AI Sovereignty Framework for Tribal Nations:
Why On-Premise AI Servers Are a Perfect Match for Tribal Governments
May 2026
Abstract
Put tribal data on a commercial cloud and it becomes a corporate custody question rather than a tribal one, and the corporation that's holding it can be compelled to produce it under the Clarifying Lawful Overseas Use of Data Act (CLOUD Act, 18 U.S.C. § 2523). That's the standing legal condition of every tribal nation whose health records, emergency operations data, enrollment information, governance documents, and traditional ecological knowledge sit on somebody else's server. This framework's the legal, operational, and strategic case for on-premise, tribally owned AI infrastructure as the only architecture that's simultaneously OCAP-compliant, HIPAA-defensible, Stafford Act-compatible, and consistent with the self-determination authority granted under the Indian Self-Determination and Education Assistance Act (ISDEAA, P.L. 93-638). The Yurok Tribe's Yurok Telecommunications Corporation (YTEL) network shows what sovereignty-first infrastructure looks like when a nation carries it all the way through, and why local AI isn't merely viable in frontier and rural country but operationally better.
Introduction
Tribal nations are getting sold artificial intelligence the same way they've been sold every technology wave before it: fast, cheap, and from outside.
Cloud AI platforms from Microsoft, Google, Amazon, and their downstream resellers are working Indian Country hard right now, and I'll grant that the pitches are good. Low upfront cost. Rapid deployment. Language tools that'll draft a grant narrative, summarize a damage report, or cross-reference treaty compliance while you're still hunting for the file.
Here's what the pitch leaves out. The moment tribal health data, enrollment records, emergency operations plans, or governance deliberations land on a cloud server owned by a U.S.-incorporated technology company, that data leaves the legal protection of tribal sovereignty and enters the jurisdictional reach of the federal government. Not metaphorically. It's under an active federal statute, and it's been that way since 2018.
That statute's the Clarifying Lawful Overseas Use of Data Act (CLOUD Act, 18 U.S.C. § 2523, enacted 2018), which amended the Stored Communications Act of 1986 to let federal law enforcement compel any U.S.-incorporated technology company to produce data under its custody or control, wherever that data physically sits. The legal hook's corporate control, not geography. A tribe whose data's processed by a cloud AI vendor hasn't got standing to contest a CLOUD Act warrant aimed at that vendor, because the warrant is aimed at a corporation, not at the tribe. That corporation isn't a sovereign nation, has no treaty relationship with the United States, and can't assert tribal sovereign immunity on anybody's behalf.
This framework works the full stack of that problem: legal, operational, strategic. It isn't an argument against artificial intelligence and I'd rather nobody read it as one. Refusing AI stopped being a realistic posture for tribal emergency management, tribal health administration, and tribal governance operations somewhere in the last twenty-odd months. The tools have become operationally necessary whether or not anybody in the building is comfortable with that. The open question's who owns the server they run on, and what that ownership choice exposes.
Read against the body of federal Indian law, data sovereignty frameworks, and emergency management operational requirements, the answer comes out one way. Tribally owned, on-premise AI infrastructure is the only configuration that satisfies OCAP principles, HIPAA protections, ISDEAA self-determination authority, Stafford Act incident data requirements, and the definition of digital sovereignty established in National Congress of American Indians Resolution NC-24-008 all at once.
Three Legal Faults in Cloud AI Deployment for Tribal Nations
The case against cloud AI for tribal data comes down to three structural faults rather than a preference or a policy reading, and any one of them's enough on its own to disqualify cloud AI for a tribal government operating in good faith under its own data governance commitments.
Fault One: OCAP Violation by Design
The OCAP Principles, Ownership, Control, Access, and Possession, were established by the First Nations Information Governance Centre in 1998 as the governing standard for Indigenous information management.1 Three of those four are claims a nation asserts on paper. Possession's a fact about where a thing physically sits, and it's the one the other three are standing on. A tribe's got to hold its own data to meaningfully exercise ownership, control, and access. There's no other way in.
Cloud AI breaks Possession by definition, not by accident. When tribal data's processed on a vendor's server, the tribe doesn't possess it. The vendor does. Every health record, every emergency operations document, every governance deliberation that runs through a cloud AI platform's data sitting in third-party custody. For any tribe that's adopted OCAP as its information governance standard, and the framework's broadly endorsed across tribal communities in the United States, that's a direct violation, and there's no reading of the document that softens it.
OCAP further asserts that a tribe controls how information about it gets collected, analyzed, and used at every stage.2 A cloud AI vendor that ingests tribal data for model improvement, even anonymized, even aggregated, breaks Control too. The tribe didn't authorize its knowledge to train a commercial system. A vendor's terms of service aren't tribal authorization and they never were. If that distinction sounds academic, it's the same one that mattered when outside researchers extracted tribal knowledge into publications that built careers and won grant funding at universities far from Indian Country, and returned nothing lasting to the communities whose knowledge made the work possible.
Fault Two: CLOUD Act Jurisdictional Exposure
The CLOUD Act hands federal law enforcement access to tribal data through a door that sits entirely outside the government-to-government framework governing federal-tribal relations. The warrant goes to the technology company. The tribe gets no notification. The tribe hasn't got standing to contest the disclosure, because it isn't the respondent. And because it isn't the respondent, none of the procedural protections that'd apply to a direct federal request for tribal records apply here: not treaty protections, not sovereign immunity assertions, not government-to-government consultation requirements. The whole thing routes around the nation.
The operational version's uglier than the legal one, and it's the one I'd take to council. A tribe filing a Public Assistance claim under the Stafford Act, negotiating damages and recovery costs with FEMA after a presidential disaster declaration, could be running that negotiation while a federal agency reads the tribe's own internal damage analysis through a CLOUD Act warrant served on the tribe's cloud AI vendor. The Preliminary Damage Assessment, the foundational document the entire PA claim rests on, is in your counterpart's hands before anybody sits down at the table.
As one analysis of the intersection of tribal sovereignty and third-party data custody concluded: if a tribe's data is held by a third party and then seized by outside government entities, the tribe will not be informed that its data is under investigation because it is no longer within its control.3 That's a description of the present, not a warning about the future: the current operating condition of every tribal nation that's running sensitive data categories through commercial cloud AI.
Fault Three: Data Colonialism in Automated Form
The extraction economy that drove dispossession of tribal lands didn't retire. It retooled, and it's running the same play with better margins.
Commercial AI platforms train on data ingested from the systems that process it. Health outcome patterns from tribal populations. Emergency response strategies built out of decades of hard-won operational experience. Governance language. Traditional ecological knowledge embedded in land management records. Cultural and linguistic material from language preservation programs. All of it's raw training material now, feeding commercial systems whose profits flow to corporate shareholders and not to the tribal nations whose knowledge and experience made those systems more capable.
That's the documented operating model of every major AI platform, not a speculative framing. Training data's the primary asset, and the more diverse, specific, and contextually rich it is, the more capable and monetizable the resulting model. That's the pitch deck, not a secret. As researchers tracking Indigenous data governance have documented, AI systems increasingly include Indigenous languages, traditional knowledge, and oral histories, sometimes collected without consent, stored in centralized databases, and used to train commercial algorithms that offer little or no benefit to the Indigenous communities.4 The National Congress of American Indians, in its 2025 response to the White House Office of Science and Technology Policy's AI Action Plan solicitation, affirmed that tribal nations possess inherent sovereign rights to enforce their digital sovereignty standards on AI data and that AI technologies must not circumvent tribal data collection protocols or violate tribal sovereignty.5
Convergent Validation
Three separate bodies of evidence arrive at the same place from different directions, and that convergence is what ought to settle it.
Pillar One: NCAI Resolution NC-24-008 and the Center for Tribal Digital Sovereignty
In 2024, the National Congress of American Indians passed Resolution NC-24-008, formally defining digital sovereignty for tribal governments. The resolution defines it as the exercise of sovereign authority over physical and virtual network infrastructure and the intangible virtual digital jurisdictional aspects of the acquisition, storage, transmission, access and use of data, including policy developments that impact the tribe's digital footprint in local and virtual spaces.6
The operative words are physical and virtual. That's not decoration. NCAI didn't write a preference about data use. It wrote a requirement for tribal authority over the physical infrastructure data moves through and rests on. A tribe that's using a commercial cloud AI platform has handed that authority to a technology vendor. By NCAI's own definition, that tribe isn't exercising digital sovereignty, whatever the policy binder says.
Concurrent with the resolution, NCAI and Arizona State University's American Indian Policy Institute launched the Center for Tribal Digital Sovereignty in June 2024, the first institution of its kind dedicated to helping tribal governments build the sovereign digital infrastructure plans they'd been told to write without one. The Center's founding Executive Director Dr. Traci Morris stated at launch that tribal digital sovereignty includes both the information and the physical means by which it transfers, and that it is governance, it is economic, it is self-determination.7 The physical means aren't a footnote to the framework. They're the floor the whole thing's standing on.
Pillar Two: The CLOUD Act as the Digital Allotment Act
The Dawes Allotment Act of 1887 didn't dispossess tribal nations in one dramatic stroke. It converted communal land into individually owned parcels and then let ordinary property law do the rest: sale, transfer, alienation, a piece at a time. The dispossession was structural, and it was patient. That's what makes it the right comparison.
The CLOUD Act runs identical logic in the digital domain. It doesn't need a breach and it never will. It creates the legal conditions under which tribal data, once it's in third-party corporate custody, gets reached and alienated from tribal control through the ordinary operation of federal warrant authority. Put sensitive data in commercial cloud infrastructure and you've built the digital equivalent of an allotted parcel: individually held by a corporation, technically available to the tribe under contractual terms, and fully exposed to federal legal process through a mechanism that bypasses tribal sovereignty entirely.
The Brookings Institution's analysis of tribal digital sovereignty and AI noted that on-premises solutions that feature local servers can be erected on tribal lands and managed directly by a tribal nation or tribally owned entity, a solution that reflects fundamental digital sovereignty principles.8 The Cherokee Nation's gone exactly that way, spending a year working with a closed-source, internally governed AI model to build its own knowledge base while keeping tribal values at the center of every implementation decision. Cherokee Nation Chief Information Officer Paula Starr has stated plainly that if a tool compromises tribal values, it does not belong in their Nation's systems.9 That's a values test sitting upstream of the procurement test, and I'd take that ordering over most enterprise architecture reviews I've read.
Pillar Three: Emergency Management Operational Requirements
Stack the Stafford Act, the Homeland Security Exercise and Evaluation Program (HSEEP), and HIPAA on top of one another and you get a set of operational data requirements that cloud AI can't satisfy for tribal emergency management. Not won't. Can't. There's a difference, and it matters here.
Under 42 U.S.C. §§ 5121-5207, as amended by the Sandy Recovery Improvement Act of 2013, tribal nations may request presidential disaster declarations directly from the President, independent of state governments.10 That declaration authority generates an extraordinary body of sensitive operational data: Preliminary Damage Assessments naming the specific locations and conditions of tribal infrastructure, Public Assistance applications laying out the full scope of tribal government resources and fiscal capacity, Individual Assistance records carrying Protected Health Information for tribal citizens, and Hazard Mitigation Grant Program applications mapping detailed vulnerabilities in tribal land, water systems, and cultural resources. Run any of it through cloud AI during an active incident and it's exposed to CLOUD Act compelled disclosure at the precise moment the tribe's negotiating with the federal agencies that could obtain it.
HSEEP documentation is its own exposure, and a serious one. After-Action Reports and Improvement Plans produced under HSEEP standards are honest maps of where tribal emergency response capacity fails under pressure: gaps in communications, logistics, medical surge capacity, interagency coordination. That's intelligence about the nation's vulnerabilities. Run it through cloud AI and it's intelligence sitting in third-party custody, reachable by federal warrant, and nobody's obligated to mention it happened.
HIPAA compounds both. Tribal health clinics and Indian Health Service-coordinated facilities operate as Covered Entities under HIPAA's Privacy, Security, and Breach Notification Rules, and during a disaster, when EOC operations coordinate medical response, track casualties, manage pharmaceutical logistics, and work with IHS on surge capacity, Protected Health Information pours straight into emergency management operations. Cloud AI vendors may offer Business Associate Agreements, as required under 45 C.F.R. § 164.504(e). Fine. But a BAA governs the vendor's contractual obligations to the tribe. The CLOUD Act governs the vendor's legal obligations to the federal government. When those two conflict, federal law wins and the contract doesn't get a vote. A BAA was never a CLOUD Act shield, and no vendor has ever put in writing that it was.
The Yurok Model: Sovereignty Built in Layers
The most compelling example of sovereignty-first infrastructure in Indian Country is a construction schedule already in the ground, not a theory paper.
The Yurok Tribe's Yurok Telecommunications Corporation (YTEL) broke ground in July 2025 on four interlocking broadband projects covering approximately 150 square miles of Yurok ancestral lands, connecting more than 2,000 locations across a corridor running from Orick north to Crescent City and east to Weitchpec, some of the most digitally underserved terrain in California.11
The projects deploy 62 miles of fiber optic cable, nine commercial-grade wireless towers, and a fiber lease agreement with the California Department of Technology under which YTEL retains full ownership of the leased fiber.12 The structure's deliberate and it's worth reading closely. Construction capital came in through the National Telecommunications and Information Administration's Tribal Broadband Connectivity Program, the California Public Utilities Commission, and CDT. But YTEL owns the fiber. YTEL runs the network. That's the whole difference and it's worth more than the grant totals. The sovereignty of the infrastructure, on and around Yurok ancestral lands, is tribally held and tribally controlled.
Yurok Tribal Chairman Joseph L. James described the projects at groundbreaking as an expression of tribal self-determination and a desire to build the future the community deserves, and that framing's exact. YTEL is building the physical infrastructure of self-determination, the pipes that tribal governance, health, education, emergency management, and economic activity move through. Jon Walton, CEO of Yurok Telecommunications, has said the same thing from the operator's chair: the sovereignty of the infrastructure on and around reservations is very important.13
YTEL's the network layer. On-premise AI's the compute layer. A tribally owned AI system on YTEL's fiber backbone, working tribal government data inside tribal jurisdiction, completes the stack: owned connectivity, owned compute, owned data. During emergency operations, a coastal earthquake, a wildland fire along the Trinity corridor, a tsunami evacuation on the Klamath coast, that architecture means the EOC's AI-assisted situational awareness tools, damage assessment processing, resource tracking, and Incident Action Plan development all run on tribal infrastructure, over tribal network, inside tribal jurisdiction. No cloud dependency. No CLOUD Act exposure through a corporate vendor. And no interruption when external internet connectivity drops, which is precisely the failure condition most likely during a federally declared disaster in rural tribal country.
When FEMA regional staff arrive for coordinated response, the tribe presents from a position of informational sovereignty. The Preliminary Damage Assessment data the tribe's own system helped compile stays under tribal control through the entire Public Assistance negotiation. The tribe's the one deciding what it shares and when. That's a structural shift in the power relationship between a tribal government and its federal counterpart during the most consequential stretch a tribal emergency manager will ever work.
Operational Use Cases Across Tribal Government
What follows are the deployment contexts I'd expect to surface first, organized by data sensitivity and operational urgency rather than by department. I'll say the obvious part out loud: this is a list of categories, it isn't a recommendation for your government. Which of these matter, and in what order, is what Discovery is for, and Discovery happens on site with your people rather than on a page like this one.
Emergency Management and EOC Operations
Emergency managers do more document-intensive analytical work than nearly anybody else in a tribal government, and they're usually doing it a person or two short. During a declared disaster an EOC team is processing incoming field reports, producing Action Plans for each operational period, coordinating logistics across departments and partner agencies, tracking resource requests and expenditures for eventual Public Assistance reimbursement, and holding situational awareness across an environment that won't stop moving. Local AI takes a real bite out of that with no cloud dependency: summarizing damage reports, drafting IAP components, cross-referencing resource inventories, generating cost documentation for PA applications, all of it running off the tribal network and none of it leaving tribal jurisdiction. In a connectivity-degraded environment, which is the most likely operating condition during a major declared disaster in rural tribal country, it keeps working offline.
Hazard Mitigation Planning
Tribal Hazard Mitigation Plans, required under Stafford Act Section 322 as a prerequisite for Hazard Mitigation Grant Program funding, are exhaustively detailed vulnerability assessments covering every significant hazard facing tribal lands, populations, and infrastructure: earthquake, flood, wildfire, tsunami, drought, dam failure, cyber threats, human-caused hazards. Which makes an HMP a comprehensive map of where the nation's most exposed, and that's about as sensitive as strategic data gets. Local AI shortens the update cycle while the vulnerability analysis doesn't leave tribal jurisdiction. Newly constructed or acquired infrastructure, YTEL's fiber network for instance, folds into the HMP framework through AI-assisted analysis without shipping the underlying data to a third-party server.
Tribal Health Services and HIPAA-Governed Data
This one's the clearest case and the most legally consequential. Tribal health clinics managing PHI under HIPAA, coordinating with IHS on referrals and billing, tracking chronic disease patterns, and supporting emergency medical operations during disasters have obvious high-value AI work sitting in front of them: clinical note drafting, drug interaction analysis, patient history summarization, population health pattern identification. All of it touches PHI, which can't legally travel to a commercial cloud server without a BAA, and which stays exposed to CLOUD Act compelled disclosure even when there's one in place. Local AI eliminates that exposure entirely and keeps every access to that PHI under governance and audit the tribe controls.
Governance, Grants, and Treaty Compliance
Tribal council operations generate decades of governance documentation: ordinances, resolutions, negotiated agreements, land management decisions, treaty compliance records, grant reporting. That corpus is the institutional memory of the nation's self-determination, and right now most of it's only findable by whoever's been there longest. Local AI that searches it, finds precedent in tribal law, drafts policy language consistent with prior governance decisions, and checks grant requirements against current program operations hands real capacity back to a small staff. That governance intelligence belongs inside tribal jurisdiction rather than inside somebody else's training set.
Language and Cultural Preservation
This is the one where I'd ask everybody to slow way down. Traditional ecological knowledge, oral history documentation, and Indigenous language materials are the most culturally irreplaceable data tribal nations hold, and they shouldn't ever enter a commercial AI training pipeline. Local AI can help with language documentation, translation support, and organizing cultural knowledge while the underlying materials stay entirely under tribal control, out of reach of commercial extraction and federal warrant authority alike. That work belongs on tribally owned infrastructure or it doesn't belong anywhere.
Doctrine and Recommendations
The Sovereignty Infrastructure Doctrine
Cloud AI's a convenience that works like a sovereignty trap. The upfront cost advantage is real and I'm not going to pretend otherwise. The data governance exposure's larger, and it never appears on an invoice. It shows up as a weakened negotiating position during a federal disaster declaration, as citizen trust that erodes when health data gets accessed without notification, and as slow attrition of the self-determination authority five decades of federal Indian policy reform have been building toward. This is a sovereignty decision wearing procurement language rather than a technology procurement decision wearing sovereignty language, and it's carrying legal, operational, and generational consequences.
On-premise AI infrastructure, deployed under tribal ownership and operating inside tribal jurisdiction, turns digital sovereignty from an aspiration into a fact about a room. It's the architecture that matches the rights OCAP articulates, that NCAI Resolution NC-24-008 defines, that ISDEAA's self-determination framework implies, and that the government-to-government relationship with the United States demands.
Recommendations for Tribal Councils
Authorize on-premise AI as a digital sovereignty assertion rather than a technology purchase, and say so in the motion. Frame it against what the nation's already committed to: ISDEAA self-determination, OCAP adoption, the data governance principles already sitting in tribal law and policy. Commission an inventory of every tribal data category currently moving through cloud AI or cloud-dependent platforms. Assess each one against the sovereignty standard this framework's setting. Then set a migration timeline, and put emergency management, health, and governance data at the front of it.
Recommendations for Tribal Emergency Managers
Audit your EOC and pre-incident planning tools for cloud dependency, and be honest about the shadow tools nobody put on the list. Identify every data category a Stafford Act declaration generates, Preliminary Damage Assessments, resource tracking, casualty data, Public Assistance cost documentation, and find out which of them touch cloud infrastructure today. Then take the CLOUD Act exposure analysis to tribal leadership in the context of active federal negotiations during a declared disaster, because that's where the argument's strongest. Ask for on-premise AI as emergency management infrastructure, and don't ask for it as a general technology capability. The first framing's the one that gets funded.
Recommendations for Federal Partners and Grant Administrators
FEMA, NTIA, and HHS should recognize tribally owned on-premise AI infrastructure as eligible for funding under existing tribal capacity-building authorities, including BRIC, HMGP, and tribal broadband programs. The Stafford Act already recognizes tribal governments as direct declaration recipients, and that recognition's carrying an implicit obligation to support the data governance infrastructure those governments need to run a declaration with their informational sovereignty intact. Federal AI policy frameworks, including the NCAI-recommended provisions of a national AI Action Plan, should say plainly that cloud-based AI deployment for tribal data categories is structurally incompatible with tribal sovereignty and with the government-to-government relationship.
Conclusion
The legal case is settled, and it isn't close. Here's the whole ledger. OCAP's Possession principle requires physical tribal data control. The CLOUD Act removes meaningful third-party protection for tribal data held in commercial cloud infrastructure. NCAI Resolution NC-24-008 defines digital sovereignty to include the physical infrastructure of data transmission and storage. ISDEAA self-determination authority gets hollowed out when the operational data of self-governed programs sits in federally reachable third-party systems. HIPAA's PHI protections are necessary and not sufficient against CLOUD Act compelled disclosure. Stafford Act declaration processes generate data whose sensitivity demands jurisdictional control while a federal negotiation is live.
The operational case is settled too, and it's simpler. On-premise AI keeps working when cloud connectivity fails, which is exactly when AI-assisted emergency management's needed most. It works sensitive data categories without jurisdictional exposure. It's building a tribal capital asset instead of a vendor's recurring revenue line. And for a nation already building sovereignty-first telecommunications infrastructure, the way the Yurok Tribe is through YTEL, on-premise AI is the natural next layer of the same stack.
Tribal nations fought to hold physical sovereignty over their lands. That fight's moved into the digital domain and nobody sent a notice. The data tribal communities generate about their own lives, lands, health, and governance is as much a tribal resource as the rivers and forests their ancestors defended. It carries ancestors in it. It carries language. It carries the knowledge of when the salmon run and where the fire moved and what the water said in a dry year. It carries the operational intelligence of emergency managers who kept communities alive through declared disasters and wildfire evacuations. It carries the clinical histories of citizens who trusted their health system with the most private thing they've got.
The infrastructure that processes that data ought to belong to the tribe. On-premise AI, tribally owned and tribally controlled, is how that belonging works in practice. It's the only version of it I've found that survives a warrant. The infrastructure we build for AI in Indian Country is either an act of sovereignty or an act of surrender. There's no neutral choice.
Bibliography
Andersen, Nick. Written Testimony before the House Homeland Security Committee on the Effect of the DHS Shutdown on Agency Missions. March 2026.
Brookings Institution. "Avoiding the Next Digital Divide: Defining Digital Sovereignty for Tribal Nations in the AI Age." Brookings, 2024.
Cybersecurity and Infrastructure Security Agency. Artificial Intelligence Risk Categories and Mitigation Strategies for Critical Infrastructure. Version 1.0. Washington, DC: CISA, December 2023.
First Nations Information Governance Centre. Ownership, Control, Access and Possession (OCAP): The Path to First Nations Information Governance. Ottawa: FNIGC, 2014.
Gila River Indian Community News. "Tribal Nations and the Rise of AI." gricnews.org, 2025.
Indian Self-Determination and Education Assistance Act. Public Law 93-638, as amended. 25 U.S.C. §§ 5301 et seq. (1975).
Island Mountain. "Tribal Data Sovereignty and the Cloud AI Problem." islandmountain.io, May 2026.
Island Mountain. "OCAP Principles and the CLOUD Act." islandmountain.io, May 2026.
National Congress of American Indians. NC-24-008: Supporting Tribal Digital Sovereignty as an Exercise of Self-Determination. Resolution adopted at the 2024 Mid Year Convention. Washington, DC: NCAI, 2024.
National Congress of American Indians. Response to NITRD National Coordination Office Request for Information on the Development of an Artificial Intelligence Action Plan. 90 Fed. Reg. 9,088 (Feb. 6, 2025).
National Indian Health Board. 2025 Tribal Health Data Symposium: Strengthening Sovereignty Through Data. Washington, DC: NIHB, March 2025.
Policy Options / IRPP. "AI and Indigenous Data: Addressing the Digital Sovereignty Gap." policyoptions.irpp.org, 2025.
Robert T. Stafford Disaster Relief and Emergency Assistance Act. Public Law 100-707, as amended. 42 U.S.C. §§ 5121-5207 (1988).
Tgandh.com. "Tribal Sovereignty Over Data and Core System Rights." tgandh.com, n.d.
U.S. Department of Homeland Security. Mitigating Artificial Intelligence Risk: Safety and Security Guidelines for Critical Infrastructure Owners and Operators. Washington, DC: DHS, April 26, 2024.
Wipfli LLP. "AI for Tribes: Managing Risk and Maximizing Impact." wipfli.com, 2024.
Yurok Tribe. "Yurok Tribe Celebrates Start of Four Broadband Projects." yuroktribe.org, July 2025.
Yurok Telecommunications Corporation. National Telecommunications and Information Administration Tribal Broadband Connectivity Program Award. NTIA, 2021.
Endnotes
- First Nations Information Governance Centre, Ownership, Control, Access and Possession (OCAP): The Path to First Nations Information Governance (Ottawa: FNIGC, 2014).
- Ibid.
- Tgandh.com, "Tribal Sovereignty Over Data and Core System Rights."
- Policy Options / IRPP, "AI and Indigenous Data," policyoptions.irpp.org, 2025.
- National Congress of American Indians, Response to NITRD National Coordination Office Request for Information on the Development of an Artificial Intelligence Action Plan, 90 Fed. Reg. 9,088 (Feb. 6, 2025).
- National Congress of American Indians, NC-24-008: Supporting Tribal Digital Sovereignty as an Exercise of Self-Determination (NCAI 2024 Mid Year Convention, 2024).
- NCAI and Arizona State University American Indian Policy Institute, Launch of the Center for Tribal Digital Sovereignty, June 4, 2024.
- Brookings Institution, "Avoiding the Next Digital Divide: Defining Digital Sovereignty for Tribal Nations in the AI Age," 2024.
- Gila River Indian Community News, "Tribal Nations and the Rise of AI," gricnews.org, 2025.
- Robert T. Stafford Disaster Relief and Emergency Assistance Act, 42 U.S.C. §§ 5121-5207 (1988), as amended by the Sandy Recovery Improvement Act of 2013, Pub. L. 113-2.
- Yurok Tribe, "Yurok Tribe Celebrates Start of Four Broadband Projects," yuroktribe.org, July 2025.
- California Department of Technology, Broadband for All Update, August 2025.
- Indigenous Economic Development, "Unlocking Opportunity: How Developing Tribal Broadband Advances Communities," indigenouscop.org, 2025.