Active threats: what the research shows and the first officers' role

At 08:00 on Sunday, June 7, the doors of Harbour Point Mall opened for something other than shopping. Two hundred people were inside: police officers, firefighters, paramedics, mall security staff, dispatchers, volunteers playing shoppers and injured people, and observers from the hospital and the city's emergency management office. At 08:47, a volunteer playing a store employee called 911 to report a man shooting in the food court. The full-scale exercise had begun. Desjardins and his students watched from the observers' area on the second floor. 'Everything you have learned so far in this course says slow down,' he tells them beforehand. 'This is the one call where that rule turns around. Watch what that does to people.'

An active threat, often called an active shooter or active assailant incident, is one in which a person is actively killing or attempting to kill people in a populated area, usually with firearms, but sometimes with knives, vehicles or other weapons. What makes it different from every other call in this course is that the harm is happening now and will continue until someone stops it. Containment does not help the people inside. Waiting does not help. This lesson covers the history and evidence that changed how police respond, and the first officers' role. Lesson 9 covers rescue and medical care. The tactics officers use are taught in supervised, scenario-based training and are not part of this course.

How the response changed

For decades, the police response to a person shooting inside a building followed the same model as a barricade: the first officers contained the scene and waited for a tactical team. That model was built for barricades and hostage incidents, where time helps. It failed at Columbine High School in Littleton, Colorado, on April 20, 1999. Two students killed twelve students and a teacher and wounded many others. Patrol officers who arrived set up a perimeter as they had been trained to do. Tactical teams took time to assemble and then searched the large building slowly. A teacher, Dave Sanders, who had been shot, bled for hours in a classroom before he was reached, and died.

After Columbine, police agencies across North America changed their training. The new principle was that the first officers to arrive, whoever they are and however few, move toward the threat and stop it, without waiting for a tactical team. Training programs such as the one developed at the Advanced Law Enforcement Rapid Response Training Center at Texas State University, known as ALERRT and founded in 2002, spread this approach. In 2013, the FBI adopted ALERRT training as its national standard for active shooter response training for law enforcement.

In Canada, the 1989 killing of fourteen women at École Polytechnique in Montreal, an attack targeting women, had already led to reviews of police response, and Canadian services adopted rapid deployment training after Columbine. At Dawson College in Montreal in September 2006, officers who were already nearby on an unrelated call entered the building within minutes and engaged the attacker, who killed one student and wounded others before taking his own life. That response was widely cited as showing that rapid intervention saves lives. The April 2020 attacks in Nova Scotia, in which a man disguised as an RCMP officer and driving a replica police car killed twenty-two people across rural communities over thirteen hours, showed different challenges: a moving threat over a large area, and failures in command and in warning the public that the Mass Casualty Commission examined in its 2023 final report.

What the research shows

The best-known study of active shooter incidents in the United States is the FBI's 2014 study of 160 incidents between 2000 and 2013, which killed 486 people and wounded 557. Of the 64 incidents in which the duration could be determined, 44 ended in five minutes or less, and 23 of those ended in two minutes or less. Many incidents ended before police arrived, often because the attacker stopped, left or killed themselves, and in some cases because unarmed people restrained the attacker. The FBI continues to publish annual reports. It counted 48 active shooter incidents in 2023 and 24 in 2024, a fall of half, while noting that a single year does not make a trend.

The research has two practical lessons. First, because most incidents are over within minutes, what matters most is what happens in the first minutes: how quickly people inside get away, hide or defend themselves, how quickly the call reaches police, and how quickly the first officers can act. Second, because incidents that last longer often involve the attacker continuing to look for victims, every minute the police take to reach and stop the attacker can cost lives. A study by ALERRT researchers of incidents where officers engaged the attacker found that officers were often alone or with one partner when they did so, which is why training now prepares every patrol officer for this role.

The first officers' priorities

The first officers' priorities on an active threat can be stated in a few words that ALERRT and many services teach: stop the killing, then stop the dying. Stopping the killing means locating and stopping the attacker as quickly as possible, by whatever lawful means are needed. Every other task, including helping the wounded, evacuating people and gathering evidence, comes after the threat is stopped, or is done by other officers and responders as they arrive. That order is hard for officers, because they will pass wounded people asking for help on the way to the threat. Training addresses that directly, because the officers who stop to help the first wounded person they see may leave the attacker free to wound many more.

Once the attacker is stopped or no longer active, the priority shifts to stopping the dying: getting medical care to the wounded as fast as possible. Lesson 9 covers how that is done. At the same time, officers must keep in mind that there may be more than one attacker, that explosives or other hazards may be present, and that the scene is still dangerous.

Information on an active threat

Active threat calls bring a flood of information, much of it wrong. Callers inside report shooters in several places at once because sound echoes. People see armed police officers, armed security guards or armed members of the public and report them as additional attackers. Descriptions conflict. Dispatchers and the first officers must pass on what is known, label what is reported, and update quickly. Officers entering the building need the attacker's last known location, description and weapon, the number of people believed injured, and the location of any wounded or trapped people. They also need to know who else is armed and inside, including other officers and armed security, so that they do not mistake them for the threat.

Dispatchers carry a large part of this burden. They take the first calls, often from people whispering from hiding places, and must decide in seconds what to broadcast. Good practice is to broadcast the location, description and weapon as soon as one caller gives them, to label them as reported until confirmed, to keep callers on the line to give updates, and to tell callers who are hiding to stay quiet and stay where they are unless they can get out safely.

Misidentification is a real danger. Plainclothes officers, off-duty officers, security guards and armed members of the public who intervene have been shot by responding police in several incidents in North America. Many services now train officers who are not in uniform to follow specific identification procedures when uniformed officers arrive, and train uniformed officers to expect that armed people they see may not be the attacker. Haddad says the hardest moment of her own active threat training was a scenario in which the armed man she found was a security guard. 'Everything says the man with the gun is the shooter. You have about a second to see the badge on his chest and hear what he is shouting. That is why we train it.'

The law of lethal force on an active threat

The law of lethal force on an active threat is the same section 25(3) of the Criminal Code that applies everywhere: an officer may use force intended or likely to cause death or grievous bodily harm when the officer believes on reasonable grounds that it is necessary to protect the officer or anyone under the officer's protection from death or grievous bodily harm. A person who is actively shooting at people clearly meets that test. The legal questions on these calls usually arise at the edges, such as whether a person seen holding a firearm was in fact the attacker, or whether force continued after the threat ended. Every police use of lethal force in Ontario is investigated by the Special Investigations Unit.

There is also a question that reviews of Parkland, Uvalde and other incidents have raised in public: is there a duty to act? Courts in the United States have generally held that police do not have a constitutional duty to protect particular individuals from harm by others, as in DeShaney v. Winnebago County in 1989 and Castle Rock v. Gonzales in 2005. But police policy and training in both countries now expect every officer to move toward an active threat, and officers who do not can face discipline and loss of their careers, as several did after Uvalde. Desjardins tells the students that the legal question misses the point. 'This is the one call where the public has the right to expect you to go in. That expectation is part of the job you are choosing.'

What the exercise showed

At Harbour Point Mall, the first two officers arrived at 08:52, five minutes after the call. They went in through the main entrance toward the food court, reporting what they saw. At 08:55, they reached the role player playing the attacker and the exercise controllers called the threat stopped. The observers' notes, which Desjardins shares with the class, recorded both strengths and problems. The officers passed several role players playing wounded people without stopping, as trained, but told them over their shoulders that help was coming. One officer broadcast the attacker's location clearly; the other's radio transmissions were cut off because he was speaking too fast. And a mall security guard who was part of the exercise, carrying no weapon but wearing a dark uniform, was briefly mistaken for a second attacker by the third officer to arrive.