Safe Perimeter, in full

1. Scope and claim

Argued at /coverage/

Ref	Level	Requirement
SP-1	MUST	The system is described as closing a specific gap — sustained, unexplained physical proximity between a child and an adult under active monitoring, in places a fixed geofence cannot see — and never as a solution to child sexual abuse generally.
SP-2	MUST	Published material states that the large majority of child sexual abuse is committed by family members and acquaintances, and that most people who commit these offences have no prior conviction and are therefore invisible to the system.
SP-3	MUST	Published material states that the system has no effect on online grooming.
SP-4	MUST NOT	Any coverage figure be published without the assumptions that produced it.
SP-5	SHOULD	Coverage be re-estimated annually against the jurisdiction’s own case data rather than national averages.

2. Enrolment of monitored subjects

Argued at /due-process/

Ref	Level	Requirement
SP-6	MUST	Monitoring be imposed prospectively, at sentencing, as an express component of the sentence, with the defendant on notice before plea.
SP-7	MUST	Any application to a person already convicted proceed by individualised determination: a validated risk assessment, notice, a hearing, the right to counsel, and a written finding.
SP-8	MUST NOT	Monitoring be applied to any class of existing registrants by blanket administrative reclassification.
SP-9	MUST	Tiering derive from a validated actuarial risk assessment together with offence characteristics, and never from an offence label alone.
SP-10	MUST	The subject be entitled to challenge the assessment and to an independent evaluation.
SP-11	MUST	Every imposition carry a defined term, with the burden on the state to justify continuation at each review.
SP-12	SHOULD	The highest tier be sized to the supervision capacity that actually exists, not to the population that qualifies on paper.

3. Enrolment of children

Argued at /legal/

Ref	Level	Requirement
SP-13	MUST	A child be enrolled only by a guardian with verified parental authority, verified against the estranged-parent threat specifically.
SP-14	MUST	Enrolment end automatically at a defined age and never convert into an adult account.
SP-15	MUST NOT	A child’s band be required as a condition of attending school, receiving services, or entering a public place.
SP-16	SHOULD	The views of a child old enough to hold one be recorded at enrolment, because a device a child did not agree to is a device they will disable.

4. Alert logic

Argued at /alert-tiers/

Ref	Level	Requirement
SP-17	MUST	The response ladder have at least the five tiers defined in this specification, with distinct recipients at each.
SP-18	MUST NOT	Any tier above Log be reached on separation distance alone, at any distance, for any duration.
SP-19	MUST	Sustained dwell be required for every tier above Notify.
SP-20	MUST	Dispatch require sustained dwell together with either a legally designated exclusion zone or a third repeat encounter within thirty days.
SP-21	MUST	A lost position fix produce no event, and the gap itself be recorded so the outage is auditable.
SP-22	MUST	A degraded position fix cap the encounter at Notify.
SP-23	MUST	Dwell thresholds be raised in dense venues, where incidental proximity is the norm.
SP-24	MUST NOT	The assessed risk tier move an outcome by more than one step in either direction.
SP-25	MUST NOT	The child’s band emit any audible or visible alert.
SP-26	MUST	Audible alerting be confined to the guardian’s own device, at tier 3 and above.
SP-27	MUST NOT	Any alert be placed automatically to emergency services on a proximity threshold.
SP-28	SHOULD	Ladder thresholds be tunable per jurisdiction and every change be versioned against the encounters it affects.

5. Data protection and matching

Argued at /data-flow/

Ref	Level	Requirement
SP-29	MUST	Proximity matching be performed on the child’s device against a published list of pseudonymous keys.
SP-30	MUST NOT	Any position of any party be transmitted to a server at any time.
SP-31	MUST	The child’s band be receive-only: no advertised service, no response to probes, and no identifier transmitted.
SP-32	MUST	Broadcast identifiers rotate at least every fifteen minutes and be unlinkable across days without the key that generated them.
SP-33	MUST	The band hold no identity for the child, so that a found device tells the finder nothing.
SP-34	MUST	Position history on the band be limited to a rolling window of no more than 72 hours and never be exportable or synchronised.
SP-35	MUST	The pairing secret be wiped on tamper and on guardian revocation.
SP-36	MUST	The published key list be partitioned by region wherever the full list exceeds what a band can hold.
SP-37	MUST	Published material state plainly that publishing the key list creates a proximity oracle any third party can build a receiver for, and that this capability did not previously exist.
SP-38	MUST NOT	A guardian be able to learn the identity of the other party to an encounter.
SP-39	SHOULD	Key distribution be rate-limited and client-attested, accepting that neither eliminates the oracle.

6. Devices

Argued at /devices/

Ref	Level	Requirement
SP-40	MUST	The subject’s device detect strap breach by continuity, wear by skin contact and temperature, and being worn by motion coherence.
SP-41	MUST	The subject’s device carry its own network radio and not depend on any device the subject controls.
SP-42	MUST	Both devices buffer events they cannot transmit and upload them on reconnection.
SP-43	MUST	Every buffered event be labelled with its true age when delivered.
SP-44	MUST NOT	A buffered event be presented as current.
SP-45	MUST	Loss of all received signals in a location with prior coverage be recorded as an event in its own right.
SP-46	MUST NOT	Any implanted device be used. A passive implant has no power, no positioning and no radio range, and cannot perform this function.
SP-47	SHOULD	The child’s band achieve a five to seven day charge interval; a band charged daily will not be worn.
SP-48	SHOULD	The child’s band carry no screen, name or branding that marks the wearer out.

7. Power and availability

Argued at /operations/

Ref	Level	Requirement
SP-49	MUST	The charging obligation be stated in the subject’s conditions with a specific window and duration.
SP-50	MUST	A dead battery on the subject’s device be defined in the order as a compliance event with a written response.
SP-51	MUST NOT	A dead battery on a child’s band ever be treated as a violation by anyone.
SP-52	MUST	Both devices warn before power loss, and the guardian be told when a band goes offline.
SP-53	SHOULD	Repeated discharge patterns be addressed through supervision rather than through the device.

8. Due process, audit and exit

Argued at /due-process/

Ref	Level	Requirement
SP-54	MUST	Every tier 3 and tier 4 event produce a record the subject is entitled to obtain, including the classifier inputs that produced it.
SP-55	MUST NOT	That record disclose the child’s identity or location history.
SP-56	MUST	A written challenge route exist with a deadline binding on the authority as well as on the subject.
SP-57	MUST	Fix quality, device health and firmware version at the time of an encounter be disclosed to a subject contesting it.
SP-58	MUST	An overturned alert be removed from the repeat count that feeds the ladder.
SP-59	MUST	Every read of the encounter store be written to an append-only audit log.
SP-60	MUST	A subject be able to obtain their own portion of that audit log.
SP-61	MUST	A petition for removal exist, with published criteria and published grant rates.
SP-62	MUST	Records be destroyed on exit, with a certificate issued to the subject.
SP-63	MUST	Alert accuracy be published in aggregate at least quarterly, classified by cause.
SP-64	SHOULD	Median time from alert to human action be tracked weekly as the programme’s leading failure indicator.

9. Operations

Argued at /operations/

Ref	Level	Requirement
SP-65	MUST	Firmware be rolled out in stages and the version recorded against every encounter.
SP-66	MUST	Staleness of a band’s copy of the key list be a monitored condition rather than a silent degradation.
SP-67	MUST	Enrolment, tier, term and audit history transfer with a subject who moves between jurisdictions.
SP-68	MUST	The programme end for a subject who moves somewhere the order is unenforceable, and say so rather than claim a coverage it no longer has.
SP-69	SHOULD	Fleet health — reporting, silent over 24 hours, strap events — be reviewed daily.

---

Open questions this document does not answer

A specification that claims to have settled everything is not finished, it is unexamined. These are open:

• Radio choice. Bluetooth LE gives range and battery life but is trivially detectable; ultra-wideband gives far better distance accuracy at a power cost a small band may not survive. The dwell thresholds in this document assume distance accuracy the radio may not deliver, and that assumption has not been tested.
• The proximity oracle. Local matching requires publishing keys, and publishing keys lets anyone build a detector. Regional partitioning and attestation narrow it. Nothing eliminates it without moving matching to a server, which reintroduces the central location database. Whoever adopts this has to choose knowingly.
• Whether the child-side device is adopted at all. Every figure in the coverage model is multiplied by the share of children carrying a working, charged band. That share is not a technical parameter, and no amount of engineering sets it.
• Cost. Nothing in this document is costed. Hardware, network, monitoring centre staffing, hearings and appeals are all real and none is estimated here, because an invented number would be worse than an absent one.
• Whether the assessment instrument is good enough. The tier feeds the ladder. Validated actuarial instruments have known and published error rates, and this design has not been tested against what those errors do to alert quality.