# Sovereign Clean Sky — Identity and Integrity Extension
BB2G / Born Between 2 Generals LLC  
Owner: Kristen Hall (Krissy)  
Design revision: October 12, 2026

## Executive summary
Extend the existing Sovereign Clean Sky proposal with three independent findings: aircraft identity, operator authorization and flight/mission authorization. Verified aircraft remain visible to behavior assessment. Add a separately governed firearm identity and theft-recovery research track, preserving statutory serial markings and avoiding claims of invisible, indestructible or universally trackable devices.

Status: proposal plus a working browser-local cryptographic prototype with synthetic enrollment and reports. See [working prototype](working-prototype.md). No registry backend, live sensor feed, hardware integration, police connection, national mandate or operating oversight organization is implemented by this revision. Existing PDF letters and proposals retain their August content; the October clarification controls the current design.

## Drone identity tiers
- Government/police: agency-specific issuers and trust roots, restricted attribution, encrypted private fleet mesh, independent oversight. Sensitive identity resolution is purpose-limited and audited. Encryption does not hide physical aircraft or all radio metadata.
- Commercial: organization and aircraft credentials, authorized operators and separately scoped missions.
- Personal: manufacturer-provisioned aircraft credential, owner enrollment and verified transfer. A manufacturer partnership and national requirement remain proposed.
- Unknown: unverified pending review. No inference of nationality, hostility or enforcement authority from absent identity.
These are issuer/permission tiers, not nationality labels.

## Required drone controls
1. **Stolen genuine drone:** Authorized operator activation; hardware-bound aircraft proof; stolen-device revocation. Limit: Revocation freshness must remain visible during outages.
2. **Copied or replayed credential:** Fresh challenge or protocol freshness checks, signed proof of possession, and accepted issuer chain. Limit: A signature alone does not stop replay.
3. **Compromised operator account:** Strong authentication, device binding, scoped permissions, recovery and revocation. Limit: A legitimate account can still be abused.
4. **Authorized operator misuses a flight:** Separate aircraft, operator and mission authorization; keep behavior monitoring active. Limit: Verified identity never removes a contact from safety review.
5. **Ownership transfer:** Revoke previous control rights, verify the transfer, enroll the new owner, preserve custody history. Limit: Aircraft identity and ownership history remain distinct.
6. **Government insider abuse:** Agency-specific trust roots, mission limits, least privilege, independent review and audit. Limit: Restricted attribution protects sensitive information; it does not eliminate oversight.
7. **Compromised mesh node:** Mutual authentication, separate agency compartments, scoped keys and node quarantine. Limit: Compromise of one node must not expose the fleet.
8. **Offline or stale revocation:** Short-lived authorization, cached signed status with age, explicit offline limits. Limit: Missing updates mean status unknown or stale, not safe by default; flight-safety behavior needs separate review.
9. **Wrong identity-to-track association:** Correlate signed messages with independent observations and show uncertainty. Limit: A valid message does not prove it belongs to the observed aircraft.
10. **Issuer or registry compromise:** Protected signing keys, dual approval for sensitive changes, independent signed checkpoints, recovery drills. Limit: Trust-root updates and emergency revocation require accountable governance.

Authentication checks must cover issuer trust, signature, credential lifetime, revocation freshness and protocol freshness. Possession of a protected key proves access to that key; it is not sufficient evidence of current owner control, mission permission or harmless intent. Protect confidentiality separately from signature validation.

## Findings and decision boundaries
Track identity as verified / unverified / expired / revoked / conflict / stale. Track operator and mission authorization independently as authorized / unauthorized / unknown / stale. Record behavior concerns separately with observations, provenance and uncertainty.
Do not collapse these fields into a single safe/hostile score.

A revoked credential is unavailable for trust, but revocation is not proof of criminal intent. Unverified or suspicious status triggers review, never automatic interception, seizure or forfeiture. Flight-safe handling of expired authorization or lost links requires independent aviation engineering; this document does not prescribe an automatic in-flight shutdown.

## Firearm identity research
Preserve required visible serial numbers and markings. A supplementary manufacturer-applied internal forensic marking or passive identity tag is a research option for recovered-object identification. It cannot guarantee concealment, physical survival, clone resistance or remote location. Physical marking and hardware integration require qualified manufacturer and forensic examination; no installation or modification instructions are provided.

A separate powered integrity module is an optional research variant. It could report supported tamper events and authenticated periodic status. It requires defined sensor coverage, secure device binding, power, communications and independent environmental/safety evaluation. Removal or damage outside sensor coverage can escape detection. A tag attached to a detached component may identify the component rather than the complete firearm.

A hash is a digest of data. It does not detect physical damage, broadcast a pulse or reveal position. A digital signature helps authenticate a message and detect alteration; freshness and encryption remain separate requirements. Heartbeat schedules need power and privacy evaluation. Random timing alone adds neither physical tamper coverage nor assured security.

Passive variant: read at recovery/inspection; no continuous reporting.
Active variant: local supported-event record and connected delivery when possible.
Recovery variant: purpose-limited location observations only with owner consent or applicable legal authority. Location needs a positioning source plus connectivity; observation time and uncertainty must be shown. No public owner or location lookup.

Do not couple these research modules to firing mechanisms or remotely disable firearms. Avoid changes affecting mechanical safety or reliability. This is identity, tamper evidence and recovery research.

## Event and reporting states
- Normal: fresh, authenticated status for the covered sensor functions; not a guarantee of physical integrity.
- Tamper suspected: supported event or inconsistent evidence; preserve the report and coverage limits for review.
- Telemetry stale: missing heartbeat or old status; do not infer tamper or theft.
- Service authorized: signed time-limited scope, approved technician/issuer and post-service re-enrollment.
- Theft reported: authenticated report with evidence and reporter; separate from authority-confirmed status.
- Recovery authorized: documented authority, purpose, access scope and expiration.
- Recovered / report corrected: authorized closure or correction preserving earlier evidence and revoking temporary access.

A firearm theft record in this proposed system does not file a police report or update government databases. Any future integration needs a real agreement, authentication and verified delivery. Agency reporting obligations are separate from private-owner reporting.

## Proposed BB2G Asset Integrity governance
This is a proposed program, not an established government agency or accredited organization.

Credential issuers: enrollment and verification, protected signing keys, scoped issuance, revocation, transfer and recovery.
Incident desk: validate telemetry/report provenance, distinguish missing data from tamper evidence, manage human review and document disposition.
Independent audit: verify signed checkpoints, privileged access, trust-root changes, location access and incident corrections.

Sensitive owner, trust-root and credential changes require authenticated requests, two-person approval, before-and-after records and a documented reason. Role separation must prevent the same actor from changing a record and approving or erasing its evidence. Independently retained signed checkpoints help reveal history rewriting; hash chains alone cannot stop a privileged attacker replacing both data and hashes.

For both programs retain event ID, asset pseudonym, issuer/device key reference, event type, observed and received times, monotonic sequence or freshness evidence, software/configuration version, relevant record digest, signature-verification finding, sensor coverage, revocation age, provenance and delivery status. Record location only where specifically authorized, including uncertainty. Never log private keys.

Dispatch, delivery and recipient acknowledgment are distinct events. Alert promptly upon validated connected detection; publish measured delays, missed events and false alarms. Preserve supported events locally across outages when hardware permits. No promise of immediate remote detection during dead power, destroyed sensors, shielding or disconnection.

Compromised issuer response: independently approve trust changes, suspend affected issuance, publish signed revocation/status updates, identify impacted records, re-enroll using a separate trusted path and audit recovery. Legitimate authorized service and corrections remain possible.

## Privacy boundaries
Separate drone and firearm stores, issuers and access roles. Do not bridge these records into elections, schools or child-safety data. Minimize personal information, encrypt sensitive records, log access purpose/authority, set retention and deletion rules, support correction and appeal, and audit insider misuse. A bare hash of a serial number is not adequate anonymization against guessing; use opaque identifiers and an appropriately reviewed binding method.

## Acceptance matrix
These are required future engineering checks, not executed hardware tests.

| Scenario | Required observable result |
| --- | --- |
| Stolen genuine drone | Aircraft identity can remain verified while operator authorization fails; contact remains visible |
| Replayed message | Freshness check rejects stale proof; evidence records reason |
| Compromised operator account | Device/scope controls and revocation exercised; identity never overrides unsafe behavior |
| Revoked drone offline | Cached status age visible; authorization unknown/stale after defined limit |
| Signed identity outside mission | Mission review flagged while aircraft identity stays verified |
| Compromised mesh node | Node quarantined; neighboring compartments stay isolated |
| Issuer compromise | Independent recovery and status distribution demonstrated |
| Wrong track association | Conflict/uncertainty shown, never a false confident identity |
| Firearm supplementary marking recovery | Independent recovery rate documented after controlled damage |
| Tag substitution or removal | Mismatch flagged where detectable; coverage failures documented |
| Surface serial damage outside sensor coverage | No false promise of detection; independent forensic review |
| Authorized maintenance/transfer | Valid scoped service accepted, history preserved, old access revoked |
| Battery loss / shielding / no signal | Stale status shown; no fabricated location or confirmed tamper |
| False theft report | Reporter checked, report separated from confirmation, correction retained |
| Old or spoofed position | Freshness/provenance checked; uncertainty or rejection displayed |
| Registry history changed | Independent checkpoint disagreement flagged; signed records alone not assumed sufficient |
| Alert delivery failure | Queued/failed status visible, retry/deduplication and eventual acknowledgment exercised |

The original scope canvas demonstrates visual identity-versus-mission separation. The added working console and shared verifier have 37 passing cryptographic, adversarial-input and fresh-process recovery tests. Physical and institutional acceptance remains pending; see the working prototype gap register.

## Primary references
- FAA Remote Identification of Drones: https://www.faa.gov/uas/getting_started/remote_id
- ATF Properly Identify a Firearm for the Purpose of Tracing: https://www.atf.gov/firearms/tools-services-law-enforcement/national-tracing-center/properly-identify-a-firearm-purpose-tracing
- NIST digital signature glossary: https://csrc.nist.gov/glossary/term/digital_signature
References support the stated regulatory and cryptographic distinctions; they do not endorse BB2G or validate proposed hardware.