Active Shooters and the Evolving Threat Environment
By Andrew Woods

This opinion piece conveys the perspective of a UK-based author on the current state of security and terrorism issues across the globe. The piece conveys the perspective of a UK subject who has lived with the threat of domestic and international terrorism all his life. A number of simple but effective strategies are outlined that have been developed through years of practical experience of having to manage terror related issues.

We Always Fight the Last War

Europe and the United Kingdom have faced terror attacks for many years. The asynchronous style and format of attacks have varied but the intended result is always the same. Terror is described by MI5 as: “The use or threat of action designed to influence the government or an international governmental organisation or to intimidate the public, or a section of the public; made for the purposes of advancing a political, religious, racial or ideological cause; and it involves or causes:

  • Serious violence against a person
  • Serious damage to a property
  • A threat to a person’s life
  • A serious risk to the health and safety of the public; or
  • Serious interference with or disruption to an electronic system.

From the IRA bombing in Birmingham to the Bombing of the London underground in 2007, the goals have been the same: to change government policy. For some years the methods to do so have remained similar, until Beslan in 2004, the Mumbai attacks in 2011 and Kenya.

Bombing buildings and public transport had been the preferred method. Planning a bombing campaign requires training and an often complex logistical and support network. The security services across the globe became very good at intercepting and neutralising these threats because of the complexity. Thankfully, the same was true with chemical and biological attacks. In fact, the security services have driven a change in the style of attacks because of their success.

So What Does the New Landscape Look Like?

Many in the security services say “it’s not if but when.” While bombing remains a threat, it may no longer be the tool of choice. Attacks may include bombs – in particular, suicide bombs – but will often feature multiple methods of attack. The style of attacks have three main driving forces:

  • Civilian casualties, which are often more desirable than collateral damage
  • Simple attacks against “soft” targets, which will still make the news
  • Economic shutdown of areas through heightened risk or alleged attacks

Breaking this down into plain English means that the blueprint of such attacks to come will take the form of:

  • Mass attacks: Groups of organised attackers aiming to cause mass casualties such as Paris or San Bernardino
  • Low-intensity attacks: Small numbers using improvised weapons such as cars and knives
  • False reports of terror attacks: Cause authorities to falsely respond

One or a combination of these styles of attack require a smaller logistics and support network than the larger-scale operations described above. In some cases they require none other than the desire to attack – such as the killing of Drummer Lee Rigby. The security services continue to intercept the threats but as we have seen in Brussels and Munich, casualties do not even need to occur for the impact to be large.

With many of the recent incidents the attackers have not only been themselves prepared to die, but see this as a key objective of the operation, along with mass causalities. This will often mean that those taken captive will be executed in cold blood as seen in Belsen, Kenya, Mumbi and Paris, with people having to play dead, running AND escaping as those captured are executed. Even the government advice telling people to hide has been widely criticized as when faced with no choice they may be forced to fight back. Trying to get a bomb on to a plane is complex and time consuming. Training, arming and deploying shooters is less so but still difficult. “Lone wolf” attacks with cars, knives and improvised weapons require little to no planning. It is no leap of the imagination to conclude we will see more mass civilian attacks.

A Nation Responds

A factor that is often overlooked is how a population responds to a terrorist attack. This can best be measured in the ways that France and Belgium responded to the December 2015 attacks.

Following the shootings in Paris many local people flooded the streets the following day to lay flowers and show respect to the fallen, ignoring advice from the local security services.

Conversely, in Belgium the city of Brussels was on total lock down. Many people reporting that shops remained closed, and road and rail were deserted.

Different cities – even different demographic populations – will respond differently.

Significant factors in the selection of future targets include the level of security at a location, if civilians are armed or if armed police or the army are present, and the infrastructure in place to respond. As mentioned above, the logistical differences between an active shooter attack and events such as bombings play a significant role in target selection.

The New Media

The attack in Paris continued the transition of how media reports terror. Material that would never have been shown was broadcast live, uncensored on the internet. In the past any reporter that posted such graphic footage would never have worked again. The Bataclan marked a watershed moment of such unfiltered content.

With 24/7 media now reporting raw feeds directly to websites and TV we can expect to see footage that is more graphic than ever before. Often during a crisis pictures or footage may be posted before the emergency services have arrived.

With live streaming so readily available and ISIS forces already using Go Pro cams in Syria, it will only be a matter of time before we see terrorists live streaming the carnage they are causing as it happens.


With the evolving threats it is vital to understand how to respond and what you as an individual or emergency management professional can do to reduce risks to yourself or organization, particularly in reference to the active shooter scenario which can involve an unknown number of perpetrators and attacks that can vary in length and intensity. The conclusions are split into three sections:

  • Personal
  • Governmental
  • Business


As an individual there are three simple steps you can take to protect yourself:

•    Be alert. Keep your eyes and ears open to what is going on around you.
  • Watch for suspicious activity
  • Turn your music player down so you can hear what is going on
•    Know your location. Look for exits, stair cases and ways out.
•    Do not stop. If you are exiting a location do not stop to take pictures or videos or to call others.

A major question that arises alongside these questions is, “Should I shelter in place or escape?” This is above all a personal decision and it should be remembered that hostages are often not the priority for the attackers.

Taking these three simple steps can significantly increase your chances of survival. It may seem like common sense but some people choose to record video rather than evacuate.

Additional Steps Include:

  • Be prepared. Keep some simple supplies with you – water, a flashlight and a first aid kit. Additional items: Heavy duty gloves and shoes, a dust mask, map, spare power supply for your mobile and eye protection
  • Have a plan. Designate a safe place and know how to get to it.
  • Learn to save a life. Trauma treatment and tourniquets applied by civilians do often save lives. It could even be your own!
  • Exercise. Both your exit strategy and yourself as you may need to walk home.

In many cases where metropolitan centres have been attacked, public and private transport networks have been shut down. Being prepared to walk out or stay overnight is a good precaution to take.


In the event that a major terrorist attack occurs the governmental responses will be focused on containing the attack, managing casualties and managing those directly impacted. Giving clear instructions on how and when to act is essential. After a major incident the lack of public information creates a vacuum of information. This vacuum will be filled by the media or worse social media.

Social media is often seen as a cheap and effective way to quickly communicate with many people during an event. While this can be true it is not a guaranteed solution because:

  • Posts/Tweets age quickly and become outdated or irrelevant.
  • There is no guarantee a person has read the most up to date message.
  • Your feed can be hijacked.

It is critical in a major incident to remain in control and ensure that messages get to the right people at the right time. From evacuating an area to keeping the public informed of critical information this can help reduce casualties, aid in responding to the incident and keep the public informed. A good example was how mass communication was used during the Boston bombings and should serve as a template for how to respond.

  • At the point of the explosions mass communications were used to account for employees and conduct welfare checks.
  • Mass Comms were then used to inform people of route closures and areas to avoid.
  • Finally, mass comms were used in detaining the suspects by keeping residents informed about the police operations.

After some incidents communities will often come together to help restore the area. This sentiment can be a blessing or a curse depending on the situation. It will depend on the attitude towards terror. A good illustration of this is the way that Paris and Brussels reacted after the terror threats and attacks in December of 2015. In Paris many people despite being told to stay in contracted to morn and lay flowers for the lost. While in Brussels business reported a 90% loss of business. Having the community engage and help with a clean-up or donate blood will be seen by the media as a very positive step.


Planning for a terror attack as a business is often seen as a folly as there is a wide held belief that the government will take care of the situation. The police are best equipped and trained to deal with a terrorist incident--but it does not require you to be the specific target to be impacted. The disruption can be far more wide reaching than just the incident location. While the incident is ongoing you may be left to manage the situation as the authorities will be managing the actual incident and its fallout. This may result in businesses needing to rely on your employees and networks to ensure you can carry on working, ensure your employees are safe and manage any additional actions. The disruption for a wide spread terror attack often materialises in restricted access to an office or location. When the next attack happens there are a handful of Golden Rules by which to live:

Have a Plan

  • Contact your employees, especially the travelling ones.
  • Manage the media.
  • Contact governmental bodies if required.
  • Keep your business operation at a minimum acceptable level.
  • Be prepared to manage the emotional fallout of the incident.

Exercise the Plan

  • Ensure that the leadership know the plan.
  • Ensure your employees know how to respond.
  • Have your crisis team plan out different scenarios.

Having a well-rehearsed plan and communication strategy can significantly help you in a terrorist attack but it may also be used in other events. Often the largest concern after an attack is locating and ensuring people are OK. To do this effectively you need a multi modal system as single modes can return results as low as less than 10%, while manual calling trees take far too long, are too labour intense and unreliable.

An area that is often overlooked is the emotional effect of a terror attack. For a person to be affected they do not necessarily need to be involved in the incident. Employees may be shocked or stunned because of the attack. This may result in productivity dropping to employees needing or waiting to go home. It is essential that if this occurs to ensure that you engage with the correct agencies and healthcare professionals. Many larger companies have welfare programs that can be utilised. Services may also be made available through health care and through agencies such as police departments. It is vital to engage with professionals in trauma and grief counselling to ensure the welfare of employees.


In 2016 the threat of global terror is only going to increase. Numerous groups are dedicated to attacking the West. This is underscored with many Police, Army and Governmental bodies saying ‘it’s not if but when.” Attacks will be against softer targets with civilian casualties as the goal. The least protected are seen as the optimal targets, with a primary focus on casualties. While we have limited control of the complex geopolitical situation, we can do our little bit by preparing ourselves, communities and companies.

In this article I have quoted many terrorist attacks and news stories, all illustrating tragic cases where friends, families and loved ones have been lost. The cases I have referenced only represent a small number of the total of global events.

What we can do is be prepared to respond to the event, be prepared for the type of attack and then keep calm and carry on.