How a tip travels: give investigators the full picture

The third of seven short articles following a tip through the whole life of a program. The second covered dialogue.

Give investigators the full picture

A tip is sealed on the reporter’s device before it travels. The crime’s location rides inside that same locked envelope, never stored as plain, searchable text. Only the program that can act on the tip can unlock it, unless it is later referred to another program, whose investigators can then read it too.

Before the content becomes readable, the system writes a permanent record: who opened it, when, and why. That record is append-only: entries are never edited or removed.

The crime’s address is mapped only after that audited open, never before. That lookup sends the address to an outside geocoding service, over a server-to-server call the reporter’s own device never touches. The no-disclosure promise covers the reporter, not the address: the crime’s location is exactly what makes the lookup useful to investigators.