Ownership-Control Criterion

Ownership-Control Criterion (n.) — The test that jurisdiction follows ownership, not registration country or deployment geography.

Applied to any infrastructure claiming to be sovereign, the criterion asks a single question: who ultimately owns the operating entity, and which states can lawfully compel that owner? Everything else — where the servers stand, where the subsidiary is registered, where the staff hold passports, where the data is "resident" — is operational detail that no court order cares about.

The criterion exists because the alternatives are systematically gamed. Registration-country claims ("our EU entity is incorporated in Frankfurt") fail because the US CLOUD Act reaches data in the possession, custody, or control of US-owned providers regardless of where a subsidiary is registered or where the data is stored. Deployment-geography claims ("your data never leaves Europe") fail for the same reason: data residency constrains latency, not jurisdiction. Operational-independence claims ("the sovereign region is run by European staff under European supervision") fail because staffing arrangements do not survive a lawful order to the parent company.

Only ownership survives. An entity whose ultimate ownership and control sit inside EU jurisdiction is reachable only by EU law. Anything else is reachable by someone else's — and infrastructure reachable by someone else's law is, in the evergray environment, someone else's infrastructure.

Development

Developed May 2026 in cloud sovereignty analysis surrounding the Tech Sovereignty Package, as the formal test underlying Sovereignty Washing: washing is precisely the practice of satisfying the gamed criteria (registration, geography, staffing) while failing the real one (ownership). The criterion follows Ahonen's Razor discipline: it is a problem-definition tool, deliberately silent on attribution and remedy.

Implications

Procurement language is the battlefield. A tender that specifies "data residency in the EU" invites washing; a tender that specifies "ultimate ownership and control within EU jurisdiction" excludes it in four words. The Digital Sovereignty Package audit applies the criterion to the EU's own flagship programme.

First public appearance

First used publicly on Bluesky (@jpahonen.eurosky.social); the origin thread will be linked here permanently.