Background Information While the tragedies at Columbine High School in 1999 and Virginia Tech in 2007 made the phrase domestic terrorist part of the lexicon of organizational safety and security, active shooter terrorist incidents can be traced back to the 1960’s. They have occurred in shopping malls, schools, government buildings, and a wide range of business facilities, including company offices, warehouses, and factories. In an analysis of 281 domestic terrorist active shooter incidents from 1966 to 2010, the New York City Police Department Counterterrorism Bureau found significant variation among planning tactics, targets, and attack methods. Of the 202 incidents that occurred in the United States and resulted in casualties, the bureau found the following: · 98 percent were carried out by a single attacker · The modal age of the terrorist shooter in non-school incidents was 35-44 · About 96 percent were male · 36 percent of attacks involved more than one weapon · Shooter terrorists often know their targets An active terrorist shooter is an individual actively engaged in killing or causing serious injury to persons in a populated area. Often the person is uncontained and difficult to isolate, typically moving to an unknown destination. In many cases, they use firearms with no apparent pattern or method to their selection of victims. People rarely “just snap”. These individuals normally have a history of violent behavior – whether reported or not – and they usually plan for violent actions following a trigger. This can include being fired, laid off, or demoted; a negative performance evaluation or difficult personal events. While no single profile exists to predict violent terrorist behavior, potentially violent persons may exhibit certain noticeable activities. The following list is not comprehensive, nor is it intended to diagnose or predict violent actions: Thoughts · Talk of previous violent incidents · Unsolicited focus on dangerous weapons · Paranoid thinking · Overreaction to workplace changes Feelings · Depression or withdrawal · Unstable, emotional responses · Feeling either arrogant and supreme or powerless · Intense anger or hostility Behaviors · Increased use of alcohol or drugs · Violations of company policy · Increased absenteeism · Exploiting or blaming others Scenario You are a member of the Emergency Response Crisis Management Team for ABC, Financial Inc. and the company has recently consolidated operations to one building from four separate buildings. The new building now houses 2,000 employees. Your team has been tasked with developing a detailed emergency response plan for the new office building and you are to involve local law enforcement in onsite training and drills. ABC Financial Inc. has had financial struggles over the last several years and the mortgage business unit may be sold to outside investors. Over 1,000 employees may be affected by the sale of the mortgage business. The Foreclosure Department has 50 emplo ...

1. Background Information
While the tragedies at Columbine High School in 1999 and
Virginia Tech in 2007 made the phrase domestic terrorist part of
the lexicon of organizational safety and security, active shooter
terrorist incidents can be traced back to the 1960’s. They have
occurred in shopping malls, schools, government buildings, and
a wide range of business facilities, including company offices,
warehouses, and factories.
In an analysis of 281 domestic terrorist active shooter incidents
from 1966 to 2010, the New York City Police Department
Counterterrorism Bureau found significant variation among
planning tactics, targets, and attack methods. Of the 202
incidents that occurred in the United States and resulted in
casualties, the bureau found the following:
· 98 percent were carried out by a single attacker
· The modal age of the terrorist shooter in non-school incidents
was 35-44
· About 96 percent were male
· 36 percent of attacks involved more than one weapon
· Shooter terrorists often know their targets
An active terrorist shooter is an individual actively engaged in
killing or causing serious injury to persons in a populated area.
Often the person is uncontained and difficult to isolate,
typically moving to an unknown destination. In many cases,
they use firearms with no apparent pattern or method to their
selection of victims.
People rarely “just snap”. These individuals normally have a
history of violent behavior – whether reported or not – and they
usually plan for violent actions following a trigger. This can
include being fired, laid off, or demoted; a negative
performance evaluation or difficult personal events.
While no single profile exists to predict violent terrorist
behavior, potentially violent persons may exhibit certain
noticeable activities. The following list is not comprehensive,

2. nor is it intended to diagnose or predict violent actions:
Thoughts
· Talk of previous violent incidents
· Unsolicited focus on dangerous weapons
· Paranoid thinking
· Overreaction to workplace changes
Feelings
· Depression or withdrawal
· Unstable, emotional responses
· Feeling either arrogant and supreme or powerless
· Intense anger or hostility
Behaviors
· Increased use of alcohol or drugs
· Violations of company policy
· Increased absenteeism
· Exploiting or blaming others
Scenario
You are a member of the Emergency Response Crisis
Management Team for ABC, Financial Inc. and the company has
recently consolidated operations to one building from four
separate buildings. The new building now houses 2,000
employees.
Your team has been tasked with developing a detailed
emergency response plan for the new office building and you
are to involve local law enforcement in onsite training and
drills.
ABC Financial Inc. has had financial struggles over the last
several years and the mortgage business unit may be sold to
outside investors. Over 1,000 employees may be affected by the
sale of the mortgage business. The Foreclosure Department has
50 employees. Within the Foreclosure Department, there is an
individual by the name of John Smith. Smith has been on edge
the last few months. He is a loner, does not get along with his
peers or supervisor, and his performance is lacking. There are
rumors that Smith has had a history of violent behavior but none
appeared on his background investigation for employment with

3. ABC. He is also known to have firearms. Management is
considering terminating Smith for performance deficiencies and
that, along with the pressures of the business unit closing, has
put a great deal of pressure on Smith and the employees in the
business unit.
The information concerning Smith is provided to the Emergency
Response Crisis Team. What, if anything, should the team do
concerning Smith?
Two weeks later management decides to terminate Smith from
employment on Friday because of performance issues. As he is
leaving Smith tells his supervisor and 4 other employees in the
Foreclosure Department unit that “you have not heard the last
from me”. Security escorts him from the building and
deactivates his access control badge.
What does your team do with the information concerning the
remarks from Smith? Think about intelligence gathering,
notifications etc…
Monday morning at ABC Financial Inc. the following occurs:
8:00 am – Security is notified that an individual matching the
description of Smith has entered ABC Financial Inc. with
several firearms. The individual demanded and obtained an
employees’ access control badge in the lobby and gained full
access to the building.
· Referring to the detailed emergency response the team
developed, what preparations should the company have in place
to handle this situation?
· What specific plans should have been established prior to the
incident?
· What are the immediate considerations?
8:02 am – What decisions and actions should you consider now
that 911 has been called by Security:
· What are your concerns?
· What are your immediate actions?
8:03 am – Security notifies occupants of an armed intruder in
the building:
· What factors affect the announcement’s content and delivery?

4. · What actions should be taken once the announcement is made?
8:05 am – Security and 911 operators are overwhelmed with
phone calls from nearly 2,000 employees in the building:
· What are the key questions, concerns and actions at this point?
· Should employees shelter in place or try to evacuate?
· For those that have evacuated, management is trying to
account for the employees in mustering locations in the parking
lot but some employees are fleeing the area and family members
are breaking through crime scene tape to assist their loved ones.
How should management and law enforcement handle this
situation?
8:07 am – Police and first responders arrive and meet with
representatives from your team:
· What actions do you take to assist emergency responders?
· Do you make a second announcement to employees? Why or
why not? Consider the pros and cons.
· How do you handle arriving media?
8:08 am – Police response shifts from crisis to tactical:
· Now that law enforcement is onsite at the facility, how does
the team coordinate efforts with them?
8:10 am - Gunshots are heard in the building and people are
seen fleeing:
· What are the key questions and concerns at this point?
8:12 am – Reports indicate the terrorist shooter is heading to
the Foreclosure Department:
· What particular concerns do you have at this point?
· What actions do you take?
8:15 am – Police notify security that the shooter has been killed
but they are continuing their search:
· Is the threat over?
· What needs to be done now?
8:30 am – Police inform security that there are no additional
shooters and initiate formal evacuation:
· How do the company and responders coordinate at this point?
8:45 am – Police notify your team of 5 fatalities and 7 injured
in the Foreclosure Department:

5. · What priorities does the team now have?
· Does the team have suggestions for a “To Do” list?
9:30 am – Your team is told that the injured are being taken to
hospitals and Police need help identifying the injured:
· How does your team assist authorities at this point?
10:30 am – Identities of the 5 deceased are provided to your
team and company executives:
· What are the keys concerns and decisions at this point?
11:50 am – ABC Financial Inc. releases official media statement
and is notified by the Police that the site is now a crime scene
indefinitely, with a need that all employees stay out of the
building until further notice:
· Are there any further issues that need to be addressed by the
team and management?
What are team’s “Lessons Learned” from this event? Provide
specifics.
Should there be a debriefing/hotwash with the stakeholders
(company, law enforcement) to discuss best practices, lessons
learned and an after-action report completed? Why or why not?