Why a good inactivity check-in is slow on purpose

A dead man's switch is a grim name for a simple idea. The system waits for a regular sign that you are still around. Keep checking in and nothing happens. Stop, and after a set period it does the thing you set up in advance: sends a message, releases instructions, hands access to the people you named. The check-in is the whole mechanism. Everything rests on how it reads your silence.

You may already own one without thinking of it that way. Google's Inactive Account Manager is exactly this, built into an ordinary account. You choose how long Google should wait before treating the account as inactive, anywhere from three to eighteen months, and you name up to ten people to notify or pass data to. Google watches ordinary signs of life for that decision: your last sign-in, recent activity, whether the Gmail app has been used, Android check-ins. It is not deciding whether you are alive. It is noticing whether the account is being used.

That gap is the heart of the design, and it is where the cheap versions go wrong. Being used is only a proxy for being around. A good check-in treats it as a proxy, and leaves room for the proxy to be wrong.

The failure nobody likes to picture is the switch firing while you are perfectly fine. You went trekking somewhere with no signal. You spent three weeks in hospital. You changed phones and the old app quietly stopped checking in. You saw the reminder, meant to deal with it, and it slid under a hundred other emails. None of that is unusual. From the outside, all of it looks identical to death: the account simply goes quiet.

So a switch that trips fast is a switch that trips wrong. Speed is not the goal, it is the danger. A handover you cannot take back, your final wishes sent, your vault opened, your family told the worst, is not a thing to hurry. The slowness is not carelessness. It is the margin that lets a missed message stay a missed message.

A well-built check-in never jumps straight from silence to handover. It climbs a ladder, and every rung gives you a chance to stop it. The first rung comes back to you, loudly, on more than one channel. Google, for one, tries your recovery email and a text to your recovery phone before it contacts anyone else. If you are alive and just distracted, that is where you tap a link and the timer resets. Most false alarms should die right here, quietly, with nobody else ever knowing the clock had started.

Only if you stay silent does the circle widen. The next rung is the people you chose, told that your account has gone quiet and asked, in effect, to check. Real people are a far better sensor than an inbox timer. They know whether you are on a boat with no phone or whether something is genuinely wrong. Bringing them in before anything is released turns a lonely automated guess into something a human can confirm or wave off.

The last rung asks for proof, not more silence, and it waits. Apple's legacy access is a clean example of the evidence step done properly. The person you named cannot get in on a hunch. They need the access key you gave them and a copy of your death certificate before Apple will release anything. Silence started the process. Evidence, reviewed by a person, is what finishes it.

Here is the principle underneath all of it: an absence of signal is not a signal. Silence has a dozen dull causes and one serious one, and from inside a server they are indistinguishable. Treating we-have-not-heard-from-you as you-have-died is the single mistake that turns a safety net into a hazard. Getting it wrong is not a small glitch. It is your estate opened while you are on holiday.

This is why serious systems want corroboration before the irreversible step. Real proof of death exists, and it is not quiet. It is a death certificate, issued from the record held by the authority that registers deaths where the person lived. In the UK, for instance, a death is recorded at the local register office and the certificate is issued from that record; other countries run their own registries with their own steps. The specifics differ by place, so check what applies where you live. The part that does not change is simple: a document from an authority is evidence, and an unanswered email is not.

A check-in that respects this does two jobs at once. It stays patient with the living, giving you every chance to say you are still here. And it stays strict at the moment of handover, refusing to act on the bare fact of quiet. Get both right and the same design that stops your family finding nothing also stops a handover you never wanted.

Setting one up, or judging one, a few things separate the safe designs from the reckless. The waiting window should be measured in months, not days, and ideally you get to choose it. There should be more than one way to reach you, because a single channel always fails at the worst possible time. There should be real people in the loop before anything opens, not just a countdown. And the final step should ask for evidence rather than settle for silence.

Then do the unglamorous part: test it, and keep it current. Let a check-in lapse on purpose once and watch what actually happens. See whether the reminders arrive and whether your contacts understand what they are being asked. Check that the people you named are still reachable and still the right people. A switch you set up years ago and never looked at again is describing a life you may no longer be living.