Active Incident Training: Preparing for the Future Threat

Preparation must go beyond incident response, tactics and the focus on active shooters.

History is an ambivalent teacher. On one hand, as Spanish essayist George Santayana opined, “Those who cannot remember the past are doomed to repeat it.” On the other hand, we have the scornful proverb from Frederic Smoler that generals fail because they prepare to fight the last war.

In the world of active incident response, we have certainly learned from history as we observed and dealt with new threats, starting with the Texas Tower at the University of Texas at Austin, and moving through Columbine, Virginia Tech, Mumbai, India, Sandy Hook and Orlando, Fla.

We abandoned the strategy of setting up a perimeter and waiting for SWAT to make entry; we moved from large entry teams to two and even a single-officer response; we’ve modified our tactics (e.g., larger and slower diamond to a faster Y/T tactical formation) to interdict the “stopwatch of death” sooner; we’ve developed new strategies, such as the rescue task force, and protected corridors to stop the bleeding sooner; and we’ve presented broader response options than sheltering in place (i.e., run and fight) to potential victims.

These innovations are, or course, positive in their entirety and have undoubtedly saved many lives. Immediate entry and fast-moving tactics like bounding overwatch and fire and movement now constitute the majority, if not the totality, of most law enforcement active shooter training.

Add to this at the school and hospital levels the ubiquity of cameras, locks and access control systems, security systems, mass notification systems, guards, incident reporting, training and student discipline procedures, and many conclude their institution is well-balanced and well-prepared to confront the unthinkable.

However, according to Awareity, these capabilities and preparations neither prevented catastrophes at Fort Hood, Texas; Virginia Tech; the Washington Navy Yard; San Bernardino, Calif.; and Columbine nor spared many of the schools from large lawsuits and/or significant losses in enrollment.

RELATED: Do You Have What It Takes to Be a University Emergency Manager?

We have failed as a community in three places:

1. We have focused largely on the active shooter threat while we see the emergence of other dangerous threats.

2. We have focused on police and security response tactics to the exclusion of many other required capabilities that must be simultaneously and seamlessly executed in an active incident.

3. We have mainly addressed response, which only constitutes a fraction of the totality of the opportunities to prevent an incident and steps to mitigate its impacts and recover from its effects.

Be Aware of These New Threats

A recent FBI study concluded active shooter incidents have increased over the last five years, both in terms of their frequency and lethality. Paris, Brussels and Orlando, Fla., demonstrate that active shooter incidents are still a real and deadly threat, and we know that schools, particularly undefended ones, are particularly attractive targets to terrorists.

While we cannot afford to stop teaching Run, Hide, Fight and other shooter response options to keep our citizens safe, or the armed police tactics mentioned above to neutralize the threat as quickly as possible, the active shooter constitutes the last (albeit still dangerous) war but not necessarily the next.

Here are just 10 new/emerging threats we need to plan against. There are many others:

1. Increasing connectivity and collaboration between international terror groups.

2. Attacks using vehicles, advocated by al-Qaida, as we saw in Nice, France.

3. Attacks using drones. If we can deliver pizzas with drones, we can certainly deliver bomblets as well as chemical and biological agents. (Some schools are teaching classes on how to operate drones, causing one to wonder about how prospective enrollees are screened.)

4. Weaponized hazardous materials (radioactive materials, sulfuric acid, etc.) from laboratories or destroying them in place to contaminate a building or portion of the campus.

5. Manufactured guns and knives that contain no metal and can avoid metal detectors.

6. More sophisticated potential combatants. As we saw in Mumbai, the assailants had received advanced tactical training. Unlike the shooters of 10 or 15 years ago, when “tactical” meant dressing in black and wearing a ball cap backwards, interactive video games give their players the opportunity to use and master small unit tactics such as fire and movement.

7. Availability of attack planning information on the Internet. Whether it’s plans to build a pressure cooker bomb or cook up ricin (one of the most deadly toxins known) or find college building plans, this information is widely available on the Internet and allows a higher level of attack planning than we’ve encountered to date.

8. Cyber-attacks against security systems, such as defeating electronic locks to allow access by shooters.

9. Distributed attacks. The Mumbai attackers targeted hotels, religious centers, transportation hubs and random targets. Most active shooter training exercises are run against a single threat, but how well are we prepared to respond with our limited personnel to simultaneous attacks at an athletic event, a campus daycare center, a dorm and a busy classroom building? Small campus police or security forces would be quickly overwhelmed, and the communications and logistical requirements for coordinating a multi-agency response would be extremely challenging, even if the affected agencies had practiced together on a regular basis.

10. And what is the threat not yet anticipated? The first application of a new technology or a new tactic, such as crashing an aircraft into the World Trade Center, is likely to catch us unaware if we are not attempting to think outside the box.

Police/Security Responses Require So Much More

As a certified active shooter response trainer, I understand why most training focuses on the tactics to engage a single shooter in a contained location. Exercises are expensive, they remind people that scary things happen on campus and represent negative marketing. They are also complex and are difficult to do correctly.

In the June/July 2016 issue of Campus Safety magazine, I addressed the scores of personnel, procedural/planning, facilities, equipment and communications inputs required to succeed against the active shooter in How to Evaluate and Improve Your Agency in 5 Easy Steps (view that story here).

The sheer scope of an active incident is almost too large to exercise. In a companion article to this one, I consider just a few (25) of the considerations/ tasks (in addition to the tactics already noted) a department must address if it is to develop a flexible and effective capability against an armed assault on campus (See 25 Tasks to Consider When Developing a Response Plan for Armed Assaults).

Getting to the shooter(s) quickly is necessary, but hardly sufficient. Are our training scenarios realistic? Do they include role players who simulate more than the shooter? Are you exercising with members of the media, wounded, parents, hostage takers, etc.?

Officers who know bounding overwatch find it difficult to execute when dealing with 15 evacuating role players running toward them and perhaps even grabbing on to them for safety.

Of course, these exercises are costly, difficult to organize, may scare the campus community who is unaware of the training schedule and bring undesired notoriety to the organization. Exercises are admirable preparations notwithstanding.

The next best thing to a formal field training exercise (FTX) is a command post exercise (CPX), initially involving officers and commanders, and later other college officials from the administration, facilities, parking, etc.

The point is active shooter training for police and security must address a lot more than tactics. Sadly, this is not often the case.

Address All 4 Dimensions of the Active Incident

The preceding paragraphs show that police/security response must involve factors going far beyond small arms tactics. Similarly, an active incident contains at least four distinct dimensions, only one of which is response; and even the response dimension contains tasks and objectives within the purview of other, non-police actors.

The four dimensions associated with active incidents are prevention/ deterrence, response, mitigation and recovery.

Each of these dimensions has tasks for police, but other actors are also involved. For instance, during the response phase, the school’s public information officer (PIO) might deal with the media, parking might deal with ingress routes and traffic control, facilities might deal with building access and the administration will deal with decisions governing operations at non-involved campuses.

The Active Incident Strategy Matrix chart below contains more than 80 strategies germane to active incident response, and this chart only scratches the surface for the police. Other campus entities need to develop a similar matrix for their own activities.

Active Killer

Let us consider some tasks associated with each dimension of active incident response:


As noted above, there are many prevention initiatives that can and should be pursued by all campus entities, not just the police.

We tell our faculty, students and staff at our community outreach presentations that when seconds count, the police arrive in minutes, which is why they call us responders. Our goal is to raise the recognition that police cannot prevent an active incident, in part because people do not knowingly break the law in front of uniformed responders.

However, citizens on campus can and do see all kinds of behaviors that, if reported to police, can prevent concerning behavior, either by direct intervention by police or providing an opportunity for a person in crisis to get needed help.

The principal challenge here is to encourage people to look up from their cell phones and actually pay attention to their surroundings. One technique we’ve used with success is to ask people to read the words:

Active Shooter

Most people (greater than 95-98 percent) respond “Paris in the Spring” and miss the second “the” that’s right in front of them. They miss the actual words because they see what they expect to see, not what’s there. We tell audiences if they never expect to see a gun or bad behavior on campus, they never will.

The problem, however, goes far beyond getting people to observe their environment. Even if they are observant, reminding people “If you see something, say something” is not enough because people refuse to report behavior to police for many reasons.

They may not want to report a friend; they may dislike the police; if from another culture, they may fear the police; they don’t want to be considered racist or Islamophobic; they fear legal or physical retaliation; or they may be uncertain if a crime was actually committed and do not want to waste the police department’s time.

An active community outreach program is the principal way the Northern Virginia Community College (NOVA) Police build campus trust, respect and confidence in its police department. The regular public safety newsletter, safety briefings offered at each campus that empower citizens to protect themselves and increase the efficacy of police actions, and police participation in student activities have yielded increased interaction between the campus community and the police.

It is important to remember that when reaching out to the campus community, different strategies work for Baby Boomers, Gen Xers and Millennials, as well as international students. Similarly, a mobile safety app makes reporting easier and less noticeable, especially for the younger tech-savvy students.

One area that is critical to deterring an active incident is knowing which facilities and equipment on campus are of greatest interest to potential attackers. In Smart Security Planning: Your Key to Administration Support, I discussed the CARVER system of selecting high-value targets. In this methodology, each target is assessed for each letter of CARVER: criticality, accessibility, recognizability, vulnerability, effect and recuperability.

Once we know what our target base looks like to potential assailants, we can develop protection checklists and patrol strategies that may deter attacks.

We have many potential high-value targets on campus, such as sporting events, parking decks, the financial aid office; controversial exhibitions; controversial offices (e.g., Young Republican, Democrats, other action groups); laboratories (HAZMAT)/computer and HVAC control facilities; senior administration offices, ROTC; police/security offices; and construction sites (for explosives).

The question is which of these, or others, are most attractive to our adversaries, recognizing that any particular target can have different values to potential adversaries based on their objectives, ideology, capabilities, timelines, etc. Once we know what our target base looks like to potential assailants, we can develop protection checklists and patrol strategies that may deter attacks.

Other police/security strategies that have met with great success include social media monitoring to identify potential threatening behavior, the development of memoranda of understanding with local agencies for joint operations and information sharing (with periodic exercising of the former), and outreach to the state Fusion Center for timely warning of intelligence trends of concern.

Campus mental health, student discipline, sexual assault services and threat assessment teams have a positive role to play in helping people in need and protecting the campus. Threat assessment teams provide a venue where this information can be consolidated and shared, thereby identifying potential threats and getting assistance as needed in a timely manner.

Other campus personnel have a critical prevention role to play. Parking, facilities and business office personnel are either moving around the campus or seeing hundreds of people every day at the business counter. These individuals are a valuable source of information, providing critical intelligence that identifies potential threats. Police or security need to reach out to them to identify the types of safety-related information of interest and establish mechanisms to collect this information.


In the police/security responses section, many of the response requirements and activities were identified so they are not repeated here. Additionally, response activities of other college entities, such as parking, facilities, office of emergency management and planning, the PIO and academic officials can be identified and explored in a CPX.


In sports, it’s often said the best defense is a good offense. This dictum also holds true for an active incident response: speed, shock and violence of action that neutralizes the threat in a timely manner will limit death and injuries as well as physical damage to the campus.

In addition to the timely and effective response by law enforcement/ security personnel, there are many strategies to limit the effect of the shooter or other type of attacker (See 7 Mass Casualty Mitigation Strategies).


In many ways, the period immediately after the resolution of the incident is when the hard work begins. NOVA dealt for months with the aftermath of a student who brought a rifle on campus and attempted to shoot a professor.

A college presidential commission was empaneled to analyze the issues that generated the incident, identify lessons learned and implement corrective actions. This commission operated for more than a year following the incident, and the lessons learned, which resulted in new general orders and equipment (e.g., patrol rifles, additional evidence lockers, more cameras and more officers), have had indelible and continuing impacts on the police department and other officers involved in mental health and concerning behaviors, to mention only a few. Other strategies that can enhance recovery include:

• Memoranda of understanding (MOUs) with local agencies: As soon as the incident scene is declared secure, responders will have to search for bombs and weapons, process a huge crime scene, inventory and store a massive amount of abandoned property, and maintain visible officer presence to calm nervous campus personnel. These tasks will challenge personnel and equipment resources of the most well-provisioned campus police department. Establishing and exercising joint operations with local responders will expedite recovery efforts and a return to normalcy.

• Counselors: There will also be a need for counselors to help victims deal with grief and officers with post-traumatic stress. A campus is unlikely to have enough experienced counselors on hand, so arrangements should be made for the types and numbers of counselors needed before the event occurs.

• Public Relations: Education is a business, and both parents and students want to matriculate at a campus that is considered safe and secure. Failure to maintain the public’s belief that a campus is safe will likely result in declining enrollment, making it crucial that campus public information officers and other senior campus personnel have a strategy to calm public fears.

Campus Police, Security Must Lead the Way

The foregoing strategies only scratch the surface of a fully integrated active incident response capability. However, the breadth of these few items underscores the complexity of the task and the need for planning that goes far beyond active shooter response tactics.

Preparing to prevent, respond to, mitigate and recover from an active incident is a daunting task that requires significant original thought, coordination both on and off campus, and practice.

Elsewhere, I have written I do not think allowing concealed carry permit holders to bring their weapons on campus is a good idea. Nevertheless, there are numerous initiatives police, security and the rest of the campus security community can pursue to prepare for the evolving active incident range of threats.

The first step is recognizing we must focus on more than the response dimension and that other entities on campus, including students, have a critical role to play in this important endeavor.

The entire campus community can be empowered in this role, and it is the police and security forces that can and should take the point on making this happen.

A multi-faceted community outreach program; departmental and both intra-campus and inter-agency exercises and training; concerning behavior information collection, consolidation, and sharing; outreach to local police agencies and fusion centers; target evaluation; and ongoing analysis of capability strengths and weaknesses should play a leading role in keeping our campuses safe and secure.

Read Next: What Does Terrorism Look Like on a College Campus?