Federal facilities run on access logs, badge readers, and clearance levels. The system records that a badge entered. It cannot tell counterintelligence whether the cleared employee was really alone, whether their phone was supposed to be in the lockbox, or whether the same unidentified device was present three times that month at the same SCIF threshold. Digital Tripwire produces the proximity record that makes the badge log defensible.
Federal facilities, military installations, courthouses, and SCIFs operate on access control infrastructure built on assumptions that are increasingly out of date. The badge says a person entered. It does not say whether that person was alone, what device they brought past the personal electronic device (PED) policy, or whether the same unidentified device was present at three separate sensitive thresholds in the same week. The cleared facility's most damaging recent failures — Manning, Snowden, Reality Winner, Teixeira, Vance — all share a single forensic gap: the badge logs and camera footage existed, but the device-level proximity record that would have surfaced the pattern weeks earlier did not.
The same gap appears in non-classified federal contexts. Courthouse evidence rooms, federal building loading docks, IRS records vaults, GSA-managed sensitive workspaces. Every one has cameras, every one has badge access, none has a forensic device-level record that survives examination by an Inspector General, a GAO auditor, or a counterintelligence investigator. Digital Tripwire was built for that gap, on infrastructure the federal evaluator already knows how to evaluate.
Digital Tripwire deploys at controlled-area thresholds, the SCIF perimeter, secure compartmented spaces, courthouse evidence rooms, federal building loading docks, and records vaults. Hub units sit in the facility security office or the IT support area. The deployment is engineered to coexist with existing access control, ICD 705 compliance, TSCM sweeps, and counterintelligence operations.
When a node detects motion or proximity, it scans every Bluetooth and Wi-Fi device within 10 feet and writes the result to a tamper-evident encrypted log. MAC address, signal strength, distance, timestamp. Uploaded over LTE-M cellular, with an optional federal cleared-cloud storage path for facilities that require it. The proximity log cross-references against badge logs, sign-in registers, PED check-in records, and visitor logs. The same unidentified device showing up at three separate sensitive thresholds in a week is a counterintelligence lead, not an unsolved mystery six months later.
Strategic node placement covers the federally regulated, mission-sensitive, and counterintelligence-relevant zones across the facility. Designed in coordination with facility security officers, ISSOs, and the cleared advisor bench. Tap a node to see what it protects — or run the demo and watch an 11:47pm SCIF threshold event get logged.
Inside the threshold frame
The controlled boundary of every Sensitive Compartmented Information Facility. Every entry, every PED lockbox check, every after-hours access gets a device-level record on the non-classified side of the boundary.
PED policy · CI pattern analysis
Inside the vault frame
Classified and controlled unclassified records custody. Access to a sealed file is itself an event worth documenting, and cross-references against FOIA and IG audit queries when the file comes up later.
FOIA custody · classified records
Inside the locker bay
Federal evidentiary chain of custody. Per-locker, not room-level, because "an agent walked past" is not an answer to a Rule 41 chain-of-custody challenge.
Federal evidentiary chain
Inside the dock frame
Supply chain and contractor access. The most porous physical layer in most federal buildings, and the least instrumented. Contractor devices are logged at the point of entry, not weeks later when the parcel goes missing.
Supply chain · contractor access
Inside the counter
Visitor check-in and escort assignment. The register says one visitor was here. The proximity log shows whether they were actually escorted the whole time, and whether they carried anything past the PED policy line.
Escort policy enforcement
Inside the rack frame
Infrastructure protection. The room where a physical presence at the wrong time is a leading indicator of the cyber event that shows up in the SIEM the next morning.
Infrastructure · physical-to-cyber bridge
Behind the wall fixture
Classified read-ins and sensitive briefings. When a leak investigation opens later, the proximity log answers "who was actually in the room" without depending on the sign-in sheet.
Leak investigation record
Inside the ceiling tile
Open work areas between the SCIF and the general office. The compartment-adjacent space where PED policy is most often violated informally, and where CI patterns first show up.
Compartment-adjacent open work
Insider threat investigations almost always reveal a pattern that should have been detected at the physical layer weeks or months before the exfiltration event. A cleared employee accesses spaces they have no operational reason to enter. The same unidentified personal device shows up at multiple sensitive thresholds. After-hours patterns shift. The patterns exist in the data. The data does not exist in the right form to detect them in time.
Digital Tripwire produces that layer. The system does not replace insider threat programs (NITTF, DoDD 5205.16, EO 13587). It supplies them with the missing piece of the kill chain: device-level proximity records that connect physical access to behavioral indicators. When a cleared employee's secondary device starts appearing at thresholds they have no reason to enter, the pattern surfaces in days, not after the leak hits the press. The same record protects cleared personnel against false accusations and pattern misinterpretation. Counterintelligence works better when both sides of the badge log have evidence.
Federal investigations frequently center on physical property whose movement, theft, or transfer is the actual evidentiary question. A serialized firearm in an ATF trace. A controlled substance in a DEA operation. A trafficked artifact in an HSI cultural property case. A piece of stolen IP in an FBI counterintelligence operation. The agency has the legal authority to monitor that property under Rule 41 warrants, controlled-delivery doctrine, or property-based investigative authorities. What the agency has historically lacked is a forensic device-level layer that documents every phone, watch, and earbud that came within ten feet of that property at every step of its chain of custody.
Digital Tripwire supplies that layer. A node embedded in or adjacent to the property logs every device cluster that comes into proximity, with hash-signed timestamps and a tamper-evident record. As the property moves through its chain, the proximity log builds an association map that surfaces patterns no badge log or camera ever could. The same unidentified device appearing at three separate touchpoints is a lead, not a coincidence. The legal authority to deploy and to act on the data belongs to the agency. Digital Tripwire is the technical capability that makes the authority useful.
Intelligence Community Directive 705 establishes the physical and technical security standards for Sensitive Compartmented Information Facilities. The directive prescribes wall construction, door hardware, alarm coverage, sound attenuation, and the personal electronic device policy that governs every entry. Compliance is mandatory for any facility handling SCI, and accreditation is granted by the Cognizant Security Authority based on a formal site security plan and TEMPEST evaluation.
Digital Tripwire is engineered to coexist with ICD 705 accredited spaces and to supplement, not conflict with, the existing accreditation framework. Hub placement is selected outside the SCIF perimeter to avoid TEMPEST concerns. Node placement at the threshold logs proximity events on the non-classified side of the boundary, supporting PED policy enforcement and visitor processing without introducing emanation risk. The system is reviewed under the same site security plan that governs every other physical-layer addition to the space.
Federal procurement does not begin with the technology. It begins with the compliance pathway. Digital Tripwire is engineered against the federal standards stack from day one: NIST 800-171 for controlled unclassified information, NIST 800-53 for federal information systems, CMMC for the defense industrial base, FedRAMP for cloud service authorizations, and FISMA for the underlying continuous monitoring posture. The hardware and cloud architecture are designed to clear the standard ATO process, not to fight it.
The export package, the chain-of-custody framework, and the audit log are all built for the authorities that the federal evaluator already knows how to read.
We asked former FBI forensics investigators, federal prosecutors, and family court judges. They'd never seen BLE proximity data used as evidence. Until now.
The system is engineered to coexist with ICD 705 accredited spaces. Hub placement is outside the SCIF perimeter to avoid TEMPEST concerns. Threshold-level nodes operate on the non-classified side of the boundary and log proximity events without introducing emanation risk. Every deployment is reviewed under the existing site security plan that governs the accredited space, in coordination with the facility security officer and the Cognizant Security Authority. We do not modify ICD 705 compliance, we supplement it with a forensic device-level layer.
Digital Tripwire is engineered against NIST 800-53 controls and is preparing for the FedRAMP authorization process for the cloud component. The hardware and on-premise architecture are designed to inherit ATO from the host facility's existing System Security Plan as a defined supplemental control set. Most pilots begin under an Interim Authorization to Test (IATT) within the host facility's existing ATO boundary, with a full SSP supplement filed during the pilot period. Contact the federal team for current ATO status and procurement vehicle availability.
Digital Tripwire supplies the physical-layer evidence stream that insider threat programs (NITTF, DoDD 5205.16, EO 13587) are required to monitor but typically lack a defensible source for. The proximity log integrates with existing UAM, SIEM, and CDM workflows as a feed, not as a replacement. The federal pilot framework is designed for review and concurrence by the host agency's insider threat coordinator, the ISSO, and the senior agency information security officer.
The standard cloud architecture stores hash-signed proximity logs in commercially available cloud infrastructure. For federal facilities that require it, a cleared-cloud storage path is available with FedRAMP-aligned controls and inherited authorization. Access to the data is controlled by host facility policy, with read access itself logged and auditable. The system supports the principle of least privilege at every layer, with role separation between the operator, the auditor, and the investigator. The host agency controls the access policy. The system enforces it.
Tamper events are themselves logged. Removing a node, blocking its signal, or attempting to disable the hub generates an immediate alert with the timestamp and device list at the moment of tampering. Logs are uploaded over LTE-M cellular and stored off-site, so they cannot be deleted by anyone with facility network access or building physical access. The system is designed under the explicit assumption that the threat may include personnel with administrative privileges, which is the entire reason proximity logs survive personnel-layer compromise.
Digital Tripwire is preparing for award through GSA Schedule, SEWP, and CHESS, with current pilots executed under SBIR/STTR authorities and OTA agreements where applicable. Contact the federal team for current contract vehicle status. Pilots typically run 90–180 days at a single facility under an Interim Authorization to Test, followed by full ATO documentation and either a phased rollout under existing contract authority or a new task order under the appropriate vehicle.
Federal pricing scaled to facility classification and node count. Pilot a single facility in 90–180 days under IATT. Counterintelligence-grade proximity evidence, ICD 705 coexistent, ATO authorization pathway, hash-signed forensic export packets.
Request a Federal Briefing