In a world run by software and data, I am interested in where the control lies. I conclude control is settled by structure, regardless of how well or badly
organisations behave. The question who ought to be in control, and how do we keep it that way? appears throughout AI, tech giant monopolies, privacy law and
health data, and I mostly try to change the answers.
CV and background. Contact dan@shearer.org ↗.
🔓
The same fight, thirty years apart1992. The SMB protocol was secret, so Microsoft decided who was allowed to interoperate. We did not ask them to open it. We wrote it down, and refusing stopped working. Microsoft lost 13-0 in the EU Court of First Instance, published 30,000 pages of protocol documentation, and was fined €899 million six days later for the terms it attached. Samba runs on roughly a billion devices, and Microsoft has honoured that ruling ever since.
But it is a permission we were granted. It took a decade at law, against one company, and it holds because a court continues to say so. Samba won every battle and is still not something most people consider when they decide where to put their files.
Now. SQLite holds the world’s personal data — contacts, messages, health records, browsing history — in plain text, at a scale nothing else reaches. LumoSQL does not ask application authors to add encryption. It changes what happens beneath them, so they get it without being modified: rpm builds against LumoSQL without a single change to rpm’s own source, and Fossil, which needs SQLite versions that have not been released yet, runs on it too.
This time nobody had to agree.
If you’re here about…
…AI ethics or agentic systems: safety belongs in the structure around AI, not inside it, and reliable structure improves on what AI companies offer. With William Waites I work on the Perseverance Composition Engine ↗, which implements the idea of Artificial Organisations — copying how human institutions have handled untrustworthy members for thousands of years. These address big problems in AI.
…medical research, biobanks, epidemiology or data ethics: Who owns health data? My work in epidemiology covers One Health and rule-based malaria modelling. Medical Snapshot proposes a system that is structurally forbidden to tell you your own results, compared against 25 systems used in the last 90 years. The Active Heat Exchanger is a 3D-printed retrofit at TRL 7 that improves indoor air quality and generates life-saving data that exists nowhere at present. Radiophobia is an easy-to-read explainer for a widespread medical problem I experienced myself.
…open source & computer science: Samba and its history have lessons for today, and LumoSQL applies them at a much larger scale. Not-forking makes it possible to build on code you do not control without forking it. Security analysis led me to consider intent, starting with Margaret Hamilton.
…IP, governance and regulation: Data mobility after Brexit is an ever-evolving painful reality for UK organisations, while much larger EU–US privacy battles might be coming to a showdown in 2026, and paracopyright is the new way to extort entire populations. Large companies often ignore regulation while claiming compliance; sometimes the regulation has surprising wrinkles, such as the facts buried in GDPR Article 28 that turn a trust problem into a cryptography problem.
…advisory, expert witness or collaboration: I work with founders, boards and courts on software IP, privacy regulation and open-source strategy — six years of technology due diligence for a Nordic venture fund, and expert witness work before the Court of Session. Background and contacts.
…contributions and corrections: errors, missing references and additions are welcome; the site challenge has the details.
More: AI and agentic systems · health and research · open source · law and privacy
Browse all content by topic or search full text.