A worked example of hardware-enforced location projection, cross-session unlinkability, and the legal consequences of a compelled production demand directed at an app that never held precise coordinates.
The ABT-D variant applies the foundational envelope-tier architecture to device-layer data collection, with location access as the canonical scenario. The variant-specific architectural element is the hardware enclave projection boundary: precise coordinates from the GPS sensor are read exclusively inside the device's secure enclave — a hardware region inaccessible to the operating system, applications, and all software processes. The enclave applies a user-configured projection (city, neighborhood, or precise) and returns only the projection to the requesting application. Precise coordinates never exist in any memory region accessible to the application, and therefore cannot be transmitted to external servers, exposed in API logs, or produced in response to legal process directed at the application or its backend. This memorandum follows Soo-Jin Hwang's location request through three daily sessions, examining the data flow, the compelled production analysis, and the GDPR Article 25 compliance posture.
When WeatherField calls the location API, the request is intercepted by the ABT-D enclave before the OS returns precise GPS coordinates to the app. The precise coordinates exist, for the duration of one computation, exclusively within the enclave's hardware memory. The app receives the projection — not the source data.
The distinction between a software privacy policy and a hardware boundary is legally significant. A software policy — "WeatherField will not share your precise location" — creates a contractual or regulatory commitment enforceable after the fact. A hardware boundary — the enclave returns only the projection — means the precise coordinates are structurally absent from the app's process space. There is no violation of the policy to investigate after the fact; there is no precise location data to share, because the app never held it.
For legal process analysis: a subpoena directed at WeatherField for "all location data collected from Soo-Jin Hwang" can only be satisfied with the city-level projection data — because that is all WeatherField holds. The subpoena is answered with the full scope of WeatherField's possession, which is structurally bounded by the enclave projection.
Hwang opens WeatherField three times on the same day from different neighborhoods. Each session produces a city-level projection with a per-session nonce. The app log is incapable of showing her movement pattern.
| Party | Holds | Cannot produce (does not hold) |
|---|---|---|
| WeatherField (app) | City-level projections; per-session nonces; timestamps of location requests | Precise coordinates; movement patterns more granular than city-level; cross-session identity linkage |
| Weather API (external server) | City-name queries (e.g., "San Francisco, CA"); timestamps | Any location data more precise than city; any user identifier linked to location |
| Device hardware / GPS | Raw coordinates (in transient enclave memory only, cleared per session) | Persistent log of coordinates; any record accessible outside the enclave session |
| Registry | Hash-chained log of projection events: "location projection issued, city-level, enc_nonce_d7f3, timestamp" | Precise coordinates; city name (registry receives only the event hash, not the projected value) |
| Property | Guarantee | Legal relevance |
|---|---|---|
| Hardware enclave boundary | Precise coordinates processed only in hardware enclave; never accessible to app process | Compelled production from app yields only projection data; hardware boundary is not a policy commitment that can be violated |
| Projection before network | City-level projection applied before any network call; external APIs never receive precise coordinates | Third-party subpoena to external API cannot yield precise location; data not held cannot be produced |
| Per-session nonces | Each location request generates a fresh enclave nonce; cross-session linkage requires enclave participation | Structural resistance to location history reconstruction from log data; Carpenter concern avoided by architecture |
| User-configurable scope | User controls projection granularity (city / neighborhood / precise); scope enforced at hardware layer | Privacy is a user-controlled property enforced below the application layer — not a permission granted at install time and ignored thereafter |
| GDPR Article 25 compliance | Data minimisation enforced by design at the hardware API layer | Regulatory compliance is structural, not dependent on each app developer's voluntary implementation |