The exposed surface

A box on a wall that anyone can walk up to

Every other domain in this system is a service behind a door. The anchor is a physical object in a school foyer, holding the identifiers that are valid right now, and it is the one part of the design a stranger can put their hands on.

Footage: Artyom Saqib / Pexels

The Anchored Zone Assessment names this as a hole rather than a weakness: anchor security is "not specified at all... a genuine hole in the current specification." It ranks writing that specification third in its priority table, behind only compliance assist and the coverage model, on the ground that the anchor is the most accessible attack surface in the system. This page closes it.

This is a design document. Nothing here has been built or deployed, and the requirements below are written to be argued with by somebody who would have to build them - which means each one is stated with the reason it exists, because a requirement without a reason gets negotiated away in a procurement meeting by someone who does not know what it was holding up.

The normative form of everything on this page is SP-107 to SP-115 in the full specification. What follows is the argument those clauses are the summary of.

What an anchor actually is, before anything is asked of it

The anchored zone is the architectural move that makes the rest of this design possible: the hard work of ranging comes off the body and onto a fixed, mains-powered, professionally sited device at a place that does not move. Every constraint that makes a wearable impossible is relieved by that move. What it creates in exchange is this: a piece of infrastructure standing in a public building, unattended, all day, holding the current-interval enrollment set - the rotating identifiers valid for the present ten-minute window across every enrolled device, pushed hourly, containing no identities and no history.

That set is the reason the anchor matters to an attacker. It is also, precisely, the thing the threat model has already identified as the narrowed-but-not-closed surface of the whole architecture. So the anchor is not one node among many. It is the node where the design's central compromise is physically stored, in a building somebody else owns, behind a lid.

Everything else in this system is protected by a boundary somebody would have to breach remotely. The anchor is protected by a lid, a bracket, and whoever happens to be in the corridor.

The requirements below all follow from taking that sentence seriously rather than treating the anchor as a server that happens to be far away.

The six minimum requirements

These are the Assessment's own list. They are set out here with the argument for each, because the arguments are what tell a reviewer which of them can be traded and which cannot - and on this list, none of them can.

SP-107 Mutual attestation, revocable within minutes

An anchor proves itself to the network, and the network proves itself to the anchor. Both halves are load-bearing and the second half is the one that gets dropped. An anchor that will accept an enrollment set from anything that can reach it is an anchor an attacker can make blind to a real device, or make alarm on a stranger - the integrity attack the isolation page already names for the set distributor, delivered instead at the edge, one anchor at a time, where nobody is watching.

The attestation key is generated inside the anchor's secure element at provisioning and never exported, so possession of the physical device is not possession of its identity. The distributor refuses to answer an anchor that cannot attest, and it treats one identity attesting from two places as a hard error rather than a warning, because that is exactly what a clone looks like.

Why minutes, and not hours. The revocation window is not a service-level target picked for comfort. The enrollment set is pushed hourly and rotates every ten minutes, so a revocation that lands slower than the push cadence means a stolen or cloned anchor receives at least one more set than it should. The requirement is that revocation reaches the distributor before the next set does - which makes the number a property of the protocol rather than of how quickly somebody reads a dashboard.

SP-108 The enrollment set lives in a secure element and nowhere else

The current-interval set is the one asset on the anchor worth stealing, because holding it is what turns a receiver into a detector of enrolled people. It is therefore sealed to the anchor's secure element, decrypted for matching, and never written to extractable storage: not to flash, not to a swap file, not to a crash dump, not to a log line, not to a diagnostic bundle a field technician mails to a vendor.

That last list is not padding. In practice the set does not leak from the storage the specification named; it leaks from the four places nobody wrote a requirement about. A design that says "held in a secure element" and permits verbose logging has specified one boundary and built five.

The consequence if this is traded away. An extractable set makes the physical theft of one anchor into a working proximity detector that keeps functioning for as long as the stolen credential does - and the thief no longer needs to attest to anything, because they already have the answer the attestation would have fetched.

SP-109 Opening the enclosure zeroizes the keys and reports

Tamper response here is detection, and it is never prevention. The devices page establishes that discipline for the wearable and it holds with more force for a device bolted to a wall: nothing in a public building is uncuttable, and a design that spends its budget on a stronger bracket has bought the wrong thing. What matters is that the moment the lid moves, the attestation key, the event-signing key and the sealed set stop existing, and a tamper event leaves the device.

The standard the wearable is measured against is a useful floor to hold the anchor to as well. 5 seconds is the maximum time from strap cut to tamper event under NIJ Standard-1004.00, with 3 minutes to reach the agency.NIJ Standard-1004.00, Offender Tracking Systems, NCJ 249810 [11] An anchor is mains-powered and networked, which removes every excuse the wearable has for being slower.

The failure mode to design against. An attacker who expects the tamper report will cut the network first and open the lid second. So silence has to be an event: an anchor that stops attesting is treated exactly like an anchor that reported an intrusion, and the difference between the two is established afterwards by a person going to look. If losing the network is the way to suppress the alarm, then the alarm is the network.

SP-110 Neighboring anchors cross-check each other

Anchors are sited by survey, so the fleet already knows which of them can hear which. That fact is free and it is the only detection mechanism in this design that does not depend on a device's own honesty about itself. Neighbors check two things and both are needed: that a peer is present, which catches removal, shielding and quiet failure; and that a peer can attest, which catches a device that has appeared on the wall and is claiming to belong there.

Presence alone is the version that gets built, and it is the version that misses the attack. A hostile transmitter answering a neighbor beacon looks exactly like a legitimate anchor to a check that only asks whether something is there.

What this buys and what it does not. It makes an active hostile anchor a thing the zone notices by itself, without a technician visiting. It does nothing whatever about a device that only listens, which is the subject of the honest section below and is the reason that section exists rather than being folded into a footnote.

SP-111 Rate limiting, and automatic quarantine

An anchor reporting a detection volume that is implausible for its site is quarantined automatically. The plausible range is a property of the site survey - a primary school foyer and a transit concourse are not the same distribution - and it is set at installation alongside the zone class, by the same person, in the same visit.

This is the defense against replay injection, and it works because a replay attack that matters has to produce volume. One fabricated detection against one subject is a bad afternoon for that subject; a stream of them is an attack on the queue itself, and the queue is the thing this whole design exists to protect. The evidence for treating volume as the primary harm is the same evidence the tier ladder is built on: 95.50% of monthly GPS monitoring alerts in Cook County were false, up from 57.79% under radio frequency.Hwang, Maniar, Smith & Nivens (2026), "False Alerts Related to GPS Electronic Monitoring in Illinois Cook County Sheriff's Office," Criminal Justice Review; urban GNSS error, Satellite Navigation (2025)
Driven by GPS drift; the worst zip codes were distinguished by tall buildings. [17]

Quarantine must degrade, not delete. Automatic quarantine is itself an availability attack if it takes an anchor off the network - an attacker who can make an anchor look chatty can silence a zone by making it look guilty. So quarantine means the anchor stops being able to escalate: it keeps matching and keeps logging locally at the bottom of the ladder, its events are held for review rather than dropped, and a person restores it. A quarantine that produces a dark zone has handed the attacker the outcome they were after.

SP-112 Penetration test results are published

The most accessible attack surface in the system should be the most publicly scrutinized. This is the same requirement the bracelet page makes of a backend operator, applied to the one component an attacker can buy, take home, and open on a bench without anyone noticing - which is exactly the component whose weaknesses will be found by somebody, published or not.

Published means the scope, the method, the findings, the fix dates, and the findings that were not fixed with the reason. A report that lists only closed items is marketing with a footnote, and a reader who has seen one can tell.

Why publication is a security control rather than a transparency gesture. This design's whole legal and political position rests on being the proposal that says the uncomfortable thing first. A program that publishes its own anchor findings can survive the day somebody else publishes them. A program that has never published is, on that day, a program that concealed something - whether or not it did.

The threat table for the anchor specifically

What the attacker gains, what detects it, and what is left over afterwards. The last column is the one worth arguing about: a threat table whose residual column is empty everywhere is a threat table nobody should believe.

Threat	What the attacker gains	What detects it	Residual risk
Anchor stolen	The physical device, the contents of the lid, and a site that no longer has an anchor standing in it.	The tamper switch fires before the attacker reaches the keys. Neighbors lose the peer within one interval. The next mutual attestation fails and the credential is revoked before the next set is pushed.	The zone is uncovered until the device is replaced, and coverage loss is invisible to the public who rely on it. An attacker whose goal was a dark zone got a dark zone.
Anchor cloned	Nothing, if the attestation key never left the secure element. If it did: current enrollment sets, and the ability to file signed events that the console has no reason to disbelieve.	One identity attesting from two places is a hard error at the distributor, not a warning. Neighbors see a peer claiming to be a device that is demonstrably elsewhere.	The window between the clone's first attestation and revocation. That window is what "within minutes" is buying, and it is bounded by the set-push cadence rather than by anybody's response time.
Hostile anchor introduced into a zone	Nothing from the fleet: it cannot attest, so it receives no enrollment set. What it gains is a position at the site and a label on a wall that looks official.	Neighbors cross-check attestation and not merely presence, so a device that answers the beacon without a credential is reported. Site custody records say what is supposed to be on that wall.	It can still receive. Detection here catches a device pretending to belong to the fleet; it catches nothing that never pretends.
Replay injection of false detections	Fabricated presence against a real subject; at volume, an attack on the attention of the queue rather than on any individual.	The ranging exchange is a two-way cryptographic distance bound rather than a signal-strength reading, so a replay has to survive time-of-flight. The rate limit quarantines implausible volume. Two agreeing modalities and a dwell threshold must both hold before anything escalates.	A low-volume, well-timed injection against one subject at one site is the hard case and none of the above closes it. It is why nothing public happens without a human adjudication.
Denial of service against a real anchor	A dark zone - by jamming, unplugging, cutting the feed, shielding the antenna, or simply flooding the radio.	Neighbors lose the peer. The distributor sees no attestation. The console sees a heartbeat stop. All three fire quickly; none of them prevents anything.	This is the cheapest attack on this page and there is no technical defense that makes it hard. The answer is operational: a dark zone must be visible to the operator as a dark zone rather than as an absence of alerts.
Coerced or compromised site host	Physical access at leisure, with a key, and a legitimate reason to be standing next to the device. Also the ability to move it, shield it, or re-aim it.	Tamper response does not care who opened the lid. The site survey fixes which peers an anchor can hear, so a moved anchor stops matching its own neighbor set. Fleet records make a re-siting a documented change rather than an unremarked one.	A host who covers an antenna produces a fault that looks like a fault. The host is a named, contracted party, so the residual control here is contractual and legal - the same class of control the threat model already relies on for the enrollment set.
Supply-chain compromise before installation	Everything, before a single control on this page exists. A key planted at manufacture attests correctly, because attestation proves the key and not the intent of whoever put it there.	Only mechanisms that do not depend on the device's own account of itself: attestation keys generated on-device at provisioning and never injected, a device identity the operator binds at installation, reproducible firmware with published hashes, and a named backend operator whose test results are published.	Open, and not closed by this specification. The comparable evidence in the adjacent product category is in the cell below.

The supply-chain row is the Assessment's B-14, which observes that device supply chain trust is asserted rather than solved. Black Hat research in 2026 found more than seventy tested children's tracking devices - tens of millions of units - funnelling through just three shared backends, where an attacker could locate a device, alter emergency contacts, falsify location, and activate microphones and cameras with no visible indication. Stykas & Solferini [35]

70+ tested children's tracking devices - tens of millions of units - funnel through just three shared backends.Stykas & Solferini, Black Hat (Aug. 7, 2026)
An attacker could locate a watch, alter emergency contacts, falsify location, and activate microphones and cameras with no visible indication. Different vendors, different enclosures, different privacy policies, one trust domain. Finding a vendor who genuinely controls their own stack is likely to be harder and more expensive than a procurement plan assumes, and the honest version of this requirement is that it raises the unit price rather than that it is free.

The part of this that no requirement above touches

A rogue anchor that merely listens is a passive harvester, and attestation does not reach it

Every control on this page is a control on a device that talks: that asks for a set, answers a neighbor, files an event, holds a credential. A receiver assembled from published parts does none of those things. It does not attest, so nothing can refuse it; it does not report, so no rate limit applies to it; it does not answer a beacon, so no neighbor notices it. It sits in a bag and collects rotating identifiers, and there is no attestation scheme, in this design or any other, that prevents somebody building one.

Alone, what it collects is a set of rotating pseudonyms with no names attached. Combined with a pair of eyes, it is something else, and this is where the Assessment's B-16 becomes concrete rather than abstract: this is a pseudonymous system, not an anonymous one, it cannot be made anonymous, and the adversaries of concern here - an abuser, a vigilante, the monitored person themselves - are adversaries with eyes. The threat model works that limit through in full, including the trade the anchored model makes to narrow the proximity oracle rather than to close it, and the de-anonymization model on that page lets a reader put their own numbers into it.

Neither of those is restated here, because restating a limit is how a limit gets quietly softened. What belongs on this page is the consequence for the anchor specification: the six requirements above raise the cost of a hostile anchor and do nothing at all to the cost of a listener. That asymmetry is permanent, it should be published in the material rather than discovered by a reporter, and a program that claims its anchor security prevents identifier harvesting has claimed something this design does not support.

What an anchor must never hold

The requirements above are about keeping an attacker out. This section is about what is worth having once they are in, and it is the more important half - because the strongest statement a design can make about a device in a public building is not that it is hard to open, but that opening it does not pay.

No identities. Not a name, not a case reference, not a subject number, not a stable device serial that a second observation could be joined on. An anchor establishes that an enrolled device was here; it has no vocabulary for which.
No history beyond the current interval. The local log expires with the interval it belongs to. Retention past that is not a convenience feature, it is a linkage corpus: identifiers that share a location across intervals begin to describe a pattern of movement, and a pattern of movement is what the whole architecture exists not to keep.
No key that resolves anything. The anchor holds keys that prove it is itself and keys that sign what it saw. It holds nothing that turns an identifier into a person, and there is no configuration, no firmware build and no emergency procedure that gives it one.
No other anchor's observations. Neighbors exchange attestation and presence, not detections. An anchor that could read its neighbors' events is a small console, and a small console at the edge is a console in the least defensible location in the system.
No enrollment set older than the one it is matching. Past sets are the linkage corpus in its purest form. The anchor cannot lose what it was never allowed to keep.

The blast radius of a fully compromised anchor, stated plainly

Assume the worst honest case: the enclosure is open, the secure element has been defeated rather than merely triggered, the firmware is the attacker's, and the device is still attesting because the compromise happened before installation. What does the attacker hold?

Presence without identity, at one known place. That an enrolled device was within range of this one anchor, for this long, in this interval - and never which device.
One interval of the enrollment set, which expires in minutes. Live, it is a detector for enrolled devices near this hardware. It is not a directory, it is not retrospective, and it goes stale on its own.
The ability to lie. To fabricate an event that never happened, or to suppress one that did. This is an integrity attack and it is the most damaging of the three, because a suppressed event is invisible and a fabricated one lands on a real person.
Nothing else. No name, no history, no other site, no route to the key custodian, and no setting that produces any of them.

That is the whole of it, and it is deliberately identical to the anchor row of the six-domain model on the isolation page - same three gains, same fourth column of things it must never reach. The two pages are meant to be checked against each other by a reviewer who suspects they disagree, and if they ever do, the isolation page is the one that governs, because it is the page that states the property the whole architecture serves.

The pairing that matters is also already settled there: the co-location matrix rates anchor plus key custodian as the single worst pair in the system, on the grounds that an anchor knows its own location to the meter, observes identifiers live, and is the most physically exposed domain there is. Everything on this page is downstream of that verdict. The anchor is hardened not because hardening makes it safe, but because it is the domain where hardening is the only control left after separation has done its work.

The anchor's own trust boundary

The dashed red edge is the enclosure, and it is drawn as the only boundary on the figure with a physical meaning. Everything to its right is a party the anchor must prove itself to and which must prove itself back. The crossed path is the route to the key custodian, which does not exist and cannot be configured. The red box at the foot sits outside every boundary on the figure: it is the passive receiver, it is not detected by anything drawn above it, and it is on the diagram because leaving it off would make the figure a claim the specification cannot support.

How to test an anchor deployment

Each of these can be run against a real installation by somebody with no access to the source, which is the standard the rest of this design document holds itself to.

Open one. Take a spare anchor off the shelf, open the lid, and then try to make it attest. If it still works, the tamper response is a log line.
Clone one. Present the same anchor identity from two places at once and watch what the distributor does. A warning is a failure; the correct behavior is a refusal and a revocation.
Cut the feed before you open the lid. If the tamper report never arrives and nothing else fires, then silence is not being treated as an event, and the alarm can be defeated by an attacker with wire cutters and the right order of operations.
Put an unattested transmitter in the zone. If the neighboring anchors do not report it, the cross-check is testing presence and calling it attestation.
Flood one with detections. Confirm that quarantine degrades the anchor rather than removing it, and that the zone does not go dark as a result - because if it does, the quarantine is an attack.
Ask for the last penetration test. Then ask for the findings that were not fixed. A report with no open findings has either been filtered or was not adversarial.
Ask where the attestation key came from. If the answer is that it was injected at manufacture rather than generated on the device, every control on this page rests on the honesty of a factory.

What this page does not claim

It does not claim that a hardened anchor makes the system safe to site anywhere, that attestation prevents identifier harvesting, or that supply-chain trust is solved. It claims that the anchor can be specified so that stealing one is loud, cloning one is short-lived, faking one is noticed by its neighbors, flooding one is self-reporting, and holding one outright is worth very little. The rest is on the threat model, where it belongs and where it is already stated.

How this works

1:06 · narrated · captioned · nothing here is sent anywhere when you press play. Prefer to read it? The transcript is below.

Transcript

At	Section	What it says
0:02	What it is	Every other domain here is a service behind a door. An anchor is a box on a wall in a public building, and it is the most accessible attack surface in the design.
0:12	Mutual attestation	An anchor proves itself to the network and the network proves itself back. The attestation key is made inside a secure element and never leaves the device.
0:22	Opening the lid	Tamper response is detection, never prevention. When the enclosure opens, the keys stop existing and the event leaves the device. Silence counts as an event too.
0:33	Neighbours	Anchors are sited by survey, so the fleet knows which of them can hear which. Neighbours check both that a peer is present and that a peer can still attest.
0:42	What it misses	A rogue anchor that merely listens attests to nothing. It asks for nothing and answers nothing, so none of this catches it. That asymmetry is permanent.
0:53	How to test it	Open one and see whether it still attests. Cut the feed before the lid. Then ask for the last penetration test, and for the findings that were not fixed.