MAKE IT HARD TO HURT YOU (MIHTHY)

Summaries to inform and educate on numerous topics to aid in awareness of risk (consequence, threats, vulnerabilities), planning, response, and preventative measures.

In the works – The importance and method of a Risk Assessment; Spheres and Circle of Defense; Why Islamists want to kill us.

SECURITY IN DEPTH SID, LLC is a Veteran Owned Business that offers service to Faith Based/Churches, Schools, Malls, and to Special Event Venues to build a safer, more secure, and more resilient entity by enhancing protection of the CI/KR sites to prevent, deter, neutralize, or mitigate the effects of deliberate efforts by criminals to destroy, incapacitate, or exploit them; and to strengthen preparedness, timely response, and rapid recovery in the event of an attack, natural disaster, or other emergency. Implementing protection requires partnerships, coordination, and collaboration among all individuals and groups at a location or event.  All partners should establish protection programs to determine eligibility for certain Federal grant programs. For example, there annual grants such as the Nonprofit Security Grant Program that many faith based organizations apply for each year. SID, LLC can assist organizations is the procedure to apply for, accept, and/or utilize grant funds. The cornerstone grant application is its risk assessment that establishes the processes for com­bining consequence, vulnerability, and threat/hazard information to produce a comprehensive, systematic, and rational assess­ment of risk.  The risk management plan should include: Set security goals; Identify assets, systems, networks, and functions; Assess risks of attacks or other hazards and known vulnerabilities to various potential attack vectors, and general or specific threat information.  Various methodologies are available to facilitate risk assess­ment.  The common definition and process for analysis of the basic fac­tors of risk for protection and is assessed as a function of consequence, vulnerability, and threat. Consequence: The negative effects on health and safety, the budget, membership confidence in institutions, and the functioning of a business, both direct and indirect, that can be expected if an asset, system, or network is dam­aged, destroyed, or disrupted by an attack, natural disaster, or other incident Vulnerability: The likelihood that a characteristic of, or flaw in, an asset, system, or network’s design, location, security posture, process, or operation renders it suscep­tible to destruction, incapacitation, or exploitation by terrorist or other intentional acts, mechanical failures, and natural hazards. Threat: The likelihood that a particular asset, system, or network will suffer an attack or an incident. In the context of risk from terrorist attack, the estimate of this is based on the analysis of the intent and the capability of an adversary; in the context of natural disaster or accident, the likelihood is based on the probability of occurrence. Risk assessments for site protection consider all three components of risk and are conducted on an asset, system, network, or function basis, depending on the fundamental characteristics of the infrastructure.  Once the three components of risk—consequence, vulner­ability, and threat—have been assessed they are factored numerically and combined mathematically to give an estimate of the expected loss considering the likelihood of an attack or other incident. Consequence Analysis – The potential consequences of any incident, including ter­rorist attacks and natural or manmade disasters, is the first factor to be considered in risk assessment and is measured as the range of loss or damage that can be expected. The criteria can be divided into four main categories: Effect on human life and physical well-being (e.g., fatalities, injuries); Direct and indirect effects on the economy (e.g., cost to rebuild asset, cost to respond to and recover from attack, downstream costs resulting from disruption of product or service, long-term costs due to environmental damage); Effect on confidence in the entity; and Impact on the ability to maintain order, deliver minimum essen­tial public services, ensure public health and safety, and carry out national security-related missions. Normally, assessments should focus on the two most fun­damental impacts: the human and the most relevant direct economic impact.  Vulnerability Assessment – Vulnerabilities are the characteristics of an asset, system, or network’s design, location, security posture, process, or operation that render it susceptible to destruction, incapacita­tion, or exploitation by mechanical failures, natural hazards, terrorist attacks, or other malicious acts. They identify areas of weakness that could result in consequences of concern, taking into account intrinsic structural weaknesses, protective measures, resiliency, and redundancies. The vulnerability assessment process typically consists of identifying and grouping vulnerabilities using common threat scenarios and the dependencies and interdependencies along with analyzing existing protective programs and gaps to determine unresolved vulner­abilities. Threat Analysis – The remaining factor to be considered in the risk assessment process is the analysis of threat. In the context of terrorist risk assessment, the threat component of the analy­sis is calculated based on the likelihood of an attack or hazard event. It also examines the intent and capability of a defined adversary, such as a criminal or terrorist group and past hazard occurrences.  It must be remembered that “threat” is an estimated value that approximates the likelihood that a specific asset, system, network, sector, or region will suffer an attack or an incident. This differs from “threat scenarios,” or “threat analysis,” which are generalized descriptions of potential methods of attack that are used to help inform consequence and vulnerability assessments.

In 2013, an information paper on active shooter security for the thousands schools and millions of students was presented by this author.  Since then, much has been written and training done that focuses on the risk of an active shooter in a school to both educate and inspire officials to make it hard to hurt our school employees and students: According to the Washington Post there have been 416 school shootings since 1999 which may indicate that the training has honorably mitigated risks’ vulnerabilities and consequences but, except for a few systems, has focused on response to an incident which has proved lacking in prevention.

There are currently thousands of schools with millions of students and faculty in the Pre-K – 12 grades in the U.S.  Since 2015, school shooting incidents in the U.S. have skyrocketed compared to previous decades.  So far in 2024, there have been 144 shooting incidents at K-12 schools, resulting in 107 injuries and fatalities.  Most active shooter incidents since 1999 have happened in high schools – 61.8 percent to date, to be exact.  According to the K-12 School Shooting Database, a publication of the Naval Postgraduate School’s Center for Homeland Defense and Security (CHDS), a total of 118 active shooter incidents have been reported at K-12 schools in the U.S. since 1999.  These shootings are defined by the CHDS as situations where the perpetrator killed or wounded targeted or random victims within the school campus during a continuous episode of violence. But there’s an inherent weakness to how we look at the data about school shootings.  If we focus solely on major school shootings by year or on a list of school massacres with higher numbers of deaths, we miss the bigger picture. That means missing the thwarted attempts, the one-off murders, and the high frequency of smaller events between the massacres with increasingly higher death counts.  We miss situations like the school attack in East Greenbush, New York, which only resulted in one injury but had the potential to kill many more if it wasn’t thwarted. The recent wave of active shooter attacks in schools illustrates the importance of focusing on prevention efforts while continuing procedures, systems, and training designed to mitigate the risks (consequences, vulnerabilities, and threats) from active shooters.  95% of American public schools drill students on lockdown procedures but in most all incidents the attack may have already begun therefore there is almost no research affirming the value of these drills for preventing school shootings or protecting the entire school community when shootings do occur.  To accomplish our goal of protecting all we must adopt a safety and security strategy within each community that establishes a secure perimeter around each school with both physical obstacles and operational strategies and tactics while also involving strong cooperation with law enforcement.  Introduction of school resource officers/safety personnel to all students and faculty to encourage suspicious activity reporting.  Examples are discussed in the Annexes.  Strong and positive relationships between the community and police are essential to safety and security. Such relationships allow law enforcement better and quicker responses to calls for assistance and emergencies involving information sharing, best practices, mutual understanding and cooperation that leads to a stronger, more secure and resilient community.  

The first step is to do a Risk Assessment that leads to a plan and training that provides the key to have schools mitigate vulnerabilities to prevent an incident from occurring but, if an incident occurs, be prepared to have quick decisive action to end the threat.  While the main effort is to prevent an attack on a school by deterring, interrupting, repelling, or defeating a planned or an actual attack, any mitigation of risks does not imply that any loss of life as a consequence is acceptable.  The intent of this information is to aid in the effort to intensify support efforts to prevent such attacks.  We all “do what we know” and all stakeholders should be part of developing solutions not just providing input to the process.  Although there is no “profile” of an active shooter, there are consistencies in previous attacks that would classify as suspicious activity, and it is highly encouraged to report and share this type of information.  It is important for all of us to be proactive and place the main effort at keeping all threats from entering the school.  While law enforcement does very well with groups and individuals that have been officially deemed a threat, lone offenders are extremely troublesome.  It is widely accepted that the only thing that will stop a bad guy with a gun is a good guy with a gun, but school security efforts must not bog down due to debates on whether or not to have armed school security.  Strategies for school security should all contain similar characteristics of the defense that constitute planning fundamentals for securing an area or a facility.  To ensure the success of the security, school security officers, administrators, teachers, students, and other stakeholders must understand the characteristics of security defense during all phases.  These fundamentals are Planning; Preparation; Tactical Defense; and Reorganization and Reunification.  Whatever the strategy, plans and training must support the essential mission objectives.  We must remain vigilant, encourage others, and share information.  You should “make it hard to hurt you.”

The annexes below are an important part to the understanding of security fundamentals, awareness, planning, preparation, and the prevention effort.     

Annex A: SOURCES

Annex B: SECURITY BASICS

Annex C: DISPLACEMENT OF VULNERABILITIES

Annex D: DETERMINE THE RISK

Annex E: PLANNING – PREPARATION – TACTICAL SEQUENCE OF THE DEFENSE

Analysis of historical data shows that almost one third of all active shooter cases occur in a school.  Almost 50% occur at school classes, events, and dismissal with most in morning classes and in the parking lots.  Many are the result of an escalation of a dispute which may not have begun at the school.  Also, the commonalities in previous events (not 100% but most common) are:

• Single actor at location with large number of people
• Ideological motivation with underlying mental illness fueled by rhetoric from violent extremists.
• No previous arrests
• Action triggered by loss of relationship, job, living arrangement, etc.
• Location surveillance done or well known by perpetrator
• Attired with disguise and inappropriate clothing

Using this information schools should:

• Conduct risk assessments as a first step. (See Annex D for discussion of Risk determination.)
• Establish security and protocols at avenues of approach and limit entrances; exits must be available for escape from all types of incidents.
• Prioritize, develop and implement reasonable strategies to address and mitigate risks, and prevent attacks.
• Establish Plans, Policies, Procedures, & Education.
• Train stakeholders and exercise plans.

Risk Assessment benefits are:

• Improve communication and decision making.
• Increase security awareness. 
• Build collaborative and partnership opportunities. 
• Reduce liability and associated costs.

After Risk Assessments priorities for strategies are developed to establish plans, policies, procedures, & education with educating School Stakeholders.   Risk Assessments can:

• Establish security and safety baselines.
• Develop appropriate control measures.
• Promote organization-wide awareness.
• Encourage ownership.
• Promote effective resource management.
• Produce Proactive Planning – Thinking ahead.

Plans should include realistic response capacity with the knowledge that the true first responders are teachers and school administrators even if there is Campus public safety/local police already present.   Plans should also have an All-Hazards Emergency Management (Concept of Operations) and should build relationships as the critical first step BEFORE a school-based emergency occurs!   All schools should share the safety plan, invite local and state officials to participate in planning meetings, drills and exercises, and invite parent representatives and the media to observe drills and exercises.  Many entities have developed mitigation recommendations based on analysis of past active shooter attacks and review of previous studies. These risk mitigation recommendations are usually tailored to engineering security or building security personnel. 

Avoiding a reduction in the effectiveness of security also involves prohibiting the detection or deception of security plans, positions, and intentions.  Security enhancement must use both active and passive measures.  Active measures include armed security; use of manned surveillance cameras and patrols; establishment of specific levels of alert within the school; and establishment of times when security should be at the highest level.  Passive measures include hiding or camouflaging security cameras; movement control; adequate communications; and door sensors.  The Standard Response Protocol (SRP) is a term used to identify elements of school security but does not consistently include security fundamentals.  Measures include planning and preparedness, personnel, access control, barriers or obstacles, communication and notification, monitoring, surveillance, inspection, cyber security, and incident response.  In addition, indicators of suspicious activities and persons are presented as examples for awareness training. 

Strategic, tactical, and operational planning and preparation is critical to prevention.  Previous incidents, intelligence and information efforts, and strategic and tactical suggestions have created the need to address the 3 Spheres of Prevention.  The 3 Spheres have of Physical Security Systems, i.e., Campus Perimeter – fence or other boundary, video surveillance, lighting; Building Perimeter – access control, video surveillance, lighting; Interior – intrusion alarms, panic/duress alarms, video surveillance; and Cyber issues.  However, other incidents utilizing elevated positions of shooters and both IED/VBIED bombings indicate that an the Spheres extends beyond the immediate perimeter to what is considered to be visible locations within the maximum effective range of possible weapons or explosives, hidden avenues of approach above and below the surface, and includes security displacement areas.  See Annex B for SECURITY BASICS information and Annex C for discussion of DISPLACEMENT OF VULNERABILITIES.

The vexing question remains on how best to prevent targeted violence toward schools.  To date, most efforts have focused on enhancing physical security measures, but it is an old axiom – if you harden an area so that no adversary can possibly get in; you can’t get out.  Although engineering efforts can enhance defensive measures, for the uninformed it can also provide a false sense of security.  A critical, but often neglected, component of efforts to prevent planned attacks is the development of a protective intelligence capacity to identify threats.  Evidence of a threat is far more likely to be identified by students and employees who report it than by law enforcement alone.  It is well documented that the key to early detection and prevention is the gathering, processing, reporting, analyzing, and sharing of suspicious activities.  Complacency is the biggest threat.  No matter how insignificant a suspicious activity may appear; it is our duty to maintain vigilance and encourage the public to report all instances of suspicious activity.

Although there is no “profile” of an active shooter there are some consistencies in all previous attacks that would classify as suspicious activity.  Most Commonality in previous events (not 100% but most common):

• Single actor at location with large number of people
• Ideological motivation with underlying mental illness fueled by rhetoric from violent extremists.
• No previous arrests.
• Action triggered by loss of relationship, job, living arrangement, etc.
• Location surveillance done or well known by perpetrator.
• Attired with disguise and inappropriate clothing.

It is emphasized that an All-Hazards Emergency Management Concept of Operations be used to build relationships as the critical first step BEFORE a school emergency occurs and sharing with all stakeholders by allowing participation in planning meetings, risk assessments, and drills and exercises:

• Conduct risk assessments.
• Prioritize, develop and implement reasonable strategies to address and mitigate risks.
• Establish Plans, Policies, Procedures, & Education.
• Train stakeholders and exercise plans.

ANALYSIS

When examining all active shooter incidents, not just schools, some common characteristics among the shooters that researchers have found are a large degree of variation among attacks across some broad categories, including: sex of the attacker, age of the attacker, number of attackers, planning tactics, targets, number of casualties, location of the attack, weapons used, and attack resolution.  The analysis demonstrates that active shooters are an overwhelmingly male group with a median age of active shooters in the data set is 35 and that 98% of active shooter incidents in the active shooter data set were carried out by a single attacker.  This median, however, conceals a more complicated, yet unsurprising distribution.  The distribution of ages is bimodal, with a first peak for shootings at schools by 15–19-year-olds, and a second peak in non-school facilities by 35-44 year-olds.  Also, it is shown that a broad range of tactical sophistication exists in the planning stage of active shooter attacks.  Some active shooters do little to no planning and attack impulsively making extremely difficult to interrupt prior to attack, while others do extensive planning, including pre-operational surveillance.  A few active shooters even set up pre-planned defenses intended to trap victims and prolong their attacks, such as chaining doors and blocking entrances.  Some attackers appear to have learned from previous active shooter incidents.  As a force multiplier an estimated 4.6 million American children live in a home where at least one gun is kept loaded and unlocked and nearly half of all parents with a weapon in the home wrongly believe their children don’t know where a gun is stored.  It is said that secure storage of firearms prevents tragedies but also curiosity of small children can be minimized with education from the parents.  In the most recent incident in Georgia a panic button system that authorities say was implemented just one week ago saved lives during the shooting and “100% saved lives.”  However, as previously mentioned, lives were lost as the incident was not prevented, only mitigated consequences.  Investigations continue so we can learn but it is extremely important to stop repetition of mistakes.

SUSPICIOUS ACTIVITY REPORTS (SAR)

Suspicious activity reporting (SAR) information underscores the role of everyone in alerting officials or law enforcement of potential threat activity to put us as far “left of the boom” as possible.  Success in detection and prevention/mitigation of present-day threats depend on reporting suspicious activity, as well as training, networking, and collaboration within the agencies that investigate suspicious activity reports and recognizing signs of threats during the course of routine criminal investigations.  In 4 out of 5 school shootings, at least one other person had knowledge of the attacker’s plan but failed to report it.  In a comprehensive school shooting study, the Secret Service and Department of Education found that 93% of school shooters planned the attack in advance.   Almost all mass school shooters shared threatening or concerning messages or images.  More than 75% raised concern from others prior to the attacks as bystanders saw warning signs in most documented active shooter cases.  Truly, we can prevent school shootings when we know the signs and see them and get help.  It is important to remember to focus on an individual’s behavior, not the individual.  Secret Service and FBI findings include:

• School violence is not an epidemic.

·    All school shooters are not alike and there is no accurate profile of the violent offender.

·    School shooters often have social difficulties, but they are not always loners.

·    Although a common factor, revenge is not the exclusive motivation for school shootings.

·    Most attackers had previously used guns and had access to them, but this is not the most significant risk factor.

·    Unusual or aberrant behaviors or interests are not the hallmark of a student destined to become violent.

·   Incidents of targeted violence at school are rarely impulsive.

·   Prior to most incidents, the attacker told someone about his/her idea or plans.

·   Most shooting incidents were not resolved by law enforcement.

·   In many cases, other students were involved in some capacity.

·   In a number of cases, bullying played a key role in and could have been a predictor of the attack.

·   Prior to the incident, most attackers engaged in behavior that caused concern.

Although studies have found that there is no accurate profile of a school shooter in almost all cases school shooters exhibited some behavior prior to the shooting incident that caused concern or indicated a need for help.  In most cases, the shooter told a sibling, friend, or schoolmate about the plan to attack the school.  However, some of these reports were not communicated to proper authorities (school administrators or law enforcement) prior to the incident occurring since, lacking in an established open communication atmosphere between students and officials, students are many times reluctant to get their friends in trouble.  One strategy that may help is the individual threat assessment approach that, initially, does not put an investigation in the official realm.  This approach is a set of operational activities driven by an investigative process and focused on strategies for gathering and corroborating information from multiple sources to examine patterns of behavior that may reflect whether a given subject is on a pathway toward a violent act.  These activities are designed to identify, assess, and manage individuals who pose a risk of violence to an identified, or identifiable, target.  There are three guiding principles that underlie the individual threat assessment approach.  The first principle is that the end result of targeted violence is an understandable and often discernible process of thinking and behavior; the second principle is that it is important to distinguish between making a threat (expressing to the target or to others an intent to harm the target) and posing a threat (engaging in behaviors that initiate or further a plan to harm the target); and the third principle is that risk for violence as a result of an individual threat is the product of an interaction between the potential attacker, his or her current situation, the target, and the setting.

Indicators of Possible Suspicious Activity

Security and law enforcement personnel at schools should be alert to potential indicators of terror activity that can be shown in school shooters as well.   Although many behaviors may be innocuous by themselves, the observation of multiple indicators may represent possible suspicious activity.  Examples are:

• Avoiding questions typically asked of school officials, showing unusual interest in school security, attempting access to restricted areas, and evading school staff.
• Not providing professional or personal details when visiting schools such as place of employment, contact information, or place of residence.
• Access or attempted access to areas of the school normally restricted to staff.
• Multiple visitors or deliveries to one individual or room.
• Unusual interest in school access, including main and alternate entrances, emergency exits, and surrounding routes.
• Use of entrances and exits that avoid the main office areas with cameras and school personnel.
• Attempts to access restricted parking areas with a vehicle or leaving unattended vehicles near the school building.
• Unusual interest in school staff operating procedures, shift changes, closed-circuit TV systems, fire alarms, and security systems.
• Noncompliance with school policies.

Awareness Training

Awareness trainingcan increase the likelihood that suspicious activities are reported.  Training may also assist in that shooting incidents in the community, or seen on the news, leave some individuals feeling vulnerable and wondering how to respond should they find themselves in a similar situation.  Research has shown that many of these situations are over in minutes and law enforcement may not arrive in time.  As a result, employees must become stakeholders in their own safety and security and develop a survival mind-set comprised of awareness, preparation, and rehearsal.  Vigorous prevention programs, timely intervention, and appropriate responses by organizations and their employees will contribute significantly to a safe and secure work environment.

SUMMARY

It is a mathematical probability that an active shooting incident in a school will occur again.  Strategies and tactical suggestions for school security are shown containing all similar characteristics of defense that constitute planning fundamentals for securing an area or a facility.  To ensure the success of the security, school security officers, administrators, teachers, students, and other stakeholders must understand the characteristics of security defense during all phases.  These fundamentals are:

• Planning
• Preparation
• Tactical Sequence of the Defense
• Reorganization and Reunification

Risk assessments with analysis of consequence, vulnerability, and threat should be the first priority.  The real first responders at a school shooting are teachers and administrators and this illustrates the importance of procedures, systems, and training designed to prevent any attack by mitigating the risks from active shooters.  Note that the mitigation of risks implies that deterrence, mitigation, and prevention are the goals and that any loss of life as a consequence is unacceptable. 

While it is usually true that “the only thing that can stop a bad guy with a gun is a good guy with a gun”, school security planning should not be mired down with debates about on-site armed security.  If armed security is to be used, planning and training the specifics to personnel is of utmost importance; if not used all efforts should be aimed at early warning, securing the area, and use of obstacles to delay attackers long enough for law enforcement to respond.  The mission is to prevent an attack on a school by deterring, interrupting, repelling, or defeating a plan or an actual attack and thereby protecting the students and employees of the school.  

Historically, a majority of thwarted terror attacks have been the result on someone reporting something suspicious and can also be important if a school attack is being planned.  An important aspect of prevention is to involve the public in a Suspicious Activity Reporting system.  

BUREN R. (Ric) MOORE, SGM-R

Security In Depth (SID), LLC

Cell:  225.936.0404

buren.moore@la.gov

ANNEX A: SOURCES

• https://www.security.org/blog/a-timeline-of-school-shootings-since-columbine/
• https://www.sandyhookpromise.org/blog/gun-violence/facts-about-gun-violence-and-school-shootings/
• https://www.cnn.com/us/live-news/apalachee-school-shooting-georgia-09-05-24/index.html
• SECURE COMMUNITY NETWORK: https://www.securecommunitynetwork.org/resources  
• https://everytownresearch.org/school-shootings/#2905
• https://thinkprogress.org/school-shootings-2018-e139b247474e/

• DHS, National Infrastructure Protection Plan, 2009, Chapter 3,  http://www.dhs.gov/xlibrary/assets/NIPP_Plan.pdf . 
• 2012 Edition of the New York City Police Department’s (“NYPD”) Active Shooter: Recommendations and Analysis for Risk Mitigation prepared by the Counterterrorism Bureau of the New York City Police Department (NYPD). 
• United States Secret Service, http://www.secretservice.gov/ntac_aapss.shtml .
• DHS, National Infrastructure Protection Plan, 2009, Chapter 3,  http://www.dhs.gov/xlibrary/assets/NIPP_Plan.pdf .
• MHA SCN Webinar on School Security Presentation Transcript; School Security Briefing Secure Community Network January 3, 2013; http://www.slideshare.net/margolishealy/mha-scn-webinar-on-school-security . 
• The Standard Response Protocol, http://iluvuguys.org/srp.html, http://iluvuguys.org/srm.html.  
• FM-8 chap 8 Defensive Operations, Section I – Characteristics of the Defense; http://www.infantrydrills.com/  

• School Shootings, the “Copycat Effect”, and the Media; Michael Chesbro; December 16, 2012
• Booth, Brandi, Van Hasselt, Vincent B. & Vecchi, Gregory M. (2011). Addressing School Violence. FBI Law Enforcement Bulletin. Vol. 80, Number 5, May 2011.
• http://www.fbi.gov/stats-services/publications/law-enforcement-bulletin/2011pdfs/may- 2011-leb
• National Association of School Psychologists (NASP). (2002). Threat Assessment: Predicting and Preventing School Violence. http://www.nasponline.org/resources/factsheets/threatassess_fs.aspx
• O’Toole, Mary E. (2001). The School Shooter: A Threat Assessment Perspective. National Center for the Analysis of Violent Crime (NCAVC). http://www.fbi.gov/statsservices/publications/school-shooter
• Romano, Stephen J., Levi-Minzi, Micol E., Rugala, Eugene A. & Van Hasselt, Vincent. (2011).
• Workplace Violence Prevention Readiness and Response. FBI Law Enforcement Bulletin. Vol. 80, Number 1, January 2011. http://www.fbi.gov/stats-services/publications/lawenforcement-bulletin/january2011/january-2011-leb.pdf
• Schuster, Beth. (2009). Preventing, Preparing for Critical Incidents in Schools. National Institute of Justice Journal, No. 262, March 2009. http://www.nij.gov/journals/262/criticalincidents-in-schools.htm
• WA Military Department, Emergency Management Division. Threat Assessment for Schools. http://www.emd.wa.gov/preparedness/documents/Schools_Threat_Assessment.doc
• DHS Office of Intelligence and Analysis NOTE, (U/FOUO) “Terrorist Tactics against Baghdad Hotels Similar to those Used in Pakistan”, 6 April 2010.

• US Army FM 7-8, Chapter 5, Section 1-8c-e Defense and Section 1-9c Security; http://www.globalsecurity.org/military/library/policy/army/fm/7-8/ch1.htm#s2p8.
• FBI, Counterterrorism Division, Intelligence Bulletin, (U/FOUO) “Evading Detection Tactics Revealed in Terrorist Travel Guide”, 5 April 2010.
• DHS Office of Intelligence and Analysis, (U/FOUO) “Threat Assessment: Hotels”, 13 September 2010.
• Congressional Research Service, “American Jihadist Terrorism: Combating a Complex Threat”, Jerome P. Bjelopera and Mark A. Randol, 20 September 2010.
• DHS, National Infrastructure Protection Plan, 2009, Chapter 3, http://www.dhs.gov/xlibrary/assets/NIPP_Plan.pdf . 

ANNEX B: SECURITY BASICS

Prevent/Deter/ Mitigate

The recent wave of active shooter attacks illustrates the importance of procedures, systems, and training designed to mitigate the risks from active shooters.  Many entities have developed mitigation recommendations based on analysis of past active shooter attacks and review of previous studies.  These risk mitigation recommendations are usually tailored to engineering security or building security personnel.  Active shooter attacks are dynamic incidents that vary greatly from one attack to another and therefore a single set of best practices for response to such incidents is not useful.

A critical ingredient in the safe school recipe is the uniform classroom response to an incident at school.   Wildland or structural fires, hazardous materials, floods, tornados, blizzards, power outages, tsunamis, bomb threats, acts of violence, acts of terror, and other threats to student safety are scenarios that are planned and trained for by school and district administration and staff.  Historically, schools have taken this scenario-based approach to respond to hazards and threats.  It’s not uncommon to find a stapled sheaf of papers or even a tabbed binder in a teacher’s desk that describes a variety of things that might happen and the specific response to each event.  However, it should be understood that in a school environment the dynamics of an active shooter event contains various scenarios that present significant planning and training issues for educators, administrators, security officials, and all other responders.  Even the type of police response to an active shooter attack depends on the unique circumstances of the incident.  In the event of such an attack, school officials and security personnel should always follow the plans as well as any instructions of the first-responders.  All plans should include a list of recommendations for school personnel and all stakeholders must understand and establish their roles in preventing incidents in their facilities.  Due to the rising concerns over violence, various agencies and organizations should understand and establish their roles and determine the risk to their facility.  School classrooms and related offices and facilities pose complex security challenges for law enforcement.  The principal objectives for implementing protective measures against an attack on schools are to complicate attack planning and surveillance, protect potential targets, and mitigate the risk of attack.  These objectives are key to the overall mission of prevention and it is much more effective for educators and students than trying to train to adapt to the changes during an attack. 

One of the first steps in the endeavor must be to conduct a Risk Assessment.  This includes understanding the various threats and identifying the vulnerabilities and consequences associated with established threat scenarios.  Once the risk is understood, plans and procedures can be developed to mitigate consequences, threats and vulnerabilities.  To be effective the plans and procedures, while being reviewed periodically, must employ design, technology, and operations that include the involvement of policies and training of personnel.

An evaluation and enhancement our schools’ security is a must in order to address strategic plans and tactics.  Even given a schools’ historical open and public nature, the major advantage of their defense is in the preparation to defend against an attack from any direction.  The main disadvantage is that unlike law enforcement or military, armed security is not concentrated initially against the avenue of approach of an adversary.  School security however must ensure that their security measures are organized in depth (layered and duplicated in the area) and that all likely avenues of approach are covered.  Schools should use control measures to assign responsibilities, coordinate responsibilities, control operations, and ensure that all employees understand the concept of security.  Obstacles give strength to security only when properly employed.  Security must include steps that will counter actions by others that intend to reduce the effectiveness of any standing security measures.  In an adaptation of the immortal words of Sun Tzu, military experts have always taught that we must know ourselves and know our enemy.  Security enhancement also includes knowing as much as possible about potential attackers’ locations, intentions, reconnaissance methods, and attack methods.   

Strategic and operational planning and preparation is critical to prevention.  An essential component of prevention is to continuously share information and intelligence between all stakeholders.  The evidence of a threat is likely to be identified in the publics’ intentional of incidental contact with security or police officers.  It is well documented that the key to early detection and prevention is the gathering, processing, reporting, analyzing, and sharing of suspicious activities.  Complacency is our biggest threat.  No matter how insignificant a suspicious activity may appear; it should be advertised to all as a duty to maintain vigilance and report all instances of suspicious activity.  To that end one should ensure that all school employees and students know that suspicious activity, any activity or behavior that is unusual, abnormal, or seems suspicious, should be reported immediately. 

Avoiding a reduction in the effectiveness of security involves prohibiting the detection of security plans, positions, and intentions.  Schools should enhance their security by taking actions to detect and deny reconnaissance by adversarial elements.  Security enhancement must use both active and passive measures.  Active measures include: use of armed security; use of obstacles; use of manned surveillance cameras and patrols; establishment of specific levels of alert within the school; and establishment of times when security should be at the highest level.  Passive measures include hiding or camouflaging security cameras; movement control; adequate communications; and door sensors.  Further suggestions are listed below in “Protective Measures.”

Standard Response Protocol (SRP)

The Standard Response Protocol (SRP) is currently used by some entities to identify an element of school security.  It is based not on individual scenarios but on the response to any given scenario. Like the Incident Command System (ICS), SRP demands a specific vocabulary but also allows for great flexibility. The premise is simple – there are four specific actions that can be performed during an incident. When communicating these actions, the action is labeled with a “Term of Art” and is then followed by a “Directive.”  Execution of the action is performed by active participants, including students, staff, teachers and first responders.

•Lockout is followed by the Directive: “Secure the Perimeter” and is the protocol used to s            safeguard students and staff within the building.

•Lockdown is followed by “Locks, Lights, Out of Sight” and is the protocol used to secure individual rooms and keep students quiet and in place.

•Evacuate is always followed by a location, and is used to move students and staff from one location to a different location in or out of the building.

•Shelter is always followed by a type and a method and is the protocol for group and self protection.

These specific actions can act as both a verb and a noun.  If the action is Lockdown, it would be announced on public address as “Lockdown! Locks, Lights, Out of Sight.”  Communication to local Law Enforcement Agency would then be “We are under Lockdown.”  Each response has specific student and staff action. The Evacuate response is always followed by a location: “Evacuate to the Bus Zone.”  Responses can also be chained.  “Evacuate to Hallway; Shelter for Tornado; Drop, Cover and Hold.”

The benefits of SRP become quickly apparent.  By standardizing the vocabulary, all stakeholders can understand the response and status of the event.  For students, this provides continuity of expectations and actions throughout their educational career.  For teachers, this becomes a simpler process to train and drill. For first responders, the common vocabulary and protocols establish a greater predictability that persists through the duration of an incident.  Parents can easily understand the practices and can reinforce the protocol.  Additionally, this protocol enables rapid response determination when an unforeseen event occurs.

The protocol also allows for a more predictable series of actions as an event unfolds.  An intruder event may start as a Lockdown, but as the intruder is isolated, first responders would assist as parts of the school go to an “Evacuate to the Gym and Lockdown,” and later “Evacuate to the Bus Zone.”

Lockout vs. Lockdown

The differentiation between Lockout and Lockdown is a critical element in SRP.  A Lockout recovers all students from outside the building, secures the building perimeter and locks all outside doors.  This would be implemented when there is a threat or hazard outside of the building. Criminal activity, dangerous events in the community, or even a vicious dog on the playground would be examples of a Lockout response.  While the Lockout response encourages greater staff situational awareness, it allows for educational practices to continue with little classroom interruption or distraction.  Lockdown is a classroom-based protocol that requires locking the classroom door, turning off the lights and placing students out of sight of any corridor windows. Student action during Lockdown is to remain quiet.  It does not mandate locking outside doors. There are several reasons for not locking perimeter doors during a Lockdown.  Risk is increased to students or staff in exposed areas attempting to lock outside doors.  Locking outside doors inhibits entry of first responders and increases risk as responders attempt to breach doors.

There may be situations where both Lockdown and Lockout need to be performed, but in this case they are identified individually.  “Lockout! Secure the Perimeter. Lockdown! Locks, Lights, out of Sight.” would be announced on public address.  We are in “Lockdown and Lockout” would be conveyed to emergency services or 911.  SRP also acknowledges that some school incidents involve a tactical response from law enforcement, and suggests specific simple actions in that event.

Definitions of Security Fundamentals

Security is the measures taken by an entity to protect it against all acts designed to impair its effectiveness.  Security measures are an inherent aspect of all operations and can be moving or stationary.  Measures include screen, guard, cover, and area security. 

– Local security consists of low-level security operations conducted nearby to prevent surprise by an adversary.  Local security is an important part of maintaining a security initiative. 

– Screen is a form of security operations that primarily provides early warning to the school building itself.  A screen may be Stationary or Mobile, and consists of a combination of observation posts and security patrols.  A screen primarily provides early warning.  A screen provides the least amount of protection of any security mission.  It does not have the power such as armed security, to affect a situation. 

– Guard is the combination of observation posts (OPs), positions, patrols, and force protection with ability to engage an adversary.  A guard differs from a screen in that a guard force contains sufficient power to defeat, cause the withdrawal of, or fix an adversary force before it can engage the main school area. 

– Cover is a form of security operations with the primary task is to protect the main area and inhabitants.  This is executed force on force to gain time while also observing and preventing an adversary’s observation efforts and ability to fire against the main school body.  It is also a place that safe from effects of gunfire. 

– Concealment is a form of security operations with the primary task is to prevent detection of the main area and inhabitants.   Basically it is a place to prevent discovery as in “lockdown.”

– Area security is a form of security operations conducted to protect personnel, installations, routes, and actions within a specific area.  These include road blocks, traffic control points, route security, convoy security, and searches.

The screen, guard, and cover are the security measures used primarily by large entities to secure themselves from an attacker.  These measures, respectively, contain increasing levels of power and provide increasing levels of security for the main area.  Along with the increase of power, there is an increase in the requirement of the security personnel to fight for time, space, and information on any attacker.  Conceptually, the measures serve the same purpose as the local security measures by smaller schools.  For example, a large school area may need to employ a mobile screen for early warning while a smaller school would only need a stationary OP.  The purpose is the same—early warning—only the degree and scale of the measures are different.

Local and area security are related in that they both focus on the threat within a specified area. Again, the difference is one of degree and scale.  Local security is concerned with protecting the school from an attacker in the immediate area, whereas area security is concerned with a possible attacker anywhere in the area of operation (AO).

Any entity should be protected at all times from surprise.  Exterior guards are utilized to protect a entity from surprise and to give personnel time to prepare to counter any threat.  Guards must be alert for surprise by any type of attack; to provide early warning attack; and to protect installations.  If the school elements are moving, security may vary from observation to the use of security patrols for escorts.  During any short halts, guards and patrols are used to provide all-round security.  For stationary positions in known danger areas or threats of imminent action, school security should always employ exterior guards to establish a surveillance system to operate day and night throughout the area.  Guards, listening posts, observation posts, patrols, aerial observers, and any other available means as well as any number of special devices to assist them in performing their duties should be used.  These may include electronic detection devices, night vision devices, or any other device to provide early warnings.

Procedures

For operations, plans should include the following procedures in exercises and training:

• Conduct a realistic security assessment to determine the facility’s vulnerability to an active shooter attack.

• Identify multiple evacuation routes and practice evacuations under varying conditions; post evacuation routes in conspicuous locations throughout the facility; ensure that evacuation routes account for individuals with special needs and disabilities.

• Designate shelter locations with thick walls, solid doors with locks, minimal interior windows, first-aid emergency kits, communication devices, and duress alarms.

• Designate a point-of-contact with knowledge of the facility’s security procedures and floor plan to liaise with police and other emergency agencies in the event of an attack.

• Incorporate an active shooter drill into the organization’s emergency preparedness procedures.

• Vary security guards’ patrols and patterns of operation.

• Limit access to blueprints, floor plans, and other documents containing sensitive security information, but make sure these documents are available to law enforcement responding to an incident.

• Establish a central command station for building security.

Systems

Engineered electronic/electrical systems can serve as force multiplier in security effort.  Some examples are:

• A credential-based access control systems that provide accurate attendance reporting, limit unauthorized entry, and do not impede emergency egress.

• A closed-circuit television systems that provide domain awareness of the entire facility and its perimeter; ensure that video feeds are viewable from central command station. All exterior doors are usually alarmed electronically to notify security of unauthorized entry or exit.  Once inside the building, visitors are allowed to access the public areas.  Staff areas should be accessible via a card-access system.  Closed Circuit Television (CCTV) cameras should monitor public areas, and concealed duress alarm switches installed at staff-visitor interaction areas provide staff the ability to call for assistance during an emergency.  It is widely known that CCTV cameras are not continually manned or if they are, the viewers are not trained in spotting suspicious behavior. 

• A communications infrastructure that allows for facility-wide, real-time messaging.

• An elevator systems that may be controlled or locked down from a central command station.

Training

An old military adage is “train as you fight” which means train realistically and think both tactics and logistics.  Two areas of training exist: one for LE or armed response and the other for occupants of the school.  NOTE: If a school has armed security on site all training of must integrate into their initial response plan.

• Train law enforcement officers and EMS/Fire personnel on response with the Advanced Law Enforcement Rapid Response Training Program (ALERRT) protocols. 

• Train school officials and students on response options outlined by the Department of Homeland Security in “Active Shooter: How to Respond” when an active shooter is in the vicinity:

• Evacuate: Building occupants should evacuate the facility if safe to do so; evacuees should leave behind their belongings, visualize their entire escape route before beginning to move, and avoid using elevators or escalators.
• Hide: If evacuating the facility is not possible, building occupants should hide in a secure area (preferably a designated shelter location), lock the door, blockade the door with heavy furniture, cover all windows, turn off all lights, silence any electronic devices, lie on the floor, and remain silent. (See Cover and Concealment in the “Definitions of Security Fundamentals section.)
• Take Action: If neither evacuating the facility nor seeking shelter is possible, building occupants should attempt to disrupt and/or incapacitate the active shooter by throwing objects, using aggressive force, and yelling.
  • Train everyone to call 911 as soon as it is safe to do so.
  • Train everyone on how to respond when law enforcement arrives on scene: follow all official instructions, remain calm, keep hands empty and visible at all times, and avoid making sudden or alarming movements.

Other Protective Measures

Protective measures include equipment, personnel, and procedures designed to protect a facility against threats and to mitigate the effects of an attack.  It should be remembered that armed security if employed at schools should act as a deterrent first but be prepared to repel or prevent any attack success.  It is suggested that armed or unarmed security that is in uniform be used to protect the outer perimeter and any armed school official while thoroughly trained should always remain incognito.  The use of armed security should be widely advertised to present both a perceived and real deterrent.  Other protective measures for schools include:

Planning and Preparedness

• Designate and train an employee to serve as security director to address all security-related activities.
• Conduct threat analyses, risk assessments, security consequence analyses, and security audits on a regular and continuing basis.
• Develop a comprehensive security and emergency response plan.
• Establish liaison and regular communication with local law enforcement and emergency responders.
• Conduct regular exercises with employees to test security and emergency response plans.
• Conduct/participate in regular exercises with local law enforcement and emergency responders to test joint coordination on security and emergency response plans.

Personnel

• Conduct background checks on all employees.
• Incorporate security awareness and appropriate response procedures for security situations into employee training programs.
• Maintain an adequately sized, equipped, and trained security force.

Access Control

• Define the perimeter and areas within the school that require access control for pedestrians and vehicles.
• Issue photo identification badges to all employees. Require that badges be displayed.
• Issue special identification badges to contractors, cleaning crews, vendors, and temporary employees.
• Restrict the storage of packages to locations away from areas where large numbers of people congregate.

Barriers or Obstacles

• Install appropriate perimeter barriers and gates.
• Implement appropriate level of barrier security.
• Install building perimeter barriers (e.g., fences, bollards, large boulders, large decorative flower pots, high curbs, and shallow ditches).
• Install barriers to protect doors and windows from small-arms fire and explosive blast effects (e.g., blast-resistant and shatter-resistant glass, offset entryways).
• Install vehicle barriers (e.g., bollards, fencing) to keep vehicles a safe distance from buildings and areas where large numbers of people congregate.

Communication and Notification

• Install systems that provide communication with all people at the school, including employees, security forces, emergency response teams, and guests.
• Install systems that provide communication channels with law enforcement and emergency responders.

Monitoring, Surveillance, and Inspection

• Install video surveillance equipment (e.g., closed circuit television, lighting, night-vision equipment) and implement appropriate monitoring schedules.
• Consider acquiring package-screening equipment for use during high-threat or high-profile events.
• Implement quality control inspections on food supply to school kitchens and special events.

Cyber Security

• Develop and implement a security plan for computer and information systems hardware and software.
• Regularly review the school’s Web site to ensure no sensitive information is provided.

Incident Response

• Ensure that an adequate number of emergency response personnel are on duty or on call at all times.
• Identify alternate rallying points where employees and others at the facility can gather for coordinated evacuation and for “head counts” to ensure all have evacuated.

ANNEX C: DISPLACEMENT OF VULNERABILITIES

Crime displacement is the relocation of crime from one place, time, target, offense, or tactic to another as a result of some crime prevention initiative. Spatial displacement is by far the most commonly recognized form, though the other four are also frequently acknowledged by those studying crime prevention effects. Formally, the possible forms of displacement are:

 Temporal – offenders change the time at which they commit crime;

 Spatial – offenders switch from targets in one location to targets in another location;

 Target – offenders change from one type of target to another;

 Tactical – offenders alter the methods used to carry out crime; and

 Offense – offenders switch from one form of crime to another.

“Displacement” in security is commonly referred to when increased security and expanded perimeters create new bottlenecks where crowds wait to clear security. Despite increased protective deployments, entry control measures, and expanded perimeters around areas with a large security presence, law enforcement and security personnel remain vulnerable at the security perimeter. Attackers, understanding where the security perimeter begins, strike just outside where congestion creates predictable crowds and security is less extensive. Recent examples are the attacks on a police officer on duty just outside the TSA checkpoint in Flint, Michigan, and on the Ariana Grande concert where the egress corridor was crowded. 

Even though displacement is viewed as a negative consequence of crime prevention efforts, in some cases it can still provide some benefit. Current thinking suggests that beneficial displacement can occur when the harm produced by the displaced crime is less than what existed before the intervention. When considering how best to manage risks, less visible security outside of a perimeter and efforts to moderate crowd size may prove effective in mitigating the risk to both civilians and security personnel. In any event, the need for peripheral awareness is important to the security effort as a whole and to the individual officers.

ANNEX D: DETERMINE THE RISK

The first step to developing a viable plan that leads to effective and efficient procedures is a Risk Assessment.  The National Infrastructure Protection Plan (NIPP) outlines the elements of Risk:

• Consequence: The negative effects on public health and safety, the economy, public confidence in institutions, and the functioning of government, both direct and indirect, that can be expected if an asset, system, or network is dam­aged, destroyed, or disrupted by a terrorist attack, natural disaster, or other incident;

• Vulnerability: The likelihood that a characteristic of, or flaw in, an asset, system, or network’s design, location, security posture, process, or operation renders it suscep­tible to destruction, incapacitation, or exploitation by terrorist or other intentional acts, mechanical failures, and natural hazards; 
• Threat: The likelihood that a particular asset, system, or network will suffer an attack or an incident. In the context of risk from terrorist attack, the estimate of this is based on the analysis of the intent and the capability of an adversary; in the context of natural disaster or accident, the likelihood is based on the probability of occurrence.

CONSEQUENCE ASSESSMENT

The potential consequences of any incident, natural disasters or manmade, is the first factor to be considered in risk assessment.  In the context of the NIPP, consequence is measured as the range of loss or damage that can be expected.   These criteria can be divided into four main categories:

• Human Impact: Effect on human life and physical well-being (e.g., fatalities, injuries);
  • Economic Impact: Direct and indirect effects on the economy (e.g., cost to rebuild asset, cost to respond to and recover from attack, downstream costs resulting from disruption of product or service, long-term costs due to environmental damage);
  • Impact on Public Confidence: Effect on public morale and confidence in national economic and political institutions; and
  • Impact on Government Capability: Effect on the govern­ment’s ability to maintain order, deliver minimum essen­tial public services, ensure public health and safety, and carry out national security-related missions.

A full consequence assessment takes into consideration public health and safety, economic, psychological, and government impacts; however, estimating potential indirect impacts requires the use of assumptions and other complex vari­ables.  An assessment of all categories of consequence may be beyond the capabilities available for a given risk analysis.  At a minimum, assessments should focus on the two most fun­damental impacts: the human and the most relevant direct economic impact.  Another consideration is the interdependency of one asset or sector on another and the intended and unintended results of the initial effects.

VULERABILITY ASSESSMENT

Vulnerabilities are the characteristics of an asset, system, or network’s design, location, security posture, process, or operation that render it susceptible to destruction, incapacita­tion, or exploitation by mechanical failures, natural hazards, criminal or terrorist attacks, or other malicious acts.  They identify areas of weakness that could result in consequences of concern, taking into account intrinsic structural weaknesses, protective measures, resiliency, and redundancies.  The vulnerability assessment process typically consists of the following key steps:

• Determining an appropriate vulnerability assessment strat­egy (e.g., self-assessment, State- or federally led assessment, expert reviews, or independent third-party assessment);
• Identifying a methodology/tool appropriate for the partic­ular type of asset, system, or network under consideration;
• Identifying and grouping vulnerabilities using common threat scenarios;
• Identifying dependencies and interdependencies with other assets and sectors;
• Considering vulnerabilities associated with physical, cyber, and human elements;
• Analyzing benefits of existing protective programs; and
• Assessing residual gaps to determine unresolved vulner­abilities.

THREAT ASSESSMENT

The threat component of the risk analy­sis is calculated based on the likelihood of an attack method on a particular asset, system, or network.  The estimate of this likelihood is based on an analysis of intent and capability of a defined adversary, such as an active shooter.  In the context of a natural disaster or accident, the likelihood is based on the probability of occurrence.  Assessment of the current threat in the United States is derived from extensive study and understanding of previous school shooters, and is may be dependent on analysis of sensitive information.  Threat assessments are derived from analysis of adversary intent and capability, and describe what is known about active shooters’ interest in particular locations, as well as specific attack methods.  Since active shooters, in particular, have continually demonstrated unpredictability, the partners in the Intelligence Community should analyze previous goals and capabili­ties to provide a broad view of the potential threat and postulated attack methods. 

In calculations for risk analysis, the term “threat” is an estimated value that approximates the likelihood that a specific asset, system, network, sector, or region will suffer an attack or an incident.  This differs from “threat scenarios,” or “threat analysis,” which are generalized descriptions of potential methods of attack that are used to help produce consequence and vulnerability assessments.

Another important aspect in this element of risk is the long-standing threat posed by insiders, or persons who have access to sensitive information and facilities.  Insider threats can result from intentional actions, such as infiltration of the organization by individuals planning to do harm, or unintentional actions, such as employees who are exploited or unknowingly manipulated to provide access to, or information about the schools.  Insiders can intentionally compromise the security of a school through espionage, sabotage, or other harmful acts motivated by the rewards offered to them by another party.  As previously mentioned most active shooters have had some relationship with the location of the attack.

Individual Threat Assessment:

Most active shooters incidents have had lone attackers.  This individual threat may require the adjustment of the current overall threat assessment.  Each individual threat must be assessed to determine their validity and the impact, if any; it has on the overall threat.  The important point is that these assessments of new or individual threats should be addressed in plans and standard operation procedures. 

The individual threat assessment approach is a set of operational activities driven by an investigative process and focused on strategies for gathering and corroborating information from multiple sources to examine patterns of behavior that may reflect whether a given subject is on a pathway toward a violent act.  These activities are designed to identify, assess, and manage individuals who pose a risk of violence to an identified, or identifiable, target.

An individual threat assessment may be initiated by any communication or behavior that causes concern.  Threats are not a necessary threshold for concern; however, the threat assessment approach also dictates that no threat should be ignored.  The process of gathering information about the individual includes an investigative emphasis on corroboration of facts to establish their veracity.  The focus of the inquiry is on the individual’s behavior in a particular case and what the progression of that person’s behaviors may suggest.  The threshold for concern is evidence that suggests the individual may be on a pathway toward violent action.  The threshold is deliberately set low enough to facilitate early intervention, as the emphasis of this approach is on prevention and the development of effective case management strategies.

The individual threat assessment approach requires the person conducting the inquiry to gather information and answer key questions about the case to determine whether there is evidence to suggest movement toward violent action.  The questions focus on motivation for the behavior that brought the person being evaluated to official attention; communication about ideas and intentions; unusual interest in targeted violence; evidence of attack-related behaviors and planning; mental condition; level of cognitive sophistication or organization to formulate and execute an attack plan; recent losses; consistency between communications and behaviors; concern by others about the individual’s potential for harm; degree of the individual’s desperation; and factors in the individual’s life and/or environment or situation that might increase or decrease the likelihood of attack.

Combined, the information learned from these questions – as gathered from the individual and from corroborating sources (family members, friends, coworkers, supervisors, criminal and mental health records, and so on) – should provide evidence on whether the subject is moving on a path toward violent action.  In particular, the information gathered regarding factors in the subject’s situation that – should they change – may increase or decrease the subject’s likelihood of violence can aid in the development of a risk management plan.

There are three guiding principles that underlie the individual threat assessment approach.  The first principle is that the end result of targeted violence is an understandable and often discernible process of thinking and behavior.  Acts of targeted violence are neither impulsive nor spontaneous.  Ideas about mounting an attack usually develop over a considerable period of time. In targeted violence, the subject must engage in planning around a series of critical factors such as which target or targets to select, the proper time and approach, and the means for the attack.  A potential attacker may collect information about the target, about the setting of the attack, or about similar attacks.  Also a potential attacker may communicate his or her ideas to others.  For some subjects, the process of planning and thinking about the attack dominates their lives and provides a sense of purpose or an attainable goal by which they see an end to their emotional pain.  This principle suggests that many incidents of targeted violence may be preventable. Conceptually, this is important since assessing risk for events that are considered to be random would seem to be a contradiction.  If, however, they are viewed as the result of a behavioral process, then a fact-based assessment makes sense.

The second principle is that it is important to distinguish between making a threat (expressing to the target or to others an intent to harm the target) and posing a threat (engaging in behaviors that initiate or further a plan to harm the target).  Many people who make threats do not pose a serious risk of harm to a target.  People may make threats for a variety of reasons, many of which are unrelated to any desire or intent to harm the target.  Conversely, many who pose a serious risk of harm will not issue direct threats prior to an attack.  While all threats (direct, indirect, conditional, or otherwise) should be taken seriously, they are not the most reliable indicator of risk.  Threats should not be established as a necessary factor to initiate an inquiry or preliminary evaluation.  The federal courts have even held that in determining what constitutes a “threatening communication” in federal statutes, “an absence of explicitly threatening language does not preclude the finding of a threat”.

As a practical matter, an individual who is committed to mounting an attack may be less inclined to threaten his or her potential target directly, particularly if he or she does not want to be stopped.  Accordingly, the key threshold question in a threat assessment is not “Did the subject make a threat?”  Rather, the question is, “Has the subject engaged in recent behavior that suggests that he or she is moving on a path toward violence directed at a particular target or targets?”

The third principle is that risk for violence as a result of an individual threat is the product of an interaction between the potential attacker, his or her current situation, the target, and the setting.  As noted previously there is no profile or typical attacker, so it is imprudent to focus exclusively, or even primarily, on the individual subject characteristics in evaluating the risk of harm.  Nevertheless, one might reasonably examine the development and evolution of ideas concerning the attack, preparatory behaviors, and how the individual has dealt with what he or she felt to be unbearable stress in the past.  Consideration of the subject’s current situation may include an assessment of what stressful events are occurring in the subject’s life, how he or she is responding, and how others in the subject’s environment are responding to his or her perceived stress and potential risk.  Finally, relevant factors about the intended target may include the subject’s degree of familiarity with the target and the vulnerability of the target

When considering how best to prevent (rather than optimally predict) targeted violence in circumstances where an individual has come to official attention because of threatening or concerning behavior, traditional inductive approaches, such as profiling or tallying risk factors, are unlikely to be helpful.  A deductive, fact-based approach is needed to investigate and assess the risk for targeted violence against judges and their courts.  The individual threat assessment approach represents a good first step toward identifying and assessing risk posed by individuals for targeted violence against judicial officials and courts.  This approach will likely provide a useful investigative framework, leading to better questions, better assessments, and better risk management decisions in preventing targeted violence against judges and maintaining safety.

ANNEX E: PLANNING – PREPARATION – TACTICAL SEQUENCE OF DEFENSE

Since the “defenders” of a school are very familiar with the area prior to any incident, they must take advantage of this by completing an all hazard plan with input from all stakeholders.  Based on information and intelligence from all stakeholders the plan should thoroughly analyzing factors such as the mission, scenarios of natural hazards and adversarial threats, terrain/physical plant features, seasonal weather considerations, in-house employee and outside security support available, preparation time available, and other local agencies/entities that may be of assistance when needed.  With this planning leaders will gain an understanding of how to adapt to daily situations and identify tactical positives and weaknesses.

Information and intelligence (I&I) function consists of the related tasks and systems that facilitate understanding of possible adversaries, terrain, weather, and other considerations.  It is a flexible, adjustable architecture of procedures, personnel, organizations, and equipment.  These provide relevant information and products relating to the current threat and environment to planners and decision makers such as:

– Assisting in risk assessments of facility.

– Identify likely avenues of approach.

– Identify an attackers’ scheme of maneuver, i.e. where will active shooter want to go.

– Plan and integrate obstacles.

– Emplace armed security systems if required or desired at tactically advantageous positions.

– Conduct an engagement area rehearsal for security and first responders, i.e. identification of lockdown locations, displacement and evacuation routes to other positions, and evacuation of casualties.

Six factors of planning are:

Mission: After deciding on the essential tasks and purposes a visualization of the interrelationships of the other factors. The goal in this analysis is to clarify what each section or designated groups are to accomplish and why they must accomplish it.  Key considerations in this analysis include:

• What is the overall intent?
• What are the overall specified tasks and purposes?
• What are the specified tasks for each scenario that must be accomplished)?  (Should align with overall intent, operational issues, tasks to others, and coordinating instructions.)
• What are the implied tasks for the operation? These are other tasks, not specifically noted but must be accomplished during any scenario.
• What are the essential tasks for each scenario?  These are all tasks, both specified and implied, that are absolutely required to ensure mission success.

Scenarios of natural hazards and adversarial threats: The analysis of each scenario and possible situations should focus on the following considerations:

• What types of natural hazards and adversarial threats would pose high risks?
• Where are the most probable scenarios?
• What kind of equipment does an adversary have?
• What are possible adversary capabilities and weaknesses?
• Where will the adversary be most vulnerable?
• How is information and intelligence received on an adversary’s possible intentions, objectives, and most probable tactics?
• What can an adversary do in response to our courses of action?

Terrain/Physical Plant features and seasonal weather considerations: Leaders should analyze the terrain/physical plant features using the factors of observation points or OPs (the first echelon of security in the defense that allows for both cover and concealment for in-house employees/security support); other OPs that can be seen by an adversary as a deterrence; obstacles; key terrain features; and avenues of approach. The following are questions to use in analysis:

• Where can an adversary observe and engage the school?
• Where can camera locations or observation posts to maximize the ability of in-house employee or security support to see the area be established?

• What routes within the area offer cover and concealment for the adversary?
• What dismounted routes offer in-house or outside responders the best available cover and concealment?
• Where is the key terrain location or area whose control affords a marked advantage to either school security effort or to the adversary?
• How can the key terrain location be utilized to support the mission?

OPs can be executed either mounted (roving in a vehicle) or dismounted (walking or stationary).  As they are complementary, if possible they should be used in combination.  The main advantage of a dismounted OP is that it provides maximum stealth hopefully preventing the enemy from detecting it.  The two main disadvantages are that it has limited flexibility, taking time to displace and limited ability to protect itself if detected.  The main advantages of a mounted OP are the flexibility that comes from vehicle mobility as well as the additional ability resident in the vehicle’s protection.  The main disadvantage is that vehicles are inherently easier to detect and can prevent the detection of an adversary.  To select and secure the OP a leader must determine how many OPs to establish and where they must be positioned to allow long-range observation along the avenues of approach.  Ideally, the fields of observation of adjacent OPs overlap to ensure full coverage of an area. 

During this process, planners should also identify existing and reinforcing any obstacles (or locations to add an obstacle) that may limit an adversary’s mobility or in retrospect also hinder in-house employee or security support mobility and affect the objectives, avenues of approach, and corridors.  Existing obstacles may include:

• Gullies, ravines, gaps, and ditches over 3 meters wide.
• Streams, rivers, and canals over 1 meter deep.
• Mountains or hills with a slope in excess of 60 percent.
• Lakes, swamps, and marshes over 1 meter deep.
• Tree stumps and large rocks over 18 inches high.
• Forest with trees 8 inches or more in diameter and with less than 4 meters of space between trees.
• Man-made existing obstacles, including built-up areas such as buildings outside campus or railroad embankments.

Reinforcing obstacles may include ditches, bollards, or fences.  Based on the degree of obstruction posed by obstacles, terrain can be classified in one of the following categories:

• Unrestricted. This is terrain that is free of any restriction to movement; no actions are required to enhance mobility. For vehicles, unrestricted terrain is typically flat or moderately sloped, with scattered or widely spaced obstacles such as trees or rocks.  This type of terrain generally allows wide maneuver and offers unlimited travel over well-developed road networks.
• Restricted. This is terrain that hinders movement to some degree.  Little effort is needed to enhance mobility, but some vehicles may have to zigzag or make frequent detours.  They may have difficulty maintaining optimum speed.  For vehicles, restricted terrain typically encompasses moderate to steep slopes and/or moderate to dense spacing of obstacles such as trees, rocks, or buildings.  Swamps and rugged ground are examples of restricted terrain for adversaries on foot. 
• Severely restricted. Terrain in this classification severely hinders or slows movement of vehicles or individuals walking.  Severely restricted terrain for vehicles is typically characterized by steep slopes, densely spaced obstacles, and/or the virtual absence of a developed road system. 

The definition of an avenue of approach is an area that provides ease of movement for an adversary to significantly affect the outcome an attack as well as one that enhances timeliness of assistance from responders.  Analysis should include considerations of the location of the most favorable avenues of approach for both adversarial and responding support.

Weather conditions should be part of the evaluation of the terrain. The following considerations should be included:

• What seasonal weather changes require adjustments to plans?
• What are the light conditions (including percentage of night illumination) and visibility?
• What are the times for beginning of sunrise, sunset, moonrise, and moonset?
• How has recent weather affected the area?
• Will weather become better or worse?
• How will fog, rain, dust, heat, snow, wind, or blowing sand affect both in-house security and adversaries, and equipment during the mission?

Available In-house employee and outside security support: Analysis of support available for a response includes an assessment of the personnel, vehicles, and equipment.  Considerations include:

• Is security personnel armed?
• Are security personnel in uniform?
• What is the present condition of the personnel, vehicles, and equipment?
• What is the supply status of necessary items?
• What is the state of training of the employees, responders, and stakeholders?
• How many key personnel or their substitute are present?
• Is there a need for any additional equipment to support or accomplish the mission?
• Are all substitute or temp employees trained?
• How many observation positions (OPs) can be manned with the available assets?

Preparation Time available: The time available begins with the “one-third/two-thirds” rule of planning and preparation.  This principle allows the leader to use one-third of planning and preparation time himself, then to allocate the remaining two-third to subordinates.  When preparing daily security or increasing planned efforts for a new threat posture additional planning considerations should include the following:

• How much time is available to plan and conduct reconnaissance of the campus perimeter?
• How long will it take to man planned OPs, to the initiate lockdown/lockout, and complete alert notifications?
• Is there enough time for rehearsals?

Other local agencies/entities: In his analysis of how the school will handle situations involving parents and others who are visiting or arrive in response leaders should assess the following considerations:

• What are the applicable rules of interaction (ROI)?
• What procedures and guidelines to be used in dealing with parents; i.e., a reunification plan.
• Will the school be working with other organizations, such as non-law enforcement governmental agencies, private groups, or the media?
• Who will speak to the Media?

PREPARATION

The school security personnel are in the area before an attack and they should constantly ensure that planned preparations are in place.  In the planning phase leaders should have thoroughly analyzed the mission, scenarios of natural hazards and adversarial threats, terrain/physical plant features, seasonal weather considerations, in-house employee and outside security support available, preparation time available, and other local agencies/entities that may be of assistance when needed.  From the planning phase, leaders gain an understanding of identifying tactical positives and weaknesses on a daily basis or a current situation. 

For example, by being in the area first, the school leaders have the advantage of preparing terrain/physical plant features before an adversarial event.  Through the proper selection of terrain and reinforcing obstacles, school security efforts can direct the energy of any attack into an area of their choosing in order to engage the attackers or as a delay tactic.  If in-house security is not armed the use of obstacles to block, delay, or redirect an attackers’ efforts is extremely important; response time of law enforcement will influence the proper use of obstacles.  Leaders must take advantage of this time by making the most thorough preparations possible and to improve any defensive security measures, engagement areas, and survivability positions.  Preparation consists of plans for lockdowns; lockouts; movement; law enforcement response plans; preparation of positions, routes, obstacles, logistics, communications, and command and control elements; and student/parent reunification.  Codes to be initiated that identify plan elements, such as lockdown, lockout, evacuate, etc. should be known by all but it is highly recommended that plain English be used to avoid any misinterpretation or confusion.  Any codes should be released only to those who have a need to know.

Using vulnerability information, security on-site is achieved by separating the various zones and corresponding circulation routes.  Security personnel, staff, and especially teachers’ entry points are generally placed away from the visitors.  Buildings and parking areas should be isolated by providing barriers that have the capability to stop most vehicles.  A standoff perimeter could be used to protect from vehicles or improvised explosive devices (IEDs) that could be used to breach school buildings.  Explosives have been a tactical tool of attackers in some incidents.   The leaders must exploit every aspect of terrain and weather to its advantage.  In developing a defensive plan, the school responders account for key terrain and observe all possible adversary avenues of approach into their area.  The school defense seeks to maximize effective cover, concealment, movement, and surprise.  Always assume that security preparations are being observed.  To hinder adversarial intelligence efforts, leaders should establish counter reconnaissance when exercising or improving physical obstacles.

The goals of the individual schools’ security efforts are normally tied to the area school board and other area schools’ efforts. These efforts include communicating the discovery suspicious activity the early warning tactic that discovered it.  All security or defensive plans vary with the circumstances, but all defensive concepts aim at disrupting an attacker’s plans or synchronization.  Counterattacks, obstacles, and the retention of key terrain prevent the adversary from concentrating his strength against selected portions of the school.  In the event of more than one attacker, separating them from one another allows them to be defeated piecemeal.  If the school has armed security available, they must mass the overwhelming effects of that power at the decisive place and time if it is to defeat the attackers.  It must obtain a local advantage at points of decision since most attacks have concluded before local law enforcement can arrive unless already on the scene.  Offensive action may be a means of gaining this advantage.  Leaders must remember that this massing refers to power and its effects—not just numbers of personnel and weapons.  It is of utmost importance that flexibility is practiced and maintained.  Flexibility is derived from sound preparation and effective command and control and results from a detailed analysis of the planning factors.  School personnel and/or first responders must be agile enough to counter or avoid the attacker’s blows and then strike back effectively.  For example, supplementary positions may provide additional flexibility to the defense.  Immediate transitions from defense to offense are difficult.  To ease this transition, the leaders must think through and plan for actions that might be needed, and then rehearse them in a prioritized sequence based on time available.

TACTICAL SEQUENCE OF THE DEFENSE

To defend an area certain tactics should be accomplished in a sequence of integrated and overlapping phases.  The following phases are within the sequence of the security defense and should be completed daily:

• Security operations.
• Occupation.
• Approach and assault of an adversarial attack.
• Counterattack.
• Reorganization and Reunification.

Security Operations

The outer perimeter should be patrolled prior to start of the school day in order to protect school employees and students and allow them settle in and secure main area as plans dictate.  The goals of a perimeter patrol or reconnaissance personnel include providing early warning, report suspicious activity, identifying any possible adversarial observations, and gathering information on any suspicious person in the area.  Additionally, such actions may be conducted periodically as part of the overall daily security operations IAW the company defensive plan including manning observation posts (OPs) or monitoring of camera surveillance.

Other personnel should be used to serve as traffic control for the perimeter patrol passage while monitoring student buses and private cars entering or departing the area.  These traffic control efforts may deny likely adversarial attack corridors to enter area at a congested time.  This will enhance flexibility and force adversaries into changing plans and drawing attention to them.  The same security operation should be considered for close of business traffic tasks to ensure safe and secure departures and that no one has entered area to lie in wait overnight for the next day. 

Occupation

The occupation phase of the defense includes moving from the security operations prior to the start of the school day in order to allow administrator/teachers/security to secure the physical plant as plans dictate.  As outer perimeter and student receiving tasks withdraw into the school buildings it is important that a subtle communication with all classes or elements affirms that everyone is safe, secure, and understand the duties and responsibilities, including priorities of work as it pertains to security plans.

Occupation and preparation of the site is sometimes conducted concurrently with in order to ensure an effective and efficient operation.  Leaders should check the primary locations or positions of all elements to verify that they are located IAW the security plan.  If there are discrepancies between actual positioning of the elements/classes and the plan, corrections or adjustments should be made.  Security leaders should personally walk the area to ensure that everyone understands the security plan to include where the alternate, supplementary, and subsequent positions as well as various rendezvous points are located. 

It is imperative that the characteristics and considerations of the various positions or locations are understood by all employees/security and stakeholders.  An alternate position – covers the same avenue of approach or sector of fire as the primary position; located slightly to the front, side, or rear of the primary position; and positioned forward of the primary positions during limited visibility operations.  They are also used to fall back to if the primary position is rendered ineffective or as a position for rest if incident is long lasting.  Supplementary positions – covers an avenue of approach or sector of fire different from those covered by the primary position and may be occupied based on specific adversarial actions.  Subsequent positions – covers the same avenue of approach and or sector of fire as the primary position; located and identified throughout the area; and occupied based on adversary actions or conducted as part of a scheme of maneuver for evacuation or reassembly of students.  Rendezvous points or RPs are locations that are designated for the congregation of evacuated persons in order to account for them. (It is imperative to ensure that RPs is not subject to surveillance or common knowledge outside the “need to know” arena.)

Approach and Assault of Adversarial Attack

When an adversary’s attack is discovered and engaged outside the building perimeter, the ability to solidify the inner defense is enhanced by allowing time to effectively use obstacles, tactical protective maneuvers, and armed security when provided.  Of course, alert notifications and calls to law enforcement are made immediately when an attack is suspected to be imminent or is in progress.  The goal is to use security assets and obstacles to disrupt the attacker’s advance, allow for local law enforcement reinforcements, and thereby increase survivability.  Blocking obstacles are used but because they require extensive engineer effort and are employed only at critical choke points, they have not been proven to be feasible in buildings.  Obstacles can also provide turning effects that support the planned scheme of maneuver by diverting the attacker from one avenue of approach to another to deny access to areas where personnel have locked down or may be evacuating or repositioning and/or into an engagement area for security or law enforcement.  Positions described previously may be shifted in response to the attackers’ actions or other factors. 

Whether the initial engagement is in outer or inner perimeter area, during an assault, attackers especially if more than one will attempt “fix and finish” any persons resisting them and destroy obstacles in order to pass through.  During the execution of the defense, security efforts should mass the defensive effects to deter, repel, disable, or slow to stop the assault. 

If armed security is available it is necessary that their positions (basically fighting not observation) provide cover.  Most observation positions may provide concealment; others are very visible to offer a deterrent effect.  However, when an attack begins cover is essential for the security while others should rely on concealment, cover, and light/noise discipline for obvious safety reasons.  After an attack begins the leaders must control security operations with standard commands or other prearranged signals.  NOTE:  It is important that non-security personnel do not move out of position unless directed or forced to by dangers such as fire, smoke, etc. because it will destroy the integrity of the defense.  All movements and actions to reposition elements must have covered and concealed routes when moving to alternate, supplementary, or subsequent defensive positions and be thoroughly rehearsed. 

Counterattack

It is always hopeful that law enforcement will arrive for a counterattack whether on site security is armed or not.  The counterattack purpose is to seize the initiative from the attacker or to completely halt his attack and restore safety and security control of the area.  The law enforcement actions must be planned, trained, and exercised by law enforcement from all responding agencies with all school officials at each location in the jurisdiction.  Maps and floor plans of all locations should accompany all training to familiarize officers with the areas and be available to agency dispatchers that can advise and guide officers.  It is of utmost important that school officials, while trained on actions to take before and during initial attack moments, also know what to do/not do when law enforcement and other first responders arrive.

REORGANIZATION AND REUNIFICATION

Once the area is secure security should reestablish the defense positioning and accounting for all elements, treating and evacuating casualties, processing of law enforcement prisoners, and reestablishing obstacles. Schools should conduct all necessary sustainment functions and prepare to continue security during this vulnerable time.  Concurrently, the Standard Reunification Method, a critical aspect of crisis response that is the accounting for and reunification of students with their parents or guardians in the event of a school crisis or emergency, must be initiated.  The Standard Reunification Method provides school and district safety teams with proven methods for planning, practicing and achieving a successful reunification.  This evolving artful process practices can be integrated into school and district safety plans but site-specific considerations will impact how it is accomplished.  Successful planning and implementation also demands partnerships with all responding agencies participating in a crisis response.  Reunification and recovery efforts starts with the crisis, not after, and “winging it” with reunifying ignores both the mental health demands which accompany an event and the responsibility of the school and the district in maintaining the chain of custody for every student.  A predetermined, practiced reunification method ensures the reunification process will not further complicate what is probably already a chaotic, anxiety-filled scene.  In fact, putting an orderly reunification plan into action will help defuse the emotion building at the site.