Bran (Brandon) Myers

Thinking out loud

Featured · Independent Investigation · 9-part series

UK Data Linkage: Independent Investigation

How the UK Ministry of Justice, ONS and NHS England link citizens' records with Splink — lawful, undisclosed to the individual, and quietly migrating toward real-time operational use — and where, exactly, the courts have ruled the same playbook unlawful. Built entirely from the governments' own published documents, every claim primary-sourced and adversarially fact-checked.

★ Start here: the Splink Investigation hub → The Joined-Up State (the close) → NEW: The Splink Ecosystem (the software map) → Palantir Goes Global → The Operational Twin (Palantir · UK) → Ruled Unlawful Next Door → Statistics or Operations? → The Quiet Joining-Up → Who Actually Uses Splink ▤ How Splink Works (visual) ▶ Slides ↓ PPTX ✎ Press kit ↗ GitHub
Public-Interest Investigation · Legal Exposure · Latest
Ruled Unlawful Next Door: What Has Actually Been Adjudicated
No court has ruled Data First, Splink, ONS IDS or ADR UK unlawful — and I say so plainly. But the same shortcut, keeping citizens' data-protection safeguards in policy instead of law, has been struck down by the courts three times running. Tier-graded, primary-sourced, with slides. Where the line is, and the line I will not cross.
Public-Interest Investigation · The Software Map · Latest
The Splink Ecosystem: Every App Tied to the Tool
The supply-chain map: every app, library, backend and government system genuinely tied to Splink — and, fenced off, the rivals that aren't. 75 items, tiered and sourced. Broad reach (~890k downloads/month) but narrow real dependency, concentrated in UK government — and GitHub's "110 dependents" turns out to be inflated.
Public-Interest Investigation · The Close · Latest
The Joined-Up State: What It All Adds Up To
The capstone. Eight investigations in one verdict: two layers of citizen-data linkage (open-source statistical Splink + US-owned operational Palantir), what the courts have actually ruled — tiered honestly — and what a citizen, a journalist or a regulator can do about it. The line held all the way through.
Public-Interest Investigation · Palantir Worldwide · Latest
The Operational Twin Goes Global: Palantir Across Every Country That Runs Splink
Does the pattern travel? Palantir mapped across all ten Splink countries, tiered and adversarially verified. The US dominant and operational; Germany's Constitutional Court ruled the Palantir-run police system unconstitutional — and named it; Chile, the Gambia and Laos clean negatives. Same states, two ends of data-linkage — the high-risk, foreign-owned end bought with far less transparency.
Public-Interest Investigation · Palantir Companion · Latest
The Operational Twin: Palantir and the Joined-Up British State
Palantir does not run Splink — but it is the US-owned operational layer in the same NHS, MoD, Home Office and police systems Splink links statistically. Eight connection vectors, tiered by what can be proven, with an animated department-by-department map. Where Splink counts, Palantir acts.
Public-Interest Investigation · Global Footprint · Latest
Who Actually Uses Splink — And What They Do With Your Records
Fourteen government adopters, each profiled to UK depth and adversarially fact-checked. The honest answer is narrower than the maintainer's logo-wall: 3 proven operational (UK MoJ, ONS, Australia), a self-reported middle tier (some of it wrong), pilots and research — and confirmed cases where Splink was tested and rejected. Tiered by what can actually be proven.
Public-Interest Investigation · How It Works · Visual
How Splink Works: No Hack, No Consent, No Opt-Out
The whole machine in one picture: separate health, tax, justice, benefits and census records — with no shared ID — matched by MoJ-built software into one profile of you. Not a hack. No consent required. No opt-out. The short, visual version of the series.
Public-Interest Investigation · Follow-up
Statistics or Operations? What the UK's Own Documents Admit
The MoJ says Data First is "not for operational decision-making." A separate transparency record describes the same tool — Splink — running in courts, in real time, with a daily feed to the police. The line they drew, and where they stepped over it.
Personal
I Always Get Back Up
There is a version of me people misunderstand. The intensity, the crashes, the rebuilding. What they often do not see is how many times I have had to become my own rescue.
Cryptography · Essay
Why I Built Invisible Encryption
Conventional encryption marks itself. It announces its own existence. I wanted to build something that didn't.
SEO · Infrastructure
Subdomain Theory and Why Everyone Gets i18n Wrong
The standard approach to international SEO is subfolders. The correct approach is subdomains. Here's why, and what 45,000 pages taught me.
Infrastructure
The Night I Replaced a Vendor Database with a Signed Chain
Atlas was being terminated. We ended with a self-hosted, Ed25519-signed, tamper-evident chain replicated across five nodes. In one session.
Cryptography · Personal
Post-Quantum in a Single Week
FIPS 204 and 205 finalized in 2024. Eighteen months later, TreeChain just shipped both as primary signatures across four nodes. One focused week. Most of it was deciding what not to do.
Cryptography · Architecture
Three Signatures, No Insurance
Most chains pick one signature scheme. I sign every entry three times. Lattice, classical, hash-based — three independent mathematical foundations. An attacker has to break all three.
Infrastructure · Personal
From Render to Sovereignty
I shut down the last vendor node this week. Four jurisdictions, no vendor in the loop. If I disappear tomorrow, the mesh keeps replicating.
Security Research
How I Zero-Dayed Chrome and What It Taught Me About Power
CVSS 9.6 Critical. 100+ vendors. Google WontFix. What finding a hole in the world's most popular browser taught me about institutions.
Cryptography
The Day AES Called Back
I sent a cold email to the co-creator of AES. He replied. He validated the architecture. That changed everything.
Architecture · Personal
On Building Systems That Hold Up When Reality Gets Messy
Not "I built something they cannot break." But "I built something that still holds up when reality gets messy." That is the level that actually wins.
Infrastructure · Personal
I Deleted Three Million Records and Slept Better
Replaced vendor-dependent database operations with embedded encrypted DuckDB. Zero latency. Zero cost. PII never leaves the rack.
Personal
On Building Through Pain
Projects froze for years. A marriage ended. Access to my daughters became conditional. A visa stripped away. And then I built harder and faster than I ever had before.