How it was made
Molnkartan was built by Reda Ekengren together with Claude Code, an AI agent from Anthropic. Claude wrote the code, ran the measurements and wrote the texts. Reda asked the question, set the rules and decided what could be published.
An AI is fast, and just as fast at fooling itself
An agent can measure 512 domains in a few minutes. It can also find the patterns it wants to see, pick the explanation that sounds best and write a headline that claims more than the data. That is why the project is built on rules that make it hard to be wrong without anyone noticing.
- The rules are written before the data. Every classification is in METOD.md (in Swedish), dated, before the measurement runs. If a rule is changed afterwards, it becomes a new version with a new test.
- Tested on data the rules have not seen. Stockholm County was used to develop the rules and Skåne decided whether they held. The web rules failed that test twice and were rewritten before anything was published.
- Independent checks. Every conclusion is tested with another method, for example Microsoft's own answer about a domain, three different DNS services and two sources for which country a network belongs to.
- Reviewers looking for errors. Two separate Claude agents and then Codex from OpenAI were tasked with finding errors. They found several, see the findings about the review.
- Gates before publishing. A measurement that does not reach 95 % coverage, or where the checks fail, is not published. The numbers on the pages are checked by tests against the raw data.
- Ask for the ground truth. In October 2026, 43 municipalities and regions were asked which email service they use, without being told what Molnkartan says about them. The result will be reported here, even if it shows the method was wrong.
- Corrections stay. Errors that are found are dated in the method. Nothing is rewritten afterwards.
What is not measured
Everything is based on what anyone can see from the outside: DNS, certificate logs and what a web page calls. No logins, no leaks. Names of internal systems and login pages are never published, and security weaknesses are reported only per county.
Frequently asked questions
- What does Molnkartan measure?
- What can be seen from the outside of US cloud services at Sweden's 290 municipalities, 20 regions and 202 government agency domains: email via DNS, Microsoft accounts, which networks the website calls before the visitor has given consent, and service names in certificate logs.
- Does Microsoft in the email setup mean the data is stored in the USA?
- No. The measurement shows configuration and requests visible from the internet, not where information is stored, which agreements apply or how dependent the organisation is.
- How do you know the measurement is right?
- The rules are written before the data is collected and tested on a region they were not developed on. Conclusions are checked with independent methods, reviewers have looked for errors, and 43 municipalities and regions have been asked which email service they use.
- How often is the data updated?
- The measurement runs automatically on the 1st of every month. Runs that do not meet their requirements are not published.
- Can I use the data?
- Yes. The data is free to use under CC BY 4.0 and the code under the MIT licence. Everything is on GitHub.
- Who is behind Molnkartan?
- Reda Ekengren, who built the project together with the AI agent Claude Code from Anthropic. Molnkartan is an independent project, not a government body.