Skip to content
ParamergeParamerge
Stephen Lieberman
Through Paramerge
Contact

PAN Lab example

BOSCO (Spain)

The secret code: an eligibility engine that gives no reasons

A rules engine decides who qualifies for an electricity-bill discount and gives no reasons, so a wrong denial is nearly impossible to spot or contest — and one uniform bug denies thousands of eligible people at once. Modeled on Spain's BOSCO. Watch where the control comes from: not from a better-built engine, but from the transparency and reasoned-decision channels the design never had, opened here from outside.

Stylized model of a documented deploymentPublic benefits & eligibility

Open this example in PAN Lab v0.1 to apply pressures and levers and watch what the system does.

What this models

This example runs on the BOSCO-class secret-code eligibility engine network: 5 components and 9 pathways between them. Every context in the Lab is a stylized model, never a reconstruction of any actual deployment, and each assumption behind it carries a provenance label.

Evidence base: 3 assumed · 3 published baseline. In the Lab, the shaded evidence band behind each headline readout draws its width from the least-established class below.

  • assumed

    This models the source-code-secrecy eligibility-determination pattern documented in the Spain BOSCO case file — not a reconstruction of the actual application or its withheld logic.

  • baseline

    The model-to-model self-loop encodes the documented 'error multiplier': one deterministic rule set decides every application, so a single systematic flaw repeats identically across every applicant rather than averaging out.

  • baseline

    The defining feature is an absence of a reasoned-decision channel: determinations gave no reasons and the source code was withheld, so a wrong denial could not be surfaced or contested from inside. The reasoned-decision / audit-against-source check starts closed at baseline; the scrutiny that opened it came from outside, by court order, and even then was slow to arrive.

  • baseline

    The applicant-declarations-and-income-checks node carries a real inflow into the engine — declared category flags and the income-data consultation some paths require — so it enters the dynamics. That withholding income-data consent could itself trigger a denial for large families, who qualify regardless of income, is documented in the case file, not computed here.

  • assumed

    The external-transparency node carries only a light, partial read pathway at baseline: the transparency body granted the specs and use cases but not the source code, so the engine's logic stayed unverifiable from outside as well as inside.

  • assumed

    Who was denied — disproportionately vulnerable consumers such as pensioners, low-income households, and large families — and the reported collapse in enrollment are documented in the case file. This Lab models institutional workflow propagation, not demographics, and estimates no differential harm to served people; that harm is measured outside any diagram like this one.

What this example does not show

  • The harm here is under-inclusion — eligible people denied a benefit they qualify for — documented by an NGO's reconstruction of the software's behaviour from functional test cases, not from a published error rate; one academic source records errors in both directions, but the well-documented net effect is under-inclusion. The Lab uses the case's shape, not calibrated rates.
  • Who was denied — disproportionately vulnerable consumers such as pensioners, low-income households, and large families — and the reported collapse in enrollment are documented in the case file. The Lab models institutional workflow propagation, not demographics, and estimates no differential harm to served people; that harm is measured outside any diagram like this one.

Sources and evidence

What this example rests on, claim by claim. Every entry resolves to the same ledger the Evidence Registry publishes.

  • In judgment STS 1119/2025 of 11 September 2025, the Third Section of Spain's Supreme Court (Sala de lo Contencioso-Administrativo) ordered the government to give the transparency foundation Civio access to the source code of BOSCO, the software that determines eligibility for the electricity social bonus (bono social electrico). Applying the Transparency Law (Ley 19/2013) together with Article 42 of the EU Charter of Fundamental Rights and Article 105.b of the Spanish Constitution, the Court held that access to public information is a constitutional right and that neither intellectual property nor national security is an automatic shield, dismissing the government's secrecy claims as a 'mere risk' of eventual harm to be assessed case by case under a proportionality test. Civio and legal commentators describe an 'error multiplier': because BOSCO decides automatically and gives no reasons, one systematic error can propagate to thousands of eligible people at once. As of May 2026, roughly eight months after the ruling, the source code had still not been delivered and Civio had filed for judicial enforcement.

    empirical
    • Government Consejo General del Poder Judicial, El Tribunal Supremo condena a la Administracion a facilitar a una Fundacion Ciudadana el codigo fuente de la aplicacion informatica que acredita a los beneficiarios del bono social electrico (2025) https://www.poderjudicial.es/cgpj/es/Poder-Judicial/Noticias-Judiciales/El-Tribunal-Supremo-condena-a-la-Administracion-a-facilitar-a-una-Fundacion-Ciudadana-el-codigo-fuente-de-la-aplicacion-informatica-que-acredita-a-los-beneficiarios-del-bono-social-electrico
    • Investigative Fundacion Ciudadana Civio, Civio pulls back the curtain on public algorithms: Spain's Supreme Court orders the Government to release BOSCO's source code (English) (2025) https://civio.es/novedades/2025/09/18/civio-pulls-back-the-curtain-on-public-algorithms-spains-supreme-court-orders-the-government-to-release-boscos-source-code/
    • Investigative Fundacion Ciudadana Civio, Civio abre camino en la transparencia algoritmica: el Supremo condena al Gobierno a entregar el codigo fuente de BOSCO (2025) https://civio.es/novedades/2025/09/17/civio-abre-camino-en-la-transparencia-algoritmica-el-supremo-condena-al-gobierno-a-entregar-el-codigo-fuente-de-bosco/
    • Academic Derecho Administrativo y Urbanismo, El Tribunal Supremo declara que la Fundacion Ciudadana Civio tiene derecho a acceder al codigo fuente de la aplicacion informatica BOSCO (STS 11/9/2025) (2025) https://www.derechoadministrativoyurbanismo.es/post/el-tribunal-supremo-declara-que-seg%C3%BAn-la-ley-de-transparencia-la-fundaci%C3%B3n-ciudadana-civio-tiene-d
    • Investigative Fundacion Ciudadana Civio, This is the landmark ruling that sets a new standard for algorithmic transparency in Spain (2025) https://civio.es/novedades/2025/11/17/this-is-the-landmark-ruling-that-sets-a-new-standard-for-algorithmic-transparency-in-spain/
    • Investigative Fundacion Ciudadana Civio, Ocho meses desde la sentencia de BOSCO y seguimos sin tener acceso al codigo (2026) https://civio.es/novedades/2026/05/14/ocho-meses-desde-la-sentencia-de-bosco-y-seguimos-sin-tener-acceso-al-codigo/
    • Advocacy Free Software Foundation Europe, The social value of the freedom to study source code in the Spanish Court (2026) https://fsfe.org/news/2026/news-20260205-01.en.html

  • The transparency foundation Civio documented, by reconstructing BOSCO's behaviour from partial technical specifications and functional test cases, two systematic ways the software denied the electricity social bonus to people who qualified: when a pensioner ticked the 'pensioner' box the application could return an 'imposibilidad de calculo' (impossibility of calculation) error and be rejected without properly evaluating income; and large families, entitled to the bonus regardless of income, were denied whenever a household member withheld authorization to consult income data, although income was not a regulatory requirement for that category. After a 2017-2018 overhaul required all beneficiaries to re-apply by 31 December 2018, enrollment fell from roughly 2.4 to 2.5 million under the prior scheme to 1,111,958 as of January 2019 (later cited around 1.5 million), against an estimated 4.5 to 5.5 million eligible people, and more than half a million applicants were rejected. No audited per-decision error rate is public, because the source code and verification-test results were withheld; one academic analysis records errors in both directions, but the documented net effect is under-inclusion.

    empirical
    • Investigative Fundacion Ciudadana Civio, La aplicacion del bono social del Gobierno niega la ayuda a personas que tienen derecho a ella (2019) https://civio.es/transparencia/2019/05/16/la-aplicacion-del-bono-social-del-gobierno-niega-la-ayuda-a-personas-que-tienen-derecho-a-ella/
    • Investigative AlgorithmWatch (Nicolas Kayser-Bril), Spain: Legal fight over an algorithm's code (2019) https://algorithmwatch.org/en/spain-legal-fight-over-an-algorithms-code/
    • Advocacy Free Software Foundation Europe, The social value of the freedom to study source code in the Spanish Court (2026) https://fsfe.org/news/2026/news-20260205-01.en.html
    • Trade press Xataka (Enrique Perez), Un algoritmo es el que decide quien recibe el bono social para la luz. El Gobierno y los jueces se niegan a ensenar el codigo (2024) https://www.xataka.com/legislacion-y-derechos/algoritmo-que-decide-quien-recibe-bono-social-para-luz-gobierno-jueces-se-niegan-a-ensenar-codigo
    • Academic Reboot Democracy (Jose Luis Marti), The Judicial Protection of Algorithmic Transparency (2025) https://rebootdemocracy.ai/blog/the-judicial-protection-of-algorithmic-transparency

Where this connects

Institutional pressures in this domain

  • Austerity & recovery incentives — Cost-cutting and overpayment-recovery targets tilt the system toward denial and enforcement errors.
  • Vendor opacity — The deploying institution cannot inspect the model, data, or update pipeline it is accountable for.
  • Compliance over substance — Paper controls (sign-offs, checklists) satisfy audits while the behavior they describe erodes.
  • Reviewer bottleneck — One fixed-capacity checking stage sits between AI output and consequence; everything queues behind it.

All of them in context on the Public benefits & eligibility domain page.

Levers available here and the patterns behind them

Documented case histories