Active Shooter: Planning for After Run-Hide-Fight

Summary: Organizations need to turn their attention to how the aftermath of an attack is handled in order to best support victims and return to operations.

Key Takeaways

• The average active shooter/hostile attacker incident lasts 8 minutes. We have extensive training and protocols for the actual attack period via the run-hide-fight protocol, but we also need extensive guidance for the aftermath, which can last as long as a year afterwards.
• An Active Shooter/Hostile Attacker plan does not have to be proscriptive and precise, but it should spell out the questions and items the response team can be expected to address.

In July of 2012 the City of Houston in the US state of Texas released a now-famous video on how to survive an active shooter incident. The video used a protocol (Run-Hide-Fight) that has now become as much a part of our lives as other safety memory devices like Stop-Drop-and-Roll or Duck-and-Cover. Organizations all over the world have since embraced this simple cadence of actions with variations such as Run-Hide-Tell (UK) and Escape-Hide-Tell (Australia), and it’s now ubiquitous in training and workplace violence prevention efforts.

But videos and training efforts are mostly aimed at individuals who otherwise don’t have safety or security training, and they focus on surviving the attack, not what happens when the violence stops.

For safety and security professionals, or those in charge of responding to Active Shooter/Active Attacker/Hostile Intruder incidents, the period after the incident requires equal effort for training and protocols.

Why the Aftermath Matters

In order to understand why we should turn equal attention to the aftermath, it helps to examine the statistics for active shooter attackers. According to the FBI, as of 2018:

• 98% acted alone
• 37% committed suicide, usually on site
• 41% were apprehended
• 21% were killed
• 34% used a long gun (rifle, shotgun, or carbine)
• 66% used a handgun
• 65% brought a single weapon
• 35% brought multiple weapons, sometimes with hundreds of rounds of ammunition
• They were dynamic and quick, finishing their attack in an average of 8 minutes

This data is notable because in the same set of data from 2013 90% of attackers committed suicide. This means that more attackers are apprehended now, which has aftermath implications for the responding organization-based teams.

Also notable is that the average attack lasts only 8 minutes. This is the period in which the Run-Hide-Fight protocol is an effective tool for survival. But what happens at minutes 10 through the next year matters equally.

In this extended aftermath period:

• The training for employees needs to be updated to include how to interact with first-responders in the immediate aftermath
• Guests need messaging to hide in their rooms, and then further messaging that the attack has ended
• Accounting for people will take up to 24 hours
• Tracking people taken to hospitals will be especially difficult as multiple hospitals may be involved and health information privacy laws will be in effect
• The Special Situations Management (SSM)/Crisis team needs to be activated and begin response
• Assigning representatives who will interact with the injured and the families of victims requires advance preparation and training
• Apprehended attackers will extend the news cycle and subsequently the traumatization of victims
• Employees require support
• Family assistance areas need to be set up
• Operations need to be taken over by support teams
• Communications and media need to be managed, and any holding statements must be carefully crafted
• Shrines to victims need to be managed and protected until appropriate to dismantle
• Human resources procedures for fatality need to be deployed, and if the event caused mass casualty, supplemental staff may be needed
• The Employee Assistance Program (EAP) needs to be activated
• Camera footage needs to be considered for release to law enforcement/legal authorities
• Response protocols from the company will be collected as part of discovery from victims
• Facility recovery occurs and specialized vendors need to be engaged
• Survivors and the families of victims can either be further traumatized or helped to heal

The Danger of Poor Aftermath Response

As part of my work helping organizations assess response and build scenario-specific playbooks for incidents like active shooter and hostile attacks, I’ve been honored to interview victims to further understand how organizations can be better prepared for the aftermath.

Some of my key takeaways:

• Employees will need counseling for up to and possibly beyond a year
• Counseling needs to be by specialized trauma counselors
• Employees will either form a tight bond and need group sessions or some will become loners and drift away; both avenues need addressing
• Employees may need an anonymous talk line
• Employees who are not given adequate services will be severely impacted and likely unable to sustain their career
• Return to work needs to be carefully managed with counselors on hand in the first few shifts
• As possible, employees should be given the option to transfer to a different location with as little push back as possible. Some of them will not be able to face the location where this traumatic event impacted them.
• Support and operational staff who go to the facility in the aftermath to provide support and perform services need to be trained to be sensitive to what their co-workers have been through
• Leaders and managers at the site of the event need to be encouraged to seek services – this will encourage their direct reports, and it will keep them from feeling like they must be stoic at all costs

Actions to Take to Improve Your Aftermath Response

Professionals in charge of a facility need to create a plan that directly addresses the areas of impact. The plan should include both operational checklists with known items that must be managed, as well as task considerations for things that will require situational analysis for appropriate response. Precise and prescriptive checklists are not needed for everything – even knowing what types of decisions may need to be made in the aftermath can help the team develop an appropriate response.

Precise and prescriptive checklists are not needed for everything – even knowing what types of decisions may need to be made in the aftermath can help the team develop an appropriate response.

What your plan should cover:

1. Plan activation and team composition (the team will be activated after the event has happened, so consider who is needed for response; how to stand up a call center)
2. Working with Law Enforcement and Local Authorities (who will coordinate, actions law enforcement is likely to take, who has the ability to release camera footage, who will track the case for apprehended attackers)
3. Media and communication coordination (holding statements, spokesperson, how a media staging area can be managed, social media monitoring, website “dark site” with hotline information and grief expressions)
4. People support (family and victim assistance including visitor and guests, EAP activation, benefits administration, insurance activation for extended guest services, next-of-kin notification support, long term counseling and care, human resources)
5. Operational considerations (specialized clean up, shrines and memorials, replacement operations team trained to specific positions to take over, facility repair, risk management and insurance claim management, financial considerations, expense management and reporting)
6. Plan de-activation and team stand-down (how the team will determine it’s time to cease operations, how documents will be collected and the case file archived, who and how to conduct an After Action Review)

Making sure you have a plan that at least spells out these considerations will allow your team to react faster, make better decisions, and handle the aftermath with humanity and care for the victims and survivors.

A version of this article appeared in the December issue of The Dispatch, a magazine for Hyatt security professionals and general managers.