Research: Nation-State Ratchets — Comparative Architecture

Comparative research dossier. Five Eyes completion (Canada/AU/NZ/Japan/SK) and Gulf surveillance customer-states (Saudi/UAE/Egypt/Bahrain/Qatar). Each nation assessed against a uniform criterion: does this state operate a coherent Ratchet architecture (think-tank brain trust + intelligence services + revolving-door personnel pipeline) worth modeling as a full cluster, or does it occupy a different role (customer, satellite, non-player)?

Verdict matrix

Sector codes below (china-state, russia-state) are this dataset’s institution-cohort labels for state-run bodies, not claims about people. See SCOPE.md.

Structural insights

Finance-first vs. defense-first vs. bureaucracy-first

The Ratchet architecture is not uniform across operator states. Three structural patterns surface from the comparison:

• Finance-first (US, UK, Canada): central-bank or major-bank → senior cabinet → board / consulting role → back. Documented in dataset by Rubin / Paulson / Geithner / Mnuchin (US); Carney / Reeves (UK & Canada); Turnbull (AU, partial — Goldman Sachs Australia MD before politics).
• Defense-first (Australia, partially Japan): military / defense-ministry → think tank with explicit state-foundation links (ASPI in AU) → policy posts. AU’s ASPI is the cleanest example — its board includes Defence Secretary + DFAT Secretary ex officio.
• Bureaucratic meritocracy (Japan): career LDP/MOFA tracks; the “Yoshida Doctrine” institutional continuity; JIIA chartered by Abe rather than independent civic foundation; intelligence fragmented across 4-5 ministries (proposed National Intelligence Agency would address this).
• Hybrid state-private (South Korea): Asan Institute is independent but policy-aligned; prosecutor-to-presidency pipeline (Yoon Suk-yeol — career prosecutor → Prosecutor General → President 2022-25) is unique; NIS politically weaponized (multiple impeachments in dataset: Park Geun-hye, Yoon).

Think-tank autonomy gradient

The independence of each Ratchet’s think-tank brain trust varies materially. From most independent to most state-chartered:

1. US (CFR) — independent foundation, member-funded
2. UK (Chatham House) — Royal charter but operationally independent
3. Australia (Lowy) — private foundation (Frank Lowy family); Lowy is independent. ASPI is state-foundation fusion (board has gov ex-officio members)
4. Canada (CIGI) — independent (Jim Balsillie founding endowment)
5. South Korea (Asan) — hybrid; independent endowment but policy-aligned
6. India (ORF) — Reliance-backed private; CSEP independent (former Brookings India)
7. Japan (JIIA) — chartered at Abe’s initiative; state-aligned, not independent
8. China (CICIR / CASS) — explicitly state-run; the analytical arm of the state

The independence gradient predicts how much the brain trust can produce findings the state doesn’t already want.

Intelligence architecture

Five Eyes (US/UK/CA/AU/NZ) operates as a formal sharing alliance. The dataset now models all five intelligence services: US (CIA, NSA, DNI, NCTC), UK (MI5, MI6, GCHQ), Canada (Canadian Security Intelligence Service, Communications Security Establishment), Australia (ASIO, ASIS, ASD, Office of National Intelligence), New Zealand (modeled implicitly through Ardern/Luxon edges to New Zealand Government; GCSB / NZSIS not yet added).

Japan + South Korea are informal Five Eyes adjacents per CSIS analysis — Japan as “de facto sixth eye”; South Korea via the Korea-US intelligence-sharing protocol. Japan’s intelligence fragmentation (PSIA + CIRO + JMOD + MOFA each operating separately) is the structural weakness vs. Five Eyes. South Korea’s NIS is unified but politicized.

Customer cohort distinction

The Gulf agent’s verdict — Saudi/UAE/Egypt/Bahrain as customers, Qatar non-player — adds a useful distinction the dataset’s existing structure didn’t carry. Customer states are documented buyers / deployers of the operator states’ commercial surveillance products (NSO Pegasus, Cellebrite, Cytrox/Predator, Hacking Team, FinFisher). They contribute to the Ratchet’s global reach without being its architects.

In the dataset, edges now run from vendor institutions (NSO, Cellebrite, Cytrox, HackingTeam) to customer-state intelligence services (General Intelligence Presidency, State Security Department, General Intelligence Service — Technical Research Division, National Security Agency). The flow is one-way (vendor → customer), distinct from the bidirectional revolving-door edges within operator Ratchets.

AI-governance instruments by state (24 October 2026)

The architecture patterns above show up in how each operator state governs frontier AI. The sourced record is on The AI Governance Ratchet and the dated calendar on the AI Governance Tracker; in brief:

• United States. Congress has passed no frontier-developer statute. California, New York and Illinois have, and the executive branch answered with Executive Order 14365 and a March 2026 framework asking Congress to preempt them; the federal testing body is named on NIST’s page the Center for Advancing Innovation and Standards for Super Intelligence (Governor of California; ILGA; White House, EO 14365; White House, framework; NIST). See US CAISI.
• European Union. Regulation (EU) 2026/1744 moved the high-risk dates to 2 December 2027 and 2 August 2028; the Commission announced enforcement from 2 August 2026 (AI Act explorer; Commission). See EU AI Office and EU AI Act.
• United Kingdom. The AI Safety Institute became the AI Security Institute on 14 February 2025 (GOV.UK). See UK AI Safety Institute.
• The network. The International Network of AI Safety Institutes (launched November 2024) is now the International Network for Advanced AI Measurement, Evaluation and Science (NIST).

What the dataset models

Full Ratchet completions (institutions + named persons):

• Canada: Centre for International Governance Innovation, Canadian Security Intelligence Service, Communications Security Establishment, Canadian Global Affairs Institute, Munk School of Global Affairs and Public Policy + David Johnston (former Governor General), Dominic Barton (McKinsey → Trudeau growth-council Chair → Ambassador to China)
• Australia: Australian Security Intelligence Organisation, Australian Secret Intelligence Service, Australian Signals Directorate, Office of National Intelligence, Australian Strategic Policy Institute, Lowy Institute + Kevin Rudd (PM → Asia Society Policy Institute President → US Ambassador), Malcolm Turnbull (Goldman Sachs → PM), Marise Payne (FM/Defence → Hoover Institution), Tony Abbott (PM → UK Board of Trade)
• New Zealand: New Zealand Institute of International Affairs only (no new persons — satellite verdict)
• Japan: Japan Institute of International Affairs, Public Security Intelligence Agency, Cabinet Intelligence and Research Office, Japan Ministry of Defense, Okazaki Institute + Shinzo Abe (longest-serving PM in Japanese history; NSC architect; assassinated 2022), Toshimitsu Motegi (FM continuity), Hisahiko Okazaki (Foreign Ministry diplomat → Okazaki Institute founder)
• South Korea: Asan Institute for Policy Studies, National Intelligence Service, Korea Institute for Defense Analyses, Ministry of National Defense + Yoon Suk-yeol (career prosecutor → President 2022-25, impeached + removed 2025), Victor Cha (NSC Bush2 → CSIS Korea Chair → Georgetown University → Asan), Choi Kang (Asan President), Park Geun-hye (PM 2013-17, impeached + removed 2017)

Customer cohort institutional anchors:

• Saudi: General Intelligence Presidency, King Faisal Center for Research and Islamic Studies, Saudi Public Investment Fund, Government of Saudi Arabia
• UAE: State Security Department, Abu Dhabi Investment Authority, DarkMatter Group, Government of the United Arab Emirates
• Egypt: General Intelligence Service — Technical Research Division, Government of Egypt
• Bahrain: National Security Agency, Government of Bahrain
• Qatar: Qatar Investment Authority, National Cyber Security Agency, Al Jazeera Media Network, Government of Qatar

Vendor expansion (operator-side commercial-surveillance ecosystem):

• NSO (already in v3), Cellebrite (added), Cytrox (Predator/Intellexa), HackingTeam (Memento Labs), FinFisher (Gamma Group)

Customer edges (vendor → customer state intelligence service): NSO→General Intelligence Presidency, NSO→State Security Department, NSO→General Intelligence Service — Technical Research Division, NSO→National Security Agency; Cellebrite→State Security Department, Cellebrite→General Intelligence Service — Technical Research Division; Cytrox→General Intelligence Service — Technical Research Division; HackingTeam→General Intelligence Service — Technical Research Division.

What this dossier supports

• Chapter argument (when written): the Ratchet is global. The US operates most of the 20 clicks — including The Eagle (click #9, US extraterritorial enforcement) as its most distinctly-national contribution. But the US doesn’t operate the global control-grid alone; the British, European, Indian, Israeli, Canadian, Australian, Japanese, and Korean state institutional architectures all participate. The customer cohort (Saudi/UAE/Egypt/Bahrain) shows the Ratchet’s product-market reach. (Naming note: the book uses click-archetypes — Eagle, Tap, Watchers, etc. — for mechanisms. The dataset uses nation-state cluster names — british-ratchet, canadian-ratchet, etc. — for institutional architectures. Two complementary vocabularies, not interchangeable.)
• Cluster queries (in MCP server): the four new operator clusters (canadian-ratchet, australian-ratchet, japanese-ratchet, korean-ratchet) plus the existing clusters (british-ratchet, european-ratchet, indian-ratchet, israeli-ratchet, plus china-state and russia-state sectors) form a queryable matrix.
• Negative results stay published: New Zealand “thin Ratchet” verdict and Qatar “non-player” verdict are themselves defensible research findings. They warn against speculative over-extension and ground the comparative analysis.

Sources

Five Eyes / Asia research (primary)

• CIGI
• ASPI, Lowy Institute
• NZIIA
• JIIA, Okazaki Institute (2015 capture; the live domain is now a parked sale page)
• Asan Institute, KIDA
• CSIS Korea Chair
• Kevin Rudd, Chatham House

Gulf customer cohort (primary)

• Citizen Lab — NSO Group operator tracking
• Citizen Lab — Predator In The Wires (Eltantawy targeting)
• Citizen Lab — Bahrain Pegasus
• Privacy International — TRD Egypt report
• Declassified UK — MI5/MI6 training Saudi/UAE/Egyptian intel
• Amnesty International — Pegasus Project
• MERIP — Abraham Accords cybersecurity cooperation