LAKANA SOS: Safety Without Surveillance

The technical problem

Civilian safety software that watches continuously to be useful in an emergency becomes a permanent surveillance system the rest of the time. This project asks whether a safety architecture can stay bounded — minimizing what it collects and releases — while still behaving usefully when communications and power infrastructure degrade.

The public-safety problem

Flood, hurricane, and other large-area events routinely take out cell towers, cellular service, and home power at the same time a resident most needs a path out or a way to signal for help. A safety design that only works when the network is healthy is not tested against the conditions that matter most.

The privacy problem

Designing for degraded infrastructure tends to push systems toward more collection "just in case" — more location history, more always-on audio, more centralized storage. This capstone treats that as a design failure to avoid, not a tradeoff to accept, and evaluates a bounded, consent-gated, custody-aware alternative instead.

Why degraded infrastructure matters

The strongest evidence produced by the companion research is architecture-level and delivery/infrastructure-mediated: it shows up specifically when ordinary centralized transport is stressed, not in ordinary conditions. A capstone story built only around a calm-weather scenario would not exercise the part of the design doing the most work.

Primary user

An isolated civilian, field-service worker, or community member operating during flood conditions and communications degradation — someone who needs a bounded, local-first safety layer when ordinary cellular, Wi-Fi, or cloud paths are unreliable.

Primary reviewer / customer context

• University safety and research review.
• Field-service safety programs.
• Community resilience planning.
• Emergency-management tabletop evaluation.

What changes between runs

Only the sliders listed above. Everything else — the scenario's flood depth and rain intensity, BFB/TAB enablement, and every other control — stays at the same preset value across both runs, so the comparison isolates the effect of communications/infrastructure degradation.

What remains controlled

The scenario, trial count, and every non-communications slider stay fixed. Both runs go through the same backend endpoint, the same trial cap, and the same receipt serialization path.

What the comparison can show

How the same modeled event's delivery-path, egress, and preservation reads change when ordinary transport is degraded and CivOS falls back to surviving permitted paths — the same architecture-level pattern the companion research reports under synthetic degraded-state stress.

What it cannot prove

This is not a controlled field experiment, an emergency-service validation, or a guarantee that a packet can leave when no physical transport path exists. When no route exists, SOS preserves the event locally and records non-delivery — it does not claim delivery happened anyway.

Frontend responsibilities

• Display the seven public presets.
• Mount scenario and shared controls.
• Validate interaction state (access agreement, stale runs).
• Show changed-from-default status.
• Show stale state after control changes.
• Submit the public-safe request.
• Display the backend receipt.
• Render the graph and role-specific interpretation.
• Support receipt download and sensitivity.

Backend responsibilities

• Sanitize inputs.
• Enforce the trial cap.
• Execute the public Monte Carlo.
• Enforce public access counters.
• Serialize the public-safe receipt.
• Apply TAB state.
• Return bounded outputs only.

Lives in the browser tab

• Current slider state (until reset or reload).
• Latest completed receipt (window.LAKANA_SOS_SIM_STATE).
• Stale-preview flag after a control change.
• Capstone baseline and blackout-stress receipt snapshots, held separately from the "latest receipt" pointer.

Lives in sessionStorage

• Run-access-agreement acceptance for the current browser session.
• A copy of the most recently upgraded receipt, for the current tab session only.

sessionStorage is browser tab storage, not a database. It clears when the tab closes and is never queried across users.

Leaves the browser

Only the sanitized public-safe request body (scenario key, slider values, trial count, seed) sent to the backend endpoint on each run. No raw audio, video, continuous location, or device identifiers are sent.

What is not persisted

There is no server-side database in this project. Public access counters live in an in-memory limiter on the serverless instance and reset if that instance recycles. Nothing about a specific run is stored after the response is returned, beyond that counter.

Real

• Frontend and backend endpoint.
• Request sanitizer.
• Monte Carlo execution.
• Run counters.
• JSON receipt.
• Stale-state behavior.
• Scenario controls.
• TAB accept/deny UI state.
• BFB visualization.
• Reviewer Lens.
• Sensitivity.
• Responsive layout.
• Guided demonstration.
• Two-run receipt comparison.

Simulated

• The emergency event itself.
• Actual dispatch.
• Responder arrival.
• Physical rescue.
• Real agency integration.
• Production local hardware.
• Ring -1 behavior.
• Kernel-adjacent behavior.
• Field communications.
• Emergency certification.

Data minimization & bounded disclosure

The allowed payload is limited to welfare state, route hint, validity, and audit fields. Denied-by-default fields — raw audio, raw video, continuous location — are named explicitly on every receipt's release boundary.

Consent-gated TAB, non-recording default

The Tactical Audio Bridge only enters an accepted state after an explicit user decision. Recording remains off by default, and no-interaction never injects a fake accepted/denied override.

BFB packet boundary

The Blue Force Bridge responder packet is minimized to route hint, welfare, validity, and audit — never a continuous location feed or raw evidence vault access.

Raw trace withholding & denied-path audit

Protected constants, private thresholds, and raw traces are withheld by design. Denied or failed transport is not silently dropped — it is recorded in the event timeline.

Stale-state protection

Once any control changes after a completed run, the result is marked stale and a rerun is required before the receipt is treated as current — the interface never quietly keeps showing a result that no longer matches the visible controls.

Browser permission posture

The public demo does not request microphone, camera, or continuous geolocation permissions. TAB and BFB flows are modeled UI state, not live WebRTC sessions.

Scene-edge arrival vs. physical access

A responder reaching the general area (scene-edge arrival) is not the same as reaching the specific person (physical access). The gap between the two — the access gap — is the operationally decisive quantity under blocked roads, floodwater, debris, smoke, or crowd compression.

Route obstruction, floodwater, and debris

Route obstruction is modeled explicitly and feeds both the egress-path read and the modeled access-gap estimate, rather than being folded silently into a single opaque score.

Communications degradation

Tower outage, RF degradation, and cellular degradation are modeled as independent, adjustable pressures, matching how large-area events typically fail: partially, unevenly, and often for the exact routes people are trying to use.

Preservation vs. delivery

When no permitted path exists, the model's answer is to preserve the event locally, not to claim delivery anyway. Preservation and delivery are reported as separate scores for this reason.

Local relay & store-and-forward

When immediate egress is blocked, the model evaluates whether a nearby peer, relay, or store-and-forward path can carry the event once a route returns, rather than treating "no immediate delivery" as final failure.

Bounded responder packet

The BFB packet a responder would see is deliberately minimized — this is dispatch-adjacent situational awareness, not a dispatch replacement, and not incident-command authority. It is designed to support incident response, not direct it.

Scope

Monte Carlo evaluation of a civilian safety architecture under separated comparison suites and synthetic degraded-state stress. 250,000 nominal trials; 500,000 synthetic degraded-state trials. Simulation-only — no field validation, no emergency-service certification, no empirically calibrated human-safety claim, no real-world attacker-resistance claim, no clinical survival claim. "Survivability" is a simulator-defined protected-outcome variable, not mortality or percent alive.

Headline architecture results (nominal, n = 250,000)

• LAKANA + CivOS: 0.954636
• LAKANA without CivOS: 0.949616
• Industry comparator: 0.947172

Shared-detector degraded-state stress

• LAKANA + CivOS: 0.950753
• Industry comparator: 0.782674

The strongest evidence is architecture-level and delivery/infrastructure-mediated under the modeled degraded-state regime — the comparator's dependence on centralized transport is the dominant failure mechanism in that diagnostic.

Detector burden–sensitivity trade-space

Detector behavior is reported as a burden–sensitivity trade-space: higher raw recall can also raise false-positive and escalation burden. This research does not claim universal detector superiority or empirical calibration.