Managing the Active Shooter Attack or Hostile Incident

In November 2015 the world watched helplessly while nine terrorists executed the deadliest attack on France, since the second world war. The attack took the lives of 130 people while injuring another 413. This would later be described as a terrorist initiated “complex coordinated attack” or CCA. While the majority of first responders working in suburban and rural areas are unlikely to experience an attack of this complexity, we shouldn’t be complacent to the possibility that a well planned and executed attack anywhere in the United States, could quickly become complex in regards to your immediate resources. In this article we are going to discuss some of the concepts to help you prepare to manage the basic to complex hostile incident. image

Knowing Building relationships may be the most important component to the pre-planning of a hostile incident. All of the money in the world will be of little value if egos and jurisdiction disputes rule the day.


One of my mentors once told me that the most important piece of large-scale incident management, was “money and relationships.” In the past three articles we have described the amount of training and equipment it requires to be adequately prepared for a hostile incident. It is no secret; this preparation comes at a cost. As with all things in emergency services, if the administration on the fire/EMS side or law enforcement (LE) side, are not willing to invest in the program, the success will mirror the investment. When contracting with agencies I always like to encourage administrators that the cost of training and equipment is a drop in the bucket compared to the political and emotional cost of failing to succeed in a future hostile incident.

Building relationships may be the most important component to the pre-planning of a hostile incident. All of the money in the world will be of little value if egos and jurisdiction disputes rule the day. These incidents are not managed by fire or police, they are managed by fire and police. If you have non-fire-based EMS, they will be a critical player and need to be at the table every bit as much as fire and law. From there, the relationships need to continue to grow beyond responders. Hospital staff, school officials, Red Cross, and local transit officials just to name a few are all critical players in the successful management of a hostile incident.

In my jurisdiction, local school officials have gone as far as consulting with fire and law to set standard construction practices that will enhance preparedness and response capabilities should an active shooter event happen. Do your hospitals mass casualty incident (MCI) plans integrate with your active shooter plans? Has your hospital considered how many gunshot victims they can take, compared to the injuries experienced in a typical bus crash?

One of the most challenging pre-planning tasks I have ever done was planning for an active shooter incident that started in the hospital. Making the investment — physically and financially — in pre-planning, is likely going to be the most critical component for success in managing a low complexity multi-patient shooting incident, or a complex coordinated attack.

Initial Operations

As all emergent operations do, strategic thinking starts at the time of dispatch. No different than a structure fire, the Incident Command (IC) should be considering resources compared to possible complexity before the keys to BC buggy are ever turned on. The first due IC should start considering known and unknown variables. Some of the known factors are:

  1. Building size and occupancy potential vs. time of day
  2. First due and mutual aid resources
  3. Capabilities and limitations of responders
  4. Initial hot, warm and cold zone areas

Some of the unknown variables:

  1. Law enforcement availability and response times
  2. Current hospital capacity and capabilities
  3. Number of shooters
  4. Types of weapons
  5. Potential IEDs
  6. Actual patient numbers
  7. Dispatch information.

I encourage all initial ICs to associate resources with occupancy potential and never dispatch information. If you listen to radio traffic from most active shooter incidents, you will notice the patient numbers start in the single digits and can end up being closer to 10 to 15 times that, as was the case in the Aurora Theater shooting. On duty incident commanders should have access to an LE radio or the availability to scan their channel. This initial information is going to be critical for the IC to hear firsthand, not repeated through fire/EMS dispatch.

Once on scene, the IC should establish a forward tactical operations post and assign a staging manager. This will be located in the cold zone but away from staging. An on-duty battalion or district chief will be best suited in an operations position or as FEMA refers to it, “triage group supervisor.” In the initial stages this individual will likely be command, but as the incident expands, command should be taken over by LE with fire/EMS chiefs who are in a mobile or fixed command post. This leaves the initial IC still making tactical decisions from a forward operating position.

To replace the first arriving chief officer and take them out of tactical decision making would be catastrophic in a complex, rapidly evolving event like a hostile incident. The best place to put a forward tactical operations post is best decided by LE. Under the FEMA PER 335 program, the fifth arriving officer is tasked with taking command of the incident and not making entry. The first arriving chief officer should coordinate with this LE officer and establish a safe place to set the forward operating post. Once a more senior LE supervisor arrives, they will take command from the “fifth man who becomes “tactical.”

Just like fire, leaving the initial law enforcement IC in the forward tactical position is critical for continuity. Under the FEMA guidelines, LE becomes the overall Incident Commander working in conjunction with fire and EMS. This shouldn’t be a territorial debate that it often is; the majority of operations during this incident, law enforcement is going to be responsible for. With strong relationships built prior to the incident, LE will likely rely on the incident management experience of the fire department.

When to Launch the Rescue Task Force

The next big tactical and strategic decision is when to switch from an LE mission, to a rescue operation, or in other words, when do you launch the Rescue Task Force (RTF)? In general, it should be immediately following the capture, containment, or killing of the active shooter. However, there is a multitude of variables that are going to affect this; I.E. what if there is reports of two shooters, what if the shooter left the premises, what if there is report of IED’s? The short answer is that the LE officer and the first arriving fire/EMS commander standing next to each other, are going to plan based on the totality of the information they have at that time. These two decision makers are going to have to conduct a threat analysis and decide if the known risks and unknown risks are mitigated to a sufficient level to support placing fire/EMS into the warm zone.

Just remember, the warm zone will never be without risk, however, if we rely on FBI data that studied 13 years of active shooter incidents, we can glean the following information; by the time fire/EMS has arrived on scene, donned PPE, and made entry to the warm zone (greater than five minutes), there is a 98 percent chance the shooter has been killed, killed themselves, fled the scene and is actually a lone shooter (, 2014). This data pretty easily justifies the statistical safety of early entry of rescue task forces into the warm zone.

Once rescue task forces are deployed, a transport group supervisor should be added to the forward operating post. This will make sure that ambulances are coordinated with tactical and RTF movements. The transport supervisor should coordinate where to set up “ambulance exchange points” or AEPs, these are where RTFs will transfer patients to ambulances. They should also be responsible for spinning up your regional MCI plan with the hospital as well as coordinating patient transport. AEPs can also be casualty collection points (CCP). In incidents where patients are spread across large geographical areas, AEPs and CCPs will be spread across the incident. Don’t get trapped in a traditional single CCP mindset, this is not a bus crash.

As this incident expands, there will be a need to implement more command staff at the Command Post as much as there is a need to supplement boots on the ground. In in the early stages of the incident, tough decisions will have to be made to fill operational positions or supervisory positions. While it may seem important to have an IC, fire/med branch supervisor, transport group supervisor, and staging officer in place prior to launching your RTF; it is of little utility if you have no one to staff the RTF. Possibly worse, all the patients have now perished in the time it took to set up a text book command structure. In the initial stages, the first arriving IC may be the entire command structure to facilitate getting responders treating and extracting victims. We must always remember, that if victims are not treated rapidly, we are really just managing the patients that would have survived regardless of us responding.


Let’s recap a few of the fundamentals we have discussed; pre planning and training will decide the success of your incident long before it ever happens. Without a commitment to financial support and building relationships, your incident performance will be a mirror of your commitment level. Strategic thinking starts at dispatch with known and unknown variables. The first on scene chief officer should be standing next to an LE supervisor as soon as possible. Well-staffed command structures are great, unless it is at the cost of boots on ground, treating victims rapidly. Finally, we must always remember that even the best planned and trained for hostile incidents will at best, be controlled chaos, we must remember the mission; treat, extract and transport as many victims as fast as possible.

Ryan Scellick is a 19-year fire service veteran and currently serves as a Ladder Captain in Pasco, WA. He spent five years a commissioned SWAT Operator and Tactical Paramedic. He teaches nationally with his company Active Shooter Solutions and Consulting since 2010 and as an adjunct instructor for Fire by Trade. He can be reached at

Contact Us

"*" indicates required fields

This field is for validation purposes and should be left unchanged.