As active shooter incidents increase year after year, we have seen a variety of responses across agencies. There are times where responding law enforcement officers seem to have forgotten the very basics of critical incident response. There is a need to get back to the basics, but this need goes beyond patrol personnel. It must include us: the leadership. As officers train, plan, and exercise the response to such an incident, administrators must do the same. When higher ranking personnel show up, officers defer to them for leadership. When leaders fail to stay current on the training their officers receive, they put the agency’s reputation and the officers’ lives at risk.

The authority having jurisdiction always belongs to the initial responding agency. As the lead agency in an incident response, someone from that agency is going to assume the role of incident commander (IC). If the agency is a small size and is unable to fulfill that role, it may pass it off to a larger agency who may also have jurisdiction. No matter the specifics, however, someone needs to declare they are the IC on the radio. Initially, it is the first responding unit and then it will generally migrate to the first responding supervisor and up the chain of command. But if this is an active shooter, the first officers on the scene are going into the hot zone. So who is left, then, to take command? Once a supervisor becomes a “player,” he or she is no longer a coach. The ranking officer at any given time needs to be prepared to command.

In Las Vegas, Nevada, the Las Vegas Metropolitan Police Department adopted the MACTAC concept several years ago. MACTAC stands for Multi-Assault, Counter Terrorism Action Capabilities. Under MACTAC, the first responding officers and supervisor make entry into the hot zone in pursuit of the attacker. The second responding supervisor stays outside, however, and begins to organize arriving law enforcement into strike teams. That supervisor assumes the role of IC and notifies all units via their radio. That IC then coordinates with the teams that are deployed to help coordinate the response and prevent an overconvergence of responders.

Chief of Police Doreen Jokerst and the University of Colorado Police in Boulder are being very proactive in this area, having secured a large grant to work on target hardening and training for the community, their agency, and agencies in the area. As a member of the Collaborative Reform Initiative-Technical Assistance Center (CRI-TAC), the author worked with the CUPD Project Manager Carissa Jaquish-Rocha on this initiative. An extensive literature review of After-Action Reports (AARs) was conducted and some common issues were noted:

• • Lack of organization
  • Overconvergence of resources
  • Poor communications
  • Inadequate planning/training
  • Poor resource management
  • Incident commanders who don’t know they are in command
  • Lack of establishing IC posts
  • Lack of unified command

One other issue stood out in all of this: police organizations do not seem to learn from one another. AARs are increasingly being published online, with the intent that agencies and leaders can learn from the experiences of those who dealt with the response to a critical incident.

Part of the issue here is the nature of these incidents. Mass shooter events are highly dynamic, explosive crimes of violence. Officers may not know the exact location of the incident or the shooter and may have multiple descriptions of the person or people, leading to uncertainty about the number of shooters. As officers from various agencies respond and converge on the scene, it is imperative to organize the response while emphasizing speed to get to the assailant and stop the killing.

Police are expected to use the National Incident Management System (NIMS)/incident command system (ICS) in this process, but there is a problem. Because these are dynamic violent incidents, officers stress will be extremely high, so they may respond with little (if any) coordination. Officers are used to having discretion in how they resolve incidents and that discretion is both necessary and challenging in this type of situation. The challenge is it encourages officers to freelance when they need instead to organize on the fly.

In June 2012, Chief (ret.) Cynthia Renaud described the issue in her thesis, “The Missing Piece of NIMS: Teaching Incident Commanders How to Function in the Edge of Chaos.”¹ In it, Chief Renaud describes what is missing in NIMS —a decision making structure during the initial response. In those precious seconds or minutes where responders are still trying to figure out the situation and how to respond, there is no ICS decision-making structure in place. This is the space that she calls “the edge of chaos.” Officers generally know what they need to do; they understand their training. With that, however, comes the issue of the command officer. Do the commanders  know what they are doing? Have they been staying current on the training their officers are receiving?

It is easy to get absorbed in the daily administrative tasks that come with being a command-level officer. But if command officers are not staying current on tactics, techniques, and procedures, then there needs to be a change in the organizational culture. Put simply, the chief had better be keeping up with the troops, because when the big one hits, they will be looking to the chief for leadership.

The Basics

In their book, Critical Incident Management: A Complete Response Guide, authors Vincent Faggiano, John McNall, and Tom Gillespie break down critical incident response to seven basic steps.² The focus is not on the incident, but the response to the incident. Their book, along with the Simulation Based Training for Initial Responders course they provide, helps prepare first responders from the line level to the IC with basic guideline son how to respond to all-hazards critical incidents within the NIMS/ICS framework.. It helps fill in that “edge of chaos” in the response.

Action Item: Establish Command Post

Someone needs to establish a command post. It may be just outside that exterior doorway or it may be in the parking lot. It may be in the supervisor’s vehicle, or it could be in a command bus. The location is less important—ore important is that responding officers know who is in command and where the command post is located. This is where the administrator/leader comes in. The highest-ranking person on scene is probably the incident commander. Tell everyone via the radio, because once that is announced, it keys other resources (Fire, EMS, bomb squad, etc.) on where to go to join in unified command. Once someone announces they are IC, real coordination of the response can begin, and it is here that ICS begins. Establishing the command post begins the ICS process.

On that note, the importance of unified command cannot be understated. It is essential that all critical incidents operate in a unified command. While an active assailant incident is very law enforcement centric, Fire and EMS still have roles to play. However, they can only coordinate with law enforcement if they are at the command post to help make decisions on critical issues.

Action Item: Establish Perimeters

After the command post is established, the next priority is the perimeters, of which there should be two: an inner and an outer. The inner perimeter surrounds the incident and keeps it from expanding. It also keeps innocent people out, so they do not get hurt. The outer perimeter clears vehicular and pedestrian traffic and gives responders an area in which they can operate with minimal interference. Perimeters can require a lot of resources, so if law enforcement resources are limited, think outside the box. If streets need to be blocked off for an outer perimeter, the “blocks” do not need to be law enforcement vehicles. Anything may work—public works trucks, vehicles from parks and recreation, fire apparatus, etc. If law enforcement does not have the resources to commit to this, it’s important to plan ahead with local partners as to how this can be accomplished.

Action Item: Set Up Staging Area

Another issue that appears frequently is the lack of a proper staging area and a failure to recognize the importance of a staging area manager. Responders need to coordinate with the IC to prevent freelancing. They should not simply be running into a building or facility that belongs to another jurisdiction. This is hard, but it is at the staging area where strike teams can be coordinated to respond to the hot zone. It is understood that in a dynamic situation like an active shooter, there may be a “forward staging” for officers to form teams and make entry with an assigned area or floor to search. Another “out-of-the-box” idea is that the staging area manager may not need to be a member of a public safety agency. If there are outside personnel who are willing to do this job and attend training, they can be added to the ICS structure.

Action Item: Inform Community

In the age of social media, police organizations need public information officers to engage with communities by alerting  the public to the incident. This may prevent community members from unknowingly entering the area or may help clear traffic near the incident. It’s important to let the community know what is happening and to alert them to the “all clear” when the incident is over. Providing updates can be key in reducing the strain to call-takers and minimizing rumors or developing conspiracy theories.

Action Item: Activate Resources

Has the jurisdiction or region created active shooter protocols? The declaration of such an incident on the radio may jumpstart an automatic response for specific resources. That could be the deployment of tactical teams, bomb squads, or other specialty teams. Such a protocol should come with the requirement to train to such incidents. All local jurisdictions should understand what the response requires and how it works, so coordination is again critical.

Whatever the issue, it’s essential to request resources early. If you think you might need a resource, ask for it up front. That resource can stand by in the staging area. If it is not needed, so be it. But if it is needed, it is ready to be deployed.

Create a rescue task force (RTF) and establish a casualty collection point (CCP). Work with your local fire and EMS agencies to determine how the RTF concept works for you. An RTF consists of EMTs who are equipped to enter the warm zone under armed law enforcement escort. The officers that escort the RTF into the warm zone do not abandon the EMTs; they provide cover for them as they render aid. Casualties can be brought out of the hot or warm zone to an area where they are triaged for transport to definitive care. This too requires coordination, which should be happening in unified command. Another “out of the box” thought here is that civilian personnel on the scene may be able to assist in rendering aid. Corporate entities, such as refineries or large processing and manufacturing plants may have their own EMS staff. It is worth asking if they are prepared to assist.

Action Item: Secure Witnesses

It’s essential to secure witnesses and provide overwatch. Witnesses can help piece the facts of the case together, identify the suspect, and provide real-time intelligence. It is human nature to try to escape the chaos of such an incident, which means people will want to go home. But, in addition to all the other things that need done, officers need to corral these people and keep them in a secure place. If they are outdoors, consider assigning an officer to the area as overwatch to prevent the witnesses from becoming secondary victims in an ongoing attack.

Action Item: Secure Crime Scene

Maintaining scene security is important as well. Keeping the crime scene secure, providing security for the command post and the staging areas—all of that is part of the police response. Often, people think of the incident as “over” when the attacker is stopped or apprehended, but it is not. Maintaining unified command will carry over into multiple operational periods as investigators conduct crime scene processing and eventually release the deceased to the medical examiner. Even then, the documentation of the crime scene continues as every round expended is accounted for as part of the investigation.

ENGAGE Response

Dr. Eric Plummer, chief of police at Radford University in Virginia, developed a simple concept he calls ENGAGE. This includes the following:

• • Enter the facility, building, or area
  • Navigate toward the active threat
  • Gain situational awareness
  • Assess additional information as you proceed
  • Get rid of a threat by stopping the assailant or restricting access to victims
  • Establish unified command

Plummer advocates allowing Fire and EMS to establish initial unified command as they are staging their units, while law enforcement moves to stop the threat. Once the shooter is engaged, law enforcement joins unified command and directs additional tactical units as appropriate for the incident.

Conclusion

Initiating the critical tasks addresses the most common issues in a critical incident response. Combining those with the ENGAGE concept in an active shooter situation establishes a proper response to an incident. There will be a lot going on at one time. Putting priority items on a card will help prompt an IC to take the minimum steps necessary to stabilize and resolve an incident. It’s an “old school” concept, but it is extremely effective.

Notes:

¹Cynthia Renaud, “The Missing Piece of NIMS: Teaching Incident Commanders How to Function in the Edge of Chaos,” Homeland Security Affairs 8 (June 2012): Article 8.

²Vincent Faggiano, John McNall, and Tom Gillespie, Critical Incident Management: A Complete Response Guide, 2nd Ed. (CRC Press, 2011).

Please cite as

Robert Mueck, “Back to Basics, But Thinking Out of The Box,” Police Chief Online, November 23, 2022.