Hardware
Nothing worn on a body is uncuttable
Stop trying to make it unremovable and make removal instantly detectable. The security is in the response time, not in the material.
Every wearable monitoring device in service can be removed with tools available in any hardware shop. This has been true for the entire history of electronic monitoring and it is not a solvable problem. It is also not the important one.
A strap that takes ninety seconds to cut and reports the cut in four is a better security control than a strap that takes twenty minutes to cut and reports it in an hour. Design for detection latency, not for material strength.
Tamper-evidence here is detection. It is never prevention, and it is not allowed to be.
Under 1 minute is the required emergency medical removal time with shears - which is why tamper-evidence in this product class is detection, never prevention.NIJ Standard-1004.00, Offender Tracking Systems, NCJ 249810 [11]
Read that requirement carefully, because it settles the question. The national standard requires that the strap be severable by medical shears inside a minute, so that emergency medical staff can remove it from a person in a crisis. Un-removability is not a target the standard failed to reach; it is a property the standard forbids. No court monitor in service is physically un-removable, and a specification promising one is not achievable - it is a specification that would fail certification for the reason it was written.
An earlier version of this design document reached the same conclusion by reasoning about materials. The standard reaches it by rule, which is stronger, and it is the version that matters to anyone procuring hardware.
What the national standard actually requires
NIJ Standard-1004.00 governs offender tracking systems, and it is the document a procurement writes against [11]. The first two rows are the ones every conversation about tamper detection turns on: 5 seconds is the maximum time from strap cut to tamper event under NIJ Standard-1004.00, with 3 minutes to reach the agency.NIJ Standard-1004.00, Offender Tracking Systems, NCJ 249810
| Parameter | Requirement | Basis |
|---|---|---|
| Strap cut > tamper event | <= 5 s | NIJ 1004.00 §5.4.1 |
| Tamper event > agency | <= 3 min | NIJ 1004.00 §5.4.1 |
| Strap separation force | 245 N ± 5 N | NIJ 1004.00 §5.4.2 |
| Emergency medical removal | <= 1 min with shears | NIJ 1004.00 §5.2.5 |
| Offline data retention | 10 days | NIJ 1004.00 §5.3.10 |
| Battery service life | >= 730 charge cycles | Doubled from the NIJ minimum of 365 - at daily charging that minimum is exactly twelve months, so a deployment longer than a year budgets replacement, not recharging |
| Body-presence sensing | Required, with published sensitivity and specificity | Not required by NIJ. No vendor publishes the figures, which is why this design document asks for them by name |
| Shielding and jamming detection | Required | Optional in NIJ only because a single manufacturer had already built it |
The last two rows are additions, not restatements, and they are marked as such deliberately. A requirement that says "body-presence sensing required" and stops there is a requirement a vendor can satisfy with a capacitance pad of unknown accuracy. Asking for the sensitivity and specificity figures, published, is what turns it into a testable claim - and the fact that no vendor currently publishes them is itself the finding.
Two devices, deliberately unalike
The subject's device
- Continuity strap. A fiber-optic loop through the strap; light in one end, photodiode at the other. Any cut, stretch beyond tolerance, or splice attempt breaks the optical path.
- Skin contact. Capacitance plus skin temperature. Detects the device being worn on something that is not a wrist or ankle - the classic defeat is a bottle of warm water.
- Motion coherence. Accelerometer signature consistent with being worn by a walking person. A device sitting on a shelf reads flat; a device taped to a dog does not read like a human gait.
- Independent radio. LTE-M or NB-IoT direct to network. It must not depend on a phone the subject controls.
- Its own clock and store. An outage buffers locally and uploads on reconnection, so a jammed hour becomes a late report rather than a missing one.
The child's band
- Receive-only radio. No advertised service, no response to probes, no identifier of any kind transmitted. A device that announces a child's presence is a stalking instrument, and children's trackers get breached regularly.
- No identity on the device. A found band tells the finder nothing about whose it is.
- No screen, no name, no branding. It should not mark a child out to other children as the one with the thing on their wrist.
- Guardian-side pairing. The pairing secret is wiped on tamper and on guardian revocation.
- Comfort is a security control. A band that is heavy, hot, itchy, or embarrassing comes off in a drawer, and a band in a drawer has a coverage of zero. This is the single largest determinant of whether the system works.
Wrist or ankle
A wrist device is defensible, and it has one real technical advantage that is rarely stated: a leg-mounted antenna is the worst practical location on a human body for satellite reception. It is low, it is shadowed by the body through most of its arc, and it spends much of its time close to the ground. The wrist swings clear of body shadow. On the physics alone, the wrist is the better place to put a receiver.
Against that sits a fact from the market rather than the laboratory. A vendor already sells wrist-worn court monitoring devices, marketed for lower-risk populations, and compensates for the form factor with periodic biometric facial re-verification [12]. That is a vendor conceding, in its own marketing material, that the wrist strap alone is not trusted to establish who is wearing it. The ankle is chosen for how hard it is to slip off, not for how well it receives.
So the requirement follows from the concession rather than from an opinion: if the wrist form factor is chosen, periodic biometric re-verification is not optional. That in turn imports a whole second set of problems - a camera on the device, a biometric template somewhere, a failure mode when the check fails at three in the morning - which is why the choice cannot be made on comfort or on antenna performance alone.
On microchipping
Dropping it was correct, and it was correct twice over. The constitutional half is set out on the legal architecture page; this is the technical half. A passive implant has no battery, no satellite receiver and no radio of its own. It is readable from a few inches by a reader held against the skin. It cannot know where it is, cannot hear a broadcast, and cannot report anything. It would be strictly worse at this job than a wristband, not better - the technology does not do what the idea needs it to do.
The number that matters
From cut to somebody knowing
Removal detection is only as good as the chain that carries the news. Most of the delay is not in the device.
Tamper detection latency budget
Adjust any stage; the chain recomposesp95 is computed as the p50 total plus the root-sum-square of each stage's own spread, which assumes the stages fail independently. They do not, entirely - a network event that delays the radio hop also delays ingest - so the true p95 is worse than this model shows. The model is deliberately optimistic and still lands close to the target, which is the finding: almost all of the delay is human triage, not hardware. Shortening the strap-detection time buys nothing. Shortening triage buys everything.
Power, and what happens when it runs out
This is the unglamorous section that decides whether the program survives its first winter.
The daily charge interval below is neither invented here nor a national requirement. It is the instruction carried in federal district-level participant handouts [14]; the national Location Monitoring Reference Guide does not state it, and an earlier version of this page attributed it there. Set against the NIJ minimum service life in the table above, that local practice is what puts a twelve-month clock on the hardware.
| Condition | Subject device | Child band |
|---|---|---|
| Charge interval | Daily, on a schedule the conditions specify by name | Target 5-7 days. A band charged daily will not be worn. |
| Low battery | Warning to subject and officer at 20%, then hourly | Quiet notice to guardian at 25% |
| Battery dead | A violation of conditions, defined as such in the order. Not a technical fault - a compliance event with a written response. | Coverage gap, guardian told. Never a violation of anything: a child is not responsible for a dead battery. |
| Charging | Stationary period is expected and logged, not alerted | Guardian sees the band as offline |
| Deliberate discharge | Pattern detection over repeated outages; addressed through supervision, not the device | Not applicable |
Offline, jammed, and indoors
- Satellite denial is normal, not exceptional. Underground, inside a shop, in a car park. This is one of the reasons satellite position is context only in this design and never the proximity decision - the anchor does the ranging, and it is bolted to a wall with mains power behind it.
- An anchor keeps working when the wearable's satellite fix does not. The broadcast and its reception need no position fix at all. What a lost fix costs is the coarse plausibility check, not the detection.
- A device that stops reporting is a Tier 1 event, not silence. The earlier version of this design treated a lost fix as no event at all. That failed quiet, and failing quiet is what the GAO record is a record of. See the alert tiers for design decision D-3a and the ceiling it puts on the other side.
- Jamming is detectable even when it works. A sudden loss of all received signals in a place with previous coverage is itself a recorded event on the subject's device.
- Store and forward. Neither device may discard an event because it could not send it. Buffer, timestamp, upload late, and mark it as late.
- A late alert must be labeled late. An officer receiving a two-hour-old Tier 2 needs to know it is two hours old. Presenting buffered events as current is how a monitoring system produces a wrong arrest.
How this works
1:17 · narrated · captioned · nothing here is sent anywhere when you press play. Prefer to read it? The transcript is below.
Transcript
| At | Section | What it says |
|---|---|---|
| 0:02 | Nothing is uncuttable | Nothing worn on a body is uncuttable. Every wearable in service can be removed with tools from a hardware shop, and that has been true for the whole history of monitoring. |
| 0:12 | Detection, not prevention | Tamper evidence here is detection, never prevention. The national standard requires the strap be severable by medical shears inside one minute, so medics can remove it in a crisis. |
| 0:24 | The real number | So design for detection latency, not material strength. A cut must raise an event in five seconds and reach the agency in three minutes. Nearly all remaining delay is human triage. |
| 0:36 | Two devices | Two devices, deliberately unalike. The subject's carries a continuity strap, skin sensing and its own radio. The child's band is receive-only and transmits no identifier at all. |
| 0:49 | Comfort | Comfort is a security control. A band that is heavy, hot or embarrassing ends up in a drawer, and a band in a drawer covers nothing. That decides whether any of this works. |
| 1:02 | Power | Power decides whether the program survives its first winter. A dead battery on the subject's device is a compliance event named in the order. On a child's band it is never a violation. |