Hardware
Nothing worn on a body is uncuttable
Stop trying to make it unremovable and make removal instantly detectable. The security is in the response time, not in the material.
Every wearable monitoring device in service can be removed with tools available in any hardware shop. This has been true for the entire history of electronic monitoring and it is not a solvable problem. It is also not the important one.
A strap that takes ninety seconds to cut and reports the cut in four is a better security control than a strap that takes twenty minutes to cut and reports it in an hour. Design for detection latency, not for material strength.
Two devices, deliberately unalike
The subject’s device
- Continuity strap. A fibre-optic loop through the strap; light in one end, photodiode at the other. Any cut, stretch beyond tolerance, or splice attempt breaks the optical path.
- Skin contact. Capacitance plus skin temperature. Detects the device being worn on something that is not a wrist or ankle — the classic defeat is a bottle of warm water.
- Motion coherence. Accelerometer signature consistent with being worn by a walking person. A device sitting on a shelf reads flat; a device taped to a dog does not read like a human gait.
- Independent radio. LTE-M or NB-IoT direct to network. It must not depend on a phone the subject controls.
- Its own clock and store. An outage buffers locally and uploads on reconnection, so a jammed hour becomes a late report rather than a missing one.
The child’s band
- Receive-only radio. No advertised service, no response to probes, no identifier of any kind transmitted. A device that announces a child’s presence is a stalking instrument, and children’s trackers get breached regularly.
- No identity on the device. A found band tells the finder nothing about whose it is.
- No screen, no name, no branding. It should not mark a child out to other children as the one with the thing on their wrist.
- Guardian-side pairing. The pairing secret is wiped on tamper and on guardian revocation.
- Comfort is a security control. A band that is heavy, hot, itchy, or embarrassing comes off in a drawer, and a band in a drawer has a coverage of zero. This is the single largest determinant of whether the system works.
On microchipping
Dropping it was correct, and not only for the bodily-integrity constitutional problems it raises. A passive implant has no battery, no GPS and no radio of its own. It is readable from a few inches by a reader held against the skin. It cannot know where it is, cannot hear a broadcast, and cannot report anything. It would be strictly worse at this job than a wristband, not better — the technology does not do what the idea needs it to do.
The number that matters
From cut to somebody knowing
Removal detection is only as good as the chain that carries the news. Most of the delay is not in the device.
Tamper detection latency budget
Adjust any stage; the chain recomposesp95 is computed as the p50 total plus the root-sum-square of each stage’s own spread, which assumes the stages fail independently. They do not, entirely — a network event that delays the radio hop also delays ingest — so the true p95 is worse than this model shows. The model is deliberately optimistic and still lands close to the target, which is the finding: almost all of the delay is human triage, not hardware. Shortening the strap-detection time buys nothing. Shortening triage buys everything.
Power, and what happens when it runs out
This is the unglamorous section that decides whether the programme survives its first winter.
| Condition | Subject device | Child band |
|---|---|---|
| Charge interval | Daily, on a schedule the conditions specify by name | Target 5–7 days. A band charged daily will not be worn. |
| Low battery | Warning to subject and officer at 20%, then hourly | Quiet notice to guardian at 25% |
| Battery dead | A violation of conditions, defined as such in the order. Not a technical fault — a compliance event with a written response. | Coverage gap, guardian told. Never a violation of anything: a child is not responsible for a dead battery. |
| Charging | Stationary period is expected and logged, not alerted | Guardian sees the band as offline |
| Deliberate discharge | Pattern detection over repeated outages; addressed through supervision, not the device | Not applicable |
Offline, jammed, and indoors
- GNSS denial is normal, not exceptional. Underground, inside a shop, in a car park. The tier engine treats a lost fix as T0 by rule — it is the reason that rule is first in the function.
- Proximity matching survives GNSS loss. The radio broadcast and its reception do not need a position fix. What is lost is the ability to say where — so the encounter can still be logged and can still notify, but it cannot claim a zone.
- Jamming is detectable even when it works. A sudden loss of all received signals in a place with previous coverage is itself a recorded event on the subject’s device.
- Store and forward. Neither device may discard an event because it could not send it. Buffer, timestamp, upload late, and mark it as late.
- A late alert must be labelled late. An officer receiving a two-hour-old T4 needs to know it is two hours old. Presenting buffered events as current is how a monitoring system produces a wrong arrest.