Border verification, offline

A border post is one of the few places where a system being briefly unavailable is not an inconvenience. An officer either has an answer about a person in front of them or does not, and the connection to the primary database runs over a satellite link that is not always there.

The engagement was a subcontract through GIZ under the Africa-EU Migration and Mobility Dialogue framework, covering the front-end edge nodes for a West Africa Police Information System rollout at three land crossings. The scope was deliberately narrow: local nodes, data sync, and audit logging. Not the central system.

Each node holds a local verification cache and keeps working through an outage rather than degrading to a blank screen. The interesting problem is not the caching, it is what happens afterwards, when several nodes that have been operating independently come back online holding versions of the same record that disagree.

Every local write is timestamped with a vector clock and hashed, so a conflicting identity record can be ordered rather than guessed at, and any tampering between write and sync is evident rather than silent. Reconciliation happens against the primary database when connectivity returns, with the conflicts surfaced instead of resolved by whichever node happened to reach the server first.

Audit logging is tamper-evident by construction. On work of this kind the log is not an operational nicety, it is the record that has to hold up later.