Active Shooter Response

Tragedies at Paris, Brussels, Orlando, Nice, Berlin, Manchester, London, and other recent incidents in the West have galvanized a wave of self-reflection for both policymakers and individuals. The grief, confusion, and anger that comes about in the days following such attacks typically brings with it a deeper introspection into the best practices to prevent and respond to acts of terror aimed at ‘soft targets’ of civilian entertainment and daily life. 

This new wave of grassroots terrorism in Europe and North America reminds us of the importance for all persons – civilians, first responders, military, and the like – to heed lessons that have been hard learned in what to keep an eye out for, how to respond, and how to keep yourself and others safe in the face of targeted violence borne of extremism. Such best practices tend to deal more with the methods employed in an attack rather than the underlying philosophies that might drive such attacks (such as militant Salafi jihadism or far-right extremism). This is about behaviour – not appearance. Factors such as race, language, ethnicity, age, religion, gender, and other personal traits are not suspicious and cannot be used to identify a terrorist. There is no ‘one-size-fits-all’ profile for a would-be terrorist. Rather, supporting public safety is everyone’s responsibility and must be balanced with the inherent responsibility of liberal democracies to protect their citizens’ individual rights and freedoms. 

Individually, many behaviours are not inherently suspicious, however, collectively they can give law enforcement the support and cooperation necessary to keep the public safe. This article serves to bring some of the most fundamental pieces of advice back to the forefront of the debate in broader terms, not as the result of any one attack in particular.

These are tips taken from initiatives like the U.S.-based See Something, Say Something and the UK-based “Run, Hide, Tell.” Context-sensitive information or more specific best practices can be accessed from your local and national public safety institutions.

Keep an eye out for
unusual items or situations

  • Acquiring large vehicles for no obvious reasons or license plate removed from vehicle.
  • Buying or storing large amounts of chemicals, fertilizers, or gas cylinders for no obvious reasons.
  • Package or luggage left unattended.
  • Vehicle left unattended in an odd location (near critical infrastructure or high traffic thoroughfares).
  • Travelling for long periods of time, but being vague about where they’re going.
  • Visiting the dark net, ordering unusual items online, or carrying out unusual bank transactions.
  • Acquiring uniforms, badges, flight manuals, access cards, identification cards, weapons, or other items for no obvious reasons.
  • Holding passports or similar documents in different names, for no obvious reasons.
  • Posting violent, hateful, or extremist opinions, analyses, and propaganda on social media or elsewhere on the Internet (including the dark net).

Eliciting information

  • Taking photos, notes, and measurements of security arrangements, infrastructure, or inspecting CCTV or other unusual things (bollards, barriers, gates, roadways, etc).
  • Suspicious questioning in person, by telephone, email, etc regarding key facilities and the people employed there.


  • Paying unusual attention to facilities or buildings “beyond a casual or professional interest.”
  • Conducting ‘dry runs’ by means of mapping routes, timing infrastructure or traffic flows, noting law enforcement presence and patrols, etc.

Homeland Security officials worked with local, state, and federal partners during the 2015 Super Bowl in Phoenix. (DHS photo by Barry Bahler)

How to respond during a terror attack
Be aware that plainclothes officers may be responding to events, or civilians seeking to help, but always be cautious of the threat as well as the chaos that will immediately follow.

  • Lives are at risk. Telephone calls, texts, videos, and photos can wait. The lives of yourself and the people around you are the most important priority. Mobile phone traffic will become saturated very quickly – help facilitate first response communication and coordination by staying off your phone and telling others to do the same.
  • Step up. Any person can be a leader in a time of crisis. Acting quickly and calmly can be the difference between life and death, for both yourself and others. Warn others to avoid the danger zone.
  • Help others. This is the most efficient way of escaping from harm and evacuating from the danger zone. In reality, it is not everybody for themselves. This is an assumption that proves readily false in the face of a significant threat.
  • Listen to directions. First responders are trained for these crises. Heed instructions and orders from emergency dispatchers and first responders rapidly and calmly.
  • Escape. Unless absolutely necessary, do not lie down and do not play dead – escape at all costs. Insist others leave with you. Leave belongings behind. They have no value relative to lives.
  • If escape routes are blocked, hide. Barricade yourself in a safe place. Silence your phone, even if separated from the immediate events. Use whatever you can to separate yourself from the attacker and reinforce your position (such as with furniture). Seek refuge behind brickwork or reinforced walls. Having cover from view does not mean you have cover from attack – do not risk hiding behind glass, wood, metal, drywall, unless there are no other options.

Notify local law enforcement of suspicious activity
Every detail, no matter how seemingly small at the time, could prove vital to law enforcement needs. Inform any first responder or security official of the danger immediately. Be precise and thorough, but time-sensitive and composed. 

  • Detail the activity you saw and why you think it’s suspicious;
  • Detail the time and location of the activity (start broad and work smaller, how long have they been there, what changes have occurred, and at what time intervals, address, landmarks, where are you in relation to the suspicious person?);
  • Detail who you saw, including gender, age, number, physical description(s), and clothing (shoes, work clothes, business wear, uniforms, vests, etc);
  • Detail equipment in use (vehicle colour and make, license plate, cameras, weapons, suspicious packages or devices, wiring, etc).

Gut instincts are a valuable tool in ensuring public safety, but proper training in awareness, prevention, and response can prove to be the key decider in minimizing the impact of terror attacks. If something feels wrong, if you see something, or hear something – say something. Do not feel apprehensive in the hope that your observation might be unfounded. This is a much smaller price to pay than not reporting something in the first place. 

Terror attacks are the very definition of context-specific. There is no ‘tell-all’ method that can allow one to escape unscathed from any and all instances of violence against soft targets for extremist ideologies. That being said, terror attacks are exceedingly rare. They are not existential in nature – they are criminal acts that can be prevented by means of insight, and mitigated by means of appropriate response. 

Be aware of your surroundings, do not hesitate to report suspicious activity to law enforcement, and listen to and assist law enforcement in any way possible. There is always the risk of danger in the course of any daily interaction, but through awareness, preparedness, and confidence, we can all do our part in protecting our free and democratic society. 

Casey Brunelle is an intelligence advisor with more than seven years’ experience in the public and private sectors. He is a graduate both the University of Ottawa and the University of Cambridge.