TetraFence: Re-Auditable Mobile Field Evidence with Immutable Location Anchoring

In the modern world, we often rely on smartphones to document the physical world, from tracking the journey of food from farm to table to verifying that construction work happened where it was supposed to. But a quiet problem exists in this digital record-keeping: a photograph taken by a phone is only as trustworthy as the story told about where and when it was taken. If a photo is uploaded to a database, nothing in the database itself guarantees that the image wasn't taken from a different location, or that the coordinates attached to it weren't faked. This gap between the moment a picture is snapped and the moment it is stored creates a "provenance gap," a space where trust can easily be lost. To solve this, researchers have begun looking at blockchain, a type of digital ledger that records information in a way that is nearly impossible to alter once written. However, simply recording a result on a blockchain does not fix the problem if the result itself was based on a lie or a mistake made before the data ever reached the ledger. The real challenge is to capture not just the final verdict, but the raw evidence—the exact location, the time, and the image itself—so that anyone can look back later and re-check the math to see if the story still holds up.

This is the specific problem a team led by Duy-Quan Nguyen set out to solve with a system called TetraFence. The researchers wanted to build a reliable pipeline for mobile field evidence, specifically for agricultural workers who need to prove they inspected crops or facilities in the correct places. They tested their system in Vietnam across three different sites: a massive rice field covering hundreds of hectares, a small processing facility, and a plant nursery. The goal was to create a workflow where a worker's ordinary smartphone could take a photo, automatically grab the device's current location and time, and lock that information into a secure, unchangeable record. The system was designed to be strict about how data entered the system; for instance, the app only allowed photos to be taken directly through the camera lens, preventing users from simply uploading old pictures from their gallery. Once the photo and location data were collected, the system checked if the worker was within a reasonable distance of the correct plot of land before sending the information to a private blockchain network.

The core of the research was to see if this system could actually preserve the ability to re-audit the evidence later. In a standard system, if a manager changes the map of a farm plot, old photos might suddenly look like they were taken in the wrong place, even though the photo itself hasn't changed. The researchers wanted to know if they could store the original map and the original photo together in a way that allowed a future auditor to repeat the exact same calculation and get the same answer, regardless of how the maps changed later. To test this, they ran 44 real-world events in the field. They then built two different computer programs to check the results: one written in a language common for web services and another written in a language specifically for the blockchain. They fed the exact same 44 sets of data into both programs to see if they agreed on whether the worker was inside or outside the designated area.

The results showed that the system worked with remarkable consistency. For the 25 events where the boundaries of the land did not change, both computer programs agreed perfectly on whether the worker was inside or outside the zone. When the programs did calculate the distance from the boundary, their answers were nearly identical, differing by an average of only 0.16 meters, with the largest difference being just 1 meter. This small margin of error is well within the normal range of uncertainty for a standard smartphone's GPS. The system also successfully handled edge cases, such as a worker standing 51 meters away from a facility. Instead of simply rejecting the photo as "wrong," the system flagged it as a "yellow" warning, preserving the record while noting that it was far enough away to require a closer look. This graded approach allowed the system to keep useful data without forcing a rigid "yes or no" decision that might discard legitimate work done just outside a fence line.

However, the study also uncovered a critical flaw in how such systems are often designed, one that only became visible when the researchers looked at the nursery site. In this case, the plot of land assigned to a batch of records was changed from a small 9,999-square-meter area to a massive 448-hectare area located nine kilometers away. When the researchers tried to re-evaluate the old photos using the new, larger map, the results changed completely. Two photos that were once considered "inside" the small plot were now "outside" the new one, and vice versa. This happened because the old records only stored the photo and the location, but not the specific version of the map that was being used at the time the photo was taken. The researchers found that without locking the specific map version to the event, the meaning of the evidence could be silently rewritten by a simple administrative change. To fix this, they concluded that every piece of evidence must be bound to the exact version of the geometry it was judged against, ensuring that the original decision can always be reproduced.

The study also measured the cost of running these checks on the blockchain. They found that verifying a single photo against a complex map with 17 corners required a specific amount of computational effort, known as gas, which was well within the limits of the network. This suggested that the system could handle a steady stream of checks without clogging the network. Yet, the author was careful to note what their system did not do. They did not prove that the phone was physically where it said it was; a skilled user with a hacked phone could still fake a location. The system's strength was not in stopping a determined cheater, but in creating a transparent, unchangeable record that allowed anyone to see exactly what data was used to make a decision. By preserving the raw inputs—the photo, the coordinate, the time, and the map version—the system turned a simple digital record into a reproducible piece of evidence.

Ultimately, the TetraFence project demonstrated that mobile data provenance is possible, but it requires a shift in how we think about digital records. It is not enough to simply store a photo and a location; the system must also store the context in which that location was judged. The research showed that when you bind the version of the map to the event, you prevent the past from being accidentally altered by changes in the present. While the system relies on the assumption that the phone itself is honest, it successfully created a pipeline where the logic of the decision can be checked and re-checked by anyone, long after the worker has put down their phone. This approach offers a practical way to build trust in mobile evidence, ensuring that the story told by a digital record remains consistent, even as the world around it changes.