This document identifies minimum acceptance criteria for the utilization of data networks for IDS alarm monitoring for the protection of classified material under the National Industrial Security Program Operating Manual (DoD 5220.22-M) (NISPOM). These data networks may include private data networks (intranets or virtual private networks/VPN’s))or public data networks(“the internet”). This guidance establishes baseline security policies and requirements for sensitive, national security related applications and systems used for such alarm monitoring.
A. The NISPOM and the DoD Arms, Ammunitions & Explosives (AA&E) Manual (DoD 5100.76-M),specifies requirements regarding the use of IDS for the protection of classified material and certain risk categories of classified and unclassified AA&E. IDS utilized as supplemental protection for classified material as well as AA&E must comply with the Underwriters Laboratories standard for National Industrial Security Systems (UL 2050) for installation, testing, operations and maintenance.UL 2050 also identifies physical security measures for IDS when utilized for protection of DoD AA&E.
B. UL 2050 provides the option of utilizing a data network2for alarm signal monitoring. While UL2050 allows monitoring over data networks and specifies technical performance specifications,3itdoes not address security requirements, policies and procedures for IDSs that utilize information systems (IS) for alarm signal monitoring over public or private communication lines. As NISPOM requirements apply only to classified information systems, additional guidance is needed to establish baseline security policies and requirements for sensitive, national security related applications and systems used for alarms.
C.IDS’ using data networks may range from the relatively simple (i.e. a contractor protected area connected directly through a static internet protocol (IP) network address to a Central Station Monitoring Service (CSMS), to the significantly complex [for example, hundreds of installations being remotely monitored over a corporate network at a Government Contractor Monitoring Station(GCMS).]
A.IDS’ utilizing data network transmission shall be installed in conformance with appropriate UL 2050requirements. All IDS equipment that is used to communicate with the data network shall be listed by
2 UL 2050 describes data network transmission as “switching that sends packets of information from the alarm control/transmission panel in an alarmed area to a monitoring station by way of private data networks (intranets or virtual private networks/VPN’s)) or public data networks(“the internet”). A private data network is also known as a local area network (LAN) or a wide area network (WAN). “For the purpose of the standard, public data networks may also include WAN and/or Internet Protocol (IP) networks.
3 Installation criteria, power, signal transmission, system operation, response personnel and procedures, time frames, records,etc.
10 UL for use with a data network, and the installation must result in the issuance of an appropriate UL2050 certificate.
B.Prior to installing an IDS [utilizing data networks for alarm system monitoring] for supplemental protection under the NISPOM, contractors will submit a request for approval to the CSA including the following information:
(1)UL Alarm System Description for National Industrial Security Alarm System Certificate(Form No. CS-ASD-NISS);
(2)Proposed IDS hardware configuration and connectivity diagram (e.g. LAN/WAN schematic diagram) detailing the components (e.g. control panel, network interface cards, and method of data transfer (e.g. encryption implementation in hardware/firmware/software, etc.) between the protected area(s) and monitoring station locations. Hardware components and software will be identified by product name and release version.
C.Depending on the type of installation (e.g. subscriber or monitoring station) and complexity of the IDS (as reflected in the hardware configuration and connectivity diagram,) the request must also address and certify compliance with the following requirements, as applicable:
(1)Government Contractor Monitoring Station (GCMS) or Central Station Monitoring Service (CSMS) IDS IS Server(s)/Host Computer:
The IDS IS Server(s) that receive and convert alarm signals to human readable form for appropriate assessment and response shall meet applicable UL requirements. The IS Server(s)running the IDS alarm signal processing software will be dedicated to the security system and staffed by monitoring personnel cleared to the Secret level. When monitoring personnel are not in attendance, the IDS IS[running IDS application
software] will be secured within a locked room
4with UL certified Extent 3 IDS protection.
Networked terminals that allow privileged access to the IDS IS host computer (i.e. can program or modify system operating parameters or user accesses, etc.)shall be continuously staffed by authorized personnel or protected within a locked room with UL certified Extent 3 IDS protection. There shall be no capability for changing the mode of operation or status of the protected area(s) IDS from locations outside the authorized IDS staffed terminals or protected area(s).
Workstations are terminals that only provide for acknowledgement of alarm signals. Unattended workstations will be secured within a locked room with UL certified Extent 3 IDS protection.
(4)User ID’s and Passwords:
A unique user ID (UID) and password is required for each individual granted access to the IDS IS Server, remote terminal and workstation.Passwords shall be a minimum of eight characters; consist of alpha, numeric, and special characters; and shall be changed a minimum of every six months.
4 Rooms securing unattended IDS monitoring servers/host computers, remote terminals and/or workstations shall be comprised of walls, floors and ceilings that are fixed in place and constitute a solid physical boundary.
5 “Extent of Protection” is defined in paragraph 5.18 and Table 23.1, UL 2050.
(5)Personnel Security Clearance (PCL) 6Requirements:
a.Authorized Alarm Service Company (ASC) Representatives: No clearance required.
When working in IDS protected areas ASC representatives will be precluded from access to classified information and will be escorted/supervised by appropriately cleared personnel.
b.System Administrator (SA):
The SA responsible for ensuring IDS IS server configuration,IDS communications signal processing software installation and updates, user account administration and maintenance will be cleared to the Secret level. For less complex IDS installations where the SA’s duties are limited to the assignment of a network address/enabling of a network path for signal transmission between the protected area and monitoring station, a PCL will not be required. If the SA requires unescorted access to closed areas storing information above the Secret level, they will be cleared to the appropriate level consistent with the level of access and need-to-know.
c.Information Technology (IT) Personnel:
There is no PCL required unless they have privileged access to the IDS server. Privileged access requires a Secret PCL. If IT personnel require full unescorted access to closed areas storing information above the Secret level, they will be cleared to the appropriate level consistent with the level of access and need to know.
Personnel working in closed areas who arm/disarm the system will be cleared to the appropriate level of classified access
Secret PCL required.
(6)Intrusion Detection Software:
IDS IS server(s) and remote terminals running IDS application and signal processing software will utilize intrusion detection software to monitor and log access attempts and all changes to IDS applications. The SA and facility security supervisor will be notified of unauthorized system access attempts and/or modifications for investigation or other appropriate action. Records will be retained for a period of 12 months (from the date of entry.)
(7)IDS Signal Transmissions:
All IDS signal transmissions between the protected area (closed area) and the monitoring station shall be:
a.Protected though firewalls or similar enhancements (e.g. routers, Virtual Private Networks/VPN’s, etc.) that are configured to allow only protective signaling data transfers between IDS components and addresses; and
b.Encrypted using a National Institute of Standards (NIST)Federal Information Processing Standards (FIPS)
7 approved algorithm with a key length of 128 bits(or greater); and,
6 A Personnel Security Clearance (PCL) is an administrative determination, based on an appropriate investigation, that an individual is eligible, from a security point of view, for access to classified information of the same or lower category as the level of the personnel clearance being granted.
7 UL 2050 also requires that the cryptographic modules must be certified in writing by the equipment manufacturer as complying with the NIST FIPS 140-2. The NIST validation list is available athttp://csrc.nist.gov/cryptva/140-/140val-all.htm.
8 Both the three-key Triple Data Encryption Algorithm (TDEA) and the Advanced Encryption Standard (AES) algorithm (FIPS197) are acceptable.
12c. Polled at a minimum of six minutes regardless of protected area alarm system status, i.e.open or closed.
(8) Service and Maintenance:
IDS IS testing, diagnostics, maintenance or programming will only be accomplished by the SA or ASC personnel,as appropriate. The ASC certifying alarm system installation and performing service,modifications or maintenance must be appropriately UL listed. While working in IDS protected areas, ASC personnel will be precluded from access to classified information and will be escorted by cleared and technically knowledgeable contractor employees. Unapproved use or substitution of non-UL listed IDS equipment or components can result in withdrawal of the UL certificate.
(9)Annual IDS Testing. After initial testing and approval, the IDS shall be inspected and tested annually to provide assurances that the IDS is functioning properly in accordance with UL 2050and the NISPOM.
(10)IDS Failure / Emergency Procedures. In the case of IDS failure, closed areas storing Secret or Top Secret material, GSA approved security containers storing Top Secret material, or substandard security containers storing no higher than Secret classified material will be periodically inspected by appropriately cleared personnel in accordance with NISPOM standards for providing supplemental controls. Areas storing DoD AA&E material will be continuously staffed. Emergency procedures will remain in effect until the system is restored to operational
D. The CSA will review the contractor’s request for approval. The CSA representative (IS Rep or in the case of AA&E, the designated Contracting Officer Representative) may consult with the appropriate UL POC regarding compliance with UL standards. If the IDS request and Alarm System Description form reflects compliance with these requirements,the designated CSA representative will sign [onpage 4 – Alarm Transmission for Data Networks] the Alarm System Description Form (CS-ASD-NISS) and maintain a copy of the form with the contractor documentation in the official facility file.The original will be provided to UL by the ASC or contractor, as appropriate. The CSA representative may then formally approve the proposed IDS as supplemental controls under the NISPOM.
E. The ASC will submit the signed Alarm Systems Description for National Industrial Security Alarm System Certificate (CS-ASD-NISS)along with the [ASC completed] Alarm System Certificate Request (CS-R2) to UL for issuance of the CRZH certificate for the protected space. Form CS-R2 is a multi-copy form. A completed copy will remain with the alarm customer as proof of [UL] submittal until the completed certificate arrives.
F. IDS currently approved in writing by a US Government cognizant security authority as meeting the requirements of DCID 6/9 for protection of SCImay be approved under the NISP provided the CSA approval was issued without waiving any requirements of the DCID 6/9 for Networked IDS. Alarm systems, procedures and related records approved for NISP use will be accessible for verification and review by DSS.
G. If an IDS approved under these procedures are subsequently determined not to be in compliance with UL and NISPOM requirements, the approval will be rescinded and the contractor will be required to implement an alternative procedures for supplemental protection of classified material.
CONTACT AAA ALARMS TODAY FOR EXPERTISE IN ELECTRONIC SYSTEMS FOR DETECTION, LOCKDOWN, ALERT, AND RESPONSE WITH LIVE VIDEO SURVEILLANCE/SECURITY CAMERAS AND GUN SHOT SOUND DETECTION ELECTRONICS
Acknowledgments.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ii
Introduction to Active Shooter Programs, by Jason Thomas Destein. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
The Six Phases of the Attack, by Linda Watson, CPP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Using Situational Awareness to Observe Pre-Attack INdicators, by Brad Spicer.. . . . . . . . . . . . . . . . . . . . . . . . . . 11
Proactively Preventing Active Shooter—Post-Incident Data, by Rick Shaw.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Lessons Learned, by Lawrence J. Fennelly.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Public Safety and School-Sponsored Onsite Training Programs for
Emergency Responders, by Jim McLain, CPP, FMP .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Behavioral Threat Assessment Teams, An Ounce of Prevention, by Jason Stone.. . . . . . . . . . . . . . . . . . . . . . . . . 25
Preventing an Active Shooter Incident, by Paul Timm, PSP.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Buying Time—Realistic Hardening of the Target at the Classroom Door, by Jim McLain, CPP, FMP.. . . . . . . . 30
K-12 as Soft Targets, by Dr. Jennifer L. Hesterman, EdD. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
When EMS Arrives on the Scene, by Michael J. Fagel, PhD, CEM.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Behaviorial Cues, by Inge Sebyan-Black, CPP.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
To Arm or Not to Arm…Teachers, by Jason Thomas Destein.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Appendix A: Tabletop Exercise, by Victor Cooper CPP.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Appendix B: Shootings on the Rise, by Mark Tarallo.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Appendix C: The Best Defense, by Laura Spadanuta.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Appendix D: Early Warning, Timely Respone: A Guide to Safe Schools, U.S. Department of Education.. . . . . 57
Appendix E: Conclusion from ASIS Workplace Violence Prevention
and Response Guideline, ASIS International Standards and Guidelines.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Active Shooter ii ASIS School Safety & Security Council
According to the FBI, the frequency and lethality of active shooter incidents in America is increasing. More than
one in four (29%) of these tragedies has occurred at educational institutions. Schools and universities must be
prepared to not only respond to these incidents, but to also prevent them.
Fortunately, when campuses properly prepare in advance to these emergencies, those prevention efforts also
address many other vulnerabilities, such as workplace violence, bullying, individuals with mental health and
addiction challenges, harrassment, emergency management (natural disaster as well as man-made), and even
public health crises.
A good friend of ours is a retired school teacher who has dedicated thirty-seven hardworking years to the profession.
Proud of what he had achieved, he took us over to his school for a tour and see the flower garden he had
planted. Before we got to his garden, we observed four doors propped open. Embarrassed, “It wasn’t called for.
They would have been secured if I was still here,” he said.
This white paper is a part of a series prepared by the members of the School Safety & Security Council. We are an
active council. Our members are from colleges and universities, K to 12, and consultants. This group has a deep
passion for the safety of children.
This paper address different approaches to Active Shooter situations, but ultimately we must think proactively
and take some action to protect individuals if the unthinkable does happen. Do not be complacent and take the
approach of, “it can’t happen here.” We are all vulnerable. The frequency as well as the effect of Active Shooter
appears to be increasing in this country. Being prepared is the key to survival and saving lives.
In this paper, Jennifer Hesterman will make a great point when she ask what the cost is of not securing your
school. We ask you to carefully think about these words. Take some action. Get prepared. Research your
industry and determine what works best in your particular situation. The response will not be the same for
everyone. Different environments require different responses. For example, the response for an elementary
school during an Active Shooter situation will not be the same as that for a university campus or a high-rise
office building. Develop emergency procedures and conduct active drills with local emergency responders.
Above all, train everyone—employees, security personnel, students, faculty and staff. You will need them to
know the appropriate response and what actions they should take.
My sincere thanks goes out to all the members of the School Safety & Security Council for their hard work in
putting this paper together and to our CVP, J. Kelly Stewart, CPP for his kind words of support.
Lawrence J. Fennelly,
School Safety & Security Council (Past Chair and Current Member)
Loss Prevention & Crime Prevention Council (Past Chair and Current Member)
Active Shooter 1 ASIS School Safety & Security Council
Introduction to Active Shooter Programs
by Jason Thomas Destein
How many Active Shooter programs are out there today? Reportedly “Run-Hide-Fight” has been lowering the
number of workplace violence fatalities over the years and would be a good model to follow except K-12 children
cannot comply with the “Fight” component of the program. There is ALICE, which is available at a national level.
“Lock out, Get out, and Take out” and ONE are yet others. These are all great programs in their own way, and
ultimately there is really no wrong program since their true intent is using them to save lives. But let’s face it,
each person has their own style and way they react to situations during stressful events, and an active shooter
event is certainly very stressful. To be clear, there is no perfect program out there. You find a program that fits
your needs, your style, so when you have to use it, you know instinctively what to do. This section lists these
programs to discuss the pros and cons of each to help you reach your decision or to explore further options.
Run, Hide, Fight
Run, Hide, Fight is based on the premise that during an active shooter situation there are steps that you follow
when you hear gunshots fired.
• Find a path and attempt to evacuate
• Evacuate whether others agree or not
• Leave your belongings
• Help others Evacuate
• Prevent others from entering
• Call 911
If you are not able to run, then you are encouraged to:
• Lock or block door
• Silence cell phone
• Hide behind large objects
• Remain quiet
• Stay out of shooters view
• Provide protection if shots fired in your direction
• Not to trap or restrict your options or movement
Active Shooter 2 ASIS School Safety & Security Council
If you do not have the ability to hide, then the last option is to:
• Attempt to incapacitate the shooter
• Act with physical aggression
• Improvise weapons
• Commit to your actions
It should be noted that “Run. Hide. Fight: Surviving an Active Shooter Event” is a U.S. Department of Homeland
Security Grant Funded Project of the Regional Catastrophic Planning Initiative. It was produced by the City of
Houston Mayor’s Office of Public Safety and Homeland Security.1
Lock Out, Get Out, Take Out
• By adding locks to all classroom doors and keeping them locked while in class. Also adding a lock and
video entry system to the main entrance for all visitors to use.
• Barricade all doors during a situation.
• Anything goes when you are in harm’s way, like breaking windows to use as the nearest exit.
• Anything goes, once again. When confronted and no other option is available, you do what you have to do.
Whether teaching how to respond to workplace violence in an office, factory/retail setting or college campus,
our consulting firm uses the “Run, Hide, Fight” video as part of our curriculum. The only additional information
we add is a reminder that “Run, Hide, Fight” is not linear. You may be in a situation when confronted by an active
shooter, and the only logical choice is to fight before you can run or hide. After a discussion about the video,
people often ask if “Run, Hide, Fight” should be taught in the K-12 setting. The short answer to this question is
“no.” The long answer is much more complicated.
1 Ready Houston, www.readyhoustontx.gov.
Active Shooter 3 ASIS School Safety & Security Council
Schools Must Keep ‘In Loco Parentis’ in Mind
It is important to remember, “Run, Hide, Fight” is shown in an office setting and not a school. Everyone depicted
in the video is an adult responsible for themselves and their own decisions. At 1:45 p.m. in the video, viewers are
instructed to: “First and foremost, if you can get out, do. Always attempt to escape and evacuate, even when others
insist on staying. Encourage others to leave with you, but don’t let them slow you down with indecision.”
K-12 schools operate under a different set of rules than business. Businesses must provide training for their
employees to meet OSHA regulations for safety, but the adults are expected to use that training and act as, well,
adults. Courts have ruled that schools and school personnel are in loco parentis, or in the place of a parent.
This gives the schools both responsibilities and, consequently, liability in regards to their actions for keeping
Not only are schools responsible for training students for an emergency, but also for leading the students in
an emergency. Therefore, in the event of an active shooter, a teacher cannot instruct their students to run for
the nearest exit, yet not make sure the students are actually trying to exit. Nor should a teacher leave behind a
student who is too frightened to leave an area, especially when the child is very young.
Barricades Compensate for Weak Locks, Doors and Windows
Hide is currently taught in schools under the term “lockdown.” When an active shooter is inside a school, staff
members are generally instructed to lock their classroom door, cover the window if possible, turn out the lights
and move the students to an area in the room where they are less likely to be hit with gun fire if the shooter fires
through the door. Although this has been shown to be an effective method for keeping students out of harm’s
way, many feel simply locking the door is not enough. Teachers are now being taught to barricade the room
using existing furniture, extension cords or commercial products designed specifically to keep a room secure
during an active shooter event. This enhanced technique of barricading overcomes weaknesses in doors such
as large windows to the side of the doorframe or large windows in the door itself.
Don’t Teach Children the ‘Fight’ Component
Fight is viewed as a last option when in direct contact with the shooter or if you do not have the option to run or
hide. Should we be teaching children to fight a person with a gun? NO! There are several good reasons why this
shouldn’t be taught to them. First, the active shooter event in school is rare. Depending on the age of the child,
we could be causing them unnecessary fear by preparing them for something that is unlikely to affect them.
Although we could have age appropriate conversations with older students about what their choices could be,
parents may not agree with the message we give their child. It is better to give the parents talking points so they
can have the discussion with their children.
Active Shooter 4 ASIS School Safety & Security Council
When my children were still in school, I gave them specific training on what to do in an emergency at school,
church, the mall, etc. As a police officer, I have a different perspective and skill set than most parents. I could
see some parents being extremely angry if I told their children what I told mine. However, I was exercising my
responsibility as a parent, not a school employee.
What About Teachers and Administrators?
Q: Should we teach staff members to fight?
A: Maybe. First, we must let them know it is their choice whether or not to attack the shooter. For example,
post 9-11, if anyone gets the least bit out of order on a plane, they are usually beaten by fellow passengers
and duct taped to a chair.
Q: Do all the passengers attack?
A: No. Some choose to attack, and others choose not to attack. This is what we need to teach our staff; they
have a choice. If they want to learn techniques for fighting, we should use our relationship with our local
law enforcement to provide the training to attack a shooter.
How ‘Lock Out, Get Out, Take Out’ Works
Q: So what do we teach in schools?
A: There are many programs and many “experts” willing to sell their sure-fire strategy for keeping students
and staff safe. Almost all are time consuming, and many are expensive. Two things schools are short of
are time and money. There is little time for training and almost no budget. Strategies must be easy to
learn, easy to remember, and easy to use. These strategies must give staff choices and allow them to make
choices based on their training and the situation.
Since Sandy Hook, many schools are securing the perimeter of the buildings and using a camera and buzzer
system to control entry to the building after the start of the school day. This is not a foolproof method of keeping
bad people out of the building, as we saw in the fall of 2013 at the McNair Discovery Learning Center when the
gunman entered the building behind a parent who had been buzzed in. However, this does add one more layer
to a school’s plan to keep their building secure. It is recommended that all classroom doors be locked at all
times, even when class is in session and even if the door is kept open. In the event of a threat inside the building,
the door is already secured and just needs to be pulled shut. The teacher does not need to find their keys, step
outside of their room into the hallway, and attempt to engage fine motor skills while potentially facing a shooter.
Steps can now be taken to barricade the door.
Active Shooter 5 ASIS School Safety & Security Council
Should the teacher attempt to lead their students out of the building at the onset of the event? Are they in direct
contact with the shooter? Do they know the exact location of the shooter and where the shooter is heading? Do
they know they have safe passage to get outside? Can they move all of their students quickly and at once? Do
they have enough information to make a good decision to leave a place where they are safe and move to an area
where they may not be safe? With so many questions, it reinforces the need to train our staff and allow them to
decide a course of action based on their training and the circumstances.
When in direct contact with an active shooter, you should do everything possible to get your students and
yourself out of harm’s way as quickly as possible. This means everything from heading to the nearest exit to
using a chair to break a classroom window and tossing students out the window. Or, you may be in a barricaded
room and no longer feel the room is safe. Get out anyway possible.
A teacher is with their class on the third floor of an old school. They have successfully barricaded their classroom
and did not attempt to leave because they had limited information on the location of the shooter. But, this is not
an active shooter event. A noncustodial parent has already killed his ex-wife and is at the school to murder his
child and commit suicide. He knows the police are on the way and has not wasted any time getting to his child’s
classroom. He has brought the tools necessary to breach the door.
It is unlikely that you or your students can survive unharmed by jumping from the third story. If that teacher
chooses to take out the shooter, there are no rules. They may use anything in their room as a weapon and do
whatever it takes to keep their students safe. However, if they choose to remain passive, that is also their choice.
Just as “Run, Hide, Fight” is not linear, neither is “Lock Out, Get Out, Take Out.” Staff members are trained in their
choices and allowed to make their choice based on that training and the current situation. However, it should
be stressed that when in contact with the active shooter, lockout is not a choice. Staff and students should put
as much distance between them and the gunman, or the staff member should do whatever is necessary to take
out the shooter. “Run, Hide, Fight” is an excellent training tool when working in colleges, office settings, and
factories. However, with the responsibility schools have for their students and range of ages of the students in
schools, “Run, Hide, Fight” should not be the model used for school safety.2
2 Gary L. Sigrist Jr. is the CEO and President of Safeguard Risk Solutions. He previously served as the Readiness and Emergency Management in Schools
(REMS) Project Director for the South-Western City School District in Grove City, Ohio.
Active Shooter 6 ASIS School Safety & Security Council
ALICE training is a strategy designed to increase survival during an armed intruder event.
ALERT: Inform as many people as possible within the danger zone of life threaten situation. Use
plain and specific language.
LOCKDOWN: Barricade the room. Silence phones. Prepare to evacuate or counter if needed.
INFORM: Communicate shooters location in real time if possible. 98% of the time the shooter works
COUNTER: Create noise, movement, distance & distraction with intent of reducing shooters ability to
shoot accurately. The focus here really is to disrupt the shooter by distractions. COUNTER is
EVACUATE: When safe do so, remove yourself from the danger zone.
Observe, Navigate, Escape (ONE)
The O.N.E concept was created mostly for the K-12 environment, as there are some schools that have not embraced
the Run, Hide, Fight concept or other programs for evacuation. The O.N.E concept is based on using your
senses to help you survive an Active Shooter situation. This concept does not encourage students to Run or Fight
their way out of a situation. There may be a point in which one of those action may be necessary, but O.N.E does
not encourage you to do either of those. Instead, O.N.E uses your natural instincts and senses that you have been
using all of your life. For children, especially in elementary school, learning using their senses is the most common
way they learn and understand. It only makes sense that we would teach them to evacuate using their senses so
that they understand what they are doing and remain calm. O.N.E was created by Securable Consulting, LLC and
inspired by the children of a local school district. Below is an overview of the O.N.E concept.
OBSERVE. This is the most important step in plan, as you will continue to OBSERVE at every step of the plan.
Simply stated, OBSERVE is meant for you to know what is around you. What is the environment you are in
(classroom, office, retail, coffee shop, etc.)
• OBSERVE with your senses (eyes, ears, nose, and touch.) You can gain valuable insight of your surroundings
just by trusting your natural instincts that we all have.
• LOOK to see if the shooter is near. Look to see if there are any signs of victims in your possible path. Look
to see if there are any possible items that you could use as a weapon if needed.
• LISTEN for any screams, further gunshots, footsteps, voices, sirens or any other sound that could indicate
some type of action. Try to ascertain distance and direction of the sound.
• SMELL the air. Is there anything different? Do you smell smoke, gun smoke or powder? Is the smell
strong or weak? This could tell you if you are close or far from the situation.
• TOUCH the walls, doors, windows and the floor. Feel for any vibrations or temperature changes. Again,
the intensity of the vibration of temperature changes can tell you how close or how far you are from potential
Active Shooter 7 ASIS School Safety & Security Council
Your surroundings can save your life if you are able to observe what is around you. We are in these environments
everyday and we should know them better than anybody else. Don’t get complacent with your surroundings
and take for granted what is around you. Escaping from harm is not as simple as running out. It can be an obstacle
course, and knowing your surroundings can be all the difference. USE YOUR SENSES AND OBSERVE YOUR
SURROUNDINGS! If your observations indicate that harm is not far, then certainly shelter and hide as best you
Remember this: You have been developing your senses since you were born! Children are learning every day
using their senses, and they are understanding more than anything else at this point in their lives. Most people
trust their senses more than anything else, and rightfully so. It is basic human instinct to rely on our senses
when danger is present. It is only when we see others in panic mode do we lose sight of using our senses to our
advantage. We must remain calm in the presence of danger. From there:
NAVIGATE. As you continue to OBSERVE your surroundings and feel that it is now the right time for you to
NAVIGATE out of your initial location to that of a location of safety, keep the following in mind:
• Always OBSERVE your surroundings and adapt to any changes.
• NAVIGATE a path based on:
——What your senses indicate to you.
——Who you are navigating with (students, co-workers, small children, strangers)
• Your ability to move, quickly, quietly, effectively and as calmly as you can is going to be of the utmost
importance. You do not need all of your belongings; technology to communicate with is the most important
item to have.
• Assign children a “buddy friend” to navigate with, and also assign each of them a role in the process.
Whether it is one child is listening and one child is looking for other signs of possible danger. Give them
something to do to keep them focused.
ESCAPE. As soon as you feel you have the opportunity to do so safely, escape. The average duration of an active
shooter event is just short of 10 minutes. It takes on average 12-15 minutes for law enforcement to arrive on
scene, according to Jim Schwartz, Chief Arlington County Fire Department.
• Follow your teacher who should be leading the way.
• Listen for sirens and try to move in that direction if safe to do so.
• Always account for the children you are leading, talk to them to keep them calm and quiet. If you are
leading out 15 children, keep counting them on the way out. This is also a good way to keep you as
the teacher focused and calm as well.
Active Shooter 8 ASIS School Safety & Security Council
The Six Phases of the Attack
by Linda Watson, CPP
We hear the words “active shooter” on a more frequent basis every time we turn on the radio or television. It
seems like the more it is happening, the more our society becomes de-sensitized to this type of violence. When
an active shooter is in the “implementation phase”, a series of events has already happened for the “actor” to
arrive at this tragic point. Experts agree there is no accurate or useful “profile” of an active shooter.
According to Dr. Joshua Sinai, Ph.D., there are six phases to any active shooter incident.3
Phase I Cognitive Opening: The “Mindset”
Phase II Planning
Phase III Preparation
Phase IV Approach
Phase V Implementation
Phase VI Post-Incident Mitigation
Given these six phases of the attack, we can look at incidents where the attacker went from thinking about an
attack to directly the attack phase with little or no planning steps in between. Contrary to much media “hype,”
most attacks are methodically planned and executed by the attacker. Much consideration is given as to whom
to target, where the incident will take place, and by what means the attack is carried out. In most incidents a
firearm is used as the weapon of choice.
Active shooters have evolved over the years. They are doing research to find how past attacks have been carried
out. They are seeing the police response and the tactics used to respond to those attacks. As a result, the active
shooters have changed some of the ways in which they plan and attack their victims. Two recent attacks that illustrate
this come to mind: the Virginia Tech attack—where the doors were chained on the inside to prevent victims
from escaping; and the Sandy Hook Elementary School attack—where the windows adjacent to the main
door were shot out by the “actor” to gain access into the school.
The Federal Bureau of Investigation published a study of recent U.S. active shooter incidents.4 A snapshot of its
• 160 incidents occurred between 2000 to 2013
• An average of 11.4 incidents occurred annually, with an increasing trend from 2000 to 2013
• 1,043 casualties, including killed and wounded (shooters were not included in this total)
• 486 were killed in 160 incidents
• 557 were wounded in 160 incidents
3 Active Shooter, A Handbook on Prevention. Joshua Sinai, Ph.D. Published by ASIS International. (2013.)
4 “A Study of Active Shooter Incidents, 2000-2013.” Texas State University and Federal Bureau of Investigation, U.S. Department of Justice, Washington,
Active Shooter 9 ASIS School Safety & Security Council
Cinemark Century 16 Theater in Aurora, Colorado: 70 (12 killed, 58 wounded), July 20, 2012.
Virginia Polytechnic Institute and State University in Blacksburg, Virginia: 49 (32 killed, 17 wounded), April 16, 2007.
Ft. Hood Soldier Readiness Processing Center in Ft. Hood, Texas: 45 (13 killed, 32 wounded), November 5, 2009.
Sandy Hook Elementary School and residence in Newtown, Connecticut: 29 (27 killed, 2 wounded), December 14, 2012.
Active Shooter Incidents with Highest Casualty Counts (2000-2013)
193 (84 killed, 109 wounded)
Active Shooter 10 ASIS School Safety & Security Council
The findings reflect the damage that can occur in a matter of minutes. In 64 incidents where the duration of the
incident could be ascertained, 44 of the 64 incidents ended in 5 minutes or less, with 23 ending in 2 minutes or less.
After seeing the FBI’s statistics, the yet unanswered question has become how to interrupt the “phases of the
attack” to stop the carnage.
In the first phase, the “actor” is thinking about the attack but has not yet shared those thoughts with anyone.
When those thoughts combine with an action plan, the attack becomes real. Next, the acquiring of weapons and
materials begins with logistical planning. Information about the attack is usually shared in some way during the
planning phase with someone who knows the attacker. This is the period where the most opportunity to stop the
attack can take place. The first three phases of the attack can take days, months, and years. When the actor is in
the approach phase, he or she has acquired all their weapons and is deploying to the site. The final phase, which
is the implementation and execution of the attack, ends within 5 minutes usually. The conclusion to the active
shooter incident is either by a self-inflicted gunshot or by the responding law enforcement.
Frequently information that has been shared by the attacker with people before the incident does not make
sense to the person(s) it is shared with. After the tragedy has occurred, people who knew the actor will come
forward with remembering odd things or behavior from that person. This echoes Secret Service statements that,
“Prior to most incidents, other people knew about the attacker’s idea and/or plan to attack.”5
In conclusion, active shooter incidents are increasing across the United States. If someone is sharing information
that is bothering you or making you nervous, find a way to tell someone who can analyze it and determine if
it is relevant or not. Lessons learned since Columbine have changed the way law enforcement agencies respond
to active shooters across the nation. Law enforcement personnel must constantly adapt and readjust to the
everchanging active shooter. More recently, incidents have occurred where the active shooter involved more
than one location. Situational awareness is key to staying alive during an active shooter event.
5 “The Final Report and Findings of the Safe School Initiative: Implications for the Prevention of School Attacks in the United States.” Washington, D.C.
Active Shooter 11 ASIS School Safety & Security Council
Using Situational Awareness to Observe Pre-Attack INdicators
by Brad Spicer
If a killer was on your campus, when would you want to know about him (or her)? Do you want to know that
he is at the parking lot? At the main entrance? Or if he has already entered the lobby, hallway, and classrooms?
Situational awareness is what allows us to recognize the early signs of danger in order to prevent violence. If prevention
fails, situational awareness can still mitigate the attack. More of an attitude than a hard skill, situational
awareness is the ability to identify and process information about what is happening around us. We all have it
some of the time, but it is also something none of us can have at all times.
As is the case with most abilities, there are varying levels of situational awareness. Jeff Cooper, a Marine and
innovator of tactical training, pioneered the concept of levels of awareness. His system, “Cooper’s Color Codes”
illustrated below, has been used to train military and law enforcement for decades. Cooper’s Color Codes have
nothing to do with warning code phrases or an outdated Homeland Security alert system. They simply assign a
color to describe a level of awareness.
Yellow is the goal for optimum situational awareness. You are best able to observe your environment and notice
changes that may pose a risk by being prepared, alert, and relaxed. Sometimes these observations are subtle and
identified by intuition. Intuition is not magical; it is an educated hunch based on your knowledge and experience.
Nothing interests us more than our own survival, and intuition can help us perceive threats.
WHITE Unprepared and unready to take action.
YELLOW Prepared, alert, and relaxed. Good situational awareness.
ORANGE Alert to probable danger. Ready to take action.
RED Action Mode. Focused on the emergency at hand.
BLACK Panic. Breakdown of physical and mental performance.
Cooper’s Color Codes
Active Shooter 12 ASIS School Safety & Security Council
Prediction can seem daunting when a mass killing is framed only within the context of the shooting. Returning
to the hypothetical killer we began with, and instead of him roaming a parking lot, imagine you are observing his
intention in the form of posts on social media days to months before the first shot was fired. Despite how they are
portrayed by the media, these shootings do not start with the first shot. The shooting did not began when “…all of
the sudden, he took out a gun and started shooting everyone.” Generally, intentions were hardened long ago.
The length and observability of these precursor incidents increase the possibility of prevention. The challenge is
having the situational awareness to observe a potential threat and then direct the appropriate resources towards
the person in question before it becomes too late.
On April 20, 1999, 13 people were murdered at Columbine High School. While not the first mass killing in a
school (there were five in 1997 alone), Columbine was the event that coined the term “Active Shooter,” which
certainly described the situation as the murders occurred. But the Columbine attack did not start on April 20.
• The attack did not start at 11:19 a.m.
when, according to a witness, one of the
two killers yelled, “Go! Go!” as they pulled
guns from beneath their trench coats and
• It did not start at 11:18 a.m. when the
two assailants left their vehicles in the
Juniors’ parking lot after their explosive
devices failed to detonate.
• It did not start earlier that morning when
they were carrying into the school explosive
devices set to detonate at 11:15 a.m.
during a busy lunch shift.
It did not start April 20 with the two loading their weapons in the morning hours. It didn’t even start that year
when they rehearsed their attack.
While we will never know the exact date, we think the attack probably was motivated in 1996 when a blog
associated with an online gaming site took a violent turn. From that point forward, warning signs were exhibited.
Those warning were missed chances at intervention and thus preventing the attack from occurring.
Active Shooter 13 ASIS School Safety & Security Council
Few mass killings are preceded by a direct threat. While threats should never be ignored, they should be viewed
more as a promise than a guarantee. Some threats can actually be viewed as psychological motivators used to
de-escalate, not escalate, confrontations. Threats are typically issued to obtain a desired response (such as fear)
rather than to forecast imminent danger. Preventing an attack requires the observation of subtle Pre-Attack INdicators
(PAINs); not just waiting for the direct threat.
Listed below are actions that may be associated with PAINs and warrant closer attention.
• Threat of suicide or self-harm
• Threat of violence (directly or implied)
• Fascination with/asserting ownership of firearms
• History of violence; behavior obviously insensitive to others
• Preoccupation with themes of violence
• Intimidating others; frequently confrontational
• Crossing boundaries (e.g., excessive calls, emails, etc.)
• Marked academic performance decline
• Notable changes in personality, mood, or behavior
• Give away personal possessions
• Shows noticeable decline in personal hygiene
• Substance abuse
When PAINs are observed, caution must be taken to consider the context of the warning signs to determine if a
threat assessment is needed. The focus of a threat assessment is not if a person makes a threat, but if they pose a
threat. Simply put, threat assessment is the process to determine dangerousness.
In his book, The Gift of Fear, Gavin de Becker outlines a powerful way to efficiently define dangerousness. JACA
is an acronym for Justification, Alternatives, Consequences, and Ability. Apply JACA from the viewpoint of the
person you are assessing, not your own, and answer the following questions.
—— Does the person feel Justified in taking violent action?
—— Does the person feel there are Alternatives to violence?
—— Is the person concerned about the Consequences of a violent action?
—— Does the person have the Ability to carry out an attack?
If one or more elements of JACA are present, a formal threat assessment is likely needed. JACA is simply a snapshot
and does not replace the need for a formal and comprehensive threat assessment and case management
Active Shooter 14 ASIS School Safety & Security Council
Threat assessment programs take advantage of early warning signs. When these are missed and the situation escalates
to imminent violence, PAINs are still present though more often associated with attack-related behavior.
Recognizing PAINs immediately prior to an attack may not enable prevention, but it can mitigate the casaulties.
First Timer’s Syndrome
Mass killers rarely have an exit strategy. They expect to die (by suicide or suicide by cop) or be captured. Because
the attack will be their first and last act of extreme violence, they will exhibit behavior and physical PAINs immediately
before the attack. An apt description of these PAINs is First Timer’s Syndrome. Working in code yellow
(prepared, alert, and relaxed) of Cooper’s Color Codes allows you to observe PAINs that slightly deviate from
baseline operations and pose danger.
Physical PAINs include appearance and dress. Behavioral PAINs include overt actions and more subtle gestures.
Obviously these PAINs are almost always consistent with perfectly innocent explanations and do not automatically
indicate danger. When the behavior is carefully and prudently explored (and the person is determined not
to be a danger to himself or to others), our intuition learns how to better distinguish future threats.
It is your intuition, training, and experience that help you determine if the situation poses no threat, if further
investigation is needed, or if immediate action response is required. In the very rare instances when immediate
action is required, your mindset (Cooper’s Color Code Red) can improve your response.
Situational Awareness and Response
Try to avoid code white (unaware) when you are at work or in public places. Make condition code yellow a habit.
When you observe potential PAINs, quickly analyze the situation. A valuable system to make rapid decisions
under pressure is the Observe-Orient-Decide-Act (OODA) Loop, which is sometimes referred to as Boyd’s Cycle
after its creator, retired U.S. Air Force Col. John Boyd.
The process begins by observing the situation. Orientation, next, is critical because most emergencies happen
too quickly to process information as it is observed. Think of orientation as gaining perspective. Once orientation
is gained, it is time to decide. The decision considers factors in information from orientation and your
training and experience. The last step is to act on the decision. The “loop” occurs when situation changes. This
cycle continues throughout an incident.
Thoughout the day, strive to have good situational awareness. If you identify potential dangers, switch to code
orange and apply the OODA Loop. In the very rare instances that require immediate response, move to code
red; however, you switch back to code yellow if no threat exists. Repeat this exercise and situational awareness
will become habit.
Active Shooter 15 ASIS School Safety & Security Council
Be Aware—But Stop Looking for Mass Killers
In “Just 2 Seconds”, a resource guide for those charged with protecting public and high profile people, authors de
Becker, Marquart, and Taylor point out it is futile to “look for assassins.” Trying to look for someone who could
be an attacker in a crowd is like looking for a needle in a stack of needles. What student does not have a backpack?
Are any shirts actually tucked in?
Rather than trying to imagine how each and every person could be a threat, maintain good situational awareness
and allow yourself to recognize physical and behavioral activities that differ from the baseline. Whenever
possible, observe persons as they exit vehicles or move to enter buildings or buses. Watch for physical and behavioral
indicators from people who approach new areas such as a school or bus.
If you wait for a guarantee of danger, then you are eliminating the opportunity to prevent the violence or seriously
limiting your ability to mitigate casualties. PAINs are warning signs that almost deserve some attention though
rarely warrant immediate action. When you observe PAINs, you should either:
- Eliminate the person as a threat and move back to Cooper’s Code Yellow;
- Continue to investigate and remain in Cooper’s Code Orange; or
- Act and implement emergency response plans. (Cooper’s Code Red)
The decision is based on your observations, circumstances, and experience. If you cannot eliminate the situation
as a threat and are unsure if the situation is dangerous, remain focused (Cooper’s Code Orange) and investigate.
How you investigate is situational. While interacting with a potential threat may seem counterintuitive, it may
be necessary if it is your responsibility to guard the safety of others around.
Protecting schools can be incredibly difficult and tragically imperfect. However, situational awareness and
PAINs are strategies that can help make campuses a little safer from a personnel standpoint. When contemplating
the implementations of preparedness programs, leaders should consider the following decision-making
• Do nothing and hope nothing happens
• Do nothing and it does happens
• Do something and nothing happens?
• Do something and it happens
Active Shooter 16 ASIS School Safety & Security Council
Proactively Preventing Active Shooters—Post-Incident Data
by Rick Shaw
Given the choice, would you rather prevent an active shooting or react to an active shooter? Given the choice,
would you rather prevent the lawsuits, damaging headlines, and invasive media grilling related to an active
shooter tragedy, or would you react to all of the above? Of course prevention is the better option, but is prevention
The short answer is YES! Prevention is possible. The steps in the Pathway to Prevention are well documented by
hundreds of post-incident reports revealing that most, if not all, were preventable. Post-incident reports reveal
that pre-incident indicators, concerning behaviors, suspicious activities, and warning signs were almost always,
if not always, observed and even reported BEFORE the shooting tragedies occurred.
So if pre-incident indicators are almost always observed and/or reported before incidents and tragedies occur,
why are so many preventable incidents and tragedies not being prevented?
Reacting versus Preventing
In response to school tragedies at Columbine, Sandy Hook, and numerous others, most school administrators
reacted by scheduling security assessments with a security expert who would visit the school to assess the
school’s security preparedness. Security assessment reports usually deliver numerous recommendations for
schools to add more security cameras, more security alarms, more physical security access products (locks,
security windows, access management, etc.), more mass notification and communications systems, more
active shooter trainings, more emergency and crisis response planning, more emergency and crisis policies/
procedures, more crisis communications and social media guidelines, and more of the same.
Security assessments can absolutely be helpful to ensure reactive and response efforts are in place. Security
cameras record forensic evidence of what happened, security alarms go off when the threat is at your door, security
access products will hopefully keep the threat out of your school, active shooter responses kick in when
a shooter is at your school, and crisis responses take place during and after a crisis has taken place. Most of the
security assessment “recommendations and solutions” are designed to improve reaction and response time to
a threat that is on your campus or an emergency/crisis that has already happened.
Active Shooter 17 ASIS School Safety & Security Council
Prevention and Prevention Assessments Offer Numerous Benefits
The benefits of proactive prevention are impressive and even life-saving, and successful prevention begins with
a Prevention Assessment, which is much different than a Security Assessment. Prevention Assessments focus
on a school or district’s capabilities to proactively prevent threats and proactively prevent at-risk individuals
from escalating on a “path to violence” that can lead to incidents, lawsuits, tragedies and soaring liabilities and
The “Path to Prevention” Involves 6 Essential Steps:
• Awareness at the individual level
• Collecting the Dots
• Assessing the Dots
• Connecting the Dots
• Intervention and Monitoring
• Prevention (Pro-Active and Pre-Active)
Each of the six essential steps in the Path to Prevention are critical and necessary for schools/colleges to proactively
intervene with at-risk individuals and incidents on campus, off campus and on Social Media BEFORE they
escalate towards something more serious, more dangerous, more expensive or more tragic.
A Prevention Assessment will review:
How schools are ensuring situational and ongoing awareness at the individual level—including but not limited
to what concerning behaviors look like, how to make incident reports (confidential and/or truly anonymous),
situational awareness, updates on new and viral social media risks, policies, procedures, plans (including individual
roles and responsibilities) related to preventing as well as ensuring all individuals are aware of emergency
and crisis response plans from security assessments.
How schools are collecting the dots—including but not limited to how schools are collecting incident reports,
investigations, interventions, social media behaviors and comments, etc. from individuals in their school and
“community-wide” who almost always see pre-incident indicators. And making sure all of the “dots” are collected
in a central, secure records management platform that is separate from Student Record Systems to eliminate
potential liabilities due to disclosures (unauthorized and authorized) outlined in multiple guidelines including
FERPA, state laws and national standards guidelines. Too many schools are using outdated approaches (paperbased,
spreadsheet-based and other silo-based approaches) that lead to gaps and information falling through
How schools are assessing the dots—including but not limited to the school/college threat assessment team and
“community-based” threat assessment and safety teams. How threat assessment team members are assessing
and measuring an at-risk individual’s potential of aggression and violence, how teams (school and communitywide)
are securely sharing information to meet privacy and security obligations, how teams ensure real-time
collaboration rather than weekly meetings, how teams include third-party and community resources such as
mental health services, law enforcement and numerous other assessing the dots efforts.
Active Shooter 18 ASIS School Safety & Security Council
How schools are connecting the dots — including but not limited to how teams are connecting all related incident
reports, investigations, witnesses, updates, legal obligations, internal resources, community-wide resources
and numerous other connecting the dots efforts. Post-incident data and comments almost always refer to
“the failure to prevent was due to not connecting the dots” and the Prevention Assessment will help your school,
college and community to identify gaps, silos and disconnects BEFORE they lead to a failure to prevent.
How intervention efforts are working with at-risk individuals, how intervention efforts are communicated and
documented across the school or district, how intervention related monitoring is working, what intervention
programs are being utilized, are intervention efforts consistent and how numerous other intervention efforts
are being utilized.
How prevention efforts are working in the school and across the district to prevent and eliminate liabilities and
incidents associated with violence, sexual assaults, bullying, cyber bullying, gangs, drugs, weapons, sexting,
social media drama, diversity/inclusion, suicides, cutting, depression, isolation, truancy, and numerous other
threats, incidents, tragedies, and soaring liabilities.
Prevention Gaps Exposed In Student Surveys
To better understand what students are experiencing, Awareity conducted Student Safety Surveys in 2013 (nearly
4500 students across 16 states) and 2014 (nearly 6500 students across 14 states) and the students’ responses
exposed several serious gaps and prevention disconnects in their schools. For example:
• 79 percent of students have been impacted by bullying in their school
• 46 percent of students have been impacted by cyberbullying
• 49 percent of students are witnessing another student being bullied at least once a week
• Only 17 percent of students said things got better when they reported a bullying incident
• 39 percent reported bullying incidents to teachers
• 36 percent reported bullying incidents to parents
• 17 percent reported bullying incidents to school office personnel
Many Students are still not reporting incidents because:
• 28 percent are scared to make the situation worse
• 26 percent don’t want to be involved
• 23 percent don’t want to be a snitch
• 20 percent don’t believe it will help
If schools are not receiving incident reports, it is not because incidents are not occurring, it could be because
students have lost trust in adults and their school’s prevention capabilities. Lost trust and lack of taking action
is a dangerous problem, because when human beings ask for help and nothing happen, human beings tend to
take matters into their own hands.
Active Shooter 19 ASIS School Safety & Security Council
Why is survey data about bullying important? Many previous active shooters have left messages and manifestos
that cited their grievances with being a victim of bullying. When you combine the survey data about bullying
with the survey data that when students report bullying and things get better ONLY 17 percent of the time, human
beings (students) may decide to take matters into their own hands — some will become violent, some will
bully others, some will become depressed, some will resort to suicidal ideations, some will turn to self-harm and
cutting and some will turn to drugs and alcohol to get away from the pain…and some have and could become
The student survey also provides insight on what students hear other students talking about:
• 34 percent are aware of someone who may pose a risk to students and their school.
• 34 percent are aware of a fellow student who has talked about or contemplated suicide.
• 34 percent are aware of students who have brought drugs or alcohol to school.
• 90 percent said they would report weapons, online threats, and suicidal students if they had an anonymous
incident reporting option.
• 98 percent said they are willing to be a hero for somebody, BUT school administrators need to equip
students (faculty, staff, and community members) with the web-based and anonymous incident reporting
tools so they can share their observations of concerning behaviors and pre-incident indicators.
The evidence from post-incident data, from lessons learned, and from student surveys is overwhelming and the
data exposes numerous liabilities and dangerous gaps with current and community-wide prevention capabilities
in schools and communities.
School Administrators should take immediate action to learn more about their school-wide and their community-
wide prevention capabilities before the next incident or tragedy occur. All schools should conduct a
Prevention Assessment to learn how they compare to leading schools who are proactively preventing active
shooters, violence, and numerous other incidents and liabilities while also improving their school climate for
all students, all school personnel, and their entire community.
Rick Shaw is President and founder of Awareity. For more information, please visit www.awareity.com
Active Shooter 20 ASIS School Safety & Security Council
by Lawrence J. Fennelly
After every active shooter incident, there are questions from victims and their families, as well as mental health
professionals. They want to know why the shooting happened. They want to know what could have been done
to prevent the attack and what caused this particular person to kill or injure innocent people. People start looking
for missed warning signs. Most importantly, everyone wants to know what can be done to prevent the next
incident from happening.
In addition to those questions, law enforcement and other first responders evaluate their response and seek
answers to their own set of questions after each and every new active shooter incident:
• What strategies worked well and what did we do “right” during the response?
• What could we have done better?
• What systems and procedures worked well and what needs to be re-evaluated or changed?
• What additional equipment or training would have made the response better?
Evaluating first responder actions are an important part of improving how active shooter incidents are handled.
We learn from mistakes that have been made in the past. For instance, when two students conducted their
attack at Columbine High School in Littleton, CO, law enforcement officers as well as first responders outside
the building were hearing shots as innocent victims were killed or injured. In the past, first responders gathered
outside the building or area, waited for additional responders, planned their strategy, and then entered the
building to neutralize the threat. Research has shown that in almost every case, once shooters are confronted
by an armed response, no other innocent victims will be killed or injured.6 Because of this the initial or sole first
responder on the scene now enters that building as quickly as possible to gain control of the situation.
Traditional law enforcement response to an active shooter event was to secure the perimeter, gather information,
and wait for additional officers to arrive. Unfortunately, the shooting at Columbine High School proved
this approach failed. Since that time, law enforcement officers now use rapid deployment to an active shooter
event by entering the building or the area as fast as possible with the goal of neutralizing the hostile threat with
the least amount of force.7 What we have learned is that even a sole first responder on the scene must communicate
with other responders who are en route and then enter the building or area to prevent further injuries or
loss of life. A law enforcement officer on the scene of an active shooter incident, who enters a building or area
alone before other first responders arrive, does so because of their sworn duty to protect. This strategy is an effort
to prevent the death toll from rising.
Past incidents have shown that an incident command post must be established as soon as possible to coordinate
the response of multiple agencies. Also, a perimeter has to be identified quickly so responding agencies will
know where to gather and what to do.
Active Shooter 21 ASIS School Safety & Security Council
Ideally, the resources of many agencies should be utilized to effectively respond to an active shooter situation.
Responders must have the needed equipment so they can prepare and effectively respond. Agencies should
work together to provide and support each other’s training so they are all aware of how they will respond and
work together as a team. The shooting at Sandy Hook Elementary School made first responders aware of how
important it is to have a plan in place to allow multi-jurisdictional agencies to communicate, and that there
must be adequate communication operators (dispatchers) available to handle the influx of calls.8 It is vital that
that communication is maintained with the community, as well as the first responders, throughout the entire
The shooting at Virginia Tech caused the university to re-evaluate their emergency communication and warning
systems. Even though there were multiple layers in their communication process, not all of them worked
well. One lesson learned was redundant modes of internal emergency communications and notifications with
overlapping layers of communication were needed. Numerous modes of communication are available such as
text alerts, audible sirens, social networks, e-mail, web pages, local university cable television stations, computer
pop-up alerts, and constant updates to local and national media. The messages provided information on
what was happening with the police response and instructions on what individuals on campus should do.
Virginia Tech also learned that some words (such as “shelter-in-place” and “lockdown”) were confusing and
many people did not understand exactly what they meant. The term “clear” caused confusion to some of the responding
agencies. They were unsure whether “clear” meant evacuate the building or “clear” the building of any
potential suspects. Even when we speak the same language, we find these words that have different meanings.
The shooting at Northern Illinois University in 2008 demonstrated the need for National Incident Management
System (NIMS) for all campus law enforcement as well as training and drills for students, faculty, and staff so
they know their roles and responsibilities during an active shooter incident. All-hazards planning and response
with comprehensive training, drills, and exercises are a critical part of emergency preparedness.
The response to the 2012 shooting at the Century 16 Theater in Aurora, Colorado, emphasized the need to have
access to an area crowded with vehicles and people. Before even arriving at the theater, first responders were
inundated by moviegoers covered in blood and carrying victims.
Although local and state first responders are almost always the first ones on the scene of an active shooter incident,
the FBI plays a large role in supporting the response to every major incident in recent years. The FBI has
training and resources which can be utilized before and after an incident occurs.9 Shooters plan their actions,
so it is reasonable that first responders also have a plan for how to best handle the situation. The lessons learned
from previous active shooter incidents are invaluable to first responders and this knowledge will help save the
lives of innocent victims who are simply in the wrong place at the wrong time.
Active Shooter 22 ASIS School Safety & Security Council
Public Safety and School-Sponsored Onsite Training Programs
for Emergency Responders
by Jim McLain, CPP, FMP
Many public K-12 school systems in America have emergency plans that include measures for active shooter
situations. This is typically in accordance with their state laws or regulations. But without proper and periodic
training, these emergency plans are merely a list of instructions that may or may not be carried out in actual
In addition to mandatory training drills (e.g., fire, lockdown, and bus evacuation), school administrators should
regularly engage with their crisis management teams in practical or tabletop exercises to train on how to execute
their plans in the event a critical incident arises. As with plans that require update, the exercises should be
modified to address different incidents. The training should be placed in a mandatory cycle to ensure the most
effective response when needed. Public safety officials must be involved in each of these tabletop exercises.
Having key stakeholders together is needed in order to educate school staff on expectations during a response,
and to evaluate and provide input on the actions taken by crisis teams.
Active Shooter 23 ASIS School Safety & Security Council
At my school district, the crisis and security plans require updating each year. All schools within the school division
are required to conduct tabletop exercises in a mandatory cycle. Secondary, high, and middle schools are
provided tabletops every other year. Elementary schools receive these exercises every three years. Schools may
request out-of-cycle tabletop exercises, and typically do this when staff changes occur or when shortcomings
This continual and cyclical timeline was planned with consideration for other drills, instructional time, the
number of schools, and the resources available to provide the training. A two-member security planning team
assigned to the central safety and security office reviews and approves plans every year. The team also conduct
tabletop exercises. The exercises are formulated and routinely modified under the supervision of a dedicated
security specialist. Approximately 85 tabletops that take about 90 minutes each are conducted each year. Supervisors
from the local police and fire departments attend every exercise.
From the school district’s perspective, this is an effective method in preparing school teams to respond to
emergencies when coupled with the multitude of other drills the teams conduct with students and staff. What
can school systems then do to facilitate public safety agencies’ abilities to respond to their school emergencies?
Coming from a law enforcement background that include years assigned to a tactical unit, it is understood
there are three basic needs in any strategy to address and resolve active shooter and other violent incidents:
Communications. Intelligence. And training.
Once schools understand and embrace this, it becomes highly effective in enhancing school safety to assist
public safety with their training needs relative to school emergencies. By providing school facilities as training
venues, administrators inherently allow emergency response groups to address each need.
Interactive training inside the school buildings provides public safety operators the opportunity to assess communications
capabilities or limitations inside particular sites, valuable real-life intelligence on the structure
itself, and an excellent training environment. Although it improves the ability of emergency responders to respond
in active shooter and mass casualty scenarios, training opportunities for the utilization of schools should
not be limited. Practically speaking, the more responders become familiar with school layouts by actually being
in them as opposed to just viewing the floor and site plans, the better off school communities are.
Since actively engaging public safety in utilization of our facilities within reasonable expectations, needed improvements
by the schools are regularly identified and addressed, response on day-to-day calls for service are
enhanced as well as emergency response.
Public safety concerns regarding their difficulty to communicate in some of our schools during training created
a need by our central office to assess each school for in building penetration of the public safety radio frequencies.
Working in conjunction with two way communications specialists in our county a number of facilities were
tested and bi-directional public safety antenna systems were installed. This program is ongoing and has the side
benefit of helping schools improve school based portable radio communications through the addition of radio
repeaters in their facilities subsequent to the onsite assessments.
Active Shooter 24 ASIS School Safety & Security Council
For pre-incident intelligence and to enhance emergency response all schools have an exterior and interior
numbering system at all primary entrances. Public safety departments are provided electronic site, floor plans
and aerials accessible from their computer aided dispatch terminals in their cruisers or apparatus. Large scale
paper versions of this for all schools are carried by school security supervisors for command post deployment
when emergency responders are on scene. The onsite training opportunities we have afforded to public safety
educated us the items we provide are useful but by comparison physical knowledge gained through training use
has been exceptionally beneficial.
Our local police SWAT group oversees active shooter training. Every summer all sworn members of the police
department, sheriff’s department, and the area state troopers go through onsite active shooter training at two
of our high schools. Recently due to the large presence of federal law enforcement agencies in our area, many
agents as well as military police have been included in training efforts as they may be in the area should an incident
occur. The base and military police are provided training at our large elementary school located on the
installation. The fire department also conducts mass casualty and multiple unit response functional exercises
during the summer months at our high schools.
Additionally, a variety of our schools are regularly used for squad-level training for our district level police
and fire stations. The training ranges from K-9 searches, building searches and room clearing, officer safety to
Important consideration must be given to the use availability of the individual school itself. Like many school
divisions, our facilities are often in use after hours and on weekends for community activities that generate
needed income for the school system. Since public safety training does not occur during regular school hours,
community usage or extracurricular school activity can limit training availability. Coordination is the key.
Our school division requires all requests for training come through the office of safety and security. Once the
request is made, an office staff member coordinates with the office of community use and the school administration
of the affected location. If a particular site is not available for the requested date, a proximate school is
offered as an alternative.
Once the training is scheduled, uniformed school security responds to grant access on the date of the training.
While many of the police entities have emergency key access for schools, security is necessary to disarm the
security system and make sure no unscheduled activities are taking place that might interfere with the planned
training session. 30 minutes prior to the end of training, school security responds back to secure the site at the
conclusion. Large scale exercises or training resulting in a number of emergency vehicles onsite necessitates the
coordination with public information offices for the school division, the police, and fire departments.
There is an old police or sports adage that is very fitting. “You play how you train.” It aptly describes the many
advantages for school systems facilitating use of their buildings for public safety.
Active Shooter 25 ASIS School Safety & Security Council
Behavioral Threat Assessment Teams,
An Ounce of Prevention
by Jason Stone
Columbine High School. Virginia Tech. Sandy Hook Elementary. What were once names of safe educational
institutions are now synonymous with fear, pain, death, and tragic loss of innocent lives. The horrific gunning
down of men and women, boys and girls, that took place on these campuses have helped coin new phrases like
“active shooter”, “lock & hide” and “run, hide, fight”. These catchphrases describe response procedures that do
just that—respond. But in order to respond to an event, it must be situation that is in progress.
When it comes time for the responding team to arrive, unfortunately there will be people that are already injured,
some possibly killed. Wouldn’t it be great if there was a tool available that can stop active shootings from happening?
What if schools could have a well-trained team that gather at a moment’s notice, evaluate the potential for
threat, and set a plan to action? This is not a dream. These teams do exist and they prevent disasters nationwide
almost daily. They are called Threat Assessment Teams (TATs), and have become an effective tool to help prevent
(that’s right, I said prevent) horrific events similar to the ones we have seen occur all too often in recent years.
Did Not See It Coming
Immediately after an attack, the news is filled with reports of shock and disbelief. We sometimes hear, “He just
snapped” or “She was such a good kid. I would never have thought she would do something like that.” Then once
the dust settles, a different truth emerges—how the person who just committed inexplicable murder wasn’t
himself lately, or how she joked about shooting up the school. More time passes and the media uncovers how
the assailant turned in dark writing assignments with shocking focus on killing, torture, or suicide that was just
“not like his normal work.” Or maybe we are told that she posted online about how hopeless it all was and want
everything to end. Thus countless investigators think about how helpful it would be to have this information
prior to resulting tragedy rather than after. We imagine how many lives could have been saved, how many
families would be spared these tragedies, if we had ‘the big picture’ before the first shot was fired.
The Secret Service conducted an in-depth study of 37 incidents that took place between January 1974 and May
- This report, called the Safe School Initiative, showed 93% of assailants in the study displayed troublesome
behavior prior to their attack. The study showed that at least one other person knew there was a very high potential
the subject would attack in 81% of the incidents studied; more than one person knew the likelihood for
violence in 59% of the cases. This information is alarming especially since 93% of those individuals with knowledge
that an attack would occur were other students or friends of the assailant.
Active Shooter 26 ASIS School Safety & Security Council
This information tells us unabashedly that people knew there was potential for violence … and said nothing. Or
if had they said something, perhaps the reporting system was fragmented, and the potential life saving information
did not reach the proper person who could have done something about it. The bottom line is nobody had
the opportunity to see the big picture. A properly functioning TAT not only gets to see the big picture, it has an
opportunity to intervene, and that makes a world of difference.
Purpose of the Team
A TAT’s main purpose is to provide a thorough and unbiased investigation into all reported potential threats.
Investigations are handled tactfully and confidentially. The team acts with the safety of all parties involved as a
primary concern at all times. Since many TAT investigations involve suicidal behavior, it is important that TAT
members do not lose focus on the fact they must consider the protection of the individuals under investigation
as well as potential targets. The team must be prepared to calmly RESPOND to the facts of a concern, and not
REACT out of fear. How the team handles the investigation does not only affect the outcome of the current investigation,
but it will also affect future ones. Teams that rely solely on punishing the subject of the investigation
rather than a course of action that helps keep the community as safe as possible will wind up alienating themselves.
If the TAT can show it performs its functions with the best interest of all involved, at all times, it will earn
the trust of the community it serves. When the trust of the community is earned, concerned peers will be more
likely to seek the team’s help. If a team is heavy handed and becomes known for acting out of fear, it will not only
lose the trust of the community, and therefore risk future operations, but it could open itself and its organization
up to lawsuits.
The Team (experienced counselors, instructors, administrators, security & safety, law enforcement)
The team should select a leader; a chairperson if you will. The chairperson should have a level head, an excellent
working knowledge of the threat assessment process, and should be very familiar with the school culture. It is
important to point out that the person selected to head the team does not have to be in a leadership position at
the school—the selected chairperson could very well be a counselor or faculty member. What is important is
that they meet the above criteria. In a group such as this, all members must be allowed to speak their mind and
not be influenced by the position any team member holds. It may take you a few tries to form a team in which
everyone works well together, but you should start with the following individuals:
• experienced counselors
• school administration
• campus security representative
• law enforcement representative
** It is very important to mention parents and students should not be a member of the TAT due to the
confidentiality of the discussion the teams will be having
Active Shooter 27 ASIS School Safety & Security Council
Training the Team
Training is one of the major keys to a TAT’s success. Proper training matched with proper staffing will make a
TAT a very effective tool to help those that may need it in your school system. It may save a life or prevent injuries
on or off campus.
All team members should be trained in basic threat assessment at minimum. It is preferred that all members
receive advanced threat assessment training at the educational level of your institution (higher education vs.
Opportunities for the team to train together under the processes put in place by your organization should be
made available whenever possible. The more the team works together, the more proficient they will become. In
some school systems, the team meets on a weekly or monthly basis to discuss legitimate cases. In other school
systems, the demand might not be as high and so the team may only be called upon once or twice a year. In the
latter cases it is very important that the team still meets regularly to discuss procedure and do tabletop exercises
to keep everyone’s skills up to date.
This section was intended to give the reader a brief summary of how a Threat Assessment Team works, a basic
outline on how to form one, and how it is trained. It is by no means an all-inclusive training document. But
hopefully this document has provided enough material for the reader consider and realize that Threat Assessment
Teams are another deployable, and in fact effective, tool in targeted violence and suicide prevention.
Active Shooter 28 ASIS School Safety & Security Council
Preventing an Active Shooter Incident
Paul Timm, PSP
Active shooter events, despite their relative rarity, are an important security concern for entities such as educational
institutions, businesses, and government buildings. The frequency of these deadly incidents is on the rise
in America, and the intense media spotlight is frequently focused on them. As a result, today, more than ever,
is the best time to implement measures and practices that are focused on training, preparing for and,perhaps
most importantly, preventing these difficult situations.
Between 2000 and 2013, 486 people were killed in active shooter events. An additional 557 were wounded.10
During the first half of this time period, there were approximately six active shooter situations per year. The
average of the second half of the 13-year study rose significantly to 16 per year. This rise in active shooter events
is an alarming trend that hs caused society take note. Regardless of the number of shootings that actually occur
each year, just the possibility of an active shooter incident must cause us to take precautions to reduce the risk.
There are several ways educational institutions, from K-12 to universities, can assist in the prevention of the
event from starting. First and possibly most importantly, provide training to your stakeholders. Training can
take many different forms, but experts should always conduct it. Vital instructional topics include:
• Heightened Awareness. Make stakeholders aware of their surroundings, potential threats, and the security
measures that are in place. Encourage them to report all legitimate issues.
• Diffusing Potentially Volatile Situations. From handling disgruntled persons to appropriately addressing
escalating or destructive behaviors, provide people with effective direction and methods.
• Personal Crime Prevention. Equip your stakeholders with good safety practices, such as utilizing a “two
person rule” for accountability purposes,intentionally moving about the campus in well-lit areas, and
avoidingthe display of money and valuable devices.
Another important way to discourage shooters from targeting educational institutions involves “hardening the
target.” The concept of target hardening centers on the idea people who contemplate executing malevolent acts
are more interested in choosing the easy target than an intimidating one. How can you make your campus and
individual facilities appear to be difficult to victimize? Security measures that aid in these efforts include strategic
placement of video surveillance cameras, noticeable presence of security personnel, and implementation
of Crime Prevention Through Environmental Design (CPTED) principles such as “natural surveillance” and
“natural access control.” These measures serve to discourage, if not warn, would-be bad guys that criminal actions
will be more difficult to carry out than not. Building design from new construction to renovations can also
significantly impact prevention. Effective design features include secured vestibules, classroom security locks,
10 A Study of Active Shooter Incidents in the United States. Federal Bureau of Investigations, U.S. Department of Justice.
Active Shooter 29 ASIS School Safety & Security Council
vehicle barriers, bullet resistant glass, and other delay measures. These features can help not only in limiting the
damage of an in-progress active shooter but also in stopping shooters before they start by making it difficult to
enter a building or gain access to classrooms or gathering areas.
Other prevention techniques focus on policies and procedures that deal with everything from visitor management
practices to social media risks. For example, policies that involve suspension, expulsion, and termination
should be drafted to address the possibility that the person being reprimanded or fired might grow upset or angry
and react violently. These policies assist administrators and those in authority in making safe decisions regarding
termination, suspension, and expulsion. Effective policies should include mandatory cool-off periods
for terminated workers. In other words, these individuals are not permitted back on campus for a certain period
of time after the termination. Monitored exit interviews and notice of termination practices allow administrators
to foster an environment where the terminated employees grievances or issues with the institution are aired
and potentially resolved before they develop into something more threatening down the line.
Today is the day to place importance on prevention efforts. Be proactive. Stopping the active shooter before he
or she has a chance to carry out their mission is obviously invaluable. According to an FBI study, most active
shooter events begin and end within five minutes. This means that if prevention failed, we may not be able to
immediately rely on the response of law enforcement officials to neutralize the threat. Instead, make a commitment
to instruct your stakeholders, discourage criminal behaviors, implement design features, and craft
relevant policies that will significantly reduce your risk.
Active Shooter 30 ASIS School Safety & Security Council
Buying Time—Realistic Hardening of the Target at the Classroom Door
by Jim McLain, CPP, FMP
The rare but devastatingly tragic incidents of targeted violence involving school shootings from external actors call
to attention the need to review and improve, where possible, the physical security of our academic institutions
nationwide. After the incident at Sandy Hook Elementary School in 2012, once again a need was identified to
provide better physical security if the outer perimeter was breached. Taking a corporate approach of layering
security in order to buy time for the arrival of emergency responders to resolve the threat, there was a renewed
focus on the construction of the classroom door.
How do you buy time at a door that is closed and already has a lock? To answer the question, school and physical
security officials evaluated standard classroom doors, their construction, and configuration to ask:
• Is the door solid or hollow core?
• Is the door wood or metal?
• Does the door have a vision kit or panel?
• Is there a sidelight next to the door?
• Does the door have a lock that can be easily engaged in an emergency with a strike and frame sturdy
enough to mitigate rapid breach?
Hollow core doors provide a privacy barrier, but they are ineffective for physical security and allow for easy
noise detection. Wood or metal solid core doors are adequate for security so long as the hinges, strikes frame,
and locking mechanism are strong enough.
The major vulnerabilities inherent in classroom doors are: 1) glass within or adjacent to the door that, when
broken, would allow access to the handle; and 2) a locking configuration that prevents easy engagement in an
The fire codes in most states require classroom interior door latches to open in case of fire, even when locked
from the outside. Unfortunately this creates a situation whereby an assailant can break the vision panel or sidelight,
and reach in to open the locked door from the inside. While it would seem obvious to simply eliminate
the glass, it is not practicable in today’s school building design. Natural light penetration is considered desirable
and even advantageous in creating optimum learning environments. This tends to make security professionals’
physical security goals more challenging in educational facilities when it comes to the layered approach.
In locking configurations on classroom doors, there has been a longstanding philosophy in many school communities
that the door should only be lockable from the outside to prevent kids from locking the teacher out.
With that we have many schools with cylinders on the outside and no means to lock the door from the inside.
31 ASIS School Safety & Security Council
In routine day to day activity, this is of course fine. In the chaos of an
emergency, however, teachers opening the door to lock it from the
outside not only exposes them to the gunman, but in some cases,
the teacher inadvertently unlocks it by pushing down on the interior
handle as they close the door under duress. The worst case scenario
that plays out being the teacher cannot find her/his keys in an emergency,
or a substitute teacher has no key to begin with.
To address this, all that many schools can do is to try locking the door
at the beginning of the day while it stands open. Should an emergency
arise where lockdown procedures are appropriate, the teacher or
substitute simply closes the door. Naturally the issue with this procedure
is under certain situations a student can close the door and the
teacher would effectively be locked out. The double cylinder locks
are effective but the dilemma of no readily accessible keys may exist.
Post Sandy Hook, the one cost-effective and seemingly ready fix that
overcame the door issues aforementioned is the portable and rapidly
deployable barricade or barring device that prevents unlocked doors
from being easily breached. The market was flooded with a plethora
of different concepts of the same tool. The school division I manage
security for even put our design engineers to work. A prototype of a
spring-loaded floor device was created. Our design, along with some
door devices we purchased from legitimate vendors, was presented
All devices were ruled as being against fire code in our state. They
were therefore rejected by the fire marshal. Research into codes and
regulations revealed that there are a great many states where the fire
code prohibits the use of any type of door barricade implement as it
may impede fire evacuation.
A two pronged approach to resolve this buying time strategy was
taken. Finding the optimum type classroom lock and taking steps to
prevent access by breaking the glass. Primary considerations have to
be considered for a cost-effective solution that works and does not
over institutionalize the facility.
Aesthetics also plays an important role in the public education culture
and must be considered by security professionals. This presents
Active Shooter 32 ASIS School Safety & Security Council
11 The single bore cylinder is commonly used because of its ease of installation and costs. Commercially, mortise type locks are popular because of its durability
and built in deadbolt type secondary lock, depending on the model you procure.
challenges in trying to address physical security needs. Both educators and school community members shun
the idea of their schools looking like prisons or defense facilities.
The preferred type of door hardware is equipment that can be locked from the inside with a single lever handle
that, when pulled down, will unlock the door from the inside. The door, frame, and hinges must be sturdy to
begin with. Consideration has to be given to the type of lock: single bore cylinder or mortise lock.11
Thumb turn (or a button on the inside lever or on the back plate) can work to lock the door from the inside;
however in a panic, the button lock can be disengaged by a teacher who pushes the button to lock the door but
then as he/she endeavors to close the door unintentionally pushes down on the lever.
We had a manufacturer fabricate a heavy duty mortise lock with an incorporated secondary locking device. A
thumb turn lock mounted on the escutcheon (or back plate) with an indicator window was used. The indicator
displays for the interior user when the door is locked in white lettering on a red background and unlocked with
black lettering on a white background. The front of the lock set has a keyed cylinder with a vandal-proof lever.
If the lever is forced down in an effort to force it open, an interior ratcheting simply breaks the lever free and it
goes back into functioning battery. Staff is currently testing the lock to ascertain if it meets our need for buying
time at the door.
Because of the desire for natural lighting and the need for administrators and teachers to monitor what’s on the
other side of the door without disrupting instructional sessions, all of my school division’s classroom doors have
vision kits/panels installed. Many school divisions throughout the nation face this same challenge. A violent
intruder need only break out the glass to reach in and defeat the lock.
There are several options in approaching this. The old established method of reinforcing the glass with wire
mesh on the inside (like the way they were when we were in school many years ago) is no longer an option in our
organization. Approximately a decade ago, it was decided to do away with utilization of this type of glass due to
a potential for a child to injure themselves if they accidently broke the glass. (Although I suspect that costs also
may have played a factor in the decision.)
There are some highly effective screens available with ballistic capabilities that are cost-effective. Bars and
heavy-duty meshes were also reviewed. These were not acceptable in the school environment here because of
the institutionalized perception. Plexiglas-type material was considered as well but the mounting and yellowing
over time concerns were raised.
The second prong of the approach came down to clear and not tinted security films. The film manufacturers
provide excellent demonstration videos, but staff and I decided to conduct field and performance testing on
our own due to concerns of door framing, mounting, and the small size of the vision panels. With over twenty
thousand classroom doors in our organization, finding a solid solution in a cost effective manner is paramount.
Active Shooter 33 ASIS School Safety & Security Council
Does security film applications work? To answer the question, our first round of testing consisted of security film
mounted to the inside and outside of existing window glass. The optional security adhesion kit to strengthen the
frame area where it meets the glass was also used.
The film and kit were installed on a four by four feet library entrance and two classroom vision kits. The optimum
cure time of ninety days was allowed. The testing was conducted in the wing of a school under renovation
after school hours so there would be no disruption to the primary mission of educating the children. The area
was cordoned off with safety personnel posted to prevent unwanted access and unintentional injury.
The local police department special weapons and tactics team performed the field testing on the glass. Three
methods of breach that might be readily available to a school shooter were deployed: the butt of a rifle, a fire
extinguisher, and finally a breaching round fired from a shotgun.
On the larger library window the film performed remarkably. Repeated and numerous strikes with the rifle butt
and fire extinguisher failed to even crack the window. The breaching round put a slug sized hole in the window
but it held together and subsequent strikes failed to breach the window even after being shot. While ballistic
capabilities are not inherent in the security films they still maintained considerable strength after being penetrated
by the round fired from a gun.
The small classroom window glass panels were tested on doors mounted in their standard frames with standard
wooden window frames. In both cases the windows remained intact but the frame surrounding the vision kit
gave way causing the entire panel to fall out thus defeating the purpose.
A second round of testing was needed so installations were done on three doors in the same building with metal
framing being installed with each vision kit. One door window installed with a single side film and adhesion kit
inside a metal frame withstood all breach attempts. The door itself was locked. The swat team member did not
shoot this door window.
The second application was identical to the first but the door was unlocked with play in it. The application failed
after several attempts. We did not shoot this panel either.
The third and final door had film installed on both sides with an adhesion kit install on the metal frame and
window seam. This door withstood all attempts, including breach by shooting.
While double-sided application with a metal frame appears to provide the solution, our team of staff elected to
perform one more round of testing so we can incorporate variables that might be considered by other school
districts and could present cost savings. For example, how do single-side installation and double-side installation
without the optional adhesion kit perform?
Active Shooter 34 ASIS School Safety & Security Council
For the second round and forthcoming third round, we invited the assistance of Underwriters Laboratories to
observe and provide their expertise in reaching a successful solution with the versatility to work on a variety
of door vision panels. The one definite reached at this junction is the necessity for an attachable metal frame
around the treated window.
The third round of testing also includes the aforementioned lockset developed for our purposes. A similar configuration
with the indicator window and thumb turn was developed for the larger doors with interior panic
hardware as well.
One final point, any testing and evaluation team should be multi-disciplinary so that all variables are considered.
The staff team mentioned in this document was comprised of school security, school design engineers,
and facilities management personnel, along with police and fire representation. Present also in prior and any
subsequent testing is a life safety development manager with Underwriters Laboratories.
We are confident the simple strategy of buying time at the classroom entrance door will be an effective layered
security solution. As to what else school divisions security officials decide to include as part of their physical
security program to mitigate the school shooter, proper consideration for what is acceptable to the organization,
costs, and how the material(s) will perform in the actual environment should be considered.
Active Shooter 35 ASIS School Safety & Security Council
K-12 as Soft Targets*
by Dr. Jennifer L. Hesterman, EdD
- Based on concepts covered in
Soft Target Hardening:
Protecting People from Attack
CRC Press, 2014
Every day, somewhere in the world, another school wakes up from
the aftermath of another violent attack possibly caused by a terrorist
or an insurgent group that threatens the United States or its citizens
abroad. In some cases, they were bombed by their own government
as a consequence of civil war or as part of a warfighting strategy that
is impossible for us to comprehend. Who could have predicted, even
ten years ago, that schools, as well as churches and hospitals, would
be considered routine and legitimate targets for terrorist groups? The
actors have redrawn the battlefield lines around sanctuaries that civilians
once held confidence in of shelter and safety. Schools for children
are legitimate and penetrable targets scoped by those who wish
to do harm, from international terrorist organizations to lone wolves
to those merely disgruntled or mentally incapacitated and have the
urge to “act out.”
A school is a soft target, meaning it is:
• A civilian-centric place
• Not typically “fortified,” meaning vulnerable, unprotected, and undefended
• Security not a primary mission
• Possibly co-located with or near a hard target
If lacking a specific agenda, terrorist criminals may choose to target a school for the ability to inflict the most
damage in terms of casualty count. Also, soft target attacks generate a long press cycle, serving any “fame,” recruiting,
or legitimacy goals of the actor. Another consideration for the tactic, soft target attacks generate more
fear and psychological “pain” than hitting a government building or installation.
Perhaps nothing more deeply affects the American public than an attack on a school. We never expect that
innocent children would be targeted by anyone, be it their fellow student, a member of the community with a
mental illness, a criminal, or a terrorist. Therefore we are wholly unprepared, shocked, and deeply saddened
when we learn of its occurrence. The ripple effect of school attacks is also immense—traumatizing students,
teachers, and first responders who view the scene; inducing post-traumatic stress and panic disorder in many.
So, a school attack persists in people’s minds and on society’s conscious long after the shooting stops, long after
the walls are repaired and the students’ return, which makes it the perfect target in the eyes of a motivated killer.
Active Shooter 36 ASIS School Safety & Security Council
Psychology of Soft Targeting
We can easily slip into a false sense of security and become complacent about safety inside our schools’ halls
and classrooms. Security, however, is not the primary mission of schools, which typically are constrained of the
resources needed to fund recommended security measures or hire additional guards. Also, schools are typically
“gun free” zones so the only resistance a violent actor will meet is a typically unarmed security guard or two.
In addition to physical security factors, we need to look inward and fight our psychological “blind spot” regarding
the issue of school security. I often speak with college presidents and high school principals about the possibility
of a terrorist attack or an active shooter event on their property, and I’ve met certain mindsets that prove
problematic. They may convey a feeling of hopelessness (there is not much we can do to prevent or mitigate the
threat); infallibility (it will never happen here); or inescapability (its destiny or unavoidable, so why even try).
Some block out the thought at a personal level by thinking “it can’t happen to me,” indicating a sense of invulnerability.
Even worse, others may believe that “if it’s going to happen, there is nothing I can do about anyway,”
Persons with these types of mindsets are a detriment to your organization in a crisis as they exhibit a lack of
awareness to the threat, mental preparation, or lack the sense of determination to engage and command the
situation. In an emergency, those without a plan or resolve may wait for first responders and law enforcement to
arrive and rescue them before taking steps to save their lives or the lives of others. The Sandy Hook shooting lasted
6 minutes and ended with 26 people dead. There is no time to wait for help when the attacker is determined
and brings heavy firepower to the fight. In an active shooter event, everyone is a first responder.
Escalation of School Attacks Worldwide
On April 7, 2011, a 24-year-old man named Wellington Oliveira traveled to the Tasso da Silveira Municipal
School in Rio de Janeiro where he was a former student and subject of classmate bullying. He methodically
killed 12 students. A firefighter who responded to the scene told newspapers, “There is blood on the walls,
blood on the chairs. I’ve never seen anything like this. It’s like something in the United States.”12 His statement
illustrates the prevailing worldview towards the escalation of school violence in our country, especially with the
recent epidemic of shootings and stabbings. As part of a larger society which is increasingly violent, there is an
inevitable ripple effect on the safety and security of our schools.
At any given time, there are at least 75 million Americans attending some type of school from Kindergarten
through doctorate level courses. Overseeing them are 5 million teachers, administrative, and support staff on
campuses.13 Many schools also serve community needs, used as places for meeting, polling, or shelters in times
of emergency—introducing other potential bad actors to the installation. Even if schools are not the intended
12 Bryan Johnson, “Top 10 Chilling Quotes During School Shootings.”
13 Department of Homeland Security, “FEMA 428, Primer to Design Safe School Projects in Case of Terrorist Attacks.” (2012.)
Active Shooter 37 ASIS School Safety & Security Council
target, children must be protected from the physical and emotional side effects of being in the proximity to horrific
violence. For example, there were four elementary schools and three high schools located within six blocks
of the World Trade Center on 9/11. Children in at least three states had parents working in or around the World
Trade Center that day. Thousands of children were exposed to the toxic dust clouds from the collapsing buildings.
In the Washington DC area, schoolchildren faced similar stress when the Pentagon was attacked.14 Schools
have also been pulled into active shooter events where a gunman is on the loose and part of a manhunt on the
school property but they weren’t the primary target.
The top two deadliest mass shootings by a single person in U.S. history both occurred on school campuses. On
April 16, 2007, 23-year-old Seung-Hui Cho killed two students in his Virginia Tech dormitory. Cho then went to
a classroom building, barricaded himself inside, and shot 53 students and teachers, killing 30 in just nine minutes.
On December 14, 2012, Adam Lanza killed his mother in their home. Lanza then went to the Sandy Hook
Elementary School in Newtown, Connecticut. There, he bypassed the security door and shot through a plate
glass window to gain entrance to the building. He killed 20 first graders and 6 staff members in only six minutes.
Since the 1999 Columbine attack, there have been at least 30 other major school shootings in our country. Certainly,
terrorists and others with nefarious intention watch and see the relative ease with which school attacks
K-12: Vulnerable in the Crosshairs
Kindergarten through 12th grade vulnerabilities differ from those on college campuses. First of all, physically not
matured the younger populace cannot defend themselves as readily and are more likely to slip into suspended
disbelief as the situation unfolds than engage a “flight or fight” response. Examining the unique vulnerabilities
found from shooting attacks associated with K-12 helps to better understand trends, the risk of attack, and
The first K-12 school attack in the United States was the Enoch Brown School Massacre, which occurred July
26, 1764. On this date, four American Indian warriors entered a white settler’s log cabin school in Greencastle,
Pennsylvania, and used a tomahawk to kill and scalp the teacher and ten students. Throughout the years,
primary and secondary schools have been the site of revenge murders, racial attacks, gang violence, suicides,
workplace violence, and lovers’ quarrels. They have been used by domestic terrorists as a way to express rage
and garner attention to their cause. For example, on May 18, 1927, the Bath Consolidated School was the scene
of the deadliest act of mass murder in a school in U.S. history in a lone wolf, anti-government attack. Andrew
Kehoe, upset with policies and tax law he believed led to his farm’s foreclosure, murdered his wife at home, and
then detonated three dynamite bombs at the Maine school where he worked as the accountant. Kehoe spent
months planting explosive material throughout the building in a premeditated act that stunned the country.
When confronted at the scene by law enforcement, he detonated a vehicle bomb, killing himself and the school
superintendent. In all, the attack killed 38 school children and five adults.
14 Centers for Deisease Control, “Schools and Terrorism: A Supplement to the National Advisory Committee on Children and Terrorism Recommendations
to the Secretary.” Atlanta, GA. (2003.)
Active Shooter 38 ASIS School Safety & Security Council
International terrorist groups and embattled governments use modern day schools as political targets. Students
have been the victims of bombings, shootings, kidnappings, and hostage situations. In the past 40 years, there
have been massacres at the Ma’a lot school in Israel, the Bahr el-Baqar school in Egypt, the Beslan school in
Russia, the Nagerkovil school in Sri Lanka, and more recently, the Army School in Peshawar. Schools in the Gaza
strip, Iraq, and Afghanistan are routinely attacked. Mass student kidnappings became a new fear when terrorists
from the al Qaeda-linked group Boko Haram, who posed as soldiers to gain trust, kidnapped more than 500
girls from their boarding school in Nigeria on April 16th, 2014. The girls literally disappeared into thin air, with
Boko Haram leaders threatening to sell them into marriage and the sex trade for $12 a person to raise money for
the group. They next attacked the village where the girls were from, killing 150 family members and search and
rescue team personnel.
Why are K-12 schools more vulnerable to attack? First of all, the student populace is made up of children and
young adults. Having not reached mental or physical maturation, obviously they are easier to overpower. Second,
security measures are typically in place but done inconsistently. For example, as violence in our country
began to rise in the 1980s, many schools began installing metal detectors at entryways. Although metal detectors
work extremely well to catch weapons, school administrators found this type of screening time-consuming;
especially when considering the rushed movement of hundreds of students to their classrooms each and every
morning. Operating detectors or individual wands is extremely manpower intensive, and so many schools
abandoned the idea.
The concept of school resource officers (SROs) took hold in the 1970s when protests and unrest related to the
Vietnam War spilled over into school systems. SROs are sworn law enforcement officers who are detailed to
the school system and work to enhance security at their institution. They may be armed and can make arrests.
However, SROs can also be of limited help when facing a determined gunman/gunmen with a practiced, solid
plan and heavy firepower, as the following cases illustrate.
In the Columbine High School attack, Eric Harris and Dylan Klebold managed to kill 15 people and injure 24
despite the presence of an onsite SRO. Jefferson County Sheriff’s Deputy Neil Gardner, a 15-year veteran of the
Sheriff’s Office, usually ate his lunch with the students in the cafeteria. His car parked in front of the cafeteria
doors between the Junior and Senior parking lots. On the day of the attacks, Deputy Gardner was eating elsewhere
on campus, watching an area frequented by smokers. When shots were fired inside of the school, he
pulled up to the indoor/outdoor cafeteria area where Harris and Klebold had tried to set off two bombs and
had already started killing students. Gardner engaged them in a gun battle; however, he was unable to hit the
perpetrators. One injured teacher and a student were able to escape during the chaos, and Gardner was responsible
for later saving other students as he protected them when they were fleeing. He exchanged gunfire
with the shooters when they were killing students in the library before they committed suicide. He likely saved
lives in the end, but Gardner’s daily presence on the school grounds obviously didn’t deter the shooters from
their operation. In fact, investigators believe the shooters purposely chose the area where Gardner typically had
lunch to start the operation with the likely intention to kill him first and remove their only obstacle to success.
Active Shooter 39 ASIS School Safety & Security Council
The Red Lake School Massacre occurred on March 21, 2005. That morning, 16-year-old Jeffrey Weise killed his
grandfather, a tribal police officer, and his girlfriend at their home. Weise then took his grandfather’s police
weapons, vest, and vehicle, and drove to Red Lake Senior High School, where he had been a student some
months before. Weise first shot and killed the unarmed security guard at the entrance of the school, then targeted
a teacher and five students. After the police arrived, Weise was undaunted and exchanged gunfire with them;
he was wounded and then committed suicide in a vacant classroom.
In May of 2014, police in Waseca, Minnesota arrested seventeen-year-old John David LaDue on charges related
to an elaborate plan to carry out a massacre at a nearby school. According to his 180-page diary that police found
in his bedroom, LaDue plotted to kill his family members, start a diversionary fire to distract first responders,
and then go to a nearby school. He was first going to kill the SRO, set off bombs, and shoot students and staff.
A resident living next to a storage facility worker tipped off police to the suspicious teen. Contents of his locker
revealed a pressure cooker, pyrotechnic chemicals, steel ball bearings, and gunpowder. He had also been able to
stockpile three completed bombs, an SKS assault rifle, a Beretta 9 mm handgun, hundreds of rounds of ammo,
and several other guns inside a safe at his home. LaDue had been testing his devices at a local elementary school
playground and intended to attack the school on the anniversary of Columbine. However, the date of the anniversary
fell on Easter Sunday and school was not in session. Locals described LaDue as a polite boy who did well
in school and had plenty of friends.15
Religious elementary schools in the U.S. have also been the target of terrorists. In August of 2011, Federal law enforcement
officers arrested Emerson Winfield Begolly in New Bethlehem, Pa. Begolly was a moderator and supporter
for the internationally known Islamic extremist Web forum Ansar al-Mujahideen English Forum (AMEF).
Begolly produced and distributed a 101-page document with instructions for constructing chemical-based explosives
and a target list that included Jewish schools.16 Secular schools must be especially vigilant since religious
terrorism is the most dangerous, with actors believing their violent actions are sanctioned and just.
Often, the perpetrators of K-12 violence are known—either current or former students, staff, or teachers. They
know the school layout, class schedule, and become familarized with the SRO’s habits. They know when and
where to strike with least resistance for the most effect. Deterring school violence under these circumstances is
Emergent Threat: Stabbing Attacks
Gun attacks are obviously the most feared weapons assault since mass casualties are inflicted in a shorter period
of time and the mortality fears it conjures. However, we confiscate more knives in schools across the country
than guns annually, and knifing incidents are on the rise as well. Between April 2013 and April 2015, there were
at least 15 reported stabbings at schools across the country. Knife attacks are fast, unexpected, and devastating
in terms of injuries. For example, on April 9, 2014, 16-year-old Alex Hribal used two kitchen knives to stab 22
15 Dana Ford and Ben Brumfeld. “Police: Minnesota Teen Planned School Massacre.” May 2, 2014.
16 The Investigative Project on Terrorism. “USA vs. Begolly, Emerson.” 2011.
Active Shooter 40 ASIS School Safety & Security Council
victims in their stomachs and lower backs at Franklin Regional High School outside of Pittsburgh, Pa. The devastating
attack lasted over 4 minutes until the assailant was subdued by brave students.
In stabbings, victims often do not feel pain from the inital wounding. Rather, it is a cold, icy feeling at the stabbing
site since the body goes into shock. Victims often do not realize what has happened until they start bleeding, which
delays the “fight or flight” response and allows the attacker more time to further engage and inflict wounds.
Reviewing stabbing case studies, it appears people may be more willing to engage and subdue an attacker wielding
a knife than choosing to run and/or hide from a gunman. However, engaging an enraged assailant wielding
large knives is very difficult, and those who approach will be likely injured. The U.S. is not the only country faced
with this emergent issue. Mass stabbing attacks have also occurred in K-12 schools around the world, with mass
casualty attacks in Ireland, China, and Germany.
Response to the Threat
In conclusion, protecting our schools and their occupants from any type of attack—whether by terrorist, lone
wolf, student, or faculty member with a vendetta—is extraordinarily difficult. We naturally don’t want to turn
our schools into fortresses, although as I illustrate in my book, Soft Target Hardening, the goal is to present your
facility as impenetrable so the bad guys move on. There are best practices for hardening your school and there
may be some inconvenience to faculty, students, and parents, but once inside, the feeling of safety and security
leads to a richer learning environment.
There are other steps we must immediately take such as identifying and eliminating our psychological blind
spot that prevents us from understanding that our school is vulnerable. A quick look at active shooting events
in K-12 schools in the U.S. proves geographic location, the type of school, and economic class of its student are
absolutely not factors. We should therefore focus on vulnerability, not probability. We also need to get out of
the business of prediction and into that of preparedness. Finally, we have to come to terms with the fact the
threat may be an insider—a disgruntled teacher or a bullied student. The identification of actors who have the
propensity to carry out a school attack, or who could bring outside danger to our doorstep, is another area ripe
Although it is more comfortable to bury our heads in the sand on this topic and spend our precious resources
on gym climbing walls or more smart boards, in the end only you can answer—what is the cost of not securing
Active Shooter 41 ASIS School Safety & Security Council
When EMS Arrives on the Scene
by Michael J. Fagel, PhD, CEM
Law enforcement, as well as fire/EMS rescue, oftentimes converge at the scene of an emergent situation from
several departments at different times and from different locations. In Active Shooter situations, there is no time
to wait for standardized SWAT protocols. Rather, convergent initial contact teams that form up to neutralize the
threat may be approaching the area from varying locations to address the situation. Additionally, other emergency
medical, fire, and rescue personnel will be arriving but (based on predetermined protocols that should
be practiced well in advance) they may stage offsite, away from the scene or out of the hot zone awaiting entry
permissions. A strong command presence and discipline from all responding agencies is needed to manage
various responding resources and to coordinate the treatment and transfer of victims.
Individuals involved in the incident may be required to provide immediate lifesaving care to treat life threatening
injuries of injured casualties. Normal EMS protocols may be suspended and the normal standard of care
we enjoy throughout the U.S. is generally diminished since MS treatment will be focused primarily at triage
and care of life threatening injuries. Initial EMS activities may occur in warm zones with further treatment and
transport in a cold zone. Law enforcement security in both warm and cold zones will be critical to supporting
effective triage, treatment, and transport of victims.
As television coverage has often shown, injuries sustained during an Active Shooter situation may be catastrophic.
EMS does not operate in a routine environment or provide normal response during this kind of operation.
To assist, all persons involved must be able to adapt and overcome the events as they unfold. This cannot
be accomplished without adequate preparations, preplanning, response drills, and similar activities. Failure to
do so may well likely lead to repeated tragic results. Fire/EMS, law enforcement, and dispatch agencies’ active
participation in planning and exercises will help to successfully adapt in a chaotic situation.
Active Shooter 42 ASIS School Safety & Security Council
Planning Practice and Preparedness are the Keys to Survival
An emergency response plan is a continuous process; meaning it should never be viewed as a final, finished
product. Also important to note, all affected parties, agencies, and members of the various entities associated
with the plan must be part of the planning process and team. An effective emergency response plan needs the
involvement from all stakeholders across all walks of life. Every departments internally to your organization
must have an active role, as well as all outside stakeholders. This must include Police, EMS, Fire, Dispatch Agencies,
Public Health, Public Works, Legal, Human Resources, and administration at all levels.
An effective emergency response plan MUST include:
• an effective method for reporting threats and other emergencies
• an evacuation plan that is practiced with posted policies and procedures
• appropriately signed, marked emergency escape procedures, and route assignments (i.e. floor plans, safe
• up-to-date contact information for, and responsibilities of, individuals to be contacted under the ERP
• contact information concerning local area hospitals (i.e., name, telephone number, and distance from
• an emergency notification system to alert various parties of an emergency, including:
—— individuals at remote locations within premises
—— local law enforcement
—— local area hospitals
In addition, the emergency response plan specifies responsibilities and key contact information within your
organization. The ERP should also include an emergency notification as well.
In the event that evacuation is necessary, your facilities should have at least two evacuation routes that are conspicuous
and well marked.
With an effective emergency response plan and training in place, you and your staff will be better able to react,
respond, and recover from a situation that will tax all elements of the team.
Active Shooter 43 ASIS School Safety & Security Council
The Facility Managers’ Responsibilities
The facility manager’s responsibilities begin before any response is required. As part of the Emergency Response
Plan, your facility managers:
• Implement and understand site security procedures. Institute security access controls (e.g. keys, security
system pass codes).
—— Key fobs, door codes
• Distribute critical items to appropriate managers/employees, including:
—— Pocket-sized floor plans in break-glass cabinets
—— Keys and other access-control measures
—— Facility personnel lists with mobile telephone numbers
—— Daily schedule
• Assemble crisis kits containing:
—— Radios, tested and rotated batteries, chemical light sticks
—— Floor plans
—— Employee roster with emergency contact numbers
—— Triage supplies to be used in emergent situations
—— Catastrophic event medical supplies (tourniquets, chest wound sealers, combat gauze)
—— Appropriate First-Aid kits
• Activate the emergency notification system when an emergency situation occurs; as well as a backup plan.
• Ensure that the facility has at least two evacuation routes.
• Coordinate with the facility’s security department to ensure the physical security of the location, as well
as an alternate route.
• Advise according to plans and protocols and if in higher education, timely and clear notification.
• Secure doors.
• Order area supervisors to immediately direct all personnel (employees, customers, visitors, vendors, etc.)
in their area to evacuate the facility if it can be done safely and with caution.
• If an evacuation is not possible, go to PRE-IDENTIFIED secure location. Lock the door and turn off the
lights. Follow the protocol for the shades and other devices if appropriate.
• Keep personnel as calm as possible and try to notify 911 (using cell phones or telephones) of your location,
number of occupants and status. Turn all cell phones silent!
• Remain in the room until an appropriate all-clear signal is given or law enforcement arrives.
• Prepare an incident report documenting personal observations.
• Post evacuation routes in conspicuous location throughout the facility.
• Place up-to-date and secure removable floor plans near entrances and exits for emergency responders.
• Include local law enforcement and first responders during training exercises. The training must be as realistic
• Encourage law enforcement, emergency responders, SWAT Teams, canine teams and bomb squads to
practice for an active shooter scenario at their locations.
• Foster a respectful workplace.
• Beware of early indications of potential workplace violence and follow appropriate protocols as trained
for the specific situation.
Active Shooter 44 ASIS School Safety & Security Council
Human Resources Responsibilities
As part of your Emergency Response plan, your human resources (HR) department must also engage in planning
for emergency situations involving an active shooter scenario.
Planning for situations may help to mitigate the likelihood of an incident by establishing processes such as:
• Conducting effective employees screening and background checks.
• Creating an effective system for reporting signs of potentially violent behavior by your employees.
• Making appropriate EAP counseling services available to employees.
Once the emergency response process is ready for testing, you and your staff should be trained in preparing to
respond to actives hooters situations, including the use of exercises that involve local law enforcement and fire/
It is important for you and your personnel to establish and effective education and training program and is effectively
and appropriately trained in its protocols and procedures so that you and your team can act effectively
if you are ever confronted with an active shooter situation.
One commonly used effective training practices in responding to an active shooter situation for you and your
team to conduct well planned out and implemented active shooter training exercises.
Security Consultants train in active shooter situations; along with local response agencies will be valuable resources
as you prepare an effective training scenario appropriate to your situation.
In addition to your immediate security staff, your employees should also be trained in:
• Recognize the sound of gunshots.
• Reacting quickly when gunshots are heard and/or when a shooting is witnessed.
• Training should cover:
—— knowing how to evacuation the area
—— knowing how to hide out
—— knowing how to action against the shooter as a last resort
—— know when to call 911 immediately
—— knowing how to respond when law enforcement arrives
—— keep your hands visible at all times
—— keep your fingers spread; drop any objects in your hand
—— how to respond to official commands
—— do not reach for or grab responders
—— knowing how to adopt a survival mindset during times of crisis
Active Shooter 45 ASIS School Safety & Security Council
Meeting the Needs of Those with Disabilities
In addition to developing the Emergency Response Plan, conducting regularly held evacuation instructions,
and performing any other retraining exercises, you should ensure that your plans, evacuation instructions, and
any other relevant information include provisions for managing the requirements of individuals with special
needs and/or disabilities. It is important to ensure that your building is accessible for individuals with disabilities,
in compliance with Americans with Disabilities Act (ADA) requirements.
Adopting these proactive measures to anticipate security concerns before they materialize can be achieved by
creating an effective security strategy, based on a robust Emergency Response Plan that is exercised.
All of the above may enhance the resiliency for your organization. This is essential to deterring potential threats.
Adversaries, including active shooters, generally focus on the MOST vulnerable target and may choose to strike
those targets (i.e., targets of opportunity or “soft” targets). Therefore mitigating the risk to your facility by minimizing
external threats outside your secure perimeter is of paramount importance. Having an effective security
program in place will reduce the likelihood of being perceived by your adversary as vulnerable and could help
dissuade such potential threats from selecting your facility as a target. Such as when an individual engages in
suspicious weapons and ammunition purchased and stockpiling.
Private sector security and law enforcement agencies may use a variety of protective measures to help disrupt
or mitigate a potential active shooter attack.
Target Selection, Planning, Rehearsal, Attack, Escape and Exploitation
Awareness is key. Observation of precursors such as behavior, elicitation, and unusual purchases are some of
the factors that can be looked at as we try to mitigate the effects of such an attack.
Planning, preparedness, practice, and options for consideration must be explored for the betterment of the
people we serve. Involving all relevant stakeholders in this process will provide the best potential for a managed
outcome at the time of an event’s occurrence.
Active Shooter: A Handbook on Prevention by Joshua Sinai, Ph.D. Published by ASIS International. (2013)
Active Shooter 46 ASIS School Safety & Security Council
by Inge Sebyan Black, CPP, CFE, CPOI
While we cannot always predict human behavior and there is no definitive psychological profile of an active
shooter, many of these individuals do share similar behavioral characteristics. No singular behavior is absolute,
but a pattern of behavior would be worth identifying. For example, those who commit these acts often choose
places with little police presence and where citizens are unarmed. There are behavioral cues at the early stages
that are signs law enforcement and security personnel might recognize to prompt intervention.17 One might
recognize the suspect preparing for his event through the gathering and concealing of weapons; or notice the
suspect possibly warning certain individuals not to attend school or work. Being aware and observant of suspicious
activity and behaviors can help prevent an active shooting incident from happening.
When making assumptions about whether someone you encounter might be a shooter, there are some cautions.
We need to remain open about borderline dysfunctional personalities that might be missed because they
blend in. Although firearms are typically used, we should not discount the use of vehicles or improvised explosive
devices as weapons. And although women were identified as the shooter in only 6 of the 160 incidents the
FBI studied, we should not discount the possibility of women as shooters. Having studies of past active shooter
events helps the ongoing conversation of best practices and helps us develop/improve emergency practices.
But these events do change as time passes by, and we will have to be ready and prepared for other and new scenarios.
In the 2014 FBI report on the “Study on Active Shooter,” out of 160 incidents, in all but two, the shooter
Active Shooter Training in the University Climate
The term “active shooter” describes an armed person (handgun, rifle, or other ballistic weapon) who is using
deadly force on other persons, and the engagement is in progress. Because the event is ‘live’, everyone and anyone
from law enforcement to the teachers and students have the potential to affect the outcome based on their
response or actions. Therefore training becomes the single most valuable way to affect positive responses, and
thus mitigating loss of lives.
17 School Resources & Training Institute. Active Shooter.
18 Federal Bureau of Investigations, U.S. Department of Justice. “A Study of Active Shooter Incidents in the United States between 2000 and 2013.”
Active Shooter 47 ASIS School Safety & Security Council
Training raises awareness to the real possibility that such an event will occur. Training facilitates dialogue which
creates ideas and protocols for when an active shooter occurs. Studying the active shooter events of the past
tells us these types of event can be over before the police arrive. Findings establish the largest impact of fatalities
occurs within a matter of minutes. In 64 incidents where the time duration was ascertained, 44 ended in under
5 minutes; 23 ended in 2 minutes or less. In some instances, law enforcement was present or able to respond,
but the individuals themselves made life and death decisions.
As with other emergency management protocols, the objectives of training are both discussing best practices
and conducting drills. Although lockdown drills were commonplace at one time and serve a particular purpose,
in active shooter drills, drills for all aspects of ‘run, hide and fight’ should be practiced and discussed. There
should be several different phases of training: one for management, one for new hires, and another ongoing,
annual training for all employees.
This training should include
• clear instructions on the announcement/communication of an active shooter scenario (i.e., “Active
Shooter on Campus”)
• overview of the company/faculty handbook
• overview of the emergency preparedness plan
• discuss active shooter scenarios (best and worst case)
• making life and death decisions
• individual options and recognizing the best one for survival
• safe meeting place following an active shooter
• behavioral signs/early warning signs to report, and who to report them to
• run, hide, and fight drills
• the role of management
Because of the unpredictable nature of active shooter situations, each person is required to make an individual
choice on how they would respond. School administrations implement various ways (email, computer pop-up
messaging, verbal or other notification through speaker systems) to notify students, teachers, and visitors about
impending crisis situations. It is clear that participating in training to estabilish what to do in emergency situations
will save lives. In those 2 to 5 minutes, students and teachers can make a life-changing difference. The
secret is Drill, Drill, Drill.
Active Shooter 48 ASIS School Safety & Security Council
To Arm or Not to Arm … Teachers
by Jason Thomas Destein
There is a growing debate in academic and school safety communities. A debate that could in fact become a
hot-button political issue in the next presidential election. This debate is centered around whether or not teachers
should be allowed to carry concealed handguns on school grounds and in the classroom. The debate itself
has been around for a number of years, but as violence from external intrusion in our schools increase, this
conversation is gaining more participants and a growing audience.
Support for arming teachers is growing around the country (and the world for that matter). As we see the increase
in attacks involving schools, there is no question that some people will lean towards responding with a more
forceful tactic. One group based in Kentucky called POST (Protecting Our Students and Teachers) advocate
arming teachers in schools.19 You can visit their website and see firsthand the positions and strategies they are
pushing for. Essentially, there are three points that POST outlines as reasons their program will work:
- Deterrence – believing that a sign posted on a door stating that this school participates in the POST
program will prevent a shooter from entering, based on recent shooting events in schools, the shooters
were not looking for a fight but rather victims.
- Immediate Armed Response – In the event of a shooting, there would be people already onsite to respond
- Thoroughness of training – POST requires extensive training and regular certification.
The other side of this debate is centered on those who support keeping guns out of teachers’ and administrators’
hands while in school. While there are many reasons offered by those on this side of the debate, there are a few
reasons that seem to be most prevalent. Kenneth S. Trump, a 25-year school safety expert and industry leader,
has articulately outlined some of the big reasons on his website.20
- Training – No matter how many hours of firearms training are administered to a teacher, to think that
they would be able to respond and act in the same manner as our public safety officials is false.
- Are there policies and procedures in place and approved by school boards, insurance companies and
their legal representatives.
- What happens in an accidental shooting from one of these weapons or if a student takes the gun from a
20 Kenneth Trump. “Arming Teachers and School Staff.”
Active Shooter 49 ASIS School Safety & Security Council
Both sides of this debate add their points and counterpoints and argue their sides with equal passion. What is
interesting is both sides have the same goal, that is to keep our schools, the students, and teachers safe. Hopefully
reading this has presented you with thoughts of going out and conducting your own research, and be able
to support or challenge the school districts and local elected leaders on their position.
Should you decide to arm, consider what has to be done assuming you are staffed with tens to hundreds of
teachers. You might seek an assistance program from your local police department, which has Glock pistols and
a firing range with several certified range masters. Each teacher would need to be trained for two weeks on the
use of the same firearm, which equate to expending 1,000 to 1,500 rounds of ammunition. So with eight teachers
at the range at any one time, you will need to do the math to see how long it would take for them to complete the
training. Plus, you will need to take into consideration if someone doesn’t pass certification or staff that need to
be recertified. The process isn’t easy, and you will need local police help and assistance.
Active Shooter 50 ASIS School Safety & Security Council
Active Shooter Tabletop Exercise
by Victor Cooper, CPP
Please click the following button to launch this file. Adobe Acrobat is recommended to view the presentation.
The initial view is set to open in full screen mode. Press “ESC” on your keyboard to exit full screen mode.
Active Shooter 51 ASIS School Safety & Security Council
Shootings on the Rise
by Mark Tarallo
More than 1,000 Americans were
casualties of active shooter incidents
that took place between 2000 and 2013.
The actual figures—486 individuals
killed and 557 wounded—come from
a recent FBI report, A Study of Active
Shooter Incidents in the United States
Between 2000 and 2013.
The goal of the study, which the FBI
initiated in early 2014, is to provide federal,
state, and local law enforcement
with information and a better understanding
of active shooter incidents so
that they will be more prepared to prevent
and respond to future incidents.
Of the report’s many findings, one
clear message stands out: the frequency
of active shooter incidents is increasing.
From 2000 to 2007, an average of
6.4 active shooter incidents occurred
annually. In the next seven years of
the study, the average increased by 166
percent, to 16.4 incidents annually. The
peak years were 2010, with 26 incidents,
and 2012, with 21 incidents.
“This trend reinforces the need to
remain vigilant regarding prevention
efforts and for law enforcement to aggressively
train to better respond to—
and help communities recover from—
active shooter incidents,” the report
On the ground, there is more and
more receptivity for active shooter
training, says Timothy Dimoff, CPP,
an active shooter training expert and
president of SACS Consulting & Investigative
Services, Inc. In the past, when
conducting training sessions, Dimoff
says he would often encounter an attitude
of, “Do we really need this?”
“Now, the shift is we’re seeing people
saying, ‘We’re very glad you’re here.
This thing can happen anywhere,’” Dimoff
says. He has also noticed an increased
demand for training among
churches and nonprofit organizations,
with administrators of those facilities
seeking tools to be prepared for a possible
incident, reflecting a mindset of,
“Let’s have a game plan, just in case,”
In the FBI report, the upward trend
in the number of incidents is even more
dramatic when examined in terms of
casualties. Before 2007, the number of
casualties in any given year peaked at
- In 2007, the number of casualties
rose to 126 and eventually peaked in
2012 at 208.
In the study, the incidents with the
highest casualties were the shootings
at Cinemark Century 16 Theater in
Aurora, Colorado, in July 2012, with 12
killed and 58 wounded; Virginia Polytechnic
Institute and State University in
Blacksburg, Virginia, in April 2007, with
32 killed and 17 wounded; Fort Hood
Soldier Readiness Processing Center in
Fort Hood, Texas, in November 2009,
with 13 killed and 32 wounded; and
Sandy Hook Elementary School and a
residence in Newtown, Connecticut,
in December 2012, with 27 killed and 2
The findings also reflect how much
damage can occur in a short period of
time. Of the 64 incidents whose duration
could be measured, 44 (69 percent)
ended in 5 minutes or less, and 23
ended in 2 minutes or less. According to
the FBI, this finding illustrates the importance
of training—for police and civilians—
that focuses on making quick
decisions under pressure.
“Even when law enforcement was
present or able to respond within
minutes, civilians often had to make
life and death decisions, and, therefore,
should be engaged in training and
discussions on decisions they may
face,” the report says.
According to Dimoff, this finding
reflects a key change in the way active
shooter incidents are perceived—
namely, that the police are no longer
the first responders. “The first responders
are now the general public [on site],
and the potential victims,” he says.
“Everyone in that building is a first responder.”
Dimoff says that, under this concept
of first responder, those on site are
trained to delay the shooter in reaching
targets—by erecting barricades, fleeing,
or fighting back in some way. Law
enforcement has focused on getting
response times down, and officers are
now trained to go in right away, instead
of waiting to set up at the perimeter.
Besides an increasing frequency
rate, the report also found that active
shooter incidents are not confined to a
specific environment or geographical
area, but are wide-ranging and nationally
ubiquitous. The 160 active shooter
incidents examined in the report took
place in 40 of 50 states (and Washington,
D.C.), in small towns and big cities,
and in urban and rural areas.
The settings also varied. Though 70
percent of the 160 active shooter incidents
occurred in either commercial
Copyright © 2016 ASIS International, 1625 Prince Street, Alexandria, VA 22314. Reprinted by permission from the
January 2015 issue of Security Management magazine.
Active Shooter 52 ASIS School Safety & Security Council
facilities or schools, incidents also occurred
in churches and other houses of
worship, as well as on military and other
government properties, in healthcare
facilities, on city streets, and in private
The report also revealed some patterns
regarding the shooters. They tend
to act alone; all but two incidents involved
a single shooter. They often kill
themselves after killing others—in 64
incidents (40 percent), the shooters
committed suicide. Of those, 54 shooters
did so at the scene of the crime. In at
least 9 incidents, the shooter first shot
and killed a family member in a residence
before moving to a more public
location to continue shooting. And not
all the shooters have been caught: at
least five remain at large.
The report does not offer any theories
on why the frequency of incidents
rose dramatically starting in 2007.
However, Dimoff’s firm has researched
more than 300 active shooter incidents,
and he says that one constant revealed
by the research is that the shooter suffers
serious psychological difficulties
and relishes the possibility of becoming
famous for a killing spree. Killing themselves
becomes the “perfect ending” to
“They basically want to go out in a
blaze of glory, and they envision their
face and name being paraded over the
news media,” Dimoff says.
If anything, media coverage of mass
killings has become more intense, and
in recent years the intensity has been
compounded by social media networks,
which provide more channels to
get the shooter’s story out, Dimoff explains.
“That’s a dangerous formula to
have out there,” he says. Thus, while he
was not sure why 2007 in particular was
the first year of the increase in frequency,
the fact that incidents are on the rise
is not surprising, he adds.
As for the victims, they also ranged
widely—young and old, male and
female, of all races, cultures, and religions.
Some were strangers to the
shooter; others were family members,
fellow students, coworkers, and law enforcement
officers, notes the report.
The findings have led to some
clarification in the way incidents are
described and classified by the government.
Ten of the officers who were
wounded in incidents were shot in
gunfights that occurred in open spaces.
“Based on these study results, therefore,
the FBI will no longer use the term
‘confined’ as part of the ‘active shooter’
definition,” the report says.
Overall, 64 of the incidents (40 percent)
fall under the recently adopted
federal definition of “mass killing,”
which is defined as incidents when at
least three victims are killed.
Although the report’s findings are
grim, Dimoff says that he has noticed
the beginnings of a positive development.
While the frequency of active
shooter incidents has risen, there are
early anecdotal signs that the increased
amount of training under the delay-
the-shooter paradigm is reducing
the number of casualties per incident.
“We’re just starting to see that,” he says.
Active Shooter 53 ASIS School Safety & Security Council
The Best Defense
by Laura Spadanuta
When a person faces a life-threatening
situation, like an active shooter, higher
analytic functions shut down. But training
can ensure that the proper response
to the threat occurs almost instinctively.
That’s the basis of boot-camp training
for soldiers. Police and private security
professionals have long understood
the need for strong training programs.
In the wake of deadly shootings at Columbine
and elsewhere, K-12 schools
have come to realize that one or more
attackers with modern large-capacity
weaponry can cause massive loss of life
before the police are able to arrive on
the scene and intervene. Thus, students
and staff will have to confront the threat
on their own. Given that reality, schools
are starting to put more emphasis on
the importance of training students
and staff in various response scenarios
The approaches to active-shooter
training are evolving, especially in light
of the recent Newtown and Aurora
shootings. Not everyone can agree on
the best approach, but they all agree that
any training program must be tailored
to the school, taking into consideration
the facility’s layout, the makeup of the
classes, and other characteristics.
Evolution. When a school orders a traditional
lockdown, it includes shutting
and locking doors, turning off lights,
and having students hide as best they
can. In some situations, this is still the
safest approach. However, in other
cases, students end up being defenseless
targets for the shooter or shooters
to easily and cruelly pick off. This was
the case at Columbine when students
were shot while hiding under tables in
the library. (Though if the students had
evacuated at the point that they knew
there was a shooter, they may have met
the gunmen in the hallway as well.)
Although many schools still teach
traditional lockdowns, there has been
a movement toward newer approaches
that enhance the traditional techniques,
says Amy Klinger, educational
administration professor at Ohio’s
Ashland University, who spoke on the
topic at the GovSec conference earlier
this year in Washington, D.C. Klinger is
also director of programs for the Educator
School Safety Network, a nonprofit
school training organization.
Not everyone applauds the newer
approaches, however. Kenneth Trump,
president of consulting company National
School Safety and Security Services,
is concerned that people are too
quick to discard proven best practices,
like lockdowns. While the lockdown
and other security measures implemented
during the active-shooter situation
at Sandy Hook Elementary school
in Newtown, Connecticut failed to save
the lives of 26 people, those measures
did save many other lives in that incident,
he says. “There were people who
reportedly were in lockdown when
the gunman went past the room. So
it did not work for all, but it did work
for some. So you just don’t summarily
throw out decades-plus of best practices,”
Proponents of the newer options
counter that they are trying to marry
the best of the old with something new.
“Oftentimes, people think that it’s replacement
of lockdown. It’s really not.
It’s adding additional components to
lockdown that are much more situation-
specific rather than just sort of
a general response to any particular
event,” Klinger tells Security Management.
New Tactics. Two popular activeshooter
that go beyond traditional lockdown in
active-shooter training are Department
of Homeland Security (DHS)-
supported “Run Hide Fight,” and ALICE
The City of Houston used federal
DHS funds to produce “Run Hide Fight”
as an active-shooter-response video.
It instructs viewers that when they
are confronted with an active-shooter
threat, they should first run out of the
building or kill zone if possible; if that’s
not possible, they should hide. If hiding
securely isn’t an option, they should
fight with anything available to end the
threat, rather than simply waiting to
become the next victim. This approach
has won many supporters, and it is part
of the Federal Emergency Management
Agency’s online active-shooter training
program. But it was for the workplace,
ALICE, a training course developed
by former SWAT-team leader
Greg Crane, of training company Response
Options, is specifically geared
toward school shooters. However, the
“Run Hide Fight” tools are now used in
Copyright © 2016 ASIS International, 1625 Prince Street, Alexandria, VA 22314. Reprinted by permission from the
August 2013 issue of Security Management magazine.
Active Shooter 54 ASIS School Safety & Security Council
schools as well. Though both programs
include the traditional tactics of evacuating
(running) when possible and
locking down in a room (hiding) when
evacuation isn’t a reasonable option,
they also include instruction on how to
fight back, which has generated controversy
(more on that later).
Evacuation. The evacuation aspect
can be difficult. That’s true in
a multi-level hotel or a high-rise office
building, and it’s no less true in a
school. There are often classrooms on
several floors, and those rooms may not
be near an exit. Additionally, there may
not be communication about where the
shooter is. But having a plan can help.
That’s why Klinger tells Security Management
that schools should have certain
protocols for when to flee. Klinger
said during her presentation that kids
who leave tend to survive these attacks.
It’s important to remember that
schools have a wide range of communication
capabilities. “We work in schools
where they don’t even have a PA system,”
Klinger says. Others have advanced
systems that can send messages
throughout the school. But even where
communications are good, it’s possible
that the person responsible for operating
the system will be incapacitated at
the start of an attack—or that person
may simply not have good information
to relay—so there is no telling what sort
of information will be passed back to
teachers and classrooms. Faculty must
be prepared to work with what they’ve
got in the moment and use that for
“When I have information about
what’s happening, if I’m at the north
end of a building and the active-shooter
event is occurring at the south end of
a building in the gym, why would I lock
the door and sit there, and wait for him
to find me? Why would we not remove
ourselves from this situation?” asks
But running has its risks, because
one never knows if the shooter will
be along the escape route, and young
children might be hard to keep quiet
or control in an evacuation, increasing
the risk of evacuation, while sheltering
in place has fewer risks if the room is
secure. “We’re talking about in K-12,
with maybe the exception of the lunchroom
or the gymnasium, those rooms
lock. Even in many of those cases, those
rooms lock. And if they don’t, we’re
usually putting the kids in the kitchen
or in locker rooms,” says Paul Timm,
PSP, president of RETA Security.
Bob Lang, assistant vice president
for strategic safety and security at
Kennesaw State University in Georgia,
sees evacuations as one viable option,
depending on the circumstances. His
school trains teachers to plan out possible
evacuations. “So we are training
them in what to do when they first walk
into their new facility and new classroom
and what to look for relative to escape
routes…what to look for in figuring
out how to get people out.”
In training and conducting drills
with the students to prepare them for
evacuations during an active-shooter
situation, it’s important to stress that
those evacuation routes might differ
from the ones used daily or during a fire
drill, Klinger says. They’ll also need to
be taught that doors and windows that
they normally wouldn’t think of using
might be something they’d need in this
unique type of threat situation.
The key is “to make sure kids understand
there [are] multiple ways out of a
room or out of an area. Especially areas
like gyms or cafeterias, where you have
large numbers of kids. They’re going to
try to go out whatever door they came
in as opposed to the four or five other
doors that might also lead them to safety,”
Barricading. If there is a closet or a
safe room for children to hide in so that
it appears there is no one in the classroom,
that’s a desirable option and one
that has been employed successfully by
schools in mass shooting events. But
when there is nowhere to hide, a barricade
against the door may help deter
the shooter or at least stall him while
law enforcement arrives. In training,
teachers are taught to be aware of the
way the door opens. They are taught
“to determine whether the door opens
in or opens out, [because] … If it opens
out, then you’re not able to barricade
the door,” says Lang.
Barricades are going to be makeshift,
says Klinger. “You’re not trying to
keep this individual out for two hours.
You’re trying to keep him out for a very
brief amount of time, until he moves
on to the next room or until law enforcement
arrives or to delay, deter,
and defend from that individual. So we
use whatever you have—desks, chairs,
tables. Whatever you can flip over and
put up against a door,” she explains.
Klinger adds that there can be internal
barricades also, so children can be
barricading within the room, such as
behind overturned desks. That way, if
the shooter does get through the door,
at least it will be more difficult to actually
get at anyone, which might buy
time to disarm the shooter.
Situational specifics. An important
aspect of training is to get teachers to
recognize that they will have to make
some snap judgments based on the
specifics at the time. In Klinger’s training
program, faculty are taken into a
classroom environment where they
can role-play how they would respond
in certain scenarios. That way, she explains,
they can get the hang of thinking
through the scenario and quickly
deciding what the best route to take is.
This “really helps people to start to understand
that there is no right or wrong
answer, that there [are] a lot of different
options that people could undertake
depending on the situation and what
they know is happening and so on,”
Teachers are also taught what factors
to consider in evaluating the viaActive
Shooter 55 ASIS School Safety & Security Council
bility of evacuations. For example, if
the teacher has a first-floor classroom
where there’s a door that leads directly
outside the building rather than into a
hallway, or if there are windows that the
students can climb out of, then evacuation
may be feasible and safe—and
thus desirable—even if the teacher or
students can’t tell where the shooter is.
If the shooter comes at lunchtime,
evacuation may also be the best option
for those teachers and students in the
cafeteria, because there are typically
multiple exits in that area, and it’s an
open space where it might be harder
to find cover from the shooter, says
If the teachers are in upper-floor
classrooms, however, the only exits
will be into hallways, which could be
a more dangerous choice if they don’t
know where the shooter is; so instead,
their best option might be to barricade
the room until they get a better sense of
Fight/Counter. Most people agree
that evacuating when possible and barricading
when stuck in a room are the
right approaches, but there are many
dissenters from the idea of fighting
back in an environment that involves
K-12 students. Trump thinks the ALICE
approach, particularly the “counter”
portion, is preying on the heightened
post-Newtown emotions and isn’t the
best way to prepare for a potential active
shooter. “You’re asking a kid to take
a 20-minute or 40-minute workshop or
assembly, and then implement something
that people in the public-safety
community armchair quarterback every
time they have an encounter with
someone,” Trump says. Trump notes
that the approach doesn’t take various
age levels, development stages, and
special needs into consideration. He
adds that it could open students up to
further injury, such as if the shooter has
explosives or was only going to commit
suicide rather than hurt others.
Moreover, schools that encourage
students to attack may be opening
themselves to additional legal liability.
“One kid stands up and runs to attack
the armed gunman and gets shot and
killed, somebody’s going to be held
accountable. There’s going to be tough
questions. What were your policies
and procedures? Was this run by your
school attorney and approved? Did
your school insurance carrier consider
this and review this and give you the goahead?”
Timm agrees that teaching students
to fight back might not be the best approach,
particularly if the students
are in schools where the doors can be
locked and the students might be safe
in traditional lockdown. “From a liability
standpoint, I probably don’t want
the kids fighting anybody,” he says. And
while he wouldn’t want kids to just be
sitting ducks if the shooter gets into the
safe room, he worries that if kids are
told fighting is an option, they won’t
understand that it should only be a last
resort. “I just get nervous that whether
the kid is 8 or 12 or…even 15, he might
have a little cowboy in him and think,
‘I’m going to get that guy. I’m going to
sprout a cape and get that guy.’ And
maybe even leave the confines of the
safe room to do it. I just think it’s not a
good idea,” Timm says.
Supporters stress that fighting back
is a last resort. “If you’re in a dire situation,
you need to go into survival
mode and do whatever you have to do
to have a chance to live,” Linda Watson,
CPP, security consultant with Whirlaway
Group LLC says. She adds, “We
know these kids aren’t cops. They’re
not trained in martial arts. They’re just
little kids going to school…. But do you
sit there paralyzed, or do you say, ok, if
we have to fight, we fight?”
“Ninety percent of our time training
is on evacuation and barricading.
We also spend time talking about violence-
prevention measures. We talk
about how teachers and school people
can think more like an emergency responder,
and even with things like communication
and calling 911 and how to
assist a law enforcement response, all
those kind of things,” Klinger says.
“We spend hardly any time…on the
counter or fight aspect of it, for a lot of
reasons,” she explains. “Number one
because there is that pushback. But the
primary reason is that when you focus
on the fight aspect, everything else
gets lost.” Klinger adds that what little
training she does do on fighting back
includes throwing things and creating
diversions to get away. The “Run Hide
Fight” video advises people to incapacitate
the shooter if possible, by using
whatever is available, such as chairs.
The video also shows people hiding
beside the door so they can catch the
shooter off-guard when he enters the
Emergency Communications. Ensuring
that critical information can be
communicated during an active-shooter
situation is important. Klinger notes
that the whole staff should know how to
carry out these tasks in case the people
who would normally fill those roles are
hurt or not available during an attack.
Teachers and other staff throughout
the school should be trained not only
in how to use the school’s emergency
communications equipment but also
in how to provide effective information
to 911. For example, they should
learn to be as specific as possible when
giving information to 911 operators or
when communicating with the rest
of the school; in describing a shooter’s
suspected location, for instance, that
would mean providing room numbers
if possible rather than just providing a
wing or a floor.
Drills. Experts all agree that it’s not
enough just to tell people what they
should do. You have to give them a
chance to act out those lessons through
exercises, both to test their training and
to test the protocols themselves. “We
Active Shooter 56 ASIS School Safety & Security Council
have to do drills because there’s only
a few times we know if our emergency
procedures work and one of those is
during the emergency. So that would
be an inconvenient time to find out
they don’t work, “says Timm. He advocates
including local law enforcement
agencies in such drills when possible so
that there is collaboration and consensus
between the school and potential
first responders to any incident.
Watson says that going through the
motions during drills can make the actions
that will be required feel more like
second nature to the students should
they ever have to respond in a real incident.
“We pop up, and we hide under
a desk, and we all pull into this room…
or we all shelter in place so that it becomes
a very natural, not a scary thing,
just something that we do maybe once
a month or whatever the frequency
they feel they need,” says Watson.
Klinger says that for the lockdown
enhancement drills, her group
conducts “what-if” scenarios, where
teachers might find out from the
principal whether there is a certain
level of lockdown or if there is a shooter
in a certain area, and then they have
to figure out what the appropriate
reaction would be to that particular
threat situation. It’s not as crucial for the
students to actually practice barricading
as it is for them to understand all of the
potential evacuation routes, she says.
It is important to drill for a variety of
possible situations that could arise with
an active shooter. Trump is concerned
that some schools do drills that are convenient
for them, rather than ones that
will be helpful in demonstrating the
different problems that might come up
during a true emergency. For example,
some schools will only do drills in the
morning but not when there are lunch
periods. “That doesn’t make sense.
That’s not good practice,” he states.
The age of the children involved
will affect how they are trained in these
procedures, says Klinger. “When you’re
looking at high-school kids, when
you’re looking at secondary kids, I think
you can be very open and very forthcoming,
‘this is what we’re
doing and why,’” Klinger says.
However, for elementary students,
Klinger says her organization encourages
teachers to build on important
skills that are already being taught.
Among those skills are moving together
quickly without pushing or trampling,
and obeying certain commands
quickly without asking questions. For
younger kids, especially, it’s “not necessarily
saying ‘this is what we would do if
there was a guy with a gun,’ but instead
you’re saying ‘this is what we would
do if in an emergency we all needed to
move quickly away, or if we all needed
to get away very quickly, or we all needed
to be together.” She adds that these
are skills that are transferable to other
extreme situations, such as a weather
John Bruner, founder of In-Crisis
Consulting, compares drills to gameday
training in professional sports; for
example, football players will practice
with loud crowd noise being pumped
in so they get used to playing in hostile
stadiums. He says he has at times
used simulated gunfire during drills
with teachers and faculty to simulate
the noise and smell of gunpowder that
might send the individuals into fight or
flight responses. He adds, however, that
they would only do this when students
are not at the school and with advance
notice to participants and cooperation
from local police and public safety.
“Even though [they] know what’s
going on … I’ve seen teachers at the end
get a little emotional and start crying
because they’ve gotten a true feel for
what this feels like,” says Bruner.
Some schools go even farther and
use the sounds of live gunshots on
drills with student participants. Those
sorts of drills may do more harm than
good, however, according to Stephen
Brock, school psychology professor at
California State University in Sacramento
and a member of the emergency
assistance team for the National Association
of School Psychologists. Brock
worries that many children are going to
be upset and potentially traumatized by
being exposed to that type of training.
Brock also says that training for an
active shooter could have the effect of
making young children, in particular,
view schools as violent, scary places,
even when their schools are safe. It can
help to avoid referring to the events as
active-shooter drills and to reassure
younger children that the school and
the teachers are there to protect them,
he says. However, he questions whether
active-shooter training is an effective
use of school resources. He says limited
dollars and time might be better spent
preparing for other incidents, including
natural disasters like earthquakes and
Other experts agree that schools
must not forget about the natural disasters
that Brock mentions and other
emergencies that need to be prepared
for. Watson says that emergency managers
should consider using an all-hazards
approach because tornadoes and
hurricanes occur more frequently than
active shooters. Considering the high
consequences of this type of low-probability
event, however, it is understandable
why some schools find it worth a
portion of their limited resources.
Active Shooter 57 ASIS School Safety & Security Council
Early Warning, Timely Response: A Guide to Safe Schools
U.S. Department of Education
Although most schools are safe, the violence that occurs in our neighborhoods and communities has found its
way inside the schoolhouse door. However, if we understand what leads to violence and the types of support
that research has shown are effective in preventing violence, we can make our schools safer. Research–based
practices can help school community’s administrators, teachers, families, students, support staff, and community
members recognize the warning signs early, so children can get the help they need before it is too late.
This guide presents a brief summary of the research on violence prevention and intervention and crisis response
in schools. It tells school communities:
• What to look, for the early warning signs that relate to violence and other troubling behaviors.
• What to do, the action steps that school communities can take to prevent violence and other troubling
behaviors, to intervene and get help for troubled children, and to respond to school violence when it
Early Warning Response
Section 1: Introduction.
All staff, students, parents, and members of the community must be part of creating a safe school environment.
Schools must have in place approaches for addressing the needs of all children who have troubling behaviors.
This section describes the rationale for the guide and suggests how it can be used by school communities to
develop a plan of action.
Section 2: Characteristics of a School That Is Safe and Responsive to All Children.
Well functioning schools foster learning, safety, and socially appropriate behaviors. They have a strong academic
focus and support students in achieving high standards, foster positive relationships between school staff and
students, and promote meaningful parental and community involvement. This section describes characteristics
of schools that support prevention, appropriate intervention, and effective crisis response.
Section 3: Early Warning Signs.
There are early warning signs that, when viewed in context, can signal a troubled child. Educators and parents
and in some cases, students can use several significant principles to ensure that the early warning signs are not
This section presents early warning signs, imminent warning signs, and the principles that ensure these signs
will not be misinterpreted. It concludes with a brief description of using the early warning signs to shape intervention
Active Shooter 58 ASIS School Safety & Security Council
Section 4: Getting Help for Troubled Children.
Effective interventions for improving the behavior of troubled children are well documented in the research
literature. This section presents research and expert based principles that should provide the foundation for all
intervention development. It describes what to do when intervening early with students who are at risk for behavioral
problems, when responding with intensive interventions for individual children, and when providing
a foundation to prevent and reduce violent behavior.
Section 5: Developing a Prevention and Response Plan.
Effective schools create a violence prevention and response plan and form a team that can ensure it is implemented.
They use approaches and strategies based on research about what works. This section offers suggestions
for developing such plans.
Section 6: Responding to Crisis.
Effective and safe schools are well prepared for any potential crisis or violent act. This section describes what to
do when intervening during a crisis to ensure safety and when responding in the aftermath of crisis. The principles
that underlie effective crisis response are included.
Section 7: Methodology, Contributors and Research Support.
This guide synthesizes an extensive knowledge base on violence and violence prevention. This section describes
the rigorous development and review process that was used. It also provides information about the projects
A final section lists resources that can be contacted for more information.
The information in this guide is not intended as a comprehensive prevention, intervention, and response plan
school communities could do everything recommended and still experience violence. Rather, the intent is to
provide school communities with reliable and practical information about what they can do to be prepared and
to reduce the likelihood of violence.