Most of the help will not be from here.
A national crisis is not your service having a bad day. It is your service reinforced by hundreds of people who have never worked your area, under a command structure that existed only on paper until that morning.
Every plan assumes they arrive knowing things they cannot know.
Mutual aid works. It is the reason a region can face something far larger than itself and keep functioning. What it cannot carry on its own is the local knowledge the plan quietly assumes: which road floods first, which building holds the residents who cannot walk, who is already working the north side, and who has the authority to say so.
This is not only our reading of it. The Netherlands Institute for Public Safety evaluated how the National Rescue Fleet, the volunteer rescue organisation called on during the July 2021 floods, was alerted and sent in. On alerting, its report carries this:
Several people we spoke to felt that, because the request for assistance was so long in coming, the units had to act headlong, without having information about the area they would encounter or the facilities that would be there for them.
A crew sent two hundred kilometres is fully trained and entirely unfamiliar. Everything they need to know is held by the people who are, that morning, the busiest in the country. So the questions go out over a radio net that is already saturated, and the local organisation spends its scarcest hour explaining its own area instead of running it.
When the tools do not span the agencies, the agencies improvise a tool that does. A group chat. A shared spreadsheet. A map printed at seven in the morning and marked up by hand all day. It works, which is exactly the problem. It becomes the operational picture, it ends up holding the addresses of vulnerable residents, nobody governs it, nothing in it is logged, and it stops when somebody's phone does.
One picture, three altitudes.
A crisis is run at three heights at once, and the usual result is three separate versions of what is happening: a briefing deck, a coordination tool, and whatever is being said on the radio. They drift apart within the hour, and the work of reconciling them falls to the people who should be deciding.
The picture the board and the mayor decide on, and the record of how those decisions were made. The same record is what answers the evaluation months later.
The picture the crisis team coordinates on. Tasks, areas, units, media and messages against one map, so the team spends its time on the decision rather than on assembling the situation again for every new person who walks into the room.
The picture in the vehicle and in the hand of someone who is not from here. The same incident, the same map, the same hazards and access points, on the device their own service issued them.
The same picture at three altitudes. Not three systems.
The alternative to sharing nothing is not sharing everything.
Services do not withhold information because they are obstructive. They withhold it because almost every tool they are offered is all or nothing: grant a partner agency access to the incident and they get the patient, the caller, the address and everything else along with it. So the honest answer in daily operation is to share nothing, and the answer under pressure is to share everything through a channel nobody governs. Both are decisions the platform forced.
An incident can cross the discipline boundary while the patient information inside it stays hidden, or is shown anonymised. Personal identifiers in message content are masked in the same way, including national identity numbers, phone numbers and dates of birth. Hiding and anonymising are two separate settings, held per profile, and the customer decides both.
The platform reads the declared escalation level from your control-room system and carries it on the incident. A profile can be scoped to crisis incidents, so what a crisis team is able to reach has no bearing on what anybody sees on an ordinary Tuesday. Widening access stays an act your organisation performs: a profile you configure and assign, on your authority, at the moment you choose.
Training, reconnaissance and surge incidents carry their own access scopes, separate from live incidents. That separation is what makes the sharing model rehearsable at all: a region can put its partner agencies through the whole arrangement and touch nothing operational while it does.
A profile is built from the dimensions your organisation already works in, so the rule you write is the rule your people would recognise:
What arrives with the reinforcement.
None of this is a crisis product. It is the platform your service already runs, carrying more people, more agencies and more ground than it does on a normal week.
The field picture in the hand of someone who is not from here.
The room.
The data you already hold, made usable during a live incident.
Asking the picture a question instead of hunting for the answer.
Surge coordination.
Exercising all of it before the day.
The crews who came to help knew the ground better than the region they came to help.
In July 2021 both Limburg safety regions scaled to GRIP 4, and assistance from other safety regions filled key roles inside the crisis organisation itself. Both of those are on the public record. See the sources
What follows is LIVEOP's own account rather than the public record. Several of the safety regions that sent assistance were running LIVEOP at the time. The region they were assisting was not. So the units that arrived held more information about the flooded area than the organisation they had come to reinforce.
No new system on the worst day.
Crisis software has a particular failure mode. It is bought for the worst week of a decade and then sits unused for the rest of it. On the morning it is finally needed it is operated by people who have logged into it twice, one of whom is on holiday. The training was three years ago, the version has changed since, and nobody is sure who still has an account.
The transfer gap is well understood for a single crew: people perform under pressure with the tool they trained on, and a tool they only meet under pressure is a tool they are learning while it matters. At national scale it is the same law with several thousand more people inside it. On the day, nobody reads a manual and nobody learns an interface. What scales is familiarity, and everything else has to be acquired in the first hour, which is the hour you have least of.
So readiness becomes a property of the platform your service already runs. The same login, the same map, the same incident, the same gestures, at a hundred times the volume and with people you have never met on the other end of them.
The crisis picture is the operational picture your people already work in every shift. There is no crisis mode to remember, and no second interface that only exists in the exercise.
Continuous upgrades, never a migration. There is no dormant crisis edition to activate, no separate release to keep current, and no licence that has to be found on the day. What your service ran last week is the current version.
When the region next door runs the same platform, the crew it sends you has been trained on it by its own service, on its own time, for years. Mutual aid then begins with the work rather than with a tutorial, and that is the whole return on preparedness.
Run the exercise first. Change nothing else.
The lowest-risk way into this is a multi-agency exercise. Training incidents carry their own access scopes, separate from live incidents, so the crisis profiles, the sharing rules and all three altitudes can be worked through on incidents that are not real, with your partner agencies in the room, while the live operation continues untouched beside it. The output is your own written answer to the question of who sees what once the escalation is declared, produced by your own people, in advance of the day they need it.
The version to forward
When a crisis crosses our boundary, most of the people working it will not be ours, and our plans assume they arrive knowing our area. LIVEOP is the layer that puts arriving units and our own crisis team on the same picture, with sharing governed per profile, so an incident can cross an agency boundary while the patient information inside it stays hidden or anonymised. Our people still make every decision, and widening access remains something we configure and assign on our own authority. We can prove the whole arrangement in a multi-agency exercise first, on training incidents that are separate from live, so nothing about our daily operation changes while we evaluate it.
Sovereignty belongs in the same conversation, because a national crisis is the moment a jurisdiction most needs this layer under its own control.
Bring us the scenario you have not exercised.
The flood everyone has talked about and nobody has run. The evacuation that crosses two regions. The week where half the people working your incident report to somebody else. Bring it, and we will work through who sees what, at which altitude, from the moment it is declared.