Issue 018: A Fire District Sues Its IT Vendor, AI Population Maps For IC, And Pennsylvania's First Aerial Ignition
Issue 018 - June 30, 2026
Read time: 9 minutes
This week: a Louisiana fire district is suing its own cybersecurity vendor over a breach that exposes the exact failure pattern thousands of departments are paying for right now. Plus Carnegie Mellon and Meta partner to give incident commanders real-time population maps during wildfires, the NVFC research that explains why half the country does not know they can volunteer, Pennsylvania's House passes $30 million in fire grants with a regionalization bonus, NIST builds an AI evacuation model that rewrites exit routes as a fire spreads, and the Allegheny National Forest pulls off its largest prescribed burn on record using aerial ignition for the first time.
Deep Dig · Cybersecurity
A Louisiana Fire District Just Sued Its Own IT Vendor For Leaving The Network Open While Hackers Were Living Inside It
St. George Fire Protection District No. 2 in Baton Rouge filed suit May 23 against General Informatics LLC, its contracted cybersecurity firm, alleging the company failed to prevent a December 2023 network intrusion and then continued using known-compromised credentials on other client networks after law enforcement flagged the breach in November 2023. The suit, covered by GovTech, alleges hackers were "living off the land" inside the fire district's network: using legitimate built-in tools to evade detection while staging for a future ransomware lockout. Law enforcement discovered the same compromised vendor credentials had also granted access to a second East Baton Rouge agency that coordinates CAD between the parish and St. George. The hackers had a foothold in two interconnected emergency systems simultaneously.
Specific failures named in the suit read like a vendor negligence checklist: no server backups were performed despite being contractually required, the network firewall was not logging certain activity, the network lacked segmentation to limit malware spread, and administrative credentials were stored in plain text. Critically, General Informatics used the same username and password for its remote access tool across all its clients - and after law enforcement notified the firm in November 2023 that those credentials were compromised, General Informatics continued using them on the St. George network for another month until law enforcement formally disclosed the breach to the fire district on December 23. A judge hearing on the firm's motion to push the dispute into arbitration is set for July 13 in the 19th Judicial District Court. Per Public Safety Threat Alliance data, 83 percent of CAD and dispatch attacks enter through flat municipal IT networks rather than by breaching fire systems directly. The average CAD outage from ransomware runs 15 days.
The take: The failure pattern here is not a sophisticated attack. It is a commodity hack that exploited the cheapest possible vendor cut corners. Any department currently operating under a managed IT services contract should pull its contract this week and audit it against these four specific failures before this becomes your lawsuit. Ask your vendor: Are credentials unique per client? Is our network segmented? When was the last backup restore actually tested - not just scheduled? Are administrative passwords in plain text anywhere on the network? If you cannot get clear written answers, you do not have a cybersecurity vendor. You have a liability.
Read the full story at GovTech →
Technology
Carnegie Mellon And Meta Are Building A Real-Time Population Map For Incident Commanders During Wildfires And Hurricanes
Carnegie Mellon's NSF AI Institute for Societal Decision Making and Meta's AI for Good program announced a partnership June 16 to develop AI-powered situation reports for first responders managing natural disasters. The system pulls aggregated population mobility and connectivity data that Meta already collects, combines it with satellite imagery, and runs it through Meta's open-source AI models including Segment Anything, DINO, and large language models to produce visualizations an IC can read in seconds. The practical output is a tool that shows whether residents have actually evacuated a danger zone, which neighborhoods are still in the path, and when people start moving back in after the threat passes.
The partnership targets wildfire, hurricane, and severe winter storm scenarios, and the teams plan to field-test during actual disasters in 2026. NSF AI-SDM already works with state and local emergency management agencies and will share early builds with those partners for operational feedback. Finalized tools are slated for distribution through the Humanitarian Data Exchange, which means they will be free to agencies without large tech budgets rather than locked behind a vendor contract.
The take: The gap this fills is real. During large wildfire evacuations, incident commanders often have no idea whether a neighborhood has cleared until 911 calls stop or a recon crew lays eyes on it. Plugging Meta's mobility data into a real-time dashboard built by one of the top AI institutes in the country changes that calculus. The open-distribution plan via Humanitarian Data Exchange is the part that matters most for departments - this is not a vendor pitch. Watch for how it gets integrated into ICS structures and whether state OES offices start requiring it on after-action paperwork.
Read the full announcement at Carnegie Mellon News →
Recruiting
More Than Half The Country Does Not Know They Can Volunteer As A Firefighter. Almost Two-Thirds Do Not Know If Their Local Department Is Recruiting.
The National Volunteer Fire Council released a new recruitment and retention research report June 16, drawing on surveys and focus groups with prospective, current, and former volunteer firefighters. The findings put numbers on the awareness gap driving the volunteer shortage: more than half of the people surveyed do not know they can volunteer as a firefighter at all, and almost two-thirds are unsure whether their own local department is even seeking recruits. The volunteer force has dropped from roughly 827,000 members in the mid-2000s to around 635,000 by 2023, a loss of nearly 200,000 active firefighters.
Beyond awareness, the research mapped what prospective volunteers need before they will commit. They want clarity on time investment and what the day-to-day role actually looks like - not just emergency calls but training, maintenance, fundraisers, and meetings. They want assurance the department will support them through the emotional and physical demands. And once they join, they need to feel genuinely valued. Departments that prioritize formal mentorship and family engagement see meaningfully stronger retention than those relying on mission appeal alone. NVFC published a companion infographic and shared the research with FireRescue1 for distribution to department leadership.
The take: Half the potential workforce does not know the door is open. That is a marketing problem before it is a recruitment problem, and it is one departments can actually solve with targeted community outreach and a clearer ask. The mentorship and family-engagement findings are equally important - volunteers do not leave because they dislike firefighting, they leave because the department culture does not hold them. This report gives chiefs a concrete playbook and a data-backed case for investing in retention infrastructure, not just open-house events and recruiting flyers.
Read the full report at NVFC →
Funding
Pennsylvania's House Just Passed $30 Million A Year For Fire Companies, With A Built-In Bonus For Departments Willing To Regionalize
The Pennsylvania House passed House Bill 2446 on June 15 in a 105-96 party-line vote, establishing a Fire Company Transformational Grant Program that would direct $30 million annually to the state's fire companies. The bill was authored by Rep. Jim Haddock, D-Hughestown, and mirrors a proposal Gov. Josh Shapiro included in his 2026-27 executive budget. Haddock pulled it out as a standalone after the budget-embedded funding looked shaky in negotiations.
Under HB 2446, individual fire companies - municipal, volunteer, or combination - could apply for grants between $100,000 and $1 million. Departments that regionalize by combining with neighboring companies qualify for higher awards between $250,000 and $2.5 million, a deliberate financial incentive for consolidation. Eligible uses include equipment, facility upgrades, staffing costs, and recruitment. The program would be administered by the Pennsylvania Office of the State Fire Commissioner. The partisan House vote means the Senate path is uncertain. A companion effort is circulating: Sen. Michele Brooks, R-Greenville, is seeking co-sponsors for legislation that would let fire departments access Redevelopment Assistance Capital Program funds for apparatus up to $150,000, reversing a 2013 restriction.
The take: Pennsylvania's fire service has been operating on thin margins for years, and this bill acknowledges that the gap between what annual formula grants cover and what a modern department actually needs has become unsustainable. The regionalization bonus is a smart design choice - it gives smaller rural departments a financial reason to talk to their neighbors rather than go it alone. The Senate math is the real story to watch. If the bill stalls, it signals how much political will exists at the state level to fund a volunteer service that is quietly hemorrhaging members. Chiefs in other states with similar shortages should track the Senate hearing closely - the regionalization-bonus structure is the kind of mechanism that gets copied state to state once one of them passes it.
Read the full story at Times Observer →
Technology
NIST Built An AI That Rewrites A Building's Evacuation Routes In Real Time As The Fire Spreads
Researchers at the National Institute of Standards and Technology, working with academic collaborators, have developed an AI evacuation model called Safe Step that continuously redirects building occupants to the safest available exit as a fire evolves. NIST published an explainer on June 9. The model, described in the Journal of Building Engineering, uses reinforcement learning trained on fire simulation data, then operates in real time from live sensor feeds in smart buildings. Unlike traditional shortest-path evacuation algorithms that only see current conditions, Safe Step anticipates how the fire will develop in the next several minutes and steers occupants away from routes that are open now but will be cut off shortly.
Safe Step is designed to pair with dynamic emergency exit displays - a new class of electronic signage already being piloted in some buildings that can show whether an exit is safe and redirect occupants with arrows pointing to a safer route. The current version handles single-story floor plans. NIST researchers are working toward multilevel capability and a multi-agent version that accounts for many occupants moving at once. Lead researcher Hongqiang Fang estimated technologies like Safe Step could appear in real buildings in five to ten years, pending regulatory approval and integration with existing building safety systems.
The take: The interesting part of Safe Step is not the exit signs. It is the underlying model - AI that anticipates fire behavior from sensor data and updates guidance in real time. That same pattern is the early shape of decision-support tools that will eventually extend to incident command. The path from smart-building exit signs to a fireground dashboard that tells an IC which sectors are becoming untenable is shorter than it looks. NIST is doing the foundational science. The fire service should be watching what it enables downstream, especially on big-box, high-rise, and warehouse pre-incident planning.
Read the full explainer at NIST →
Deep Dig · Wildfire
The Allegheny National Forest Just Pulled Off Its Largest Prescribed Burn Ever, And It Was The First Time Aerial Ignition Has Been Used There
On April 23, the Allegheny National Forest in Pennsylvania completed its largest prescribed fire on record, treating 2,044 acres at Tracy Ridge - a site inside a designated National Recreation Area bordered by campgrounds, the Allegheny Reservoir, and stretches of the North Country National Scenic Trail. The Forest Service published a detailed operational account on June 11. The complexity of the project required years of planning and the first-ever use of aerial ignition on the Allegheny.
The aerial ignition operation used a helicopter equipped with a hopper that dispensed small plastic spheres filled with potassium permanganate. Each sphere was injected with a second compound just before release, and a chemical reaction ignited the sphere about 20 seconds after it hit the ground. The technique let the crew treat steep, hard-to-reach terrain without putting personnel on the slopes. Ground crews and a Forest Service boat on the reservoir patrolled the perimeter and monitored fire behavior. Law enforcement issued a temporary public closure for the duration given the proximity to recreational infrastructure. Tracy Ridge contributes to a broader push: in 2025 the Forest Service logged more than 1,400 flight hours collecting fire imagery nationwide and treated 134,381 acres through drone and aerial ignition combined. The agency completed more than 4,200 acres of drone-supported prescribed fire in the Northern Rockies alone in the first four months of 2026.
The take: Most of the prescribed fire conversation centers on the West. Allegheny's record burn is a reminder that the fuels problem is national and that the aerial ignition toolkit is scaling fast into regions that have never used it before. The potassium permanganate sphere system is not new, but deploying it for the first time inside a heavily-used national recreation area - with boaters, campers, and trail users in the buffer zone - required a coordination model that other eastern forests can study and copy. This is the kind of operational story that should be running in every state forester's briefing this month and is not.
Read the full feature at U.S. Forest Service →
What We're Watching
PA HB 2446 lands in the state Senate. The Senate calendar between now and the end of the fiscal year will signal whether the $30M grant program survives. Brooks's parallel RACP bill on apparatus is the secondary tell - if either advances, expect copycat funding bills in Ohio, Michigan, and New York where volunteer numbers are also in decline.
Public Safety Threat Alliance threat intel feed for CAD. The shared-credential pattern in the Louisiana lawsuit is not isolated. PSTA, the Motorola-backed sector ISAC for public safety, has been publishing tactic write-ups on managed IT vendor attacks. Worth setting up a feed if your department touches a regional dispatch system.
Eastern prescribed fire programs scaling drone and aerial ignition. The Allegheny operation is the bellwether. Forest Service regional fire shops in Region 8 (Southern) and Region 9 (Eastern) are scoping similar projects in shoulder-season windows. Departments adjacent to national forests should expect coordination meetings before fall.
Humanitarian Data Exchange as a distribution channel for first-responder AI. The CMU and Meta partnership routes finished tools through HDX, which has historically served international NGOs. If US state OES agencies start pulling situational-awareness layers from HDX, it changes the procurement conversation - free-and-open beats vendor lock-in on the budget line.
Subscribe to The Overhaul Brief
Fire service tech, AI, and innovation delivered every Tuesday.
