// INSIGHTS
Reuniting Lost Family Members at a Mass Gathering
6 min read
At a large mela, an eight-year-old lets go of a hand near a food stall and is forty metres away within twenty seconds. The family goes to the nearest police tent. The announcement goes out over a PA system competing with three sound systems and a generator, in one language, across a ground where the family cannot hear it anyway. Most reunions still happen, eventually, on foot. The gap between eventually and quickly is where the harm lives, and it is an engineering problem.
Why the usual approach fails
Public address announcements assume audibility, a common language and a stationary listener. On a crowded ground at 95 to 100 decibels, with attendees speaking Hindi, Marwari, Bhojpuri, Gujarati, Tamil and others depending on the gathering, none of those hold. Phone-based solutions assume a charged phone, a working data connection and a family member who uses smartphones. At mass gatherings all three fail routinely: mobile networks saturate, batteries die by mid-afternoon and a large share of elderly attendees do not carry a smartphone at all.
We built a reunification platform around the opposite assumptions. Assume no connectivity. Assume no personal device. Assume multiple languages and low literacy. What remains is physical infrastructure and paper, made trustworthy by cryptography.
The ground is pre-mapped and fitted with permanent geotagged QR checkpoints, typically every 150 to 250 metres and at every gate, medical post, police tent and major landmark. Each checkpoint has a fixed identifier bound to real coordinates. A found person registered at any checkpoint is located precisely, without anyone having to describe where they are. Family credentials are issued as Ed25519-signed QR codes on a wristband or card, which cannot be forged or edited and which verify offline in milliseconds. Every checkpoint device works fully offline and reconciles with the others when a link is available, so a network outage slows synchronisation but never stops a registration or a handover.
How the ground is instrumented
What makes it work under real conditions
Permanent geotagged checkpoints
Fixed QR markers bound to surveyed coordinates. A scan establishes exact location without anyone describing landmarks in a language the operator may not speak.
Offline-first by design
Every device holds the full local state and operates without a network. Records reconcile automatically when connectivity returns, with conflict resolution built in.
A* pedestrian routing
Routing runs over the actual walkable graph, accounting for barricades, one-way corridors and closed gates, so directions given to a family reflect the ground as it is today.
Signed, unforgeable credentials
Family and guardian credentials are Ed25519-signed QR codes. Verification is local and cryptographic, so no one can produce a valid claim to collect a child they are not linked to.
From ground survey to verified handover
Pre-map and place checkpoints
The venue is surveyed and the walkable graph is built, including barricade lines and one-way flows. Checkpoints are installed and their coordinates verified on foot, not from a drawing.
Issue family credentials at entry
Families opt in at gates and receive linked wristbands or cards. The data collected is deliberately minimal: a group identifier and one contact, not a profile.
Register a found person at any checkpoint
A volunteer or officer scans the checkpoint QR and records the person. Location is exact and instant. Matching against reported-missing entries begins immediately across all synced devices.
Verified handover with an audit trail
Handover requires a cryptographic credential match or a documented manual verification by two staff members. Every handover is logged with time, checkpoint, staff identity and method.
What usually goes wrong
The risk that matters most is not slow reunion. It is handover to the wrong adult. A child who is frightened will agree with a confident stranger. A crowd of anxious people at a police tent creates pressure to resolve quickly. This is why the verification ritual is the core of the system rather than an add-on, and why we insist on either a cryptographic credential match or a two-person manual verification with a recorded reason. Speed is subordinate to correctness here, and we say so to clients who ask for a one-tap release. The second common failure is coverage: checkpoints placed for convenience rather than by survey leave dead zones exactly where crowds are densest. The third is staffing. The platform is only as fast as the number of trained people who can operate a checkpoint, and volunteer briefing needs to be short enough to deliver in five minutes in the local language.
We are also asked regularly to add face matching for lost children, and we generally advise against it as a primary mechanism. Face recognition accuracy on children is substantially worse than on adults, published evaluations show higher error rates for children and for several demographic groups, and the consequence of a false match in this specific context is severe. It also means creating a biometric database of minors at a public gathering, which under the DPDP Act carries heightened obligations around verifiable parental consent and is difficult to justify when a signed wristband achieves the outcome without the exposure. Our default build collects the minimum viable data, keeps it on device, purges within 72 hours unless a case is open, and treats any biometric layer as an explicitly consented exception rather than the design.
Common questions
What if the family has no smartphone?
Nothing in the core flow requires one. Credentials are physical: a printed wristband or card carrying a signed QR code. Checkpoint devices are operated by staff and volunteers. A family can register at a gate, get separated, and be reunited without anyone in the group owning a phone.
Do you use facial recognition on children?
Not by default, and we recommend against it. Accuracy on children's faces is materially worse than on adults, the cost of a false match is a wrongful handover, and building a biometric database of minors triggers heightened DPDP obligations. Signed physical credentials solve the problem without that exposure.
What happens to the data after the event?
Personal records are purged on a configurable schedule, 72 hours by default, unless a case remains open or law enforcement has a documented requirement. Checkpoint and routing data, which contains no personal information, is retained for planning. The retention policy is agreed in writing before any registration opens.
Map the ground before the crowd arrives
Share your venue plan and expected footfall and we will propose a checkpoint layout and a handover verification protocol.
