This is a post we would prefer not to write. But as people whose expertise is security, we believe it is time that Americans, both in their organizations and in their personal activities, learn about active assailant and active shooter situations and how to prevent or react to such levels of evil.
The FBI agrees. On Friday, November 10, 2017, The Wall Street Journal quoted FBI agent, Christopher Combs, who is involved in investigating the Sutherland Springs, Texas church shooting saying,
“Everybody, no matter where you are, needs to think about this.”
Not long ago, most Americans regarded active assailant incidents as black swan events, unpredictable and largely indefensible. However, with the increasing frequency of these events, the time is at hand when venue owners, employers, and operators of gathering places need to evaluate and mitigate the risk of these incidents, or potentially face legal consequences. And the number and type of venues at risk may increase. Consider:
During the finale of a country music festival in Las Vegas on October 1st this year, an assailant fired hundreds of rounds into the huge crowd beneath his 32nd floor hotel room. He killed 58 people outright and injured well over 400. When the shooter was finally found, he had committed suicide. No one really knows why he did it.
During a calm Halloween afternoon, as school was letting out, an assailant turned his rented truck onto a bike path in Manhattan and accelerated. He killed 8 and injured 11 more before crashing into a school bus. He jumped out of the truck and was quickly shot by a police officer. His actions and a note indicate this was a terrorist action.
On Sunday morning, November 5th, a troubled man used an AR-15-type weapon to mow down 26 parishioners at the First Baptist Church in Sutherland Springs, Texas, injuring another 20. He was found dead in his SUV a short time later, with two bullet wounds reportedly inflicted by citizens and another consistent with a self-inflicted shot. Devin Kelley received a “bad conduct” discharge from the Air Force in 2012, and events since then have confirmed violent tendencies and potentially serious mental illness.
As these examples show, an active assailant may use a variety of weapons. An ordinary truck has been used in terrorist attacks in several places around the world, reflecting a centralized effort by radical Islamic terrorists to export their impact. Two brothers used home-made kettle bombs to kill and maim near the finish of the 2013 Boston Marathon. However, in the United States, the vast majority of incidents involve guns, many of them semi-automatic assault-style or semi-automatic handguns, usually with high capacity magazines.
An Alarming Trend
Looking at active shooter situations specifically, which the FBI defines as “an individual actively engaged in killing or attempting to kill people in a confined and populated area,” the incidents are trending upward at an alarming rate. To give you a benchmark, the FBI data shows 20 cases each in 2014 and 2015, which is more than any two-year average in the past 16 years and nearly six times as many as the period of 2000-2001 when the FBI started its review. No doubt the data will continue to tell a sad story when we add 2016-2017 numbers.
A known, but not fully understood risk.
Based on the definition of an active assailant incident alone, which indicates that the event is “in progress” and therefore has the potential to be influenced by law enforcement, security personnel, employees, and citizens, there is an inherent duty to be prepared.
The increasing frequency of active assailant incidents raises the level of a risk that must be managed, making it more of a ‘known-unknown’, not just a random event. It is now reasonable if not expected to look at this risk as based on a pattern that we know, or should know. Therefore, since the employer or venue manager has a duty of care toward employees, clients, or customers, or other bystanders, then he or she will very likely become liable for taking reasonable precautions to prevent the situation. Failing to do so may result in a claim of negligence if an incident occurs.
It is already the case that employers have a duty of care toward employees and customers. The Occupational Safety and Health Administration (OSHA) makes this responsibility explicit, based in law. But other kinds of venues—like churches—where there is public access and limited escape routes may also be at risk.
It is true that many venues where active assailant incidents have occurred have been cleared of liability at trial because the assailant is the ultimate responsible party, and the event was determined to be unforeseeable. However, because active assailant events are increasingly common, are having greater impacts, and follow a more well understood pattern, courts are increasingly likely to consider them “foreseeable.” The time is approaching where the known-unknowns are well enough understood that reasonable organizations would take precautions to degrade the opportunity an active assailant might otherwise have.
We have learned something about the circumstances where the attacks can and do occur. They usually happen:
• In places with public access;
• where there are numerous targets (a “target rich environment”), at least at specific predictable times;
• exits are limited;
• defensive measures are limited or non-existent;
• assailants have access.
Anti-terrorism experts have become better at learning how to protect high value targets, including both people and property. In short, there is a growing body of experience and knowledge about preventative steps that provide at least some protections to citizens and the authorities against assailants.
The precautions we are talking about here are those an employer or venue owner/manager might take on behalf of employees, customers, or bystanders. These do not replace steps individuals can take to prepare for an active assailant situation, e.g., by learning what steps to take for self-preservation. However, employers and venue owners should begin now to undertake a security audit focused on ‘expected’ violence, and develop a program to mitigate it.
Even though it is difficult, if not impossible, to know in advance when a deranged individual will target innocent individuals, it is quite possible to harden the targeted venue. And for individuals entering public spaces, understanding “situational awareness” may become an essential tool in self-preservation: Observe, Orient, Decide and Act (OODA).
Some key takeaways to consider as you think about making yourself a harder target:
• Do you monitor your premise with CCTV for suspicious behavior?
• Do you have an active assailant incident response plan?
• Do you have armed security trained in incident response?
• Do you have a designated Ombudsman or other employee who employees can talk to if they have problems at work or with other workers?
• Do you have a hot line that employees and contractors can use to identify workers with potential violence issues without identifying themselves?
• Do you routinely change alarm and access codes/cards when a keyholder leaves employment?
What is your organization doing to prepare for the new reality of this known-unknown risk? If the answer is “hoping it doesn’t happen here”, consider yourself unprepared.