Quick-reference answers on TAK federation, Cursor-on-Target, multi-agency coordination, shared operational pictures, and interoperability for security operations. For Empyrean's approach to the common operational picture, see COP capabilities.
What is TAK?
TAK - the Team Awareness Kit - is a government-developed geospatial mapping and situational awareness platform originally built by the U.S. Air Force Research Laboratory for special operations forces. It has since been adopted across military, law enforcement, emergency management, and public safety organizations as a common operating picture tool that runs on Android (ATAK), iOS (iTAK/TAKAware), and Windows (WinTAK) devices.
TAK is Government-off-the-Shelf (GOTS) software available at no cost for government and public safety use. The FBI provides public safety organizations access to TAK servers through the Law Enforcement Enterprise Portal (LEEP), minimizing infrastructure burden while providing immediate capability. Federal and local law enforcement agencies - including the FBI, USSS, DEA, and ATF - use TAK for high-risk operations and National Security Special Events (NSSEs) such as Presidential inaugurations and the UN General Assembly.
TAK's strength is interoperability. While many applications exist for blue force tracking and mission planning, few can communicate with each other. TAK addresses this through a central hub architecture - the TAK Server - that bridges devices, agencies, and data sources into a shared geospatial picture. This is why it has become the de facto standard for multi-agency coordination in the United States.
Empyrean Defense integrates bi-directionally with TAK - pushing and receiving tracks, overlays, markers, alerts, and policy events to and from TAK Servers and Cursor-on-Target endpoints. This means any agency already running TAK can receive Empyrean's fused operational picture without installing new software or changing their workflow.
What is Cursor-on-Target (CoT)?
Cursor-on-Target (CoT) is an XML-based data exchange standard developed by MITRE Corporation in 2002 for sharing time-sensitive position data between Department of Defense systems. CoT messages encode three fundamental elements: what the object is, when the event occurred, and where it is located.
CoT was first demonstrated during a combined joint task force exercise in 2003, during which a Predator uncrewed aircraft operated in coordination with crewed aircraft using CoT for real-time position sharing. Its loosely coupled design led to broad adoption across military and public safety systems, and it is now the primary data format used by TAK for sharing situational awareness information.
A CoT message is lightweight - typically a few hundred bytes - and can be transmitted over UDP, TCP, or multicast networks. This makes it functional on degraded networks, mesh radios, and satellite links where bandwidth is limited. Each CoT event carries a unique identifier, a type classification (structured as a hierarchical tree), and geographic coordinates with associated metadata.
Empyrean's CoT parser ingests and produces CoT messages natively - including atoms (point entities), bits (sensor data), routes, shapes, and remote resources. This means Empyrean can both consume tracks from TAK-connected sensors and devices, and publish its fused tracks, alerts, and policy events back to TAK as standard CoT messages that any TAK endpoint can display.
What is federation in the context of security operations?
Federation is the ability for separate organizations - each with their own operational picture, their own data, and their own security boundaries - to share selected information with each other in real time without merging their systems. Each organization controls what it shares, with whom, and under what conditions. The receiving organization sees the shared data as an integrated layer within their own operational picture.
This is distinct from a centralized system where everyone logs into the same platform. Federation preserves organizational sovereignty - your data stays in your system, under your control, and only the specific tracks, alerts, overlays, or incident context you authorize for sharing is visible to partner organizations. The partner sees what you push to them, nothing more.
In practice, federation solves the problem that every industry page on this site describes: when an incident exceeds the authority of the organization that detected it, the response depends on partners who have no visibility into what the detecting organization sees. The energy facility that detects a drone over a substation calls the FBI field office. The stadium security team that detects a social media threat calls local PD. The port FSO who observes unusual vessel behavior calls the Coast Guard. In each case, the responding agency starts from zero - no map, no track data, no sensor context, no timeline.
Empyrean's federation architecture - via TAK integration or Empyrean's native federation pipeline - turns that phone call into a shared picture. The responding agency receives a scoped view of the situation: the drone track, the alert timeline, the facility overlay, the relevant sensor data. They arrive with context instead of starting from zero. And the sharing is under the originating organization's control.
How does TAK federation work between a private facility and law enforcement?
The facility operator runs Empyrean at their site. Law enforcement runs TAK (ATAK on phones, WinTAK at their operations center, or a TAK server at their fusion center). Empyrean connects to the TAK server and publishes selected data as standard CoT messages.
The facility operator defines the sharing scope: which tracks to share (e.g., drone detections, perimeter alerts), which overlays to share (e.g., facility boundary, restricted areas, access points), and which incident data to share (e.g., alert timeline, associated camera sectors). Internal data - OT network status, employee information, proprietary facility details - stays behind the boundary the operator defines.
The law enforcement partner sees the shared data on their TAK device as standard map markers, tracks, and overlays. They can see the drone track moving over the substation, the facility perimeter, and the timeline of events. When they dispatch a unit, their own position appears on the shared picture (if they choose to share it), and the facility operator can see the response approaching.
This model is already operational. Colorado's statewide TAK deployment connects state agencies across jurisdictions for shared situational awareness. Texas DPS used TAK during Hurricane Harvey to coordinate rescues, respond to criminal activity, and establish perimeters across agencies that had never worked together before. Empyrean extends this model to private-sector infrastructure operators by making them a first-class participant in the shared picture.
What is a shared operational picture and why does it matter for multi-agency coordination?
A shared operational picture is a common, real-time representation of the operational environment that multiple organizations can see simultaneously - each from their own perspective and with their own role-based view of the data. It is not a single screen that everyone looks at. It is a common data set that each participant views through their own lens.
Without a shared operational picture, multi-agency coordination happens over phone calls, radio nets, and conference bridges. The information is verbal, sequential, and lossy. The person describing the situation and the person receiving the description are building different mental models. By the time the responding agency arrives, the situation has changed and the only record is a dispatcher's log entry.
With a shared operational picture, every participant sees the same geographic reality - the same tracks, the same alerts, the same timeline - updated in real time. The coordination shifts from verbal description to visual confirmation. The incident commander does not need to describe the drone's position over the radio; the responding officer can see it on their device. The FSO does not need to verbally relay the MARSEC level change; the Coast Guard liaison can see the status on their picture.
The technology for shared operational pictures exists today. TAK provides it for government agencies. Empyrean extends it to infrastructure operators, venue security teams, and any organization that needs to share operational context with response partners. See Common Operational Picture for Empyrean's approach.
What is blue force tracking?
Blue force tracking (BFT) is the ability to see the real-time location of friendly units - your people, your vehicles, your aircraft - on a shared map. The term originated in military operations where "blue" denotes friendly forces, and tracking their positions prevents fratricide and enables coordination. In law enforcement and emergency management, the same concept applies: knowing where your officers, fire units, EMS teams, and partner agency personnel are located in real time.
TAK was originally developed by the U.S. Air Force Research Laboratory to provide blue force tracking for special operations forces. It has since expanded well beyond BFT into a full situational awareness platform - but BFT remains the foundational capability that every TAK deployment provides. When a deputy installs ATAK on their phone and connects to the TAK server, their position appears on every other connected user's map. During Hurricane Harvey, Texas agencies that had never used TAK before adopted it within hours specifically for blue force tracking - knowing where rescue teams were operating across flooded terrain where radio alone could not provide that picture.
Empyrean extends blue force tracking beyond personnel positions to include sensor coverage areas, detection events, facility status, and asset locations. The result is a picture that shows not just where your people are, but what they can see, what they have detected, and what is happening at the facilities they are protecting.
What is the difference between ATAK, iTAK, and WinTAK?
These are platform-specific versions of the TAK ecosystem, each running on a different operating system:
ATAK (Android Team Awareness Kit) runs on Android devices - phones and tablets. It is the most widely deployed version and the one most law enforcement officers and field teams use. ATAK supports the full range of TAK capabilities including blue force tracking, route planning, sensor integration, and CoT messaging. The military version (TAK-MIL) includes additional targeting and battlefield capabilities with strict export controls.
iTAK runs on iOS (iPhones and iPads). It is sponsored by the United States Secret Service and provides core TAK capabilities for Apple device users. TAKAware is an alternative iOS client adopted primarily by the broader first responder community.
WinTAK runs on Windows computers and is typically used at operations centers, command posts, and analyst workstations where a larger screen and keyboard/mouse interface are preferred for monitoring and analysis.
All three clients connect to the same TAK Server infrastructure and share data via the Cursor-on-Target protocol. An officer running ATAK in the field sees the same operational picture as the analyst running WinTAK at the fusion center. Empyrean federates with all three through the TAK Server - the platform is agnostic to which client the partner agency uses.
What is interoperability in emergency management?
Interoperability is the ability of different agencies, systems, and personnel to communicate and share information during a response. FEMA and DHS have identified interoperability as a persistent challenge in emergency management - agencies arrive at a disaster with different radio systems on different frequencies, different data systems that do not exchange information, and different terminology that creates confusion during voice communication.
TAK addresses the data interoperability problem by providing a common geospatial picture that multiple agencies can share regardless of their radio systems. Empyrean extends this to include sensor data, threat intelligence, facility status, and cross-domain correlation - so interoperability means more than just seeing each other's positions. It means seeing the same operational reality across all domains.
How do fusion centers share information with field teams?
Most fusion centers share intelligence products with field teams through email distribution lists, SharePoint sites, secure portals (like HSIN - the Homeland Security Information Network), or law enforcement message systems like NLETS and RISS. These channels are asynchronous - the product is published and field teams access it when they check the system, which may be hours or days after publication.
The gap is real-time, bidirectional sharing. The DHS fusion center guidelines describe an intelligence cycle that assumes continuous information flow between analysts and operators, but the tools in use do not support that flow. The analyst's product reaches the field as a static document; the field team's observations reach the analyst as narrative text in a phone call or CAD entry.
Empyrean closes this by making the fusion center analyst and the field team participants in the same operational picture. When the analyst flags a threat, it appears on the field team's map as a geocoded alert. When the field team reports an observation, it enters the system as structured data with location and time - not as free text in a radio log. The information flows in both directions, in real time, through the same platform. See State Fusion Centers & Emergency Management for the full operational context.
Can Empyrean share data with agencies that do not use TAK?
Yes. TAK integration is the primary federation mechanism because TAK is the most widely adopted situational awareness platform across U.S. law enforcement, emergency management, and military organizations. But not every partner agency runs TAK, and not every partner agency is ready to deploy it.
For partners without TAK, Empyrean supports native federation - direct Empyrean-to-Empyrean data sharing between instances - as well as standard data exchange formats that can be consumed by other GIS and situational awareness platforms. The architecture is designed to meet partners where they are, not to require them to adopt a new platform before coordination can begin.
Related
- Common Operational Picture - Empyrean's COP capability
- COP FAQ - quick-reference answers on the common operational picture
- State Fusion Centers & Emergency Management - operational context for fusion center and EOC coordination
- Public Venues & Event Security - multi-agency coordination for live events
- Sensor Fusion - the fusion engine that feeds the shared picture
