Active-Shooter Incidents: Planning Your Response


Emergency services organizations are still attempting to define their role in active-shooter incident responses. Each agency’s function and participation vary based on factors such as size, personnel, equipment, service level, geography, and training. No definitive levels of standards can be applied to the fire service as a whole. Major metropolitan fire departments can bring more resources to bear on a mass-casualty incident than a strictly volunteer department serving a population of 15,000 citizens. The strategy and tactics that the metropolitan department employs may not be a feasible or wise direction for the smaller volunteer department. It is reasonable to assume that higher and denser population areas will have a greater demand for emergency services. Major cities have championed emergency services response to active-shooter and mass-casualty incidents because of the size of the population they serve. However, the strategy and tactical practices these agencies have developed may not be applicable to the fire service nationwide. This article narrows the broad spectrum ideology of active-shooter response into a framework that can be applied to any department whether large or small, paid or volunteer.

Law enforcement will surround medical personnel and provide protection from every possible angle that a threat could present itself
(1) Law enforcement will surround medical personnel and provide protection from every possible angle that a threat could present itself. Medical and rescue personnel are relatively protected in this type of configuration. (Photos by Mike Legeros.)


Understanding who active shooters have been and the types of incidents their actions have created can be helpful in preparing a proper response. In the United States, most of the active-shooter incidents have involved a single shooter. The most famous exception is the active-shooter duo Eric Harris and Dylan Klebold, who, in 1999, shot 37 Columbine (CO) High School faculty members and students, killing 13 and wounding 24. This event led all emergency service agencies to realize that a similar type of incident could occur in their jurisdiction and to initiate a nationwide call to action for responders to preplan and be prepared for similar incidents in our public schools. Although it may be difficult, if not impossible, to find a school in the United States that does not have some type of active-shooter plan, the opposite could be said for other areas of public assembly in these communities, many of which have no active-shooter/mass-casualty plan.

Yet, the active shooter has targeted every occupancy type imaginable. The targets have included, in addition to schools, churches, restaurants, movie theaters, grocery stores, malls, parks, government facilities, manufacturing facilities, and office buildings. Prior to the Aurora, Colorado, theater shooting, many municipalities would not have considered their local movie theater as a potential active-shooter target.

The motivations for these attacks have been varied-political motivations, disgruntled employees, mental disability, social beliefs (such as pro-life/pro-choice), animal rights, and protection of the environment, to name some. No jurisdiction is immune to individuals who choose violence as their form of expression. The Cornell University Veterinary School, for example, has been a target of animal rights activists for years.

Considering all this, fire departments and agencies must evaluate any area/facility/event that employs, houses, or is patronized by significant numbers of people as a potential target for an active shooter. Look through your response district for locations that could have high appeal for such terrorists, establish a preplan for each location, and practice the plan with other agencies that will be part of a multicasualty response.

Historically, active shooters have taken their lives on the arrival of law enforcement, and there appears to be no previous incident in which a shooter has hidden to target responders later in the incident. However, this does not mean that these conditions will always apply. Consider, for instance, that the Columbine shooters engaged arriving law enforcement personnel and had planned to participate in an aggressive firefight with emergency responders on the scene.

Published references to these shooters as “cowards who kill themselves at the first sign of returned aggression,” however, may be enough for some of these individuals to take exception to the “coward” label and dispose them to direct their shots toward responders, instead of themselves, to set a precedence.

Law enforcement will proceed rapidly to neutralize any threats as a team
(2) Law enforcement will proceed rapidly to neutralize any threats as a team. This team’s strength in numbers will vary based on response times, resources, and training.


The first step in planning a response is to develop a preincident plan for every potential target facility in your jurisdiction and a response plan for public events that will draw a large number of people. This document will be vital in communicating an action plan and the means to systematically accomplish the established objectives. When developing the plan, consult with law enforcement and emergency medical services (EMS) personnel to ensure that no information that could be helpful to all agencies is overlooked. Included in the plan should be the following information:

  • detailed floor plans;
  • entry and egress points;
  • utility control locations;
  • occupant loads;
  • business operation times;
  • facility points of contact;
  • door and lock construction for interior and exterior doors (this will be discussed in more detail later);
  • window construction;
  • stairwell locations (if the facility has multiple floors, additional personnel will be needed to remove victims);
  • times of high occupancy/low occupancy;
  • floor plans with room numbers and operational areas;
  • if there is a mass-notification system;
  • the locations of the attic, crawl spaces, or other hidden area access points;
  • entry and egress points for emergency vehicles;
  • access areas for stretching handlines and connecting to fire department connections (FDCs); and
  • staging areas for law enforcement and EMS. During the Sandy Hook, Connecticut, shooting, access and egress of emergency vehicles quickly became a problem as multiple ambulances were staged along roadways.

Preplan public events such as parades, carnivals, concerts, festivals, and the like. The Boston Marathon bombing is a somber example of how aggressors will target events with large populations. The venue or the event itself may have little to do with the motive for the attack. It may simply serve as an opportunity. Response agencies should collaborate with event coordinators to ensure that, at a minimum, first aid and security personnel have been briefed on a mass-casualty plan for the event. Ideally, these personnel will have integrated communications and training in mass-casualty triage.

All agencies should review the plan before an incident occurs.

RESPONSE Use of Preincident Plan

Law enforcement personnel will use much of the information in the plan to formulate an incident action plan after the shooter has been neutralized. The main priority of law enforcement is to enter the threat area and rapidly proceed to the shooter’s location to engage and terminate the threat.

After this has been done, the police officers will use the information in the preincident plan to secure and clear the remainder of the facility. For example, they must determine how best to access doors and defeat lock mechanisms so they can check every room, closet, office, and the like to verify that the aggressor is not present.

Law enforcement is responsible for securing and clearing the emergency scene. A secured area has been swept in a crude and expedient manner to identify and neutralize immediate threats. After the sweep, the area is secured by establishing a parameter or posting law enforcement personnel at entry and egress points. This law enforcement presence will be strong visually and authoritative in nature. There will be little doubt that the area is under law enforcement control.

Law enforcement personnel are familiar with some forcible entry techniques, but sometimes fire department personnel may enter the scene with law enforcement members to assist. These firefighters must be trained to operate in such an environment and should be provided with ballistic vests at a minimum. They would have no means of self-defense. Each department must evaluate which approach is appropriate for it. Imagine that the fire department asked law enforcement personnel to assist with interior operations at a structure fire and the law enforcement officer would be provided with bunker gear but no self-contained breathing apparatus or hoseline. Not many law enforcement officers would agree to participate in such an operation. Use extreme caution when placing fire personnel in these areas. The decision to use fire personnel in law enforcement operations should be a well-thought-out and coordinated one devised in cooperation with law enforcement personnel in advance of the response.

Fire department leaders should help bridge the knowledge gap in forcible entry by conducting joint training on it. It would be safer to teach law enforcement personnel forcible entry techniques so that firefighters would not be exposed to potential danger. Once the active-shooter scene is no longer active, meaning no shots can be heard and no signs of aggression can be observed, it is reasonable for fire and EMS personnel to enter the building if the areas from which victim extractions are to be made have an extremely heavy law enforcement presence ready to neutralize any hidden threat.

Removing Victims and Unharmed Occupants

Most police officers will not assist with the evacuation of victims in areas where the shooter has come and gone. They will stand guard in the hallways or means of egress to protect patients and responders. Historically, active shooters will continue to inflict as much injury and death as possible until the threat of force is imminent or returned by law enforcement. There have been no instances of hidden or secret shooters lying in wait among the wounded to engage emergency responders to date. A heavy and alert law enforcement presence should be able to neutralize a threat immediately. All responding agencies must communicate and share information to help ensure success and that the operation is as safe as possible.

Use window construction, stairwell access, the elevator system, and mass-notification systems to help plan the removal of injured and noninjured occupants. It may be tactically sound to remove victims using ladders from upper floors. Being familiar with the window systems in the facility will help you make this decision. Can the window open? Is the window constructed of impact-resistant glass? Is the window blast resistant? These questions will affect your decisions during rescue operations. Furthermore, the window construction may be such that the shooter may not be able to easily engage responders. Ammunition does not easily penetrate laminated and multipane windows. This is not to say that such windows will repel bullets; the direction of the round cannot be predicted once it is fired through such types of glass. Conversely, law enforcement will not be able to engage the threat through such window systems.

Stairwells may be used to evacuate the injured and noninjured occupants. As in high-rise firefighting operations, identify a stairwell for responders to access the floors; use secondary stairwells for evacuation. In facilities with many stairwells, designate specific routes for the noninjured or walking wounded separate from an access stairwell for responders, or consider a rescue-assisted evacuation stairwell.

Reserve the elevators for the use of the severely wounded and those in need of immediate evacuation. It may be necessary to designate an individual to monitor and coordinate the use of facility elevators so that each trip down and back up best supports the entire operation. It is possible to carry litters and backboards up the responder stairwell, but an empty elevator ascending to retrieve victims is a better choice.

The Canned Response

The fire service frequently provides a “canned” response to structure fires, vehicle accidents, hazardous materials responses, technical rescue calls, and other daily responses that are allotted a predetermined number of personnel and apparatus. Law enforcement and EMS will respond accordingly with resources based on the size and complexity of the event. The fire service’s canned responses to these types of incidents have been determined through national recommendations, neighboring jurisdictions, trial and error, as well as preincident plans.

In your preincident plan, you can insert a canned response for facilities identified as high-target values for active-shooter incidents. Agencies can conduct experimental drills and exercises to gain valuable information on the resources needed to mitigate the incident. Consider the number of victims needing extraction, treatment, and transport as well as the facility’s size and complexity. To establish a baseline, conduct drills that require engine or ladder companies to extract victims from facilities. A company’s staffing level will affect the amount of resources needed. As an example, if a four-person engine company can extract four victims using backboards or litters from a facility in less than 30 minutes, it will take four engine companies to extract 15 victims from an active-shooter or a mass-casualty incident.

Additionally, the number of victims will determine how many ambulances will be needed. Agencies need to know the local EMS providers’ policies and procedures regarding multiple-patient transports: Does one patient equal one ambulance, or can ambulances transport multiple patients at a time? Consider also the number of supervisory responders needed. There must be adequate supervisory personnel at the scene to command and control the resources. The size and complexity of the facility are also factors. Responders will be able to access and extract victims from a single-story mall much faster than from a four-story mall with victims on each level. Conduct experimental drills on the most complex facilities to develop a worst-case scenario response matrix.

Once these data have been obtained, formulate the canned response following a National Incident Management System framework. A level 4 incident is one in which the number of victims may be handled with that jurisdiction’s equivalent of a first-alarm structural fire assignment. The initial ambulance response would consist of the number needed to transport the maximum number of patients from a level 4 incident. Local hospitals and trauma centers in a predetermined geographical area surrounding the incident location would be notified of the number of patients and their conditions.

As an example, a shooting occurred at a local fast-food restaurant, and law enforcement has neutralized the single shooter. The first-arriving fire or EMS unit advises dispatch that it is on scene and there are possibly seven to 10 victims. That first unit would advise dispatch of a level 4 active-shooter incident. Since the area has been preplanned, the closest hospitals and trauma centers are known. The number of fire apparatus needed to remove victims and assist in triage is also known. The number and capabilities of ground and air ambulance transport are known as well, which could be up to 10 units. Once the level 4 incident has been identified and announced, the preplanned response would be initiated.

Agencies may also train with law enforcement personnel, who can also declare the incident level as soon as it is known. A level 3 could be another full-alarm assignment added to the first alarm if your department has those resources and personnel, or a level 3 could involve mutual aid from neighboring jurisdictions. Level 2 and level 1 responses can be stepped up from that point based on mutual-aid response times and equipment with personnel that can be brought to the scene. It is not possible to lay out a full canned level scenario because each department is different in size and strength. The agencies should start with the foundation of the level 4 concept and grow the response accordingly with regard to available personnel, response times, and the complexity of the jurisdiction’s facilities.

Incident Management

In Fire Engineering‘s November 2013 digital supplement “Major Incident Response,”, I highlighted the task fire departments most commonly perform at emergency scenes-carrying bodies to the colored tarps. The fire service should not perform the function of the incident commander. Actually, the medical group of an incident command system (ICS) should manage fire department personnel and operations as long as there is no need for fire protection or hazardous materials functions. If the incident is a shooting that involves mass casualties, the fire department will be the workhorse that moves patients from various incident scene locations to patient triage and treatment areas.

The fact that the fire department is unmatched in its experience with incident management sometimes leads to conflict. Law enforcement and EMS personnel are commonly operating from single units at scenes that do not require multiple resources. That type of daily operation does not lend itself to acquiring an in-depth understanding and working knowledge of an ICS. In contrast, the fire department uses the ICS every day, primarily because of the multiple apparatus and personnel that need to be managed at an incident. It is easy to argue that even single-engine company responses use and practice ICS, so why can’t single EMS or law enforcement units do the same?

The issue becomes a matter of frequency. More often than not, fire departments will respond to working incidents with multiple units that need an ICS structure to maintain command and control of all the resources and assets on scene. EMS operations rarely need multiple units, and those incidents that do usually involve the fire department, which implements the ICS without prompting, and EMS roll into the established framework. The emergency phase of a law enforcement incident generally ends expeditiously more quickly than a fire emergency. A subject who runs on foot from a stolen car is, for the most part, caught rather quickly. Once the suspect is apprehended, the emergency phase of the incident is terminated. During the chase, officers will receive direction from the officer who initiated the contact with the suspect or from a ranking patrol officer, depending on the department’s policies and procedures.

To summarize, the daily response from EMS and law enforcement personnel is task oriented at the single-unit level, whereas the fire department response is based on a strategic mindset at the company level with a tactical assignment. Most law enforcement and EMS assignments are at the task level. It is not until a major nontypical incident involving multiple resources occurs that law enforcement and EMS will perform at the strategic and tactical levels. These incidents are not frequent in most municipalities. For law enforcement, they may include barricaded subjects, hostage situations, extensive large-area manhunts, incidents involving civil unrest, and special events such as dignitary protection details. This is not to say that law enforcement and EMS agencies cannot or do not implement ICS or implement it well. Major municipalities have agencies that are very skilled in performing the functions of the ICS. These agencies have adopted an attitude that instills the use and promotes the importance of an organized ICS structure.

Recently, officials in Connecticut released telephone and radio recordings from the Sandy Hook school shooting. You can glean some of the ICS shortfalls that occurred from the on-scene law enforcement personnel. Although the command, sector, group, and division positions were identified and assigned, they were not clearly explained using ICS principles. Police unit numbers and individual officer names were used to identify scene functions such as staging and who was in charge. This may seem to be a critical observation of a national tragedy, but it must be identified so that all may learn from what could have gone better. Telephone recordings show multiple dispatchers calling neighboring jurisdictions for ambulance support. Those who received the calls asked the critical question of how many resources were needed. The response was, “Send all that you can.” Dispatchers were fielding calls from personnel who were attempting to self-dispatch to the scene as well as calls from media outlets fishing for information. At one point, a state police dispatcher advised a department he was calling for assistance, “We [state police] have taken over the scene.” Law enforcement personnel were updating dispatchers by cell phone and vice versa. Reports on the Sandy Hook response explained that too many ambulances overwhelmed emergency responders and that no command and control of those resources seemed to be present. If law enforcement personnel had taken over the scene, were they requesting ambulances? Did medical personnel evaluate and triage the wounded to determine transport status and priority?

Fire departments have the ICS experience and proper attitude to assist law enforcement and EMS agencies in becoming more proficient in the use of ICS. The fire service should attempt to make partnerships that foster the exchange of ideas and concepts among other agencies. Relationships that result in arguments and end with fire and EMS personnel being arrested by the police over the issue of opening or closing the roadway need immediate reconciliation. How can agencies work together on a mass-casualty call if they cannot perform with one another on a car accident scene?


In September 2013, the Metro Chiefs endorsed a position paper during the Urban Fire Forum 1,2 that detailed the use of a Rescue Task Force (RTF) during active-shooter and mass-casualty terrorist incidents. It advocates Tactical Emergency Casualty Care (TECC) guidelines, which were derived from military combat-care procedures. The Hartford Consensus, a group of professionals and experts from the American College of Surgeons and the Federal Bureau of Investigation, met in Hartford, Connecticut, in April 20133 and in September 2013.4 The group examined active-shooter incidents and created procedures to increase victim survival.

At the first meeting, it was recommended that the THREAT (Threat suppression, Hemorrhage control, Rapid Extrication to safety, Assessment by medical providers, and Transport to definitive care and integrated response) protocol be followed. At the September meeting, the Hartford Consensus II announced a call to action. It highlighted the need for public education, law enforcement training in hemorrhage control, and integration of fire/EMS and law enforcement agencies.

Other provisions included the following:

  • The task force shall consist of two fire and EMS personnel accompanied by two armed law enforcement officers. It will enter areas that have victims with traumatic injuries but that have no active aggressor threat.
  • The objective of the RTF is to reach victims with uncontrolled hemorrhaging wounds quickly to stop the bleeding and increase the survivability profile.
  • The incident location will be sectioned into hot, warm, and cold zones. The zones are similar to those used in hazardous materials incidents. Hot zones are areas with an active threat, in which a perpetrator is attempting to wound or kill bystanders. Warm zones are areas in which an
  • aggressor has already conducted attacks and there are victims: The “shooter” has come and gone. Cold zones are areas where there is no threat of violence and there are no victims.
  • Fire and EMS personnel who form RTFs shall be provided with ballistic protection that includes vests and helmets.
  • Multiagency training among fire, EMS, and law enforcement agencies that will form these tasks forces is strongly recommended.

The formation of the RTF appears to be the responsibility of personnel from the fire service who already are engaged in rendering service in the areas of hazardous materials, technical rescue, and fire incident responsibilities. If your fire department does not provide advanced life support transport functions and the EMS response is a separate agency, then the RTF should consist of EMS and law enforcement personnel.

Again, the function of the fire department is to provide personnel and basic life support assistance to EMS and law enforcement. EMS personnel should assess, treat, and triage patients. Most EMT Basics cannot decompress a patient’s chest or use hemostatic agents; however, paramedics can. It does not make sense to train personnel from the fire department to perform these types of interventions when there are personnel on scene who are already trained. EMS personnel will assign treatment, triage, and transportation officers. It makes sense to assign as the triage officer someone who has already been in the facility and possesses firsthand knowledge of the scope and complexity of the incident. Similarly, as a structure fire escalates, command may designate one of the first-due company officers as operations because he is best suited with the knowledge already gained from being on scene to perform that function.

Unfortunately, in areas of the country where the concept of the RTF is valid and has great merit, many of the emergency services agencies cannot create RTFs with the resources available within their jurisdictions. Some law enforcement agencies only have four to six personnel on the road at any given time. These officers may be committed to prisoner transports, active calls such as domestic violence responses, shootings, or foot and vehicle chases that they cannot just break away from. It is not realistic for a department of that size to respond to an active-shooter incident and to provide two personnel to form a RTF.

In addition, some aggressors use the tactic of secondary scenes. In Columbine, Harris and Klebold set a fire bomb to go off in a field so that responders would be on the other side of town when the two began their attack. James Eagan Holmes set more than 30 homemade grenades and 10 gallons of gasoline to explode in his apartment prior to the theater shooting in Colorado. His neighbors reported loud music coming from his apartment and even attempted to knock on his door. It appears that the idea was to have a law enforcement officer or neighbors enter his apartment to investigate the loud music and create a secondary scene that would occupy first responders. Moreover, having neighboring jurisdictions respond may greatly affect response times, negating the team’s core concept of rapid access and initial treatment. Local law enforcement agencies must be equipped with the proper weapons to protect fire and EMS personnel. Using a handgun to protect a group is rarely effective. Officers need long guns such as patrol rifles or rifled shotguns to engage threats from a distance. An officer’s handgun is for self-defense, not group defense in a tactical environment. If local law enforcement cannot provide personnel with these weapons to form an RTF, then other avenues must be pursued.

As active-shooter incidents increase, the public is becoming more aware that they may have to take some action. The Hartford Consensus II suggested public education. I suggest taking that basic education further: Instruct bystanders in how to use hasty tourniquets during general active-shooter awareness training. This skill could prove vital in areas with limited emergency response resources.

If agencies cannot effectively reach the patient, then they must get dynamic to improve victim survivability. Training 911 operators as well as police and fire dispatchers to give TECC instructions over the phone could provide immediate hemorrhage control much more quickly than any RTF could deploy. During the Sandy Hook shooting, a dispatcher was on the phone with a teacher who had a gunshot victim in the room with her for more than 11 minutes. To the dispatcher’s credit, she attempted to give instructions for providing direct pressure to the victim’s wounds, but the caller was too emotional to accept the task.

Agencies that train dispatchers to provide instructions for TECC must train them to aggressively engage the caller. Noncompliance should prompt the dispatcher to ask for someone else in the room to provide the care or receive the instruction. Dispatchers can also provide instructions to control a sucking chest wound. In the military, it was once taught to use the victim’s military identification card. Similar in size to a credit card, the ID was laminated and served to seal a wound and provide identification as to who the victim was. It is an ingenious manner in which to create an occlusive dressing. These simple tactics can be relayed over the phone.

When considering how to execute the rapid extrication of the THREAT principles, consider this: Bystanders of a traumatic event can be vital in assisting emergency responders. Rather than have fire and EMS personnel enter the building in small teams, have the unwounded assist in evacuating the wounded. After law enforcement neutralizes the threat and begins to clear rooms, officers can stop and frisk bystanders who will assist and then direct them to carry the most severely wounded out to care providers. The bystanders are already in the environment and have little choice but to be there. Their emotions will be high and charged. Assigning bystanders to perform a task will focus that emotion in a positive direction. Officers will want to pat down or stop and frisk bystanders who will assist for weapons to ensure they are not aggressors. A single law enforcement officer may escort the bystanders to ensure egress to the proper casualty collection point. Tables can be used as litters or chairs with wheels can be used to extract the most seriously injured first. Law enforcement must be engaged, and training will have to be conducted extensively to accomplish this tactic. Law enforcement may need to identify those in serious need of medical attention over the walking wounded or less injured, which may require additional training. These alternatives are not suggested to replace emergency service agency integration. Fire and EMS personnel must strive to enter the facility as soon as possible. These suggestions are made to provide victims with life-saving interventions quickly with limited resources while providing for safety.




The role of emergency responders in active-shooter incidents is expanding and evolving rapidly. The fire service needs to evaluate how it can be used in these types of events. Small- and medium-size fire departments need not accept roles for which other agencies are better trained and more skilled simply because the departments have knowledge in an aspect of the operation or special knowledge of a tactic or tool. Agencies must evaluate the use of preincident plans and develop response procedures for all target hazard facilities in their response area with the same vigor that was used when preplanning a school shooting. Using a canned response may remove the confusion and indecisiveness of what and how many resources to dispatch as well as prevent an overload of too many resources. Every agency regardless of size or response footprint can prepare for these types of incidents, but they all cannot prepare using the same strategies and tactics.






STEVEN C. HAMILTON, a career lieutenant with the Fort Jackson Fire Department in Columbia, South Carolina, is a 17-year veteran of the fire service and a certified EMT-B, fire instructor II, and fire officer III. He is also a reserve deputy with the Richland County Sheriff’s Department.


More Fire Engineering Issue Articles
Fire Engineering Archives


No posts to display