THERMAL DRONE OVERWATCH · FIRE & RESCUE · UNITED KINGDOM

First on scene.
Before the crew.

When a 999 fire call drops, a service’s own drone, launched fast enough, can reach the address ahead of the appliances — streaming live thermal overwatch to the incident commander. Warden is the governance software designed to sit alongside that flight: a named person’s authorisation on the record, and a head start on the assessment the service’s data protection officer (DPO) completes.

See how it works ↓

WARDEN · DFR OVERWATCH · PRE-PRODUCTION

DetectLaunchOverwatchAccount

51.5074° N · 0.1278° W · --:--:-- UTC

Why we built it01 / 10

A fire crew rolls to a 999 call knowing an address and little else. The minutes that decide how the fire ends are lived without a picture. The service’s own drone can put eyes over the scene, and Warden keeps that flight on the record — so the crew arrives already knowing what it is walking into.

Built as

Software

The drone is the service’s own, flown by its own pilots. Warden is the authorisation and accountability layer that sits alongside it.

The wedge

Sign-off

The blocker to flying a camera over the public isn’t the aircraft. It’s a data-protection officer being able to sign it off.

Bound by

The record

A named person’s authorisation goes on the record before launch, and each decision is written to a hash-chained log. Warden records the decision to launch; it cannot stop one.

How it works02 / 10

From a 999 call to
eyes overhead — on the record.

When a fire is reported, the first minutes shape the outcome. The service’s own drone can put thermal overwatch over the scene, and Warden puts the decision to fly, and what follows, on the record — so the ground crew arrives already knowing what it is walking into.

DFR // STATION-04

THERMAL OVERWATCH · AUTHORISED

T+00:38 · ON SCENE · 2 APPLIANCES INBOUND

Incident record

The incident is opened in the console

When a 999 call comes in, an incident is opened in Warden and its first entry is written to the hash-chained record. Airspace and permission to fly stay with the service and its own Civil Aviation Authority (CAA) arrangements.

999 incidentnamed authorisationhash-chained record

The service’s aircraft

The service’s drone launches

The service’s own drone — flown by its own trained pilot, or launched from a dock the service runs — lifts off as it would today. Warden puts a named person’s authorisation on the record before launch. It records the decision to launch; it cannot stop one. No dock connection is built yet.

Service-owned aircraftpilot or docknamed authorisation

The ingest

Telemetry streams into the console

Position, battery and altitude arrive over a MAVLink → WebSocket bridge, thermal video over RTSP (Real-Time Streaming Protocol) — into the common operating picture the whole response shares. Warden’s software sends nothing back. So far the bridge has been tested only against ArduPilot’s simulator, and the video only with a test stream.

MAVLink → WebSocketsends no commandsimulator-tested

Commander dashboard

Thermal overwatch, before boots

The incident commander watches the thermal video over encrypted WebRTC: eyes over the scene before the first appliance arrives, and one picture the whole response can act on.

WebRTCencryptedthermal

<0s

Dispatch to airborne target

A design target; the real figure depends on the service’s own aircraft and pilot, and is not measured by Warden.

<0ms

Thermal video latency target

A design target over WebRTC; not yet measured with a real aircraft.

One incident per 999 call

Opened in the console; no computer-aided dispatch (CAD) feed is connected.

None

Commands sent to the aircraft

Warden’s software has no function that sends anything to the aircraft.

Figures are design targets, not measured performance. Warden is pre-production and not deployed at any service; no real aircraft has been connected to it.

Airframe-agnostic03 / 10

Designed for the drone
you already fly.

Warden isn’t a drone — it’s the authorisation-and-accountability layer that sits downstream of one. Its software sends nothing to the aircraft, so in principle it can work with any platform that can hand it two feeds: live thermal video, and telemetry. So far that has been tested only with ArduPilot’s simulator and a test video stream.

Open-stack

Native (MAVLink)

Anything on ArduPilot or PX4 speaks MAVLink — the protocol Warden’s telemetry bridge reads. Paired with a standard RTSP video feed, that is the shortest route in. So far the bridge has been tested only against ArduPilot’s simulator.

ArduPilot · PX4

SDK / closed

Adapter

Aircraft with their own software development kit (SDK) or cloud application programming interface (API) — including DJI, which many UK services fly — or a Drone-in-a-Box would connect through a per-vendor adapter that maps their video and telemetry onto the same contract. No DJI or dock adapter is built yet.

Per-vendor adapter · not built

One-way

Read-only, downstream

Video and telemetry flow in. Warden’s software has no function that sends anything out, so it never arms, steers or lands the aircraft. In an installation the connection it reads from would also be set to receive only; that set-up is not built or tested yet, so it belongs in the service’s own safety assessment.

Sends no command

Route in

Inside the kit you already buy

UK fire services fly their own drones, bought through suppliers they already use. Warden is designed to travel inside that supplier’s offering, not to ask the service to take on a new supplier.

Through existing suppliers

How integration works, for suppliers →

The aircraft04 / 10

A typical drone,
and where Warden sits.

A typical thermal drone sends its video, telemetry and C2 (command and control) to the ground over one encrypted link. In principle Warden would read a copy of the thermal feed and the telemetry at the ground station, with no change to the aircraft; it has not been connected to a real one. Here is that idea on one sheet, drawn as a generic multirotor rather than any particular product.

Illustrative: a typical multirotor, not a specific product, and not a chosen or partner aircraft. No relationship with, partnership with, or endorsement from any manufacturer or fire and rescue service; Warden has not been connected to a real aircraft.

The operating picture05 / 10

One console.
The whole incident.

Thermal overwatch, the incident data, a human-in-command authorise gate and the live hash-chained record — the view an incident commander would run it from. This is a glimpse; the full working prototype is one click away.

Open the console demo → Read a callout, minute by minute →

The lawful-use test06 / 10

“Lawful” isn’t a claim.
It’s a test.

A camera in the sky is only welcome if it stays inside the law. So we wrote the line down as an illustrative test each tasking can be checked against — four gates: a lawful basis, a human in command, a proportionate and targeted purpose, and a record you can answer for. One failure is a refusal; the decision to fly, and the flying, stay with the service.

Select a tasking request

Four gates · lawful basis · human command · proportionate · accountable

THE GATE · LAWFUL-USE TESTILLUSTRATIVE

Illustrative only — example requests, not real taskings. This four-gate check does not run in Warden’s software; the console records one flight authorisation per incident.

UK data protection07 / 10

Governance,
designed in.

Flying a thermal camera over homes is personal-data processing. So governance isn’t a policy PDF bolted on afterwards — it’s designed into the software, and each decision is written to a hash-chained record. This is the posture the product is designed to; the lawful basis is the service’s to decide, and its data protection officer (DPO) completes and owns the full data protection impact assessment (DPIA).

Lawful basis

Proposed: public task

Warden proposes public task under Art 6(1)(e) of the UK General Data Protection Regulation (UK GDPR) — a statutory fire & rescue function — for imagery that may include people; the lawful basis is the service’s to decide. Vital interests (Art 6(1)(d)) is the narrow fallback in an acute life threat. Any casualty or health signal would be special-category data; the service’s data protection officer decides the Article 9 condition, and the Art 9(2)(c) vital-interests condition is one candidate.

UK GDPR Art 6 & 9 · Data Protection Act 2018

Hard red line

No facial recognition. Ever.

Overwatch assesses a scene, never identifies a person. No facial-recognition or biometric-matching model is integrated, and the architecture is designed so it cannot be added without a governance change. Bystanders are minimised, not recognised.

Data minimisation · Art 5(1)(c)

DPIA

Assessed before it flies

Systematic monitoring of a publicly accessible area on a large scale requires a Data Protection Impact Assessment (Art 35(3)(c)); whether a deployment meets that test is the data protection officer’s call. Warden provides a starter DPIA; the deploying service’s data protection officer completes, signs and owns it before day one.

UK GDPR Art 35 · ICO guidance

Not covert surveillance

Overt, incident-linked only

Overt, incident-linked emergency use generally falls outside the directed-surveillance regime of the Regulation of Investigatory Powers Act 2000 (RIPA) — covertness is assessed case-by-case. The system is designed for overt, incident-triggered use only, and Article 8 (Human Rights Act 1998) necessity and proportionality apply to every flight regardless.

RIPA 2000 (Part II) · HRA Art 8

Retention & disclosure

Live-only by default

Overwatch is designed to be live-only by default — no footage is recorded unless a commander explicitly authorises recording. Recorded footage is retention-bound and designed to be deleted when the window ends, unless lawfully held as evidence (fire investigation, coroner, litigation); that scheduled deletion is not yet switched on. Subject-access, Freedom of Information (FOI) and disclosure requests are designed to be handled with a full access trail.

Storage limitation · Art 5(1)(e)

Data residency

Hosted in Ireland today

Role-based access is built. Designed to be encrypted in transit and at rest, with no third-party data sharing. The backend runs in Ireland (eu-west-1), not the UK. It has not been independently security-assessed.

eu-west-1 · Ireland

See the governance designed into the console → The starter DPIA your data protection officer completes → The whole flow on one picture — callout to sealed record →

Radical accountability08 / 10

Every decision,
on the record.

Every incident leaves a trail: who opened it, who authorised the flight, each hazard flagged, any purge of imagery and the seal. Each entry is hash-chained to the one before it with SHA-256, which needs no key, and signed with Ed25519 under Warden’s published key, so anyone holding an export can check it without Warden; a named person’s authorisation goes on the record before launch. Below, edit a line and watch the chain break. Events up to the latest time-stamped anchor (one whose token verifies) also carry an outside RFC 3161 time-stamp, so they cannot be altered undetected after that time-stamp; the newest events are not covered until the next anchor.

Incident record Structure fire · Kiln Road · 06:12–06:24 Sealed

06:12:04 999 call receivedStructure fire, persons reported · Kiln Road recorded byWatch manager ········

06:12:41 Flight authorisedCommander’s decision recorded · overt response decided byWatch manager ········

06:13:02 Drone airborneService aircraft · en route to scene recorded bySystem ········

06:13:20 Recording authorisedOpt-in — live-only until now · retention 31 days · no facial recognition decided byWatch manager ········

06:14:55 Hazard flaggedGas cylinder detected · flagged to the incident commander decided byWatch manager ········

06:21:10 Return to baseOverwatch complete decided byWatch manager ········

06:24:30 Record sealedRetention window 31 days recorded bySystem ········

Each line’s hash is computed from its content plus the hash before it — SHA-256, in your browser, right now. Change anything above and every hash from that point on stops matching.

A synthetic incident record, written for this page; the flight, people and data are illustrative. The deployed record applies the same idea, a keyless SHA-256 chain, to the full event, and also signs each link with Ed25519, which this page does not show.

Don't trust us — read how verification works, and what's deployed vs designed →

Red lines09 / 10

What this will
never do.

A camera over the public earns its place by what it refuses to do. These are the limits Warden is designed around — part of the design, not promises left to a policy document. Some are in the built software today; others, such as scheduled deletion, are designed but not yet switched on.

It will never run facial recognition.

No facial-recognition or biometric-matching model is integrated. Overwatch assesses a scene, never identifies a person — and the architecture is designed so it can’t be added without a governance change.

It will never fly covert surveillance.

Overt, incident-linked use only. Covert directed surveillance belongs to RIPA and a separate authorisation regime; that is not what this is built for.

It will never keep footage “just in case”.

Imagery is designed to be deleted after a set retention window unless lawfully held as evidence; that scheduled deletion is not yet switched on. Storage limitation, by design — not indefinite retention.

It will never sell or share the data.

Imagery is the service’s. No third-party data sharing. The backend runs in Ireland (eu-west-1), not the UK.

It will never remove the human from the launch.

A named person’s authorisation goes on the record before launch. A person decides; Warden records that decision, and it cannot stop a launch.

These commitments describe how Warden is designed. Warden is pre-production and not yet a registered company, so they are not contractual undertakings.

Hard questions10 / 10

The questions we
refuse to dodge.

Q 01Does this replace fire crews?

No. It gets a picture to the crew faster. The appliances and firefighters still respond exactly as they do now — the incident commander just isn’t blind for the first minutes.

Q 02Who actually flies the drone?

The fire and rescue service does, as it does today: its own aircraft, its own trained pilots and its own Civil Aviation Authority (CAA) permissions. Warden is the software layer — the operating picture, the governance and a hash-chained record — not the drone or the pilot. Its software sends no command to the aircraft.

Q 03Is it legal to fly a camera over people’s homes?

Only under a lawful basis, a signed data protection impact assessment (DPIA) and strict proportionality. The lawful basis is the service’s to decide — Warden proposes public task — and the DPIA on this site is a starter that the service’s Data Protection Officer completes and owns. See the governance section — this is illustrative design intent, not legal advice.

Q 04Does it use facial recognition?

No — and the architecture is designed so it can’t be added without a governance change. It assesses a scene, never identifies a person. Bystanders are minimised, not recognised.

Q 05Is Warden actually a company?

No — Warden is not yet a registered company. It is pre-production: a working system, built and testable, with no customer, partner or pilot project, and not deployed at any fire & rescue service. Its route to a service would be inside the offering of a supplier the service already uses (for suppliers). We publish exactly what is and isn't in place on the status page, gaps included.

Talk to us

Get eyes on the fire
sooner.

For the suppliers who equip UK fire & rescue drone units, researchers, and anyone working to reach the scene better: try the console, then let’s talk.

Channel 01 // Suppliers Drone, dock & training suppliers Already equipping fire & rescue drone units? How Warden could travel inside your offering. Channel 02 // The console Try the prototype The interactive overwatch console demo — synthetic data, nothing to install. Channel 03 // Disclosure Responsible disclosure Found a weakness? A safe-harbour path to report it, in confidence. Channel 04 // Press Media enquiries Briefings and comment for journalists and researchers.

Pre-production · not yet a registered company · route in through existing suppliers

The watchword

Human, in command, always.

A person decides every flight. Warden records the decision.

First on scene.Before the crew.

From a 999 call toeyes overhead — on the record.