels, with 80–120 tankers being re-registered under the Russian Maritime Register of Shipping. When Eagle S was seized it contained 'advanced transmitting and receiving devices enabled for electronic surveillance' and an unauthorised Russian operator. In May 2025 Estonian forces attempted to detain the tanker Jaguar and a Russian Su-35S violated NATO airspace in response. On 1 October 2025 French naval forces boarded the tanker Boracay, which had loitered near Denmark during the September 2025 drone incidents, and found two Russian military contractors from Moran Security Group. A 2 July 2026 IISS report concluded shadow-fleet vessels 'likely served as the platform' for some drone operations. Russia's Baltic Maritime Insurgency · Small Wars Journal (Arizona State University) — Dan White and Gabriella Calder · 2026-08-13 <https://smallwarsjournal.com/2026/08/13/russias-baltic-maritime-insurgency/>

Norden och Nato

[NORD-2] The NORDEFCO Vision 2030 was signed on 30 April 2024 in Tórshavn, Faroe Islands, and covers eight areas: strategic dialogue and consultations; ability to conduct and command multinational combined operations; host nation support and logistical support; military mobility to, between and through the Nordic countries; capabilities based on strategic and operational requirements; defence materiel cooperation for increased interchangeability; security of military supplies for increased resilience; and total defence to secure adequate support to the defence sector from all sectors of society. Joint vision to enhance Nordic defence cooperation · Government Offices of Sweden (Regeringskansliet) · 2024-04-30 <https://www.government.se/articles/2024/04/joint-vision-to-enhance-nordic-defence-cooperation/>

[NORD-3] At the NORDEFCO Ministerial in Copenhagen on 21 November 2024 the Nordic defence ministers signed a Letter of Intent committing to 'the establishment of harmonized military corridors between the Nordic countries', signed a Letter of Intent on promoting the availability of Nordic airspace for NATO activities, endorsed initiatives to ramp up Nordic ammunition production, initiated Nordic cooperation on unmanned aerial systems, and stated they look forward to strengthening military cooperation 'in the framework of Joint Force Command Norfolk'. Declaration from the NORDEFCO Ministerial Meeting in Copenhagen 21 November 2024 · Finnish Ministry of Defence (Puolustusministeriö) · 2024-11-21 <https://defmin.fi/en/-/declaration-from-the-nordefco-ministerial-meeting-in-copenhagen-21-november-2024>

[NORD-4] The Nordic Defence Concept was signed on 20 September 2024 by the Chiefs of Defence of Denmark, Finland, Iceland, Norway and Sweden; it 'describes overarching principles of our regional cooperation, enhancing our capability to act together in all security situations, in peace, crisis and armed conflict' and serves the objectives of NORDEFCO Vision 2030. Joint Statement · Nordic Defence Concept — Danish Defence (Forsvaret) · 2024-09-20 <https://www.forsvaret.dk/da/opgaver/internationalt-samarbejde/nordefco/joint-statement--nordic-defence-concept/>

[NORD-5] NORDEFCO was established by a Memorandum of Understanding signed by all five Nordic nations on 4 November 2009; its structure comprises Ministers of Defence and Chiefs of Defence at the top, a Policy Steering Committee with policy (POL), armaments (ARMA) and capabilities (CAPA) branches, and a Military Coordination Committee with three work strands — Operational Planning (OP), Joint Support & Enablement (JS&E) and Capability Development (CAPDEV). About NORDEFCO · NORDEFCO · 2026 <https://nordefco.info/about-nordefco/>

[NORD-6] The Nordic defence ministers signed a revised NORDEFCO Memorandum of Understanding on 6 May 2025 in Rovaniemi, Finland — the first revision of the MoU since Finland and Sweden joined NATO; the chairmanship rotates annually (Sweden 2023, Denmark 2024, Norway 2026), and ministers met in Trøndelag, Norway on 5–6 May 2026. Nordic Defence Cooperation · Government Offices of Sweden (Regeringskansliet) · 2026 <https://government.se/government-policy/nordic-defence-cooperation/>

[NORD-8] The Haga III declaration, adopted at the Haga Ministerial Meeting on 27–28 November 2024 in Oslo, builds on Haga I (2009) and Haga II (2013) and commits the five Nordic ministries responsible for civil preparedness to 'an enhanced and coordinated Nordic crisis preparedness cooperation encompassing an all-hazards and whole-of-society approach', to 'facilitate and strengthen Nordic civil-military cooperation together with NORDEFCO', and to 'support the involvement of the civil sector in the Host Nation Support processes'. Haga III declaration for the Haga Ministerial Meeting on 27–28 November 2024 in Oslo · Myndigheten för civilt försvar (MCF, formerly MSB) / Nordic ministries responsible for civil preparedness · 2024-11-28 <https://www.mcf.se/siteassets/dokument/om-msb/internationella-samarbeten/haga-iii-declaration.pdf>

[NORD-9] Haga cooperation covers civil preparedness, civil protection and resilience; directors-general of the Nordic counterpart agencies meet at least once a year with a rotating chairmanship (Denmark chairs during 2026); Sweden and Finland additionally signed a bilateral joint declaration on 16 September 2024 deepening collaboration on civil protection and security of supply. The Haga cooperation · Myndigheten för civilt försvar (MCF), Sweden · 2026 <https://www.mcf.se/en/about-us/international-cooperation/nordic-cooperation/the-haga-cooperation/>

[NORD-10] On 16 March 2023 at Ramstein Air Base the air force commanders of Denmark, Finland, Norway and Sweden signed a Joint Declaration of Intent to link their air forces into a combined force of approximately 250 modern front-line combat aircraft, pursuing an integrated command structure for planning and executing air operations, a flexible and sustainable support system, joint air situational awareness, and joint training and exercises. Nordic nations move to link air forces into 250-strong aircraft fleet · Defense News · 2023-03-24 <https://www.defensenews.com/global/europe/2023/03/24/nordic-countries-move-toward-linking-their-air-forces-250-planes/>

[NORD-11] The Nordic Air Commanders' Intent established in March 2023 remains the framework for integrated Nordic air defence within NATO, with four operational lines of effort — integrated command, control and operational planning; flexible and resilient deployment; enhanced airspace surveillance cooperation; and expanded education, training and exercise collaboration — reaffirmed by the Nordic air chiefs meeting on Bornholm on 15 May 2025. Nordic air chiefs on Bornholm: Strengthening the defence of the Nordic region · Danish Defence (Forsvaret) · 2025-05-15 <https://www.forsvaret.dk/en/news/2025/nordic-air-chiefs-on-bornholm-strengthening-the-defense-of-the-nordic-region/>

[NORD-12] On 5 December 2025 NATO marked the realignment of Finland, Sweden and Denmark from Joint Force Command Brunssum to Joint Force Command Norfolk, whose area of responsibility then covered Denmark, Finland, Iceland, Norway, Sweden and the United Kingdom in addition to the Atlantic; the Finnish Chief of Defence General Janne Jaakkola stated that 'Finland is and will always be responsible for our own security and defence' and that collaboration with JFC Brunssum continues. Finland, Sweden and Denmark to be transferred to Joint Force Command Norfolk · Finnish Defence Forces (Puolustusvoimat) · 2025-12-05 <https://puolustusvoimat.fi/en/-/finland-sweden-and-denmark-to-be-transferred-to-joint-force-command-norfolk>

[NORD-14] The Helsinki District Court dismissed the charges against the captain and two officers of the tanker Eagle S on 3 October 2025, ruling that the Finnish Criminal Code could not be applied because of restrictions arising from the United Nations Convention on the Law of the Sea; the Deputy Prosecutor General announced an appeal on 9 October 2025. The alleged incident on 25 December 2024 damaged the Estlink 2 interconnector and data cables in the Gulf of Finland. Prosecutor appeals judgement in the Eagle S case · Finnish Government (Valtioneuvosto) · 2025-10-09 <https://valtioneuvosto.fi/en/-/11121156/prosecutor-appeals-judgement-in-the-eagle-s-case>

[NORD-15] Nordic joint procurement failed repeatedly across two decades: the Nordic Standard Helicopter Project (1998–2001) collapsed as participants chose different models; Norway then Denmark withdrew from the Viking submarine project; the Swedish-Finnish AMOS mortar failed; and in December 2013 Norway withdrew from both the ARCHER artillery project and the joint MAN truck procurement within days. Finland (1992), Norway (2008) and Denmark (2016) all rejected Sweden's JAS Gripen. Dahl writes that 'the nonalignment of two of the Nordic countries... puts a severe limit to how far defence integration and cooperation can go'. Back to the Future: Nordefco's First Decade and Prospects for the Next · Scandinavian Journal of Military Studies, vol. 4(1), pp. 172–182, DOI 10.31374/sjms.85 (author: Ann-Sofie Dahl) · 2021 <https://sjms.nu/articles/10.31374/sjms.85>

[NORD-16] Karsten Friis warns that 'a de facto NATO border might emerge in the Baltic Sea between JFC Norfolk and JFC Brunssum', identifies five risks to Nordic defence cooperation including nations pursuing capability growth at 'national level' rather than integrated procurement, a possible Nordic 'beauty contest' toward the United States, 'overstretch' from simultaneous NATO integration processes, and divergent deterrence postures (Finland versus Norway's nuclear restrictions and flight corridors near Russia); he also notes that before NATO accession 'Finnish and Swedish forces were not guaranteed to be available in the case of war, so Norway and Denmark could not make themselves militarily dependent on them'. Reviving Nordic Security and Defense Cooperation · Carnegie Endowment for International Peace · 2024-10-02 <https://carnegieendowment.org/research/2024/10/nordic-baltic-defense-cooperation-nato?lang=en>

[NORD-18] FOI's 95-page study of Nordic operational defence cooperation identified five areas of collaboration — established contacts and secure communications, simplified access and alternative basing, exercise exchange, sharing of surveillance data, and joint operations with combined forces — and concluded that differing alliance affiliations set the limits on Nordic cooperation ('olika allianstillhörigheter [sätter] gränser för nordiskt samarbete'). Nordiskt operativt försvarssamarbete · Nuläge och framtida utvecklingsmöjligheter (FOI-R--4628--SE) — Totalförsvarets forskningsinstitut (FOI); authors Johan Engvall, Eva Hagström Frisell, Madelene Lindström · 2018 <https://www.foi.se/rapportsammanfattning?reportNo=FOI-R%E2%80%934628%E2%80%93SE>

[NORD-19] The Nordic-Baltic Eight (NB8) comprises Denmark, Estonia, Finland, Iceland, Latvia, Lithuania, Norway and Sweden; formal cooperation dates from 1992 and the NB8 name was adopted on 30 August 2000. It is an informal format with no permanent structure, with an annually rotating coordinator (Denmark in 2025, Estonia from 1 January 2026). The Birkavs–Gade 'Wise Men' report, completed in August 2010, proposed 38 ways to deepen cooperation across foreign policy dialogue, civil and cyber security, defence, energy and NB8 branding. Nordic-Baltic Eight (NB8) · Ministry of Foreign Affairs of the Republic of Estonia (Välisministeerium) · 2026 <https://vm.ee/en/NB8>

[NORD-20] NATO Defence Planning Process (NDPP): fem steg genomforda over fyra ar — establish political guidance, determine requirements (konsoliderad lista), apportion requirements and set targets (Capability Target-paket till medlemslanderna), facilitate implementation, review results. Medlemslanderna fyller i Defence Planning Capability Survey (DPCS) vartannat ar, som samlar nationella planer och policyer inklusive insatser mot NATO Capability Targets, militar formaga och i forekommande fall civil kapacitet, samt forsvarsinvesteringar (personal, drift, materiel, forskning). Multilateral granskning gors i Defence Policy and Planning Committee (DPPC). Overenskommelser nas med 'consensus minus one' — enskilda lander kan inte veta beslut om sina egna Capability Targets. Capability Report godkanns av Nordatlantiska radet och endosseras av forsvarsministrarna, vanligen i juni udda ar. NATO Defence Planning Process · NATO · 2025-04-16 <https://www.nato.int/cps/en/natohq/topics_49202.htm>

[NORD-21] FOI 2013: 'Svenska forband varderas enligt OCC EoF (Nato, 2011) for att (1) kunna delta i Natoovningar, (2) sta i internationell beredskap, samt (3) ge till, och ta emot stod fran, andra nationer.' Rapporten atergiver enskilda utvarderingsfragor med paragrafnummer, t.ex. 'Does the unit have the capability to issue orders though a reliable and interoperable CIS C2 network?' (avsnitt LAND-TT 5.4.2A1) och 'Does the staff use the appropriate tactical symbols in order to depict the current situation?'. Kallforteckningen namnger primardokumenten 'ACO Forces Standards vol.7/Unit (CREVAL) SEPT 2012 DRAFT' och 'Operational Capabilities Concept Evaluation and Feedback (OCC E&F) Programme Handbook version 2.0'. Om nyttan med tekniska stödsystem för taktisk stridsledning (FOI-R--3826--SE) · Totalförsvarets forskningsinstitut (FOI), kund Försvarsmakten · 2013-12 <https://www.foi.se/rest-api/report/FOI-R--3826--SE>

Vård och masskadeutfall

[VARD-1] NATO's medical planning standard is the 10-1-2(+2) timeline: life-saving first response within 10 minutes of wounding, advanced resuscitation and pre-hospital emergency care within 1 hour, life/limb/function-preserving surgery no later than 2 hours, and further stabilising surgical/specialist care within 2 hours of tactical evacuation after damage control surgery; Role 4 (full spectrum, reconstructive surgery, prosthetics, rehabilitation) is a national responsibility normally provided by hospitals in the casualty's country of origin or at a regional hub. AJP-4.10 Allied Joint Doctrine for Medical Support, Edition C Version 1 (STANAG 2228) · NATO Standardization Office · 2019-09-11 <https://www.coemed.org/files/stanags/01_AJP/AJP-4.10_EDC_V1_E_2228.pdf>

[VARD-2] AJP-4.10 para 2.23 states that the quality of medical records has significant impact on quality of care and that in a multinational environment medical documentation 'requires common standards concerning language, key information and formats to be interoperable throughout the theatre of operations and in all national contingents'; para 2.24 adds that national legal requirements on protection and sharing of medical information must be adhered to and 'may differ between troop contributing nations'. AJP-4.10 Allied Joint Doctrine for Medical Support, Edition C Version 1, Chapter 2 (Medical Information Management) · NATO Standardization Office · 2019-09-11 <https://www.coemed.org/files/stanags/01_AJP/AJP-4.10_EDC_V1_E_2228.pdf>

[VARD-5] Exercise Casualty Move 2024 (CAMO 24), held in Sweden from 9 September 2024, involved more than 150 people from 16 countries in a scenario evacuating patients from northern Finland and the Baltics; the exercise revealed that 'de olika journalsystemen uppges inte matcha med varandra' (the different medical record systems do not match each other) and that military and civilian healthcare use different terms for injuries. Socialstyrelsen's preparedness chief Taha Alexandersson said that if thousands of patients need care during transport, transport quantity must increase. Brister kring sjuktransporter och kommunikation vid stor Natoövning · Läkartidningen · 2024-09-13 <https://lakartidningen.se/aktuellt/nyheter/2024/09/brister-kring-sjuktransporter-och-kommunikation-vid-stor-natoovning>

[VARD-6] CAMO 24 was Sweden's first host-nation exercise since joining NATO; Sweden acted as host and transit nation with international patient-flow coordination through a multinational medical coordination centre (MMCC/EMC) based in Sweden, with Socialstyrelsen coordinating between healthcare regions and liaising with military medical units. The exercise sought to test Sweden as a transit country with two hubs, a larger one in Mälardalen and a smaller one in northern Sweden. Sjukvården i fokus i svensk Natoövning · Socialstyrelsen · 2024-09 <https://www.socialstyrelsen.se/om-socialstyrelsen/pressrum/press/sjukvarden-i-fokus-i-svensk-natoovning/>

[VARD-9] Socialstyrelsen's dimensioning targets for civil defence healthcare planning set the civilian war injury panorama for adults 18+ as 26% head/neck, 18% thorax, 10% abdomen/back and 50% extremities (arms 32%, legs 18%), with about 5% of injured adults suffering burns and about 60% showing acute psychiatric reactions; 23% of the injured are children under 18, of whom about 12% suffer burns and about 47% acute psychiatric reactions. The military injury panorama is 20% head/neck, 10% thorax, 10% abdomen/back, 60% extremity, 10% other. The actual military casualty numbers (bilaga 4) are classified under 15 kap. 2 § offentlighets- och sekretesslagen (2009:400). The report notes that neither WHO, NATO nor ICRC has published forward-looking models for civilian casualty estimation in open sources. Nyckeltal och dimensionerande målbilder för hälso- och sjukvårdens planering för civilt försvar · Slutredovisning av regeringsuppdrag, artikelnummer 2023-12-8916 — Socialstyrelsen · 2023-12-20 <https://www.socialstyrelsen.se/contentassets/3f81af9cc1fd4023812b1603921ce0e2/2023-12-8916.pdf>

[VARD-10] Försvarsberedningen's report estimates 20,000–30,000 dead and wounded civilians and soldiers if fighting occurred on Swedish territory over several weeks, and recommends designated beredskapssjukhus in each civilområde, notably on Gotland and in northern Norrland. Disaster medicine professor Andreas Wladis states Sweden would have to shut down very large parts of Swedish healthcare and that the country is 'absolut inte' prepared and will not be for years. Rapport: Beredskapssjukhus bör finnas i Norrland och på Gotland · Läkartidningen · 2024-02-15 <https://lakartidningen.se/nyheter/rapport-beredskapssjukhus-bor-finnas-i-norrland-och-pa-gotland/>

[VARD-12] Läkarförbundet's 2025 survey found that only about one third of Swedish doctors say their employer has concrete plans for how work should be conducted in an acute crisis or war situation; 17% both have such an employer and knew well what they were expected to do; and only 7% answered yes to all three questions — plans exist, they know their role, and they have taken part in crisis exercises. The report states that according to Socialstyrelsen's benchmark values there is an immediate need to increase the number of available hospital beds by 15% under normal conditions. Läkarförbundet granskar: Vårdens beredskap för kris eller krig · Sveriges läkarförbund · 2025-01 <https://slf.se/app/uploads/2025/01/lakarforbundet-granskar-varden-kris-och-krig-rappport-webb.pdf>

[VARD-14] Each of Sweden's two burn centres (Akademiska sjukhuset in Uppsala and Universitetssjukhuset in Linköping) can handle eight severely burned patients in a mass casualty incident; roughly 500 severely burned patients receive inpatient care annually at the two centres. An Akademiska R&D project mapped material, medicine and personnel needs from patient records and simulation systems 'dag för dag, timme för timme', finding that eight moderately-to-severely burned patients over the first two weeks require 17,000 examination gloves, 597 litres of Ringer-acetate and 5,546 intensive care nursing hours. Brännskadecentrum rustar för bättre beredskap · Akademiska sjukhuset / Region Uppsala (via TT) · 2024-08-15 <https://via.tt.se/pressmeddelande/3572657/brannskadecentrum-rustar-for-battre-beredskap?publisherId=3235843&lang=sv>

[VARD-15] Sweden's national alarm plan for severe burns routes 1–2 severely burned patients directly between the affected region and one of the two burn centres, and triggers national coordination at 3 or more; for events outside Sweden the alarm goes via Socialstyrelsen's TiB. The plan includes a triage decision table allocating care by expected survival against resource need across age bands and burned body surface area. Diarienummer RS 2016-108; valid from 2013-11-15, last revised 2022-02-09, with validity stated as expiring 2024-02-09. Nationell högspecialiserad vård av svåra brännskador · Larmplan och nationell samordning — Socialstyrelsen / Brännskadecentrum Region Uppsala och Region Östergötland · 2022-02-09 <https://www.socialstyrelsen.se/globalassets/sharepoint-dokument/dokument-webb/ovrigt/krisberedskap-rikssjukvard-av-brannskador-nationell-larmplan.pdf>

[VARD-16] Sweden has 26 blodverksamheter across six sjukvårdsregioner. Approved donors are held only in local registers at each blood establishment; there is no national register, and regions cannot see each other's registers, so a donor generally cannot give blood in another region without being assessed as new. The guest-donation system Samverkande Blodsystem (SBS) covers roughly half of Sweden's regions and, per Socialstyrelsen's environmental scanning, 'saknar teknisk kapacitet att göra flera anrop/förfrågningar samtidigt i den omfattning som skulle behövas vid krissituationer eller krig'. Regions currently telephone one another to ask about stocks when their own blood inventories run low. Nationellt register över blodgivare och plan för ökad kapacitet (regeringsuppdrag S2021/02921 delvis) · Socialstyrelsen · 2022 <https://www.socialstyrelsen.se/globalassets/sharepoint-dokument/dokument-webb/ovrigt/nationellt-register-over-blodgivare-och-plan-for-okad-kapacitet.pdf>

[VARD-17] Sweden had 195,081 active blood donors and 355,287 registered donors in 2023; Socialstyrelsen judges that the number needs to roughly double to about 400,000 active donors, equal to 5% of the population. Around one blood bag is used every minute in Sweden; about 50% goes to cancer and chronic disease treatment and about 10% to intensive care. 64% of the population say they are willing to donate but only 3% do. Socialstyrelsen: fördubbla antalet blodgivare · Socialstyrelsen · 2024-06-14 <https://www.socialstyrelsen.se/om-socialstyrelsen/pressrum/press/socialstyrelsen-fordubbla-antalet-blodgivare/>

[VARD-18] A Läkartidningen review by Wikman, Aspevall Diedrich, Norda, Bäckström, Wladis and Nimberger Hansson found Sweden has no national emergency plan for blood supply, that regional and local plans are limited, that only 17 of 26 blood establishments take part in disaster drills, and that hospital blood stocks correspond to 1–3 weeks of normal consumption. Reported transfusion demand per casualty was 1.3 red cell units in Israeli bombing attacks 2000–2005 (6.7 among moderately-to-severely injured), 4.8 units per patient in the Paris 2015 attacks and 3.7 units per patient in Nice 2016. Only six ambulance helicopters and one physician-staffed vehicle carried blood products prehospitally; France and Germany are the sole producers of lyophilised plasma. Blodförsörjning vid katastrofer – en nationell beredskap behövs · Läkartidningen (Klinik och vetenskap, temaartikel) · 2021-03-16 <https://lakartidningen.se/klinik-och-vetenskap-1/artiklar-1/temaartikel/2021/03/blodforsorjning-vid-katastrofer-en-nationell-beredskap-behovs>

[VARD-20] By 2022 Ukraine's national electronic healthcare system held 36 million registered patients, more than 1.6 billion electronic medical records and 400,000 active users. During the full-scale war the central database remained functional, but the peripheral medical information system vendor ecosystem collapsed: 'of the 40 MISs before the war, only four to six will probably survive', driven by destroyed infrastructure, financial losses and evacuation of IT specialists. The future of Ukrainian healthcare: the digital opportunity · Journal of Global Health (DOI 10.7189/jogh.15.03039) · 2025-10-03 <https://jogh.org/2025/jogh-15-03039>

[VARD-21] WHO has verified more than 3,000 attacks on health care in Ukraine over 1,534 days since the full-scale invasion, of which roughly 80% affected outpatient clinics, hospitals and other care settings and around 20% targeted ambulances and health vehicles, with nearly one third of transport attacks causing casualties. In 2026 to 8 May, 186 verified attacks caused 15 deaths and at least 81 injuries; deaths rose nearly fourfold and injuries almost doubled versus the same period in 2025. 3000 attacks on health care in Ukraine verified by WHO since full-scale invasion · World Health Organization Regional Office for Europe · 2026-05-08 <https://www.who.int/europe/news/item/08-05-2026-3000-attacks-on-health-care-in-ukraine-verified-by-who-since-full-scale-invasion>

[VARD-24] 1177 Journalen lets residents aged 16+ view visit notes, vaccinations, referrals, diagnoses, dental care, medicines and lab results; all Swedish regions display information from their systems, but each care provider independently decides what to display and when, so coverage varies. The service holds no centralised copy — it is 'ett fönster' into the providers' own systems, reading data directly from them. Journalen (1177) · Inera AB · 2025 <https://www.inera.se/tjanster/alla-tjanster-a-o/journalen/>

El, nät och telekom

[EL-1] The ENTSO-E Expert Panel's final report on the 28 April 2025 Iberian blackout, published 20 March 2026, concluded the blackout resulted from a combination of interacting factors: oscillations, gaps in voltage and reactive power control, differences in voltage regulation practices, rapid output reductions and generator disconnections in Spain, and uneven stabilisation capabilities, which led to fast voltage increases and cascading generation disconnections; the panel comprised 49 members including TSOs, Regional Coordination Centres, ACER and national regulators. ENTSO-E Publishes Expert Panel Final Report on 28 April 2025 Blackout in Spain and Portugal · ENTSO-E (European Network of Transmission System Operators for Electricity) · 2026-03-20 <https://www.entsoe.eu/news/2026/03/20/entso-e-publishes-expert-panel-final-report-on-28-april-2025-blackout-in-spain-and-portugal/>

[EL-2] The blackout of continental Spain and Portugal occurred on 28 April 2025 at 12:33 CEST and is described by ENTSO-E as 'the most severe blackout incident on the European power system in over 20 years, and the first ever of its kind'; a small area of southwest France near the Spanish border experienced brief disruption while the rest of Europe's system was unaffected. The Expert Panel's factual report was published 3 October 2025 and the final report 20 March 2026. 28 April 2025 Iberian Blackout · ENTSO-E · 2026-03-20 <https://www.entsoe.eu/publications/blackout/28-april-2025-iberian-blackout/>

[EL-3] Svenska kraftnät's Nätutvecklingsplan 2026–2035, published 15 December 2025, plans approximately 2,900 km of new transmission lines and approximately 40 new stations over ten years, plus reinvestment in over 1,100 km of lines and roughly half of its approximately 200 stations. Annual facility investment rises from 9 billion SEK in 2025 to 20 billion SEK per year in 2026 and 2027. Investment drivers: reinvestment in ageing infrastructure 45%, system strengthening for capacity and operational security 36%, connections for new production/consumption 14%, market integration 5%. The plan states requested electricity demand is more than twice today's peak load hour in Sweden. Nätutvecklingsplan 2026–2035 – en plan för Sveriges samhällsbyggnad · Svenska kraftnät · 2025-12-15 <https://www.svk.se/om-oss/rapporter-och-remissvar/natutvecklingsplan/>

[EL-4] Svenska kraftnät cancelled its procurement of the strategic reserve (effektreserv) for the winter 16 November 2025 – 15 March 2026, announced 7 October 2025, leaving Sweden without a strategic reserve. Up to 800 MW was sought; all three bids received, all from existing electricity production, exceeded the EU-mandated price cap. Svenska kraftnät's Malin Stridh stated the regulatory framework 'makes it in principle impossible to procure a strategic reserve'. Operations chief Pontus de Maré called the situation 'concerning', noting Svenska kraftnät could order manual load shedding (manuell förbrukningsfrånkoppling), a measure never previously used. Sverige står utan elreserv i vinter · Svenska kraftnät · 2025-10-07 <https://www.svk.se/press-och-nyheter/nyheter/allmanna-nyheter/2025/sverige-star-utan-elreserv-i-vinter/>

[EL-5] Svenska kraftnät's final report to government (ärende Svk 2023/2801, dated 30 September 2024) sets transmission capacity targets in MW between Swedish bidding zones against maximum allocated NTC in 2021–2023. Verbatim table: SE1→SE2 3,300 MW (2021–23) → 3,300 (2030) → 3,300 (2035) → 3,700 (2040) → 4,000 (2045); SE2→SE1 3,300 → 3,300 → 5,500 → 6,500 → 7,500; SE2→SE3 7,300 → 8,100 → 9,600 → 10,500 → 10,500; SE3→SE2 7,300 → 7,300 → 7,300 → 7,300 → 7,300; SE3→SE4 5,600 → 6,200 → 6,200 → 6,200 → 6,200; SE4→SE3 2,800 → 2,800 → 3,300 → 3,500 → 3,600. Targets take into account the government's assessment of electricity need of at least 300 TWh in 2045. Mål för ökning av överföringskapaciteten mellan Sveriges elområden – Slutrapportering av regeringsuppdrag · Svenska kraftnät · 2024-09-30 <https://www.svk.se/siteassets/om-oss/rapporter/2024/uppdrag-att-satta-mal-for-okning-av-overforingskapacitet_slutrapport.pdf>

[EL-6] The Nordic TSOs (Energinet, Fingrid, Svenska kraftnät, Statnett), in 'Requirements for minimum inertia in the Nordic power system' dated 28 August 2025 by the Nordic Analysis Group, conclude there is no need to define a minimum inertia for the Nordic synchronous system for the coming two years. The reference incident is disconnection of the Oskarshamn 3 unit at maximum 1,450 MW; the instantaneous frequency minimum must not fall below 49.0 Hz. Design kinetic energy for FCR-D performance is 150 GWs; the stability level is 120 GWs; analyses show stability is challenged around 90 GWs. Nordic TSOs implemented real-time kinetic energy estimation in their SCADA/EMS in 2015 and forecast inertia a week ahead to size Fast Frequency Reserve. Requirements for Minimum Inertia in the Nordic Power System · Nordic Analysis Group / ENTSO-E (hosted by Fingrid) · 2025-08-28 <https://www.fingrid.fi/globalassets/dokumentit/fi/tiedotteet/2025---requirements-for-minimum-inertia-in-the-nordic-power-system.pdf>

[EL-7] Svenska kraftnät states that the most central prerequisite for ö-drift (islanding) is local electricity production capable of black start from a dead grid, and that production and consumption must be balanced completely and continuously throughout. It describes islanding as under development through preliminary studies and testing, states that full-scale islanding cannot be exercised 'sharply' ('Det går inte att öva ö-drift skarpt helt och hållet'), that its function cannot be guaranteed with one hundred percent certainty, that scope is local and regional islands within single communities or municipalities rather than nationwide, and that it requires very harsh prioritisation of who receives electricity and involves operating a weak grid which is complicated and risky. Om ö-drift · Svenska kraftnät · 2026 <https://www.svk.se/sakerhet-och-beredskap/elberedskap/om-odrift/>

[EL-8] On 17 March 2026 Svenska kraftnät announced a new strategic direction for Gotland's electricity supply: it will take responsibility for robust supply to the island by 2030, when a new main-grid connection consisting of two 220 kV cables becomes operational, expanding the transmission grid to include the island. Vattenfall operates the existing cables and one HVDC connection to the mainland, which Svenska kraftnät will not take over. Stated rationale: Gotland's strategically important role in Sweden's total defence, geographic isolation making its supply more vulnerable than other regions, and the changed security situation. Svenska kraftnät notes that more serious disturbances and heightened alert situations require additional robustness beyond the redundancy the new cables plus existing HVDC provide. Ny strategisk inriktning för elförsörjningen till Gotland · Svenska kraftnät (via TT) · 2026-03-17 <https://via.tt.se/pressmeddelande/4289066/ny-strategisk-inriktning-for-elforsorjningen-till-gotland>

[EL-9] The Aurora Line, a 400 kV interconnector over 380 km between the Messaure substation in Sweden and the Pyhänselkä substation in Finland, built by Svenska kraftnät and Fingrid Oyj, was officially commissioned on 12 November 2025, ahead of the initial schedule. It increases cross-border transmission capacity by up to 800 MW from Sweden to Finland and 900 MW in the opposite direction, and received over EUR 131 million in EU Connecting Europe Facility (CEF) funding. CEF Energy: the Aurora Line interconnector enters operation ahead of schedule · CINEA – European Climate, Infrastructure and Environment Executive Agency · 2026-02-20 <https://cinea.ec.europa.eu/news-events/news/cef-energy-aurora-line-interconnector-enters-operation-ahead-schedule-2026-02-20_en>

[EL-10] PTS registered 334 incident cases in 2025, of which 327 were finally assessed as reportable incidents. Of these, 28 cases were security incidents (säkerhetsincidenter) — of 31 initially registered, 28 were judged genuine. Root causes of the 28: 14 system errors and 8 third party. Five of the 28 affected societal functions. PTS reports continued low reporting of security incidents caused by power outages (strömavbrott). Outages arose where a redundant cable either did not work, was missing, or was placed so close to the ordinary cable that both were damaged. In December 2025 PTS fined Tele2 8.1 million SEK in sanction fees. Incident- och tillsynsrapport inom området säker kommunikation 2025 (PTS-ER-2026:10) · Post- och telestyrelsen (PTS) · 2026-04-08 <https://pts.se/contentassets/474ed0f35a9f4b499c87c46d69b62f34/slutlig_incident--och-tillsynsrapport-inom-omradet-saker-kommunikation-2025.pdf>

[EL-15] A ransomware attack on Swedish IT supplier Miljödata, detected Saturday 24 August 2025, affected approximately 200 of Sweden's 290 municipalities and 21 regions. Compromised data was employee-related HR information including medical certificates, rehabilitation plans, work-related injuries and sick-leave management records. Sweden's civil defence minister stated CERT-SE offered advice and support to the company and affected customers. Hundreds of Swedish municipalities impacted by suspected ransomware attack on IT supplier · The Record (Recorded Future News) · 2025-08-27 <https://therecord.media/sweden-municipalities-ransomware-software>

[EL-16] As of Q1 2025, the top five RAN vendors controlled 93% of RAN sales, while Open RAN challengers held a combined 7% market share, approximately $2.5 billion in annual revenues. Ericsson and Nokia together spend about $5 billion annually on R&D supporting their mobile network units. Ericsson holds over 50% market share in North America, potentially as high as 70% according to Dell'Oro analyst Stefan Pongratz. How Ericsson and Nokia vanquished the open RAN threat · Light Reading (Iain Morris, International Editor) · 2025-06-26 <https://www.lightreading.com/open-ran/how-ericsson-and-nokia-vanquished-the-open-ran-threat>

[EL-18] EASA Safety Information Bulletin 2022-02R4, issued 3 July 2026, addresses GNSS outages and alterations, distinguishing jamming (intentional radio frequency interference preventing signal reception) from spoofing (broadcasting counterfeit satellite signals causing incorrect position and navigation data). It identifies regions with notable increases in interference since February 2022: the Mediterranean, Black Sea, Middle East, Baltic Sea and Arctic. Flight Information Regions specifically named include ESAA (Sweden), EFIN (Helsinki), EETT (Tallinn), EVRR (Riga) and EYVL (Vilnius). EASA publishes 7-day and 30-day FIR impact rankings based on ADS-B data. Global Navigation Satellite System outages and alterations (SIB 2022-02R4) · EASA – European Union Aviation Safety Agency · 2026-07-03 <https://www.easa.europa.eu/en/domains/air-operations/global-navigation-satellite-system-outages-and-alterations>

[EL-19] Styrel ar 'ett systematiskt satt att identifiera och prioritera samhallsviktiga elanvandare' infor manuell forbrukningsfrankoppling. Framtaget av Energimyndigheten tillsammans med MSB och Svenska kraftnat. Myndigheter, lansstyrelser, kommuner, elnatsforetag och privata aktorer samverkar om prioriteringen. Vilar pa forordning (2011:931) och foreskrift STEMFS 2013:4. Planeringsomgang 2023-2025. Styrel — prioritering av samhällsviktiga elanvändare · Energimyndigheten · 2026-01-30 <https://www.energimyndigheten.se/energiberedskap/energiberedskap-for-offentlig-sektor/styrel/>

Livsmedel och insatsvaror

[MAT-1] Swedish agriculture, aquaculture and fisheries produced 3,530 kcal per person per day on average 2013–2023 (net of waste in all stages up to consumer), enough to theoretically feed about 14 million people in an average year; Skåne and Västra Götaland together accounted for 52% of total food production in 2023 and Götaland for about 78% of produced calories. Livsmedelsförsörjningen i siffror – Nyckeltal och indikatorer (NIL 2025) · Livsmedelsverket & Jordbruksverket · 2025 <https://www.livsmedelsverket.se/globalassets/publikationsdatabas/rapporter/2025/2025---livsmedelsforsorjningen-i-siffror.pdf>

[MAT-2] Sweden has no domestic mineral fertiliser production at all. Of nutrients used in 2021, 87% of nitrogen (203,000 t N), 46% of phosphorus (31,000 t P) and 24% of potassium (122,000 t K) came via foreign trade. 1.2 million tonnes of mineral fertiliser product was imported in 2024, with Germany and Finland supplying 62%. Belarus and Russia averaged ~22% of imported volume 2014–2021 and near zero 2022–2024, while the EU as a whole still imported 3.9 million tonnes from Russia in 2023 (~24% of EU fertiliser imports). Livsmedelsförsörjningen i siffror (NIL 2025), section 3.5.2.3 Gödning · Livsmedelsverket & Jordbruksverket · 2025 <https://www.livsmedelsverket.se/globalassets/publikationsdatabas/rapporter/2025/2025---livsmedelsforsorjningen-i-siffror.pdf>

[MAT-3] Seed dependency is highly crop-specific: of seed used in Sweden in 2021, 3% of cereal seed (180,000 t) was imported, but 70% of oilseed seed (613 t), 97% of sugar-beet seed (87 t) and 18% of ley-grass seed (82 t) came via foreign trade. Plant protection products are 100% imported with no production in Sweden — 1,766 t herbicides, 209 t fungicides and 34 t insecticides used in 2021. Livsmedelsförsörjningen i siffror (NIL 2025), sections 3.5.2.2 Utsäde and 3.5.2.4 Växtskyddsmedel · Livsmedelsverket & Jordbruksverket · 2025 <https://www.livsmedelsverket.se/globalassets/publikationsdatabas/rapporter/2025/2025---livsmedelsforsorjningen-i-siffror.pdf>

[MAT-4] 91% of fuels used in Sweden came via foreign trade in 2024, with domestic biofuel production of 22 TWh (partly from imported feedstock). Sweden is obliged under the IEA International Energy Program agreement and EU directive 2009/119/EC to hold emergency stocks equal to 90 days of net fuel imports. 70% of the 675,000 t of protein feed used in 2021 was imported, versus only 2% of the 2,300,000 t of feed grain. Livsmedelsförsörjningen i siffror (NIL 2025), sections 3.5.1.1 Drivmedel and 3.5.2.1 Foder · Livsmedelsverket & Jordbruksverket · 2025 <https://www.livsmedelsverket.se/globalassets/publikationsdatabas/rapporter/2025/2025---livsmedelsforsorjningen-i-siffror.pdf>

[MAT-5] Swedish state food preparedness stockpiling ceased entirely at the turn of the year 2001. The 1987 and 1990 decisions had dimensioned stocks for four weeks of isolation plus five months of vegetable raw materials for industry, at an operating cost of about SEK 175 million per year in the early 1990s (about SEK 315 million in 2023 prices). The wind-down of food and food raw materials concluded in 2001 and generated total revenue of about SEK 1.1 billion. Post-war stockpiles had been dimensioned for a one-year blockade with imports cut to 25–30% of normal, equal to roughly two months of consumption measured in calories. Livsmedelsberedskap för en ny tid (SOU 2024:8), chapter 8.2 · Statens offentliga utredningar / Regeringskansliet · 2024-02 <https://www.regeringen.se/contentassets/fc08dfb51d014b3996b719005beb146f/livsmedelsberedskap-for-en-ny-tid-sou-20248.pdf>

[MAT-6] As of the 2024 inquiry, Sweden had no preparedness stockholding whatsoever: "Beredskapslagringen var tidigare omfattande i Sverige. Även om det finns en viss lagringskapacitet i det svenska livsmedelssystemet i dag, så är det främst omsättningslager inom företagens verksamhet. Lagerhållning för beredskapsändamål saknas helt." Swedish total defence planning is dimensioned to handle a security crisis for at least three months. The inquiry also warns that stockpiling "kan minska motivationen att vidta alternativa åtgärder och kan därmed bidra till att försena mer långsiktiga lösningar." Livsmedelsberedskap för en ny tid (SOU 2024:8), chapters 8.1–8.3 · Statens offentliga utredningar / Regeringskansliet · 2024-02 <https://www.regeringen.se/contentassets/fc08dfb51d014b3996b719005beb146f/livsmedelsberedskap-for-en-ny-tid-sou-20248.pdf>

[MAT-7] Finland's state security stockpiles hold grain for human consumption equal to six months of average consumption, expanded during 2022 by a further 2.5 months, plus certified seed, protein crops and other goods needed to sustain primary production. Finland's protective stockpile system covers 174 listed products under contracts between the state and companies. Switzerland's mandatory stocks are dimensioned for 3–4 months of normal consumption at a total cost of about CHF 13 per person per year, of which food is about 40% of stock value — roughly CHF 5, or about SEK 60, per person per year. Livsmedelsberedskap för en ny tid (SOU 2024:8), chapters 8.5.2–8.5.3 · Statens offentliga utredningar / Regeringskansliet · 2024-02 <https://www.regeringen.se/contentassets/fc08dfb51d014b3996b719005beb146f/livsmedelsberedskap-for-en-ny-tid-sou-20248.pdf>

[MAT-8] The four northernmost counties (Västernorrland, Jämtland, Västerbotten, Norrbotten) have essentially no cultivation of grain for food purposes, no grain storage capacity intended for food-grade grain, and no grain mills at all; the grain grown there is used exclusively for feed. Jordbruksverket proposes prioritising these counties for grain preparedness stockpiling and states mobile mills must be secured there. A December 2024 market survey found most interested companies could not rotate such stocks, with one willing to invest. Uppbyggnad av livsmedelsberedskapen 2024 – Redovisning av regeringsuppdrag · Livsmedelsverket (beredskapssektorn livsmedel) · 2025 <https://www.livsmedelsverket.se/globalassets/publikationsdatabas/rapporter/2025/uppbyggnad-av-livsmedelsberedskapen-2024.pdf>

[MAT-9] Finland's National Emergency Supply Agency maintains emergency grain stockpiles of at least six months of regular human consumption per the Government Decision on the Objectives of Security of Supply, and in December 2022 launched procurement of Finnish-grown oats, wheat and barley equal to approximately 2.5 months of average consumption, bringing the total to approximately 8.5 months. In spring 2022 Finland released about 8,500 tonnes of spring grains from the stockpiles. National Emergency Supply Agency boosting Finland's emergency grain stockpiles · Huoltovarmuuskeskus (National Emergency Supply Agency, Finland) · 2022-12-15 <https://www.huoltovarmuuskeskus.fi/en/a/national-emergency-supply-agency-boosting-finlands-emergency-grain-stockpiles>

[MAT-10] The Finnish National Emergency Supply Fund has a balance of approximately EUR 2 billion, most of it tied up in emergency stockpiles, and may borrow up to EUR 600 million. Its revenue comes from the strategic stockpile fee, mainly collected from electricity consumption, estimated at approximately EUR 66 million in 2026 and rising to approximately EUR 92 million in 2027 under the new Act, which entered into force on 1 April 2026. Funding – National Emergency Supply Agency · Huoltovarmuuskeskus (National Emergency Supply Agency, Finland) · 2026 <https://www.huoltovarmuuskeskus.fi/en/organisation/funding>

[MAT-11] In a normal year Swedish food production corresponds to about 150–200 percent of the population's caloric energy needs and 200–250 percent of protein needs. The report stresses that production statistics alone miss the decisive factors: "Infrastructure, energy supply, access to agricultural inputs, storage, and logistics can all play decisive roles in a crisis." Swedish production of fruit and vegetables is significantly below recommended intakes. Sweden produces enough calories and protein for self-sufficiency, new report finds (report "Räcker maten?", PLATE) · Stockholm Resilience Centre / PLATE, Stockholm University & SLU · 2026-03-26 <https://www.stockholmresilience.org/research/research-stories/2026-03-26-sweden-produces-enough-calories-and-protein-for-self-sufficiency-new-report-finds.html>

[MAT-12] The commonly cited Swedish self-sufficiency figure of about 50 percent refers to the total retail value of foodstuffs originating from Sweden, not to production capacity. The authors argue it "does not say anything about how much food is produced in Sweden and could be used to provision the population during a crisis." When LRF recalculated for 2021 using energy content instead of value, the import share was a few percentage points lower. Sveriges försörjningsförmåga – Vad innebär 50 procent? · Mistra Food Futures (Karlsson, Karlsson Potter, Röös, Einarsson) · 2025 <https://mistrafoodfutures.se/bloggar/sveriges-forsorjningsformaga-vad-innebar-50-procent/>

[MAT-13] The parliamentary follow-up identifies fuel shortage as the foremost vulnerability: agricultural machinery "drivs nästan uteslutande med diesel, och om lantbrukaren inte har tillgång till drivmedel stannar produktionen." Product-level self-sufficiency for 2019 included grains above 100% (but 80% in the drought year 2018), eggs about 100%, carrots 92%, cucumbers 46% and tomatoes 17%. It records that state stockpiles of food, raw materials and other products were dismantled in the early 2000s. Lantbrukets sårbarhet – en uppföljning (Rapport från riksdagen 2020/21:RFR7) · Sveriges riksdag, Miljö- och jordbruksutskottet · 2021 <https://www.riksdagen.se/sv/dokument-och-lagar/dokument/rapport-fran-riksdagen/lantbrukets-sarbarhet---en-uppfoljning_H80WRFR7/html/>

[MAT-14] Interview-based research with Swedish farmers concludes that "den låga självförsörjningsgraden av insatsmedel till jordbruket är alltså ett större problem än den låga självförsörjningsgraden av livsmedel." Farmers estimate production would fall roughly by half without diesel; in a first crisis year they could reduce tillage and still get a decent harvest, but subsequent years would yield very little as accumulated soil nutrients from previous fertilisation are exhausted. None of the participating farms were fully self-sufficient. Livsmedelsproduktion ur ett beredskapsperspektiv – Sårbarheter och lösningar för ökad resiliens (MSB1223) · MSB / Sveriges lantbruksuniversitet (Camilla Eriksson) · 2018-05 <https://rib.msb.se/filer/pdf/28493.pdf>

[MAT-15] A meta-analysis of 13 publications covering 22 European locations and 267 observation records found alley cropping cereal yields at 96% of sole-crop yield at tree planting, declining 2.6% per year over the first 21 years of the tree stand, giving a mean relative yield of 71%; Spanish/Portuguese dehesa systems by contrast yielded 102 ± 4.1%. An increase of 100 trees per hectare was associated with a 20% decrease in relative yield. No significant difference was found between northern and southern European alley cropping. Crop Yields in European Agroforestry Systems: A Meta-Analysis · Frontiers in Sustainable Food Systems (Ivezić, Yu, van der Werf) · 2021 <https://doi.org/10.3389/fsufs.2021.606631>

[MAT-16] A Bayesian meta-analysis of 195 paired soil-organic-carbon and crop-yield observations from 40 studies across 10 temperate oceanic countries found SOC increases from no tillage (0.06 g C/100 g), reduced tillage (0.09 g C/100 g) and ley-arable rotations (0.05 g C/100 g per ley year), but no significant crop yield effect from any practice and no SOC effect from cover crops. The authors conclude the results "do not verify the claim that RA practices can simultaneously increase SOC and crop yield in temperate oceanic regions." Temperate Regenerative Agriculture practices increase soil carbon but not crop yield · a meta-analysis — Environmental Research Letters (Jordon, Willis, Bürkner, Haddaway, Smith, Petrokofsky) · 2022 <https://doi.org/10.1088/1748-9326/ac8609>

[MAT-17] The Swedish vegetation period, defined as the part of the year when daily mean temperature exceeds +5°C, has lengthened by nearly 30 days on average since the beginning of the 1900s, with the change more pronounced in spring than autumn. Duration ranges from nearly eight months in south-western Skåne to about three months at the highest mountain stations. The page carries no explicit publication date. Vegetationsperiod (Kunskapsbanken) · SMHI · 2025 <https://www.smhi.se/kunskapsbanken/klimat/fenologi/vegetationsperiod>

[MAT-18] CIBUSmod 25.09 is an open-source spatially disaggregated biophysical agri-food systems model with Sweden as case study. Baseline (2016–2020) estimates 145,000 tonnes of mineral nitrogen fertiliser applied; a 2050 sustainability scenario reduces this to 106,000 tonnes with organic cropland at 50% nationally (17–68% regionally). Currently 24% of organic-farm nitrogen originates from conventional animal manure, declining to 14% under the scenario. CIBUSmod 25.09: a spatially disaggregated biophysical agri-food systems model for studying national-level demand- and production-side intervention scenarios · Geoscientific Model Development, 18, 8589–8611 (Karlsson, Karlsson-Potter, Lagnelöv, Ericsson, Einarsson, Hansson) · 2025 <https://doi.org/10.5194/gmd-18-8589-2025>

[MAT-19] Livsmedelsstrategin 2.0 was presented on 21 March 2025 with three focus areas — increased robustness in the food chain, export promotion, and Swedish quality and gastronomy. The press release specifies no quantified targets, instead assigning Jordbruksverket to concretise monitoring and goal formulation for food production, and does not use the words "självförsörjning" or "beredskap". Uppdaterad strategi för ökad svensk livsmedelsproduktion – Livsmedelsstrategin 2.0 · Regeringskansliet (Landsbygds- och infrastrukturdepartementet) · 2025-03-21 <https://www.regeringen.se/pressmeddelanden/2025/03/uppdaterad-strategi-for-okad-svensk-livsmedelsproduktion--livsmedelsstrategin-2.0>

[MAT-20] No Swedish national survey data on precision agriculture adoption was located. The widely circulated figure that precision technology covers 81% of area in 2024 (up from 78% in 2023) is Danish, not Swedish; barriers cited in the Danish survey were cost (46%), lack of knowledge (25%) and technical difficulty (10%). Farms using precision technology averaged 171 hectares and those using harvest sensors 278 hectares. The article explicitly notes a comparable Swedish study would be valuable — i.e. it does not exist. Precisionslantbruk på 81 procent av arealen · Lantbruksnytt · 2025 <https://lantbruksnytt.se/precisionslantbruk-pa-81-procent-av-arealen/>

[MAT-21] Forfogandelag (1978:262), i kraft, senast andrad SFS 2024:805. 1 §: 'Kommer riket i krig, trader 4-6 §§ i tillampning.' 2 §: regeringen kan foreskriva utvidgad tillampning vid krigsfara eller utomordentliga forhallanden foranledda av krig utanfor Sveriges granser eller knapphet pa forsvarsviktiga fornodenheter. 5 §: fastighet far tas i ansprak med nyttjanderatt och annan egendom tas i ansprak; transportmedel far tas i bruk; lageranlaggning far alaggas att forvara egendom. 7 §: beslut fattas av regeringen eller, efter bemyndigande, kommuner, regioner eller statliga myndigheter. Förfogandelag (1978:262) · Sveriges riksdag / Svensk författningssamling · 1978-05-25, senast ändrad SFS 2024:805 <https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/forfogandelag-1978262_sfs-1978-262/>

[MAT-22] Ransoneringslag (1978:268), i kraft, senast andrad SFS 2024:806. Tillamplig vid krig, krigsfara eller 'knapphet eller betydande fara for knapphet' pa fornodenhet viktig for totalforsvaret eller folkforsorjningen. 6 §: regeringen far foreskriva att fornodenhet inte far saljas, overlatas eller forvarvas utan myndighets ordning och villkor. Instrument: ransoneringsbevis (25-30 §§), forfogande (13-16 §§), dispositionsforbud (14 §), overforbrukningsavgift (38 §), uppgiftsskyldighet (31-34 §§). Omfattar sarskilt livsmedel och energi. Ransoneringslag (1978:268) · Sveriges riksdag / Svensk författningssamling · 1978-05-25, senast ändrad SFS 2024:806 <https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/ransoneringslag-1978268_sfs-1978-268/>

Digitala tvillingar och nationella program

[TVILL-2] ISO 23247-1:2021 'Automation systems and integration — Digital twin framework for manufacturing — Part 1: Overview and general principles' was published in 2021; Parts 2–4 (reference architecture, digital representation of manufacturing elements, information exchange) were published the same year, and Part 5 (digital thread) is dated 2026. ISO 23247-1:2021 · Digital twin framework for manufacturing, Part 1 — ISO (TC 184/SC 4) · 2021 <https://cdn.standards.iteh.ai/samples/75066/ec0a1c59176e488887873acda6b7ecd9/ISO-23247-1-2021.pdf> Förbehåll: probable

[TVILL-3] IEC 63278-1:2023 'Asset Administration Shell for industrial applications — Part 1: Asset Administration Shell structure', Edition 1.0, dated 2023-12, defines the standardised digital representation of an industrial asset enabling trusted information exchange between software applications. IEC 63278-1:2023 · Asset Administration Shell for industrial applications — IEC · 2023-12 <https://webstore.iec.ch/en/publication/65628> Förbehåll: probable

[TVILL-5] The UK National Digital Twin Programme was launched by HM Treasury in July 2018 and run by the Centre for Digital Built Britain, a partnership between the University of Cambridge and the Department for Business, Energy and Industrial Strategy; CDBB 'completed its five-year mission and closed its doors at the end of September 2022', with the Digital Twin Hub transferring to Connected Places Catapult from 1 April 2022. National Digital Twin Programme · what we did — Centre for Digital Built Britain, University of Cambridge · 2022-09 <https://www.cdbb.cam.ac.uk/what-we-did/national-digital-twin-programme>

[TVILL-7] Destination Earth has received over EUR 300 million from the Digital Europe Programme; the initiative started in 2021, its first phase completed in June 2024 delivering the core service platform, the data lake, the Digital Twin Engine and the first two digital twins, with expansion planned by 2027. DIGITAL success stories · DestinE: Building a digital twin of the Earth — European Commission, DG CNECT · 2024 <https://digital-strategy.ec.europa.eu/en/factpages/digital-success-stories-destine-building-digital-twin-earth>

[TVILL-8] The European Commission confirmed the third phase of Destination Earth on 1 February 2026; phase three runs from June 2026 to June 2028, with ECMWF, ESA and EUMETSAT operating and evolving the Climate Change Adaptation and Weather-Induced Extremes digital twins and the Digital Twin Engine on EuroHPC supercomputers, in partnership with over 100 organisations. Third phase of Destination Earth confirmed · ECMWF · 2026-02 <https://www.ecmwf.int/en/about/media-centre/news/2026/third-phase-destination-earth-confirmed>

[TVILL-9] Dassault Systèmes and Singapore's National Research Foundation announced the Virtual Singapore platform on 16 June 2015, built on the 3DEXPERIENCity platform, with completion 'expected by 2018'. Dassault Systèmes and National Research Foundation Collaborate to Develop the Virtual Singapore Platform · Dassault Systèmes · 2015-06-16 <https://www.3ds.com/newsroom/press-releases/dassault-systemes-and-national-research-foundation-collaborate-develop-virtual-singapore-platform>

[TVILL-10] Estonia's data embassy in Luxembourg holds critical state databases and information systems, is at Tier 4 security level, is 'fully under the control of Estonia', uses KSI blockchain integrity technology, and is capable of providing 'data backups, but also operating the most critical services'; the concept began in 2015 and the agreement was signed in 2017. Data Embassy · e-Estonia (Enterprise Estonia) · 2017 <https://e-estonia.com/solutions/e-governance/data-embassy/>

[TVILL-11] On 20 June 2017 Estonian Prime Minister Jüri Ratas and Luxembourg Prime Minister Xavier Bettel signed the agreement establishing the world's first data embassy, described by Ratas as 'fundamentally a double guarantee to our data and services', with operations beginning at the start of 2018. Estonia to establish the world's first data embassy in Luxembourg · Government of the Republic of Estonia (valitsus.ee) · 2017-06-20 <https://www.valitsus.ee/en/news/estonia-establish-worlds-first-data-embassy-luxembourg>

[TVILL-12] Gaia-X is characterised as a failure by named participants: former CEO Francesco Bonfiglio said it was 'too ambitious', trying to be 'all things to all people'; Nextcloud's Frank Karlitschek called it a 'paper monster' in 2024; Scaleway withdrew in November 2021 citing bureaucracy; day-one member Agdatahub was liquidated after EUR 4.8 million in funding; and European cloud market share fell by three quarters in three years. Gaia-X · Chronicle of a Failure Foretold — EuroStack Directory Project (Stefane Fermigier) · 2025-02-04 <https://euro-stack.com/blog/2025/2/gaia-x-failure>

[TVILL-13] Riksrevisionen's report RiR 2025:8, published 29 April 2025, examined 1,094 strategic digitalisation projects at 136 Swedish state agencies over 2013–2024 with a combined budget of about SEK 40 billion; roughly half were marked by major delays and cost overruns, about 5 percent (31 projects) were discontinued without delivering results at a cost of SEK 1.6 billion, and at least 120 of 722 completed projects did not fully meet their goals. Stora kostnadsökningar och förseningar i statliga it-projekt (RiR 2025:8) · Riksrevisionen · 2025-04-29 <https://www.riksrevisionen.se/nyhetsarkiv/nyhetsarkiv/2025-04-29-stora-kostnadsokningar-och-forseningar-i-statliga-it-projekt.html>

[TVILL-16] The Formas-financed Nationella samordningshubben för Digitala tvillingar (NHDT) has published a vision and roadmap for digital twins in the Swedish built-environment sector with milestones at 2030 (foundation of Sweden's digital twin infrastructure laid), 2035 (full-scale implementation in many municipalities), 2040 (complete technical and organisational realisation) and 2045 (a national ecosystem approach established), involving municipalities, Boverket, Lantmäteriet, Trafikverket, SKR and industry. Vision och färdplan från NHDT · NHDT / DigiVis · 2025 <https://digivis.se/vision-och-fardplan-fran-nhdt/>

[TVILL-17] Stefano Moroni argues in Computational Urban Science (2025, DOI 10.1007/s43762-025-00174-0) that the limits of city-scale digital twins are structural, not contingent: 'Complex urban systems are unpredictable in detail, not because we lack certain data, but because of their intrinsic nature', dispersed knowledge 'cannot be collected and re-unified because, as a coherent and integrated whole, it does not and cannot exist anywhere', and digital twins can therefore only yield pattern predictions for a whole city. Insurmountable limitations of city-scale digital twins? On urban knowledge and planning · Computational Urban Science (Springer Nature) · 2025 <https://link.springer.com/article/10.1007/s43762-025-00174-0>

[TVILL-18] NIST Interagency Report 8356, 'Security and Trust Considerations for Digital Twin Technology' by Voas, Mell, Laplante and Piroumian, was published 14 February 2025 and examines both traditional and novel cybersecurity challenges presented by digital twin technology alongside trust considerations. NIST IR 8356: Security and Trust Considerations for Digital Twin Technology · NIST (U.S. Department of Commerce) · 2025-02-14 <https://www.nist.gov/publications/security-and-trust-considerations-digital-twin-technology-digital-twin-technology>

Kvant och kryptografi

[KVANT-1] NIST published FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) on 13 August 2024; HQC was selected as a backup key-encapsulation mechanism on 11 March 2025; FALCON/FN-DSA is still only 'in development' as FIPS 206 with no publication date announced as of August 2026. Post-Quantum Cryptography Standardization · NIST Computer Security Resource Center (CSRC) · 2025-03-11 <https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization>

[KVANT-2] The EU PQC Workstream's 'A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography, Part 1', Version 1.1 dated 11.06.2025, recommends that all Member States initiate a national PQC transition strategy by end of 2026, transition high-risk use cases 'no later than the end of 2030', and complete the transition 'for as many systems as practically feasible' by 2035; it recommends standardised hybrid solutions and never once mentions QKD. A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography, Part 1, Version 1.1 · NIS Cooperation Group / EU PQC Workstream (European Commission) · 2025-06-11 <https://securitydelta.nl/media/com_hsd/report/750/document/Roadmap-on-postquantum-cryptography-PzBJxNUYyeuEdVUacWL696DofZQ-117507.pdf>

[KVANT-4] The UK NCSC states 'The NCSC will not support the use of QKD for government or military applications', notes that 'QKD does not provide authentication, nor do any other quantum techniques', that 'PQC is the best mitigation to the threat to cryptography from quantum computers', and that QKD use 'should not constitute evidence towards assessments of security of data-in-transit under the NCSC's Cyber Assessment Framework'. Quantum security technologies (whitepaper) · UK National Cyber Security Centre (NCSC) · 2025-08-05 <https://www.ncsc.gov.uk/whitepaper/quantum-security-technologies>

[KVANT-8] Sweden's Nationellt cybersäkerhetscenter (NCSC, part of FRA) states in its 2026 national recommendations that the transition to quantum-safe cryptography 'behöver vara klar till slutet av 2035 och i vissa känsliga fall redan till slutet av 2030'; that 'Kvantdatorer bedöms att inom tio till tjugo år ha kapacitet att bryta delar av den kryptografi som i dag är allmänt förekommande'; recommends ML-KEM, ML-DSA, SLH-DSA, LMS and XMSS while deprecating ECDH, RSA, ECDSA and EdDSA; and states that most organisations should follow the recommended plan rather than attempt their own analysis of quantum computer development. QKD is not mentioned anywhere in the 16-page guidance. Nationella rekommendationer för övergången till kvantsäker kryptografi 2026 · Nationellt cybersäkerhetscenter (NCSC) vid FRA, Sweden · 2026 <https://www.ncsc.se/siteassets/publikationer/nationella-rekommendationer-for-overgangen-till-kvantsaker-kryptografi-2026_tga.pdf>

[KVANT-9] Sweden's NCSC one-page recommendation dated 2025-05-15 states that in most situations the transition must be complete by end of 2035, but 'I situationer där kryptering är essentiell för att inte röja information på tio år eller längre' it must be complete by end of 2030, and that only standardised algorithms in large-scale international use may be used, naming FIPS 203, 204 and 205. Rekommendationer för övergången till kvantsäker kryptografi · Tidpunkter — Nationellt cybersäkerhetscenter (NCSC), Sweden · 2025-05-15 <https://www.ncsc.se/siteassets/publikationer/rekommendationer-for-overgangen-till-kvantsaker-kryptografi.pdf>

[KVANT-10] The Quantum Threat Timeline Report 2025 (published 9 March 2026), based on a survey of 26 experts, places the averaged probability of a cryptographically relevant quantum computer within 10 years at 28-49% and within 15 years at 51-70%; 92% of respondents put the 20-year probability at 50% or above. Quantum Threat Timeline Report 2025 · Global Risk Institute / evolutionQ (Michele Mosca, Marco Piani) · 2026-03-09 <https://globalriskinstitute.org/publication/quantum-threat-timeline-report-2025b/>

[KVANT-14] Vinnova records the NQCIS project (National Quantum Communication Infrastructure in Sweden), coordinated by KTH at AlbaNova, as running January 2023 to October 2026 with SEK 30,000,000 in Vinnova funding, with partners including Stockholm University, Chalmers, Linköping University, Ericsson AB, Quantum Scopes AB and quCertify AB, integrating Swedish infrastructure into EuroQCI. National Quantum Communication Infrastructure in Sweden (NQCIS) · Vinnova · 2023-01 <https://www.vinnova.se/en/p/national-quantum-communication-infrastructure-in-sweden/>

[KVANT-15] CSIS analysts (Matisek, Schweiker, Bazilian, 9 October 2025) assess quantum sensing as 'fragile but advancing quickly' with a 'gap between promise and practice': systems 'drift without constant recalibration', 'malfunction when exposed to the motion, temperature swings, and background noise of real-world military operations', magnetometers 'throw spurious tracks near power systems', gravimeters 'lose stability in turbulence', and 'size, weight, power, and cost constraints add another layer of difficulty, as few systems can meet the rugged demands of combat'. Quantum Sensing and the Future of Warfare: Five Essential Reforms to Stay Competitive · Center for Strategic and International Studies (CSIS) · 2025-10-09 <https://www.csis.org/analysis/quantum-sensing-and-future-warfare-five-essential-reforms-stay-competitive>

[KVANT-16] A June 2026 field validation of a wearable free-induction-decay optically pumped magnetometer for GNSS-independent positioning achieved a Beckmann-distributed radial positioning error of 2.24 m over a walking route exceeding 500 m and lasting approximately 360 seconds. Field validation of GNSS-independent positioning enhancement using a wearable ultra-stable quantum magnetometer · arXiv:2606.24612 (University of Strathclyde group) · 2026-06-23 <https://arxiv.org/abs/2606.24612>

[KVANT-17] Cloudflare reported on 27 February 2026 that over 60% of human-generated TLS traffic to its network used post-quantum (hybrid ML-KEM) key agreement in February 2026, while only approximately 10% of origin servers could benefit from post-quantum-preferred key agreement — a 10x increase from under 1% at the start of 2025. Bringing more transparency to post-quantum usage, encrypted messaging, and routing security · Cloudflare · 2026-02-27 <https://blog.cloudflare.com/radar-origin-pq-key-transparency-aspa/>

[KVANT-18] NATO's Quantum Technologies Strategy, approved by Foreign Ministers on 28 November 2023 with a summary released 16-17 January 2024, commits the Alliance to supporting 'the development and implementation of post-quantum cryptography and quantum key distribution', and identifies quantum sensors for 'space-based data collection and positioning, navigation and timing capabilities without relying on Global Navigation Satellite Systems'; it sets no completion dates. Summary of NATO's Quantum Technologies Strategy · NATO · 2024-01-16 <https://www.nato.int/cps/en/natohq/official_texts_221777.htm>

[KVANT-19] Renner and Wolf (ETH Zürich, arXiv:2307.15116, submitted 27 July 2023) reply to the NSA's published objections to QKD and argue 'that some of the points raised are unjustified, whereas others are problematic now but can be expected to be resolved in the foreseeable future'. The debate over QKD: A rebuttal to the NSA's objections · arXiv (Renato Renner, Ramona Wolf, ETH Zürich) · 2023-07-27 <https://arxiv.org/abs/2307.15116>

[KVANT-20] Galileo Open Service Navigation Message Authentication (OSNMA) forklarades operativ under 2025 och ger 'protection against GNSS spoofing'. EUSPA beskriver den som 'a milestone for trusted positioning'. Galileo SAS ska komplettera OSNMA med autentisering pa ranging-niva for civila anvandare. Galileo OSNMA — operativ tjänst (EUSPA newsroom) · EUSPA (EU Agency for the Space Programme) · 2026-07-27 (nyhetsflöde; deklaration ca juli 2025) <https://www.euspa.europa.eu/newsroom/news/galileo-osnma-service-now-publicly-available> Förbehåll: DELVIS — deklarationsdatum och deklarerande organ ej fastställt i primärkälla; EUSPA:s nyhetsflöde anger att tjänsten förklarades operativ under 2025, och att den ger 'protection against GNSS spoofing'. Skyddet mot störsändning är inte påstått i källan och påstås inte i texten.

Lärdomar från Ukraina

[UKR-1] Ukraine's Law No. 2075-IX 'On Cloud Services' was adopted 17 February 2022 — one week before the invasion — signed 15 March 2022 and entered force 16 September 2022; Cabinet of Ministers Resolution No. 263 of 12 March 2022 permitted public authorities to place public information resources, public e-registers and their encrypted reserve copies on cloud resources or data centres outside Ukraine during martial law. Cloud technologies and data centres: new regulation in Ukraine · Sayenko Kharenko (Ukrainian law firm) · 2022 <https://sk.ua/cloud-technologies-and-data-centres-new-regulation-in-ukraine/>

[UKR-2] AWS migrated over 10 petabytes of data from 42 Ukrainian government authorities, 24 universities and dozens of private companies; AWS Snowball devices reached Kraków on 26 February 2022 and Ukrainian destinations by that Sunday; PrivatBank moved 4 petabytes from 3,500 servers in under 45 days. Before the crisis Ukrainian law required certain government and private-sector data to be stored on servers physically inside Ukraine. Safeguarding Ukraine's data to preserve its present and build its future · Amazon (AWS) · 2022 <https://www.aboutamazon.com/news/aws/safeguarding-ukraines-data-to-preserve-its-present-and-build-its-future>

[UKR-4] Over 23 million Ukrainians use Diia, which offers 70+ digital public services and 33 digital documents, as of 15 October 2025. Diia Reaches 23 Million Users: Ukraine's Digital Government Becomes the New Normal · Ministry of Digital Transformation of Ukraine (digitalstate.gov.ua) · 2025-10-15 <https://digitalstate.gov.ua/news/govtech/ponad-23-milyony-ukrayintsiv-uze-korystuiutsia-diyeiu-tsyfrova-derzava-stala-novoiu-normoiu>

[UKR-5] Trembita, Ukraine's interoperability layer, launched in 2019 and by June 2025 connected 150+ government registries and had processed over 14 billion data exchanges; Diia (launched 2020) had 22 million users (60% of the population) as of April 2025 and 140+ services; Ukraine rose on the UN e-Government Development Index from 30th (2022) to 16th (2024). Ukraine is digital by design: Resilience and trust, embedded in governance · e-Governance Academy (eGA), Estonia · 2025-07-02 <https://ega.ee/ukraine-digital-by-design/>

[UKR-6] A GRU-attributed cyberattack on Ukraine's state registries was formally announced 19 December 2024; citizens had already been unable to sell cars, file legal claims or register marriages from early December, and the Justice Ministry only stated registries were operational again on 20 January 2025. Cybersecurity specialist Karla Wagner said 'Centralization and single points of failure are a well-known anti-pattern', and former SBU officer Mykyta Knysh described the infrastructure as 'overly centralized' following 'the old Soviet model'. Massive Russian hack on government database shows cracks in Ukraine's warp-speed digitalization drive · The Kyiv Independent · 2025-01-20 <https://kyivindependent.com/massive-russian-hack-on-government-database-shows-cracks-in-ukraines-warp-speed-digitalization-drive/>

[UKR-7] Russian hackers breached Kyivstar, Ukraine's largest telecom operator, in May 2023, held full access from November 2023, and executed a destructive attack on 12 December 2023 that in SBU cybersecurity chief Illia Vitiuk's words 'wiped almost everything' and 'completely destroyed the core of a telecoms operator'; Solntsepek, linked to GRU unit Sandworm, claimed responsibility on 13 December. Entry was via a compromised employee account. SBU cybersecurity chief: Hackers had access to Kyivstar months before December attack · The Kyiv Independent (reporting Reuters interview) · 2024-01-04 <https://kyivindependent.com/reuters-sbu-cybersecurity-chief-says-russian-hackers-had-access-to-kyivstar-for-months-before-december-attack/>

[UKR-8] Ukraine's pre-war dispatchable generation capacity was 38 GW; 19 GW was lost to occupation, destruction or damage in the first year of war, falling to 12 GW after the spring 2024 attacks, with 3 GW restored for winter 2024/25 and 17.6 GW anticipated available entering October 2025. Between March and September 2025 the power sector suffered over 3,100 disruptions due to Russian aggression; the 7–8 September 2025 attack was the largest-ever air attack on Ukraine, and on 10 October 2025 an attack left 800,000 residents without power. Ukraine imported 4,436 GWh of electricity in 2024. Ukraine's Energy Security: A pre-winter assessment · International Energy Agency (IEA) · 2025 <https://www.iea.org/reports/ukraines-energy-security/a-pre-winter-assessment>

[UKR-9] High-voltage transformers and autotransformers at 330–750 kV have production cycles of 12–18 months, extending to several years for orders not secured in advance; more than 150 large autotransformers were ordered with approximately USD 1.5 billion in public and international financing; by February 2026 the EU had offered more than 11,200 generators and more than 7,200 transformers; more than 9 GW was damaged between October 2025 and early April 2026, of which more than 4 GW was restored, against a severe winter peak demand of approximately 18 GW. Approval and tendering delays run six to eight months. Repairing under fire · recovery chain constraints on Ukraine's energy resilience — Danish Institute for International Studies (DIIS) · 2026 <https://www.diis.dk/en/research/repairing-fire-recovery-chain-constraints-on-ukraines-energy-resilience>

[UKR-10] Ukraine had 56.1 GW of installed capacity before February 2022 and lost approximately 27 GW to occupation, destruction and damage; rebuilding to EU standards is costed at USD 67.8 billion. Decentralised units of 5–100 MW are the stated resilience target; Mykolaiv's water utility deployed 5 MW of solar PV plus 1 MWh of battery storage under a EUR 7.2 million grant approved in May 2025, and Khmelnytskyi region has approximately 14.9 MW of operational solar on city-owned land. In November 2024 alone Russia fired 350 missiles and more than 2,500 drones at the grid. Striving for Access, Security, and Sustainability: Ukraine's Transition to a Modern and Decentralized Energy System · Center for Strategic and International Studies (CSIS) · 2025-07-02 <https://www.csis.org/analysis/striving-access-security-and-sustainability>

[UKR-14] In 2025 Ukraine's Ministry of Defence planned to procure approximately 4.5 million FPV drones, matching total national industry capacity, allocating over UAH 110 billion for drone procurement including more than UAH 102 billion through the Defence Procurement Agency; by end-2024 over 1.5 million drones had been procured, 96% paid to Ukrainian manufacturers and suppliers, up from thousands in 2023. Stated by Glib Kanievskyi, Director of the Procurement Policy Department. Glib Kanievskyi: In 2025, the Ministry of Defence plans to procure 4.5 million FPV drones · Ministry of Defence of Ukraine · 2025-03-10 <https://mod.gov.ua/en/news/glib-kanievskyi-in-2025-the-ministry-of-defence-plans-to-procure-4-5-million-fpv-drones>

[UKR-17] By 2022 the central component of Ukraine's eHealth system had 36 million patients registered, more than 1.6 billion electronic medical records and 400,000 active users, processing 1,000–1,500 requests per second to the central database. Before the invasion the network included over 40 regional medical information systems (MIS); the authors project that only four to six will probably survive, owing to financial losses, destroyed infrastructure and evacuation of qualified IT specialists. The future of Ukrainian healthcare: the digital opportunity · Journal of Global Health · 2025 <https://jogh.org/2025/jogh-15-03039>

Statlig åtkomst, integritet och motevidens

[ATK-8] eIDAS art. 45 "prohibits browsers from enforcing any security requirements" utöver ETSI-godkända — ett tak, inte ett golv. Tillbakarullning till 2011. Refererar DigiNotar 2011 (certifikat använda för att avlyssna e-post i Iran) och CNNIC 2015 https://www.eff.org/deeplinks/2023/11/article-45-will-roll-back-web-security-12-years · Hämtad, bekräftad <https://www.eff.org/deeplinks/2023/11/article-45-will-roll-back-web-security-12-years>

[ATK-9] Branschgemensamt uttalande, 12 undertecknare (Cloudflare, Fastly, Mozilla, Linux Foundation, ISRG, Mullvad, OpenSSF m.fl.): "an error of judgment or deliberate action by one member state will affect citizens in all other member states" https://openssf.org/blog/2023/11/02/openssf-co-signs-industry-joint-statement-on-article-45-in-the-eus-eidas-regulation/ · Hämtad, bekräftad <https://openssf.org/blog/2023/11/02/openssf-co-signs-industry-joint-statement-on-article-45-in-the-eus-eidas-regulation/>

[ATK-11] QWAC-genomförandeakt formellt antagen 17 dec 2025 https://securityriskahead.eu/ · Hämtad, bekräftad <https://securityriskahead.eu/>

[ATK-13] EUDI-plånbok: medlemsstater ska tillhandahålla plånbok före utgången av 2026; tjänsteleverantörer med identifieringsplikt måste acceptera den https://digital-strategy.ec.europa.eu/en/policies/eudi-regulation · Hämtad — artikelnummer ej åtkomliga, EUR-Lex nere <https://digital-strategy.ec.europa.eu/en/policies/eudi-regulation>

[ATK-24] Svensk lagringsproposition: Säkerhetspolisen får besluta om mer omfattande lagring vid allvarligt hot mot nationell säkerhet; nummeroberoende interpersonella kommunikationstjänster förs in under lagrings- och anpassningsskyldighet; ikraft 1 mars 2026 https://www.regeringen.se/rattsliga-dokument/departementsserien-och-promemorior/2024/11/utkast-till-lagradsremiss-datalagring-och-tillgang-till-elektronisk-information/ · Hämtad, bekräftad <https://www.regeringen.se/rattsliga-dokument/departementsserien-och-promemorior/2024/11/utkast-till-lagradsremiss-datalagring-och-tillgang-till-elektronisk-information/>

[ATK-25] FÖRSVARSMAKTENS INVÄNDNING — textens tyngsta svenska fakta. VERIFIERAD I ORIGINAL 13 aug 2026.<br><br>Yttrande 2025-01-17, beteckning FM2024-28855:2, till Justitiedepartementet, er beteckning Ju2024/02286.<br><br>Ordagrant: "Utifrån sin sakkunskap genom uppdraget att leda och samordna signalskyddstjänsten ser Försvarsmakten anledning att kommentera vad som anförs i utkastet om hur anpassningsskyldigheten kan genomföras vid totalsträckskrypterad kommunikation. Försvarsmakten bedömer att kravet på anpassningsskyldighet av nummeroberoende interpersonella kommunikationstjänster inte kommer att kunna uppfyllas utan att införa sårbarheter och bakdörrar som kan komma att nyttjas av tredje part."<br><br>Nästa mening, och den är avgörande: "Försvarsmakten har inga synpunkter på utkastet till lagrådsremiss i övrigt." — Försvarsmakten hade alltså ingen annan invändning mot hela lagförslaget. Bakdörren var det enda de kommenterade.<br><br>I beredningen deltog kryptostrateg Pia Gruvö, chefsingenjör Ulrik Söderblom och jurist Rickard Tennisberg. Beslutat av ställföreträdande chefsjurist Helene Arango Magnusson. Yttrandet kommer alltså från den myndighet som leder och samordnar signalskyddstjänsten — Sveriges kryptomyndighet — inte från en intresseorganisation https://www.regeringen.se/contentassets/e22f777eb1964c258c5d9a21adb6a355/forsvarsmakten.pdf · VERIFIERAD — primärkälla läst <https://www.regeringen.se/contentassets/e22f777eb1964c258c5d9a21adb6a355/forsvarsmakten.pdf>

[ATK-27] Högnivågruppen om åtkomst till data: 42 rekommendationer, RIF-rådet 13 juni 2024; rek. 22–24 driver "lawful access by design"; kommissionen tog bort gruppens öppenhetskrav ur arbetsordningen https://edri.org/our-work/high-level-group-going-dark-outcome-a-mission-failure/ · Hämtad, bekräftad <https://edri.org/our-work/high-level-group-going-dark-outcome-a-mission-failure/>

[ATK-29] ProtectEU 1 apr 2025: kommissionen ska ta fram "a Technology Roadmap on encryption, to identify and assess technological solutions that would enable law enforcement authorities to access encrypted data in a lawful manner"; expertgrupp levererar 2026 https://home-affairs.ec.europa.eu/policies/internal-security/lawful-access-data/encryption_en · Hämtad, bekräftad <https://home-affairs.ec.europa.eu/policies/internal-security/lawful-access-data/encryption_en>

[ATK-30] Motstånd: 89 undertecknare (74 organisationer + 15 namngivna säkerhetsexperter), 26 maj 2025: "Scanning... creates vulnerabilities that could be exploited by criminals and hostile state actors". Refererar brittiska Safety Tech Challenge där granskaren fann att ingen av prototyperna klarade utvärderingsramverket https://www.globalencryption.org/2025/05/joint-letter-on-the-european-internal-security-strategy-protecteu/ · Hämtad, bekräftad <https://www.globalencryption.org/2025/05/joint-letter-on-the-european-internal-security-strategy-protecteu/>

[ATK-31] ATHENS AFFAIR — textens bärande fall. ~100 telefoner avlyssnade inkl. statsminister Kostas Karamanlis, hans hustru, försvars- och utrikesministrarna, EU-kommissionärer. Start aug 2004, upptäckt via oleveread SMS 24 jan 2005. Angriparna subverterade Remote-control Equipment Subsystem (RES) — själva avlyssningsmekanismen i Ericssons AXE-växlar hos Vodafone Grekland, genom att patcha 29 separata kodblock. Vodafone bötfällt 76 MEUR (dec 2006). Nätplaneraren Costas Tsalikidis hittad hängd 9 mars 2005. Gärningsmännen aldrig identifierade. Ingenting var trasigt — systemet fungerade som konstruerat, någon annan levererade tillståndet https://spectrum.ieee.org/the-athens-affair <https://spectrum.ieee.org/the-athens-affair>

[ATK-32] Salt Typhoon. CALEA (1994) påbjuder avlyssningsförmåga; kinesiska statshackare komprometterade avlyssningssystem hos AT&T, Lumen, Verizon. Matt Blaze: "CALEA should be regarded as a cautionary tale, not a success story, for backdoors." Meredith Whittaker: "There's no way to build a backdoor that only the 'good guys' can use." https://techcrunch.com/2024/10/07/the-30-year-old-internet-backdoor-law-that-came-back-to-bite/ <https://techcrunch.com/2024/10/07/the-30-year-old-internet-backdoor-law-that-came-back-to-bite/>

[ATK-33] Omfattning: 9 amerikanska operatörer per 27 dec 2024; 100 000+ routrar kapade i AT&T:s nät; metadata om 1 miljon+ användare; angriparna fick "almost complete list of phone numbers under court-authorized wiretapping" — dvs. kontraspionagekartan över vilka staten övervakade. Kvarvarotid över ett år. Sen. Warner 21 nov 2024: "worst telecom hack in our nation's history" https://en.wikipedia.org/wiki/2024_global_telecommunications_hack <https://en.wikipedia.org/wiki/2024_global_telecommunications_hack>

[ATK-34] VIKTIGT NEGATIVT FYND. CISA/FBI/NSA-varning AA25-239A, 27 aug 2025 om Salt Typhoon nämner inte avlyssningssystem alls. Avlyssningskopplingen kommer ur pressrapportering okt 2024, inte ur myndighetsvarningen. Tillskriv den inte CISA/FBI https://www.attackiq.com/2025/09/04/cisa-advisory-aa25-239a/ <https://www.attackiq.com/2025/09/04/cisa-advisory-aa25-239a/>

[ATK-37] Vastaamo. Intrång nov 2018 och mars 2019, offentliggjort 21 okt 2020. ~36 000 patienter. ~30 000 utpressades individuellt (200 EUR stigande till 500 i bitcoin). Vastaamo i konkurs feb 2021. Kivimäki dömd till 6 år 3 mån april 2024 https://en.wikipedia.org/wiki/Vastaamo_data_breach <https://en.wikipedia.org/wiki/Vastaamo_data_breach>

[ATK-38] Vastaamo i fackgranskad form: fällande dom på 30 000 åtalspunkter, en per offer; "substantial reported harms ranging from distress to tragic suicides because of the leaking of the personal psychotherapy records" https://pmc.ncbi.nlm.nih.gov/articles/PMC11804136/ <https://pmc.ncbi.nlm.nih.gov/articles/PMC11804136/>

[ATK-42] Utredningsbehovet, kvantifierat. Europeiska polischefernas gemensamma deklaration 21 apr 2024, 32 undertecknare. Vid planerad E2EE-utrullning försvinner 92 % av Facebooks och 85 % av Instagrams anmälningar till brittisk polis. Nuvarande flöde skyddar ~1 200 barn per månad och ger ~800 gripanden per månad. Ett enskilt underrättelseflöde gav 327 gripanden, 3,5 ton klass A-narkotika, 4,8 MGBP återtaget, 29 tidigare okända hot mot liv https://www.nationalcrimeagency.gov.uk/news/european-police-chiefs-call-for-end-to-end-encryption-roll-out-to-include-public-protection-measures <https://www.nationalcrimeagency.gov.uk/news/european-police-chiefs-call-for-end-to-end-encryption-roll-out-to-include-public-protection-measures>

[ATK-44] NCMEC CyberTipline 2025: 21,3 miljoner anmälningar, 61,8 miljoner filer. Online-kontaktsökning +158 % mot 2024, människohandel med barn +323 % https://www.ncmec.org/gethelpnow/cybertipline/cybertiplinedata <https://www.ncmec.org/gethelpnow/cybertipline/cybertiplinedata>

[ATK-45] Centraliseringens forskningsutdelning. Danmark: CPR elektroniskt sedan 1968, dödsorsaker sedan 1943, sjukhuskontakter sedan 1977, recept sedan 1995, >99 % listtäckning. Unikt 10-siffrigt CPR ger "exact individual-level record linkage among all data sources" och "lifelong follow-up with accurate censoring at emigration or death". ~100 kliniska kvalitetsdatabaser https://pmc.ncbi.nlm.nih.gov/articles/PMC6634267/ <https://pmc.ncbi.nlm.nih.gov/articles/PMC6634267/>

[ATK-46] Delade journalers kliniska nytta. Systematisk översikt, 24 artiklar/63 analyser: 68,3 % rapporterade nytta, 7,9 % skada. Alla 7 studier med strikt design rapporterade nytta, ingen skada. Kostnader 77,8 % positiva, vårdkvalitet 90 % positiva https://pmc.ncbi.nlm.nih.gov/articles/PMC7646861/ <https://pmc.ncbi.nlm.nih.gov/articles/PMC7646861/>

[ATK-47] FEDERERADE LÖSNINGAR MISSLYCKAS I FÄLT — tesens svåraste motfakta. Direkt jämförelse: federerad analys tog 18 månader att nå operativ förmåga mot ~1 månad för alternativet, och gav riktningsmässigt identiska resultat (SMD < 0,1). Distribuerad analys "has not resulted in timely results in practice" https://pmc.ncbi.nlm.nih.gov/articles/PMC10352377/ <https://pmc.ncbi.nlm.nih.gov/articles/PMC10352377/>

[ATK-48] Systematisk avvägning: centraliserade modeller ger bättre harmonisering, sökbarhet och snabbare arbetsflöden; federerade lider av "limited data interoperability", svårare harmonisering av retrospektiva samlingar, "heterogeneous data quality policies across participating nodes" och autentisering per institution → "extended times for data access" https://academic.oup.com/bib/article/25/4/bbae262/7688102 <https://academic.oup.com/bib/article/25/4/bbae262/7688102>

Egen beräkning

[EGEN-1] 104 089 invånare, 761 skyddsrum, 85 540 platser. Täckning 55 % inom 300 m, 69 % inom 500 m, 81,5 % inom 1 000 m; 31 832 personer utanför 500 m. KÄLLOR: MSB/MCF ArcGIS REST Feature Service gisapp.msb.se/arcgis/rest/services/Befolkningsskydd/Skyddsrum_kontrollanter för skyddsrummens läge och platsantal; SCB WFS geodata.scb.se/geoserver/stat/wfs, lager befolkning_1km_2025, för befolkning per kvadratkilometer. Referenssystem SWEREF99 TM (EPSG:3006). Hämtat 2026-08-09. METOD: varje befolkningsruta delades i 25 provpunkter i ett 5×5-rutnät; för varje punkt beräknades fågelvägsavståndet till närmaste skyddsrum; rutans befolkning fördelades jämnt över punkterna. BEGRÄNSNINGAR: fågelväg är inte gångväg, så täckningen är en övre gräns; befolkningen antas jämnt fördelad inom rutan; platsantalet är registrerat och inte funktionellt; beräkningen prövar inte om platsen räcker när alla inom avståndet kommit fram. Skyddsrumstäckning i Karlstads kommun — egen beräkning · WINNIIO · 2026-08-09 Ingen offentlig länk — se källregistret.

[EGEN-2] Egen berakning ur [VARD-14]. 5 546 intensivvardstimmar / 8 patienter / 14 dygn = 49,5 vardtimmar per patient och dygn. Talet ar ett MEDELVARDE over hela perioden och beskriver inget enskilt dygn; forbrukningen i ett brannskadeforlopp ar inte jamn over tiden. Det anvands i texten enbart for att visa storleksordning. EN TIDIGARE VERSION av den har posten bar aven talen 152 handskar och 5,3 liter per patient och dygn samt en skalning till 125 ganger atta patienter. De ar tillbakadragna efter en medicinsk invandning: handskatgangen drivs av omlaggningar och katetrar och inte av bemanningen, vatsketillforseln ar kraftigt framtung, och skalningen raknade doda som vardbehovande. De star darfor varken i texten eller har. Egen beräkning — vårdtimmar per brännskadepatient och dygn (medelvärde) · Egen beräkning, redovisad i källförteckningen · 2026-08-18 Ingen offentlig länk — se källregistret.

[EGEN-3] Egen berakning ur [SKYDD-7] och [SKYDD-8]. [SKYDD-7] anger for 2025 bade 2 000 nya kontroller och 10 000 tillsyner. Rakning A, kontroller: 64 000 / 2 000 = 32 ar. Rakning B, alla besok: 64 000 / 12 000 = 5,3 ar. Texten anvander A eftersom kontrollen ger den fysiska tillstandsuppgiften medan tillsynen provar om agaren fullgor sin skyldighet; ar den skillnaden mindre skarp i praktiken narmar sig utfallet B, och da ar textens invandning svagare. MSB:s ambition ar en femarscykel [SKYDD-8]; 64 000 / 5 = 12 800 per ar, 6,4 ganger takten i A. Tillampat pa scenariots ar 2037, elva ar efter lagens ikrafttradande: 11 x 2 000 = 22 000 objekt, alltsa omkring 34 procent av bestandet. Egen beräkning — år till skyddsrumsgenomgång, två räkningar med begränsningar · Egen beräkning, redovisad i källförteckningen · 2026-08-18 Ingen offentlig länk — se källregistret.

173 poster. Nycklar markerade DELVIS eller med förbehåll i tillitsfältet är citerade med det förbehållet utskrivet i brödtexten, eller inte alls.

English edition, version 3.5, 18 August 2026. Translated from the Swedish original, which is the authoritative text and carries the same version number. Every source key, figure and date is bound to the Swedish by a mechanical check that compares both — `tools/oversattning.py`, which ships with a fixture that makes it fail.

Two rounds of expert review preceded this edition. Twelve objections were carried out in full, all of them against the text: chapter 14's central claim about what crosses a Nordic border was false for military units and is corrected with two verified sources; chapter 10 was contradicted by its own source on the right to demand information; chapter 16 chose the smaller of two figures in the same sentence of its own source, and now states both with their limits; chapter 11's input-goods calculation rested on an average that describes no real day.

The companion short story on the same theme is "The Note Nobody Read".