Bringing It Together: An Operating Model for the Intelligence-Driven Fire Service

■ Defence, mining, oil and gas, and autonomy point to one future: a fire service that predicts earlier, decides faster, protects its people better and works seamlessly with Police, Ambulance and SES. ■ The operating model rests on five pillars: intelligence at the core, integrated operations centres, safety by design, assets ready when needed, and human–machine teaming. ■ Cyber security isn't a sixth pillar.

It is the foundation under all five, and it must be designed in from the start. ■ A three-horizon roadmap turns the model into action over ten years. The real enabler is leadership.

■ Operational capability, meaning people, assets, facilities and supplies ready together, is what turns the model into a response that actually arrives. Pillar 4 covers fleets, aircraft, facilities, maintenance, purchasing and inventory. ■ This edition adds each pillar in depth, an illustrative season under the new model, governance and funding options, the workforce of the future, sequencing and dependencies, and measures of transformation.

Across this series we've looked at what defence, mining, oil and gas, and autonomous systems can teach Australian fire services. Each industry offers distinct lessons, but together they point to a common future: an intelligence-driven fire service that predicts earlier, decides faster, protects its people better and works seamlessly with partner agencies.

So what does that look like in practice, and how do we get there securely? Fire burning at the base of trees beside a charged hose line in New South Wales. Every element of the operating model exists to bring people home safely.

Source: Photo by Darren Covington What each industry taught Before setting out the operating model, it is worth recapping the central lessons from the series. Defence taught us that intelligence is a core function, not a support task. It showed the value of faster decision cycles, mission command when communications fail, joint operations across organisations, persistent sensing, wargaming and honest readiness reporting.

And it showed the importance of assuming that networks will be contested. Mining showed how remote operations centres can run whole regions as one integrated system, how critical control management focuses attention on the few controls that prevent fatalities, and how fatigue can be managed as a science rather than a matter of willpower. It also showed what happens when operational technology is connected to networks without strong security.

Oil and gas taught us that good injury statistics do not mean a catastrophe can't happen. It gave us bow-tie analysis, the safety case, leading indicators, digital twins, asset integrity, stop-work authority, realistic exercising and crew resource management. Its disasters also showed how organisational weaknesses, not just technical faults, lie behind major accidents.

Autonomy showed how machines can take on dull, dirty and dangerous work while people stay in command. It highlighted the need for clear levels of autonomy, safe airspace integration, resilience in degraded conditions, community trust and secure command links. Across all four, three common threads stand out: information must move faster and more reliably; safety must be managed deliberately, with a focus on what could kill people; and every connected capability must be secure by design.

The five pillars of an intelligence-driven fire service The intelligence-driven fire service operating model. Source: Darren Covington 1. Intelligence at the core (from defence).

Intelligence is a core function, equal to operations and logistics. Always-on sensing, AI-driven fusion and predictive modelling give commanders a continuously updated picture of hazards, risks and community impacts. Decision cycles get faster at every level, and mission command lets the frontline adapt when conditions or communications change.

2. Integrated operations centres (from mining and oil and gas). State operations centres evolve into integrated, real-time operations centres connecting fire, Police, Ambulance, SES, the Bureau of Meteorology, utilities, transport and industry partners.

Specialists support the frontline remotely, anywhere in the state, and everyone works from one shared picture. 3. Safety by design (from mining and oil and gas).

Major-hazard risks are managed through critical controls, bow-tie analysis and leading indicators. Fatigue is managed scientifically. Crew tracking, exposure monitoring and live verification of critical controls protect career staff and volunteers.

Every person has the authority and the confidence to stop unsafe work. 4. Operational capability: assets ready when needed (from mining, oil and gas, and defence).

Operational capability depends on the assets behind every response: ground fleets of tankers, pumpers, rescue and support vehicles; fixed-wing and rotary-wing aircraft; stations, depots, airbases and operations centres; and the stock of breathing apparatus, PPE, hose, fuel, retardant and spare parts that keeps them working. Predictive maintenance, asset integrity management, disciplined purchasing, real-time inventory and readiness reporting mean that capability is available when demand peaks. Readiness is measured, not assumed.

5. Human–machine teaming (from autonomy). Drones, robots and autonomous systems take on dull, dirty and dangerous tasks, extending the reach of crews and commanders while humans keep control of critical decisions.

The pillars in depth Pillar 1: Intelligence at the core What it looks like in practice: dedicated intelligence roles at state, regional and incident level; standard intelligence products tied to decision points; a layered sensing network; AI-assisted fusion and prediction; and clear intent from commanders so the frontline can act when conditions change. First steps: map the decision cycle for a recent major event, establish a state intelligence cell with clear products, and connect weather, satellite and dispatch data in one analytical environment. How you'll know it's working: shorter time from a change in conditions to a change in action, more decisions supported by intelligence products, and after-action reviews that show intelligence changed outcomes.

Pillar 2: Integrated operations centres What it looks like in practice: a state operations centre where fire, Police, Ambulance, SES, the Bureau of Meteorology, utilities and transport share one live picture; specialists supporting incidents remotely; exception-based monitoring; and planning, rostering, maintenance and aviation coordinated as one system. First steps: pilot integration for one region or hazard season, agree data-sharing arrangements with partner agencies, and define roles and authority consistent with AIIMS. How you'll know it's working: fewer conflicting pictures between agencies, faster coordination of resources across incidents, and partner agencies actively using the shared picture.

Pillar 3: Safety by design What it looks like in practice: a major-hazard register with bow-ties for each fatal hazard; critical controls with owners and verification; leading indicators reported to executives; fatigue risk management; live crew tracking; and a culture where anyone can stop unsafe work. First steps: build bow-ties for the top three fatal hazards, choose a first set of leading indicators, and review fatigue rules for campaign events and long-distance travel. How you'll know it's working: critical controls verified routinely, leading indicators improving across seasons, more near misses reported, and fewer serious injuries.

Pillar 4: Operational capability What it looks like in practice: ■ Ground fleets: telematics on appliances and vehicles, predictive maintenance planned around the season, whole-of-life fleet management and common specifications across agencies, with workshop support for volunteer brigades. ■ Aviation, fixed and rotary wing: a real-time view of which aircraft are serviceable, where and for how long, combining maintenance records, crew duty hours and contract data, and linked to national arrangements through NAFC. ■ Facilities: condition monitoring of power, water, fuel and communications at stations, depots, airbases and operations centres, with climate-risk planning and backup systems for the most critical sites.

■ Purchasing: whole-of-life cost modelling, demand forecasting, supplier risk management and joint purchasing where it makes sense, so long lead times don't bite mid-season. ■ Inventory: shared, real-time visibility of critical stock such as breathing apparatus, PPE, hose, fuel, retardant, sandbags and spare parts, with demand tied to the seasonal outlook.

■ Readiness reporting: honest, real-time reporting of operational capability by region, covering crews, appliances, aircraft, facilities and stock together. First steps: fit telematics to a priority fleet, baseline real availability on high-risk days across appliances, aircraft and facilities, define readiness levels for high-risk periods, and build a shared view of critical inventory. How you'll know it's working: higher availability of appliances and aircraft on high-risk days, fewer breakdowns during responses, no critical stock-outs, critical facilities operating through outages, and an honest, real-time view of capability.

Pillar 5: Human–machine teaming What it looks like in practice: drones, robots and remotely operated plant doing dull, dirty and dangerous tasks; clear autonomy levels for each task; integrated airspace management; strong privacy rules; and autonomous system outputs flowing into the common operating picture. First steps: review existing drone use, select three priority use cases for structured trials, and write security, privacy and data sovereignty requirements into procurement. How you'll know it's working: more hazardous work done by machines, faster detection and assessment, no airspace incidents, and strong community support.

“Cyber security isn't a sixth pillar. It is the ground the other five stand on.” Operational capability: why assets are mission-critical Every pillar ultimately comes down to one question on the worst day: can we put the right crews, appliances and aircraft where they are needed, in time, and keep them there? Intelligence that predicts a fire run is wasted if the nearest tanker is off the road for a fault nobody saw coming, the air tanker is grounded for maintenance at the wrong moment, the station has lost power, or the breathing apparatus cylinders were never refilled.

A NSW Rural Fire Service appliance pump panel at night. Operational capability depends on equipment that works first time, every time. Source: Photo by Darren Covington

Operational capability is people, assets, facilities and supplies, ready together. That has three implications for the operating model: ■ Assets are operational, not administrative. Asset availability, maintenance, purchasing and inventory belong in operational planning and reporting, not only in corporate services.

■ Readiness links to risk. The daily risk outlook should be matched against real capability, so leaders can pre-position, request interstate support or warn the community that response may be stretched. ■ Capability is national.

Fires and floods cross borders, and so do appliances and aircraft. National visibility of capability, built on common standards, lets agencies help each other faster. Empowering the frontline The operating model only works if it reaches the people at the sharp end.

Frontline volunteers and staff make the fastest, highest-stakes decisions, often where there is no mobile coverage. They need integrated, fit-for-purpose applications that give them the same real-time picture as the operations centre, filtered to their role, and connected over satellite when terrestrial networks fail: ■ One aligned toolset, not a dozen apps. Tasking and commander's intent, the shared operating picture filtered to the user's role, crew location, escape routes and safety alerts, fire spread and flood predictions, warnings, photo and voice reporting, availability and fatigue hours, and appliance and stock status, all in one integrated experience.

■ Fit for purpose on the fireground. Designed for gloves, glare, smoke and stress, with simple screens, large controls and voice input, and co-designed with the volunteers and staff who use them. ■ Connected anywhere.

Offline-first apps that sync over mobile networks when available, and over low-earth-orbit satellite terminals on appliances and command vehicles, or direct-to-device satellite messaging on phones, when they are not. ■ Radio stays primary for safety-critical voice. Apps add the shared picture and data; they don't replace the radio.

■ Secure by design. Managed devices, multi-factor sign-in, encryption, remote wipe for lost devices, and data held under Australian jurisdiction.

A NSW Rural Fire Service brigade station at dawn. Volunteers are the backbone of fire and emergency services across most of Australia. Source: Photo by Darren Covington For volunteers, the intelligence-driven fire service should mean better information on the way to an incident, safer deployments with fatigue and escape routes actively managed, less paperwork, recognition of the skills they bring from their working lives, and new ways to contribute, from drone piloting to intelligence analysis.

It should never mean more burden for less support. The best way to make sure of that is for volunteers to help design it. Empowering the frontline in this way is mission command made practical: clear intent, a shared picture and the authority to act on it.

The foundation: cyber security and resilience Cyber security at the core: secure by design, not bolted on. Source: Darren Covington

Every pillar makes fire services more connected, and therefore more exposed. Intelligence platforms hold sensitive community data. Operations centres become single points of failure.

Crew tracking and warnings are safety-critical. Autonomous systems depend on trusted command links. For that reason, cyber security and resilience form the foundation of the operating model, not an add-on.

What a secure-by-design fire service looks like: ■ Governance at the top. Cyber risk is owned by the executive and reported to the board alongside operational risk. ■ Zero-trust architecture.

Every user, device and data feed is continuously verified, with least-privilege access across agencies and jurisdictions. ■ Essential Eight as the baseline. The Australian Signals Directorate's Essential Eight mitigations are implemented, with higher maturity for safety-critical systems.

■ Operational technology segmented from corporate IT, with 24/7 security monitoring. ■ Sovereign, protected data. Community, workforce and operational data is held under Australian jurisdiction, encrypted, and used only for its purpose.

■ Degraded-mode operations. Every critical capability has a tested manual or offline fallback. ■ Secure supply chains.

Vendors and cloud providers meet clear security standards, written into contracts. ■ A cyber-aware workforce. Career staff and volunteers are trained to recognise phishing, social engineering and suspicious activity, and know how to report it.

The cyber resilience journey Most agencies will build cyber resilience in stages: 1 Know what you have. An inventory of systems, data and suppliers, with the safety-critical ones identified. 2 Get the basics right.

Essential Eight controls implemented and verified, starting with multi-factor authentication, patching, privileged access and tested backups. 3 Separate and monitor. Operational and safety-critical systems segmented from corporate IT, with 24/7 monitoring.

4 Assume breach. Zero-trust architecture, tested incident response plans and degraded-mode procedures for every critical capability. 5 Resilient by design.

Security built into every new capability from the business case onwards, with regular independent testing and continuous improvement. Each stage reduces risk significantly. The important thing is to start, and to give the most attention to the systems people's lives depend on.

The other foundations underneath Alongside cyber security, none of the pillars works without: ■ Data: common standards, integrated platforms and trusted data sharing across agencies and jurisdictions. ■ Resilient infrastructure: always-on communications, cloud and edge computing, satellite connectivity for appliances, command vehicles and frontline devices, and progress on the national Public Safety Mobile Broadband program.

■ Responsible AI governance: transparency, testing against extreme scenarios, assurance and human accountability. ■ People and culture: training, new roles (intelligence analysts, data specialists, drone pilots, digital twin modellers, cyber specialists) and leadership that embraces change. ■ Volunteers: systems designed around volunteers' time, skills and wellbeing, not just career staff.

■ Partnerships: with Defence, industry, research institutions, technology providers and the community. Choosing where to start No agency can do everything at once. A simple way to choose where to start is to score possible initiatives against four questions: 1 Risk: does it address one of our biggest risks to crews or communities?

2 Readiness: do we have the data, people and partners to make it work now? 3 Visibility: will crews, volunteers and partners see the benefit quickly? 4 Foundation: does it build capability that later initiatives will depend on?

Initiatives that score well on all four make strong first moves. For most agencies, they are likely to include fatigue management, critical controls for the top fatal hazards, integration of core data into the common operating picture, Essential Eight uplift for safety-critical systems, and two or three well-chosen drone use cases. Initiatives that score well on risk but poorly on readiness, such as advanced AI prediction or autonomous suppression, should be prepared for through research, partnerships and foundation-building, rather than rushed.

Governance: who owns the transformation? An operating model this broad needs clear ownership. Options include: ■ An executive owner for intelligence, responsible for intelligence capability, data, analytics and the common operating picture.

■ An executive owner for cyber resilience, responsible for the security of corporate, operational and safety-critical systems, reporting regularly to the board. ■ A transformation program office that coordinates the pillars, manages dependencies and reports progress. ■ A cross-agency steering group with Police, Ambulance, SES and other partners, so integration is designed jointly rather than imposed.

■ Frontline and volunteer representation in governance, so the people most affected shape the changes. At a national level, existing bodies such as AFAC, NEMA, NAFC and the Bureau of Meteorology provide a foundation for common standards and shared capability. The aim should be to agree standards nationally and implement them locally, so that systems in different jurisdictions can work together without forcing everyone into the same structure.

Funding the transformation Transformation of this scale cannot be funded from operating budgets alone. A credible funding strategy combines several sources: ■ Reprioritising existing spending, for example by integrating systems that are currently maintained separately. ■ State capital investment, justified by safety, readiness and resilience benefits.

■ National programs, including disaster resilience and preparedness funding, for capabilities with national benefit. ■ Shared investment with other agencies and jurisdictions, so common platforms are built once and used many times. ■ Partnerships with industry and research, for trials, test facilities and surge capability.

Investment cases are strongest when they are built on evidence from pilots, framed in terms of lives protected and risks reduced, and honest about ongoing costs such as maintenance, licences, security and skilled staff. The workforce of the future The intelligence-driven fire service will still depend on firefighters, volunteers and incident managers. Their skills will remain at the heart of the organisation.

But they will be joined by new roles and new skills: ■ Intelligence analysts who turn data into assessments and forecasts. ■ Data and geospatial specialists who build and maintain the information foundations. ■ Remote pilots and robotics operators who run autonomous systems.

■ Digital twin modellers who simulate scenarios for planning and exercises. ■ Cyber security specialists who protect the systems everything depends on. ■ Human factors and safety specialists who design systems and procedures around how people actually work.

Many of these roles can be filled by developing existing staff and volunteers. Clear career pathways, partnerships with universities and TAFE, and recognition of skills that volunteers bring from their working lives will all help. What the model means for partner agencies The operating model is written from a fire service perspective, but it only works if partners benefit too.

■ Police gain earlier, shared predictions of fire and flood to plan evacuations, road closures and traffic management, and a single picture of where crews and resources are. ■ Ambulance services gain visibility of where demand is likely to surge, which health and aged care facilities are at risk, and which routes are safe for crews and patients. ■ SES units gain shared rostering and fatigue visibility for members who also serve with fire brigades, and integrated flood intelligence linked to fire and storm information.

■ Local government gains better information for evacuation centres, community recovery and local planning, and a clearer role in the shared picture.

■ Utilities and transport operators gain early warning of threats to power, water, telecommunications and roads, and a channel to share their own status with emergency services. ■ The Bureau of Meteorology and research partners gain richer feedback on how forecasts and models perform in real events. Each partner also contributes data, expertise and capability.

Agreements that set out what is shared, why, and under what protections are the practical foundation of integration. Data: the pillar beneath the pillars Every pillar depends on data. Intelligence needs it to see.

Operations centres need it to coordinate. Safety by design needs it to verify controls. Readiness reporting needs it to be honest.

Autonomous systems produce and consume it in large volumes. A data strategy for the intelligence-driven fire service should cover: ■ Standards: common definitions and identifiers for incidents, resources, people and places, agreed nationally where possible. ■ Integration: connecting core systems so information is entered once and used many times.

■ Quality: clear ownership for keeping critical data accurate, especially volunteer availability, qualifications and appliance status. ■ Access: role-based access, so people see what they need and no more. ■ Protection: classification, encryption, sovereignty and retention rules, with particular care for personal and health information.

■ Use: analytics, modelling and AI built on trusted data, with results fed back to improve the data itself. Handling compound events Compound events, such as fire followed by flood, or heatwave combined with power outages, test every part of the operating model. They strain resources, fatigue the workforce and create hazards that cross agency boundaries.

The model handles them through: ■ Multi-hazard intelligence that looks ahead across hazards, not just at the current event. ■ Integrated operations that coordinate fire, flood and health responses in one picture. ■ Fatigue management across agencies, because the same people often serve in several roles.

■ Readiness planning that anticipates the second event while managing the first. ■ Digital twins that model the combined effects, such as debris flows on burn scars or evacuation routes affected by both fire and flood.

The community in the operating model An operating model for emergency services is not just about agencies. Communities are the first responders to many emergencies, the source of much of the information agencies rely on, and the people every warning is designed to protect. An intelligence-driven fire service treats the community as a partner: ■ Community reports as intelligence.

Calls, app reports, photos and social media posts are valuable signals when they are verified and fused with other data. ■ Warnings people can act on. Timely, specific and accessible warnings, in multiple languages and formats, through every channel people use, including AusAlert, agency apps, radio and social media.

■ Local knowledge. Long-time residents, Traditional Owners, farmers and local businesses know their country. Their knowledge should inform planning and preparedness.

■ Cultural burning and land management. Partnerships with First Nations communities on fire management bring knowledge built over thousands of years into contemporary practice. ■ Community-led preparedness.

Programs that help households and neighbourhoods plan, prepare and support each other. ■ Transparency. Being open about how data is collected and used, and how autonomous systems and AI are governed, builds the trust that makes everything else work.

Responsible AI in the operating model AI appears throughout the operating model: in detection, fusion, prediction, rostering, damage assessment and decision support. To use it responsibly, agencies need: ■ A clear policy on where AI may and may not be used, consistent with national guidance such as the Australian Government's Voluntary AI Safety Standard and the Digital Transformation Agency's Policy for the responsible use of AI in government. ■ Human accountability for every AI-influenced decision.

■ Testing against extreme and novel conditions, not just past events. ■ Transparency for users about what models do, how confident they are and their known limitations. ■ Monitoring in operation, to detect when a model's performance drifts.

■ Security against data poisoning, manipulated inputs and leakage of sensitive information. Working across jurisdictions Fires and floods don't respect borders, and neither does the workforce. Interstate and international deployments are now routine during major events.

The operating model must work across jurisdictions as well as within them: ■ Common data standards so resources, incidents and intelligence can be shared without manual translation. ■ Interoperable systems that allow deployed crews to see the host jurisdiction's picture and be tracked by it. ■ Mutual recognition of qualifications, including new roles such as intelligence analysts and remote pilots.

■ Shared national capability, such as detection networks and aviation, built once and used by all. ■ Consistent security standards, so connecting systems across jurisdictions doesn't create weak links.

National bodies already coordinate much of this. The next step is to extend that coordination from equipment and people to data and systems. Lessons from transformations that struggled Large public sector technology programs have a mixed record, in Australia and overseas.

The UK's Emergency Services Network, a program to replace police, fire and ambulance radio communications, is a well-known example of a program that experienced years of delay and significant cost growth. The lessons from programs like it are consistent: ■ Ambition outran delivery capability. Programs tried to do too much at once, with immature technology.

■ Users were consulted too late. Systems were designed without enough input from the people who would rely on them. ■ Dependencies were underestimated, particularly on networks, data and other programs.

■ Governance was unclear, with too many decision-makers and too little accountability. ■ Fallbacks were not planned, leaving organisations exposed when timelines slipped. The roadmap in this article is designed to avoid these traps: start small, prove value, involve users throughout, sequence dependencies carefully, and keep existing capabilities running until new ones are proven.

A practical roadmap From connected to intelligence-driven. Source: Darren Covington Horizon 1 (0–2 years): Connect and learn ■ Integrate weather, satellite, geospatial, CAD and workforce data into the common operating picture.

■ Pilot AI-assisted detection, incident fusion and fatigue-aware rostering. ■ Introduce critical control management and leading safety indicators. ■ Expand drone programs for reconnaissance and mapping.

■ Pilot an integrated frontline app for volunteers and staff, with satellite terminals on priority appliances and command vehicles. ■ Uplift cyber maturity against the Essential Eight and segment operational technology. ■ Establish a single view of fleet, aviation, facility and inventory readiness, starting with telematics on priority appliances.

■ Build partnerships with Defence, mining, energy and research organisations. Horizon 2 (2–5 years): Predict and protect ■ Establish integrated operations centres across agencies. ■ Deploy predictive fire, flood and storm impact modelling operationally.

■ Roll out live crew tracking, critical control verification and exposure monitoring. ■ Introduce predictive maintenance across ground fleets, with aviation availability forecasting and condition monitoring of critical facilities. ■ Move to whole-of-life purchasing, common specifications and shared inventory across agencies.

■ Build secure digital twins of high-risk communities. ■ Scale BVLOS drone operations with integrated airspace management. ■ Implement zero-trust architecture and 24/7 security monitoring across agencies.

Horizon 3 (5–10 years): Optimise and transform ■ Run national, cross-jurisdictional intelligence and resource management, including national visibility of appliances, aircraft and critical stock. ■ Deploy autonomous and optionally piloted systems for suppression, resupply and hazardous tasks. ■ Embed continuous learning, with every event improving models, doctrine and training.

■ Run a fully intelligence-driven, multi-agency, secure-by-design operating model. Dependencies and sequencing Some parts of the roadmap depend on others, and getting the order right avoids wasted investment: ■ Data before AI. Predictive models and AI tools need integrated, trusted data.

Invest in data foundations first. ■ Security before connection. Connect systems only after the basics of cyber security are in place, or build them in at the same time.

■ Critical controls before live monitoring. Decide which controls matter and what "working" means before investing in technology to verify them. ■ Procedures before autonomy.

Airspace management, privacy rules and autonomy levels should be agreed before drone and robotics programs scale. ■ People throughout. Training, consultation and new roles must keep pace with technology at every stage.

An illustrative season under the new model The following scenario is illustrative. Before the season. The leading indicator dashboard shows training, maintenance and communications gaps, which are fixed by October.

A wargame of a Catastrophic day with Police, Ambulance, SES and utilities identifies a weakness in evacuation coordination, which is addressed. A cyber exercise tests manual dispatch, and backups are restored successfully. Early summer.

Dry lightning starts several fires. The intelligence cell fuses satellite, camera and lightning data within minutes and ranks the fires by risk. Crews and aircraft are pre-positioned with fatigue and qualifications checked automatically.

Drones monitor fire edges overnight. Mid-season. A large fire threatens two towns.

The integrated operations centre coordinates evacuations with Police, moves ambulances to support an aged care facility, and keeps power companies informed. Critical control monitoring alerts a crew that its escape route is at risk, and it moves before the fire arrives. Late season.

Heavy rain falls on burn scars. Digital twin modelling of debris flows, prepared earlier in the season, guides SES pre-positioning and early warnings. After the season.

After-action reviews draw on data from every system. Models are updated, procedures are improved and the leading indicators for next season are set. The season is still dangerous and demanding.

But information moves faster, crews are better protected, agencies work as one, and the organisation learns continuously. What success looks like in ten years If the roadmap is delivered, an Australian fire service in ten years' time could look like this: ■ Every significant ignition is detected and assessed within minutes, day or night. ■ Incident controllers, Police, Ambulance and SES work from one live picture, across jurisdictions.

■ Crews' escape routes, communications and fatigue are monitored continuously, and they are warned before conditions become untenable. ■ Appliances and aircraft are available when needed because their condition is known and maintained in advance. ■ Machines do much of the most dangerous work, with people firmly in command.

■ Communities receive timely, specific warnings and trust them. ■ Critical systems keep working through cyber attacks, outages and the event itself, and fall back safely when they can't. ■ Every event makes the system smarter.

None of this is science fiction. Every element exists somewhere today. The task is to bring them together, securely, for Australian conditions.

Leadership is the real enabler The technologies described in this series are proven or maturing. The industries we've looked at show that the hardest part isn't the technology. It is leadership, culture, governance and sustained investment.

Defence learned through conflict. Mining learned through the pursuit of safety and productivity in remote, harsh conditions. Oil and gas learned through tragedy.

Fire services have the chance to learn from all three without paying the same price. What leadership looks like The leaders who will make the intelligence-driven fire service real share some common behaviours: ■ They set a clear direction and explain why it matters, in terms of lives protected and communities supported. ■ They invest in foundations, such as data, security and people, even when visible equipment would be easier to announce.

■ They build coalitions across agencies, jurisdictions, industry and the community. ■ They listen to the frontline and adjust when something isn't working. ■ They model a learning culture, treating failures in pilots as information rather than embarrassment.

■ They stay the course through budget cycles and leadership changes, embedding the model so it outlasts any one person. Eucalypts regrowing months after a bushfire. Recovery and renewal are part of the Australian landscape, and of our emergency services.

Source: Photo by David Clode, Unsplash Measuring the transformation Progress should be measured across all five pillars and the foundation, and reported to executives and boards: ■ Intelligence: time to awareness and time to decision on significant changes. ■ Integration: partner agencies contributing to and using the common operating picture. ■ Safety: critical control verification, leading indicator trends, near-miss reporting and serious injuries.

■ Operational capability: availability of crews, appliances, aircraft and critical facilities on high-risk days, and critical stock held against target. ■ Teaming: hazardous tasks done by machines, and airspace safety.

■ Cyber resilience: Essential Eight maturity for critical systems, time to restore in exercises, and degraded-mode readiness. ■ People: workforce and volunteer engagement with the changes, and retention. Questions for boards and executives ■ Which of the five pillars is our strongest, and which is our weakest?

■ On our worst day, how much of our operational capability (crews, appliances, aircraft, facilities and stock) would actually be available? ■ Who owns intelligence and cyber resilience at executive level, and how do they report to the board? ■ Is our investment sequenced so that data and security come before advanced tools?

■ How are career staff, volunteers, unions and partner agencies shaping the changes? ■ If a major cyber incident hit during our worst fire day, how would we keep people safe? Risks to the transformation, and how to manage them ■ Change fatigue.

Staff and volunteers who have experienced many reforms may be sceptical. Keep the focus on a few clear benefits, and deliver them visibly. ■ Technology over people.

Investment can drift towards equipment and platforms at the expense of skills and culture. Fund people and training explicitly. ■ Vendor lock-in.

Buying proprietary platforms without open standards can make future integration expensive. Require open standards and data portability. ■ Security debt.

Connecting systems quickly without security creates risks that are expensive to fix later. Build security in from the start. ■ Loss of momentum.

Leadership changes and budget cycles can stall programs. Embed the operating model in strategy, governance and performance measures so it outlasts individuals. ■ Cross-agency friction.

Different priorities and cultures can slow integration. Invest in relationships, joint governance and shared wins. What leaders should do next ■ Adopt the five pillars as the frame for your next strategic and investment plan.

■ Appoint an executive owner for intelligence, and another for cyber resilience, with board-level reporting for both. ■ Fund Horizon 1 now: data integration, critical controls, fatigue science, drone trials and Essential Eight uplift. ■ Build the coalition: Police, Ambulance, SES, Defence, industry and neighbouring jurisdictions.

■ Bring your people with you: co-design with career staff, volunteers and unions from the start.

Climate extremes are already here. Our communities, our firefighters, our paramedics, our police and our SES volunteers deserve emergency services that use the best available intelligence, technology and safety thinking from every sector, and that are secure enough to rely on when everything else is failing. The question for every leader in emergency management is no longer whether to become intelligence-driven, but how fast, and how securely.

Glossary ■ Common operating picture: a shared, real-time view of an event that all agencies can see. ■ Critical control: a control crucial to preventing a fatal event or reducing its consequences. ■ Digital twin: a virtual model of a place or system, fed by live data, used for simulation and planning.

■ Essential Eight: the Australian Signals Directorate's baseline set of cyber security mitigation strategies. ■ Leading indicator: a measure that gives early warning that risk is increasing. ■ Mission command: a style of command based on clear intent and trust in teams to decide how.

■ Zero trust: a security approach in which no user, device or data feed is trusted by default. Further reading ■ Royal Commission into National Natural Disaster Arrangements, Report (2020). ■ 2009 Victorian Bushfires Royal Commission, Final Report (2010).

■ International Council on Mining and Metals, Health and Safety Critical Control Management: Good Practice Guide (2015). ■ The Hon Lord Cullen, The Public Inquiry into the Piper Alpha Disaster (1990). ■ Australian Signals Directorate, Essential Eight Maturity Model.

■ AFAC, Australasian Inter-service Incident Management System (AIIMS). Thank you to everyone who has engaged with this series. I'd welcome your thoughts, challenges and examples from your own organisations and industries.

#EmergencyManagement #FireServices #Intelligence #CyberSecurity #Defence #Mining #OilAndGas #Autonomy #DigitalTransformation #ClimateResilience #Leadership #Australia #ResponsibleAI Darren Covington writes on intelligence-driven emergency services, climate resilience, technology and cyber security in Australia. Photo credits: Darren Covington; David Clode / Unsplash. Unsplash photos are used under the Unsplash Licence.

Other photos and graphics © Darren Covington.