An approach is provided in which a public protection system sends a data collection request to user devices located within a geographical proximity of an incident in progress that instructs the user devices to capture real-time data corresponding to the incident in progress. The public protection system receives the real-time data from the user devices and determines that a set of the real-time data includes evidence data corresponding to the incident in progress.