Rebuilding Kenya's Missing Persons Network with Civil Trace

When a family member goes missing or critical identity documents are lost, families experience sheer, disorienting panic. In Kenya and communities across the Global South, the immediate reaction is universal: design a digital flyer, paste personal mobile numbers across WhatsApp groups, post pleas on X (Twitter) and Facebook, and pin photocopies on neighborhood electric poles and bus stages.

For 48 hours, that post circulates rapidly. Then, three structural failures inevitably occur:

1. The Algorithmic Black Hole: Within two days, the post is pushed down by social media algorithms. The public assumes the person was found, while the family remains stranded with zero centralized visibility.
2. The Permanence & Dignity Trap: If a teenager or vulnerable adult is safely reunited within 72 hours, their missing person poster—often containing photos taken in distress, home locations, and sensitive personal health details—remains indexed on Google Image Search and social feeds five years later.
3. Predatory Extortion & Scams: Unscrupulous bad actors scour public social feeds for telephone numbers on missing posters, contacting grieving families demanding "transport fare" or "facilitation fees" to release fabricated sightings.

What began years ago as an experimental community tool called Missing Link Kenya (currently live as an early legacy prototype) has been completely re-architected as Civil Trace—an open-source, community-driven civic public safety platform engineered to amplify verified alerts while protecting human dignity.

Civil Trace is currently in active pre-deployment development. We have made the deliberate choice to build this project entirely in the open on GitHub (github.com/mkimbo/civil-trace) to invite developers, civic organizers, legal advocates, and community leaders to audit the architecture, contribute code, and help shape a resilient civic safety tool for the public good.

Here is the architectural philosophy and system design behind the platform.

1. The Anti-Social Playbook: Why "Friction by Design" is Critical#

In consumer software products, product managers obsess over eliminating friction: 1-click logins, instant publishing, and viral sharing loops.

In civic safety and emergency response, zero friction is dangerous. If anyone can post an alert anonymously in 30 seconds with no verification, the platform immediately devolves into an engine for marital disputes, unverified rumors, online vigilantism, and personal harassment.

For Civil Trace, we introduced Friction by Design:

The Verification Triad#

Every high-stakes alert (such as a missing child or vulnerable adult) must pass three distinct verification checkpoints before entering the public directory:

1. Mandatory Police Occurrence Book (OB) Number: The reporter must supply an official OB number issued by an authorized Kenya National Police Service station (e.g. OB 42/12/08/2026 Kilimani Police Station). Without a legally filed police report, missing person alerts cannot be published.
2. The Proxy Protocol (Social Proof Parity): Civil Trace does not act as the primary originator of unverified claims. It functions strictly as an enforcement and amplification proxy. The reporter links to an existing public social media post authored by verified family members, allowing our triage engine to cross-check photo and identity parity.
3. SMS OTP Authenticated Reporting via Provider-Agnostic Adapter: Users can browse active alerts anonymously, but initiating an alert or reporting a sighting requires authenticated identity verification. Our backend implements an SMS Adapter Pattern via dependency injection (/lib/sms.ts), allowing the platform to hot-swap between Twilio and Africa's Talking via environment variables without touching core alert logic.

"Two Doors, One Building" Role-Based Access Control#

Security and PII confidentiality are enforced through our "Two Doors" architecture:

• Door 1: Payload Native Admin (/admin): Strictly restricted to the super-admin core engineering team with direct MongoDB connection and emergency backdoor access.
• Door 2: Custom Client Application (/dashboard): All community roles (moderator, editor, warden, and standard user) authenticate through Firebase SSO (Google, Facebook, X/Twitter). A server-side dispatcher evaluates the user's role array and routes triage volunteers directly to the verification queue while restricting access to raw database tables.

Automated Parity Scoring & Geo-Radius Ingress Hooks#

Rather than relying on manual polling, the alert verification lifecycle is governed by Payload collection hooks:

• beforeChange AI Parity Hook: Extracts metadata from the linked social media post and compares names, dates, and police station references against the submitted alert, generating an automated Parity Confidence Score for moderator review.
• afterChange FCM Notification Hook: When a moderator transitions an alert from draft to published, an asynchronous hook broadcasts an emergency push notification via Firebase Cloud Messaging (FCM) targeted specifically to users within that geographical radius.

By making the submission workflow deliberate rather than impulsive, fraudulent entries and malicious alerts are halted at the perimeter.

2. Dynamic Consent & ODPC Compliance: Solving the Permanence Trap#

Under Kenya's Data Protection Act (governed by the Office of the Data Protection Commissioner - ODPC), hosting Personally Identifiable Information (PII)—especially sensitive photos of minors—carries profound legal and moral obligations.

Traditional missing person flyers create permanent digital scars. When a child returns home safely, their trauma shouldn't remain the top Google search result for the rest of their adult life.

Programmatic Deletion Engine#

Civil Trace implements Dynamic Consent:

// Conceptual Dynamic Consent & Auto-Deletion Hook
import { getPayload } from 'payload';
import config from '@/payload-config';

export async function processConsentLifecycleCheck(alertId: string) {
  const payload = await getPayload({ config });
  const alert = await payload.findByID({ collection: 'alerts', id: alertId });

  if (!alert) return;

  // 1. Verify if the primary source post is still active
  const sourceStatus = await checkExternalSourceStatus(alert.sourceUrl);

  // If the family deleted the post or marked it 'RESOLVED' / 'FOUND'
  if (sourceStatus.isDeleted || sourceStatus.isResolved) {
    console.log(`[Privacy] Consent revoked or subject found for alert ${alertId}. Initiating programmatic deletion.`);

    // 2. Programmatically unpublish from public queries
    await payload.update({
      collection: 'alerts',
      id: alertId,
      data: { status: 'resolved', isPublic: false },
    });

    // 3. Purge cached image binaries from CDN storage
    await purgeMediaAssetsFromStorage(alert.mediaAssetKeys);

    // 4. Submit urgent de-indexing ping to search engine APIs
    await notifySearchEnginesOfDeletion(alert.canonicalUrl);
  }
}

The system treats every published record as temporary by default. When the crisis resolves, the record programmatically disappears, preserving the subject's long-term digital privacy and dignity.

3. Offline-First PWA Architecture: Zero-Data Emergency Access#

Connectivity in East Africa is heterogeneous. During an emergency—such as someone stranded in a bus terminal at night or a community member looking for the direct line to the nearest police station commander—cellular reception may be intermittent or mobile data bundles may be completely exhausted.

A civic platform that displays a blank white screen when an offline user opens it has failed its core mission.

We engineered Civil Trace as an offline-first Progressive Web App (PWA) utilizing Next.js and Service Workers with strict State Partitioning:

Why Partition State?#

Pre-caching a static directory of 400+ Kenyan police stations, emergency contacts, and step-by-step guidance on "What to do in the first 2 hours of a disappearance" requires less than 850 KB of storage in IndexedDB. Users can access this vital directory completely offline with zero active airtime or WiFi.

Conversely, the active missing person alerts remain strictly network-only. Caching sensitive missing person photos locally on offline devices creates a privacy hazard, as outdated alerts might linger indefinitely on personal phones even after an alert has been legally deleted.

4. Zero-Cash Gamification: The Civic Points Economy#

Many well-intentioned civic initiatives collapse because of flawed incentive design:

• The Bounty Failure: Offering cash rewards for sightings attracts extortionists, counterfeit leads, and bounty hunters who harass innocent citizens who look vaguely similar to posters.
• The Volunteer Burnout: Relying entirely on unpaid goodwill causes volunteer engagement to plummet after the initial launch excitement fades.

To create sustainable community participation without money, Civil Trace introduces The Civic Points Economy:

• Verified Sighting Report (+500 Pts): Manually validated by reviewing officers or platform triage team.
• Physical Community Ambassador (+300 Pts): Generates automated high-contrast PDF poster & pins at designated bus stage.
• Police Station Contact Verification (+150 Pts): Verifies an active OCS telephone line to keep the offline directory fresh.
• Geo-Radius Active Standby (+50 Pts): Opts into emergency push notifications within a 5km radius of an incident.

Utility Over Speculation#

Civic Points can never be redeemed for cash, airtime, or cryptocurrency. By completely decoupling points from monetary value, the incentive for fraud drops to zero.

Instead, points unlock functional civic utility:

• Lost Property Notices: A citizen can spend accumulated Civic Points to publish verified notices for lost national ID cards, passports, or academic certificates with priority placement.
• Community Warden Badges: High-reputation volunteers earn the Verified Warden status, granting them trusted-reporter privileges that bypass automated queue delays for urgent neighborhood notices.

5. An Open-Source Invitation: Join the Mission on GitHub#

Civil Trace is not a closed proprietary startup. It is an open-source public safety initiative designed to be maintained, audited, and deployed by the global engineering community.

As we continue developing the foundational codebase before our first official deployment, we invite developers, UI/UX designers, accessibility specialists, and human rights advocates to collaborate:

• GitHub Repository: github.com/mkimbo/civil-trace
• Stack: Next.js, Payload CMS, TypeScript, Tailwind CSS, Service Workers / Workbox.
• Open Contribution Areas:
  1. Security & Verification Audit: Refining the OB number validation algorithms and reporting rate limits.
  2. Low-Bandwidth Optimization: Benchmarking performance on sub-$50 Android mobile devices and 2G/3G networks.
  3. Localized Language Toolkits: Contributing Swahili, Sheng, and regional translation packs for the offline emergency directory.
  4. ODPC Compliance Auditing: Reviewing automated media purge hooks against the latest 2026 data protection guidelines.

What’s Next?#

Building technology for civic impact demands the same architectural rigor as scaling enterprise SaaS. To read more about how we structure production systems, explore our other technical deep dives:

👉 Ditching Vercel for a $15 Hetzner Server with Dokploy

👉 Architecting a WhatsApp AI Receptionist

👉 Behind the Multi-Agent Architecture of Panda FPL

Want to contribute to Civil Trace? Check out the code and open issues on GitHub, or review the initial Missing Link Kenya Project Overview.

Interested in civic technology, ethical AI systems, or resilient software architecture? Let's connect and discuss.