Intrusion Detection System (IDS ) Monitoring Over Data Networks

This document identifies minimum acceptance criteria for the utilization of data networks for IDS alarm monitoring for the protection of classified material under the National Industrial Security Program Operating Manual (DoD 5220.22-M) (NISPOM). These data networks may include private data networks (intranets or virtual private networks/VPN’s))or public data networks(“the internet”). This guidance establishes baseline security policies and requirements for sensitive, national security related applications and systems used for such alarm monitoring.
1.BACKGROUND:
A. The NISPOM and the DoD Arms, Ammunitions & Explosives (AA&E) Manual (DoD 5100.76-M),specifies requirements regarding the use of IDS for the protection of classified material and certain risk categories of classified and unclassified AA&E. IDS utilized as supplemental protection for classified material as well as AA&E must comply with the Underwriters Laboratories standard for National Industrial Security Systems (UL 2050) for installation, testing, operations and maintenance.UL 2050 also identifies physical security measures for IDS when utilized for protection of DoD AA&E.
B. UL 2050 provides the option of utilizing a data network2for alarm signal monitoring. While UL2050 allows monitoring over data networks and specifies technical performance specifications,3itdoes not address security requirements, policies and procedures for IDSs that utilize information systems (IS) for alarm signal monitoring over public or private communication lines. As NISPOM requirements apply only to classified information systems, additional guidance is needed to establish baseline security policies and requirements for sensitive, national security related applications and systems used for alarms.
C.IDS’ using data networks may range from the relatively simple (i.e. a contractor protected area connected directly through a static internet protocol (IP) network address to a Central Station Monitoring Service (CSMS), to the significantly complex [for example, hundreds of installations being remotely monitored over a corporate network at a Government Contractor Monitoring Station(GCMS).]
2.GUIDANCE:
A.IDS’ utilizing data network transmission shall be installed in conformance with appropriate UL 2050requirements. All IDS equipment that is used to communicate with the data network shall be listed by
2 UL 2050 describes data network transmission as “switching that sends packets of information from the alarm control/transmission panel in an alarmed area to a monitoring station by way of private data networks (intranets or virtual private networks/VPN’s)) or public data networks(“the internet”). A private data network is also known as a local area network (LAN) or a wide area network (WAN). “For the purpose of the standard, public data networks may also include WAN and/or Internet Protocol (IP) networks.
3 Installation criteria, power, signal transmission, system operation, response personnel and procedures, time frames, records,etc.
10 UL for use with a data network, and the installation must result in the issuance of an appropriate UL2050 certificate.
B.Prior to installing an IDS [utilizing data networks for alarm system monitoring] for supplemental protection under the NISPOM, contractors will submit a request for approval to the CSA including the following information:
(1)UL Alarm System Description for National Industrial Security Alarm System Certificate(Form No. CS-ASD-NISS);
(2)Proposed IDS hardware configuration and connectivity diagram (e.g. LAN/WAN schematic diagram) detailing the components (e.g. control panel, network interface cards, and method of data transfer (e.g. encryption implementation in hardware/firmware/software, etc.) between the protected area(s) and monitoring station locations. Hardware components and software will be identified by product name and release version.
C.Depending on the type of installation (e.g. subscriber or monitoring station) and complexity of the IDS (as reflected in the hardware configuration and connectivity diagram,) the request must also address and certify compliance with the following requirements, as applicable:
(1)Government Contractor Monitoring Station (GCMS) or Central Station Monitoring Service (CSMS) IDS IS Server(s)/Host Computer:
The IDS IS Server(s) that receive and convert alarm signals to human readable form for appropriate assessment and response shall meet applicable UL requirements. The IS Server(s)running the IDS alarm signal processing software will be dedicated to the security system and staffed by monitoring personnel cleared to the Secret level. When monitoring personnel are not in attendance, the IDS IS[running IDS application
software] will be secured within a locked room
4with UL certified Extent 3 IDS protection.
5
(2)Remote Terminals:
Networked terminals that allow privileged access to the IDS IS host computer (i.e. can program or modify system operating parameters or user accesses, etc.)shall be continuously staffed by authorized personnel or protected within a locked room with UL certified Extent 3 IDS protection.  There shall be no capability for changing the mode of operation or status of the protected area(s) IDS from locations outside the authorized IDS staffed terminals or protected area(s).
(3)Workstations:
Workstations are terminals that only provide for acknowledgement of alarm signals. Unattended workstations will be secured within a locked room with UL certified Extent 3 IDS protection.
(4)User ID’s and Passwords:
A unique user ID (UID) and password is required for each individual granted access to the IDS IS Server, remote terminal and workstation.Passwords shall be a minimum of eight characters; consist of alpha, numeric, and special characters; and shall be changed a minimum of every six months.
4  Rooms securing unattended IDS monitoring servers/host computers, remote terminals and/or workstations shall be comprised of walls, floors and ceilings that are fixed in place and constitute a solid physical boundary.
5 “Extent of Protection” is defined in paragraph 5.18 and Table 23.1, UL 2050.
11
(5)Personnel Security Clearance (PCL) 6Requirements:
a.Authorized Alarm Service Company (ASC) Representatives: No clearance required.
When working in IDS protected areas ASC representatives will be precluded from access to classified information and will be escorted/supervised by appropriately cleared personnel.
b.System Administrator (SA):
The SA responsible for ensuring IDS IS server configuration,IDS communications signal processing software installation and updates, user account administration and maintenance will be cleared to the Secret level. For less complex IDS installations where the SA’s duties are limited to the assignment of a network address/enabling of a network path for signal transmission between the protected area and monitoring station, a PCL will not be required. If the SA requires unescorted access to closed areas storing information above the Secret level, they will be cleared to the appropriate level consistent with the level of access and need-to-know.
c.Information Technology (IT) Personnel:
There is no PCL required unless they have privileged access to the IDS server. Privileged access requires a Secret PCL. If IT personnel require full unescorted access to closed areas storing information above the Secret level, they will be cleared to the appropriate level consistent with the level of access and need to know.
d.Users:
Personnel working in closed areas who arm/disarm the system will be cleared to the appropriate level of classified access
e.Monitoring Personnel:
Secret PCL required.
(6)Intrusion Detection Software:
IDS IS server(s) and remote terminals running IDS application and signal processing software will utilize intrusion detection software to monitor and log access attempts and all changes to IDS applications. The SA and facility security supervisor will be notified of unauthorized system access attempts and/or modifications for investigation or other appropriate action. Records will be retained for a period of 12 months (from the date of entry.)
(7)IDS Signal Transmissions:
All IDS signal transmissions between the protected area (closed area) and the monitoring station shall be:
a.Protected though firewalls or similar enhancements (e.g. routers, Virtual Private Networks/VPN’s, etc.) that are configured to allow only protective signaling data transfers between IDS components and addresses; and
b.Encrypted using a National Institute of Standards (NIST)Federal Information Processing Standards (FIPS)
7 approved algorithm with a key length of 128 bits(or greater); and,
6 A Personnel Security Clearance (PCL) is an administrative determination, based on an appropriate investigation, that an individual is eligible, from a security point of view, for access to classified information of the same or lower category as the level of the personnel clearance being granted.
7  UL 2050 also requires that the cryptographic modules must be certified in writing by the equipment manufacturer as complying with the NIST FIPS 140-2. The NIST validation list is available athttp://csrc.nist.gov/cryptva/140-/140val-all.htm.
8 Both the three-key Triple Data Encryption Algorithm (TDEA) and the Advanced Encryption Standard (AES) algorithm (FIPS197) are acceptable.
12c. Polled at a minimum of six minutes regardless of protected area alarm system status, i.e.open or closed.
(8) Service and Maintenance:
IDS IS testing, diagnostics, maintenance or programming will only be accomplished by the SA or ASC personnel,as appropriate. The ASC certifying alarm system installation and performing service,modifications or maintenance must be appropriately UL listed. While working in IDS protected areas, ASC personnel will be precluded from access to classified information and will be escorted by cleared and technically knowledgeable contractor employees. Unapproved use or substitution of non-UL listed IDS equipment or components can result in withdrawal of the UL certificate.
(9)Annual IDS Testing.  After initial testing and approval, the IDS shall be inspected and tested annually to provide assurances that the IDS is functioning properly in accordance with UL 2050and the NISPOM.
(10)IDS Failure / Emergency Procedures.  In the case of IDS failure, closed areas storing Secret or Top Secret material, GSA approved security containers storing Top Secret material, or substandard security containers storing no higher than Secret classified material will be periodically inspected by appropriately cleared personnel in accordance with NISPOM standards for providing supplemental controls. Areas storing DoD AA&E material will be continuously staffed. Emergency procedures will remain in effect until the system is restored to operational
status.
D. The CSA will review the contractor’s request for approval. The CSA representative (IS Rep or in the case of AA&E, the designated Contracting Officer Representative) may consult with the appropriate UL POC regarding compliance with UL standards. If the IDS request and Alarm System Description form reflects compliance with these requirements,the designated CSA representative will sign [onpage 4 – Alarm Transmission for Data Networks] the Alarm System Description Form (CS-ASD-NISS) and maintain a copy of the form with the contractor documentation in the official facility file.The original will be provided to UL by the ASC or contractor, as appropriate. The CSA representative may then formally approve the proposed IDS as supplemental controls under the NISPOM.
E. The ASC will submit the signed Alarm Systems Description for National Industrial Security Alarm System Certificate (CS-ASD-NISS)along with the [ASC completed] Alarm System Certificate Request (CS-R2) to UL for issuance of the CRZH certificate for the protected space. Form CS-R2 is a multi-copy form. A completed copy will remain with the alarm customer as proof of [UL] submittal until the completed certificate arrives.
F. IDS currently approved in writing by a US Government cognizant security authority as meeting the requirements of DCID 6/9 for protection of SCImay be approved under the NISP provided the CSA approval was issued without waiving any requirements of the DCID 6/9 for Networked IDS. Alarm systems, procedures and related records approved for NISP use will be accessible for verification and review by DSS.
G. If an IDS approved under these procedures are subsequently determined not to be in compliance with UL and NISPOM requirements, the approval will be rescinded and the contractor will be required to implement an alternative procedures for supplemental protection of classified material.

Remote Video Monitoring /remote guard tour

We run a chemical transfer facility that is on government terrorist target list, dispensing the likes of chlorine, acids and other dangerous chemicals. We receive chemicals in bulk via container ship, or trucking, off loading and storage at our facility and dispensing into customer sized containers for local distribution. Being a mostly outdoor operation, conventional alarm type systems would not be practical due to false alarm issues. We called upon the experts at AAA Alarms to design a system to monitor our facility. Since we are too small to support a 24hr security guard, we were counting on an electronic security solution from AAA. AAA Alarms designed a remotely Monitored Video Security system that THEY monitor from their Central monitoring station 24 HRs a DAY! The system consists of sophisticated outdoor and indoor high definition video cameras that automatically analyze movements to determine if it is human, crossing a perimeter in one direction, looks for regional intrusion from vehicles and persons and more. In addition to security alarms, the system also counts the number of vehicles and persons that enter / exit the facility, and provides for AAA central station to conduct periodic guard tours. We receive alarm video clips to our personnel smart phones at the same time AAA Central personnel are reviewing the alarm tripped video to determine if police presence should be requested based on live video feed. This service is invaluable and costs a fraction of 24hr on site security guards, and never falls asleep!

Why UL-Certified Alarms Are Essential for Jewelers

Why UL-Certified Alarms Are Essential for Jewelers

Using an alarm

Would you drive a car that wasn’t crash-tested or inspected to make sure all of its complex parts worked together in harmony?

Hopefully not. The risks would be too devastating to overcome if something went wrong.

Now, apply that same principle and cautionary state of mind to your jewelry business and ask yourself if you can risk not having a UL-Certified alarm.

What does UL stand for?

UL stands for Underwriters Laboratories, and they are an organization that tests everything from alarms to appliances to cleaning products to kids toys.

In fact, they do more than test: they certify, validate, test, verify, inspect, audit, advise, and educate.

 

 

You may recognize their mark — it appears on over 22 billion products, including alarms. In addition to the actual alarm, UL also certifies alarm service providers, which is equally important for jewelers to consider.

What makes an alarm and an alarm service UL-Certified?

UL sets minimum performance standards for alarm systems that exceed those captured in an alarm service and maintenance agreement. Among other things, they ensure that:

  • electrical protection circuits and devices signal properly
  • the system is properly installed
  • the system is monitored and maintained according to UL standards

Even if the alarm system is fully operational, it doesn’t do much good if the response to an alarm signal is inadequate or completely absent. UL issues certificates for two types of monitoring:

CRZH (Dept of Defense) and Central Station
Mercantile (MR)
  • A guard (also known as a runner) is designated for a response
  • Provides supervised openings and closings
  • Provides two-party control over arming and disarming of the alarm system
  • Requires that repairs begin within one hour of the guard’s response time (after normal closing time)
  • No guard (runner) is dispatched
  • Supervised openings and closing can be arranged, but are not automatic
  • Requires that repairs begin within 18 hours after the alarm company receives notification

Why are UL-Certified alarms essential?

Unlike the perils of smash-and-grab robberies and grab-and-run thefts that are primarily only threats to retailers, burglaries are of major concern to jewelry businesses of all kinds.

There have been instances where nearly all of a jeweler’s inventory was stolen because the alarm did not produce a signal or there was no response after an alarm signal was received.

Having a UL-certified alarm will give you peace of mind that an alarm will signal and that there will be a response to that signal. Additionally, having this level of protection could help your cause when purchasing insurance. Having a current and valid UL certificate is recognized as a risk mitigator, which means you’ll likely receive a more favorable premium, assuming your other risk factors are equal.

AAA Alarms and Fire Protection is able to issue UL Certificates and design/install and service security systems that meet these Standards.

 

Active Shooter Gun Shot Sound Detection Systems from AAA Alarms.

CONTACT AAA ALARMS TODAY FOR EXPERTISE IN ELECTRONIC SYSTEMS FOR DETECTION, LOCKDOWN, ALERT, AND RESPONSE WITH LIVE VIDEO SURVEILLANCE/SECURITY CAMERAS AND GUN SHOT SOUND DETECTION ELECTRONICS

ACTIVE SHOOTER
Contents
Acknowledgments.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ii
Introduction to Active Shooter Programs, by Jason Thomas Destein. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
The Six Phases of the Attack, by Linda Watson, CPP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Using Situational Awareness to Observe Pre-Attack INdicators, by Brad Spicer.. . . . . . . . . . . . . . . . . . . . . . . . . . 11
Proactively Preventing Active Shooter—Post-Incident Data, by Rick Shaw.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Lessons Learned, by Lawrence J. Fennelly.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Public Safety and School-Sponsored Onsite Training Programs for
Emergency Responders, by Jim McLain, CPP, FMP .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Behavioral Threat Assessment Teams, An Ounce of Prevention, by Jason Stone.. . . . . . . . . . . . . . . . . . . . . . . . . 25
Preventing an Active Shooter Incident, by Paul Timm, PSP.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Buying Time—Realistic Hardening of the Target at the Classroom Door, by Jim McLain, CPP, FMP.. . . . . . . . 30
K-12 as Soft Targets, by Dr. Jennifer L. Hesterman, EdD. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
When EMS Arrives on the Scene, by Michael J. Fagel, PhD, CEM.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Behaviorial Cues, by Inge Sebyan-Black, CPP.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
To Arm or Not to Arm…Teachers, by Jason Thomas Destein.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Appendix A: Tabletop Exercise, by Victor Cooper CPP.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Appendix B: Shootings on the Rise, by Mark Tarallo.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Appendix C: The Best Defense, by Laura Spadanuta.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Appendix D: Early Warning, Timely Respone: A Guide to Safe Schools, U.S. Department of Education.. . . . . 57
Appendix E: Conclusion from ASIS Workplace Violence Prevention
and Response Guideline, ASIS International Standards and Guidelines.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Active Shooter ii ASIS School Safety & Security Council
According to the FBI, the frequency and lethality of active shooter incidents in America is increasing. More than
one in four (29%) of these tragedies has occurred at educational institutions. Schools and universities must be
prepared to not only respond to these incidents, but to also prevent them.
Fortunately, when campuses properly prepare in advance to these emergencies, those prevention efforts also
address many other vulnerabilities, such as workplace violence, bullying, individuals with mental health and
addiction challenges, harrassment, emergency management (natural disaster as well as man-made), and even
public health crises.
Robin Hattersley,
Executive Editor,
Campus Safety
A good friend of ours is a retired school teacher who has dedicated thirty-seven hardworking years to the profession.
Proud of what he had achieved, he took us over to his school for a tour and see the flower garden he had
planted. Before we got to his garden, we observed four doors propped open. Embarrassed, “It wasn’t called for.
They would have been secured if I was still here,” he said.
This white paper is a part of a series prepared by the members of the School Safety & Security Council. We are an
active council. Our members are from colleges and universities, K to 12, and consultants. This group has a deep
passion for the safety of children.
This paper address different approaches to Active Shooter situations, but ultimately we must think proactively
and take some action to protect individuals if the unthinkable does happen. Do not be complacent and take the
approach of, “it can’t happen here.” We are all vulnerable. The frequency as well as the effect of Active Shooter
appears to be increasing in this country. Being prepared is the key to survival and saving lives.
In this paper, Jennifer Hesterman will make a great point when she ask what the cost is of not securing your
school. We ask you to carefully think about these words. Take some action. Get prepared. Research your
industry and determine what works best in your particular situation. The response will not be the same for
everyone. Different environments require different responses. For example, the response for an elementary
school during an Active Shooter situation will not be the same as that for a university campus or a high-rise
office building. Develop emergency procedures and conduct active drills with local emergency responders.
Above all, train everyone—employees, security personnel, students, faculty and staff. You will need them to
know the appropriate response and what actions they should take.
My sincere thanks goes out to all the members of the School Safety & Security Council for their hard work in
putting this paper together and to our CVP, J. Kelly Stewart, CPP for his kind words of support.
Lawrence J. Fennelly,
School Safety & Security Council (Past Chair and Current Member)
Loss Prevention & Crime Prevention Council (Past Chair and Current Member)
Active Shooter 1 ASIS School Safety & Security Council
Introduction to Active Shooter Programs
by Jason Thomas Destein
How many Active Shooter programs are out there today? Reportedly “Run-Hide-Fight” has been lowering the
number of workplace violence fatalities over the years and would be a good model to follow except K-12 children
cannot comply with the “Fight” component of the program. There is ALICE, which is available at a national level.
“Lock out, Get out, and Take out” and ONE are yet others. These are all great programs in their own way, and
ultimately there is really no wrong program since their true intent is using them to save lives. But let’s face it,
each person has their own style and way they react to situations during stressful events, and an active shooter
event is certainly very stressful. To be clear, there is no perfect program out there. You find a program that fits
your needs, your style, so when you have to use it, you know instinctively what to do. This section lists these
programs to discuss the pros and cons of each to help you reach your decision or to explore further options.
Run, Hide, Fight
Run, Hide, Fight is based on the premise that during an active shooter situation there are steps that you follow
when you hear gunshots fired.
Run
• Find a path and attempt to evacuate
• Evacuate whether others agree or not
• Leave your belongings
• Help others Evacuate
• Prevent others from entering
• Call 911
If you are not able to run, then you are encouraged to:
Hide
• Lock or block door
• Silence cell phone
• Hide behind large objects
• Remain quiet
• Stay out of shooters view
• Provide protection if shots fired in your direction
• Not to trap or restrict your options or movement
Active Shooter 2 ASIS School Safety & Security Council
If you do not have the ability to hide, then the last option is to:
Fight
• Attempt to incapacitate the shooter
• Act with physical aggression
• Improvise weapons
• Commit to your actions
It should be noted that “Run. Hide. Fight: Surviving an Active Shooter Event” is a U.S. Department of Homeland
Security Grant Funded Project of the Regional Catastrophic Planning Initiative. It was produced by the City of
Houston Mayor’s Office of Public Safety and Homeland Security.1
Lock Out, Get Out, Take Out
Lock Out
• By adding locks to all classroom doors and keeping them locked while in class. Also adding a lock and
video entry system to the main entrance for all visitors to use.
• Barricade all doors during a situation.
Get Out
• Anything goes when you are in harm’s way, like breaking windows to use as the nearest exit.
Take Out
• Anything goes, once again. When confronted and no other option is available, you do what you have to do.
Whether teaching how to respond to workplace violence in an office, factory/retail setting or college campus,
our consulting firm uses the “Run, Hide, Fight” video as part of our curriculum. The only additional information
we add is a reminder that “Run, Hide, Fight” is not linear. You may be in a situation when confronted by an active
shooter, and the only logical choice is to fight before you can run or hide. After a discussion about the video,
people often ask if “Run, Hide, Fight” should be taught in the K-12 setting. The short answer to this question is
“no.” The long answer is much more complicated.
1 Ready Houston, www.readyhoustontx.gov.
http://www.youtube.com/watch?v=5VcSwejU2D0
Active Shooter 3 ASIS School Safety & Security Council
Schools Must Keep ‘In Loco Parentis’ in Mind
It is important to remember, “Run, Hide, Fight” is shown in an office setting and not a school. Everyone depicted
in the video is an adult responsible for themselves and their own decisions. At 1:45 p.m. in the video, viewers are
instructed to: “First and foremost, if you can get out, do. Always attempt to escape and evacuate, even when others
insist on staying. Encourage others to leave with you, but don’t let them slow you down with indecision.”
K-12 schools operate under a different set of rules than business. Businesses must provide training for their
employees to meet OSHA regulations for safety, but the adults are expected to use that training and act as, well,
adults. Courts have ruled that schools and school personnel are in loco parentis, or in the place of a parent.
This gives the schools both responsibilities and, consequently, liability in regards to their actions for keeping
students safe.
Not only are schools responsible for training students for an emergency, but also for leading the students in
an emergency. Therefore, in the event of an active shooter, a teacher cannot instruct their students to run for
the nearest exit, yet not make sure the students are actually trying to exit. Nor should a teacher leave behind a
student who is too frightened to leave an area, especially when the child is very young.
Barricades Compensate for Weak Locks, Doors and Windows
Hide is currently taught in schools under the term “lockdown.” When an active shooter is inside a school, staff
members are generally instructed to lock their classroom door, cover the window if possible, turn out the lights
and move the students to an area in the room where they are less likely to be hit with gun fire if the shooter fires
through the door. Although this has been shown to be an effective method for keeping students out of harm’s
way, many feel simply locking the door is not enough. Teachers are now being taught to barricade the room
using existing furniture, extension cords or commercial products designed specifically to keep a room secure
during an active shooter event. This enhanced technique of barricading overcomes weaknesses in doors such
as large windows to the side of the doorframe or large windows in the door itself.
Don’t Teach Children the ‘Fight’ Component
Fight is viewed as a last option when in direct contact with the shooter or if you do not have the option to run or
hide. Should we be teaching children to fight a person with a gun? NO! There are several good reasons why this
shouldn’t be taught to them. First, the active shooter event in school is rare. Depending on the age of the child,
we could be causing them unnecessary fear by preparing them for something that is unlikely to affect them.
Although we could have age appropriate conversations with older students about what their choices could be,
parents may not agree with the message we give their child. It is better to give the parents talking points so they
can have the discussion with their children.
Active Shooter 4 ASIS School Safety & Security Council
When my children were still in school, I gave them specific training on what to do in an emergency at school,
church, the mall, etc. As a police officer, I have a different perspective and skill set than most parents. I could
see some parents being extremely angry if I told their children what I told mine. However, I was exercising my
responsibility as a parent, not a school employee.
What About Teachers and Administrators?
Q: Should we teach staff members to fight?
A: Maybe. First, we must let them know it is their choice whether or not to attack the shooter. For example,
post 9-11, if anyone gets the least bit out of order on a plane, they are usually beaten by fellow passengers
and duct taped to a chair.
Q: Do all the passengers attack?
A: No. Some choose to attack, and others choose not to attack. This is what we need to teach our staff; they
have a choice. If they want to learn techniques for fighting, we should use our relationship with our local
law enforcement to provide the training to attack a shooter.
How ‘Lock Out, Get Out, Take Out’ Works
Q: So what do we teach in schools?
A: There are many programs and many “experts” willing to sell their sure-fire strategy for keeping students
and staff safe. Almost all are time consuming, and many are expensive. Two things schools are short of
are time and money. There is little time for training and almost no budget. Strategies must be easy to
learn, easy to remember, and easy to use. These strategies must give staff choices and allow them to make
choices based on their training and the situation.
Lock Out
Since Sandy Hook, many schools are securing the perimeter of the buildings and using a camera and buzzer
system to control entry to the building after the start of the school day. This is not a foolproof method of keeping
bad people out of the building, as we saw in the fall of 2013 at the McNair Discovery Learning Center when the
gunman entered the building behind a parent who had been buzzed in. However, this does add one more layer
to a school’s plan to keep their building secure. It is recommended that all classroom doors be locked at all
times, even when class is in session and even if the door is kept open. In the event of a threat inside the building,
the door is already secured and just needs to be pulled shut. The teacher does not need to find their keys, step
outside of their room into the hallway, and attempt to engage fine motor skills while potentially facing a shooter.
Steps can now be taken to barricade the door.
Active Shooter 5 ASIS School Safety & Security Council
Should the teacher attempt to lead their students out of the building at the onset of the event? Are they in direct
contact with the shooter? Do they know the exact location of the shooter and where the shooter is heading? Do
they know they have safe passage to get outside? Can they move all of their students quickly and at once? Do
they have enough information to make a good decision to leave a place where they are safe and move to an area
where they may not be safe? With so many questions, it reinforces the need to train our staff and allow them to
decide a course of action based on their training and the circumstances.
Get Out
When in direct contact with an active shooter, you should do everything possible to get your students and
yourself out of harm’s way as quickly as possible. This means everything from heading to the nearest exit to
using a chair to break a classroom window and tossing students out the window. Or, you may be in a barricaded
room and no longer feel the room is safe. Get out anyway possible.
Take Out
A teacher is with their class on the third floor of an old school. They have successfully barricaded their classroom
and did not attempt to leave because they had limited information on the location of the shooter. But, this is not
an active shooter event. A noncustodial parent has already killed his ex-wife and is at the school to murder his
child and commit suicide. He knows the police are on the way and has not wasted any time getting to his child’s
classroom. He has brought the tools necessary to breach the door.
It is unlikely that you or your students can survive unharmed by jumping from the third story. If that teacher
chooses to take out the shooter, there are no rules. They may use anything in their room as a weapon and do
whatever it takes to keep their students safe. However, if they choose to remain passive, that is also their choice.
Just as “Run, Hide, Fight” is not linear, neither is “Lock Out, Get Out, Take Out.” Staff members are trained in their
choices and allowed to make their choice based on that training and the current situation. However, it should
be stressed that when in contact with the active shooter, lockout is not a choice. Staff and students should put
as much distance between them and the gunman, or the staff member should do whatever is necessary to take
out the shooter. “Run, Hide, Fight” is an excellent training tool when working in colleges, office settings, and
factories. However, with the responsibility schools have for their students and range of ages of the students in
schools, “Run, Hide, Fight” should not be the model used for school safety.2
2 Gary L. Sigrist Jr. is the CEO and President of Safeguard Risk Solutions. He previously served as the Readiness and Emergency Management in Schools
(REMS) Project Director for the South-Western City School District in Grove City, Ohio.
Active Shooter 6 ASIS School Safety & Security Council
ALICE
ALICE training is a strategy designed to increase survival during an armed intruder event.
ALERT: Inform as many people as possible within the danger zone of life threaten situation. Use
plain and specific language.
LOCKDOWN: Barricade the room. Silence phones. Prepare to evacuate or counter if needed.
INFORM: Communicate shooters location in real time if possible. 98% of the time the shooter works
alone.
COUNTER: Create noise, movement, distance & distraction with intent of reducing shooters ability to
shoot accurately. The focus here really is to disrupt the shooter by distractions. COUNTER is
about survival.
EVACUATE: When safe do so, remove yourself from the danger zone.
Observe, Navigate, Escape (ONE)
The O.N.E concept was created mostly for the K-12 environment, as there are some schools that have not embraced
the Run, Hide, Fight concept or other programs for evacuation. The O.N.E concept is based on using your
senses to help you survive an Active Shooter situation. This concept does not encourage students to Run or Fight
their way out of a situation. There may be a point in which one of those action may be necessary, but O.N.E does
not encourage you to do either of those. Instead, O.N.E uses your natural instincts and senses that you have been
using all of your life. For children, especially in elementary school, learning using their senses is the most common
way they learn and understand. It only makes sense that we would teach them to evacuate using their senses so
that they understand what they are doing and remain calm. O.N.E was created by Securable Consulting, LLC and
inspired by the children of a local school district. Below is an overview of the O.N.E concept.
OBSERVE. This is the most important step in plan, as you will continue to OBSERVE at every step of the plan.
Simply stated, OBSERVE is meant for you to know what is around you. What is the environment you are in
(classroom, office, retail, coffee shop, etc.)
• OBSERVE with your senses (eyes, ears, nose, and touch.) You can gain valuable insight of your surroundings
just by trusting your natural instincts that we all have.
• LOOK to see if the shooter is near. Look to see if there are any signs of victims in your possible path. Look
to see if there are any possible items that you could use as a weapon if needed.
• LISTEN for any screams, further gunshots, footsteps, voices, sirens or any other sound that could indicate
some type of action. Try to ascertain distance and direction of the sound.
• SMELL the air. Is there anything different? Do you smell smoke, gun smoke or powder? Is the smell
strong or weak? This could tell you if you are close or far from the situation.
• TOUCH the walls, doors, windows and the floor. Feel for any vibrations or temperature changes. Again,
the intensity of the vibration of temperature changes can tell you how close or how far you are from potential
harm.
Active Shooter 7 ASIS School Safety & Security Council
Your surroundings can save your life if you are able to observe what is around you. We are in these environments
everyday and we should know them better than anybody else. Don’t get complacent with your surroundings
and take for granted what is around you. Escaping from harm is not as simple as running out. It can be an obstacle
course, and knowing your surroundings can be all the difference. USE YOUR SENSES AND OBSERVE YOUR
SURROUNDINGS! If your observations indicate that harm is not far, then certainly shelter and hide as best you
can.
Remember this: You have been developing your senses since you were born! Children are learning every day
using their senses, and they are understanding more than anything else at this point in their lives. Most people
trust their senses more than anything else, and rightfully so. It is basic human instinct to rely on our senses
when danger is present. It is only when we see others in panic mode do we lose sight of using our senses to our
advantage. We must remain calm in the presence of danger. From there:
NAVIGATE. As you continue to OBSERVE your surroundings and feel that it is now the right time for you to
NAVIGATE out of your initial location to that of a location of safety, keep the following in mind:
• Always OBSERVE your surroundings and adapt to any changes.
• NAVIGATE a path based on:
——What your senses indicate to you.
——Who you are navigating with (students, co-workers, small children, strangers)
• Your ability to move, quickly, quietly, effectively and as calmly as you can is going to be of the utmost
importance. You do not need all of your belongings; technology to communicate with is the most important
item to have.
• Assign children a “buddy friend” to navigate with, and also assign each of them a role in the process.
Whether it is one child is listening and one child is looking for other signs of possible danger. Give them
something to do to keep them focused.
ESCAPE. As soon as you feel you have the opportunity to do so safely, escape. The average duration of an active
shooter event is just short of 10 minutes. It takes on average 12-15 minutes for law enforcement to arrive on
scene, according to Jim Schwartz, Chief Arlington County Fire Department.
• Follow your teacher who should be leading the way.
• Listen for sirens and try to move in that direction if safe to do so.
• Always account for the children you are leading, talk to them to keep them calm and quiet. If you are
leading out 15 children, keep counting them on the way out. This is also a good way to keep you as
the teacher focused and calm as well.
Active Shooter 8 ASIS School Safety & Security Council
The Six Phases of the Attack
by Linda Watson, CPP
We hear the words “active shooter” on a more frequent basis every time we turn on the radio or television. It
seems like the more it is happening, the more our society becomes de-sensitized to this type of violence. When
an active shooter is in the “implementation phase”, a series of events has already happened for the “actor” to
arrive at this tragic point. Experts agree there is no accurate or useful “profile” of an active shooter.
According to Dr. Joshua Sinai, Ph.D., there are six phases to any active shooter incident.3
Phase I Cognitive Opening: The “Mindset”
Phase II Planning
Phase III Preparation
Phase IV Approach
Phase V Implementation
Phase VI Post-Incident Mitigation
Given these six phases of the attack, we can look at incidents where the attacker went from thinking about an
attack to directly the attack phase with little or no planning steps in between. Contrary to much media “hype,”
most attacks are methodically planned and executed by the attacker. Much consideration is given as to whom
to target, where the incident will take place, and by what means the attack is carried out. In most incidents a
firearm is used as the weapon of choice.
Active shooters have evolved over the years. They are doing research to find how past attacks have been carried
out. They are seeing the police response and the tactics used to respond to those attacks. As a result, the active
shooters have changed some of the ways in which they plan and attack their victims. Two recent attacks that illustrate
this come to mind: the Virginia Tech attack—where the doors were chained on the inside to prevent victims
from escaping; and the Sandy Hook Elementary School attack—where the windows adjacent to the main
door were shot out by the “actor” to gain access into the school.
The Federal Bureau of Investigation published a study of recent U.S. active shooter incidents.4 A snapshot of its
findings summarizes:
• 160 incidents occurred between 2000 to 2013
• An average of 11.4 incidents occurred annually, with an increasing trend from 2000 to 2013
• 1,043 casualties, including killed and wounded (shooters were not included in this total)
• 486 were killed in 160 incidents
• 557 were wounded in 160 incidents
3 Active Shooter, A Handbook on Prevention. Joshua Sinai, Ph.D. Published by ASIS International. (2013.)
4 “A Study of Active Shooter Incidents, 2000-2013.” Texas State University and Federal Bureau of Investigation, U.S. Department of Justice, Washington,
D.C. (2014.)
Active Shooter 9 ASIS School Safety & Security Council
Cinemark Century 16 Theater in Aurora, Colorado: 70 (12 killed, 58 wounded), July 20, 2012.
€€€€€€€€€€€€€€€€€€€€
€€€€€€€€€€€€€€€€€€€€
€€€€€€€€€€€€€€€€€€€€
€€€€€€€€€€
Virginia Polytechnic Institute and State University in Blacksburg, Virginia: 49 (32 killed, 17 wounded), April 16, 2007.
€€€€€€€€€€€€€€€€€€€€
€€€€€€€€€€€€€€€€€€€€
€€€€€€€€€
Ft. Hood Soldier Readiness Processing Center in Ft. Hood, Texas: 45 (13 killed, 32 wounded), November 5, 2009.
€€€€€€€€€€€€€€€€€€€€
€€€€€€€€€€€€€€€€€€€€
€€€€€
Sandy Hook Elementary School and residence in Newtown, Connecticut: 29 (27 killed, 2 wounded), December 14, 2012.
€€€€€€€€€€€€€€€€€€€€
€€€€€€€€€
Active Shooter Incidents with Highest Casualty Counts (2000-2013)
193 (84 killed, 109 wounded)
€
killed
€
wounded
Active Shooter 10 ASIS School Safety & Security Council
The findings reflect the damage that can occur in a matter of minutes. In 64 incidents where the duration of the
incident could be ascertained, 44 of the 64 incidents ended in 5 minutes or less, with 23 ending in 2 minutes or less.
After seeing the FBI’s statistics, the yet unanswered question has become how to interrupt the “phases of the
attack” to stop the carnage.
In the first phase, the “actor” is thinking about the attack but has not yet shared those thoughts with anyone.
When those thoughts combine with an action plan, the attack becomes real. Next, the acquiring of weapons and
materials begins with logistical planning. Information about the attack is usually shared in some way during the
planning phase with someone who knows the attacker. This is the period where the most opportunity to stop the
attack can take place. The first three phases of the attack can take days, months, and years. When the actor is in
the approach phase, he or she has acquired all their weapons and is deploying to the site. The final phase, which
is the implementation and execution of the attack, ends within 5 minutes usually. The conclusion to the active
shooter incident is either by a self-inflicted gunshot or by the responding law enforcement.
Frequently information that has been shared by the attacker with people before the incident does not make
sense to the person(s) it is shared with. After the tragedy has occurred, people who knew the actor will come
forward with remembering odd things or behavior from that person. This echoes Secret Service statements that,
“Prior to most incidents, other people knew about the attacker’s idea and/or plan to attack.”5
In conclusion, active shooter incidents are increasing across the United States. If someone is sharing information
that is bothering you or making you nervous, find a way to tell someone who can analyze it and determine if
it is relevant or not. Lessons learned since Columbine have changed the way law enforcement agencies respond
to active shooters across the nation. Law enforcement personnel must constantly adapt and readjust to the
everchanging active shooter. More recently, incidents have occurred where the active shooter involved more
than one location. Situational awareness is key to staying alive during an active shooter event.
5 “The Final Report and Findings of the Safe School Initiative: Implications for the Prevention of School Attacks in the United States.” Washington, D.C.
(May 2002.)
Active Shooter 11 ASIS School Safety & Security Council
Using Situational Awareness to Observe Pre-Attack INdicators
by Brad Spicer
If a killer was on your campus, when would you want to know about him (or her)? Do you want to know that
he is at the parking lot? At the main entrance? Or if he has already entered the lobby, hallway, and classrooms?
Situational awareness is what allows us to recognize the early signs of danger in order to prevent violence. If prevention
fails, situational awareness can still mitigate the attack. More of an attitude than a hard skill, situational
awareness is the ability to identify and process information about what is happening around us. We all have it
some of the time, but it is also something none of us can have at all times.
As is the case with most abilities, there are varying levels of situational awareness. Jeff Cooper, a Marine and
innovator of tactical training, pioneered the concept of levels of awareness. His system, “Cooper’s Color Codes”
illustrated below, has been used to train military and law enforcement for decades. Cooper’s Color Codes have
nothing to do with warning code phrases or an outdated Homeland Security alert system. They simply assign a
color to describe a level of awareness.
Yellow is the goal for optimum situational awareness. You are best able to observe your environment and notice
changes that may pose a risk by being prepared, alert, and relaxed. Sometimes these observations are subtle and
identified by intuition. Intuition is not magical; it is an educated hunch based on your knowledge and experience.
Nothing interests us more than our own survival, and intuition can help us perceive threats.
WHITE Unprepared and unready to take action.
YELLOW Prepared, alert, and relaxed. Good situational awareness.
ORANGE Alert to probable danger. Ready to take action.
RED Action Mode. Focused on the emergency at hand.
BLACK Panic. Breakdown of physical and mental performance.
Cooper’s Color Codes
Active Shooter 12 ASIS School Safety & Security Council
Prevention
Prediction can seem daunting when a mass killing is framed only within the context of the shooting. Returning
to the hypothetical killer we began with, and instead of him roaming a parking lot, imagine you are observing his
intention in the form of posts on social media days to months before the first shot was fired. Despite how they are
portrayed by the media, these shootings do not start with the first shot. The shooting did not began when “…all of
the sudden, he took out a gun and started shooting everyone.” Generally, intentions were hardened long ago.
The length and observability of these precursor incidents increase the possibility of prevention. The challenge is
having the situational awareness to observe a potential threat and then direct the appropriate resources towards
the person in question before it becomes too late.
On April 20, 1999, 13 people were murdered at Columbine High School. While not the first mass killing in a
school (there were five in 1997 alone), Columbine was the event that coined the term “Active Shooter,” which
certainly described the situation as the murders occurred. But the Columbine attack did not start on April 20.
• The attack did not start at 11:19 a.m.
when, according to a witness, one of the
two killers yelled, “Go! Go!” as they pulled
guns from beneath their trench coats and
began shooting.
• It did not start at 11:18 a.m. when the
two assailants left their vehicles in the
Juniors’ parking lot after their explosive
devices failed to detonate.
• It did not start earlier that morning when
they were carrying into the school explosive
devices set to detonate at 11:15 a.m.
during a busy lunch shift.
It did not start April 20 with the two loading their weapons in the morning hours. It didn’t even start that year
when they rehearsed their attack.
While we will never know the exact date, we think the attack probably was motivated in 1996 when a blog
associated with an online gaming site took a violent turn. From that point forward, warning signs were exhibited.
Those warning were missed chances at intervention and thus preventing the attack from occurring.
Active Shooter 13 ASIS School Safety & Security Council
Pre-Attack INdicators
Few mass killings are preceded by a direct threat. While threats should never be ignored, they should be viewed
more as a promise than a guarantee. Some threats can actually be viewed as psychological motivators used to
de-escalate, not escalate, confrontations. Threats are typically issued to obtain a desired response (such as fear)
rather than to forecast imminent danger. Preventing an attack requires the observation of subtle Pre-Attack INdicators
(PAINs); not just waiting for the direct threat.
Listed below are actions that may be associated with PAINs and warrant closer attention.
• Threat of suicide or self-harm
• Threat of violence (directly or implied)
• Fascination with/asserting ownership of firearms
• History of violence; behavior obviously insensitive to others
• Preoccupation with themes of violence
• Intimidating others; frequently confrontational
• Crossing boundaries (e.g., excessive calls, emails, etc.)
• Marked academic performance decline
• Notable changes in personality, mood, or behavior
• Give away personal possessions
• Shows noticeable decline in personal hygiene
• Substance abuse
When PAINs are observed, caution must be taken to consider the context of the warning signs to determine if a
threat assessment is needed. The focus of a threat assessment is not if a person makes a threat, but if they pose a
threat. Simply put, threat assessment is the process to determine dangerousness.
In his book, The Gift of Fear, Gavin de Becker outlines a powerful way to efficiently define dangerousness. JACA
is an acronym for Justification, Alternatives, Consequences, and Ability. Apply JACA from the viewpoint of the
person you are assessing, not your own, and answer the following questions.
—— Does the person feel Justified in taking violent action?
—— Does the person feel there are Alternatives to violence?
—— Is the person concerned about the Consequences of a violent action?
—— Does the person have the Ability to carry out an attack?
If one or more elements of JACA are present, a formal threat assessment is likely needed. JACA is simply a snapshot
and does not replace the need for a formal and comprehensive threat assessment and case management
program.
Active Shooter 14 ASIS School Safety & Security Council
Threat assessment programs take advantage of early warning signs. When these are missed and the situation escalates
to imminent violence, PAINs are still present though more often associated with attack-related behavior.
Recognizing PAINs immediately prior to an attack may not enable prevention, but it can mitigate the casaulties.
First Timer’s Syndrome
Mass killers rarely have an exit strategy. They expect to die (by suicide or suicide by cop) or be captured. Because
the attack will be their first and last act of extreme violence, they will exhibit behavior and physical PAINs immediately
before the attack. An apt description of these PAINs is First Timer’s Syndrome. Working in code yellow
(prepared, alert, and relaxed) of Cooper’s Color Codes allows you to observe PAINs that slightly deviate from
baseline operations and pose danger.
Physical PAINs include appearance and dress. Behavioral PAINs include overt actions and more subtle gestures.
Obviously these PAINs are almost always consistent with perfectly innocent explanations and do not automatically
indicate danger. When the behavior is carefully and prudently explored (and the person is determined not
to be a danger to himself or to others), our intuition learns how to better distinguish future threats.
It is your intuition, training, and experience that help you determine if the situation poses no threat, if further
investigation is needed, or if immediate action response is required. In the very rare instances when immediate
action is required, your mindset (Cooper’s Color Code Red) can improve your response.
Situational Awareness and Response
Try to avoid code white (unaware) when you are at work or in public places. Make condition code yellow a habit.
When you observe potential PAINs, quickly analyze the situation. A valuable system to make rapid decisions
under pressure is the Observe-Orient-Decide-Act (OODA) Loop, which is sometimes referred to as Boyd’s Cycle
after its creator, retired U.S. Air Force Col. John Boyd.
The process begins by observing the situation. Orientation, next, is critical because most emergencies happen
too quickly to process information as it is observed. Think of orientation as gaining perspective. Once orientation
is gained, it is time to decide. The decision considers factors in information from orientation and your
training and experience. The last step is to act on the decision. The “loop” occurs when situation changes. This
cycle continues throughout an incident.
Thoughout the day, strive to have good situational awareness. If you identify potential dangers, switch to code
orange and apply the OODA Loop. In the very rare instances that require immediate response, move to code
red; however, you switch back to code yellow if no threat exists. Repeat this exercise and situational awareness
will become habit.
Active Shooter 15 ASIS School Safety & Security Council
Be Aware—But Stop Looking for Mass Killers
In “Just 2 Seconds”, a resource guide for those charged with protecting public and high profile people, authors de
Becker, Marquart, and Taylor point out it is futile to “look for assassins.” Trying to look for someone who could
be an attacker in a crowd is like looking for a needle in a stack of needles. What student does not have a backpack?
Are any shirts actually tucked in?
Rather than trying to imagine how each and every person could be a threat, maintain good situational awareness
and allow yourself to recognize physical and behavioral activities that differ from the baseline. Whenever
possible, observe persons as they exit vehicles or move to enter buildings or buses. Watch for physical and behavioral
indicators from people who approach new areas such as a school or bus.
About PAINs
If you wait for a guarantee of danger, then you are eliminating the opportunity to prevent the violence or seriously
limiting your ability to mitigate casualties. PAINs are warning signs that almost deserve some attention though
rarely warrant immediate action. When you observe PAINs, you should either:

  1. Eliminate the person as a threat and move back to Cooper’s Code Yellow;
  2. Continue to investigate and remain in Cooper’s Code Orange; or
  3. Act and implement emergency response plans. (Cooper’s Code Red)
    The decision is based on your observations, circumstances, and experience. If you cannot eliminate the situation
    as a threat and are unsure if the situation is dangerous, remain focused (Cooper’s Code Orange) and investigate.
    How you investigate is situational. While interacting with a potential threat may seem counterintuitive, it may
    be necessary if it is your responsibility to guard the safety of others around.
    Protecting schools can be incredibly difficult and tragically imperfect. However, situational awareness and
    PAINs are strategies that can help make campuses a little safer from a personnel standpoint. When contemplating
    the implementations of preparedness programs, leaders should consider the following decision-making
    possibilities:
    • Do nothing and hope nothing happens
    • Do nothing and it does happens
    • Do something and nothing happens?
    • Do something and it happens
    Active Shooter 16 ASIS School Safety & Security Council
    Proactively Preventing Active Shooters—Post-Incident Data
    by Rick Shaw
    Given the choice, would you rather prevent an active shooting or react to an active shooter? Given the choice,
    would you rather prevent the lawsuits, damaging headlines, and invasive media grilling related to an active
    shooter tragedy, or would you react to all of the above? Of course prevention is the better option, but is prevention
    possible?
    The short answer is YES! Prevention is possible. The steps in the Pathway to Prevention are well documented by
    hundreds of post-incident reports revealing that most, if not all, were preventable. Post-incident reports reveal
    that pre-incident indicators, concerning behaviors, suspicious activities, and warning signs were almost always,
    if not always, observed and even reported BEFORE the shooting tragedies occurred.
    So if pre-incident indicators are almost always observed and/or reported before incidents and tragedies occur,
    why are so many preventable incidents and tragedies not being prevented?
    Reacting versus Preventing
    In response to school tragedies at Columbine, Sandy Hook, and numerous others, most school administrators
    reacted by scheduling security assessments with a security expert who would visit the school to assess the
    school’s security preparedness. Security assessment reports usually deliver numerous recommendations for
    schools to add more security cameras, more security alarms, more physical security access products (locks,
    security windows, access management, etc.), more mass notification and communications systems, more
    active shooter trainings, more emergency and crisis response planning, more emergency and crisis policies/
    procedures, more crisis communications and social media guidelines, and more of the same.
    Security assessments can absolutely be helpful to ensure reactive and response efforts are in place. Security
    cameras record forensic evidence of what happened, security alarms go off when the threat is at your door, security
    access products will hopefully keep the threat out of your school, active shooter responses kick in when
    a shooter is at your school, and crisis responses take place during and after a crisis has taken place. Most of the
    security assessment “recommendations and solutions” are designed to improve reaction and response time to
    a threat that is on your campus or an emergency/crisis that has already happened.
    Active Shooter 17 ASIS School Safety & Security Council
    Prevention and Prevention Assessments Offer Numerous Benefits
    The benefits of proactive prevention are impressive and even life-saving, and successful prevention begins with
    a Prevention Assessment, which is much different than a Security Assessment. Prevention Assessments focus
    on a school or district’s capabilities to proactively prevent threats and proactively prevent at-risk individuals
    from escalating on a “path to violence” that can lead to incidents, lawsuits, tragedies and soaring liabilities and
    other challenges.
    The “Path to Prevention” Involves 6 Essential Steps:
    • Awareness at the individual level
    • Collecting the Dots
    • Assessing the Dots
    • Connecting the Dots
    • Intervention and Monitoring
    • Prevention (Pro-Active and Pre-Active)
    Each of the six essential steps in the Path to Prevention are critical and necessary for schools/colleges to proactively
    intervene with at-risk individuals and incidents on campus, off campus and on Social Media BEFORE they
    escalate towards something more serious, more dangerous, more expensive or more tragic.
    A Prevention Assessment will review:
    How schools are ensuring situational and ongoing awareness at the individual level—including but not limited
    to what concerning behaviors look like, how to make incident reports (confidential and/or truly anonymous),
    situational awareness, updates on new and viral social media risks, policies, procedures, plans (including individual
    roles and responsibilities) related to preventing as well as ensuring all individuals are aware of emergency
    and crisis response plans from security assessments.
    How schools are collecting the dots—including but not limited to how schools are collecting incident reports,
    investigations, interventions, social media behaviors and comments, etc. from individuals in their school and
    “community-wide” who almost always see pre-incident indicators. And making sure all of the “dots” are collected
    in a central, secure records management platform that is separate from Student Record Systems to eliminate
    potential liabilities due to disclosures (unauthorized and authorized) outlined in multiple guidelines including
    FERPA, state laws and national standards guidelines. Too many schools are using outdated approaches (paperbased,
    spreadsheet-based and other silo-based approaches) that lead to gaps and information falling through
    the cracks.
    How schools are assessing the dots—including but not limited to the school/college threat assessment team and
    “community-based” threat assessment and safety teams. How threat assessment team members are assessing
    and measuring an at-risk individual’s potential of aggression and violence, how teams (school and communitywide)
    are securely sharing information to meet privacy and security obligations, how teams ensure real-time
    collaboration rather than weekly meetings, how teams include third-party and community resources such as
    mental health services, law enforcement and numerous other assessing the dots efforts.
    Active Shooter 18 ASIS School Safety & Security Council
    How schools are connecting the dots — including but not limited to how teams are connecting all related incident
    reports, investigations, witnesses, updates, legal obligations, internal resources, community-wide resources
    and numerous other connecting the dots efforts. Post-incident data and comments almost always refer to
    “the failure to prevent was due to not connecting the dots” and the Prevention Assessment will help your school,
    college and community to identify gaps, silos and disconnects BEFORE they lead to a failure to prevent.
    How intervention efforts are working with at-risk individuals, how intervention efforts are communicated and
    documented across the school or district, how intervention related monitoring is working, what intervention
    programs are being utilized, are intervention efforts consistent and how numerous other intervention efforts
    are being utilized.
    How prevention efforts are working in the school and across the district to prevent and eliminate liabilities and
    incidents associated with violence, sexual assaults, bullying, cyber bullying, gangs, drugs, weapons, sexting,
    social media drama, diversity/inclusion, suicides, cutting, depression, isolation, truancy, and numerous other
    threats, incidents, tragedies, and soaring liabilities.
    Prevention Gaps Exposed In Student Surveys
    To better understand what students are experiencing, Awareity conducted Student Safety Surveys in 2013 (nearly
    4500 students across 16 states) and 2014 (nearly 6500 students across 14 states) and the students’ responses
    exposed several serious gaps and prevention disconnects in their schools. For example:
    • 79 percent of students have been impacted by bullying in their school
    • 46 percent of students have been impacted by cyberbullying
    • 49 percent of students are witnessing another student being bullied at least once a week
    • Only 17 percent of students said things got better when they reported a bullying incident
    • 39 percent reported bullying incidents to teachers
    • 36 percent reported bullying incidents to parents
    • 17 percent reported bullying incidents to school office personnel
    Many Students are still not reporting incidents because:
    • 28 percent are scared to make the situation worse
    • 26 percent don’t want to be involved
    • 23 percent don’t want to be a snitch
    • 20 percent don’t believe it will help
    If schools are not receiving incident reports, it is not because incidents are not occurring, it could be because
    students have lost trust in adults and their school’s prevention capabilities. Lost trust and lack of taking action
    is a dangerous problem, because when human beings ask for help and nothing happen, human beings tend to
    take matters into their own hands.
    Active Shooter 19 ASIS School Safety & Security Council
    Why is survey data about bullying important? Many previous active shooters have left messages and manifestos
    that cited their grievances with being a victim of bullying. When you combine the survey data about bullying
    with the survey data that when students report bullying and things get better ONLY 17 percent of the time, human
    beings (students) may decide to take matters into their own hands — some will become violent, some will
    bully others, some will become depressed, some will resort to suicidal ideations, some will turn to self-harm and
    cutting and some will turn to drugs and alcohol to get away from the pain…and some have and could become
    SHOOTERS.
    The student survey also provides insight on what students hear other students talking about:
    • 34 percent are aware of someone who may pose a risk to students and their school.
    • 34 percent are aware of a fellow student who has talked about or contemplated suicide.
    • 34 percent are aware of students who have brought drugs or alcohol to school.
    • 90 percent said they would report weapons, online threats, and suicidal students if they had an anonymous
    incident reporting option.
    • 98 percent said they are willing to be a hero for somebody, BUT school administrators need to equip
    students (faculty, staff, and community members) with the web-based and anonymous incident reporting
    tools so they can share their observations of concerning behaviors and pre-incident indicators.
    The evidence from post-incident data, from lessons learned, and from student surveys is overwhelming and the
    data exposes numerous liabilities and dangerous gaps with current and community-wide prevention capabilities
    in schools and communities.
    School Administrators should take immediate action to learn more about their school-wide and their community-
    wide prevention capabilities before the next incident or tragedy occur. All schools should conduct a
    Prevention Assessment to learn how they compare to leading schools who are proactively preventing active
    shooters, violence, and numerous other incidents and liabilities while also improving their school climate for
    all students, all school personnel, and their entire community.
    Rick Shaw is President and founder of Awareity. For more information, please visit www.awareity.com
    Active Shooter 20 ASIS School Safety & Security Council
    Lessons Learned
    by Lawrence J. Fennelly
    After every active shooter incident, there are questions from victims and their families, as well as mental health
    professionals. They want to know why the shooting happened. They want to know what could have been done
    to prevent the attack and what caused this particular person to kill or injure innocent people. People start looking
    for missed warning signs. Most importantly, everyone wants to know what can be done to prevent the next
    incident from happening.
    In addition to those questions, law enforcement and other first responders evaluate their response and seek
    answers to their own set of questions after each and every new active shooter incident:
    • What strategies worked well and what did we do “right” during the response?
    • What could we have done better?
    • What systems and procedures worked well and what needs to be re-evaluated or changed?
    • What additional equipment or training would have made the response better?
    Evaluating first responder actions are an important part of improving how active shooter incidents are handled.
    We learn from mistakes that have been made in the past. For instance, when two students conducted their
    attack at Columbine High School in Littleton, CO, law enforcement officers as well as first responders outside
    the building were hearing shots as innocent victims were killed or injured. In the past, first responders gathered
    outside the building or area, waited for additional responders, planned their strategy, and then entered the
    building to neutralize the threat. Research has shown that in almost every case, once shooters are confronted
    by an armed response, no other innocent victims will be killed or injured.6 Because of this the initial or sole first
    responder on the scene now enters that building as quickly as possible to gain control of the situation.
    Traditional law enforcement response to an active shooter event was to secure the perimeter, gather information,
    and wait for additional officers to arrive. Unfortunately, the shooting at Columbine High School proved
    this approach failed. Since that time, law enforcement officers now use rapid deployment to an active shooter
    event by entering the building or the area as fast as possible with the goal of neutralizing the hostile threat with
    the least amount of force.7 What we have learned is that even a sole first responder on the scene must communicate
    with other responders who are en route and then enter the building or area to prevent further injuries or
    loss of life. A law enforcement officer on the scene of an active shooter incident, who enters a building or area
    alone before other first responders arrive, does so because of their sworn duty to protect. This strategy is an effort
    to prevent the death toll from rising.
    Past incidents have shown that an incident command post must be established as soon as possible to coordinate
    the response of multiple agencies. Also, a perimeter has to be identified quickly so responding agencies will
    know where to gather and what to do.
    6 http://www.policemag.com/channel/careers-training/articles/2013/02/rethinking-active-shooter-response.aspx
    7 https://info.publicintelligence.net/LAactiveshootertactics.pdf
    Active Shooter 21 ASIS School Safety & Security Council
    Ideally, the resources of many agencies should be utilized to effectively respond to an active shooter situation.
    Responders must have the needed equipment so they can prepare and effectively respond. Agencies should
    work together to provide and support each other’s training so they are all aware of how they will respond and
    work together as a team. The shooting at Sandy Hook Elementary School made first responders aware of how
    important it is to have a plan in place to allow multi-jurisdictional agencies to communicate, and that there
    must be adequate communication operators (dispatchers) available to handle the influx of calls.8 It is vital that
    that communication is maintained with the community, as well as the first responders, throughout the entire
    incident.
    The shooting at Virginia Tech caused the university to re-evaluate their emergency communication and warning
    systems. Even though there were multiple layers in their communication process, not all of them worked
    well. One lesson learned was redundant modes of internal emergency communications and notifications with
    overlapping layers of communication were needed. Numerous modes of communication are available such as
    text alerts, audible sirens, social networks, e-mail, web pages, local university cable television stations, computer
    pop-up alerts, and constant updates to local and national media. The messages provided information on
    what was happening with the police response and instructions on what individuals on campus should do.
    Virginia Tech also learned that some words (such as “shelter-in-place” and “lockdown”) were confusing and
    many people did not understand exactly what they meant. The term “clear” caused confusion to some of the responding
    agencies. They were unsure whether “clear” meant evacuate the building or “clear” the building of any
    potential suspects. Even when we speak the same language, we find these words that have different meanings.
    The shooting at Northern Illinois University in 2008 demonstrated the need for National Incident Management
    System (NIMS) for all campus law enforcement as well as training and drills for students, faculty, and staff so
    they know their roles and responsibilities during an active shooter incident. All-hazards planning and response
    with comprehensive training, drills, and exercises are a critical part of emergency preparedness.
    The response to the 2012 shooting at the Century 16 Theater in Aurora, Colorado, emphasized the need to have
    access to an area crowded with vehicles and people. Before even arriving at the theater, first responders were
    inundated by moviegoers covered in blood and carrying victims.
    Although local and state first responders are almost always the first ones on the scene of an active shooter incident,
    the FBI plays a large role in supporting the response to every major incident in recent years. The FBI has
    training and resources which can be utilized before and after an incident occurs.9 Shooters plan their actions,
    so it is reasonable that first responders also have a plan for how to best handle the situation. The lessons learned
    from previous active shooter incidents are invaluable to first responders and this knowledge will help save the
    lives of innocent victims who are simply in the wrong place at the wrong time.
    8 www.dhs.gov/active-shooter-preparedness
    9 http://www.fbi.gov/about-us/office-of-partner-engagement/active-shooter-incidents
    Active Shooter 22 ASIS School Safety & Security Council
    Public Safety and School-Sponsored Onsite Training Programs
    for Emergency Responders
    by Jim McLain, CPP, FMP
    Many public K-12 school systems in America have emergency plans that include measures for active shooter
    situations. This is typically in accordance with their state laws or regulations. But without proper and periodic
    training, these emergency plans are merely a list of instructions that may or may not be carried out in actual
    emergency situations.
    In addition to mandatory training drills (e.g., fire, lockdown, and bus evacuation), school administrators should
    regularly engage with their crisis management teams in practical or tabletop exercises to train on how to execute
    their plans in the event a critical incident arises. As with plans that require update, the exercises should be
    modified to address different incidents. The training should be placed in a mandatory cycle to ensure the most
    effective response when needed. Public safety officials must be involved in each of these tabletop exercises.
    Having key stakeholders together is needed in order to educate school staff on expectations during a response,
    and to evaluate and provide input on the actions taken by crisis teams.
    Active Shooter 23 ASIS School Safety & Security Council
    At my school district, the crisis and security plans require updating each year. All schools within the school division
    are required to conduct tabletop exercises in a mandatory cycle. Secondary, high, and middle schools are
    provided tabletops every other year. Elementary schools receive these exercises every three years. Schools may
    request out-of-cycle tabletop exercises, and typically do this when staff changes occur or when shortcomings
    are identified.
    This continual and cyclical timeline was planned with consideration for other drills, instructional time, the
    number of schools, and the resources available to provide the training. A two-member security planning team
    assigned to the central safety and security office reviews and approves plans every year. The team also conduct
    tabletop exercises. The exercises are formulated and routinely modified under the supervision of a dedicated
    security specialist. Approximately 85 tabletops that take about 90 minutes each are conducted each year. Supervisors
    from the local police and fire departments attend every exercise.
    From the school district’s perspective, this is an effective method in preparing school teams to respond to
    emergencies when coupled with the multitude of other drills the teams conduct with students and staff. What
    can school systems then do to facilitate public safety agencies’ abilities to respond to their school emergencies?
    Coming from a law enforcement background that include years assigned to a tactical unit, it is understood
    there are three basic needs in any strategy to address and resolve active shooter and other violent incidents:
    Communications. Intelligence. And training.
    Once schools understand and embrace this, it becomes highly effective in enhancing school safety to assist
    public safety with their training needs relative to school emergencies. By providing school facilities as training
    venues, administrators inherently allow emergency response groups to address each need.
    Interactive training inside the school buildings provides public safety operators the opportunity to assess communications
    capabilities or limitations inside particular sites, valuable real-life intelligence on the structure
    itself, and an excellent training environment. Although it improves the ability of emergency responders to respond
    in active shooter and mass casualty scenarios, training opportunities for the utilization of schools should
    not be limited. Practically speaking, the more responders become familiar with school layouts by actually being
    in them as opposed to just viewing the floor and site plans, the better off school communities are.
    Since actively engaging public safety in utilization of our facilities within reasonable expectations, needed improvements
    by the schools are regularly identified and addressed, response on day-to-day calls for service are
    enhanced as well as emergency response.
    Public safety concerns regarding their difficulty to communicate in some of our schools during training created
    a need by our central office to assess each school for in building penetration of the public safety radio frequencies.
    Working in conjunction with two way communications specialists in our county a number of facilities were
    tested and bi-directional public safety antenna systems were installed. This program is ongoing and has the side
    benefit of helping schools improve school based portable radio communications through the addition of radio
    repeaters in their facilities subsequent to the onsite assessments.
    Active Shooter 24 ASIS School Safety & Security Council
    For pre-incident intelligence and to enhance emergency response all schools have an exterior and interior
    numbering system at all primary entrances. Public safety departments are provided electronic site, floor plans
    and aerials accessible from their computer aided dispatch terminals in their cruisers or apparatus. Large scale
    paper versions of this for all schools are carried by school security supervisors for command post deployment
    when emergency responders are on scene. The onsite training opportunities we have afforded to public safety
    educated us the items we provide are useful but by comparison physical knowledge gained through training use
    has been exceptionally beneficial.
    Our local police SWAT group oversees active shooter training. Every summer all sworn members of the police
    department, sheriff’s department, and the area state troopers go through onsite active shooter training at two
    of our high schools. Recently due to the large presence of federal law enforcement agencies in our area, many
    agents as well as military police have been included in training efforts as they may be in the area should an incident
    occur. The base and military police are provided training at our large elementary school located on the
    installation. The fire department also conducts mass casualty and multiple unit response functional exercises
    during the summer months at our high schools.
    Additionally, a variety of our schools are regularly used for squad-level training for our district level police
    and fire stations. The training ranges from K-9 searches, building searches and room clearing, officer safety to
    hazmat response.
    Important consideration must be given to the use availability of the individual school itself. Like many school
    divisions, our facilities are often in use after hours and on weekends for community activities that generate
    needed income for the school system. Since public safety training does not occur during regular school hours,
    community usage or extracurricular school activity can limit training availability. Coordination is the key.
    Our school division requires all requests for training come through the office of safety and security. Once the
    request is made, an office staff member coordinates with the office of community use and the school administration
    of the affected location. If a particular site is not available for the requested date, a proximate school is
    offered as an alternative.
    Once the training is scheduled, uniformed school security responds to grant access on the date of the training.
    While many of the police entities have emergency key access for schools, security is necessary to disarm the
    security system and make sure no unscheduled activities are taking place that might interfere with the planned
    training session. 30 minutes prior to the end of training, school security responds back to secure the site at the
    conclusion. Large scale exercises or training resulting in a number of emergency vehicles onsite necessitates the
    coordination with public information offices for the school division, the police, and fire departments.
    There is an old police or sports adage that is very fitting. “You play how you train.” It aptly describes the many
    advantages for school systems facilitating use of their buildings for public safety.
    Active Shooter 25 ASIS School Safety & Security Council
    Behavioral Threat Assessment Teams,
    An Ounce of Prevention
    by Jason Stone
    Columbine High School. Virginia Tech. Sandy Hook Elementary. What were once names of safe educational
    institutions are now synonymous with fear, pain, death, and tragic loss of innocent lives. The horrific gunning
    down of men and women, boys and girls, that took place on these campuses have helped coin new phrases like
    “active shooter”, “lock & hide” and “run, hide, fight”. These catchphrases describe response procedures that do
    just that—respond. But in order to respond to an event, it must be situation that is in progress.
    When it comes time for the responding team to arrive, unfortunately there will be people that are already injured,
    some possibly killed. Wouldn’t it be great if there was a tool available that can stop active shootings from happening?
    What if schools could have a well-trained team that gather at a moment’s notice, evaluate the potential for
    threat, and set a plan to action? This is not a dream. These teams do exist and they prevent disasters nationwide
    almost daily. They are called Threat Assessment Teams (TATs), and have become an effective tool to help prevent
    (that’s right, I said prevent) horrific events similar to the ones we have seen occur all too often in recent years.
    Did Not See It Coming
    Immediately after an attack, the news is filled with reports of shock and disbelief. We sometimes hear, “He just
    snapped” or “She was such a good kid. I would never have thought she would do something like that.” Then once
    the dust settles, a different truth emerges—how the person who just committed inexplicable murder wasn’t
    himself lately, or how she joked about shooting up the school. More time passes and the media uncovers how
    the assailant turned in dark writing assignments with shocking focus on killing, torture, or suicide that was just
    “not like his normal work.” Or maybe we are told that she posted online about how hopeless it all was and want
    everything to end. Thus countless investigators think about how helpful it would be to have this information
    prior to resulting tragedy rather than after. We imagine how many lives could have been saved, how many
    families would be spared these tragedies, if we had ‘the big picture’ before the first shot was fired.
    The Secret Service conducted an in-depth study of 37 incidents that took place between January 1974 and May
  4. This report, called the Safe School Initiative, showed 93% of assailants in the study displayed troublesome
    behavior prior to their attack. The study showed that at least one other person knew there was a very high potential
    the subject would attack in 81% of the incidents studied; more than one person knew the likelihood for
    violence in 59% of the cases. This information is alarming especially since 93% of those individuals with knowledge
    that an attack would occur were other students or friends of the assailant.
    Active Shooter 26 ASIS School Safety & Security Council
    This information tells us unabashedly that people knew there was potential for violence … and said nothing. Or
    if had they said something, perhaps the reporting system was fragmented, and the potential life saving information
    did not reach the proper person who could have done something about it. The bottom line is nobody had
    the opportunity to see the big picture. A properly functioning TAT not only gets to see the big picture, it has an
    opportunity to intervene, and that makes a world of difference.
    Purpose of the Team
    A TAT’s main purpose is to provide a thorough and unbiased investigation into all reported potential threats.
    Investigations are handled tactfully and confidentially. The team acts with the safety of all parties involved as a
    primary concern at all times. Since many TAT investigations involve suicidal behavior, it is important that TAT
    members do not lose focus on the fact they must consider the protection of the individuals under investigation
    as well as potential targets. The team must be prepared to calmly RESPOND to the facts of a concern, and not
    REACT out of fear. How the team handles the investigation does not only affect the outcome of the current investigation,
    but it will also affect future ones. Teams that rely solely on punishing the subject of the investigation
    rather than a course of action that helps keep the community as safe as possible will wind up alienating themselves.
    If the TAT can show it performs its functions with the best interest of all involved, at all times, it will earn
    the trust of the community it serves. When the trust of the community is earned, concerned peers will be more
    likely to seek the team’s help. If a team is heavy handed and becomes known for acting out of fear, it will not only
    lose the trust of the community, and therefore risk future operations, but it could open itself and its organization
    up to lawsuits.
    The Team (experienced counselors, instructors, administrators, security & safety, law enforcement)
    The team should select a leader; a chairperson if you will. The chairperson should have a level head, an excellent
    working knowledge of the threat assessment process, and should be very familiar with the school culture. It is
    important to point out that the person selected to head the team does not have to be in a leadership position at
    the school—the selected chairperson could very well be a counselor or faculty member. What is important is
    that they meet the above criteria. In a group such as this, all members must be allowed to speak their mind and
    not be influenced by the position any team member holds. It may take you a few tries to form a team in which
    everyone works well together, but you should start with the following individuals:
    • experienced counselors
    • teachers
    • school administration
    • campus security representative
    • law enforcement representative
    ** It is very important to mention parents and students should not be a member of the TAT due to the
    confidentiality of the discussion the teams will be having
    Active Shooter 27 ASIS School Safety & Security Council
    Training the Team
    Training is one of the major keys to a TAT’s success. Proper training matched with proper staffing will make a
    TAT a very effective tool to help those that may need it in your school system. It may save a life or prevent injuries
    on or off campus.
    All team members should be trained in basic threat assessment at minimum. It is preferred that all members
    receive advanced threat assessment training at the educational level of your institution (higher education vs.
    K-12).
    Opportunities for the team to train together under the processes put in place by your organization should be
    made available whenever possible. The more the team works together, the more proficient they will become. In
    some school systems, the team meets on a weekly or monthly basis to discuss legitimate cases. In other school
    systems, the demand might not be as high and so the team may only be called upon once or twice a year. In the
    latter cases it is very important that the team still meets regularly to discuss procedure and do tabletop exercises
    to keep everyone’s skills up to date.
    This section was intended to give the reader a brief summary of how a Threat Assessment Team works, a basic
    outline on how to form one, and how it is trained. It is by no means an all-inclusive training document. But
    hopefully this document has provided enough material for the reader consider and realize that Threat Assessment
    Teams are another deployable, and in fact effective, tool in targeted violence and suicide prevention.
    Active Shooter 28 ASIS School Safety & Security Council
    Preventing an Active Shooter Incident
    Paul Timm, PSP
    Active shooter events, despite their relative rarity, are an important security concern for entities such as educational
    institutions, businesses, and government buildings. The frequency of these deadly incidents is on the rise
    in America, and the intense media spotlight is frequently focused on them. As a result, today, more than ever,
    is the best time to implement measures and practices that are focused on training, preparing for and,perhaps
    most importantly, preventing these difficult situations.
    Between 2000 and 2013, 486 people were killed in active shooter events. An additional 557 were wounded.10
    During the first half of this time period, there were approximately six active shooter situations per year. The
    average of the second half of the 13-year study rose significantly to 16 per year. This rise in active shooter events
    is an alarming trend that hs caused society take note. Regardless of the number of shootings that actually occur
    each year, just the possibility of an active shooter incident must cause us to take precautions to reduce the risk.
    There are several ways educational institutions, from K-12 to universities, can assist in the prevention of the
    event from starting. First and possibly most importantly, provide training to your stakeholders. Training can
    take many different forms, but experts should always conduct it. Vital instructional topics include:
    • Heightened Awareness. Make stakeholders aware of their surroundings, potential threats, and the security
    measures that are in place. Encourage them to report all legitimate issues.
    • Diffusing Potentially Volatile Situations. From handling disgruntled persons to appropriately addressing
    escalating or destructive behaviors, provide people with effective direction and methods.
    • Personal Crime Prevention. Equip your stakeholders with good safety practices, such as utilizing a “two
    person rule” for accountability purposes,intentionally moving about the campus in well-lit areas, and
    avoidingthe display of money and valuable devices.
    Another important way to discourage shooters from targeting educational institutions involves “hardening the
    target.” The concept of target hardening centers on the idea people who contemplate executing malevolent acts
    are more interested in choosing the easy target than an intimidating one. How can you make your campus and
    individual facilities appear to be difficult to victimize? Security measures that aid in these efforts include strategic
    placement of video surveillance cameras, noticeable presence of security personnel, and implementation
    of Crime Prevention Through Environmental Design (CPTED) principles such as “natural surveillance” and
    “natural access control.” These measures serve to discourage, if not warn, would-be bad guys that criminal actions
    will be more difficult to carry out than not. Building design from new construction to renovations can also
    significantly impact prevention. Effective design features include secured vestibules, classroom security locks,
    10 A Study of Active Shooter Incidents in the United States. Federal Bureau of Investigations, U.S. Department of Justice.
    Active Shooter 29 ASIS School Safety & Security Council
    vehicle barriers, bullet resistant glass, and other delay measures. These features can help not only in limiting the
    damage of an in-progress active shooter but also in stopping shooters before they start by making it difficult to
    enter a building or gain access to classrooms or gathering areas.
    Other prevention techniques focus on policies and procedures that deal with everything from visitor management
    practices to social media risks. For example, policies that involve suspension, expulsion, and termination
    should be drafted to address the possibility that the person being reprimanded or fired might grow upset or angry
    and react violently. These policies assist administrators and those in authority in making safe decisions regarding
    termination, suspension, and expulsion. Effective policies should include mandatory cool-off periods
    for terminated workers. In other words, these individuals are not permitted back on campus for a certain period
    of time after the termination. Monitored exit interviews and notice of termination practices allow administrators
    to foster an environment where the terminated employees grievances or issues with the institution are aired
    and potentially resolved before they develop into something more threatening down the line.
    Today is the day to place importance on prevention efforts. Be proactive. Stopping the active shooter before he
    or she has a chance to carry out their mission is obviously invaluable. According to an FBI study, most active
    shooter events begin and end within five minutes. This means that if prevention failed, we may not be able to
    immediately rely on the response of law enforcement officials to neutralize the threat. Instead, make a commitment
    to instruct your stakeholders, discourage criminal behaviors, implement design features, and craft
    relevant policies that will significantly reduce your risk.
    Active Shooter 30 ASIS School Safety & Security Council
    Buying Time—Realistic Hardening of the Target at the Classroom Door
    by Jim McLain, CPP, FMP
    The rare but devastatingly tragic incidents of targeted violence involving school shootings from external actors call
    to attention the need to review and improve, where possible, the physical security of our academic institutions
    nationwide. After the incident at Sandy Hook Elementary School in 2012, once again a need was identified to
    provide better physical security if the outer perimeter was breached. Taking a corporate approach of layering
    security in order to buy time for the arrival of emergency responders to resolve the threat, there was a renewed
    focus on the construction of the classroom door.
    How do you buy time at a door that is closed and already has a lock? To answer the question, school and physical
    security officials evaluated standard classroom doors, their construction, and configuration to ask:
    • Is the door solid or hollow core?
    • Is the door wood or metal?
    • Does the door have a vision kit or panel?
    • Is there a sidelight next to the door?
    • Does the door have a lock that can be easily engaged in an emergency with a strike and frame sturdy
    enough to mitigate rapid breach?
    Hollow core doors provide a privacy barrier, but they are ineffective for physical security and allow for easy
    noise detection. Wood or metal solid core doors are adequate for security so long as the hinges, strikes frame,
    and locking mechanism are strong enough.
    The major vulnerabilities inherent in classroom doors are: 1) glass within or adjacent to the door that, when
    broken, would allow access to the handle; and 2) a locking configuration that prevents easy engagement in an
    emergency.
    The fire codes in most states require classroom interior door latches to open in case of fire, even when locked
    from the outside. Unfortunately this creates a situation whereby an assailant can break the vision panel or sidelight,
    and reach in to open the locked door from the inside. While it would seem obvious to simply eliminate
    the glass, it is not practicable in today’s school building design. Natural light penetration is considered desirable
    and even advantageous in creating optimum learning environments. This tends to make security professionals’
    physical security goals more challenging in educational facilities when it comes to the layered approach.
    In locking configurations on classroom doors, there has been a longstanding philosophy in many school communities
    that the door should only be lockable from the outside to prevent kids from locking the teacher out.
    With that we have many schools with cylinders on the outside and no means to lock the door from the inside.
    Active Shooter
    31 ASIS School Safety & Security Council
    In routine day to day activity, this is of course fine. In the chaos of an
    emergency, however, teachers opening the door to lock it from the
    outside not only exposes them to the gunman, but in some cases,
    the teacher inadvertently unlocks it by pushing down on the interior
    handle as they close the door under duress. The worst case scenario
    that plays out being the teacher cannot find her/his keys in an emergency,
    or a substitute teacher has no key to begin with.
    To address this, all that many schools can do is to try locking the door
    at the beginning of the day while it stands open. Should an emergency
    arise where lockdown procedures are appropriate, the teacher or
    substitute simply closes the door. Naturally the issue with this procedure
    is under certain situations a student can close the door and the
    teacher would effectively be locked out. The double cylinder locks
    are effective but the dilemma of no readily accessible keys may exist.
    Post Sandy Hook, the one cost-effective and seemingly ready fix that
    overcame the door issues aforementioned is the portable and rapidly
    deployable barricade or barring device that prevents unlocked doors
    from being easily breached. The market was flooded with a plethora
    of different concepts of the same tool. The school division I manage
    security for even put our design engineers to work. A prototype of a
    spring-loaded floor device was created. Our design, along with some
    door devices we purchased from legitimate vendors, was presented
    for approval.
    All devices were ruled as being against fire code in our state. They
    were therefore rejected by the fire marshal. Research into codes and
    regulations revealed that there are a great many states where the fire
    code prohibits the use of any type of door barricade implement as it
    may impede fire evacuation.
    A two pronged approach to resolve this buying time strategy was
    taken. Finding the optimum type classroom lock and taking steps to
    prevent access by breaking the glass. Primary considerations have to
    be considered for a cost-effective solution that works and does not
    over institutionalize the facility.
    Aesthetics also plays an important role in the public education culture
    and must be considered by security professionals. This presents
    Active Shooter 32 ASIS School Safety & Security Council
    11 The single bore cylinder is commonly used because of its ease of installation and costs. Commercially, mortise type locks are popular because of its durability
    and built in deadbolt type secondary lock, depending on the model you procure.
    challenges in trying to address physical security needs. Both educators and school community members shun
    the idea of their schools looking like prisons or defense facilities.
    The preferred type of door hardware is equipment that can be locked from the inside with a single lever handle
    that, when pulled down, will unlock the door from the inside. The door, frame, and hinges must be sturdy to
    begin with. Consideration has to be given to the type of lock: single bore cylinder or mortise lock.11
    Thumb turn (or a button on the inside lever or on the back plate) can work to lock the door from the inside;
    however in a panic, the button lock can be disengaged by a teacher who pushes the button to lock the door but
    then as he/she endeavors to close the door unintentionally pushes down on the lever.
    We had a manufacturer fabricate a heavy duty mortise lock with an incorporated secondary locking device. A
    thumb turn lock mounted on the escutcheon (or back plate) with an indicator window was used. The indicator
    displays for the interior user when the door is locked in white lettering on a red background and unlocked with
    black lettering on a white background. The front of the lock set has a keyed cylinder with a vandal-proof lever.
    If the lever is forced down in an effort to force it open, an interior ratcheting simply breaks the lever free and it
    goes back into functioning battery. Staff is currently testing the lock to ascertain if it meets our need for buying
    time at the door.
    Because of the desire for natural lighting and the need for administrators and teachers to monitor what’s on the
    other side of the door without disrupting instructional sessions, all of my school division’s classroom doors have
    vision kits/panels installed. Many school divisions throughout the nation face this same challenge. A violent
    intruder need only break out the glass to reach in and defeat the lock.
    There are several options in approaching this. The old established method of reinforcing the glass with wire
    mesh on the inside (like the way they were when we were in school many years ago) is no longer an option in our
    organization. Approximately a decade ago, it was decided to do away with utilization of this type of glass due to
    a potential for a child to injure themselves if they accidently broke the glass. (Although I suspect that costs also
    may have played a factor in the decision.)
    There are some highly effective screens available with ballistic capabilities that are cost-effective. Bars and
    heavy-duty meshes were also reviewed. These were not acceptable in the school environment here because of
    the institutionalized perception. Plexiglas-type material was considered as well but the mounting and yellowing
    over time concerns were raised.
    The second prong of the approach came down to clear and not tinted security films. The film manufacturers
    provide excellent demonstration videos, but staff and I decided to conduct field and performance testing on
    our own due to concerns of door framing, mounting, and the small size of the vision panels. With over twenty
    thousand classroom doors in our organization, finding a solid solution in a cost effective manner is paramount.
    Active Shooter 33 ASIS School Safety & Security Council
    Does security film applications work? To answer the question, our first round of testing consisted of security film
    mounted to the inside and outside of existing window glass. The optional security adhesion kit to strengthen the
    frame area where it meets the glass was also used.
    The film and kit were installed on a four by four feet library entrance and two classroom vision kits. The optimum
    cure time of ninety days was allowed. The testing was conducted in the wing of a school under renovation
    after school hours so there would be no disruption to the primary mission of educating the children. The area
    was cordoned off with safety personnel posted to prevent unwanted access and unintentional injury.
    The local police department special weapons and tactics team performed the field testing on the glass. Three
    methods of breach that might be readily available to a school shooter were deployed: the butt of a rifle, a fire
    extinguisher, and finally a breaching round fired from a shotgun.
    On the larger library window the film performed remarkably. Repeated and numerous strikes with the rifle butt
    and fire extinguisher failed to even crack the window. The breaching round put a slug sized hole in the window
    but it held together and subsequent strikes failed to breach the window even after being shot. While ballistic
    capabilities are not inherent in the security films they still maintained considerable strength after being penetrated
    by the round fired from a gun.
    The small classroom window glass panels were tested on doors mounted in their standard frames with standard
    wooden window frames. In both cases the windows remained intact but the frame surrounding the vision kit
    gave way causing the entire panel to fall out thus defeating the purpose.
    A second round of testing was needed so installations were done on three doors in the same building with metal
    framing being installed with each vision kit. One door window installed with a single side film and adhesion kit
    inside a metal frame withstood all breach attempts. The door itself was locked. The swat team member did not
    shoot this door window.
    The second application was identical to the first but the door was unlocked with play in it. The application failed
    after several attempts. We did not shoot this panel either.
    The third and final door had film installed on both sides with an adhesion kit install on the metal frame and
    window seam. This door withstood all attempts, including breach by shooting.
    While double-sided application with a metal frame appears to provide the solution, our team of staff elected to
    perform one more round of testing so we can incorporate variables that might be considered by other school
    districts and could present cost savings. For example, how do single-side installation and double-side installation
    without the optional adhesion kit perform?
    Active Shooter 34 ASIS School Safety & Security Council
    For the second round and forthcoming third round, we invited the assistance of Underwriters Laboratories to
    observe and provide their expertise in reaching a successful solution with the versatility to work on a variety
    of door vision panels. The one definite reached at this junction is the necessity for an attachable metal frame
    around the treated window.
    The third round of testing also includes the aforementioned lockset developed for our purposes. A similar configuration
    with the indicator window and thumb turn was developed for the larger doors with interior panic
    hardware as well.
    One final point, any testing and evaluation team should be multi-disciplinary so that all variables are considered.
    The staff team mentioned in this document was comprised of school security, school design engineers,
    and facilities management personnel, along with police and fire representation. Present also in prior and any
    subsequent testing is a life safety development manager with Underwriters Laboratories.
    We are confident the simple strategy of buying time at the classroom entrance door will be an effective layered
    security solution. As to what else school divisions security officials decide to include as part of their physical
    security program to mitigate the school shooter, proper consideration for what is acceptable to the organization,
    costs, and how the material(s) will perform in the actual environment should be considered.
    Active Shooter 35 ASIS School Safety & Security Council
    K-12 as Soft Targets*
    by Dr. Jennifer L. Hesterman, EdD
  • Based on concepts covered in
    Soft Target Hardening:
    Protecting People from Attack
    CRC Press, 2014
    Every day, somewhere in the world, another school wakes up from
    the aftermath of another violent attack possibly caused by a terrorist
    or an insurgent group that threatens the United States or its citizens
    abroad. In some cases, they were bombed by their own government
    as a consequence of civil war or as part of a warfighting strategy that
    is impossible for us to comprehend. Who could have predicted, even
    ten years ago, that schools, as well as churches and hospitals, would
    be considered routine and legitimate targets for terrorist groups? The
    actors have redrawn the battlefield lines around sanctuaries that civilians
    once held confidence in of shelter and safety. Schools for children
    are legitimate and penetrable targets scoped by those who wish
    to do harm, from international terrorist organizations to lone wolves
    to those merely disgruntled or mentally incapacitated and have the
    urge to “act out.”
    A school is a soft target, meaning it is:
    • A civilian-centric place
    • Not typically “fortified,” meaning vulnerable, unprotected, and undefended
    • Security not a primary mission
    • Possibly co-located with or near a hard target
    If lacking a specific agenda, terrorist criminals may choose to target a school for the ability to inflict the most
    damage in terms of casualty count. Also, soft target attacks generate a long press cycle, serving any “fame,” recruiting,
    or legitimacy goals of the actor. Another consideration for the tactic, soft target attacks generate more
    fear and psychological “pain” than hitting a government building or installation.
    Perhaps nothing more deeply affects the American public than an attack on a school. We never expect that
    innocent children would be targeted by anyone, be it their fellow student, a member of the community with a
    mental illness, a criminal, or a terrorist. Therefore we are wholly unprepared, shocked, and deeply saddened
    when we learn of its occurrence. The ripple effect of school attacks is also immense—traumatizing students,
    teachers, and first responders who view the scene; inducing post-traumatic stress and panic disorder in many.
    So, a school attack persists in people’s minds and on society’s conscious long after the shooting stops, long after
    the walls are repaired and the students’ return, which makes it the perfect target in the eyes of a motivated killer.
    Active Shooter 36 ASIS School Safety & Security Council
    Psychology of Soft Targeting
    We can easily slip into a false sense of security and become complacent about safety inside our schools’ halls
    and classrooms. Security, however, is not the primary mission of schools, which typically are constrained of the
    resources needed to fund recommended security measures or hire additional guards. Also, schools are typically
    “gun free” zones so the only resistance a violent actor will meet is a typically unarmed security guard or two.
    In addition to physical security factors, we need to look inward and fight our psychological “blind spot” regarding
    the issue of school security. I often speak with college presidents and high school principals about the possibility
    of a terrorist attack or an active shooter event on their property, and I’ve met certain mindsets that prove
    problematic. They may convey a feeling of hopelessness (there is not much we can do to prevent or mitigate the
    threat); infallibility (it will never happen here); or inescapability (its destiny or unavoidable, so why even try).
    Some block out the thought at a personal level by thinking “it can’t happen to me,” indicating a sense of invulnerability.
    Even worse, others may believe that “if it’s going to happen, there is nothing I can do about anyway,”
    expressing inevitability.
    Persons with these types of mindsets are a detriment to your organization in a crisis as they exhibit a lack of
    awareness to the threat, mental preparation, or lack the sense of determination to engage and command the
    situation. In an emergency, those without a plan or resolve may wait for first responders and law enforcement to
    arrive and rescue them before taking steps to save their lives or the lives of others. The Sandy Hook shooting lasted
    6 minutes and ended with 26 people dead. There is no time to wait for help when the attacker is determined
    and brings heavy firepower to the fight. In an active shooter event, everyone is a first responder.
    Escalation of School Attacks Worldwide
    On April 7, 2011, a 24-year-old man named Wellington Oliveira traveled to the Tasso da Silveira Municipal
    School in Rio de Janeiro where he was a former student and subject of classmate bullying. He methodically
    killed 12 students. A firefighter who responded to the scene told newspapers, “There is blood on the walls,
    blood on the chairs. I’ve never seen anything like this. It’s like something in the United States.”12 His statement
    illustrates the prevailing worldview towards the escalation of school violence in our country, especially with the
    recent epidemic of shootings and stabbings. As part of a larger society which is increasingly violent, there is an
    inevitable ripple effect on the safety and security of our schools.
    At any given time, there are at least 75 million Americans attending some type of school from Kindergarten
    through doctorate level courses. Overseeing them are 5 million teachers, administrative, and support staff on
    campuses.13 Many schools also serve community needs, used as places for meeting, polling, or shelters in times
    of emergency—introducing other potential bad actors to the installation. Even if schools are not the intended
    12 Bryan Johnson, “Top 10 Chilling Quotes During School Shootings.”
    http://listverse.com/2012/05/09/top-10-chilling-quotes-during-school-shootings/
    13 Department of Homeland Security, “FEMA 428, Primer to Design Safe School Projects in Case of Terrorist Attacks.” (2012.)
    Active Shooter 37 ASIS School Safety & Security Council
    target, children must be protected from the physical and emotional side effects of being in the proximity to horrific
    violence. For example, there were four elementary schools and three high schools located within six blocks
    of the World Trade Center on 9/11. Children in at least three states had parents working in or around the World
    Trade Center that day. Thousands of children were exposed to the toxic dust clouds from the collapsing buildings.
    In the Washington DC area, schoolchildren faced similar stress when the Pentagon was attacked.14 Schools
    have also been pulled into active shooter events where a gunman is on the loose and part of a manhunt on the
    school property but they weren’t the primary target.
    The top two deadliest mass shootings by a single person in U.S. history both occurred on school campuses. On
    April 16, 2007, 23-year-old Seung-Hui Cho killed two students in his Virginia Tech dormitory. Cho then went to
    a classroom building, barricaded himself inside, and shot 53 students and teachers, killing 30 in just nine minutes.
    On December 14, 2012, Adam Lanza killed his mother in their home. Lanza then went to the Sandy Hook
    Elementary School in Newtown, Connecticut. There, he bypassed the security door and shot through a plate
    glass window to gain entrance to the building. He killed 20 first graders and 6 staff members in only six minutes.
    Since the 1999 Columbine attack, there have been at least 30 other major school shootings in our country. Certainly,
    terrorists and others with nefarious intention watch and see the relative ease with which school attacks
    are accomplished.
    K-12: Vulnerable in the Crosshairs
    Kindergarten through 12th grade vulnerabilities differ from those on college campuses. First of all, physically not
    matured the younger populace cannot defend themselves as readily and are more likely to slip into suspended
    disbelief as the situation unfolds than engage a “flight or fight” response. Examining the unique vulnerabilities
    found from shooting attacks associated with K-12 helps to better understand trends, the risk of attack, and
    mitigation challenges.
    The first K-12 school attack in the United States was the Enoch Brown School Massacre, which occurred July
    26, 1764. On this date, four American Indian warriors entered a white settler’s log cabin school in Greencastle,
    Pennsylvania, and used a tomahawk to kill and scalp the teacher and ten students. Throughout the years,
    primary and secondary schools have been the site of revenge murders, racial attacks, gang violence, suicides,
    workplace violence, and lovers’ quarrels. They have been used by domestic terrorists as a way to express rage
    and garner attention to their cause. For example, on May 18, 1927, the Bath Consolidated School was the scene
    of the deadliest act of mass murder in a school in U.S. history in a lone wolf, anti-government attack. Andrew
    Kehoe, upset with policies and tax law he believed led to his farm’s foreclosure, murdered his wife at home, and
    then detonated three dynamite bombs at the Maine school where he worked as the accountant. Kehoe spent
    months planting explosive material throughout the building in a premeditated act that stunned the country.
    When confronted at the scene by law enforcement, he detonated a vehicle bomb, killing himself and the school
    superintendent. In all, the attack killed 38 school children and five adults.
    14 Centers for Deisease Control, “Schools and Terrorism: A Supplement to the National Advisory Committee on Children and Terrorism Recommendations
    to the Secretary.” Atlanta, GA. (2003.)
    Active Shooter 38 ASIS School Safety & Security Council
    International terrorist groups and embattled governments use modern day schools as political targets. Students
    have been the victims of bombings, shootings, kidnappings, and hostage situations. In the past 40 years, there
    have been massacres at the Ma’a lot school in Israel, the Bahr el-Baqar school in Egypt, the Beslan school in
    Russia, the Nagerkovil school in Sri Lanka, and more recently, the Army School in Peshawar. Schools in the Gaza
    strip, Iraq, and Afghanistan are routinely attacked. Mass student kidnappings became a new fear when terrorists
    from the al Qaeda-linked group Boko Haram, who posed as soldiers to gain trust, kidnapped more than 500
    girls from their boarding school in Nigeria on April 16th, 2014. The girls literally disappeared into thin air, with
    Boko Haram leaders threatening to sell them into marriage and the sex trade for $12 a person to raise money for
    the group. They next attacked the village where the girls were from, killing 150 family members and search and
    rescue team personnel.
    Why are K-12 schools more vulnerable to attack? First of all, the student populace is made up of children and
    young adults. Having not reached mental or physical maturation, obviously they are easier to overpower. Second,
    security measures are typically in place but done inconsistently. For example, as violence in our country
    began to rise in the 1980s, many schools began installing metal detectors at entryways. Although metal detectors
    work extremely well to catch weapons, school administrators found this type of screening time-consuming;
    especially when considering the rushed movement of hundreds of students to their classrooms each and every
    morning. Operating detectors or individual wands is extremely manpower intensive, and so many schools
    abandoned the idea.
    The concept of school resource officers (SROs) took hold in the 1970s when protests and unrest related to the
    Vietnam War spilled over into school systems. SROs are sworn law enforcement officers who are detailed to
    the school system and work to enhance security at their institution. They may be armed and can make arrests.
    However, SROs can also be of limited help when facing a determined gunman/gunmen with a practiced, solid
    plan and heavy firepower, as the following cases illustrate.
    In the Columbine High School attack, Eric Harris and Dylan Klebold managed to kill 15 people and injure 24
    despite the presence of an onsite SRO. Jefferson County Sheriff’s Deputy Neil Gardner, a 15-year veteran of the
    Sheriff’s Office, usually ate his lunch with the students in the cafeteria. His car parked in front of the cafeteria
    doors between the Junior and Senior parking lots. On the day of the attacks, Deputy Gardner was eating elsewhere
    on campus, watching an area frequented by smokers. When shots were fired inside of the school, he
    pulled up to the indoor/outdoor cafeteria area where Harris and Klebold had tried to set off two bombs and
    had already started killing students. Gardner engaged them in a gun battle; however, he was unable to hit the
    perpetrators. One injured teacher and a student were able to escape during the chaos, and Gardner was responsible
    for later saving other students as he protected them when they were fleeing. He exchanged gunfire
    with the shooters when they were killing students in the library before they committed suicide. He likely saved
    lives in the end, but Gardner’s daily presence on the school grounds obviously didn’t deter the shooters from
    their operation. In fact, investigators believe the shooters purposely chose the area where Gardner typically had
    lunch to start the operation with the likely intention to kill him first and remove their only obstacle to success.
    Active Shooter 39 ASIS School Safety & Security Council
    The Red Lake School Massacre occurred on March 21, 2005. That morning, 16-year-old Jeffrey Weise killed his
    grandfather, a tribal police officer, and his girlfriend at their home. Weise then took his grandfather’s police
    weapons, vest, and vehicle, and drove to Red Lake Senior High School, where he had been a student some
    months before. Weise first shot and killed the unarmed security guard at the entrance of the school, then targeted
    a teacher and five students. After the police arrived, Weise was undaunted and exchanged gunfire with them;
    he was wounded and then committed suicide in a vacant classroom.
    In May of 2014, police in Waseca, Minnesota arrested seventeen-year-old John David LaDue on charges related
    to an elaborate plan to carry out a massacre at a nearby school. According to his 180-page diary that police found
    in his bedroom, LaDue plotted to kill his family members, start a diversionary fire to distract first responders,
    and then go to a nearby school. He was first going to kill the SRO, set off bombs, and shoot students and staff.
    A resident living next to a storage facility worker tipped off police to the suspicious teen. Contents of his locker
    revealed a pressure cooker, pyrotechnic chemicals, steel ball bearings, and gunpowder. He had also been able to
    stockpile three completed bombs, an SKS assault rifle, a Beretta 9 mm handgun, hundreds of rounds of ammo,
    and several other guns inside a safe at his home. LaDue had been testing his devices at a local elementary school
    playground and intended to attack the school on the anniversary of Columbine. However, the date of the anniversary
    fell on Easter Sunday and school was not in session. Locals described LaDue as a polite boy who did well
    in school and had plenty of friends.15
    Religious elementary schools in the U.S. have also been the target of terrorists. In August of 2011, Federal law enforcement
    officers arrested Emerson Winfield Begolly in New Bethlehem, Pa. Begolly was a moderator and supporter
    for the internationally known Islamic extremist Web forum Ansar al-Mujahideen English Forum (AMEF).
    Begolly produced and distributed a 101-page document with instructions for constructing chemical-based explosives
    and a target list that included Jewish schools.16 Secular schools must be especially vigilant since religious
    terrorism is the most dangerous, with actors believing their violent actions are sanctioned and just.
    Often, the perpetrators of K-12 violence are known—either current or former students, staff, or teachers. They
    know the school layout, class schedule, and become familarized with the SRO’s habits. They know when and
    where to strike with least resistance for the most effect. Deterring school violence under these circumstances is
    very difficult.
    Emergent Threat: Stabbing Attacks
    Gun attacks are obviously the most feared weapons assault since mass casualties are inflicted in a shorter period
    of time and the mortality fears it conjures. However, we confiscate more knives in schools across the country
    than guns annually, and knifing incidents are on the rise as well. Between April 2013 and April 2015, there were
    at least 15 reported stabbings at schools across the country. Knife attacks are fast, unexpected, and devastating
    in terms of injuries. For example, on April 9, 2014, 16-year-old Alex Hribal used two kitchen knives to stab 22
    15 Dana Ford and Ben Brumfeld. “Police: Minnesota Teen Planned School Massacre.” May 2, 2014.
    16 The Investigative Project on Terrorism. “USA vs. Begolly, Emerson.” 2011.
    Active Shooter 40 ASIS School Safety & Security Council
    victims in their stomachs and lower backs at Franklin Regional High School outside of Pittsburgh, Pa. The devastating
    attack lasted over 4 minutes until the assailant was subdued by brave students.
    In stabbings, victims often do not feel pain from the inital wounding. Rather, it is a cold, icy feeling at the stabbing
    site since the body goes into shock. Victims often do not realize what has happened until they start bleeding, which
    delays the “fight or flight” response and allows the attacker more time to further engage and inflict wounds.
    Reviewing stabbing case studies, it appears people may be more willing to engage and subdue an attacker wielding
    a knife than choosing to run and/or hide from a gunman. However, engaging an enraged assailant wielding
    large knives is very difficult, and those who approach will be likely injured. The U.S. is not the only country faced
    with this emergent issue. Mass stabbing attacks have also occurred in K-12 schools around the world, with mass
    casualty attacks in Ireland, China, and Germany.
    Response to the Threat
    In conclusion, protecting our schools and their occupants from any type of attack—whether by terrorist, lone
    wolf, student, or faculty member with a vendetta—is extraordinarily difficult. We naturally don’t want to turn
    our schools into fortresses, although as I illustrate in my book, Soft Target Hardening, the goal is to present your
    facility as impenetrable so the bad guys move on. There are best practices for hardening your school and there
    may be some inconvenience to faculty, students, and parents, but once inside, the feeling of safety and security
    leads to a richer learning environment.
    There are other steps we must immediately take such as identifying and eliminating our psychological blind
    spot that prevents us from understanding that our school is vulnerable. A quick look at active shooting events
    in K-12 schools in the U.S. proves geographic location, the type of school, and economic class of its student are
    absolutely not factors. We should therefore focus on vulnerability, not probability. We also need to get out of
    the business of prediction and into that of preparedness. Finally, we have to come to terms with the fact the
    threat may be an insider—a disgruntled teacher or a bullied student. The identification of actors who have the
    propensity to carry out a school attack, or who could bring outside danger to our doorstep, is another area ripe
    for exploration.
    Although it is more comfortable to bury our heads in the sand on this topic and spend our precious resources
    on gym climbing walls or more smart boards, in the end only you can answer—what is the cost of not securing
    your school?
    Active Shooter 41 ASIS School Safety & Security Council
    When EMS Arrives on the Scene
    by Michael J. Fagel, PhD, CEM
    Law enforcement, as well as fire/EMS rescue, oftentimes converge at the scene of an emergent situation from
    several departments at different times and from different locations. In Active Shooter situations, there is no time
    to wait for standardized SWAT protocols. Rather, convergent initial contact teams that form up to neutralize the
    threat may be approaching the area from varying locations to address the situation. Additionally, other emergency
    medical, fire, and rescue personnel will be arriving but (based on predetermined protocols that should
    be practiced well in advance) they may stage offsite, away from the scene or out of the hot zone awaiting entry
    permissions. A strong command presence and discipline from all responding agencies is needed to manage
    various responding resources and to coordinate the treatment and transfer of victims.
    Individuals involved in the incident may be required to provide immediate lifesaving care to treat life threatening
    injuries of injured casualties. Normal EMS protocols may be suspended and the normal standard of care
    we enjoy throughout the U.S. is generally diminished since MS treatment will be focused primarily at triage
    and care of life threatening injuries. Initial EMS activities may occur in warm zones with further treatment and
    transport in a cold zone. Law enforcement security in both warm and cold zones will be critical to supporting
    effective triage, treatment, and transport of victims.
    As television coverage has often shown, injuries sustained during an Active Shooter situation may be catastrophic.
    EMS does not operate in a routine environment or provide normal response during this kind of operation.
    To assist, all persons involved must be able to adapt and overcome the events as they unfold. This cannot
    be accomplished without adequate preparations, preplanning, response drills, and similar activities. Failure to
    do so may well likely lead to repeated tragic results. Fire/EMS, law enforcement, and dispatch agencies’ active
    participation in planning and exercises will help to successfully adapt in a chaotic situation.
    Active Shooter 42 ASIS School Safety & Security Council
    Planning Practice and Preparedness are the Keys to Survival
    An emergency response plan is a continuous process; meaning it should never be viewed as a final, finished
    product. Also important to note, all affected parties, agencies, and members of the various entities associated
    with the plan must be part of the planning process and team. An effective emergency response plan needs the
    involvement from all stakeholders across all walks of life. Every departments internally to your organization
    must have an active role, as well as all outside stakeholders. This must include Police, EMS, Fire, Dispatch Agencies,
    Public Health, Public Works, Legal, Human Resources, and administration at all levels.
    An effective emergency response plan MUST include:
    • an effective method for reporting threats and other emergencies
    • an evacuation plan that is practiced with posted policies and procedures
    • appropriately signed, marked emergency escape procedures, and route assignments (i.e. floor plans, safe
    areas)
    • up-to-date contact information for, and responsibilities of, individuals to be contacted under the ERP
    • contact information concerning local area hospitals (i.e., name, telephone number, and distance from
    your location)
    • an emergency notification system to alert various parties of an emergency, including:
    —— individuals at remote locations within premises
    —— local law enforcement
    —— local area hospitals
    In addition, the emergency response plan specifies responsibilities and key contact information within your
    organization. The ERP should also include an emergency notification as well.
    In the event that evacuation is necessary, your facilities should have at least two evacuation routes that are conspicuous
    and well marked.
    With an effective emergency response plan and training in place, you and your staff will be better able to react,
    respond, and recover from a situation that will tax all elements of the team.
    Active Shooter 43 ASIS School Safety & Security Council
    The Facility Managers’ Responsibilities
    The facility manager’s responsibilities begin before any response is required. As part of the Emergency Response
    Plan, your facility managers:
    • Implement and understand site security procedures. Institute security access controls (e.g. keys, security
    system pass codes).
    —— Key fobs, door codes
    • Distribute critical items to appropriate managers/employees, including:
    —— Pocket-sized floor plans in break-glass cabinets
    —— Keys and other access-control measures
    —— Facility personnel lists with mobile telephone numbers
    —— Daily schedule
    • Assemble crisis kits containing:
    —— Radios, tested and rotated batteries, chemical light sticks
    —— Floor plans
    —— Employee roster with emergency contact numbers
    —— Triage supplies to be used in emergent situations
    —— Catastrophic event medical supplies (tourniquets, chest wound sealers, combat gauze)
    —— Appropriate First-Aid kits
    —— Flashlights
    • Activate the emergency notification system when an emergency situation occurs; as well as a backup plan.
    • Ensure that the facility has at least two evacuation routes.
    • Coordinate with the facility’s security department to ensure the physical security of the location, as well
    as an alternate route.
    • Advise according to plans and protocols and if in higher education, timely and clear notification.
    • Secure doors.
    • Order area supervisors to immediately direct all personnel (employees, customers, visitors, vendors, etc.)
    in their area to evacuate the facility if it can be done safely and with caution.
    • If an evacuation is not possible, go to PRE-IDENTIFIED secure location. Lock the door and turn off the
    lights. Follow the protocol for the shades and other devices if appropriate.
    • Keep personnel as calm as possible and try to notify 911 (using cell phones or telephones) of your location,
    number of occupants and status. Turn all cell phones silent!
    • Remain in the room until an appropriate all-clear signal is given or law enforcement arrives.
    • Prepare an incident report documenting personal observations.
    • Post evacuation routes in conspicuous location throughout the facility.
    • Place up-to-date and secure removable floor plans near entrances and exits for emergency responders.
    • Include local law enforcement and first responders during training exercises. The training must be as realistic
    as possible.
    • Encourage law enforcement, emergency responders, SWAT Teams, canine teams and bomb squads to
    practice for an active shooter scenario at their locations.
    • Foster a respectful workplace.
    • Beware of early indications of potential workplace violence and follow appropriate protocols as trained
    for the specific situation.
    Active Shooter 44 ASIS School Safety & Security Council
    Human Resources Responsibilities
    As part of your Emergency Response plan, your human resources (HR) department must also engage in planning
    for emergency situations involving an active shooter scenario.
    Planning for situations may help to mitigate the likelihood of an incident by establishing processes such as:
    • Conducting effective employees screening and background checks.
    • Creating an effective system for reporting signs of potentially violent behavior by your employees.
    • Making appropriate EAP counseling services available to employees.
    Training
    Once the emergency response process is ready for testing, you and your staff should be trained in preparing to
    respond to actives hooters situations, including the use of exercises that involve local law enforcement and fire/
    EMS responders.
    It is important for you and your personnel to establish and effective education and training program and is effectively
    and appropriately trained in its protocols and procedures so that you and your team can act effectively
    if you are ever confronted with an active shooter situation.
    One commonly used effective training practices in responding to an active shooter situation for you and your
    team to conduct well planned out and implemented active shooter training exercises.
    Security Consultants train in active shooter situations; along with local response agencies will be valuable resources
    as you prepare an effective training scenario appropriate to your situation.
    In addition to your immediate security staff, your employees should also be trained in:
    • Recognize the sound of gunshots.
    • Reacting quickly when gunshots are heard and/or when a shooting is witnessed.
    • Training should cover:
    —— knowing how to evacuation the area
    —— knowing how to hide out
    —— knowing how to action against the shooter as a last resort
    —— know when to call 911 immediately
    —— knowing how to respond when law enforcement arrives
    —— keep your hands visible at all times
    —— keep your fingers spread; drop any objects in your hand
    —— how to respond to official commands
    —— do not reach for or grab responders
    —— knowing how to adopt a survival mindset during times of crisis
    Active Shooter 45 ASIS School Safety & Security Council
    Meeting the Needs of Those with Disabilities
    In addition to developing the Emergency Response Plan, conducting regularly held evacuation instructions,
    and performing any other retraining exercises, you should ensure that your plans, evacuation instructions, and
    any other relevant information include provisions for managing the requirements of individuals with special
    needs and/or disabilities. It is important to ensure that your building is accessible for individuals with disabilities,
    in compliance with Americans with Disabilities Act (ADA) requirements.
    Adopting these proactive measures to anticipate security concerns before they materialize can be achieved by
    creating an effective security strategy, based on a robust Emergency Response Plan that is exercised.
    All of the above may enhance the resiliency for your organization. This is essential to deterring potential threats.
    Adversaries, including active shooters, generally focus on the MOST vulnerable target and may choose to strike
    those targets (i.e., targets of opportunity or “soft” targets). Therefore mitigating the risk to your facility by minimizing
    external threats outside your secure perimeter is of paramount importance. Having an effective security
    program in place will reduce the likelihood of being perceived by your adversary as vulnerable and could help
    dissuade such potential threats from selecting your facility as a target. Such as when an individual engages in
    suspicious weapons and ammunition purchased and stockpiling.
    Private sector security and law enforcement agencies may use a variety of protective measures to help disrupt
    or mitigate a potential active shooter attack.
    Target Selection, Planning, Rehearsal, Attack, Escape and Exploitation
    Awareness is key. Observation of precursors such as behavior, elicitation, and unusual purchases are some of
    the factors that can be looked at as we try to mitigate the effects of such an attack.
    Planning, preparedness, practice, and options for consideration must be explored for the betterment of the
    people we serve. Involving all relevant stakeholders in this process will provide the best potential for a managed
    outcome at the time of an event’s occurrence.
    Further Reading
    Active Shooter: A Handbook on Prevention by Joshua Sinai, Ph.D. Published by ASIS International. (2013)
    Active Shooter 46 ASIS School Safety & Security Council
    Behaviorial Cues
    by Inge Sebyan Black, CPP, CFE, CPOI
    Introduction
    While we cannot always predict human behavior and there is no definitive psychological profile of an active
    shooter, many of these individuals do share similar behavioral characteristics. No singular behavior is absolute,
    but a pattern of behavior would be worth identifying. For example, those who commit these acts often choose
    places with little police presence and where citizens are unarmed. There are behavioral cues at the early stages
    that are signs law enforcement and security personnel might recognize to prompt intervention.17 One might
    recognize the suspect preparing for his event through the gathering and concealing of weapons; or notice the
    suspect possibly warning certain individuals not to attend school or work. Being aware and observant of suspicious
    activity and behaviors can help prevent an active shooting incident from happening.
    When making assumptions about whether someone you encounter might be a shooter, there are some cautions.
    We need to remain open about borderline dysfunctional personalities that might be missed because they
    blend in. Although firearms are typically used, we should not discount the use of vehicles or improvised explosive
    devices as weapons. And although women were identified as the shooter in only 6 of the 160 incidents the
    FBI studied, we should not discount the possibility of women as shooters. Having studies of past active shooter
    events helps the ongoing conversation of best practices and helps us develop/improve emergency practices.
    But these events do change as time passes by, and we will have to be ready and prepared for other and new scenarios.
    In the 2014 FBI report on the “Study on Active Shooter,” out of 160 incidents, in all but two, the shooter
    acted alone.18
    Active Shooter Training in the University Climate
    The term “active shooter” describes an armed person (handgun, rifle, or other ballistic weapon) who is using
    deadly force on other persons, and the engagement is in progress. Because the event is ‘live’, everyone and anyone
    from law enforcement to the teachers and students have the potential to affect the outcome based on their
    response or actions. Therefore training becomes the single most valuable way to affect positive responses, and
    thus mitigating loss of lives.
    17 School Resources & Training Institute. Active Shooter.
    http://www.school-training.com/newsletter/articles/submitted/active-shooter.shtml
    18 Federal Bureau of Investigations, U.S. Department of Justice. “A Study of Active Shooter Incidents in the United States between 2000 and 2013.”
    http://www.fbi.gov/news/stories/2014/september/fbi-releases-study-on-active-shooter-incidents/pdfs/a-study-of-active-shooter-incidents-in-theu.
    s.-between-2000-and-2013
    Active Shooter 47 ASIS School Safety & Security Council
    Training raises awareness to the real possibility that such an event will occur. Training facilitates dialogue which
    creates ideas and protocols for when an active shooter occurs. Studying the active shooter events of the past
    tells us these types of event can be over before the police arrive. Findings establish the largest impact of fatalities
    occurs within a matter of minutes. In 64 incidents where the time duration was ascertained, 44 ended in under
    5 minutes; 23 ended in 2 minutes or less. In some instances, law enforcement was present or able to respond,
    but the individuals themselves made life and death decisions.
    As with other emergency management protocols, the objectives of training are both discussing best practices
    and conducting drills. Although lockdown drills were commonplace at one time and serve a particular purpose,
    in active shooter drills, drills for all aspects of ‘run, hide and fight’ should be practiced and discussed. There
    should be several different phases of training: one for management, one for new hires, and another ongoing,
    annual training for all employees.
    This training should include
    • clear instructions on the announcement/communication of an active shooter scenario (i.e., “Active
    Shooter on Campus”)
    • overview of the company/faculty handbook
    • overview of the emergency preparedness plan
    • discuss active shooter scenarios (best and worst case)
    • making life and death decisions
    • individual options and recognizing the best one for survival
    • safe meeting place following an active shooter
    • behavioral signs/early warning signs to report, and who to report them to
    • run, hide, and fight drills
    • the role of management
    Because of the unpredictable nature of active shooter situations, each person is required to make an individual
    choice on how they would respond. School administrations implement various ways (email, computer pop-up
    messaging, verbal or other notification through speaker systems) to notify students, teachers, and visitors about
    impending crisis situations. It is clear that participating in training to estabilish what to do in emergency situations
    will save lives. In those 2 to 5 minutes, students and teachers can make a life-changing difference. The
    secret is Drill, Drill, Drill.
    Active Shooter 48 ASIS School Safety & Security Council
    To Arm or Not to Arm … Teachers
    by Jason Thomas Destein
    There is a growing debate in academic and school safety communities. A debate that could in fact become a
    hot-button political issue in the next presidential election. This debate is centered around whether or not teachers
    should be allowed to carry concealed handguns on school grounds and in the classroom. The debate itself
    has been around for a number of years, but as violence from external intrusion in our schools increase, this
    conversation is gaining more participants and a growing audience.
    Support for arming teachers is growing around the country (and the world for that matter). As we see the increase
    in attacks involving schools, there is no question that some people will lean towards responding with a more
    forceful tactic. One group based in Kentucky called POST (Protecting Our Students and Teachers) advocate
    arming teachers in schools.19 You can visit their website and see firsthand the positions and strategies they are
    pushing for. Essentially, there are three points that POST outlines as reasons their program will work:
  1. Deterrence – believing that a sign posted on a door stating that this school participates in the POST
    program will prevent a shooter from entering, based on recent shooting events in schools, the shooters
    were not looking for a fight but rather victims.
  2. Immediate Armed Response – In the event of a shooting, there would be people already onsite to respond
    quickly.
  3. Thoroughness of training – POST requires extensive training and regular certification.
    The other side of this debate is centered on those who support keeping guns out of teachers’ and administrators’
    hands while in school. While there are many reasons offered by those on this side of the debate, there are a few
    reasons that seem to be most prevalent. Kenneth S. Trump, a 25-year school safety expert and industry leader,
    has articulately outlined some of the big reasons on his website.20
  4. Training – No matter how many hours of firearms training are administered to a teacher, to think that
    they would be able to respond and act in the same manner as our public safety officials is false.
  5. Are there policies and procedures in place and approved by school boards, insurance companies and
    their legal representatives.
  6. What happens in an accidental shooting from one of these weapons or if a student takes the gun from a
    teacher.
    19 http://postky.org
    20 Kenneth Trump. “Arming Teachers and School Staff.”
    Active Shooter 49 ASIS School Safety & Security Council
    Both sides of this debate add their points and counterpoints and argue their sides with equal passion. What is
    interesting is both sides have the same goal, that is to keep our schools, the students, and teachers safe. Hopefully
    reading this has presented you with thoughts of going out and conducting your own research, and be able
    to support or challenge the school districts and local elected leaders on their position.
    Should you decide to arm, consider what has to be done assuming you are staffed with tens to hundreds of
    teachers. You might seek an assistance program from your local police department, which has Glock pistols and
    a firing range with several certified range masters. Each teacher would need to be trained for two weeks on the
    use of the same firearm, which equate to expending 1,000 to 1,500 rounds of ammunition. So with eight teachers
    at the range at any one time, you will need to do the math to see how long it would take for them to complete the
    training. Plus, you will need to take into consideration if someone doesn’t pass certification or staff that need to
    be recertified. The process isn’t easy, and you will need local police help and assistance.
    Active Shooter 50 ASIS School Safety & Security Council
    APPENDIX A
    Active Shooter Tabletop Exercise
    by Victor Cooper, CPP
    Please click the following button to launch this file. Adobe Acrobat is recommended to view the presentation.
    The initial view is set to open in full screen mode. Press “ESC” on your keyboard to exit full screen mode.
    Active Shooter 51 ASIS School Safety & Security Council
    APPENDIX B
    Shootings on the Rise
    by Mark Tarallo
    More than 1,000 Americans were
    casualties of active shooter incidents
    that took place between 2000 and 2013.
    The actual figures—486 individuals
    killed and 557 wounded—come from
    a recent FBI report, A Study of Active
    Shooter Incidents in the United States
    Between 2000 and 2013.
    The goal of the study, which the FBI
    initiated in early 2014, is to provide federal,
    state, and local law enforcement
    with information and a better understanding
    of active shooter incidents so
    that they will be more prepared to prevent
    and respond to future incidents.
    Of the report’s many findings, one
    clear message stands out: the frequency
    of active shooter incidents is increasing.
    From 2000 to 2007, an average of
    6.4 active shooter incidents occurred
    annually. In the next seven years of
    the study, the average increased by 166
    percent, to 16.4 incidents annually. The
    peak years were 2010, with 26 incidents,
    and 2012, with 21 incidents.
    “This trend reinforces the need to
    remain vigilant regarding prevention
    efforts and for law enforcement to aggressively
    train to better respond to—
    and help communities recover from—
    active shooter incidents,” the report
    says.
    On the ground, there is more and
    more receptivity for active shooter
    training, says Timothy Dimoff, CPP,
    an active shooter training expert and
    president of SACS Consulting & Investigative
    Services, Inc. In the past, when
    conducting training sessions, Dimoff
    says he would often encounter an attitude
    of, “Do we really need this?”
    “Now, the shift is we’re seeing people
    saying, ‘We’re very glad you’re here.
    This thing can happen anywhere,’” Dimoff
    says. He has also noticed an increased
    demand for training among
    churches and nonprofit organizations,
    with administrators of those facilities
    seeking tools to be prepared for a possible
    incident, reflecting a mindset of,
    “Let’s have a game plan, just in case,”
    he says.
    In the FBI report, the upward trend
    in the number of incidents is even more
    dramatic when examined in terms of
    casualties. Before 2007, the number of
    casualties in any given year peaked at
  7. In 2007, the number of casualties
    rose to 126 and eventually peaked in
    2012 at 208.
    In the study, the incidents with the
    highest casualties were the shootings
    at Cinemark Century 16 Theater in
    Aurora, Colorado, in July 2012, with 12
    killed and 58 wounded; Virginia Polytechnic
    Institute and State University in
    Blacksburg, Virginia, in April 2007, with
    32 killed and 17 wounded; Fort Hood
    Soldier Readiness Processing Center in
    Fort Hood, Texas, in November 2009,
    with 13 killed and 32 wounded; and
    Sandy Hook Elementary School and a
    residence in Newtown, Connecticut,
    in December 2012, with 27 killed and 2
    wounded.
    The findings also reflect how much
    damage can occur in a short period of
    time. Of the 64 incidents whose duration
    could be measured, 44 (69 percent)
    ended in 5 minutes or less, and 23
    ended in 2 minutes or less. According to
    the FBI, this finding illustrates the importance
    of training—for police and civilians—
    that focuses on making quick
    decisions under pressure.
    “Even when law enforcement was
    present or able to respond within
    minutes, civilians often had to make
    life and death decisions, and, therefore,
    should be engaged in training and
    discussions on decisions they may
    face,” the report says.
    According to Dimoff, this finding
    reflects a key change in the way active
    shooter incidents are perceived—
    namely, that the police are no longer
    the first responders. “The first responders
    are now the general public [on site],
    and the potential victims,” he says.
    “Everyone in that building is a first responder.”
    Dimoff says that, under this concept
    of first responder, those on site are
    trained to delay the shooter in reaching
    targets—by erecting barricades, fleeing,
    or fighting back in some way. Law
    enforcement has focused on getting
    response times down, and officers are
    now trained to go in right away, instead
    of waiting to set up at the perimeter.
    Besides an increasing frequency
    rate, the report also found that active
    shooter incidents are not confined to a
    specific environment or geographical
    area, but are wide-ranging and nationally
    ubiquitous. The 160 active shooter
    incidents examined in the report took
    place in 40 of 50 states (and Washington,
    D.C.), in small towns and big cities,
    and in urban and rural areas.
    The settings also varied. Though 70
    percent of the 160 active shooter incidents
    occurred in either commercial
    Copyright © 2016 ASIS International, 1625 Prince Street, Alexandria, VA 22314. Reprinted by permission from the
    January 2015 issue of Security Management magazine.
    Active Shooter 52 ASIS School Safety & Security Council
    facilities or schools, incidents also occurred
    in churches and other houses of
    worship, as well as on military and other
    government properties, in healthcare
    facilities, on city streets, and in private
    residences.
    The report also revealed some patterns
    regarding the shooters. They tend
    to act alone; all but two incidents involved
    a single shooter. They often kill
    themselves after killing others—in 64
    incidents (40 percent), the shooters
    committed suicide. Of those, 54 shooters
    did so at the scene of the crime. In at
    least 9 incidents, the shooter first shot
    and killed a family member in a residence
    before moving to a more public
    location to continue shooting. And not
    all the shooters have been caught: at
    least five remain at large.
    The report does not offer any theories
    on why the frequency of incidents
    rose dramatically starting in 2007.
    However, Dimoff’s firm has researched
    more than 300 active shooter incidents,
    and he says that one constant revealed
    by the research is that the shooter suffers
    serious psychological difficulties
    and relishes the possibility of becoming
    famous for a killing spree. Killing themselves
    becomes the “perfect ending” to
    their struggles.
    “They basically want to go out in a
    blaze of glory, and they envision their
    face and name being paraded over the
    news media,” Dimoff says.
    If anything, media coverage of mass
    killings has become more intense, and
    in recent years the intensity has been
    compounded by social media networks,
    which provide more channels to
    get the shooter’s story out, Dimoff explains.
    “That’s a dangerous formula to
    have out there,” he says. Thus, while he
    was not sure why 2007 in particular was
    the first year of the increase in frequency,
    the fact that incidents are on the rise
    is not surprising, he adds.
    As for the victims, they also ranged
    widely—young and old, male and
    female, of all races, cultures, and religions.
    Some were strangers to the
    shooter; others were family members,
    fellow students, coworkers, and law enforcement
    officers, notes the report.
    The findings have led to some
    clarification in the way incidents are
    described and classified by the government.
    Ten of the officers who were
    wounded in incidents were shot in
    gunfights that occurred in open spaces.
    “Based on these study results, therefore,
    the FBI will no longer use the term
    ‘confined’ as part of the ‘active shooter’
    definition,” the report says.
    Overall, 64 of the incidents (40 percent)
    fall under the recently adopted
    federal definition of “mass killing,”
    which is defined as incidents when at
    least three victims are killed.
    Although the report’s findings are
    grim, Dimoff says that he has noticed
    the beginnings of a positive development.
    While the frequency of active
    shooter incidents has risen, there are
    early anecdotal signs that the increased
    amount of training under the delay-
    the-shooter paradigm is reducing
    the number of casualties per incident.
    “We’re just starting to see that,” he says.
    Active Shooter 53 ASIS School Safety & Security Council
    APPENDIX C
    The Best Defense
    by Laura Spadanuta
    When a person faces a life-threatening
    situation, like an active shooter, higher
    analytic functions shut down. But training
    can ensure that the proper response
    to the threat occurs almost instinctively.
    That’s the basis of boot-camp training
    for soldiers. Police and private security
    professionals have long understood
    the need for strong training programs.
    In the wake of deadly shootings at Columbine
    and elsewhere, K-12 schools
    have come to realize that one or more
    attackers with modern large-capacity
    weaponry can cause massive loss of life
    before the police are able to arrive on
    the scene and intervene. Thus, students
    and staff will have to confront the threat
    on their own. Given that reality, schools
    are starting to put more emphasis on
    the importance of training students
    and staff in various response scenarios
    The approaches to active-shooter
    training are evolving, especially in light
    of the recent Newtown and Aurora
    shootings. Not everyone can agree on
    the best approach, but they all agree that
    any training program must be tailored
    to the school, taking into consideration
    the facility’s layout, the makeup of the
    classes, and other characteristics.
    Evolution. When a school orders a traditional
    lockdown, it includes shutting
    and locking doors, turning off lights,
    and having students hide as best they
    can. In some situations, this is still the
    safest approach. However, in other
    cases, students end up being defenseless
    targets for the shooter or shooters
    to easily and cruelly pick off. This was
    the case at Columbine when students
    were shot while hiding under tables in
    the library. (Though if the students had
    evacuated at the point that they knew
    there was a shooter, they may have met
    the gunmen in the hallway as well.)
    Although many schools still teach
    traditional lockdowns, there has been
    a movement toward newer approaches
    that enhance the traditional techniques,
    says Amy Klinger, educational
    administration professor at Ohio’s
    Ashland University, who spoke on the
    topic at the GovSec conference earlier
    this year in Washington, D.C. Klinger is
    also director of programs for the Educator
    School Safety Network, a nonprofit
    school training organization.
    Not everyone applauds the newer
    approaches, however. Kenneth Trump,
    president of consulting company National
    School Safety and Security Services,
    is concerned that people are too
    quick to discard proven best practices,
    like lockdowns. While the lockdown
    and other security measures implemented
    during the active-shooter situation
    at Sandy Hook Elementary school
    in Newtown, Connecticut failed to save
    the lives of 26 people, those measures
    did save many other lives in that incident,
    he says. “There were people who
    reportedly were in lockdown when
    the gunman went past the room. So
    it did not work for all, but it did work
    for some. So you just don’t summarily
    throw out decades-plus of best practices,”
    asserts Trump.
    Proponents of the newer options
    counter that they are trying to marry
    the best of the old with something new.
    “Oftentimes, people think that it’s replacement
    of lockdown. It’s really not.
    It’s adding additional components to
    lockdown that are much more situation-
    specific rather than just sort of
    a general response to any particular
    event,” Klinger tells Security Management.
    New Tactics. Two popular activeshooter
    response-training approaches
    that go beyond traditional lockdown in
    active-shooter training are Department
    of Homeland Security (DHS)-
    supported “Run Hide Fight,” and ALICE
    (Alert-Lockdown-Inform-Counter-
    Evacuate).
    The City of Houston used federal
    DHS funds to produce “Run Hide Fight”
    as an active-shooter-response video.
    It instructs viewers that when they
    are confronted with an active-shooter
    threat, they should first run out of the
    building or kill zone if possible; if that’s
    not possible, they should hide. If hiding
    securely isn’t an option, they should
    fight with anything available to end the
    threat, rather than simply waiting to
    become the next victim. This approach
    has won many supporters, and it is part
    of the Federal Emergency Management
    Agency’s online active-shooter training
    program. But it was for the workplace,
    not schools.
    ALICE, a training course developed
    by former SWAT-team leader
    Greg Crane, of training company Response
    Options, is specifically geared
    toward school shooters. However, the
    “Run Hide Fight” tools are now used in
    Copyright © 2016 ASIS International, 1625 Prince Street, Alexandria, VA 22314. Reprinted by permission from the
    August 2013 issue of Security Management magazine.
    Active Shooter 54 ASIS School Safety & Security Council
    schools as well. Though both programs
    include the traditional tactics of evacuating
    (running) when possible and
    locking down in a room (hiding) when
    evacuation isn’t a reasonable option,
    they also include instruction on how to
    fight back, which has generated controversy
    (more on that later).
    Evacuation. The evacuation aspect
    can be difficult. That’s true in
    a multi-level hotel or a high-rise office
    building, and it’s no less true in a
    school. There are often classrooms on
    several floors, and those rooms may not
    be near an exit. Additionally, there may
    not be communication about where the
    shooter is. But having a plan can help.
    That’s why Klinger tells Security Management
    that schools should have certain
    protocols for when to flee. Klinger
    said during her presentation that kids
    who leave tend to survive these attacks.
    It’s important to remember that
    schools have a wide range of communication
    capabilities. “We work in schools
    where they don’t even have a PA system,”
    Klinger says. Others have advanced
    systems that can send messages
    throughout the school. But even where
    communications are good, it’s possible
    that the person responsible for operating
    the system will be incapacitated at
    the start of an attack—or that person
    may simply not have good information
    to relay—so there is no telling what sort
    of information will be passed back to
    teachers and classrooms. Faculty must
    be prepared to work with what they’ve
    got in the moment and use that for
    quick action.
    “When I have information about
    what’s happening, if I’m at the north
    end of a building and the active-shooter
    event is occurring at the south end of
    a building in the gym, why would I lock
    the door and sit there, and wait for him
    to find me? Why would we not remove
    ourselves from this situation?” asks
    Klinger.
    But running has its risks, because
    one never knows if the shooter will
    be along the escape route, and young
    children might be hard to keep quiet
    or control in an evacuation, increasing
    the risk of evacuation, while sheltering
    in place has fewer risks if the room is
    secure. “We’re talking about in K-12,
    with maybe the exception of the lunchroom
    or the gymnasium, those rooms
    lock. Even in many of those cases, those
    rooms lock. And if they don’t, we’re
    usually putting the kids in the kitchen
    or in locker rooms,” says Paul Timm,
    PSP, president of RETA Security.
    Bob Lang, assistant vice president
    for strategic safety and security at
    Kennesaw State University in Georgia,
    sees evacuations as one viable option,
    depending on the circumstances. His
    school trains teachers to plan out possible
    evacuations. “So we are training
    them in what to do when they first walk
    into their new facility and new classroom
    and what to look for relative to escape
    routes…what to look for in figuring
    out how to get people out.”
    In training and conducting drills
    with the students to prepare them for
    evacuations during an active-shooter
    situation, it’s important to stress that
    those evacuation routes might differ
    from the ones used daily or during a fire
    drill, Klinger says. They’ll also need to
    be taught that doors and windows that
    they normally wouldn’t think of using
    might be something they’d need in this
    unique type of threat situation.
    The key is “to make sure kids understand
    there [are] multiple ways out of a
    room or out of an area. Especially areas
    like gyms or cafeterias, where you have
    large numbers of kids. They’re going to
    try to go out whatever door they came
    in as opposed to the four or five other
    doors that might also lead them to safety,”
    Klinger says.
    Barricading. If there is a closet or a
    safe room for children to hide in so that
    it appears there is no one in the classroom,
    that’s a desirable option and one
    that has been employed successfully by
    schools in mass shooting events. But
    when there is nowhere to hide, a barricade
    against the door may help deter
    the shooter or at least stall him while
    law enforcement arrives. In training,
    teachers are taught to be aware of the
    way the door opens. They are taught
    “to determine whether the door opens
    in or opens out, [because] … If it opens
    out, then you’re not able to barricade
    the door,” says Lang.
    Barricades are going to be makeshift,
    says Klinger. “You’re not trying to
    keep this individual out for two hours.
    You’re trying to keep him out for a very
    brief amount of time, until he moves
    on to the next room or until law enforcement
    arrives or to delay, deter,
    and defend from that individual. So we
    use whatever you have—desks, chairs,
    tables. Whatever you can flip over and
    put up against a door,” she explains.
    Klinger adds that there can be internal
    barricades also, so children can be
    barricading within the room, such as
    behind overturned desks. That way, if
    the shooter does get through the door,
    at least it will be more difficult to actually
    get at anyone, which might buy
    time to disarm the shooter.
    Situational specifics. An important
    aspect of training is to get teachers to
    recognize that they will have to make
    some snap judgments based on the
    specifics at the time. In Klinger’s training
    program, faculty are taken into a
    classroom environment where they
    can role-play how they would respond
    in certain scenarios. That way, she explains,
    they can get the hang of thinking
    through the scenario and quickly
    deciding what the best route to take is.
    This “really helps people to start to understand
    that there is no right or wrong
    answer, that there [are] a lot of different
    options that people could undertake
    depending on the situation and what
    they know is happening and so on,”
    says Klinger.
    Teachers are also taught what factors
    to consider in evaluating the viaActive
    Shooter 55 ASIS School Safety & Security Council
    bility of evacuations. For example, if
    the teacher has a first-floor classroom
    where there’s a door that leads directly
    outside the building rather than into a
    hallway, or if there are windows that the
    students can climb out of, then evacuation
    may be feasible and safe—and
    thus desirable—even if the teacher or
    students can’t tell where the shooter is.
    If the shooter comes at lunchtime,
    evacuation may also be the best option
    for those teachers and students in the
    cafeteria, because there are typically
    multiple exits in that area, and it’s an
    open space where it might be harder
    to find cover from the shooter, says
    Klinger.
    If the teachers are in upper-floor
    classrooms, however, the only exits
    will be into hallways, which could be
    a more dangerous choice if they don’t
    know where the shooter is; so instead,
    their best option might be to barricade
    the room until they get a better sense of
    the situation.
    Fight/Counter. Most people agree
    that evacuating when possible and barricading
    when stuck in a room are the
    right approaches, but there are many
    dissenters from the idea of fighting
    back in an environment that involves
    K-12 students. Trump thinks the ALICE
    approach, particularly the “counter”
    portion, is preying on the heightened
    post-Newtown emotions and isn’t the
    best way to prepare for a potential active
    shooter. “You’re asking a kid to take
    a 20-minute or 40-minute workshop or
    assembly, and then implement something
    that people in the public-safety
    community armchair quarterback every
    time they have an encounter with
    someone,” Trump says. Trump notes
    that the approach doesn’t take various
    age levels, development stages, and
    special needs into consideration. He
    adds that it could open students up to
    further injury, such as if the shooter has
    explosives or was only going to commit
    suicide rather than hurt others.
    Moreover, schools that encourage
    students to attack may be opening
    themselves to additional legal liability.
    “One kid stands up and runs to attack
    the armed gunman and gets shot and
    killed, somebody’s going to be held
    accountable. There’s going to be tough
    questions. What were your policies
    and procedures? Was this run by your
    school attorney and approved? Did
    your school insurance carrier consider
    this and review this and give you the goahead?”
    Trump states.
    Timm agrees that teaching students
    to fight back might not be the best approach,
    particularly if the students
    are in schools where the doors can be
    locked and the students might be safe
    in traditional lockdown. “From a liability
    standpoint, I probably don’t want
    the kids fighting anybody,” he says. And
    while he wouldn’t want kids to just be
    sitting ducks if the shooter gets into the
    safe room, he worries that if kids are
    told fighting is an option, they won’t
    understand that it should only be a last
    resort. “I just get nervous that whether
    the kid is 8 or 12 or…even 15, he might
    have a little cowboy in him and think,
    ‘I’m going to get that guy. I’m going to
    sprout a cape and get that guy.’ And
    maybe even leave the confines of the
    safe room to do it. I just think it’s not a
    good idea,” Timm says.
    Supporters stress that fighting back
    is a last resort. “If you’re in a dire situation,
    you need to go into survival
    mode and do whatever you have to do
    to have a chance to live,” Linda Watson,
    CPP, security consultant with Whirlaway
    Group LLC says. She adds, “We
    know these kids aren’t cops. They’re
    not trained in martial arts. They’re just
    little kids going to school…. But do you
    sit there paralyzed, or do you say, ok, if
    we have to fight, we fight?”
    “Ninety percent of our time training
    is on evacuation and barricading.
    We also spend time talking about violence-
    prevention measures. We talk
    about how teachers and school people
    can think more like an emergency responder,
    and even with things like communication
    and calling 911 and how to
    assist a law enforcement response, all
    those kind of things,” Klinger says.
    “We spend hardly any time…on the
    counter or fight aspect of it, for a lot of
    reasons,” she explains. “Number one
    because there is that pushback. But the
    primary reason is that when you focus
    on the fight aspect, everything else
    gets lost.” Klinger adds that what little
    training she does do on fighting back
    includes throwing things and creating
    diversions to get away. The “Run Hide
    Fight” video advises people to incapacitate
    the shooter if possible, by using
    whatever is available, such as chairs.
    The video also shows people hiding
    beside the door so they can catch the
    shooter off-guard when he enters the
    safe room.
    Emergency Communications. Ensuring
    that critical information can be
    communicated during an active-shooter
    situation is important. Klinger notes
    that the whole staff should know how to
    carry out these tasks in case the people
    who would normally fill those roles are
    hurt or not available during an attack.
    Teachers and other staff throughout
    the school should be trained not only
    in how to use the school’s emergency
    communications equipment but also
    in how to provide effective information
    to 911. For example, they should
    learn to be as specific as possible when
    giving information to 911 operators or
    when communicating with the rest
    of the school; in describing a shooter’s
    suspected location, for instance, that
    would mean providing room numbers
    if possible rather than just providing a
    wing or a floor.
    Drills. Experts all agree that it’s not
    enough just to tell people what they
    should do. You have to give them a
    chance to act out those lessons through
    exercises, both to test their training and
    to test the protocols themselves. “We
    Active Shooter 56 ASIS School Safety & Security Council
    have to do drills because there’s only
    a few times we know if our emergency
    procedures work and one of those is
    during the emergency. So that would
    be an inconvenient time to find out
    they don’t work, “says Timm. He advocates
    including local law enforcement
    agencies in such drills when possible so
    that there is collaboration and consensus
    between the school and potential
    first responders to any incident.
    Watson says that going through the
    motions during drills can make the actions
    that will be required feel more like
    second nature to the students should
    they ever have to respond in a real incident.
    “We pop up, and we hide under
    a desk, and we all pull into this room…
    or we all shelter in place so that it becomes
    a very natural, not a scary thing,
    just something that we do maybe once
    a month or whatever the frequency
    they feel they need,” says Watson.
    Klinger says that for the lockdown
    enhancement drills, her group
    conducts “what-if” scenarios, where
    teachers might find out from the
    principal whether there is a certain
    level of lockdown or if there is a shooter
    in a certain area, and then they have
    to figure out what the appropriate
    reaction would be to that particular
    threat situation. It’s not as crucial for the
    students to actually practice barricading
    as it is for them to understand all of the
    potential evacuation routes, she says.
    It is important to drill for a variety of
    possible situations that could arise with
    an active shooter. Trump is concerned
    that some schools do drills that are convenient
    for them, rather than ones that
    will be helpful in demonstrating the
    different problems that might come up
    during a true emergency. For example,
    some schools will only do drills in the
    morning but not when there are lunch
    periods. “That doesn’t make sense.
    That’s not good practice,” he states.
    The age of the children involved
    will affect how they are trained in these
    procedures, says Klinger. “When you’re
    looking at high-school kids, when
    you’re looking at secondary kids, I think
    you can be very open and very forthcoming,

[explaining]

‘this is what we’re
doing and why,’” Klinger says.
However, for elementary students,
Klinger says her organization encourages
teachers to build on important
skills that are already being taught.
Among those skills are moving together
quickly without pushing or trampling,
and obeying certain commands
quickly without asking questions. For
younger kids, especially, it’s “not necessarily
saying ‘this is what we would do if
there was a guy with a gun,’ but instead
you’re saying ‘this is what we would
do if in an emergency we all needed to
move quickly away, or if we all needed
to get away very quickly, or we all needed
to be together.” She adds that these
are skills that are transferable to other
extreme situations, such as a weather
emergency.
John Bruner, founder of In-Crisis
Consulting, compares drills to gameday
training in professional sports; for
example, football players will practice
with loud crowd noise being pumped
in so they get used to playing in hostile
stadiums. He says he has at times
used simulated gunfire during drills
with teachers and faculty to simulate
the noise and smell of gunpowder that
might send the individuals into fight or
flight responses. He adds, however, that
they would only do this when students
are not at the school and with advance
notice to participants and cooperation
from local police and public safety.
“Even though [they] know what’s
going on … I’ve seen teachers at the end
get a little emotional and start crying
because they’ve gotten a true feel for
what this feels like,” says Bruner.
Some schools go even farther and
use the sounds of live gunshots on
drills with student participants. Those
sorts of drills may do more harm than
good, however, according to Stephen
Brock, school psychology professor at
California State University in Sacramento
and a member of the emergency
assistance team for the National Association
of School Psychologists. Brock
worries that many children are going to
be upset and potentially traumatized by
being exposed to that type of training.
Brock also says that training for an
active shooter could have the effect of
making young children, in particular,
view schools as violent, scary places,
even when their schools are safe. It can
help to avoid referring to the events as
active-shooter drills and to reassure
younger children that the school and
the teachers are there to protect them,
he says. However, he questions whether
active-shooter training is an effective
use of school resources. He says limited
dollars and time might be better spent
preparing for other incidents, including
natural disasters like earthquakes and
tornadoes.
Other experts agree that schools
must not forget about the natural disasters
that Brock mentions and other
emergencies that need to be prepared
for. Watson says that emergency managers
should consider using an all-hazards
approach because tornadoes and
hurricanes occur more frequently than
active shooters. Considering the high
consequences of this type of low-probability
event, however, it is understandable
why some schools find it worth a
portion of their limited resources.
Active Shooter 57 ASIS School Safety & Security Council
APPENDIX D
Early Warning, Timely Response: A Guide to Safe Schools
U.S. Department of Education
Although most schools are safe, the violence that occurs in our neighborhoods and communities has found its
way inside the schoolhouse door. However, if we understand what leads to violence and the types of support
that research has shown are effective in preventing violence, we can make our schools safer. Research–based
practices can help school community’s administrators, teachers, families, students, support staff, and community
members recognize the warning signs early, so children can get the help they need before it is too late.
This guide presents a brief summary of the research on violence prevention and intervention and crisis response
in schools. It tells school communities:
• What to look, for the early warning signs that relate to violence and other troubling behaviors.
• What to do, the action steps that school communities can take to prevent violence and other troubling
behaviors, to intervene and get help for troubled children, and to respond to school violence when it
occurs.
Early Warning Response
Section 1: Introduction.
All staff, students, parents, and members of the community must be part of creating a safe school environment.
Schools must have in place approaches for addressing the needs of all children who have troubling behaviors.
This section describes the rationale for the guide and suggests how it can be used by school communities to
develop a plan of action.
Section 2: Characteristics of a School That Is Safe and Responsive to All Children.
Well functioning schools foster learning, safety, and socially appropriate behaviors. They have a strong academic
focus and support students in achieving high standards, foster positive relationships between school staff and
students, and promote meaningful parental and community involvement. This section describes characteristics
of schools that support prevention, appropriate intervention, and effective crisis response.
Section 3: Early Warning Signs.
There are early warning signs that, when viewed in context, can signal a troubled child. Educators and parents
and in some cases, students can use several significant principles to ensure that the early warning signs are not
misinterpreted.
This section presents early warning signs, imminent warning signs, and the principles that ensure these signs
will not be misinterpreted. It concludes with a brief description of using the early warning signs to shape intervention
practices.
Active Shooter 58 ASIS School Safety & Security Council
Section 4: Getting Help for Troubled Children.
Effective interventions for improving the behavior of troubled children are well documented in the research
literature. This section presents research and expert based principles that should provide the foundation for all
intervention development. It describes what to do when intervening early with students who are at risk for behavioral
problems, when responding with intensive interventions for individual children, and when providing
a foundation to prevent and reduce violent behavior.
Section 5: Developing a Prevention and Response Plan.
Effective schools create a violence prevention and response plan and form a team that can ensure it is implemented.
They use approaches and strategies based on research about what works. This section offers suggestions
for developing such plans.
Section 6: Responding to Crisis.
Effective and safe schools are well prepared for any potential crisis or violent act. This section describes what to
do when intervening during a crisis to ensure safety and when responding in the aftermath of crisis. The principles
that underlie effective crisis response are included.
Section 7: Methodology, Contributors and Research Support.
This guide synthesizes an extensive knowledge base on violence and violence prevention. This section describes
the rigorous development and review process that was used. It also provides information about the projects
Web site.
A final section lists resources that can be contacted for more information.
The information in this guide is not intended as a comprehensive prevention, intervention, and response plan
school communities could do everything recommended and still experience violence. Rather, the intent is to
provide school communities with reliable and practical information about what they can do to be prepared and
to reduce the likelihood of violence.