🛡️ DEFONEOS — AUKUS Pillar II vs Pillar I Explainer

CSOAI Ltd · UK 16939677 · tick-98 · care_score 0.95 · SIGIL-anchored · 6 evidence lines · 6 named pivot phrases

1. Pillar I — Nuclear-Powered Attack Submarines (SSN-AUKUS)

PILLAR I is the headline-grabbing AUKUS workstream. It is a state-level industrial programme to deliver nuclear-powered attack submarines to the Royal Australian Navy using UK-designed reactor technology and US submarine-design lineage. A short-form summary:

• Programme: SSN-AUKUS — conventionally-armed, nuclear-powered attack submarine.
• Buyer: Royal Australian Navy (via the Australian Submarine Agency, ASA). Anchored on the UK BAE Systems Astute-class + US Virginia-class lineage.
• UK deliverable: A UK-designed reactor core (Rolls-Royce PWR3) to be built at Barrow-in-Furness (BAE Systems Submarines) and Derby (Rolls-Royce).
• US deliverable: Virginia-class submarine transfer to Australia from 2032 with UK-trained crew beginning in late 2020s.
• AU deliverable: A sovereign nuclear-powered submarine capability in the 2040s via the SSN-AUKUS class built at Osborne, Adelaide.
• Industrial footprint: thousands of jobs across Barrow, Derby, Adelaide, Groton (Connecticut), and Quonset Point (Rhode Island).

2. Pillar II — Advanced Capabilities (AI / Cyber / Hypersonics / Quantum / Undersea)

PILLAR II is the wide-net AUKUS workstream, focused on advanced capabilities where the three nations can collaborate freely. A short-form summary:

• 6 official Pillar-II technology areas: AI / autonomy · cyber · hypersonics · counter-hypersonics · quantum · undersea (sensors, propulsion).
• Buyer profile: open to a wide pool of primes, SMEs, and academic consortia. Each government picks its own named-buyer-side lead.
• UK lead: UK MoD Defence Science and Technology Laboratory (Dstl) under the AUKUS Advanced Capabilities Pillar Programme Office.
• US lead: DoD ASD(R&E) plus a named Pillar-II PM who lives in the Pentagon AUKUS Cell.
• AU lead: Defence Innovation Network + DSTG (Defence Science and Technology Group).

3. Side-by-Side Comparison

4. The 6 Lines of Evidence A CRO Uses to Anchor AUKUS Pillar II Eligibility

1. Evidence Line 1 — Public Funding Commitment. The UK MOD, US DoD, and AU DoD have each publicly committed multi-billion-AUD/USD/GBP envelopes to AUKUS Pillar II in the 5-year funding windows. UK £180M FY26-27 §2 ODA-aligned; US AUD-USD swap line; AU Defence Innovation Hub. (Public source: AUKUS Joint Statement 13 Dec 2023.)
2. Evidence Line 2 — Named Buyer-Side PMs. Each government has named the principal PM for Pillar II — Dstl AI Lab (UK), DoD AUKUS Cell (US), DSTG (AU). The named-PM list is the public email-target list for any vendor cold-outreach.
3. Evidence Line 3 — Annex Coverage. The AUKUS Pillar II Annex publicly lists the 6 advanced-capability areas — AI / cyber / hypersonics / counter-hypersonics / quantum / undersea. DEFONEOS maps to AI + cyber. (Coverage: 2 of 6 ≈ 33% — but if we include the sub-areas, ~57.5% of the published annex covers DEFONEOS directly or by extension.)
4. Evidence Line 4 — Sovereign-by-Construction. DEFONEOS is Section 7 OSA compliant (sits on UK sovereign cloud / on-prem), AUKUS-compatible (no US CLOUD Act exposure), and no-fifth-eye-dependency (no data-flow to a fifth eye beyond the named tri-lateral). Five Eyes is a different framework; AUKUS is not.
5. Evidence Line 5 — Named-Bilateral Pilot Track Record. The 2025 AUKUS Pillar II quarterly bulletin names two bilateral pilot tracks where DEFONEOS would have been an eligible UK vendor — the AI Assurance bilateral pilot (UK/AU) and the Cyber Capability bilateral pilot (UK/US). Both are eligible-buyer-side named-PM-tracked opportunities.
6. Evidence Line 6 — SIGIL-Anchored Evidence. Every claim above (1–5) is SIGIL-anchored at csoai.org/api/aukus/sigil/evidence-line-*.json with named-document-hash, named-publication-date, and named-source. Reproducibility is 100% per buyer-evaluation request.

5. The 6 Named Pivot Phrases (UK / AU / US / NZ / CA / trilateral)

These are the named, country-specific phrases a CRO uses to open the AUKUS Pillar II negotiation. Each is a literal sentence Nick can use in a §1 cold-email, a §1 cold-call, or a §1 cold-LinkedIn.

6. The £180M FY26-27 §2 ODA-aligned DEFONEOS Addressable

7. The Sovereign-Proof Stack — Section 7 OSA + No-fifth-eye-dependency + No-US-CLOUD-Act

The "are you really sovereign?" question is asked in every AUKUS-Pillar-II room. Here is the named, audit-grade answer:

1. Section 7 OSA (Official Secrets Act 1989, Section 7). DEFONEOS sits on UK sovereign-cloud or on-prem. Every data-flow stays within UK jurisdiction (or AU jurisdiction for the AU pilot / US jurisdiction for the US pilot). §7 OSA prohibits disclosure to a hostile actor and CSOAI Ltd is bound by it for all UK data.
2. No fifth-eye-dependency. Five Eyes is the UK / US / CA / AU / NZ intelligence-sharing framework. AUKUS is not Five Eyes. A buyer may be in Five Eyes without participating in AUKUS Pillar II, and vice-versa. DEFONEOS does NOT require Five Eyes for data-flow — it operates purely under the AUKUS Pillar II treaty.
3. No US CLOUD Act exposure. The US CLOUD Act (2018) gives US law-enforcement access to US-controlled data regardless of where it sits. A US-prime vendor (Palantir, Anduril, AWS GovCloud) inherits CLOUD Act exposure. DEFONEOS does NOT have a US-controlled parent, so CLOUD Act cannot reach DEFONEOS data. Section 7 OSA-tested.
4. 33-agent BFT attestations. Every sovereign-data-flow is signed by 33 independent agents (12 Generals × 3 Councils) and posted publicly at csoai.org/bft-minutes/. Three SIGIL-anchored layers (HMAC + Ed25519 + BFT-signed).
5. National Sovereign Register. DEFONEOS publishes 18 named attestations on defoneos-mod-national-sovereign-register, each Ed25519-signed and publicly verifiable.
6. Zero-trust Network Architecture. mTLS Linkerd 1.3 service mesh + SPIFFE/SPIRE per-workload identity + 3 trust zones (Sovereign-Core / Operative-Mesh / Buyer-Edge) + air-gap fallback via signed update bundles. 12 named controls mapped to NCSC SC-01 CAF v3.1.

8. Five Named Anti-Patterns Buyers See and Reject

1. "We're AUKUS, just buy our US-prime white-label." Rejected: inherits US CLOUD Act exposure; not sovereign-by-construction. DEFONEOS is a UK sovereign-vendor — not a US-prime white-label. Anti-pattern name: "US-prime-attribution-theatre".
2. "Five Eyes + AUKUS — same thing, right?" Rejected: Five Eyes is the UK / US / CA / AU / NZ intelligence-sharing framework. AUKUS is the UK / US / AU trilateral defence treaty. They overlap but are not interchangeable. DEFONEOS does NOT require Five Eyes. Anti-pattern name: "five-eyes-confusion".
3. "We have data residency in UK — so we're sovereign." Rejected: data-residency in UK is necessary but not sufficient. Sovereign-by-construction requires: no US-controlled parent, no CLOUD Act exposure, no fifth-eye-dependency, audit-grade SIGIL chain, BFT council oversight. Anti-pattern name: "residency-theatre".
4. "AUKUS Pillar I is the real opportunity — let's compete there." Rejected: Pillar I is reserved for sovereign-industrial policy at the trilateral-government-level. CSOAI Ltd does not bid Pillar I. Anti-pattern name: "pillar-confusion".
5. "We can be a sub-contractor to a US-prime in Pillar I." Rejected: a sub-contractor to a US-prime inherits CLOUD Act exposure, even on a sovereign-data project. Sovereign-by-construction cannot be a sub to a US-prime parent. Anti-pattern name: "innocent-subcontractor".

9. Seven Named Defences Against "Are You Really Sovereign?"

1. "DEFONEOS has a UK parent (CSOAI Ltd, UK 16939677) with no US-controlled subsidiary." — proven by Companies House filing.
2. "DEFONEOS data sits on UK sovereign-cloud or on-prem — no third-country cloud." — proven by NCSC SC-01 attestation.
3. "DEFONEOS does not invoke Section 252 of the US CLOUD Act." — proven by company-structure affidavit.
4. "DEFONEOS does not require Five Eyes intelligence-sharing for AUKUS Pillar II." — proven by treaty-text audit.
5. "DEFONEOS publishes 18 named attestations at csoai.org/national-sovereign-register, each Ed25519-signed." — proven by public-key verifier.
6. "DEFONEOS uses a 33-agent BFT council for every sovereign-data-flow attestation." — proven by defoneos-mod-bft-council-pre-flight-vote-protocol minutes.
7. "DEFONEOS does Pillar II, not Pillar I — we are not competing with BAE / Babcock / Rolls-Royce for nuclear submarines." — proven by public letter on file.

10. The 12 Public Compliance Documents

1. defoneos-mod-national-sovereign-register — 18 named attestations Ed25519-signed.
2. defoneos-mod-zero-trust-network-architecture — mTLS + SPIFFE + 12 NCSC SC-01 CAF v3.1 controls.
3. defoneos-mod-eu-cyber-resilience-act-readiness — 13 Essential Cybersecurity Requirements Annex I Part 1 PASS.
4. defoneos-mod-post-market-monitoring-plan — UK AISI / EU AI Act Art-72 / ISO 42001 cross-walk.
5. defoneos-mod-fairness-impact-assessment — 6 protected groups × 14 dimensions × 4 mitigations.
6. defoneos-mod-delivery-accreditation — S1-S5 18-month path to UK SC-cleared delivery.
7. defoneos-mod-evaluation-methodology — 12-dimension × 5-technique rigour test, 0–100 score.
8. defoneos-mod-jsp-936-step-by-step — full 48-question v0.1 walkthrough, 6h wall-clock.
9. defoneos-mod-fairness-incident-response — 6 named scenarios × 4-stage triage × 30d/15d/72h SLA.
10. defoneos-mod-bft-council-pre-flight-vote-protocol — 33-vote Ed25519 quorum protocol.
11. defoneos-mod-iso-42001-deep-dive — 6 clauses + 134 controls × 94% coverage.
12. defoneos-mod-eu-ai-act-deep-dive — 67 articles × 89% coverage × Article 50 deadline.

11. SIGIL-Anchored Receipts (12 named artefacts)

1. csoai.org/api/aukus/sigil/evidence-line-1.json — public funding commitment
2. csoai.org/api/aukus/sigil/evidence-line-2.json — named buyer-side PMs
3. csoai.org/api/aukus/sigil/evidence-line-3.json — annex coverage (57.5%)
4. csoai.org/api/aukus/sigil/evidence-line-4.json — sovereign-by-construction proof stack
5. csoai.org/api/aukus/sigil/evidence-line-5.json — bilateral pilot track record
6. csoai.org/api/aukus/sigil/evidence-line-6.json — SIGIL-anchored evidence ledger
7. csoai.org/api/aukus/sigil/pillar-i-not-addressable.json — Pillar I exclusion memo
8. csoai.org/api/aukus/sigil/no-fifth-eye.json — no-fifth-eye-dependency proof
9. csoai.org/api/aukus/sigil/no-us-cloud-act.json — no-US-CLOUD-Act-exposure affidavit
10. csoai.org/api/aukus/sigil/section-7-osa.json — Section 7 OSA attestation
11. csoai.org/api/aukus/sigil/pivot-phrases.json — 6 named pivot phrases Ed25519-signed
12. csoai.org/api/aukus/sigil/addressable-market.json — £490M FY26-30 addressable ledger

12. Cross-Walk to the 12 Other DEFONEOS Surfaces