Active AttackerOxford Properties

Security Awareness Training July 14, 2012

David R. Neely, CPP

Mr. Neely is board certified as a Security Management Professional by the American Society for Industrial Security, having received the security profession’s highest recognition of practitioners, the Certified Protection Professional (CPP) designation.

Mr. Neely’s distinguished career includes 28 years of service within the criminal justice sector serving both government and private clients. His duties have included corporate security program management, the development and operation of custom security and business services and software solutions, the threat risk assessment of government and commercial facilities and the protection of prominent at-risk-individuals.

Mr. Neely has attended specialized police training including: United States Secret Service, “Presidential Campaign Candidate/Nominee Protection” and is a graduate of the Canadian Police College, Strategic Intelligence Analysis program.

Mr. Neely is a member of the American Society for Industrial Security, the International Association of Chiefs of Police and a former member of the ASIS International Law Enforcement Liaison Council, the International Association of Chiefs of Police Private Sector Liaison Committee and the Fleming College, Security Risk Management Advisory Board.

∗ The threat – what is an active attacker?∗ Characteristics / Behavior(s)∗ Active Attacker Incidents∗ How to Respond

∗ External Threat Near Premise ∗ Internal Threat

∗ Post Incident∗ Resources∗ Summary

Active Attacker

Toronto Police Service definition:An individual or individuals who are actively engaged in killing or attempting to kill people in a confined and/or populated area, usually but not always involving firearms.

What is an Active Attacker

∗ Active attackers have usually experienced some level of rejection with which they cannot cope.

∗ Motives include anger, revenge, ideology and untreated mental illness.

∗ May result from structured life, no sense of belonging leading to no sense of identity.

∗ Rejections may lead the individual(s) to blame other persons or institutions and lead to their becoming violent.

Active Attacker Charactersitics

Indicators/ warning signs∗ obsession with video games.∗ personal crisis signs.∗ interest in fire arms, sudden/increased firearms training.∗ pre-operational training (in a majority of past cases

individuals have trained with their firearms).∗ Workplace violence indicators.

Active Attacker Characteristics

Active Attacker Incidents

Some examples include:

∗Columbine, 1999.∗Union Station, 2006.

∗ - TD Centre∗Eaton’s Centre, 2012.∗Mumbai, 2008.∗Norway, 2011.

Some Lessons Learned:∗Tourism/Hospitality destinations continue to be attractive and vulnerable targets.∗Venues with high human density are especially attractive.∗Landmark and iconic targets guarantee media coverage.∗In the case of terrorism, multiple, simultaneous targets common. (Hotel, Jewish Community Centre, Restaurant, Train Station, Hospital, Police Station).

Active Attacker Incidents

Police Lessons Learned:∗Active attacker incidents are unpredictable and evolve quickly. Typically there is no pattern in the selection of victims.∗The immediate deployment of Police is required.∗Toronto Police Service – “It is now unacceptable for Police to officers to simply respond to an ongoing shooting incident and simply contain the premise or area and await the arrival of skillfully trained tactical units.”

Active Attacker Incidents

External Threat Near Premise:∗Hold and Secure

∗ Movement in and out of building is restricted due to possible external police action.

∗ Persons outside should enter the building, exterior doors should be locked and monitored to ensure no one is locked outside and exposed to threat.

∗ Movement within building may continue avoiding windows/doors.

How to Respond

Internal Threat - Possible Active Attacker:∗Lockdown Procedure

∗ All movement in and out restricted.∗ Occupants move to designated safe areas/rooms and

lock doors.∗ Remain quiet, silence cell phones, account for persons

in your safe area and note last known location for those missing.

∗ Wait to be released from safe area/room by Police.

How to Respond

∗ Determine the most reasonable way to protect life. If there is an accessible escape path, and if safe to do so, evacuate away from the threat.

∗ If Police are already on scene, exit in the direction the officers are entering.

∗ Keep your hands raised and visible at all times.

How to Respond(Security)

∗ Obtain description, clothing, location of suspect(s), direction of travel, weapon(s) if known.

∗ Number of victims, locations and extent of injuries.∗ Give details to Police if possible.∗ Provide a radio for responding police that will

communicate with building operations for CCTV feeds.

∗ Provide master keys, access cards for responding police.

How to Respond(Security)

∗ If safe evacuation is not possible, move people to as safe an area as possible, hide.∗ Be out of attackers view.∗ Prevent an active attacker from entering your hiding

place, secure and lock the door, stay out of view of windows and doors.

∗ Silence your cell phone and remain quiet.

How to Respond(Security)

∗ You should know that:∗ Employees/visitors are likely to follow the lead of

uniform personnel and managers during an emergency.∗ On average active attack phase lasts 10 minutes.∗ Police consider active attackers as terrorists and

respond accordingly. The attacker’s intent is to kill as many people as possible.

∗ Incidents typically end with the death of the attacker(s) by suicide or deadly force.

How to Respond(Security)

∗ Remember the location is now a crime scene and will no longer be accessible. BCP comes to life.

∗ Prepare for media & crisis communications.∗ Establish a media centre, stand-up location and

appoint a PIO.∗ Establish a location for communication with families &

loved ones. (Nearby hotel, RBC/Oxford location, 1-800, social media, twitter, PTSD Care, etc. )

Post Incident

∗ Toronto Police - Threats to School Safety Video - Active Attacker Response

https://www.tapps.org/portal/SmartDefault.aspx?at=1716

∗ USA DHS: Active Attacker- What You Can Dohttp://emilms.fema.gov/IS907/index.htm

Resources

∗ Active attacker, individual(s) actively engaged in killing or attempting to kill people.

∗ Motives include anger, revenge, ideology, untreated mental illness.

∗ Tourism/hospitality destinations continue to be attractive targets – lots of people.

∗ Police active measures response = terrorism∗ Response to external threat = hold & secure.

Summary

∗ Internal threat – possible active attacker = lockdown∗ Under attack = use common sense, escape if safe to

do so, away from threat∗ Provide information, keys, radio to police∗ Can’t escape = hide (cover vs. concealment)∗ Secure safe area, remain out of sight, quiet, phones

off.∗ Wait for police all clear.

Summary

∗ Post incident – site is a crime scene, BCP activate∗ Media & crisis communications.∗ Friends & family information.∗ Post incident care, counselling.

Summary

Thank you

∗ Questions?