Executive Risk Services

— ERS Briefing 012 · July 2026

Signal
without a phone.

Every protective plan eventually depends on one moment: a person under threat getting a signal out. Most plans quietly assume the phone will do it. The phone is the first thing taken, the first thing dead, and the last thing a person under stress can operate precisely. The signaling layer deserves the same engineering attention as the locks and the cameras, and in most programs it has received none.

Download the PDF →✦ Four pages · No registration required
01

The phone assumption

Ask how a protective plan learns that something is wrong, and the answer is usually an app: a shared-location circle, a messaging thread, an SOS feature buried behind a button combination. Each works in a demonstration. Under incident conditions, the assumptions stack badly. The phone is the first object an attacker controls, precisely because everyone, including the attacker, knows what it can do. Batteries die on the days that run long. The SOS gesture that seemed simple in the kitchen becomes fine motor control under adrenaline, performed while observed. And a signal that depends on the phone being present, powered, unlocked, and operated correctly is four assumptions deep before anyone has been alerted.

Consumer location-sharing adds its own quiet failure: it is social software. It gets toggled off for privacy, forgotten after trips, silenced with notifications. A layer that family members routinely disable is not a protective layer. It is an intention.

02

What the signaling layer must actually do

Engineered as a control rather than an app, the layer has a short list of non-negotiable properties. It must be separate from the phone, because the phone is assumed lost. It must be unremarkable, something worn or carried that identifies nothing about its owner's importance, because a visible panic device is a device that gets removed. Activation must be possible under stress and under observation: gross motor, low precision, no screen. It must fail loudly, reporting its own dead battery or lost link to someone whose job is to notice, because a protective device that fails silently is worse than none; it spends trust the family thinks is earned. And it must terminate somewhere real: a signal that rings a phone that is asleep has moved the problem, not solved it. The receiving end, who answers, what they do in the first five minutes, what they escalate to, is the majority of the system's value and the part most often left undesigned.

03

Fitting it to the household

The device question is downstream of the program question. Who carries a dedicated signal, the principal, the spouse, the children, the driver, follows from the exposure work earlier briefings describe, not from a catalog. The activation protocol has to be rehearsed the way the household rehearses anything else that matters: rarely, calmly, and enough that the motion exists under stress. And the response path must be written down and tested end to end, because every link that exists only in someone's head fails at the moment it is needed. ERS builds hardware in this category, Anchor, through our R&D lab, and the details live there rather than here; the briefing's argument stands regardless of whose hardware a family chooses. What matters is that the signaling layer is chosen and engineered on purpose.

04

Method

This briefing discusses signaling design at the level of properties, not protocols. It deliberately omits activation specifics and response-path details that would let an attacker anticipate a real configuration. We publish the pattern and the protective takeaway. We omit operational detail.