SAQR

01The problem nobody guards

Critical facilities are watched by cameras, and the whole security model quietly assumes the camera is telling the truth. It is the one node in the chain trusted by default and verified by nobody.

If an attacker owns the camera, they do not need to break the guard, the gate or the operator. They only need to control what those three see. Every downstream decision — dispatch a patrol, open a door, close an investigation — is made on evidence the attacker chose.

9

02The constraint I set

I refused to build a detector that only raises alarms. An alarm is advice; the operator can ignore it and often does, because alarms are usually wrong.

So the requirement became stricter: a camera that loses trust must stop being able to influence decisions at all. Not flagged — excluded. That single change moves the system from detection to containment, and it is much harder to build.

1

03Decisions

Trust is earned per frame, not granted at install. Each camera holds a live trust score derived from the consistency of its own telemetry, not from its identity or its certificate.

Telemetry is signed and replay-proof. Every measurement carries an HMAC signature and a nonce, so a recorded-and-replayed stream fails on arrival rather than being reasoned about later.

The control plane is separated from the data plane. A WebSocket control channel carries trust state and commands; it is authenticated with JWT and gated by role-based access control, so a compromised viewer cannot issue a command.

The audit log is serialized and tamper-evident. Entries are chained, so an attacker who reaches the log can destroy it but cannot quietly edit it — and destruction is itself detectable.

78

04How it was verified

I built a digital twin of the facility and ran 2,400 seeded runs against it: five attack scenarios — replay, botnet command-and-control, RF jamming, physical tampering and framing — plus a benign baseline, 100 runs each, against SAQR and three baseline systems.

Across that sweep: every attack was detected, no benign event was ever misclassified as an attack, and 98% of evidence retained its integrity guarantee end to end.

Separately from the simulation: 73 automated tests on the codebase (unit, integration and adversarial), 19 of 19 DAST checks (dynamic application security testing, run against the live service) passed, no bandit findings across 1,904 lines (static security analysis), and no known vulnerabilities in 57 dependencies from pip-audit.

And outside the twin, on a real camera: in a live drill, a camera whose own recording was replayed into its feed was isolated after about six seconds.

The point of listing four different kinds of evidence is that each one is blind to a different failure. Tests miss runtime exposure; DAST misses logic; static analysis misses dependencies; simulation misses everything that is not modelled.

4

05What it still cannot do

The digital twin is a model, and a model is an argument, not a proof. A physical attack class I did not think to model is a class the twin reports zero for — and a zero from an unasked question looks identical to a zero from a defended one.

It has run on one real camera in a drill, but not on a real site. Until it has, the honest claim is narrower: the design holds under every condition I was able to imagine and construct.