One sensor is an opinion; two that agree are a measurement

Once the ranging moves onto fixed anchors, the question stops being "can this be measured at all?" and becomes "which measurement is allowed to send an officer somewhere?". This design document answers that with three modalities of unequal authority and one rule that binds them together.

The ordering below is not a preference. It is the order in which each technology's published error compares with the distance it is being asked to decide, and each one is confined to the decision its error permits.

M-1 · Ultra-wideband ranging - primary

An anchor initiates a two-way exchange and the wearable answers. What is measured is the time the radio spent in the air, which is a physical quantity that furniture cannot argue with; the published 2D accuracy is under 15 cm [18]. This is the only modality in the design that is permitted to state how far apart two things are, and it is the reason the wearable needs a real radio rather than a tag.

Qorvo DWM3000 datasheet; UWB energy analysis, arXiv 2311.14523

M-2 · BLE Channel Sounding - corroborating

Two mechanisms in one modality. Phase-based ranging gives an independent distance estimate - line-of-sight p90 of 0.39 m, non-line-of-sight p95 of 4.89 m [16] - which is good enough to confirm M-1 and not good enough to replace it. Round-trip-time distance bounding gives something M-1's accuracy cannot: a cryptographic ceiling on how far away the counterparty can possibly be, derived from the speed of light rather than from trust.

Silicon Labs, BLE Channel Sounding performance metrics

M-3 · GNSS zone containment - context only

Coarse confirmation that the wearable is in the anchor's municipality at all. It is never used for the proximity decision. 18.4 m RMS error per position in an urban environment, which derives to about 26 m on a separation estimate - larger than the threshold it would be asked to decide.[17]

The per-position figure is what was measured; the separation figure follows from differencing two of them, and this design document shows that step rather than quoting the larger number as though it had been observed directly. An earlier draft asserted only the derived figure, which is the harder version to check and the easier one to dispute. M-3 answers "is this plausible?". It is not asked, and cannot answer, "how far apart are they?".

Hwang, Maniar, Smith & Nivens (2026), "False Alerts Related to GPS Electronic Monitoring in Illinois Cook County Sheriff's Office," Criminal Justice Review; urban GNSS error, Satellite Navigation (2025)
The per-position figure is the measurement; the separation figure is derived from it, and this document shows the derivation rather than asserting the larger number.

Two modalities must agree

Escalation past the lowest tier requires agreement between at least two independent modalities. A reading from one sensor may be logged; it may not raise an alarm, notify a guardian, or reach a caseload.

The reason is in the field record rather than in theory. Sensor drift is not an occasional fault in monitoring deployments - it is the normal operating condition, and it produces alert volumes that overwhelm the people receiving them. The Cook County measurement of GPS zone alerting is the clearest published example: the overwhelming majority of monthly alerts were false, the rate rose sharply when the technology was upgraded, and the worst-performing areas were distinguished by tall buildings [17]. A Tennessee audit found most alerts were never checked at all [29].

Hwang, Maniar, Smith & Nivens (2026), "False Alerts Related to GPS Electronic Monitoring in Illinois Cook County Sheriff's Office," Criminal Justice Review; urban GNSS error, Satellite Navigation (2025)
Driven by GPS drift; the worst zip codes were distinguished by tall buildings.

What cross-modality agreement filters is exactly that failure. Two sensors on different physical principles - time of flight and signal phase - do not drift the same way at the same moment for the same reason. A multipath reflection that lengthens a UWB estimate does not lengthen a phase measurement identically; a wearable at the wrong end of a corridor produces a mismatch rather than a confident wrong answer. Requiring agreement converts a class of silent errors into visible disagreements, and a visible disagreement can be logged, counted, and investigated. A confident single-sensor error cannot.

Leith & Farrell, PLOS ONE (2020) e0239943 (tram) and (2021) e0250826 (bus); MIT Lincoln Laboratory
The German configuration reached 9%; the Italian about 50%, with a matching 50% false-positive rate.

The reason for writing this as a prohibition rather than a preference is that RSSI is always the cheapest thing in the room. It needs no new silicon, no ranging exchange, and no power budget, and it produces a number that looks like a distance. Every implementation under schedule pressure will be tempted by it, and the temptation arrives long after the people who understood why it was excluded have moved on.

Relay attacks, and why round-trip time is the answer

A system that decides on radio proximity is making a claim about physical space from an electromagnetic observation, and an attacker who can carry the observation somewhere else can move the claim with it. Two radios and a link between them are enough: one sits beside the wearable, the other beside the anchor, and each faithfully forwards what it hears. Nothing is forged. Every message is genuine, correctly signed, and belongs to a real enrolled device. The anchor concludes that a monitored person is standing in a playground; the monitored person is at home.

Encryption does not help, because nothing is being decrypted. Signatures do not help, because nothing is being altered. Rotating identifiers do not help, because the current one is being relayed live. The attack is against the inference that receiving a message implies the sender was nearby, and that inference is what the whole architecture rests on.

It matters in both directions, which is why it is a design requirement rather than a footnote:

• A false encounter is manufactured. Someone who wants a monitored person referred to law enforcement carries a relay to a school gate. This is the malicious-reporter case in the threat model, and it produces a record that looks exactly like a genuine one.
• A real encounter is suppressed. A monitored person with an accomplice can have their identifier appear somewhere harmless while they are somewhere else, and an anchor with no distance bound has no way to notice.
• The record is what a hearing sees. An encounter record that cannot distinguish a relay from a presence is not evidence, and counsel will say so the first time it is offered.

The mitigation is distance bounding: the anchor measures the round-trip time of a challenge and a response, and the speed of light imposes a ceiling on how far away the responder can be. A relay adds propagation delay and processing delay, and it cannot subtract either. The protocol is built so a correct response cannot be produced early - the response depends on a challenge the wearable has not yet seen - so the only way to answer within the bound is to actually be inside it.

What this hands to the tier engine

The sensing layer produces a separation estimate and a verdict on whether that estimate is fit to escalate. It does not decide a tier. The tier ladder takes it from there, adding the gates this layer has no business deciding - sustained dwell, the anchor's zone class, and a human adjudication before anything is audible or dispatched. Each of those can only lower the ceiling this layer sets. None of them can raise it.

The two layers are separated on purpose. Whether a measurement can be believed is a question about physics and adversaries; what to do about a believable measurement is a question about proportionality and law. Answering them in one function is how a system ends up sending officers to a reading that its own designers would not have trusted.