Due process
The parts every failed program skipped
Enrollment criteria, an appeal that can succeed, an audit trail, and a way out. Monitoring schemes have been beaten in court on exactly these four, repeatedly, and they are the cheapest part of the build.
"Paedophile" is not a legal category
It is a clinical term, and it does not map onto who is on a registry.
Registries include people convicted of offenses with no child victim at all - public indecency, some prostitution offenses, offenses against adults. They include Romeo cases: a nineteen-year-old and a seventeen-year-old, where the conduct was consensual and the age gap is the whole offense. And they exclude a great many people who do pose a risk to children, because 95.9% of sexual offense arrests over a 21-year period in New York were by people with no prior sex offense conviction.
Sandler, Freeman & Socia, Does a Watched Pot Boil?, Psychology, Public Policy, and Law 14(4):284-302 (2008)
One state, one period. It is the most-cited figure of its kind, not a national constant.
Using the word as though it named a group is not just imprecise. It builds the wrong system: it sweeps in people who present no risk to children, misses people who do, and hands opposing counsel an easy argument that the program is not rationally connected to its stated purpose - which is factor 6 of the test on the legal page.
What to tier on instead
A validated actuarial risk assessment combined with offense characteriztics - victim age, relationship to the victim, use of force, prior offense history - producing a written tier with a stated confidence, reviewed on a schedule. This is more defensible in court, more accurate in practice, and materially cheaper to run, because the highest tier stays small enough to supervise properly.
The reason a label cannot do this work is the spread inside the population the label covers. 0.7% to 48.7% is the range of five-year sexual recidivism across Static-99R scores - roughly a seventyfold spread. A scheme that treats everyone in the covered class alike is not being cautious; it is discarding the single strongest piece of information it has about who to watch. An earlier draft of this design document put the top of that range at a lower figure and the spread at rather less than it is - the corrected numbers make the point harder, not softer.
Hanson, Thornton, Helmus & Babchishin (2016), Sexual Abuse 28(3); Static-99R Evaluators' Workbook (2021)
Treating that population as uniform is both empirically wrong and the exact defect courts identify as punitive.
It also makes the tier a genuine input to the alert ladder rather than a label. In the classifier, the tier moves the outcome by one step in either direction and never more, precisely because an assessment is a probability, not a verdict.
Enrollment, review and the way out
| Route | Process | Safeguards |
|---|---|---|
| At sentencing (the primary route) | Imposed as an express component of the sentence, on the record, after the assessment is in evidence. | Notice before plea. Counsel present. Findings written. Appealable as part of the sentence. |
| Existing registrant, individualized | Petition or referral, assessment, hearing, written finding, defined term. | Right to counsel. Right to challenge the assessment and to an independent evaluator. Burden on the state. |
| Blanket retroactive sweep | Not available in this design. It is the specific mechanism held punitive in Does #1-5 v. Snyder, and adopting it puts the entire program at risk to gain a population the individualized route reaches anyway, more slowly. | |
| The child's side | Guardian enrols with verified parental authority. No enrollment of a child by anyone else, ever. | Verification designed against the estranged-parent threat, not against fraud in general. |
False alerts and how someone contests one
A system that produces alerts must assume some of them are wrong, and must say in advance what happens when they are. 1976 the Supreme Court set out the balancing test for what process is due before a deprivation. - notice, an opportunity to be heard, and a decision-maker who is not the accuser.
Mathews v. Eldridge, 424 U.S. 319 (1976)
- Every tier-3 and tier-4 event produces a record the subject is entitled to see - the time, duration, tier, and the classifier inputs that produced it. Not the child's identity, and not the child's location history.
- A written challenge route with a deadline on the authority, not only on the subject. An appeal process with no time limit on the agency is not a process.
- Technical evidence is disclosed. Fix quality, device health, and firmware version at the time. A subject cannot contest an encounter whose accuracy they cannot examine.
- An overturned alert is removed from the pattern count. If it stays in, a false alert permanently raises the subject's escalation risk - repeats are an input to the ladder - and the error compounds instead of being corrected.
- Alert accuracy is published in aggregate. Upheld, overturned, and unresolved. A program unwilling to publish its own false-positive rate should not be believed about anything else.
The audit log
Every query against the encounter store is itself a record: who read what, when, and under what authority. The log is append-only, is retained beyond the records it describes, and - this is the part that gets dropped - the subject can obtain their own portion of it. An audit log that only the agency can read is an internal control, not a safeguard.
What the guardian can and cannot see
A guardian receives notifications at tier 2 and above and can review the band's local log on the device. They cannot query anyone's identity, cannot see who the other party was, and cannot retrieve a track. A guardian who could learn the identity of the person nearby would be a de-anonymization channel with a friendly name on it.
The path off the program
A program with no exit is, on factor 7, excessive. It is also unmanageable: the monitored population only grows, supervision quality falls as it does, and the highest-risk cases get the same attention as the lowest.
- A defined term set at imposition and tied to the assessment, not a default of life.
- Mandatory review at fixed intervals whether or not anyone petitions - the burden to continue sits with the state.
- Published criteria for removal, and published grant rates. If nobody has ever been removed, the petition is decorative and a court will treat it as such.
- Data destruction on exit, with a certificate to the subject. Leaving the records behind means the program never really ends.
- A child ages out. The band's enrollment ends at a defined age; it does not quietly convert into an adult tracking account.
The short version
Build the boring half first
The appeal route, the audit log, the exit and the published error rate cost a fraction of the hardware and decide whether any of the hardware ever gets deployed.
How this works
0:59 · narrated · captioned · nothing here is sent anywhere when you press play. Prefer to read it? The transcript is below.
Transcript
| At | Section | What it says |
|---|---|---|
| 0:02 | The skipped parts | Monitoring schemes have been beaten in court on four things. Enrollment criteria, an appeal that can succeed, an audit trail, and a way out. They are the cheapest part of the build. |
| 0:14 | Not a legal category | Paedophile is a clinical term, and it does not map onto who is on a registry. Registries carry offenses with no child victim, and miss many people who do pose a risk to children. |
| 0:25 | Tier on assessment | So the tier comes from a validated risk assessment and offense characteristics, written with a stated confidence and reviewed on a schedule. Not from an offense label. |
| 0:34 | Contesting an alert | Every tier three and tier four event produces a record the subject is entitled to see. An overturned alert leaves the pattern count, and accuracy is published in aggregate. |
| 0:45 | The way out | A defined term. Mandatory review whether or not anyone petitions. Published removal criteria and grant rates. Data destroyed on exit, and a child who simply ages out. |