Elections
Election Resilience Command
Voter rolls, custody, tabulation evidence, ROLLBOOK and SECOND LOOK.
FAFO Apex Intel v3 workbench
Open briefing ↗
BB2GNational Data Resilience Audit
BB2G is auditing every kind of public data, from voter rolls and court files to driver, birth, death and land records. For each one we find where it was created, where it is stored in-house, which vendors hold it, where it was sold and what was done with it. Every command center runs the same audit, including on itself.
Every documented incident from the elections, anti-trafficking, sensitive-data and cyber briefings, plotted where it happened. Each color is a command center, and an incident that appears in more than one briefing is plotted once. The audit adds a layer for every new data type.
The same six questions go to every data type, in every state, starting with the agency's own systems and ending with the last vendor that bought a copy.
The agency, the form and the law that allowed it to be collected.
Every in-house server, database, file share, backup and cloud account that holds a copy.
Staff, contractors, vendors, subcontractors and the accounts they use.
Every transfer, data share, bulk export and sale, with the price and the buyer.
Retention, resale, analytics and AI training by every vendor and buyer.
A timed restore test, and proof that copies past their retention date are gone.
The audit is how BB2G's system gets built right. Each data type is audited in every jurisdiction and nationally, the threats are mapped, and the fixes the real numbers call for go into the BB2G build. Then the whole picture is audited as one.
Each row becomes its own command center and briefing. "Where it flows" lists the channels the audit traces first.
| Data type | Who holds it | Where it flows | Governing law | Briefing |
|---|---|---|---|---|
| Elections and voter rolls | Secretaries of state, county clerks, voter-registration vendors | Voter lists sold or licensed to campaigns and researchers under each state's rules; DMV and death-record matching | NVRA, HAVA, state election codes | Live briefing ↗ |
| Anti-trafficking and survivor services | Task forces, shelters, hotlines, grantees | Grant reporting, case referrals, provider databases | TVPA, VAWA confidentiality, state law | Live briefing ↗ |
| All sensitive data | Every agency and vendor in this table | Breaches, vendors, data brokers | HIPAA, FERPA, DPPA, IRS 1075, state breach laws | Live briefing ↗ |
| Cyber and critical infrastructure | Water, power, hospitals, 911, transit | Remote-access vendors, managed service providers | CISA directives, sector rules | Live briefing ↗ |
| Courts | State court administrators, clerks, case-management vendors | Bulk case data licensed to background-check and data companies in many states | State court rules, FCRA for resale | Next |
| DMV and identity | Motor vehicle agencies, ID card vendors | Driver records sold under the federal DPPA's permitted uses to insurers, employers, marketers and resellers | Driver's Privacy Protection Act | Next |
| Vital records | State vital records offices, county registrars | Death data shared with SSA and election offices; birth data with immunization and benefits systems | State vital statistics acts | Next |
| Land and property records | County recorders and assessors, e-recording vendors | Bulk deed and parcel files sold to title, real estate and data aggregators | State recording statutes | Next |
| Child and family services | Child welfare agencies, foster providers, ACF systems | Federal AFCARS and NCANDS reporting, provider contracts, court reports | CAPTA, Title IV-E, Family First | Next |
| Education | School districts, state education agencies, ed-tech vendors | Student data in ed-tech apps, testing vendors and state data systems | FERPA, COPPA, state student-privacy laws | Next |
| Health and Medicaid | Medicaid agencies, hospitals, claims processors | Clearinghouses, billing vendors, analytics firms | HIPAA, 42 CFR Part 2 | Next |
| Tax, revenue and benefits | Revenue departments, unemployment and disability programs | Payment processors, identity-verification vendors, federal matching | IRS Pub. 1075, SSA agreements | Next |
| Law enforcement and criminal justice | Police, sheriffs, fusion centers, prisons | CJIS networks, license-plate and records vendors | CJIS Security Policy | Next |
| Hosting and servers | State data centers, cloud providers, colocation | Backups, managed service providers, subcontracted hosting | FedRAMP, StateRAMP, contracts | Next |
| Public spending and integrity | Comptrollers, auditors, ethics boards | Contracts, grants, vendor payments, official disclosures | State ethics and procurement law | Next |
Before BB2G audits anyone else, every command center runs the audit on itself. The first test asks whether the sensitive-data engine knows sensitive data when it sees it, and the results are published, good or bad.
BB2G builds a test set of records with known answers: real sensitive fields, look-alikes and harmless data.
The system labels every record: sensitive or not, which law, which risk.
It reports what it caught, what it missed and what it flagged by mistake, for each data type.
For every decision, it shows why it thought a field was sensitive.
Two reviewers settle every disagreement and correct the rules.
The scorecard is sealed and repeated every cycle, so improvement or drift is on the record.
Each center runs the audit on its own data and on itself, and each has its own FAFO Apex Intel v3 workbench. Four briefings are live; the rest follow in this order.
Voter rolls, custody, tabulation evidence, ROLLBOOK and SECOND LOOK.
Funding oversight, providers, court coordinators, the five books.
Every sensitive record's path, WAYBILL, BACKSTOP 3-2-1.
Self-scanning, self-healing code and the Strongroom response.
Every server, backup and hosting contract, with timed restores.
Your sovereign hybrid compute: state servers, ProBox, bounded cloud.
Licensed, public-source investigations for all 51 jurisdictions.
Case systems, records access and bulk-data sales.
Driver and ID data, DPPA sales and identity verification.
Births, deaths and the systems that match them.
Deeds, parcels, e-recording vendors and title fraud.
Foster care, Family First, child welfare data and providers.
Student data, ed-tech vendors and the Cyber Cadet curriculum.
Executive, legislative and judicial systems side by side.
Corruption, improper payments and recovery-to-work.
Every command center has the same workbench for fusing sources, checking them against each other and turning findings into evidence. Findings roll up to the top tier, where the patterns across all centers show.
Public records, open sources, financial filings and technical signals in one workspace.
Every claim checked against independent sources before it counts, with Truthmark provenance.
Each finding graded and linked to its source, timestamp and hash.
Licensed investigators work inside written legal boundaries: public sources and lawful referrals only.
Anyone named in a finding can challenge it, and every correction is logged.
Each center's findings feed the national tier without moving anyone's private records.
The keep is the last stronghold, the tower that holds when the walls fall. KEEP is the name for your sovereign hybrid compute: the servers that hold sensitive data never leave the jurisdiction's control, and everything can be rebuilt from them. A separate Server Resilience Command audits every server, backup and hosting contract.
Air-gapped servers inside the state hold every sensitive record, with keys the state controls.
Local analysis and AI on the loopback address, with no outside connection.
Public dashboards and briefings like this one, with no personal data.
Accountability starts with the people trusted with public money and public data. Then it builds the paths that get people sober, trained and working.
Public contracts, grants, conflicts of interest and officials' own tax compliance, from public records.
Improper payments, duplicate enrollments and vendor fraud in benefits programs, traced to the system failure that allowed them.
Treatment courts, recovery programs and job training, including paid work training AI and processing records.
Work that fits each person's abilities, through programs like Social Security's Ticket to Work, without cutting off people who truly can't work.
Sober, working parents and stable homes, connected to the Child and Family Services command.
Findings about people go to the officials and courts with authority to act. No public naming without a court record.