Version 6.0 · 2026. Companion documents: the Bitaid Specification and the Bitaid Foundations.
Violence is decided in the minutes between a crime and anyone’s response to it. That is where the harm is done, and no institution of public safety is present in it. Those institutions are a monopoly: without prices or competition they cannot learn what protection is worth, where or to whom, they have no rival to outdo and no customer who can leave, so they neither innovate nor improve as technology does. A purely peer-to-peer protocol for emergency response would let a person in danger summon nearby, capable strangers and pay them without asking anyone’s permission or going through a dispatcher, and would let the strangers be paid without trusting the person who called them. Bitcoin escrows provide part of the solution. The main benefits are lost, though, if a trusted party is still needed to decide who did what and who gets paid.
We propose a solution in which the offer is escrowed before any emergency, and the moment a responder accepts, the parties’ devices automatically sign every payout the case can end in, before anyone has a reason to dispute. Payment then needs only an attestation choosing one outcome from that fixed set. Every outcome in it pays only the parties, and all were signed before anyone knew how the case would end, so whoever attests can choose among them but cannot add one: the intermediaries who decide never hold the funds and cannot pay themselves any of it. The outcome is settled by the people who were there, through blind itemised ballots. Where they disagree, it is settled by a closed pool of pseudonymous arbitrators who answer narrow factual questions against a fixed canon of reference cases and lose money when they depart from it. Whoever claims pay must prove what they did on their own recordings, so every scene is filmed by the people with the most reason to film it, from several independent angles; each recording is hashed before it is uploaded and anchored to Bitcoin. Every role stakes a refundable bond larger than anything it could gain by cheating. How much a participant’s word counts — the weight of a responder’s ballot, an arbitrator’s claim to a seat — grows only with paid work actually done, for responders in the cells where it was done, seasoned over calendar time that cannot be bought. Pay comes from the incident alone, and there is no governance to sway. Because pay is owed only when something happens, insurers can pool capital across people who rarely need it at once, so a small premium stands behind a large offer. Cheating does not pay: every attempt stakes more than it can win, fabricating consistent footage from several independent cameras is beyond practical reach, and any case can be reopened later. The protocol has no token, no company and no administrator. It inherits its ordering and finality from Bitcoin.
A woman is followed home at two in the morning. A family’s door is forced by people who know a Bitcoin investor lives there. In each case the outcome is decided within minutes — often within seconds — by whoever is present: the aggressor, the victim, and, by chance, a bystander with no equipment, no cover and every reason to keep walking.
Public safety, as it exists, does not operate in those minutes. A police force can patrol, deter in aggregate, investigate and prosecute; but at the moment of an attack it is a phone queue and an estimated arrival time. By the time an officer arrives, the harm the caller feared has usually either happened or not happened. What arrives is a record, sometimes a pursuit, rarely a rescue. The gap is not one of waiting times that better management could shorten. It is structural: the protection a person needs is only useful in the place and minute the threat exists, and a central service dispatched from elsewhere can almost never be there.
When the response does arrive, it brings a second problem: judgment made on the spot, on one party’s word, by people answerable to no one present. In Southampton in December 2025, an eighteen-year-old student, Henry Nowak, was stabbed by a man who told the arriving officers that Nowak had racially abused him. Body-worn video shows the officers handcuffing Nowak as he lay dying; when he said he had been stabbed, one replied, “I don’t think you have, mate.” His attacker was convicted of murder in June 2026; the officers are under investigation for gross misconduct [1]. The failure was not a lack of officers. It was an unaccountable judgment about who was credible.
Nor is it a single lapse. A monopoly is judged by where it spends its attention, and its users cannot leave. In 2023 police in England and Wales made 12,183 arrests over “grossly offensive” online messages, about 33 a day [2]. In the decades before, organised gangs raped children in town after town while the authorities looked away; in Rotherham, police arrested fathers who tried to pull their daughters out of the houses where they were being abused [3]. The figures that exist are local: at least 1,400 children in Rotherham, a borough of 265,000 [3], and more than a thousand in Telford [4]. No one has counted the country — a national audit in 2025 judged the official record “highly unlikely” to reflect the true scale [5] — but Rotherham’s rate, if it held across England, would mean some 300,000 children. When the protector of last resort arrests the father at the door, the family has no protector at all.
For some, the state is worse than absent: it is the leak that aims the attacker. Bitcoin holders, the protocol’s first users, now face kidnappings, home invasions and extortion. French prosecutors counted 18 such attacks in 2024, 67 in 2025 and 47 more in the first months of 2026 [6]. In January 2025 the co-founder of a hardware-wallet company was taken from his home, and his kidnappers sent a video of his severed finger with their ransom demand [7]. Attackers find their victims through leaked customer databases and, allegedly, through the state’s own records: in 2025 a French tax official was charged after investigators found she had searched the tax administration’s systems for crypto investors and allegedly sold their data [8]. Self-custody removes the bank, and with it the bank’s vault. It does not remove the need for someone to come when the door is forced.
The demand for physical security is not negotiable, so where the state fails, people buy their own: guards, patrols, armed-response contracts. Private security is the honest alternative to the monopoly, but it sells readiness. A guard is paid by the hour whether anything happens or not, and a post staffed around the clock needs four or five salaries. Its cost grows with the hours covered and the gates watched, so it protects places rather than people, and only those who can pay for idle hours. A community of a thousand that pools two dollars a month each collects $24,000 a year, in most countries not enough to keep one gate staffed day and night. What private security lacks is not willingness but a way to pay for protection only when it is needed: to find capable strangers in the minute it matters, pay them without trust, and have their conduct judged afterwards by someone they did not choose and cannot buy.
The pieces now exist. A smartphone can sign, locate itself and record. Bitcoin can hold money in an escrow that no one controls and that pays out only on agreed conditions. Peer-to-peer networks can route messages and store data without a centre. The right of a private person to defend others and to detain someone caught in a serious offence predates professional policing by centuries, and survives in most jurisdictions. What has been missing is a protocol that composes them into a market: an open market for first response, enforced by money and cryptography rather than by a trusted party.
In such a market, the caller does not need to persuade a sceptical dispatcher that the danger is real. A deposit posted before the emergency, and forfeited if the alert is false, says so more reliably than any description given under stress. The cryptographic work is done in advance, during calm registration; in the emergency, the caller presses one button. What follows describes how the alert reaches nearby responders, how money moves, how evidence is kept, and how disputes are resolved without anyone in authority.
Paying for outcomes instead of hours changes what the same money buys. Capital that waits costs no wages: it sits as unspent bitcoin until an alert draws on it. And because emergencies rarely strike the same people at once, one stake can stand behind many offers, as every insurer’s does. The same thousand people at two dollars a month can be covered by an insurer that stakes $24,000 in three layers of $8,000. Every one of them can then summon nearby responders with an $8,000 offer, wherever they are, three emergencies at a time, and their premiums pay the claims for as long as full payouts stay rarer than about one per four hundred members a year. That is actuarial leverage of some three hundred to one, applied to the defence of life and property.
The cover scales with what members choose to pay: at the same claim rate, ten dollars a month stands behind an offer of some $40,000, and fifty behind $200,000. Offers of that size are not paid to make one rescue lavish. They are revenue that competing responders can invest against, so the capability they fund — teams minutes away, drones over every street, trained medics — comes within reach of anyone with a modest premium, rather than of those who can afford to keep it on standby. Protection stops being a luxury staffed by the hour and becomes an insurable good, cheap in the ordinary year and loud in the minute it matters: not by declaring a right to security, but by engineering its price (Section 9).
The protocol has four roles. A caller asks for help. A responder — a person, a security firm, a drone fleet — attends. An archivist stores the evidence. An arbitrator resolves disputes. Every node also relays alerts; there is no separate relay role. Each role stakes a bond: refundable collateral, locked in a Bitcoin script, forfeited only on a finding of misuse. The bond is the price of entry, not an investment. It earns no yield and grants no governance; the incentive is to post what the role requires, use it honestly and take it back.
An alert carries an economic offer of three tiers, fixed before anyone moves:
Each tier prices a different behaviour: the deposit prices honesty, the bounty the attempt, and the reward the problem actually being solved. Responders sort alerts by the whole package, not by queue position, and decide for themselves whether an offer is worth the risk. Anyone may add to an offer — an insurer, a neighbour, a local business. After a case is final, anyone may also tip a responder at their per-case address for service beyond the offer. Tips cannot buy a ballot, never count as work history and carry no weight in the protocol.
Figure 1. Roles, bonds and money. The caller’s offer is escrowed; responders attend and record; archivists keep the evidence; arbitrators settle disputes, and their joint oracle key only picks among payouts the parties pre-signed.
Figure 2. The offer. Three tiers, each pricing a different behaviour, all escrowed before any emergency.
Participation has no standing cost. A caller’s deposit stays theirs until an incident and can be withdrawn whenever no alert is open. The only money a caller ever spends is the bounty and reward actually earned, the archival fees for footage it recorded itself, and arbitration fees if they ask for a ruling. A person who never has an emergency pays nothing.
Rewards attach to the safety of the covered person or property, never to force as such. No template pays more for striking or detaining someone than for de-escalating, and callers choose rewards from standard templates rather than writing their own conditions; a caller who could write a condition could use the protocol to hire someone to hurt a person they label an aggressor. Each template has an endpoint — handover to emergency services, property secured, or a fixed time after resolution — and is judged from the responder’s arrival to that endpoint.
The problem with paying strangers for emergency work is that every payment depends on a judgment made afterwards, and at the moment of judgment the losing party will not sign. Bitaid therefore signs every possible payment at the one moment when all parties are known and none is disputing: when a responder accepts the alert.
Funding output. At registration, the caller locks the deposit, bounty and reward in a funding output with three spending conditions:
Before any withdrawal, the oracle first writes a withdrawal authorised event to the log, then releases its signature. From that event on, any alert the output backs shows in responders’ apps as unbacked. A caller therefore cannot pull the deposit while an alert is live, and cannot obtain a withdrawal in a quiet moment and hold it for later.
Acceptance. When a responder accepts, their app and whichever device holds the caller’s scoped key sign three things automatically, within a network round trip and without anyone on the scene touching a screen:
From acceptance on, the funds can leave only by cooperative close, by one of the pre-signed payouts, or by the refund. A normal incident closes cooperatively and the payout set is never used.
Figure 3. Escrow paths. Before acceptance the funds are the caller’s; after it, every exit was signed in advance by the parties themselves.
Payouts as adaptor signatures. Each payout is signed as an adaptor signature [10] locked to a point S_m that anyone can compute from the oracle’s public key, a nonce committed for this pot of this case, and the outcome m. When the oracle publishes its attestation for m, that attestation is exactly the secret that completes the payout for m and no other. The oracle holds no key in the incident outputs and signs nothing that pays out a case. It can choose among the payouts the parties signed; it cannot create a new one. Elsewhere it only co-signs beside an owner’s key — a withdrawal, or a forfeiture the owner pre-signed — so it can delay, never move funds alone.
Figure 4. For each pot, one payout is pre-signed for every possible ending, each locked to a point derived from that ending. The oracle’s attestation for the pot is the secret that completes exactly one of them.
Bounded outcomes. Pre-signing requires the set of outcomes to be small and fixed before any dispute exists. It is, because every outcome acts on only three things, and each sits in its own output:
Because the three pots are held separately, each needs payouts only for its own endings, and the counts add rather than multiply: at most 7 for the deposit, 253 for the reward and 127 for the bounty — 387 in all, where one shared output would need 7 × 3 × 127 = 2,667 — and far fewer with fewer responders or when a pot is empty. A case that closes by agreement spends all three outputs in one transaction; a disputed one settles in up to three, one per pot, plus one per slice where a pot is sliced. Signing them is quick: on a 2019 budget phone, one signer’s whole part of the 387 — its own signatures and the checks of everyone else’s — takes 0.7 seconds with a standard library. Everything else a verdict can do acts on bonds, each with its forfeitures pre-signed when its exposure began, in fixed fractions: 25%, 50% or 100%.
More seats for larger offers. Five seats suit most incidents, and more cannot be added the same way: the number of possible splits grows with every seat and every finer step, so eight seats at 10% steps would need 58,356 payouts. A larger offer uses a different layout. The bounty and the reward are each cut into equal slices — ten, or twenty for the largest offers — and each slice is paid to one seat, so a split is simply which seat each slice goes to, and the payouts grow with the seats rather than with their combinations: ten seats at 10% steps need about 340. The pots are still single outputs, and a case closed by agreement settles them in one transaction at any split. Only when it is not is a pre-signed fan-out broadcast, moving each pot into its slices under the same keys, after which the oracle attests one seat per slice. The number of seats is set at registration from the size of the offer, since a slice must be worth well over what paying it out costs, and a caller or its insurer can raise it to twelve, to bring more independent units to a scene. A seat is a bond, not a person: a unit of several people and machines takes one seat and splits its share internally, and every seat clears the same acceptance gate.
Who signs for the caller. The caller is in an emergency and may lose the phone. Their side is signed by the scoped key, which the wallet authorises at registration together with a template of every caller-side output: the refund descriptor, from which each case derives a fresh refund address so that none is ever reused, and anything else owed to the caller. Up to three holders may carry the key: the phone, the caller’s always-on node, or bonded signing delegates. The oracle co-signs the incident transaction only if it matches the template, and attests only payout sets that match it, so a holder of the scoped key can add responders but cannot redirect the caller’s money, and a stolen key moves nothing on its own. A delegate’s bond must exceed the value it signs for, and a delegate caught signing for responders it controls loses that bond to the caller.
No hot key holds money. Every key that lives on an online device — a caller’s scoped key, a responder’s, an arbitrator’s seat key — can sign only what its owner’s cold wallet committed in advance, and every path that could move funds early needs a second key it does not have: a stolen scoped key cannot withdraw a deposit, redirect a payout or touch a bond, and can at most act in its owner’s name. The one way to take money with hot keys is to hold two at once: a caller’s stolen scoped key and a bonded responder controlled by the thief, which together hold an incident’s pots. That responder has staked at least twice the offer, a staged incident forfeits it to the caller first, and the caller’s app shows any alert it did not send with one tap to dispute it, so the thief risks twice what it can take. A scoped key can also be split across devices — any two of the caller’s phone, node and delegate, or an arbitrator’s node and phone — so that one compromised machine can sign nothing at all; for arbitrators, whose votes an attacker could otherwise harvest from many infected servers at once, two devices are required. Two devices means two independent machines, not a human in the loop: an operator can automate both, and arbitration run entirely by AI agents is allowed, best with the second machine running its own client and model and co-signing only when its own reading agrees. The cold wallet is used only to register, top up, withdraw and renew outputs about once a year, and can stay on a hardware signer. Specification §14.3 and Appendix B.4 set out each key.
Figure 5. The cold key draws the fence. The scoped key on the phone, node or delegate can sign only what the wallet’s template allows; a thief with it can never send the stake elsewhere.
Joining. Responders who accept within a 120-second window sign together as one incident set. A later responder whose device reports a position within about 300 metres of the scene is added automatically: the signers’ devices co-sign a new incident transaction and a fresh payout set under a fresh oracle nonce, and the oracle attests only under the newest nonce. The set holds five signing seats, or up to ten — twelve on request — for larger offers. A seat, once taken, is kept until the case closes or its holder withdraws, so a responder who leaves the scene in pursuit is not displaced, and nobody can be pushed out by a closer arrival, real or spoofed. A responder who arrives after the seats are full attends as a documenter outside the escrow; their bond’s forfeitures are still pre-signed toward the signers, so they answer for their conduct even though they cannot be paid from the escrow. The app shows seats as they fill, so a responder knows before setting off whether a paid seat remains; once they are full, a tip is the only pay, and a scene already filmed from every seat gains little from one more camera.
Figure 6. Seats by proximity. Arrivals inside the ring take empty seats and keep them, even in pursuit; a responder arriving after the seats are full documents outside the escrow, its bond still answering for its conduct.
What remains. The oracle’s co-signature is a threshold signature, so any qualifying subset of the pool can give it. If too few members are online, or every holder of the caller’s scoped key is unreachable at acceptance, the deposit is never locked, and responders see before setting off that the alert is unbacked. Every accepted incident costs one on-chain transaction.
Geofenced alerts. The world is divided into H3 hexagonal cells [11] of about 5 km². An alert propagates over Tor to nodes in the caller’s cell and its six neighbours, and to the next ring where fewer than five nodes are active. Initially it carries only the cell, the economic offer and proof that the funding output is live. Precise coordinates go only to responders who accept. Every node checks an alert’s signature and its funding before relaying it, so a forged alert dies at the first honest node.
Figure 7. The alert reaches the caller’s cell and its six neighbours. Labor is weighed over the same seven cells (Section 10).
Relaying. Every node relays because that is what nodes do; there is no payment for routing and no relay bond. Liveness is enforced by routing consequence instead: a peer that signed a receipt for an alert and then failed to forward it collects dead-end attestations, and a peer whose dead-end ratio over its last 200 attestations exceeds 0.3 is deprioritised, and above 0.6 excluded. A peer that never acknowledged is merely unreachable and is not scored, so a network split produces no false reports. Exclusion is not permanent; an excluded node can recover by forwarding honestly while on probation.
Figure 8. Dead-end scoring. Only a peer that signed for an alert and failed to forward it is reported; one that never answered is merely unreachable. The penalty is routing, not money.
The alert card. A responder sees the offer, any footage the caller’s device buffered before the button was pressed, the funding status, and how many others have accepted. Passing on an alert carries no penalty. A responder may set a standing policy — distance, minimum deposit, minimum offer, hours — and accept automatically; an auto-accepted responder who cannot actually go may withdraw at no cost within the joining window. The protocol sets only a floor; each responder draws their own cut above it, and the alerts below it simply go to someone else (Figure 9). Under a flood of cheap alerts, cuts rise by themselves — no rule has to change.
Figure 9. A responder’s own cut. Alerts are ranked by the caller’s deposit; those above the cut are shown and may be accepted automatically, those below are hidden from this responder but stay open to anyone with a lower cut.
Stake above exposure. By default a responder may accept only if their personal bond, plus the first layer of any insurer backing (Section 9), is at least twice the most they could capture from the incident. At acceptance no one knows how the split will fall, so that is the whole offer — bounty, reward and any seized deposit — as if they alone were paid all of it. Every node computes this gate identically from the posted offer. A caller can raise it but not set it below 1×. Every operator role follows the same rule: an operator’s own capital at risk must exceed what its counterparty has at stake with it.
Figure 10. Stake above exposure. A responder may accept only if its own bond plus the first insurer layer is at least twice the whole offer, the most it could capture if it alone were paid.
The scene channel. Responders who accept the same incident share an end-to-end encrypted channel, joined automatically by later arrivals. It is not meant to be the best radio on the scene — firms will talk on their own nets, which will always be better. It is the scene’s directory, listing each unit and the channels the units talk on; the ledger of the calls that decide fault and of each member’s live position, as short button events every device acknowledges, so the record shows who received what; and the fallback voice for anyone without a radio, above all the caller. Talk on outside channels counts through recordings: each responder records the channels they join, as their own defence, and a call made there reaches every unit the directory lists on that channel. A responder announces there any act that endangers others on the scene — a strobe, a taser, entry into a building — and anyone within reach can call a hold. Each firm on the scene is a unit under its own chain of command, speaking to the others through one liaison. The liaison of the first unit to accept coordinates — naming the one responder who gives orders to the subject, and who holds which position — and hands over to a unit with more stake and labor behind it only when the scene allows. Coordination commands no one; it changes the evidence. Shared positions carry the accuracy their devices report, and another responder’s shot is grounds to take cover, not to fire. These rules are a floor: insurers, who pay for every failure between responders, will price the standard above it. The caller is on the channel too: they can say where they are and ask for a hold. A caller’s hold is information, not a command: responders are judged by whether a threat to a person is still active, so protecting someone while the caller shouts to stop is lawful. A real cancellation goes through the cancel flow, where a duress PIN appears to cancel while raising a silent alert. The channel’s transcript is hashed into the evidence like footage.
Figure 11. The scene channel. An announced act, a hold from someone within reach, and the act after the all-clear: no one is at fault.
Figure 12. Units on one scene. Each firm talks on its own net; liaisons share one channel; the scene channel keeps the directory, the ledger of calls that decide fault, and a voice for the caller.
Callers who are not people. A home alarm, a commercial panel or an industrial sensor array can register as a caller and raise alerts on its own. It posts the same deposit and funds the same offer, and usually supplies richer evidence than a person can: continuous video from several angles, sensor telemetry and footage from before the trigger. Responders who can see the scene before they reach it can act sooner and harder.
What the caller tells responders. A person can give responders the same head start. At registration a caller may attach a scene dossier: proof that the property is theirs, the layout of the building and its entrances, the people who live there with their photographs, pets, hazards and how to get in. Like the precise location, it goes only to responders who accept, and in stages — the layout at acceptance, faces and access only once they are close — so that someone who accepts merely to harvest dossiers learns little. A responder who forces a door then knows whose door it is, who should be behind it and who should not, and the resident whose photograph they have seen is not mistaken for the intruder. A dossier informs; it never designates a threat (Section 7). What a caller reveals is their trade between privacy and speed, and theirs to set.
Every dispute is settled on recordings. Whoever claims pay must have their presence and their act captured, and whoever accuses must have the misconduct captured; what no source recorded cannot be found true (Section 7). Every responder therefore films, because their own footage is their claim to payment and their defence, and a scene with several responders is recorded from several independent points of view. Recordings must then be impossible to suppress or alter after the fact.
Hash before upload. On acceptance, a responder’s camera streams to the Bitaid Content-Addressed Evidence Network (BCAEN) in 256 KB chunks. Each chunk is hashed and its hash gossiped before the upload completes. A recording substituted later does not match the hash already in hundreds of nodes; a recording withheld leaves its hash behind as proof that it existed. At incident close, the Merkle root of all chunk hashes is anchored in a Bitcoin transaction. A caller’s own buffered footage — up to 60 seconds before the button — uploads as one continuous stream whose hash commits to the pre-trigger segment as well.
Figure 13. Each chunk’s hash spreads before the chunk itself is stored; at close, the root of all hashes is anchored in a Bitcoin transaction.
Redundant custody. Each evidence package is held in several places. Its base slots go only to archivists with an earned record of reliable storage and retrieval. Once a region has thirty such nodes, the package is cut into 30 erasure-coded shards of which any 10 rebuild it: the same storage as three full copies, but an attacker must now destroy or withhold 21 pieces instead of 3. Any bonded archivist may bid for marginal slots, which add full copies across more jurisdictions. Chunks are fetched by their hash the way Nostr’s Blossom media servers serve files, so an archivist runs ordinary server software, sells storage to anyone else on the same machine with its evidence slots served first, and any Blossom server anywhere may mirror the chunks as one more copy. Tested on thirty real Blossom servers, the evidence came back byte for byte with twenty of them shut down, and probes caught nodes that corrupted, trimmed or deleted what they held. Every attending responder also keeps their own footage, which they need for their own defence. To suppress a recording, an attacker must compromise enough shards, every extra copy and every responder’s device, and in addition the gossip in which its hashes spread and the Bitcoin chain in which its root is anchored.
Redundancy follows the case’s age. Evidence matters most while its case is open. Until thirty days after the case is final it is held as the 30 shards plus a full copy; for the rest of its first year as the shards alone; then, to the end of its fifth year, as 20 shards, any 10 of which rebuild it. That averages about 2.2 times its size instead of three, while the weeks in which money waits on the footage get more protection than three copies ever gave. Whoever needs the service pays for it. The uploader pays the first year at upload, under a dollar for a ten-minute incident filmed by three responders. The later years serve the arbitration layer — reviews, the calibration canon arbitrators train on, fraud cascades — and are paid by it, from participation fees, review and training retrievals, and the subsidy pool that seized bonds feed. What is kept is decided by the case, not by the camera: a stream that earned a share of the pay, or that a panel, review or cascade relied on, is kept; a stream that earned nothing and that nobody cited in a year of open scrutiny expires unless someone pays to keep it. A case reopened, flagged or entered in the canon returns to its first-year protection. Footage is never re-encoded or enhanced to save space: an upscaler invents plausible detail, faces included, so a panel judges only the file as recorded.
Figure 14. Layers of custody. Each ring is held by different parties; suppressing a recording means breaking all of them, and even then its hash remains.
Availability, checked in secret. Evidence is retrieved constantly — for disputes, for reviews, and for training arbitrators on past cases. Every chunk is gossiped with two hashes: its address, and the root of a tree over its 4 KiB slices, so one random slice can be checked against the public root at a sixty-fourth of the cost of the chunk. Each period, arbitrators learn privately, by a verifiable random draw, which slots they are to probe. A probe looks like any other request and is never announced, so a node passes only by serving everyone; probers are paid the same whatever they report. A node failing half of its last 20 probes loses its base slot, with its deposit returned, since failing to serve is not proof of deletion. A slice that fails its proof is signed evidence of corruption, and the node loses its bond. Anyone may also post a public challenge: five arbitrators from different regions request the whole chunk within six blocks, and if four fail, the node’s availability deposit pays for its replacement. The probers forward what they retrieve, so a challenge is also the retrieval of last resort. Because the content is addressed by its hash, a single successful retrieval proves availability.
Integrity is not truth. A valid hash proves only that the bytes are the ones committed, not that they show the incident truthfully. What the footage shows is a question for the judges of Sections 6 and 7, and footage from several independent cameras is what makes a fabrication expensive: a deepfake must agree with every other angle whose hashes were already public before anyone could coordinate.
Most incidents should close without a judge. Those who attended settle it themselves, by a procedure built to make self-serving accounts easy to spot.
Itemised blind ballots. After an incident each attendee submits a ballot. A ballot is not a proposed split. It is an incident report with fixed questions: it lists every act its author saw — who did it, what it was, when, and a pointer to the footage — and classifies each act as intervention or documentation, with its contribution and any harm or obstruction. Ballots are committed as hashes and revealed together once commitment closes, so no one can copy the majority.
What counts as intervention. An intervention is a deliberate act directed at the threat or at the person in danger, meant to change what happens: restraint or force, shielding, medical aid, a strobe or sound device aimed at an attacker, or a warning backed by the present ability to carry it out. It is classified by its function, not by whether it worked and not by what it risked. A drone that ends an assault with a strobe from twenty metres has done the same service as a guard who steps in, more cheaply and more safely. Presence and recording deter, but they are documentation; so is a warning with nothing behind it.
Figure 15. Intervention or documentation, by function: what an act was meant to change, not whether it worked or what it risked.
Weights. Every attendee’s ballot counts on the facts, weighted by its author’s merit weight. That weight grows with the square root of their personal stake (capped at three times the role’s floor), from a floor of 0.1, with their history of successful work of the relevant kind in that area, and is multiplied by their ballot accuracy (Section 10). Whether the outcome was achieved is decided only by attendees with a history of intervening. History weighs ballots; this incident alone decides pay.
Figure 16. Merit weight. Stake with sharply diminishing returns, times history, times accuracy. It weighs ballots; it never sets pay.
Pay. The bounty is split into an intervener pool and a documentation pool, 70/30 by default and configurable by the caller. Within the intervener pool, the key act — the one that most changed the course of the threat — weighs 2, each other act that contributed weighs 1, and an act that added nothing weighs 0. A bond’s weight is that of its best act, never the sum of everything its people or machines did, so fielding more drones does not buy a larger share. A genuine attempt that failed keeps its weight. The documentation pool is split equally among the bonds that documented without intervening. An attendee who did neither receives nothing. The outcome reward is one pot, paid only if the outcome was achieved, and then split in the same proportions as the bounty.
Figure 17. The payout split. Acts become pools and weights, then exact shares, then buckets; the reward, if earned, follows the same split.
Figure 18. A bond counts its best act, never the sum of its people or machines.
Closing. An attendee’s classification and contribution stand when 80% of ballot weight agrees on them. Then the case closes in one of three ways:
A signer who does not sign cannot block settlement. If a ballot flags a signer as injured, closing waits up to seven days for that signer’s ballot. If the caller’s key stays silent and the footage shows the caller incapacitated or dead, the classification goes to a panel of three arbitrators instead of closing on the attendees’ ballots. A vote that does not reach 80% escalates automatically.
Figure 19. Settlement by agreement. Ballots are committed blind and revealed together; an 80% agreement closes the case unless a bonded party escalates.
Figure 20. When a case closes. Usually 48 hours after the vote; later if a signer is injured; by a panel if the caller is silent and the footage shows them down.
Who decides what. Attendees settle pay among themselves. They may flag misconduct or caller misuse in their ballots, but they cannot decide it, because they gain from it: a seized deposit is paid to them, and a colleague’s zeroed share is redistributed to them. Every finding of misuse or misconduct is made by an arbitration panel.
Arbitration is where the protocol has to judge, and it is the part that completes the removal of trust: once judgment itself cannot be bought, captured or bent, nothing depends on anyone’s good character. A verdict is credible because it is anchored to a fixed standard, reduced to questions of fact, made by people who lose money for departing from that standard, and open to re-examination for as long as anyone is willing to pay to look again.
The standard is the non-aggression principle: no one may initiate force against another person or their property. It is not chosen by vote, which would make it a preference anyone could capture; its justification is set out in the Foundations document. It suits a protocol because it is physical — the crossing of the boundary of a person or their property is something a camera can show — and directional: it separates who started the force from who answered it.
The protocol applies it through a canon: a fixed library of at least 100 reference cases at launch — real police calls and civilian arrests, and written scenarios — showing appropriate and inappropriate conduct in both directions, each annotated with the answers to the checklist questions below. The canon cannot be amended. It changes only by fork, because a standard that a majority could edit would drift toward rules that no longer protect victims. Offences without a victim are excluded: there is no aggressor to annotate.
Distilled, the canon says one thing: stop real aggression, and nothing else. Force against an active aggressor is not rationed; it may be whatever overcomes him for as long as he remains a threat. It must hit the threat and spare the innocent, serve protection or recovery rather than punishment, and end when the threat is actually suppressed. No one is held beyond the template’s endpoint, and no one is treated cruelly once captured. What can be shown decides; what cannot be shown punishes no one and pays no one.
The canon judges conduct inside the protocol; it grants no immunity outside it. Local law stays whatever it is, and the protocol neither asks its permission nor waits for it. Private operators have always found ways to serve demand under rules that seemed to leave no room — Spain’s desokupa firms built a business recovering occupied homes where the courts would take years — and responders do the same: they choose the methods that work where they stand, and price whatever risk remains into the offers they accept. Insurers can sell legal-defence cover alongside. The distance between the canon and local law becomes a price, not a wall.
Arbitrators do not pick outcomes. They answer narrow questions of fact, and the outcome follows mechanically from the answers, down to the penalty tier — the common law’s special verdict, applied to footage. Every answer is True, False, Uncertain or Not captured. What no source captured cannot be found true: an unproven answer takes the default the checklist names, which always falls against whoever needs the fact. A claimant must have their presence and action captured; an accuser must have the misconduct captured. The panel writes one shared incident record — the acts, their timeline, their causal links, each marked observed, inferred or unresolved — and every party’s verdict is read from it, so separate verdicts cannot tell separate stories. Perception is judged as it was available to the person at that moment, not with the hindsight of the full record.
Figure 21. What cannot be shown. Uncertain and not captured both leave a fact unproven, and the default falls against whoever needs it.
The checklists cover each recurring dispute. The most consequential is the use of force. Each use of force is an episode, judged on its own, and two rules protect those who take the risk: when footage leaves a question open, the answer clears the responder, and a predicate is found against them only when the footage makes the excess obvious. The questions, per episode, are whether there was a threat observable to the responder (a caller’s say-so is not enough), whether the force had a protective purpose, whether it was aimed at whoever appeared to be the threat, whether it stopped when the threat was actually suppressed, whether any detention ended when the person was safe or at handover to the authorities and never past the endpoint, whether force in recovering property went beyond overcoming resistance, and whether bystanders were put at obvious, avoidable risk. The tier is read from a fixed table, the highest any failed question reaches:
Figure 22. One use of force, episode by episode. Against an active threat force is not rationed; once the threat is suppressed it must stop, and no one is held past need or past the endpoint.
| Failed question | No or minor injury | Serious or fatal injury |
|---|---|---|
| Force continued after the threat was suppressed | Lapse | Misconduct |
| Force beyond overcoming resistance in recovering property | Lapse | Misconduct |
| Bystanders put at obvious, avoidable risk | Lapse; misconduct if a bystander was hurt | Misconduct |
| Detention beyond need, or beyond the endpoint | Misconduct | Misconduct |
| Force with no protective purpose | Misconduct | Bannable |
| Force with no threat observable to the responder | Misconduct | Bannable |
| Force aimed at someone clearly no threat | Bannable | Bannable |
A lapse loses that case’s pay and 25% of the bond, doubling with recurrence. Misconduct takes the whole bond. Bannable conduct takes the whole bond and excludes the identity for good. In short: excess against an aggressor in the heat of a fight costs a margin; holding someone past need, or hurting them for no purpose, costs the bond; harm to someone who was clearly no threat costs everything.
Figure 23. Lapses compound. Each lapse raises a score that decays with every incident; the forfeit steps from 25% to 50% to 100%.
Other checklists cover false alerts and staged incidents, false claims of presence or credit (fraud, at the bannable tier), and harm between responders on a shared scene. In the last, urgency decides whether an announcement on the scene channel was owed, though never whether the line of fire was: a fellow responder is owed the care any bystander is. The forfeiture is set by the harm done and by the fault — negligence, ignoring a hold, or sabotage. Harm between parties to a case is repaired first: the harmed party is paid from the seizure before anyone else. That payment is a directional signal, not an assessment of damages. The party at fault loses and the party harmed gains, in days, from money already locked. Every legal claim remains with the courts of the place.
Figure 24. Harm between responders. Fault and harm set the share of the acting responder’s exposure seized, and the harmed responder is repaid from it first.
The payout follows from the answers in a fixed order, so that every node derives the same one:
Redistribution within the pool is deliberate. Teams tend to cover for a colleague who misbehaves. Here the colleagues gain from a finding, so they have a reason to report one, and because they gain, they may report it but not decide it.
Who may sit. An arbitrator posts a bond of at least 0.1 BTC. For any given case, an arbitrator is eligible only if their own bond is at least twice everything the verdict can move — the same factor responders carry — so a corrupted verdict puts at least four times its value at risk. At least two thirds of every panel must be labor-qualified — at least 80% agreement with final rulings and canon answers over at least ten cases. A party may demand stricter arbitrators — higher agreement, larger bonds, fewer unqualified seats — but never laxer ones.
Blind taking. Panels form by taking, not by selection. Eligible arbitrators take seats seeing only the fee, the tier, the case value and the filters. They learn the parties, the place and the evidence only after committing. When more take than there are seats, a Bitcoin block hash mined afterwards draws them. Arbitrators are pseudonymous keys reached over Tor, so there is no list of judges to bribe or threaten. Votes are committed as hashes and revealed together.
Figure 25. Blind taking. Takers see only the fee, tier, value and filters; the block hash picks among them; the case is revealed only after the seats are committed.
Penalties. Arbitrators are paid for agreeing with the final ruling and lose substantially more for disagreeing with it. A vote against the final ruling costs two to four times the case fee, more the more isolated it was, deducted from the bond. Errors that recur close together compound: each adds to a momentum score D that decays by 1% per case and is measured against the pool’s normal error rate, so honest disagreement on hard cases does not accumulate, and the penalty is multiplied by 2^D, up to 32×. A scattered honest mistake costs little; a pattern becomes ruinous, and at D ≥ 3 the arbitrator’s recent cases are reviewed automatically. Coherence is measured against the canon and the final ruling, never against the panel an arbitrator happened to sit on, so a panel that drifts together is still measured against the canon.
Figure 26. Penalties grow with a pattern. The same three errors cost little when scattered and compound when clustered, and a high enough score sends recent cases to review.
Re-rolls. A party who disputes a verdict pays to re-roll it to a larger panel — 3, then 7, 15, 31 arbitrators and doubling, with no final tier — each deciding by the same two-thirds supermajority and each formed by blind taking. Each re-roll costs more but draws from more of the pool, diluting any captured subset. Penalties settle only against the final ruling. A dissenter vindicated by a larger tier is refunded, paid the fee they would have earned, and takes half the penalties the wrong majority now pays. A dissenter who cannot wait for a party to appeal may post a challenge bond of three times the fee to send the case up at their own risk.
Figure 27. Vindication. A lone dissenter proven right by a larger panel is refunded, paid, and takes half of what the wrong majority now pays.
Review. Every closed case, disputed or not, may be drawn for independent review with a probability that rises with its value: 5% up to 0.01 BTC, 10% up to 0.1 BTC, 20% up to 1 BTC and 40% above, and at least 40% for any case a split panel decided, since bought verdicts are almost always split. Whoever puts money from outside the parties into a payout — an insurer’s layer, liability cover, a sponsor — is itself a party: it can escalate at its own expense and is repaid first from what a confirmed fraud seizes. And any bonded arbitrator may flag any closed case, staking a bond it loses if the case is clean and earning a premium if fraud is confirmed. The draw is seeded by a block hash mined after the case closes, so no one can predict which cases will be looked at. A case is flagged when 40% of its later reviewers dissent; a staged review — a panel of 30, whose finding must be confirmed by a second and a third panel of 30 — can then overturn it, each at an 80% supermajority, even after settlement. A clean review stops at the first 30; no punishment rests on fewer than 90 reviewers. The party harmed by an overturned verdict is repaid first from the bonds of the arbitrators who voted for it — which, since each bond is at least twice the case value, cover it. Reviewers earn a fixed premium of three times the fee only when a review confirms misconduct, never a share of what is seized, so a captured review majority gains nothing by inventing fraud. A confirmed fraud reopens every recent case of the identities involved, and the cases around it are left to open flagging: any bonded arbitrator may flag any closed case on a stake and earns the same premium if fraud is confirmed.
Figure 28. A disputed verdict can be re-rolled to ever larger panels for as long as a party pays; every closed case can also be drawn for review.
Figure 29. Where seized money goes. The harmed party is repaid first; no one who ruled takes a share of what was seized.
Fees. Whoever asks for a ruling pays for it: the escalating party pays each drawn arbitrator directly before the panel deliberates, and recovers the fee only from what the ruling seizes from the other side. A member who takes the fee and does not rule forfeits enough of its bond to refund the payer. If no one pays, no panel sits and the refund settles the case. The arbitration fee rises 12.5% with every case closed while a queue remains, falls 12.5% with every case closed that empties it, and rises another 6.25% every 18 blocks while the queue persists. An attacker who floods the queue therefore pays compounding costs, while the rising yield draws in honest arbitrators. Emergency response never waits on arbitration: dispatch, evidence and payment by agreement run outside it. The fee is recovered only from what the ruling seizes, so an objection that only delays a settlement the panel confirms costs the objector the fees it paid.
Figure 30. The fee market. Unbroken queues make every case dearer until arbitrators are drawn in and the queue clears; then the fee falls.
The pool is closed. Capital alone cannot buy a seat, because no seat is for sale. A slot opens only on turnover — an exit, an ejection for inactivity, a forfeiture — or when the queue has stayed non-empty for 432 consecutive blocks (about 72 hours) after every case that cannot pay the current fee has been removed. Even then, only one slot opens.
Entry is by competition. Each applicant pays a non-refundable participation fee to the archivists who serve the evidence and locks a refundable intention bond. They then answer an exam of 15 cases drawn for them from a block hash: 10 live cases, on which they cast blind shadow votes scored against the final ruling, and 5 canon cases scored against the canon’s answers. Nobody can study for a live case that nobody has decided yet; studying the canon is the point. The highest score wins. An applicant who outscores honest applicants on cases nobody has decided has, in practice, become an honest arbitrator. The winner serves a 30-case probation, occupying at most a third of any panel; a probationer who dissents from an old verdict sends it to review, earning a strike for each flag the review clears and losing one for each fraud it confirms.
Figure 31. Entering the arbitrator pool. A seat opens, applicants sit an exam of live and canon cases, the best wins, serves probation, and qualifies by agreement over time.
At launch there is no history to qualify anyone. The pool is seeded by a cohort of about fifty arbitrators selected for alignment with the canon, each of whom must still score at least 97% per question on ten canon cases. The network opens for cases once 31 have qualified. Like the canon, the cohort is part of the protocol’s trusted setup, and it is the part that the rest of the mechanism then tests continually.
Some key must say which pre-signed outcome a case reached. Bitaid makes that key a threshold key held by the arbitrator pool itself: a FROST key [12] in which any ⌊n/2⌋ + 1 of the n arbitrators who have completed probation and seasoning can sign, and no smaller group can.
Each member signs only after replaying the anchored log and confirming that the outcome follows from the recorded votes and roster, and that the case’s payout set matches the caller’s template. The oracle attests once per pot, after the last re-roll window has closed — three answers released together from one replay of the log, so the reward’s split always matches the bounty’s — each under a nonce generated for that pot of that case alone. Using a Schnorr nonce for two messages would reveal the key, so nonces are generated jointly in advance, in batches large enough that a surge of cases never waits for one, and each is spent exactly once. Membership changes at fixed epochs, and the key is reshared at each to the incoming members while the public key stays the same. Absent members do not stall a case once a threshold has responded.
The oracle’s power is bounded. It holds no funds and can move none alone: its key sits only beside another party’s key, in funding and bond outputs, and in no incident output. It chooses which pre-signed payout becomes valid; it cannot make a new one. A captured majority could push wrong outcomes case by case, but every attestation can be checked against the anchored record, and a wrong one is visible to everyone. Each member releases its share in public, checkable against its own key, so while honest members still hold a threshold, a member who attests a wrong outcome has signed evidence against itself and loses its bond. A captured majority can combine its shares in private; then the remedy is a fork with a fresh key. That is why the cost of capturing a majority of the pool (Section 11) is the protocol’s central defence, as the cost of a majority of hash power is Bitcoin’s. If the oracle disappears, nothing is trapped: the refund pays after 90 days and bonds return to their owners after 365. Members come and go, and resharing alone cannot stop people who once held shares from pooling them later, so the pool’s key is regenerated about once a year; outputs move to the new key when their owners renew them. Even a leaked key moves nothing by itself, since every output it guards also needs its owner’s key.
Figure 32. The oracle’s bounded power. A threshold of members completes exactly one of the pre-signed payouts; no one can complete a payout that was never signed.
This is the least finished part of the design, and it is presented as such. Threshold signing among hundreds of changing members, resharing as they come and go, and the per-case nonce protocol are built from published constructions, and they have been tested on Bitcoin and Liquid test networks and simulated with up to 301 members, but not yet run at that scale on a live network or reviewed by cryptographers. The Specification lists them as open, together with the test they must pass: implemented on testnet and exercised adversarially, every path terminating, no funds trapped, no unilateral spend. If they cannot pass it, the fallback is a federation of named arbitrators holding a multisig — simpler to audit, easier to coerce.
A caller who wants to offer more than they hold, or a responder who wants to clear a higher acceptance gate, can be backed by an insurer. The insurer pledges buffers — fully reserved Bitcoin outputs — behind its clients’ own funds. A buffer never replaces the personal floor: every participant stakes the floor from their own capital, and the protocol strips buffers out before computing any weight. Buffers carry credibility in the market, not in the protocol.
One layer, many clients. A buffer is not a deposit held for one person. One layer can be pledged behind the offers of many clients at once, because their emergencies rarely happen together. A layer of 0.05 BTC behind a hundred clients, each offering 0.005 BTC, backs ten times its own value. At a yearly incident rate of 1% per client it expects about one claim a year, and the insurer prices the layer by that expectation, not by the face value it backs. That multiplier is the insurer’s business: capital that would back one person as a deposit backs a whole neighbourhood as a pooled risk. Nothing is created out of thin air — every satoshi a client can claim sits in a real, unspent output — but the same output is promised to many, and the promise is sound only as far as claims stay apart. Each buffer’s encumbrance — how many escrows it currently backs, and in which broad regions — is public, so no one counts the same layer at full value twice, and a layer whose clients all live in one neighbourhood, where a single riot or flood strikes them together, is seen for what it is. A misconduct finding against one client of a shared first layer takes only that client’s counted part of it; the rest keeps covering the others.
Layers smooth the actuarial leverage. When an incident draws on a shared layer, the layer is locked in that incident’s escrow until it settles, and whatever was not paid out returns to it afterwards. A second incident among the same clients in the meantime falls to the next layer, and a third to the one after. The stack is how the actuarial leverage of one layer is made safe: the first layer carries the expected claims, and each layer above it carries the ever rarer case of more claims arriving together. Depth is therefore the measure of how many coinciding emergencies a pool of clients can absorb, and it is visible to every caller and responder deciding whether to rely on it. The layers may belong to one insurer or to several, each pricing its own position, as reinsurers price theirs.
Figure 33. One layer backs many clients. An incident locks the first layer until settlement; an incident in the meantime falls to the next. Forfeiture for misconduct reaches only the client’s own bond and the first layer.
Cheap premiums, loud prices. Actuarial leverage — pooling risks that rarely strike together, as every insurer does — is what lets protection be priced loudly without being paid for in full. A client whose premium is small can carry an outcome reward many times their savings — for the safety of a child, or of a home — because the insurer pays it only in the rare event and prices it by that rarity. Every alert from such a client draws the best-equipped responders within minutes. The same prices work before any alert: like an alarm company’s sign on a gate, cover that attackers know or suspect is there tells them that this target summons a well-paid crowd, and every attack deterred is a claim never paid. So the insurer is paid to shrink its own exposure: it gains by lowering the incidence of what it covers — funding faster responders nearby, cameras, the hardening of its clients’ homes — wherever that costs less than the claims it saves. A security firm for hire sells hours of guarding whether anything happens or not. An insurer here sells a price that is paid only when something does, and profits only by making it happen less.
The arithmetic, and its brake. Three layers, each the size of one offer, staked behind a thousand clients absorb three emergencies at once, and each client’s yearly premium needs to be only about a three-hundredth of its offer for as long as full payouts stay rarer than one per four hundred clients a year; the premium scales with the offer at the same claim rate. Larger offers need larger stakes on the other side, though. A lone responder must stake twice what it could capture, so an offer of 2 BTC asks 4 BTC of stake per signing responder, its own bond and its insurer’s first layer together. Responders’ insurers pool those stakes the same way, and sliced pots spread a large offer across more seats, but the largest offers will draw well-capitalised teams rather than passers-by, and will be contested harder; their premiums rise somewhat faster than the offer.
Where the cover sits. An insurer places most of the cover it writes in the outcome reward, which pays only once the attendees or a panel confirm a genuine incident and an achieved outcome. A client’s false alarm made in good faith then costs the insurer only the bounty, which pays for the responders’ trip; a troll’s forfeit reaches the first layer, the insurer’s vouching for its client, and never the deeper layers. So the large sums are exposed to the event they insure — a real emergency that ends well — and not to a client’s nerves, while the bounty is kept modest and priced from each client’s record, like any claims history. What remains is fraud by a staged “success”, which costs every colluder its bond at the bannable tier and repays the insurer first. The bounty should still be sized to honest effort: it is what pays responders who come and fail, and too small a bounty leaves the hard cases unanswered.
Draws and forfeitures. The stack responds differently to two different events. Paying an offer the client could not fund is a draw: the policy executing as written, consumed through the layers in order, with no penalty. A finding of misuse or misconduct is a forfeiture, and it reaches only the first layer. Deeper layers are ring-fenced from it entirely: the first layer is the insurer vouching for its client’s conduct, and seizing deeper layers would add no deterrence while making it unsafe to offer stacked cover at all.
The first-layer insurer is the one underwriting its clients’ conduct, and its record shows it: nodes compute each insurer’s clean ratio — the share of identities it backed that were never forfeited — and an insurer whose clients misbehave sees its business degrade in real time. Fees and minor fines are drawn from the first layer before the personal bond; the gravest findings drain both. An insurer may also publish a schedule of cover for harm its client causes to other parties on a scene, paid as a draw.
A new market. This is underwriting with no custodian and no balance sheet to trust. Any Bitcoin holder can become an insurer by pledging a layer; its exposure is public, its reserve can be checked on-chain at any moment, and its returns come from pricing emergencies better than the next layer up. The insurer is also paid to prevent what it would otherwise pay for: an insurer whose own guards answer its own client’s alert collects the bounty and reward from that client’s escrow, and the intervention lowers the claim it insures. The economics of that flywheel are set out in the Foundations document.
The protocol has no proof of work and no stake that earns yield. Its resistance to fake identities comes from requiring three things at once, each priced in a different scarce resource.
Bond. Every identity in every role posts refundable collateral. The floors are 5,000 satoshis for a caller, deflating 20% a year to stay accessible; 0.01 BTC for a responder; 0.1 BTC for an arbitrator; and 0.005 BTC for an archivist, scaling with storage capacity. Above the floors, stake above exposure sets each operator’s real minimum. Bonds leave only after a 90-day hold, during which they remain exposed to any review.
Figure 34. Floors over time. The caller floor deflates to stay roughly flat in cash; the service floors stay fixed in bitcoin, and rise in cash as it appreciates.
Labor. Paid work actually done sets how much a participant’s word counts: the weight of a responder’s ballot, and whether an arbitrator may sit. Each case is recorded in the cell where the alert was raised, for every attendee. When labor is weighed, it is summed over that cell and its six neighbours — the area the alert reaches (Figure 7) — and work from farther away carries no weight. A history manufactured in an empty cell is worth nothing in a busy one. Labor is discounted by seasoning: labor × min(1, days / 90). Ninety days cannot be bought or compressed. Responders accumulate two kinds of labor: intervention, counted only from cases whose outcome was achieved, and documentation. Both are measured in bounty earned, in units of the typical local case, and neither is capped: proven local expertise settles routine cases, which keeps arbitration rarer and cheaper for the cases that need it. Tips and outside rewards never count. Labor is earned and permanent, and it is recorded on the public log against a pseudonym rather than against payment addresses.
Figure 35. Cell-scoped labor. Work counts where it was done: fully inside the alert’s ring of cells, not at all a few cells away.
Coherence. An arbitrator’s coherence is agreement with the canon and with final rulings. Responders are scored too, but for something different: ballot accuracy — how often their ballots agreed with the final ruling on cases decided independently of the ballots, by escalation or by review. Cases closed by agreement do not count, or a majority would only confirm itself. Accuracy starts at a neutral 1 until five ballots have been tested, and multiplies ballot weight. It is an epistemic test, not a moral one, and it carries no fine: a responder whose accounts prove wrong loses influence over future splits, and one whose lone dissent is vindicated gains it. Arbitrators answer for both the facts and the judgment; responders answer for the facts they reported.
Figure 36. Ballot accuracy. Only ballots on cases ruled independently are tested; until five are, the multiplier stays at one.
Why all three. A bond without labor can be overwhelmed by capital. Labor without a bond has nothing to forfeit. Bond and labor together say nothing about whether a judge is any good, or stays good. Together the three make a barrier of the same shape as proof of work — a cost paid in advance, in time and exposure, that money alone cannot bypass — but built from conjunctive requirements rather than burnt energy. Detection is part of the primitive, not an outside assumption: responders are paid to record, which makes them adversarial witnesses of each other; every case can be reviewed later; evidence cannot be changed after the fact; and coherence history is never windowed. In short, the three legs give credibility without trust between strangers who meet once.
Figure 37. The barrier is conjunctive. Money buys the bond; time, place, judgment and exposure must be paid in their own currencies, all at once.
False alerts. A false alert costs the caller the whole offer — deposit, bounty and reward — paid to the responders it wasted, once a panel confirms it. Responders who find no incident can fast-track the case to a three-arbitrator panel within 24 blocks, and other cases with the same pattern are flagged for review. A caller with a good-faith basis for alarm who turns out to be wrong loses nothing; the bounty is paid and the reward withheld.
Figure 38. How an alert can end. Being wrong in good faith costs nothing; a troll forfeits the whole offer; staging costs every bond involved.
Fake identities. Every identity needs its own bond, its own 90 days and its own cell history. Influence over a scene requires work in that scene’s cells; influence over a verdict requires a seat that capital cannot buy. Labor does not transfer between roles: a long history as a responder confers nothing as an arbitrator.
Fabricated cases. An attacker who controls a caller, responders and some arbitrators can stage an incident. Each staged case is permanent, hash-anchored evidence, and must agree across every independent camera whose hashes were public before anyone could coordinate. A single fake might never be drawn for review. But a single fake earns little: fraud that pays has to be repeated, and every repetition is another draw that no one can predict. At the lowest review rate, one case in twenty, a fraudster is more likely than not to be drawn somewhere among fifteen staged cases, and drawn more than nine times in ten within fifty (Figure 39). The cases are not independent bets, either. When one is caught, every colluder loses its bond at the bannable tier, every recent case of the identities involved is reopened, and every other closed case in the cells where they worked is open to flagging by arbitrators hunting for the review premium, so their accomplices in the same area are examined too (Figure 40). A fraudulent history is a chain that unravels from whichever link is pulled first. And a ring that stages among its own members only moves its own money: staging pays only where money from outside the ring reaches the payout, and whoever put that money in is a party with every reason to check. An insurer that escalates about one draw in three makes staging against it a loss at the default 2× stake, since an escalated case pays the ring nothing and costs it every stake, and it pays for that checking itself. Once a ring is caught, arbitrators hunting the archive for the cases around it, at their own risk and for a premium, do the rest.
Figure 39. Chance that at least one case of a fraudulent history is drawn for review, by the review rate that applies to its case value.
Figure 40. Review cascade. One drawn and confirmed case reopens the rest of its authors’ cases and invites flagging of their neighbours’ cases.
Per-case deterrence. A cheat caught within the case is never paid and loses its stake; one caught by a later review keeps what it was paid and still loses its stake. Either way, cheating loses money in expectation once the chance of being caught passes a threshold set by the ratio of gain to stake: gain ÷ (gain + stake) within the case, gain ÷ stake after it. These are worst cases. A responder’s stake is sized against the whole offer, so one third and one half apply only to a lone responder cheating for all of it at the minimum stake of twice the offer. A cheat who can only shift part of a split risks the same stake for a fraction of the gain: inflating one’s share from a fifth of an offer to two fifths gains a fifth of it against a stake of twice the whole, and puts the threshold near one in ten. The minimum is also only a floor: the stakes the market demands — callers and insurers of responders, case values of arbitrators — are higher, and every increase lowers both thresholds further. Disputed cases are always examined, and parties on the scene are paid to dispute.
Figure 41. When cheating stops paying, in the worst case: a lone responder cheating for the whole offer, at the minimum stake of twice it. Caught within the case, it loses in expectation beyond one third; caught by a later review, beyond one half. Cheating for only part of a split, or a higher stake, tilts both lines further down.
Capturing arbitration. A captured majority of the pool is the real risk, as 51% of hash power is Bitcoin’s. The penalty cannot by itself tell an honest majority from a captured one; what protects the protocol is what it takes to build one, and that is not a sum money and patience can pay. Seats open only on turnover or one per sustained 72-hour queue signal, so forcing k seats by queue pressure takes at least k such windows whatever the budget — more than 300 days for 101 seats of a 200-seat pool, before probation begins. Queue pressure counts only from cases attended by seasoned, bonded responders, so generating it requires a pipeline of fake responders working in real cells under honest observation. Every seat is won against honest applicants on live cases nobody has decided. Two thirds of every panel must be labor-qualified. Every closed case can be reopened, and a seat opened by queue pressure is voided if any case behind that pressure is later found fabricated, even if the seat’s winner has ruled well, so manufactured demand buys nothing that lasts; and every such seat stays provisional until three rounds of 30 of its window’s cases have been reviewed clean. And while the queue is kept full, the fee compounds: the 18-block trigger alone multiplies it about 4.3× in 72 hours and about 790,000× in four weeks, every satoshi of it paid to the honest arbitrators the attacker is trying to outvote. Like a majority of hash power, it means holding many independent things at once — seats, cells, seasoned responders, live judgments, exposure to review — each priced in its own scarce resource; a state faces the same barrier as anyone else, and a captured majority that acts does so in public and is answered by a fork.
Figure 42. Capturing the pool takes time money cannot buy: one seat per sustained queue window, then probation.
Corrupting a single panel. Corrupting a verdict needs two of three seats, each staked at twice the case value, so it risks at least four times what it can move; it loses money wherever review is more likely than one in four, even if the briber’s payment is kept, and split verdicts are reviewed at least 40% of the time. Seats are taken blind and drawn by block hash. The losing party can re-roll to ever larger panels, and any honest arbitrator on a captured panel is paid to expose it through the challenge bond.
Suppressing evidence. Section 5 lists what must be compromised at once. Hashes gossiped before upload and roots anchored on Bitcoin mean that even total destruction of a recording leaves proof that it existed and what its hash was.
Coercion. The protocol keeps no server to raid and no database to subpoena. Arbitrators are pseudonymous keys over Tor, so a state wishing to coerce them must first correlate keys to people at scale, a cost that adds to, rather than replaces, the cost of the seats. What the protocol cannot do is protect a person from physical coercion of the person. A responder who is identified can be arrested; a key that is seized can be used. These are limits, stated plainly.
No identity is required. Every participant is a key; there is no registration database, no phone number and no email. Alerts and gossip travel over Tor, and evidence over I2P [13] or an equivalent transport with no exit nodes. An alert reveals only its cell until a responder accepts; precise location goes only to those who accepted. A caller’s identity is held encrypted on their own device and disclosed only by a transaction they sign. Responders are paid at a fresh address for each case, derived from their identity, so outsiders cannot link their earnings, while the responder can prove each payout is theirs.
Figure 43. What is revealed, and when. The cell before acceptance, the exact point only to those who accepted, and the caller’s identity never.
Responders bear more exposure than callers, because physical presence is the one layer cryptography cannot hide. A responder who accepts many alerts in one place builds a pattern that could be correlated with cameras or phone records. They can manage this as journalists manage source protection — dedicated devices, several pseudonyms, more than one area of operation — but the protocol does not pretend to remove it.
Most stakes live on Liquid [14], whose one-minute blocks and steady fees speed settlement; larger stakes may live on Bitcoin itself, where no federation is involved. The same outputs, keys and payouts are used on both chains. Escrow amounts are explicit on both: the protocol publishes offers and stakes anyway, so that anyone can check the acceptance gates, and hiding them would multiply the signing exchange many times over.
The protocol’s state — bonds, cases, verdicts, labor, pool membership — is computed by replaying a log of signed events, and every honest node that replays the same log reaches the same state. The protocol needs no blockchain of its own because it borrows Bitcoin’s [15].
What is on-chain. Three kinds of event are committed to a chain: transactions themselves (bonds, escrows, payouts, forfeitures, refunds); a commitment per panel tier to its roster and its answers, revealed only when review needs them, so the chain does not publish an answer key; and the Merkle root of each incident’s evidence. Everything else lives off-chain and is verified against these commitments.
Ordering. Where money moved, the chain decides: of two conflicting spends, the confirmed one is the fact. Off-chain events are ordered by the Bitcoin block height they reference, and are accepted only if that height is within two blocks of the receiver’s own, so no one can backdate an event to win a conflict. At the same height, events apply in dependency order: what ends or invalidates something — a withdrawal, an exit, a forfeiture — first, then what starts something, then what relies on it, and ties are broken by hash. A withdrawal and an alert in the same block therefore resolve the safe way: the alert shows as unbacked.
Figure 44. Ordering events against Bitcoin. Each off-chain event cites a block height; at the same height, events that end something come first; checkpoints close each six-block window.
Checkpoints. Agreeing on which events exist is the other half of the problem, since an event could be released late or only to some nodes. Every six blocks the oracle anchors the Merkle root of all events it has seen; events arriving after a checkpoint closes are rejected. A participant whose event was left out can anchor its hash themselves, and the next checkpoint must include it, so omission is provable rather than silent. In testing, 2,000 random event sets each replayed in five different arrival orders produced identical state every time.
The result is a public, auditable record of who did what work, judged how, and paid what — a ledger of demonstrated human coordination, secured by Bitcoin’s own consensus, with no separate token and no separate consensus.
We have proposed a protocol for emergency response that relies on no trusted party. Strangers find each other through geofenced alerts priced by the person in danger. Every payment is signed before anyone has a reason to dispute it, so settlement needs only a choice among signed outcomes. That choice is made by the people who were there, through blind itemised reports, or, when they disagree, by a closed pool of pseudonymous arbitrators. The arbitrators answer factual questions against a fixed canon under the non-aggression principle, are paid for agreeing with the final ruling, lose more for departing from it, and can be overruled by larger panels and by review for as long as anyone pays to look again. Evidence is hashed before upload and anchored to Bitcoin, so it cannot be quietly changed. Every operator stakes more than it can gain, and influence comes only from paid work, seasoned over time, in the places where it was done.
None of this depends on any participant’s character, and none of it asks the state for permission. What is enforced by script holds if the scripts are correct, and the escrow scripts have been tested against an unmodified Bitcoin node, including the attacks they must refuse (Specification, Appendix B.9); what is argued about incentives is for deployment to confirm or refute; and what remains open in the engineering is listed in the Specification rather than assumed away. It does not replace public safety institutions. It works in the gap they leave — the minutes between a crime and anyone’s answer to it — faster where policing works and essential where it does not, as an opt-in for whoever wants it.
[1] AP / ABC News, “UK police who arrested teenage stabbing victim as he lay dying face misconduct probe,” 2026; NPR, “Fatal stabbing case rocks Britain after police video emerges,” June 3, 2026.
[2] The Times, freedom-of-information data from 37 police forces for 2023, reported April 2025; summarised by the Free Speech Union, “Police make 30 arrests a day for offensive online messages,” April 6, 2025. Arrests under section 127 of the Communications Act 2003 and section 1 of the Malicious Communications Act 1988; arrests are not charges or convictions.
[3] A. Jay, Independent Inquiry into Child Sexual Exploitation in Rotherham 1997–2013, 2014, Executive Summary and §5.9.
[4] T. Crowther, Independent Inquiry into Telford Child Sexual Exploitation, July 2022.
[5] L. Casey, National Audit on Group-based Child Sexual Exploitation and Abuse, Home Office, June 2025. Borough and national populations: Office for National Statistics, Census 2021.
[6] Decrypt, “France charges 88, including minors, in crypto wrench attack crackdown,” April 27, 2026, reporting the National Organized Crime Prosecutor’s Office (PNACO).
[7] The Local France, “France holds seven after crypto boss kidnapping,” January 25, 2025.
[8] IMI Daily, “French tax official sold cryptocurrency investor data to criminal networks,” 2025. Charges, not a conviction.
[9] J. Nick, T. Ruffing and Y. Seurin, “MuSig2: Simple Two-Round Schnorr Multi-Signatures,” 2020.
[10] T. Dryja, “Discreet Log Contracts,” 2017.
[11] Uber Technologies, “H3: Hexagonal Hierarchical Spatial Index,” 2018.
[12] C. Komlo and I. Goldberg, “FROST: Flexible Round-Optimized Schnorr Threshold Signatures,” 2020.
[13] The I2P Project, “I2P: The Invisible Internet Project.”
[14] Blockstream, “Strong Federations: An Interoperable Blockchain Solution to Centralized Third-Party Risks,” 2018.
[15] S. Nakamoto, “Bitcoin: A Peer-to-Peer Electronic Cash System,” 2008.