As enterprise security executives, we are largely trained to focus our security plans toward a Design Basis Threat (DBT) – the most likely or credible threat(s) to a site, weighted by probability and impact of successful attack. Primarily this focus is aimed towards three common categories: Insiders, Outsiders and Outsiders with Connections to Insiders. Among these categories you may evaluate the intent of each group (vandalism, theft, sabotage, etc.), the skill level of each group (unskilled, semi-skilled, highly trained, etc.), and the methods used to achieve the intended goal (hand-tools, cutting tools, explosives, deception, etc.). What is often omitted or overlooked from these threat assessments is an Active Shooter/Violent Intruder/Active Threat.

Though often overlooked, active shooter events should be considered by every enterprise security executive. While hard to predict, the probability of active shooter is a real threat for every enterprise. The rate of occurrence of active shooter events has nearly tripled since 2000 and continues to rise. The common misconception is that active shooter incidents rarely happen outside of schools/campuses. However in an FBI report, A Study of Active Shooter Incidents in the United States between 2000 and 2013, the numbers paint a different picture. Commerce facilities were the targets of active shooter incidents in nearly half of the 160 cases studied. Educational facilities were targets 25 percent of the time, and government facilities were targets 10 percent of the time.

Analyzing the successful execution of an active shooter incident is fairly simple and supplies expected results. A New York Police Department report found that the perpetrators of these incidents had a relationship with their victims in more than three quarters of the cases; nearly 40 percent of those relationships were professional in nature. The FBI report found that, regardless of location, the perpetrators usually had knowledge of and a relationship with the area (current and former employees/students, familial or romantic relationships to employees/students, etc.). Because of their relationships to their targets, active shooters have high success rates. More specifically:

• They choose the time and place of the attack.
• They are usually familiar with the security protocols and procedures in place at their target location.
• No reliable active shooter profile has been developed, so it is often difficult to identify these individuals prior to their attack.
• Many facilities have insufficient or no active shooter response plans in place.
• Where plans are in place, employees are often not adequately trained to respond to an active shooter incident.

In an attempt to save lives, active shooter scenarios need to be considered in our Physical Protection System (PPS) designs. Often, you may find that common security “best practices” have not taken active shooter incidents into account. For this reason, special attention is needed by enterprise security consulting on PPS planning and facility design.

Flawed Designs

Because we often neglect to consider active shooters in our DBT, we also implement security controls that, in the event of an active shooter scenario, put our people at greater risk. We are so concerned with keeping intruders out that we neglect to realize the impact of these efforts when the attack comes from within. After all, we are all taught that our most valuable asset is our employees, yet we fall into the common trap of protecting our assets with a monetary value first. Below are several security design features that are found in a variety of facilities whose applications should be carefully considered.

Facility Hardening

In our never-ending attempts to keep the bad guys out, we often first look towards doors and windows. A common security practice is the application of ballistic or shatter-resistant window film or window bars/grills. While this goes a long way toward lengthening the penetration time of your facility’s exterior, it also negates that window as a viable escape option during emergencies such as fires and active shooter events. Analysis of Columbine, Virginia Tech and several other active shooter events demonstrates that evacuation through windows may be the only way out and saves lives.

We also limit access to our facility by limiting the amount of external doors on our facilities. Misapplication of this practice leads to one or two exterior doors. This again limits the evacuation options of your occupants. The proper application of this practice would be limited exterior doors with both the ingress and egress function. Several other doors should be egress-only emergency exits with no external hardware or hinges.

Access Control

Physical Access Control Systems (PACS) are a crucial part of any security design. However, there are several weak points that must be considered for an active shooter scenario. Your PACS system is only as good as the people involved in its operation. Does your receptionist blindly buzz people into your facility without requesting identification? Have you consulted local police to determine if your site presents special challenges? How will police enter your site after normal business hours? How will they move through your PACS-controlled facility? Do you rely on a human operator to lock and unlock doors for responding officers? If so, will they be reliable to do so under the stress and panic of an active shooter situation? Should you be expecting a person to remain in the facility for this purpose during an active shooter event? Your local police department as well as local FBI Office can assist in active shooter preparation and response planning.

Architectural and Aesthetic Plans

Security should always be consulted and involved in the design of a new facility or the renovation of an existing site. New and modern designs often do not consider active shooter scenarios and the risks it may create. When utilizing ALICE Training or following Department of Homeland Security recommendations and “Run, Hide, Fight” response options to active shooters, where can your employee’s lockdown and barricade themselves if all of the walls in the facility are made from tempered glass?

Do you have half-wall cubicles in your facility? When in an active shooter scenario, these provide little help in keeping your employees safe. On the other hand, typical five- or six-foot cubicle walls provide your employees with chokepoints where they can barricade and delay the active shooter’s ability to engage them, giving them enough time to prepare to defend themselves.

Another common architectural design that is often supported by security is the installation of several small (less than man sized) windows in places of one larger window. These are effective in preventing unauthorized entry into the facility while still allowing natural light, but make emergency evacuation impossible.

Security without Thought

There are several products and practices that have been deployed to stop active threats. In one case, a school district was installing biometric lockboxes in their schools to hold firearms. Certain teachers were given authorization to access the boxes and “approved” by school administrators to use the firearms in the case of an active shooter. The teachers had no training or qualification requirements with the firearms, and the administration refused to inform the local police of the “authorized” personnel. You can imagine how that is going to end up when police do respond to a report of an active shooting. 

Another implementation came from a facility that likely had no true security professionals designing their PPS. In place was a PACS system that, in the case of an active shooter, could lock all interior rooms of the facility. That alone demonstrates limited knowledge about how location affects response, but to make things even worse, the facility had massive pepper spray foggers installed, hidden above the ceiling, that would deploy the agent in the hallways. One can almost understand the thinking… these were supposed to be secret so the perpetrator could not plan for them. Unfortunately, while pepper spray may affect a shooter’s aim, it does very little to affect his ability to point a gun and pull a trigger and fails to account for how the shooter somehow ended up being in the hallway alone. The plan also does not account for the fact that responding officers will be delayed entering the building as they don their gas masks (assuming all responding officers will be equipped), fails to account for the reaction of civilians who may have been trapped in the building and are exposed, and shows an assumption of extensive training by road patrol officers to enter, move, shoot accurately and work effectively in a contaminated environment. An even more importantly, how do you evacuate the facility when the entire hallway system has been contaminated?

There are a number of systems on the market being touted as being able to stop an active shooter. Primarily these involve some type of secondary lock or barricade that attaches to a door. The common thought among active threat experts and Fire Safety Marshals is that a good majority of these devices violated fire code and safety codes. Most fire codes and life safety codes prohibit installing secondary locking devices onto a door or door frame. Many of these devices also require fine motor skills to install, which almost always diminish under stress. Beware of devices that are looking to capitalize on society’s heightened awareness of these incidents. Devices sold as after-market products and not sold, manufactured and installed as part of the door should immediately be suspect.

Striking a Balance

A Design Basis Threat is developed after a long process of analysis, assessments and research. This is certainly valuable information that should not be thrown by the wayside and replaced with an active shooter DBT. However, it is very likely that, because Active Shooter events are so hard to predict and analyze, they will not rise to the level of a DBT for an individual facility. So how do we account for active shooter threats when many of our common security practices are counter-intuitive to an active shooter scenario?

Understand the Costs

Loss of life is never acceptable, and as security professionals we must do everything we can to prevent it. Insignificant when compared to the loss of life, active shooter events also have a hefty price tag. When accounting for the negative publicity, impact to your business’s reputation, providing counseling and other assistance to survivors, diminished business production following the event, legal fees and the myriad other repercussions of an active shooter event, the financial price tag can be astronomical.

Weigh the Risk

Depending on your DBT, you can weigh the effectiveness of a particular security device or implementation against its hindrance during an active shooter scenario. This should be done at both a macro and micro level. How a device or implementation affects the overall facility in these matters may not be the same as how it affects the room in which it is located. For example, putting shatter-resistant film on five specific windows in your facility may not appear to effect emergency egress greatly. However, if one of those windows is the only exterior window within the room it is located; you have essentially created a kill-box for an active shooter. Again, what may keep a threat out, may be the same thing that traps your people in during an emergency.

Consider your Options

There are several ways to achieve the “Detection” and “Delay” function within your PPS. Using concentric layers of security, you can use your inner layers and compensating controls when an ideal security control conflicts with active shooter considerations, much like you would where life safety codes preclude use of desired security devices. Some states are already altering their building codes or establishing recommended best practices that incorporate active shooter response.

Have a Plan and Train

A common saying among the military and law enforcement community is: “We do not rise to the level of our expectations. We fall to the level of our training.” This is equally true for civilians during a crisis event. Most civilians, if they’ve received any training at all, have received training for an archaic lockdown system that equates to hiding in the dark and hoping the bad guy does not find you. This simply does not work.

It is an unfortunate reality, but active shooter events have been, are, and will continue to be a part of American society. Many countries have to live with and plan for IEDs and suicide bombings; likewise, we must begin to plan for active shooter events. Not only must we plan for them, but we must dedicate the same amount of time and resources to training as we do for fire drills and emergency evacuations. Active shooter event frequency continues to rise, and there is no indication that will change. Whether you subscribe to the ALICE Training approach or the “Run, Hide, Fight” recommendations, you should have a response plan in place.

While threat assessments may be effective to detect or delay such an incident from occurring, training your people how to respond may be the most important step you can take to minimize casualties. While most of these incidents end by the attacker’s choice (suicide, fleeing the scene, etc.), citizens put a stop to active shooter events nearly as often as law enforcement. That is why active shooter response training is a necessary part of emergency preparedness training.