The Active Shooter / Armed Intruder
Planning For…Responding To…Recovering From the Unthinkable©
Last week's shooting at the school in Uvalde, TX has once again left our nation shocked, appalled, and numb with grief and disbelief. And once again, we find businesses and organizations of all types pushing active shooter preparedness to the top of the To Do List. And, judging from the number of calls that we have received in the last week, it certainly looks like more companies are ill prepared than well prepared.
Putting together an active shooter plan is not a simple task. Canned programs typically don't work, and there is no such thing as “one size fits all”. your program must be written to your organization, to your schedules, and to your building layout and design.
We have collaborated with companies across the nation who have dealt with active shooters or armed intruders in the workplace. One of the things that frustrates us most is that we continue to hear comments like “we never thought it would have been here.” There is no reason to believe it will not happen in your building, in your company, or in your community. There has yet to be an event that anybody expected it to happen. The first rule of preparedness is to accept the fact that it can happen in your organization or in any of your facilities, and preparedness is critical. It may be a subject we don't want to talk about, training, or have exercises and drills for, but we are still obligated to do so. Getting rid of denial is step one!
One of the most valuable tools that you will find in developing your preparedness plan is the security vulnerability assessment (SVA). The SVA a is designed to help you identify “chinks in the armor” in your security management program that could contribute to the likelihood of an event occurring. We use a program that we developed years ago called P2T2® when we perform an SVA. P2T2® represents the four critical areas of a security management program: People, Programs, Training, and Technology. If deficiencies in any of these four elements of your security management program, vulnerabilities exist, an event is more likely to occur.
Securing a facility starts at the perimeter and works inward. Typically, this means property lines become the first point of protection. Rings of Security Are effective in looking at our ability to protect our facility at the property line, at the building perimeter, and inside the building (see attached).
Rings of Protection
Your security program for every location should have Deterrent, Delay/Denial/Detection and Response elements immediately around the target to be protected, at the perimeter of the property and between the perimeter and the target ring. This protection technique is referred to as the ‘Rings of Protection’ concept.
HARDENING YOUR BUILDING
Depending on the type of business you are, building hardening can be a valuable tool in lessening the chances of an event occurring. Retail facilities we'll find this difficult to do because they rely on members of the public coming into the building to support the business. Shopping centers, grocery stores, and similar outlets are an example. Even in these facilities, however, design features can be incorporated to lessen the chances of an event and to maximize protection to the occupants.
CPTED (Crime Prevention Through Environmental Design) is an architectural principle we use with our clients to maximize efficiency of the building but to lessen the vulnerability to crime. CPTED principles include natural surveillance, access management, territoriality, physical maintenance, and order maintenance.
If it is not necessary for your building to be open, an engineered access control system should be considered. Not surprisingly, many people do not understand the concept of access control. It is much more complex than just giving a person and access card that works at certain times on certain doors. Even with the most expensive system, if it is not professionally designed and installed, it is subject to failure. I think back to a number of years ago when I visited a local school after the new “security system” was installed. The school principal was quite proud of her new system and had the local newspaper present showing it off. As she walked out the back door to show off her outdoor cameras on the perimeter of the building, she took a folding chair and used it to prop the door open. Not only did she destroy the security on the inside of the building, but if her system had been designed properly, the minute she propped the door open, it would have been setting off bells and whistles. If you have an access control system on your building, kudos to you. My challenge to you now is to go back and have it evaluated and make sure it is professionally designed and is not vulnerable to the bad habits of the people in the building.
People often ask me about the use of ballistic (bullet proof) glass. I'm OK with it if you want to spend the money, but it always leaves me scratching my head when I see ballistic glass installed in a service window, but no ballistic protection in the walls surrounding the window. That half inch sheet of drywall on either side of the stud is not going to give you any protection. If you're going to install ballistic windows, make sure that the doors and walls are equally protected. We have clients now using a security window film instead. First, let me make very clear that this window film has no ballistic value, and will not stop any type of ammunition.
One of the easiest ways for an armed intruder to defeat the security system is to shoot the glass out of the door or window to gain access into the building. when a shot is fired into the window, typically the window will shatter. This security film holds the window together, resulting in a spiderwebbing of the window without actual failure. The shooter will still have to spend an exorbitant amount of time that he or she doesn't have trying to tear through the broken glass and security film on the window.
CCTV cameras are another valuable tool, but again only if effectively use. I visit many companies that have spent 10s of thousands of dollars on security cameras but have nobody monitoring the cameras. There is nothing proactive about this. In a sense, they are saying “we will accept an event happening, but we want to be able to look at the video afterwards and know who did it.” That is not acceptable. Security cameras should be monitored whenever the building is occupied, and the person monitoring the cameras given full authority to call 911 whenever they see anything on a camera that looks suspicious.
THE WRITTEN PLAN
Your preparedness program starts with a professionally written active shooter plan. As I previously stated, I strongly encourage against going out and buying any canned programs. These are designed to do one thing, and that is to line the sellers’ pockets with gold! Your plan needs to be written specifically for you, for your situation, and for your environment.
A professionally written active shooter plan will include, but not necessarily limit to the following:
- Protocols for facility lockdowns
- Potential threat warning signs
- Domestic situations
- Disgruntled former employees
- Other facility specific
- Notification of employees, customers, and others in the building of an intruder
- Response guidelines for staff[1]
- Run, Hide, Fight
- The Four Outs
- When law enforcement arrives
- Hiding places in the building (by wing or area)
- Recovery
TRAINING
I don't want to sound like a broken record but having worked with so many companies over the past 21 years in business that has had armed intruders or active shooters, training in active shooter preparedness, response and recovery seems to be very rare, and is seldom realistic or effective. I have heard all the excuses:
- it will scare our employees
- it will scare our customers
- we know all our employees and their families, and just don't see it happening here
- we provide training to employees on things that are more likely to happen
- there is no state or federal mandate requiring it
- too much liability
- … and much much more
If you want to talk about liability exposure, I'll be happy to do that in a separate article and will gladly include a couple of local attorneys to coauthor with me. We can also talk about OSHA, and their requirements under the emergency preparedness standard. We've already established that there is not one business in any given or any random industry that can truly say that they are immune from the risk. If you know the risk is there, you have the obligation to prepare your employees to minimize or eliminate the chances of an occupational injury resulting.
The better trained your employees are at responding to an armed intruder, the greater the chances of minimizing the casualty count. Let me go on record as saying that if we have a shooter in the building, in all likelihood there will be casualties. In most cases, we don't even know that we have a shooter in the building until the first shot rings out, and by then, we already have casualties. While we would like to say that our goal is to prevent casualties, we must be realistic and say that our goal is to minimize the casualty count and maximize survivability.
Training is your key to meeting those goals. How people respond will dictate the outcome more often than not. The shooter has his or her plan and before they ever come on our property, they know what they are going to do. To balance the scales, we must have a plan in place to know what we are going to do if this happens. Not having anything in place will only increase the casualty count.
A well-designed active shooter preparedness training program will consist of two key elements:
- Didactic / classroom training to introduce the subject, the content of the training, and a review of the company plan
- Exercises and drills designed to develop the skills necessary to respond under the most stressful conditions with survivability in mind
Always remember, in any type of emergency preparedness training, we educate the minds to understand, and we train the hands to perform. Didactic training without exercises and drills will be ineffective; exercises and drills without didactic training will be ineffective.
Much the same as fire drills and other types of emergency preparedness drills, active shooter training must be an ongoing thing. “One and done” will not work. If an actual event occurs, your employees and your leadership team we'll both be more scared than anything they have ever experienced. Repetition breeds competency, and people will perform the way they train. The more they are trained, the better they will perform.
As you can see, exercises and drills are a critical part of training. Sadly, it is often the part that is least talked about, and seldom practiced. But these types of emergency preparedness drills are the same as every other type of emergency preparedness drill, we do in the workplace. We take the same approach: We have no reason to believe it will happen, but we still must be prepared. We don't expect a fire, but we still do fire drills. Do drills pay off? Keep in mind that the last child to die in a school fire in the United States was on December 1st, 1958, at the Our Lady of Angels school fire in Chicago. After that, school fire drills became a requirement, and the results speak for themselves.
When having an active shooter exercise or drill, there are a number of different approaches that can be taken. Our preferred method is to start with tabletop exercises to evaluate your plan. Test the plan in small, bite-size pieces. Do one part at a time and make sure it works. Do not try to do a full-scale drill until you know your plan is right. You may think that you have written an incredibly outstanding active shooter plan, but until it gets actually tested, you won't really know. Your tabletop exercise is your opportunity to evaluate your plan and revise it before you put it out onto the floor in front of your workforce.
Once you know your plan is ready to go, you are now ready to start evaluating the plan in small, bite sized pieces. Do one part at a time and make sure it works. Don't try to do everything at once. Evaluate it using hypothetical situations and small groups of employees, and when you identify areas that need attention, correct those and retest before you go on. Finally, when it is time to do a full-scale exercise, make sure all your employees know that the exercise will be conducted, and when and where. Do not try to do a surprise exercise. The results may be disastrous, and you may experience employees having adverse medical responses (heart attacks) to the fear.
RECOVERY
One of the most overlooked components of any facet of emergency preparedness is the recovery after an event. Even on training and exercises, we drill for the event, but we never talk about recovery. But let's think about the unimaginable for a moment. Let's imagine that the unthinkable has occurred in your building. The event is over, the fatalities have been removed, the injured taken to the hospital, and the investigation has begun. Where does that leave you? What is going to be needed from you?
Think about the resources that your employees, their families, your customers, your company, and everyone else involved is going to need. Based on a hypothetical situation, this may include:
- crisis counseling
- public relations assistance
- legal / risk management
- cleanup and restoration
- emergency management consultants
- media
- security (armed or unarmed)
- traffic control
- insurance claims management
- defense counsel
- others
If you needed all these resources at once, do you know where to find them? Do you have a relationship with any providers of this type? Are they qualified for the type of situation you are dealing with? Now is not the time to be asking these questions period it should have been asked long in advance of the event, and these considerations built into your recovery plan. And just because you may know someone who does this type of work does not mean they are qualified. A marriage counselor is not the best person to be calling for crisis counseling following a workplace shooting. You need someone specifically trained to deal with this type of situation.
Start developing your recovery plan now. Search out qualified partners in these areas and any others that may be applicable to your occupation or industry. Develop relationships with these partners, assuring that you can call them at any time, days, nights, weekends, holidays in the event of an emergency and that they will respond to provide you with assistance and guidance.
Experience has proven that even the best of leaders lose their effectiveness in such a situation. As a good leader, you are attached to your company and to your people. And when those are violated and victimized, it will affect your ability to make rational decisions for both short term and long-term outcomes. Have a qualified someone to turn to who can help you in the complex decisions you will be called upon to make and to provide you with the resources they all need to get through this.
CONCLUSION
We are a small community. I wish I could look at you and say that it won't happen here, but I would be lying to you. I have no reason to believe it won't happen here. Uvalde, TX Is about the same population as Bradley IL. They thought it would never happen there. We must accept the fact that it can happen anywhere, and that we must be prepared for this. The world we live in has changed, and we must stay a step ahead in making sure that everybody in the workplace is protected.
Stay safe and stay in touch!
Steve Wilder
President and Senior Security Consultant
Sorensen, Wilder & Associates
Bradley, IL
815-933-5977
