Active threats: what the research shows and the first officers' role

At 08:00 on Sunday, June 7, the doors of Harbor Point Mall opened for something other than shopping. Two hundred people were inside: police officers, firefighters, paramedics, mall security staff, dispatchers, volunteers playing shoppers and injured people, and observers from the hospital and the city's emergency management office. At 08:47, a volunteer playing a store employee called 911 to report a man shooting in the food court. The full-scale exercise had begun. Desjardins and his students watched from the observers' area on the second floor. 'Everything you have learned so far in this course says slow down,' he tells them beforehand. 'This is the one call where that rule turns around. Watch what that does to people.'

An active threat, often called an active shooter or active assailant incident, is one in which a person is actively killing or attempting to kill people in a populated area, usually with firearms, but sometimes with knives, vehicles or other weapons. What makes it different from every other call in this course is that the harm is happening now and will continue until someone stops it. Containment does not help the people inside. Waiting does not help. This lesson covers the history and evidence that changed how police respond, and the first officers' role. Lesson 9 covers rescue and medical care. The tactics officers use are taught in supervised, scenario-based training and are not part of this course.

How the response changed

For decades, the police response to a person shooting inside a building followed the same model as a barricade: the first officers contained the scene and waited for a tactical team. That model was built for barricades and hostage incidents, where time helps. It failed at Columbine High School in Littleton, Colorado, on April 20, 1999. Two students killed twelve students and a teacher and wounded many others. Patrol officers who arrived set up a perimeter as they had been trained to do. Tactical teams took time to assemble and then searched the large building slowly. A teacher, Dave Sanders, who had been shot, bled for hours in a classroom before he was reached, and died.

After Columbine, police agencies across North America changed their training. The new principle was that the first officers to arrive, whoever they are and however few, move toward the threat and stop it, without waiting for a tactical team. Training programs such as the one developed at the Advanced Law Enforcement Rapid Response Training Center at Texas State University, known as ALERRT and founded in 2002, spread this approach. In 2013, the FBI adopted ALERRT training as its national standard for active shooter response training for law enforcement.

Other incidents shaped the response further. At Marjory Stoneman Douglas High School in Parkland, Florida, in February 2018, where seventeen people were killed, the school resource officer remained outside the building during the attack; a state commission found serious failures, and the officer was later tried and acquitted of criminal charges. At Robb Elementary School in Uvalde, Texas, on May 24, 2022, nineteen children and two teachers were killed. Nearly 400 officers from many agencies responded, but 77 minutes passed between the arrival of the first officers and the moment officers entered the classroom and killed the attacker. The U.S. Department of Justice's Critical Incident Review, published in January 2024, found that the response was a failure, and that officers treated the incident as a barricaded subject situation instead of an active shooter.

What the research shows

The best-known study of active shooter incidents in the United States is the FBI's 2014 study of 160 incidents between 2000 and 2013, which killed 486 people and wounded 557. Of the 64 incidents in which the duration could be determined, 44 ended in five minutes or less, and 23 of those ended in two minutes or less. Many incidents ended before police arrived, often because the attacker stopped, left or killed themselves, and in some cases because unarmed people restrained the attacker. The FBI continues to publish annual reports. It counted 48 active shooter incidents in 2023 and 24 in 2024, a fall of half, while noting that a single year does not make a trend.

The research has two practical lessons. First, because most incidents are over within minutes, what matters most is what happens in the first minutes: how quickly people inside get away, hide or defend themselves, how quickly the call reaches police, and how quickly the first officers can act. Second, because incidents that last longer often involve the attacker continuing to look for victims, every minute the police take to reach and stop the attacker can cost lives. A study by ALERRT researchers of incidents where officers engaged the attacker found that officers were often alone or with one partner when they did so, which is why training now prepares every patrol officer for this role.

The first officers' priorities

The first officers' priorities on an active threat can be stated in a few words that ALERRT and many services teach: stop the killing, then stop the dying. Stopping the killing means locating and stopping the attacker as quickly as possible, by whatever lawful means are needed. Every other task, including helping the wounded, evacuating people and gathering evidence, comes after the threat is stopped, or is done by other officers and responders as they arrive. That order is hard for officers, because they will pass wounded people asking for help on the way to the threat. Training addresses that directly, because the officers who stop to help the first wounded person they see may leave the attacker free to wound many more.

Once the attacker is stopped or no longer active, the priority shifts to stopping the dying: getting medical care to the wounded as fast as possible. Lesson 9 covers how that is done. At the same time, officers must keep in mind that there may be more than one attacker, that explosives or other hazards may be present, and that the scene is still dangerous.

Information on an active threat

Active threat calls bring a flood of information, much of it wrong. Callers inside report shooters in several places at once because sound echoes. People see armed police officers, armed security guards or armed members of the public and report them as additional attackers. Descriptions conflict. Dispatchers and the first officers must pass on what is known, label what is reported, and update quickly. Officers entering the building need the attacker's last known location, description and weapon, the number of people believed injured, and the location of any wounded or trapped people. They also need to know who else is armed and inside, including other officers and armed security, so that they do not mistake them for the threat.

Dispatchers carry a large part of this burden. They take the first calls, often from people whispering from hiding places, and must decide in seconds what to broadcast. Good practice is to broadcast the location, description and weapon as soon as one caller gives them, to label them as reported until confirmed, to keep callers on the line to give updates, and to tell callers who are hiding to stay quiet and stay where they are unless they can get out safely.

Misidentification is a real danger. Plainclothes officers, off-duty officers, security guards and armed members of the public who intervene have been shot by responding police in several incidents in North America. Many services now train officers who are not in uniform to follow specific identification procedures when uniformed officers arrive, and train uniformed officers to expect that armed people they see may not be the attacker. Haddad says the hardest moment of her own active threat training was a scenario in which the armed man she found was a security guard. 'Everything says the man with the gun is the shooter. You have about a second to see the badge on his chest and hear what he is shouting. That is why we train it.'

The law of lethal force on an active threat

The law of deadly force on an active threat is the same as everywhere: under Graham v. Connor and Tennessee v. Garner, deadly force is reasonable when an officer has probable cause to believe that a person poses a threat of death or serious physical harm to the officer or others. A person who is actively shooting at people clearly meets that standard. The legal questions on these calls usually arise at the edges, such as whether a person seen holding a firearm was in fact the attacker, or whether force continued after the threat ended. In Ohio, police shootings are commonly investigated by the Bureau of Criminal Investigation and reviewed by a prosecutor.

There is also a question that reviews of Parkland, Uvalde and other incidents have raised in public: is there a duty to act? Courts in the United States have generally held that police do not have a constitutional duty to protect particular individuals from harm by others, as in DeShaney v. Winnebago County in 1989 and Castle Rock v. Gonzales in 2005. But police policy and training in both countries now expect every officer to move toward an active threat, and officers who do not can face discipline and loss of their careers, as several did after Uvalde. Desjardins tells the students that the legal question misses the point. 'This is the one call where the public has the right to expect you to go in. That expectation is part of the job you are choosing.'

What the exercise showed

At Harbor Point Mall, the first two officers arrived at 08:52, five minutes after the call. They went in through the main entrance toward the food court, reporting what they saw. At 08:55, they reached the role player playing the attacker and the exercise controllers called the threat stopped. The observers' notes, which Desjardins shares with the class, recorded both strengths and problems. The officers passed several role players playing wounded people without stopping, as trained, but told them over their shoulders that help was coming. One officer broadcast the attacker's location clearly; the other's radio transmissions were cut off because he was speaking too fast. And a mall security guard who was part of the exercise, carrying no weapon but wearing a dark uniform, was briefly mistaken for a second attacker by the third officer to arrive.