When Minutes Kill: ML Systems for Mass Casualty Response
12 people were killed in a Johannesburg mass shooting and a manhunt is now active. Most cities are running gunshot detection and crowd anomaly systems that were architected a decade ago. Here's what modern ML-powered public safety infrastructure actually looks like, and where it still catastrophically fails.
A mass shooting in Johannesburg killed 12 people last night. The manhunt is active. And somewhere in a city operations center, analysts are doing manually what computers should be doing automatically.
I want to talk about the systems. Because the gap between what we know how to build and what's actually deployed in cities worldwide is honestly staggering.
The Detection Problem Is Basically Solved. Deployment Isn't.
ShotSpotter (now SoundThinking) has been detecting gunfire acoustically since 1996. The modern version triangulates using time-difference-of-arrival (TDOA) across a sensor mesh, classifies audio events with a CNN trained on millions of labeled samples, and gets an alert to dispatch in under 60 seconds. The math is straightforward: if you have 3+ sensors and known coordinates, you solve a system of hyperbolic equations for the source location.
Median localization error is around 25 meters in dense deployments. That's good enough.
But here's what most people don't know: ShotSpotter's own court-submitted data showed a 97% alert rate for confirmed gunfire in covered areas. The problem isn't detection accuracy. It's coverage density. A sensor grid needs nodes every 300-500 meters in urban canyons to work. Most cities that license it cover maybe 20% of their jurisdiction.
What Real-Time Fusion Actually Looks Like
In 2021, I consulted briefly with a 3M-resident metro area building a unified dispatch platform. They had ShotSpotter feeds, CCTV with basic motion detection, CAD (computer-aided dispatch) logs, and 911 call streams. All in separate databases. Zero real-time joins. An analyst would get a ShotSpotter ping and then manually open four different browser tabs.
The architecture they needed wasn't exotic. Apache Kafka ingesting all event streams. A Flink job doing temporal windowing: if ShotSpotter fires an alert AND 911 receives calls with audio classified as distress within a 90-second window AND CCTV motion spikes in a 200m radius, you've got a confirmed incident with a confidence score. Push to PagerDuty equivalent for dispatch. Simple CEP (complex event processing) logic.
Building it took 4 months. Getting procurement approval took 18.
The Manhunt Model: Where ML Gets Interesting
Post-incident, the engineering shifts. Now you're doing multi-camera person re-identification (ReID). The standard approach is training a transformer-based embedding model (check the BoT-Net and TransReID papers, both on arxiv) that maps any image of a person to a 2048-dim vector. Same person, different cameras, different angles: vectors cluster close in embedding space. Different people: they don't.
similarity = cosine(embed(cam_A_crop), embed(cam_B_crop))
if similarity > threshold: # typically 0.85
flag_as_same_individual()The hard part isn't the model. It's the camera network latency. Most municipal CCTV runs on 15-30 second buffered streams pushed over RTSP to a central NVR. By the time a ReID query runs, the subject is already 400 meters away. You need edge inference on the cameras themselves, which means you're fighting a procurement and integration war with 12 different camera vendors.
What Good Infrastructure Actually Requires
Cities that do this well (Medellin's integrated security center is the most documented example) run a unified video analytics platform with standardized ONVIF camera APIs, a shared geospatial event bus, and dedicated ML inference clusters that process feeds in under 3 seconds end-to-end. That's not research. That's engineering discipline and political will to standardize infrastructure.
The models exist. The open-source tooling (DeepStream, OpenVINO, ONNX runtime) makes edge deployment tractable. The real blocker is that city tech stacks are fragmented across 15-year procurement cycles, and nobody owns the integration layer.
Every city with this problem has the budget. Almost none have the architecture.