OBSCURA for police, fire and defence
Most of this site assumes a desk. A growing part of it assumes a road at two in the morning, with no signal, no account and nobody to ask. This is what that part is, what it is not, and the answers your information assurance review is going to want.
The gap is not a missing feature
At an incident there are two kinds of tool. There is paper — a card in a pocket, an aide memoire in the other vehicle, a notebook — which works everywhere and counts nothing, adds nothing up, and cannot tell you that a casualty has not been looked at for fifty minutes. And there is a system, which counts and adds up beautifully, and needs a signal, an account, a device on the estate, and a data processing agreement signed eighteen months ago.
What is missing is the thing in between: arithmetic and bookkeeping that runs with nothing behind it. A page that has already loaded is a computer, and it does not care whether the mast is up.
That is the whole design here. Every tool on this site runs inside the browser tab. Nothing is uploaded, because there is nowhere to upload it to. Which means the awkward property — no server — is the same property that makes it work in a basement.
What is here for this work
At the scene
Built for the first hour, when the bookkeeping is what fails rather than the judgement.
- NINELINE — nine-line MEDEVAC, UXO, METHANE, SALUTE, MIST and a contact report, with the codes beside the line and the words as they are spoken
- TRIAGE — the sieve or START, a live count for the casualty message, and a re-check clock on every casualty
- CORDON — published stand-off distances, the real perimeter and post count, eight positions to send units to, and who held them
- SIGNAL — radio horizon, fade margin, Fresnel clearance, and a PACE card that insists on a trigger
- BEARING — coordinates between every format, UTM and MGRS, distance and bearing on the ellipsoid
- SNAP — a photograph that carries its own hash, time and place, sealed as it is taken
Writing it up afterwards
The part that gets done at the end of a shift and read out in a hearing two years later.
- FORCE — a use of force account in the order it is judged in, read back for the four habits that cost writers most
- STATEMENT — a statement sealed with a digest of its own text
- WITNESS — a witness statement built to hold up
- DECISION — a decision log that shows tampering, including the rejected options
- INTERVIEW — plan, run and write up an interview
- MINUTES — minutes with the decisions picked out
The clock
Statutory deadlines, counted with the section beside every figure rather than in somebody’s head.
Building the case
Analysis that can be explained to a jury, rather than a black box that produces a number.
- TIMELINE — a chronology where every entry carries its source
- CASEMAP — who, what, when, and what proves it
- COMMS — a schedule of call data, read without the two errors that do most of the harm
- LINK — an association chart with betweenness, which finds the broker rather than the switchboard
- SKID — collision speeds, given as bands because a single number is the problem
- DIGITS — numbers that were made up
- MATCH — names against a watchlist, on the device
- DOSSIER — a chat export as a numbered transcript
Exhibits, disclosure and continuity
- PROOF — prove a set of files has not changed
- CHAIN — a chain of custody log
- EXHIBIT — exhibits bound into one PDF with Bates numbers
- BUNDLE — a paginated bundle with a linked index
- SCREENS — chat screenshots as a transcript, each its own exhibit
- ARCHIVE — a web page frozen as evidence, with a hash
- PRIVLOG — a privilege log, checked
- REDACTLOG — what was redacted, and why
Before anything leaves the building
The redaction tools here remove data rather than drawing over it, which is the difference between a redaction and a rectangle.
- SEAL — a PDF redacted so it stays redacted
- VEIL — faces and plates blurred out of a photograph
- SCREENSHIELD — the private parts of a screenshot blacked out
- BASTION — an identity document armoured before it is sent
- MEDISCRUB — personal details out of a record
- CLEANROOM — one pass to strip everything before a file goes
- CROWD — a dataset checked before it is released
- RECAST — part of a video blacked out
Looking at what you have been handed
- X-RAY — what a file is hiding
- OPTIC — the text in a photograph or a scan, read on the device
- MACROLENS — the macros in an Office file, without running them
- TAMPER — signs a photograph was edited
- STRATA — every earlier version saved inside a PDF
- DOTS — the tracking dots a printer hid on a page
- HEADERPROOF — whether an email is from who it says
- SIEVE — files sorted into known and unknown
Moving it and keeping it
- CAPSULE — an encrypted file anyone can open in a browser
- STRONGBOX — a password-protected zip, made on the device
- AIRGAP — data moved across a camera, with no network between the two machines
- SHARD — a secret split into pieces, so no one person holds it
- MIRAGE — a decoy workspace if a device is taken
- DEADBOLT — traces cleared on a shared computer
Why nothing leaves the device, and what that buys
A casualty list, an operational photograph, a grid reference and a draft account of a contested incident are four of the most sensitive documents that exist. None of them is uploaded here, because there is no upload. The file is opened from the disk, worked on in memory, and written back to the disk.
That is not a policy anyone promises to keep. It is how the software is built, and it takes a minute to confirm: open any tool, open the network tab, and use it. Nothing goes out.
The practical consequences are the reason this page exists. There is no processor relationship, so there is nothing to negotiate. There are no sub-processors. There is no region to choose, no retention period to set, and no deletion request to make, because nothing of yours was ever held. And there is no availability dependency: a tool that has loaded once keeps working when the connection, or this project, does not.
What this is not
Said plainly, because finding out later is worse than not adopting it:
- It is not accredited. There is no security clearance, no authority to operate, no assurance against any national scheme, and no certification of any kind. If your process requires one, this does not clear it.
- It is not a force system or a command and control system. It does not integrate with a control room, a records management system, a custody system or a dispatch system, and it never sees what they hold.
- It is not a medical device and nothing here makes a clinical decision. TRIAGE runs published algorithms on answers a trained person gives and records what that person decided. The person decides.
- It is not evidence by itself. A hash kept entirely under your own control proves that a record cannot be altered quietly, not that it is true. What makes it worth anything is the seal written down somewhere outside the tool.
- It is not advice. The distances, the algorithms and the message formats here are published ones, reproduced. The person who owns the scene decides, and on anything involving ordnance that is the ordnance officer.
- There is no support contract, no response time, no admin console, no central provisioning and no usage reporting. There is no server to log anything.
The questions an assurance review will ask
Where does the data go?
Nowhere. There is no account, no login, no database and no upload endpoint. Anything you type or open stays in the browser on that device, and is kept in that browser’s own storage if the tool saves state at all. Clearing site data removes it.
Does it work with no connection?
The tools on this page do, once the page has loaded. None of them makes a network call in use. Install it from the install page and the device keeps a copy that opens with nothing behind it, which is the state most of this work happens in.
About fifteen of the heavier tools elsewhere on the site fetch a library the first time they run. Those come from obscuraos.com rather than a third-party CDN, and are kept on the device afterwards.
Can we run it on our own network?
There is no supported on-premises deployment today, and it would be wrong to pretend otherwise. What exists is a static site with no backend, which is the easy half of that problem rather than the whole of it. If an internally hosted copy is a requirement, say so and it can be discussed honestly rather than promised on a page.
What happens to our records if this project stops?
Nothing. They were never here. Everything is written out as ordinary files — text, PDF, CSV — that open in software you already have, and an installed copy keeps working with no connection. That is the mitigation for the real risk in the next answer.
Who are we adopting this from?
A small independent project, not a venture funded company and not a supplier with a framework agreement. That is a genuine risk and it should be weighed rather than waved away. The mitigation is the previous answer.
What does it cost?
Nothing. There is no licence, no per-seat price and no public sector tariff. It behaves identically for everyone because it has no way to know who anyone is. If it earns its keep, chip in.
The honest summary
This is a set of well-made, single-purpose tools that run on a device with nothing behind them, written by somebody who thinks the bookkeeping is what fails and not the judgement. It is not accredited, it is not integrated, and it is not a replacement for a system of record.
It is very good at the hour when none of those are available.
If something here is close to what you need and not quite it, that is worth an email. Most of the tools on this page exist because somebody described an hour of their working life precisely enough to build for.