The MOSAIC Protocol: Building, Costing and Integrating a Multijurisdictional Cyber-Attribution Service

Paper 3 argued that a hostile cyber operation may be divided amongst jurisdictions so that no territorial State possesses an intelligible view of it, whilst the controller, having designed the division, retains the only map capable of joining objective, target, code, infrastructure, payment and effect. The legal answer proposed there was a duty of correlation placed chiefly upon the actor which possesses that map, supported by authenticated notices, rapid preservation and federated enquiries between States. This paper supplies the machinery. MOSAIC—the Multijurisdictional Operation Signal Attribution and Integrity Correlation protocol—is a federated public system through which authorised national nodes, designated providers and investigators can ask narrowly defined questions of evidence held elsewhere without first transferring the evidence itself. It is not a global database. Raw logs remain with the lawful custodian; the protocol exchanges signed enquiries, match assertions, provenance, confidence and preservation receipts. Production follows the legal process applicable to the requested evidence. The design thereby shortens the interval in which an ephemeral fragment disappears, without pretending that technical correlation proves legal attribution. The paper specifies the service rather than merely recommending it. It defines the common event schema; the cryptographic operation identifier; the controller's attribution manifest; the national node; provider gateways; privacy-preserving matching; evidential chain of custody; human decision points; correction and challenge; zero-trust access; compromise recovery; independent oversight; and the interfaces by which the National Cyber Security Centre, National Crime Agency, courts, regulators, operators of essential services and foreign counterparts might employ it. STIX 2.1 and TAXII 2.1 provide an exchange foundation, but require legal-evidence and privacy extensions; existing MISP or OpenCTI deployments may serve as adapters, not as the final system of record. A twelve-month United Kingdom-led pilot is estimated at £10.61 million including optimism-bias contingency. The core three-year programme—twelve national partners, approximately 2,000 reporting organisations, 250 million normalised security events each month and continuous operations—is estimated at £61.2 million in 2026 pounds, excluding VAT and the ordinary cost of participants' existing logs. A constrained deployment is estimated at £29.6 million; a thirty-State, high-volume deployment at £125.6 million. Each estimate discloses staffing, infrastructure, assurance, partner grants, contingency and the assumptions by which it may be challenged. MOSAIC cannot make an unwilling State cooperate, determine intent from an address, or confer an international right to use force. It can do something more modest and, for immediate defence, more useful: preserve the fragment before it expires; reveal that apparently separate fragments form one campaign; show which actor possessed which knowledge at which time; and produce an auditable record by which sanctions, prosecution, civil restraint, diplomatic action and, where the independent rules of international law permit it, defensive force may be considered upon evidence rather than conjecture. Publication edition, revised October 2026; not yet peer reviewed.