Alert logic
What it takes to make the alarm go off
The alarm is the point of the system, so it has to be worth trusting. That means it does not fire on one sensor having an opinion. It fires when two independent sensors agree, the person stays, the place is one built for children, and a human signs their name to it. Four gates, in that order, and then the sound.
The design decision that matters most in this design document is that distance alone never produces a dispatch. That was true in the earlier version of this page. The reason has since become much stronger, and it is now evidence rather than judgment.
What changed here, and why
The earlier ladder took a separation distance in meters between two wearables and climbed on it. That input does not exist. Two passive wearables cannot detect each other without an external illuminator, and a footpath does not come with one; received-signal-strength ranging measured at a two-meter threshold performed no better than picking people at random; and an urban satellite-derived separation estimate carries an error larger than the threshold it is being asked to decide. A ladder cannot be more reliable than the measurement it climbs, and that measurement was noise wearing a number.
What replaces it is the anchored zone. Fixed, mains-powered, professionally sited anchors at places that do not move do the ranging; the wearable only broadcasts. The classifier's inputs are now the things an anchor can actually establish - which class of place this is, how many independent modalities agree, how long the presence lasted, and whether a human being has looked at it.
The old design reached the right conclusion on a weaker reason than the one that now supports it. Keeping both halves of that on the page is deliberate: the correction is the most useful thing this design document has to teach anyone building in this area.
The evidence the ladder is built against
These three figures are not context. They are the specification for every gate below.
- 95.50% of monthly GPS monitoring alerts in Cook County were false, up from 57.79% under radio frequency.Hwang, Maniar, Smith & Nivens (2026), "False Alerts Related to GPS Electronic Monitoring in Illinois Cook County Sheriff's Office," Criminal Justice Review; urban GNSS error, Satellite Navigation (2025)
Driven by GPS drift; the worst zip codes were distinguished by tall buildings. [17] - 80% of alerts were never checked by officers in a Tennessee audit.Karsten & West, Brookings (2017) [29]
- 1% of roughly 63,000 monthly California alerts were restricted-zone entries.AP / NBC News (2011), reporting CDCR data for Jan. 2009 - Dec. 2010; Govtech (2014), Los Angeles County alert volumes [30]
Alert fatigue is not a usability concern. It is the failure mode.
GAO-16-10 records what the end of that sequence looks like [31]. An offender generated repeated tamper alerts, each one lasting under five minutes. The regional office's rule was to escalate only after five minutes, so none of them escalated. The supervising officer was never notified. The offender removed the device, and committed rape and murder.
Every alert in that record worked. The hardware detected the tamper, the network carried it, the monitoring center received it. What failed was that the stream had been made unreadable - by volume, and by a threshold set to suppress volume - so no person ever read the one that mattered. A system that produces alerts nobody opens has not produced safety. It has produced a record that will be read after the fact, by an investigator.
The ladder
| Tier | Trigger | Action | Identity resolved |
|---|---|---|---|
| T0 · Local log | Single-modality identifier match inside a zone. | Local log on the anchor, 72-hour retention, nothing transmitted. | No |
| T1 · Officer queue | Two independent modalities agree on presence. | Supervising officer's queue, at the next review. | No |
| T2 · Guardian notice | Tier 1, and a continuous dwell of at least 30 seconds. | Silent notification to guardians enrolled in that zone. | No |
| T3 · Audible and police | Tier 2, and a Class A zone, and a human adjudication. | Local audible alert; referral to police; identity resolution invoked. | Yes - under a judicial order, with the independent key custodian, and an audit record either way |
Zone classes
| Class | What it is | Highest tier reachable |
|---|---|---|
| Class A | A place whose primary purpose is children's presence: school grounds during hours, playgrounds, daycares, pools. | T3 |
| Class B | A place children frequent incidentally: a library, a shopping center, a transit station. | T2 |
| Unclassified | An anchor with no protected-place classification. | T2 |
Class is set by a person at installation and written into the anchor. It is never inferred, because inference is exactly how a pharmacy that happens to sit beside a school becomes a playground. The class gate is the mechanism that stops a monitored person buying groceries from generating a dispatch, and it only works if somebody surveyed the site.
Where the noise is, and who hears it
The alarm at Tier 3 is local, loud, and aimed at the adults standing there: it exists so that a room full of people turns around at once and puts itself between a monitored person and the children. Everything in front of it is there to make sure it is believed. A sound that goes off for nothing gets ignored inside a week, and an ignored alarm protects no one. There is also a second reason for the gates, and it is worth stating plainly: a loud alarm tells everyone in earshot who the alarm is about, because the person walking away is the answer. Registered individuals have been killed using registry data. So the alarm never names or describes anyone, it takes three conditions and a human to reach, and the threat model treats the vigilante as a first-class adversary rather than an edge case. The sound says come here. It does not say who.
Tier classifier
The classifier from the specification, running here-
This is not a mock-up of the classifier. It is SP.classify() from /assets/engine.js, the same function the check page runs against its published vector table - including the four vectors that exist only to prove the refusals: a single modality never escalates, a Class B zone can never reach the top tier, the top tier is refused without a human, and a lost signal never reaches it at all. Try each one.
Why the ladder exists
The room where a bad threshold gets you ignored
Dispatchers triage. A source that is wrong almost every time is a source they learn to skip, and on the published evidence they are right to.
Dispatch load model
Dialling on every zone alert, against the graduated ladder-
reduction in referrals from putting corroboration, dwell, zone class and a human in front of the dispatch tier.
Where each default comes from, and what it assumes. The false-alert share is the Cook County monthly figure. The share of alerts an officer opens is the Tennessee audit's complement. The Class A share is the California restricted-zone share of monthly alert volume. Two of these are load-bearing assumptions rather than measurements and are stated as such: that cross-modality corroboration removes false alerts at exactly the rate the field measured them - that is, that the second modality is precisely as good as the first one was bad - and that a human confirms rather than dismisses in the majority of adjudications. Neither has been measured for a system that does not exist. Move them and watch the dispatch figure; it stays small across the whole range, which is the finding. The exact number is not the point. The order of magnitude between the two policies is.
Capacity is dispatchers × 480 minutes × three shifts. Raw alerts per subject per day is the model's softest input, because it depends entirely on anchor density and siting.
Rules that are load-bearing
- Nothing escalates past Tier 0 on a single modality. Not with a long dwell, not in a Class A zone, not with a history, not for a high-risk subject. One uncorroborated reading is what the field measurements are made of.
- Only a Class A zone can reach Tier 3. A library and a shopping center are places children are, incidentally. They do not carry a dispatch.
- Tier 3 additionally requires a human. The system does not decide to make a noise in a room or send a car. A person does, and their decision is recorded as theirs.
- Loss of signal is a Tier 1 event, and can never be a Tier 3 one. It rises to Tier 2 if the last known position was inside a Class A zone or the outage runs past its configured length. It stops there permanently, because a device that has stopped reporting is evidence of proximity to nobody - see design decision D-3a below.
- Repeat history and assessed risk order the queue. They do not open a gate. Letting either substitute for corroboration, dwell, class or a human is how a graduated ladder quietly stops being graduated. They are inputs, not overrides - see due process for why the risk tier has to come from a validated assessment rather than an offense label.
Design decision D-3a - the direction of failure is a choice, and it must be made explicitly
A lost signal is ambiguous between three states: the device failed, the wearer is in a basement, or the wearer has fled. There is no safe default. Failing loud reproduces the false-alert rate above and the ignored stream it produces. Failing quiet reproduces the GAO fatality. The earlier version of this design failed quiet by rule - a lost fix produced no event at all - and on the published evidence that was the wrong half of the trade.
The protocol takes neither default. A loss of signal is a supervision event, addressed to the officer who supervises this person, and never a public one. It is escalated a single step if the last known position was inside a Class A zone or the outage exceeds a configured duration, and it is barred from the top tier absolutely.
How this works
1:15 · narrated · captioned · nothing here is sent anywhere when you press play. Prefer to read it? The transcript is below.
Transcript
| At | Section | What it says |
|---|---|---|
| 0:02 | The core decision | This page is the alert ladder. The decision that matters most is that distance alone never produces a dispatch, and that is now supported by evidence rather than by judgement. |
| 0:13 | Alert fatigue | Alert fatigue is the failure mode, not a usability problem. In one county, over ninety-five percent of alerts were false. An audit elsewhere found eighty percent were never checked. |
| 0:25 | Four tiers | Four tiers. A local log held on the anchor. The supervising officer's queue. A silent notice to enrolled guardians. And, last, an audible alert and a referral to police. |
| 0:37 | The gates | Nothing escalates past the local log on a single modality. Only a place whose purpose is children can reach the top tier, and the top tier also requires a person to adjudicate it. |
| 0:49 | A lost signal | A device that stops reporting is a supervision matter, sent to one officer and never made public. It rises a single step at worst, and it is barred from the top tier absolutely. |
| 1:00 | The load model | The load model here runs on the measured figures, not invented ones. Move any of them and the dispatch count stays small. The order of magnitude is the finding, not the number. |