TruAnon Writing

After the Quake: "I Have Your Child" Should Be Impossible to Fake

· Jesse Tayler

A rescue worker in an orange jumpsuit searching through earthquake rubble

We see this time and again. The quake hits. There's a flood. Children are scattered, photos circulate, and one system holding everything becomes a honeypot. Then the call: "I have your child." —this should be impossible to fake, but it's not.

To secure our future world, private data must be separated into two parts so this honeypot does not connect in ways that allow threat-actors to prey on people when they are most vulnerable. Emergency services must rely on software to get the job done and families must rely on private to protect their children and themselves.

Two Halves

The answer is to split it. Instead of a single platform we break these tasks into two and control how they compare and share private data. Let's call them Rescue and Family.

Family knows who the child is; Rescue knows who was found. Neither sees the other. The only link is the parent, who Grants visibility between them. It's live, not permanent, and the parent can Revoke this visibility at any moment.

Family photos are separated from the owner's account, while Rescue stores photos separately from names

A child's photo is saved by a rescuer and stored on Rescue; their name and personal details are stored on Family — one entry, split the moment it's captured. This is mutual blindness, not a cryptographic proof: neither platform's database ever holds both halves together, so stealing one exposes nothing that points to the other. The only link between them is the parent's Grant — it exists nowhere else.

Rescue asks Family one question for each child found: "Is there an owner for this child?" Family matches privately, discards the photo in real time, and answers YES/NO or a confidence percentage. Only a matching parent is notified, in their own account. Nobody browses anyone's children.

How This Works

This framework is the only way to secure this situation and it is a problem of life-and-death that we must resolve. Lives are at stake, four limits hold firm:

  • The question carries one thing: one photo of one found child, sent only across a Granted and secure link.
  • The found child can't Grant in the moment. The parent's Grant must already exist, made through a verified Family account.
  • Face matching is probabilistic. YES means "likely match," followed by in-person verification before release. You already have that step.
  • The Grant is the only link between the halves, so it must be protected outside both platforms.

Scenario 1: Rescuer finds your kid

  • The Split. Rescuer takes a photo and notes the name/age. The photo stays anonymous in Rescue. The PII text goes blindly to Family.
  • The Ping. Family matches the text to your profile (e.g., 80% match) and alerts you: "A child matching this description was found."
  • The Handshake. You grant a one-time cryptographic key back to Rescue to safely unlock and view the photo. You confirm it's your kid.

Scenario 2: You are looking for your kid

  • The Broadcast. You flag your kid as missing in Family with a name and a baseline photo. Your account starts a silent cryptographic "listening" loop.
  • The Blind Query. A rescuer uploads an anonymous photo to Rescue. Rescue streams the photo data over to Family to ask: "Does this face match any active missing profiles?"
  • The Reveal. Family runs the match in secure memory, hits a match on your baseline photo, and wipes the query. You get an alert, use your key to pull the live photo from Rescue, and claim your child.

The Bottom Line: The databases never link up permanently. The fuzzy name match or the face match is just a blind switchboard to route a secure notification to you. That switchboard has to be provably run honestly, not just reported — tamper-proof, so even the platform hosting it can't quietly fake or alter an answer. Once you see the photo and say "That's my kid," the digital handshake is done, the temporary key expires, and you go get your child in person.

In the commercial world, the example we most commonly address is a more simple: Uber needs a driving record from the DMV. Taken online, ID cards are easy to fake and cheap to steal. We require a purely digital solution to secure ourselves and our children.

  • The Owner anchors to their DMV record, once.
  • The same owner anchors to Uber.
  • Uber asks: "Is this driving record clear?"
  • The DMV answers from its own record, the only one this owner has.

Only the one owner anchored at both ends can broker this. Neither platform knows the other's data, so sniffing the wire or stealing either database isn't enough.

Platforms don't even know the Owner, only that the same individual must have anchored their account at both ends.

A fraudster would need to defeat security at both ends, and know which two records to connect, before the owner does. Each record can have only one owner, and the owner is anchored before any private data is uploaded.

The Same Digital Rights Apply

  • Mutual blindness. Neither platform knows the other's data. Each knows only that the same owner Granted visibility between them. Nothing points back.
  • The Grant is for now — continuous, owner-controlled, and Revocable at any moment.
  • One owner anchors both ends and can ask only about their own thing. The answer is yes/no, or a confidence %, about that one fact.
  • The asker sends the key it already holds (a license number, Rescue's photo). The answerer uses it in the moment, answers, and doesn't store it.
  • Three defenses stack. Intercepting transit isn't enough. Stealing either database isn't enough. A fraudster must defeat both ends and know which two to connect.
  • APIs are locked with keys. There's no other way to query.

This Is the Point

We usually try to solve digital trust by putting more information into one system and then protecting the system. But the safer system is the one that never possesses the complete picture.

Family doesn't need Rescue's database.

Rescue doesn't need Family's database.

Uber doesn't need the DMV's records.

The DMV doesn't need Uber's users.

The Owner connects visibility between and may revoke this visibility at will. That is the same primitive whether the thing at stake is a driving record, a digital account, or a child found after an earthquake.

When the stakes are life and death, "I have your child" shouldn't be something anyone can simply claim.

The system must ensure the claim itself remains extremely difficult to fake and today? There is nothing that can do this but TruAnon.