Incident Response | EMBCP

5.2.6 Active Attack Response and Training Plan

I. Introduction

Effective response to an Active Attack event requires effective planning and role reinforcement through training for personnel caught in the incident, as well as for leaders coordinating the response to the incident.

Personnel in the vicinity of an Active Attacker may need to evacuate or shelter in place depending upon circumstances unique to that incident.

Organization leadership coordinating the response to an active attacker incident need to be able to provide effective direction to personnel in the vicinity of the Active Attacker, provide clear situation information to first responders, and inform the public.

II. Purpose

This Active Attacker Response and Training Plan provides instructions and guidance to effectively address the response of Lamar State College Orange to an Active Attacker or Hostile Intruder incident.

This Active Attacker Response and Training Plan was prepared by the Director of Safety and Security.

III. Preparedness

An Active Attacker is an individual actively engaged in killing or attempting to kill people in a confined and populated place; in most cases, active attackers use firearms and there is no pattern or method to their selection of victims. Active attacker situations are unpredictable and evolve quickly. Typically, the immediate deployment of law enforcement is required to stop the shooting and mitigate harm to victims.

Because active attacker situations are often over within 10–15 minutes, before law enforcement arrives on the scene, individuals must be prepared both mentally and physically to deal with an active attacker situation.

IV. Command Structure / Response Organization

The initial Incident Command Structure will be led by the Incident Commander and likely include a full cooperation with other responding law enforcement agencies. The location of this command structure will be decided upon at the time and will be close to the incident. The Incident Commander and LSCO’s Director of Safety & Security will communicate with outside law enforcement agencies regarding response, meeting locations, crime scene details, and other needed resources. The Incident Commander (IC) will communicate with the LSCO Emergency Response Team if activated.

An Emergency Operations Center (EOC) and Emergency Management Team will be activated (if needed) as soon as possible in areas designated by the LSCO Emergency Management and Business Continuity Plan (EMBCP). Their function will be of support and assistance to the Incident Commander, as well as to make high-level decisions about school closure and management of the media.

V. Pre-Incident Planning

Active attacker incidents often begin and conclude quickly, leaving college leadership and security little to no time to coordinate response procedures with employees. College readiness requires that leadership develop and exercise response plans that apply general preparedness and response protocols. Training and exercising the plan allows the college to identify gaps, correct weaknesses, and validate the plan.

A. Training and Awareness

LSCO has adopted the Civilian Response to Active Shooter Events (CRASE) training program for our campus. LSCO’s Emergency Management Coordinator and the Director of Safety & Security have been trained in the Active Attack Event Response Leadership Training and an experienced active attack Security Officer has been trained in the CRASE Instructor Train the Trainer program.

• CRASE face to face training is available throughout the year at scheduled events and is available online.
• CRASE training videos are available on the Emergency/Risk Management website: https://www.lsco.edu/risk-management/embcp-active-attack-response-and-training-plan.asp
• Faculty can request training for their students by contacting the Office of Director of Safety and Security at 409.882.3910.

B. Prepare for an Incident

• Learn how to recognize potential workplace violence and suspicious behavior.
• Identify the location of the nearest exits in a room, office or building, and identify potential safe hideouts.
• Become familiar with what to expect from law enforcement during an Active Attacker incident.
• Know who to call to report an incident and what information to provide about the situation.
  • Call 911: Notifies Orange Police Department
  • Call (409) 670-0789 or pick up any Emergency Telephone located in campus buildings: Notifies LSCO Security Team (who will respond and notify Orange Police Dispatch)
• Know who to call to report suspicious behavior, a person acting strangely or someone making statements that cause concern.
  • Call extension 3910: Tip line, to alert the campus of suspicious behavior of a student, employee, or visitor on campus

C. Exercise Emergency Plans Regularly and Repeatedly

• Schedule regular training, drills, tabletop and functional exercises.
• Assess gaps in plans, exercises and training.

D. Establish a Relationship with Emergency Responders

• Involve emergency services responders from multiple agencies in training and exercises.
• Invite all emergency services responders to tour your site and provide details about the facility that will help responders to adjust their protocols if necessary.

VI. Incident Response Considerations

Active attacker incidents often begin and conclude quickly, and the incident may be at any location. This leaves campus security personnel very little time to coordinate response procedures with off-campus law enforcement and students, faculty and staff. The response to a specific incident will depend on the circumstances unique to that incident. However, there are general procedures that apply to all active attacker incidents.

A. Students, Faculty, and Staff – AVOID / DENY / DEFEND

AVOID if possible:

• Determine an escape route based on where an active attacker may be located. If it is unclear where the attacker is, hide/barricade in a room before running into a hallway where the attacker may be.
• Leave your belongings behind. Keep your hands empty and visible at all times.
• Help others run away, if possible, but do not attempt to move the wounded. Run away even if others do not agree to follow.
• Be aware of those with accessibility and functional needs:
  • This group of people may need extra assistance to Avoid or Deny.
  • They may be very disoriented or scared if they cannot hear or see.
• Move quickly to a safe place far from the attacker and take cover. Remain there until police arrive and give instructions.
• Remain calm. Avoid screaming or yelling as you run away.
• Follow all instructions of law enforcement.
• When and only if it is safe, call 911.

DENY when getting away is difficult or maybe impossible:

• Go to the nearest room, office, or classroom and lock the door(s). If the door does not lock, wedge the door shut or use heavy furniture to barricade it.
• Identify an escape route in the event you are directed to evacuate.
• Close blinds, turn off lights, and cover windows.
• Silence all noise, including cell phones, radios, and computers.
• Have one person call 911, if it is safe to do so. Be prepared to answer the dispatcher’s questions. If it is not safe to talk, keep the phone on so it can be monitored by the dispatcher.
• Stay out of sight and take cover behind large, thick items or furniture.
• Do not open the door until the person can provide an identification badge.
• Remain under cover until law enforcement advises it is safe to evacuate. Positively verify the identity of law enforcement, as an unfamiliar voice may be the attacker attempting to lure victims from a safe place.

DEFEND, if you must, because you have the right to protect yourself:

• If there is no opportunity to avoid or deny, as a last resort, and only when your life is in imminent danger, attempt to disrupt and/or incapacitate the active attacker.
• Use any object in the vicinity to throw at and disorient the attacker – even a couple of seconds of disruption could cause less shooting.
• Be aggressive and committed to your actions.
• Do not fight fairly – this is about SURVIVAL.

Respond Appropriately When Law Enforcement Arrives:

• Remain calm and follow officers’ instructions.
• Raise your hands, spread your fingers, and keep hands visible at all times.
• Do not run when police enter the vicinity. Drop to the floor, if you are told to do so, or move calmly out of the area or building.
• Do not make quick moves toward officers or hold on to them for safety.
• Avoid pointing, screaming, or yelling.
• Do not stop officers to ask for help or directions. Evacuate the building in the direction the officers arrived while keeping your hands above your head.
• For your own safety, do not get upset or argue if an officer questions whether you are an attacker or a victim. Do not resist, even if you are handcuffed and searched.
• If you are a witness you will be asked to give a statement to the police.

When is it safe to come out of hiding or return to the building?

• Stay hidden and quiet until a law enforcement officer tells you it is safe or you receive other valid information that lets you know the incident has ended.
• Law enforcement may enter the room with keys and give instructions regarding evacuation.
• A mass text notification may be sent indicating it is safe and clear.
• Other forms of communication may be used to let people know it is safe and clear.

B. College Safety & Security Department

• Identifying Secondary Impacts
  • Identify additional attackers or other threats
• Establish a safe location to stage evacuees/injured
• Assist Emergency Medical Services (EMS) and other law enforcement agencies
• Manage the crime scene
• Conduct interviews
• Consider a family reunification area (work with EOC to establish)
• Manage the perimeter
• Control or prevent the entrance of the media into secure or sensitive areas

C. Warnings, Messages, and Signage

In order to notify students, faculty and staff of incidents happening on campus, Emergency Notification Messages need to be pre-scripted. This section includes information related to how messages will reach students, faculty, and staff, including location and method of communicating warnings and messages.

• Mass Text Notification: a text message will be sent as soon as possible to those who are in the database.
  • Opt-Out Program (phone numbers are automatically added to service; if one would like to remove their number they may do so).
• BrightAuthor: a system that displays information on hallway televisions located throughout campus.
• LSCO email: as possible, information will be sent through this resource.
• LSCO Social Media: as possible, information will be sent through these resources.

D. Activation, Staging, and Mobilization

Emergency Medical Support Staging

The Emergency Management Coordinator or Incident Commander will select, with coordination from EMS, a location secure and close to the location of the incident. This location is where the injured will be taken as soon as possible for medical treatment, triage, and transport. Selection of the staging area will be dependent on the location of the incident.

Family Reunification Assistance

The Emergency Management Coordinator will set up an appropriate location for family reunification. This area will allow those involved in the incident a location to be reunited with friends and family. Considerations should be made for food services, mental health services, and easy public access (note: this area needs to be away from the media).

• Possible locations to consider:
  • Student Center
  • Shahan Events Center

Crime Scene / Interview Staging

The Incident Commander or Emergency Management Coordinator will select an area to conduct interviews for those who were close to, involved with, or have information regarding the incident. Considerations should be taken to:

• Select an area large enough to provide privacy and discourage witnesses from talking to each other
• Provide snacks/water for witnesses
• Provide paper and pens to allow for written statements
• Provide mental health services

E. Incident Recovery Considerations

Address Victims and Families

• Establish a hotline early on for family and friends to call who are looking for information.
• Publish information quickly to the main LSCO website.
• Gather information related to victim identities, extent of injuries, and what hospitals are being utilized.
• Coordinating with the Emergency Command Center, notify the family members using personnel who are specifically trained for this responsibility.
• Procure mental health counselors for employees and families.
• Develop an action plan to handle concerns about returning to work/school.

Consideration for Students, Faculty, and Staff

• Returning to work may be difficult for some. An assessment for time off may need to occur on a case-by-case basis.
• Returning to class may be difficult for some. An assessment for time off may need to occur on a case-by-case basis.
• Mental health services, short-term and long-term, should be offered.
• Funeral leave accommodations.
• Overwork and burnout: the first few days directly after an incident may have many employees working more than usual to cover for absent employees. Consider options for alternate work schedules.

Communicate Internally

• After the initial emergency communications, continue to give updates to students, faculty, and staff regarding the situation.
• Communicate when to return to normal business operations.
• Communicate where to obtain mental health services if needed.
• Identify work location if it has changed.

Communicate Externally

• Contact Chancellor and Office of General Counsel.
• Identify the designated official for responding to media inquiries.
• Determine what information and details the College will provide to the media that will ease community concerns without inciting panic or hindering the investigation.
• Continue to provide updates for several days.

Continue Business Operations

• Implement business recovery/continuity plans: determine which business operations will stay open and which will close temporarily, if any.
• Make re-entry decisions after the site is released by law enforcement.
• Provide safety and security debriefings.
• Fill positions of deceased and injured employees.
• Take actions to ensure employees feel safe. This may include more visible security/police officers for a period of time.
• Determine how the institution will continue operating with limited business operations or with certain areas designated a crime scene.
• Depending on the location of the incident, some business operations may need to be moved to another location temporarily.

VII. Post Incident Review / Debriefing

A post incident review / debriefing should be conducted immediately following an exercise or incident and should involve representatives from each participating agency/organization. Members of the Emergency Response Team, Incident Response Team, and local law enforcement agencies should be included in this meeting. This should include information on the major events, all lessons learned, and a review of any new initiatives developed or identified during the exercise or incident.

The post incident review should also include a discussion of all techniques, tactics, and procedures utilized during the exercise or incident, including what went right and what went wrong. It should identify any issues and the consequences resulting from the potential or actual outcomes of those issues.

Following the post incident review meetings and discussion, an After Action Report and Improvement Plan (AAR/IP) should be written which identifies areas that require improvements, the actions required, the timelines for implementing those improvements, and the organization and party responsible for each action.

The AAR/IP should be shared with all stakeholders, and used to further define the plans and procedures related to incidents at the college.