SitReps
SitRep, or situation report, was used widely in World War II by the military to describe anything from troop deployments to details of the aftermath of military conflicts. Another term that is commonly used to discuss an event after it has occurred is an After Action Report or After Action Review (AAR). State and federal agencies regularly release AARs related to mass shootings, many of which we provide on our resource page. We have designed our SitReps to shed light on the research and lessons learned from these attacks concerning behavioral threat assessment and physical safety and security measures.
It is important to say clearly, the blame lays squarely at the feet of the person or persons who planned and carried out the attack. DPrep Safety Division remains committed to reducing the contagion effect that comes from glorifying and naming the attackers.
The purpose of our SitRep reports is to provide a regular update to the threat, BIT and CARE community on effective ways to prevent this violence from occurring in the future.
Aurora
Target: Screening of The Dark Knight Rises
Location: Aurora, CO
Date: July 20, 2012
Attackers: 24m
Victims: 12 Killed, 58 Injured
At the start of the midnight screening of The Dark Knight Rises, the attacker left the theater, propping open the door behind him. He returned a few minutes later dressed in head-to-toe protective gear and deployed two tear gas canisters into the theater. He then opened fire, killing twelve and injuring 58. He surrendered to police outside the theater. The police found a package addressed to his psychiatrist that contained a notebook with details of his attack plan and his obsession with killing, as well as booby traps and multiple IEDs.
One of the lessons learned from this attack was the importance of having team leadership align with national standards. BIT/CARE and threat chairs are often the chief student affairs officer, dean of students or conduct officer. In a co-chair system, there should be clear policy, procedure and practice guidelines to ensure areas of responsibility are well defined. BIT/CARE and threat teams are governed primarily by FERPA and team communications should be understood in this capacity. When mental health professionals chair a team, there is a danger of seeing the information sharing under state confidentiality law or privilege, which is a more restrictive standard of communication.
Further Reading: Ending Campus Violence by Dr. Brian Van Brunt; DPrep Safety’s Behavioral Intervention, CARE & Threat Assessment Team Audit Tool
Teams work best when they include membership from a variety of core campus areas including student conduct, counseling, and police/campus safety. Leaving any of these three core areas off the team severely limits the ability of the team to accurately view the elements of a case from a variety of viewpoints. In addition to these three areas, teams should include members from residential life (as applicable), health services, athletics, ADA/504 accommodations, Title IX, human resources, and faculty representation. Teams should operate in the range of 8-12 members, with weekly or bi-weekly meetings.
As with many threat cases, the attacker’s environmental stressors that serve as triggers, catalysts or escalators toward violent action should be identified and monitored in cases that are deemed higher risk. Catalyst events can include the loss of academic major or career potential, the loss of an intimate relationship, the death of a loved one, termination from a job, suspension or expulsion from an academic program, the diagnosis of a terminal/chronic disease, loss or change in therapy or medical options/treatment, financial distress, or loss of housing. If more than one of these occur, this increases the level of concern. In this case, the attacker failed a key oral exam on June 7th and dropped out of his program of study. In a rare example of clarity on this issue, the attacker writes, “people would erroneously believe that failures with women or with jobs led to…the rampage. Both failures were expediting catalysts, not the reason. My causation being my state of mind for the past 15 years.”
Further Reading: Understanding and Treating Incels by Dr. Chris Taylor & Dr. Brian Van Brunt
Leakage in an attack is the intentional or unintentional sharing of attack details prior to the violent action. A legacy token is a manifesto or explanation of the attackers motivations and/or reasons for the attack. Attackers often deliver a this legacy token in the hours prior to the attack. In this shooting, there was some inaccurate reporting that a notebook detailing the attacker’s thinking and plans was mailed a month prior to the attack. In reality, it arrived in the mail room addressed to the attacker’s psychiatrist on the day of the attack. The Isle Vista attack, El Paso shooting, Virginia Tech massacre, and Collier County shooting at an LA Fitness all involve token legacies shared at the moment of attack.
​
Further Reading: An Educator’s Guide to Assessing Threats in Student Writing: Social Media, Email, and other Narrative by Brian Van Brunt, W. Scott Lewis, and Jeffrey H. Solomon
Determining access to firearms, incendiary devices or other weapons is an essential part of assessing the lethality and actionability of an attack plan when conducting a violence risk or threat assessment. In this case, the attacker acquired high capacity magazines and weapons immediately following the failure of his oral exam. The acquisition of weapons occurred immediately prior to the attack in the Uvalde shooting and the El Paso attack. In the Norway attack, weapons were acquired over time. These attacks also involved the acquisition of ammunition and para-military protective/tactical gear. In coordination with the BIT/CARE team and law enforcement, campus mail room staff should receive training in, and develop a protocol for, responding to suspicious packages.
Orlando
Target: Pulse Nightclub
Location: Orlando, FL
Date: June 12, 2016
Attackers: 29m
Victims: 49 Killed, 53 Injured
On June 12, 2016, one of the deadliest active shooting events in the United States took place when a 29-year-old gunman entered the Pulse nightclub in downtown Orlando and began firing with a high-powered rifle and a pistol. Several after-action reports have been written by police, fire, and EMS outlining response, communications, equipment, and coordination lessons learned.
The attacker was employed as a security guard at the time of the shooting. He had applied to numerous law enforcement agencies in Florida but was rejected for making threats of bringing a gun to schools, openly threatening other cadets, and additional administrative issues. The FBI interviewed him in 2013 and 2014 as a “person of interest” because of potential ties to terrorist organizations and ideology. These cases were dismissed due to a lack of substantial evidence. Former family members and colleagues claimed that he was “mentally unstable and mentally ill” and “obviously disturbed, and deeply traumatized.” He reportedly supported extremist Islamic groups and expressed frustration with American policies towards the Middle East.
Further Reading: ”Beyond the Red Flags” by Dr. Brian Van Brunt & Dr. Amy Murphy; ”Terrorist in Training” by Dr. Lisa Pescara-Kovach, Dr. Brian Van Brunt, & Dr. Amy Murphy
The attacker made numerous social media posts promising vengeance for the American air attacks on Syria and Iraq. While there were some reports that the attacker was motivated by internal conflicts between his sexuality and his Islamic beliefs, there is no clear evidence supporting this theory. Instead, investigations suggest that he chose the Pulse location because of its apparent lack of visible security. He had researched “Orlando Night Clubs,” and in the hours leading up to the attack, he visited Disney Springs and other clubs.
Further Reading: Extreme Overvalued Beliefs: Clinical and Forensic Psychiatric Dimensions by Tahir Rahman, MD with Jeffrey Abugel
Run, Hide, Fight is the FBI approach to surviving an active shooting. These actions are not progressive (run, then hide, then fight), but rather chosen using situational awareness to make the most informed decision. Many reports from the event said those inside Pulse were unsure of where the exits were and hid in places like the bathroom, where the attacker was able to shoot through the door, killing two and wounding several others.
It was a former Marine, Imran Yousuf, who recognized the gunshots and acted by unlocking an area that allowed over 70 people to escape. Off-duty Orlando Police Officer Adam Gruler was in the club during the attack, engaged with the attacker, and coordinated with responding officers.
Taking 30 seconds to a minute when entering a new space to orient yourself to the nearest exits could save your life and the lives of others in the event of an attack. Even with run, hide, fight training, it is essential to remember that an active shooter event is fluid and ever-changing. Continuously reevaluate to determine your next course of action.
Further Reading: FBI Active Shooter Safety Resources
The late hour of the attack and the location of the club posed challenges for the hospital response. Pulse is only three blocks from the hospital, but the 30-block, cordoned-off area surrounding the club made it difficult for staff and ambulances to reach the emergency department until the Orlando Police Department was able to designate a route.
Additionally, many staff do not have landlines and silence their cell phones after hours. The emergency mass notification system was insufficient to reach all staff at 2:00 AM when the attack occurred. Following the attack, the emergency mass notification system within the Orlando Regional Medical Center was enhanced to include a “hunt” feature, which allows the system to continue sending notices through multiple channels until the recipient acknowledges receipt of the message.
Further Reading: Lessons Learned from the Pulse Nightclub Shooting
Officers should recognize that when they arrive at an active shooting, they will come under immediate fire, or be forced to respond immediately, without taking the time to gather additional protective equipment (helmet, plates), and access enhanced equipment and weaponry (active shooter bag, tactical vest, long guns), before engaging. Additionally, a decision needs to be made on whether to treat it as an active shooter event or a barricaded/hostage event, as these two events require different tactics to neutralize the threat. Another lesson from this attack was the use of slings on long guns to ensure quick access as well as easy transition to a secondary weapon or task.
As with other attacks, implementing physical security measures such as bollards, reinforced doors, access control, searches, emergency communication, and armed security personnel could help prevent an attack. The attacker had not initially chosen Pulse as the original site of the attack but moved to this site as it had less security than other sites he considered (e.g., Disney Springs). Hardened physical security measures are crucial and should be complemented by behavioral threat assessment and intervention to create a more comprehensive, layered security model.
San Bernardino
Target: Inland Regional Center
Location: San Bernardino, CA
Date: December 2, 2015
Attackers: 28m & 29m
Victims: 14 Killed, 22 Injured
Islamic extremists attended a work training and holiday party at Inland Regional Center, left and returned in tactical clothing and shot numerous attendees, killing 14 and injuring 22. They planned to detonate an IED but were engaged in a subsequent vehicle pursuit and shootout, and both suspects were killed. They were found with AR-15s, semi-automatic pistols, and IEDs.
There has been an increase in recent years with attackers spending time researching and developing increased tactical abilities related to weapons systems, strategy and planning of their attacks. This attack involved a high degree of sophistication, including counter measures related to cell phone tracking and methodical planning. Law enforcement should be prepared to engage attackers with higher lethality weapons systems, ammunition, body armor and surveillance capabilities. This includes awareness of explosives, including secondary attacks on staging areas for first responders, such as delayed explosive devices placed prior to the attack. This was one of the tactics involved in this attack. Realigning and enhancing this response in collaboration with FBI, fusion centers, ATF, and state police will enhance the survivability of and safety of first responders in increasingly complicated threat environments.
Further Reading: Harm to Others and Ending Campus Violence, both by Dr. Brian Van Brunt
As with many attacks, the planning occurred privately with few opportunities for reports to police, a behavioral intervention team (BIT) or human resources. Colleges, K-12 schools, and workplaces should invest in the development of these teams and attend to early approach behaviors such as depression, isolation, fixation and focus on targets, grievance collection, leakage, and bullying/teasing as opportunities for early detection of potential violence to self or others.
Further Reading: ”Beyond the Red Flags” by Dr. Brian Van Brunt & Dr. Amy Murphy
Home grown attacks are much more common than coordinated attacks from outside the U.S. These single cell attacks may occur independently of larger terrorist networks and often depend on local resources and planning to carry out the attack. College and university campus law enforcement should attend to trends in extremist violence targeting the various religious groups, white supremacist ideology, and individuals focused on women as targets in incel related attacks.
Further Reading: ”Terrorist in Training” by Dr. Lisa Pescara-Kovach, Dr. Brian Van Brunt, & Dr. Amy Murphy; Understanding and Treating Incels by Dr. Chris Taylor & Dr. Brian Van Brunt; White Supremacist Violence by Dr. Brian Van Brunt, Dr. Lisa Pescara-Kovach, & Bethany Van Brunt; Audit of the Department of Justice’s Strategy to Address the Domestic Violent Extremism Threat
While we don’t want to focus most resources on outlier behavior, it is essential to review cases that may shed light on emerging trends. In this case, the female suspect was believed to have ties to extremists. Data supports males as the overwhelming drivers of these attacks. While female attackers and attackers with ties to overseas terrorism cells and more coordinated counter-surveillance measures are not common in mass shootings, understanding this as a potential escalating pattern is important to stay ahead of the attacker’s plans.
Those in a first response role found themselves experiencing sensory overload at they came into the scene. Preparation, planning, and training are critical to assist first responders to successfully engage and neutralize the threat. Understanding the building’s layout, particularly when there are multiple hallways in a large building like the Inland Regional Center. Likewise, having a clear and consistent approach to marking rooms clear will prevent the need to repeat clearing rooms (an element in this attack). Another element is coordination with first responders who may serve in a volunteer role or arrive in a personal vehicle. Having a clear plan for vehicles prior to an emergency event prevents blocking access, as occurred here and in numerous other attacks, including Aurora and the Naval Yard.
Further Reading: Colorado Theater Shooting Fast Facts from CNN; MPD Navy Yard After Action Report
The greatest cause for death following an active shooting is loss of blood. Training staff at schools, colleges, workplaces, community centers and sports/event facilities in Stop the Bleed has a drastic effect on keeping people alive by reducing bleeding until medical first responders arrives.
Uvalde
Target: Robb Elementary School
Location: Uvalde, TX
Date: May 24, 2022
Attackers: 18m
Victims: 21 Killed, 17 Injured
On May 24, 2022, an 18-year-old former student armed with an AR-15-style rifle entered Robb Elementary School in Uvalde, Texas, through an unsecured door. He fatally shot 21 victims (19 students and two teachers). The attack began at 11:33 a.m. and ended at 12:50 p.m., when a Border Patrol tactical team breached the classroom and killed the attacker. The law enforcement response was criticized for its delayed entry into the classroom, despite children and teachers having called 911 and provided updated reports.
The shooter had a history of troubling behaviors prior to the shooting, including violent threats on social media and self-harm. He posted photos of firearms and commented about school shootings online. He dropped out of high school and reportedly had a troubled home life. He had a long history experiencing teasing and bullying related to his appearance, educational challenges, socio-economic status, gender expression, and stutter/lisp. Many students, peers and online acquaintances not only noticed, but responded by labeling him as a potential school shooter. Despite these indicators, there was no effective behavioral threat assessment or intervention. The attacker had no criminal record and none of his online behavior was reported to the police.
Investigations after the shooting found that he legally purchased two AR-style assault rifles and hundreds of rounds of ammunition days after his 18th birthday. He made many entries on social media with his intent and violent tendencies.
Further Reading: Beyond the Red Flags: Overcoming Obstacles and Managing Threat
Although law enforcement was on scene within minutes, the response was marked by communication failures, a lack of incident command, and conflicting information. More than 370 officers from local, state, and federal agencies responded; however, no one assumed command. Officers waited for over an hour to enter the classroom and stop the threat.
The Texas House report described the response as a “systemic failure.” While staff and children called 911, officers remained in the hallway, mistakenly treating the incident as a barricaded suspect rather than an active shooter. There was also confusion as to whether the door was locked or unlocked.
Further Reading: Texas House of Representatives Investigative Committee on the Robb Elementary Shooting
Many classrooms did not have doors that could be locked from the inside. The shooter entered through an such an exterior door. Students and teachers had limited information during the attack, and inconsistent lockdown procedures added to the confusion.
Situational awareness training, reinforced lockdown and active attacker procedures, and clear evacuation practices are critical. The tragedy illustrates the importance of training that empowers immediate action in active attacker incidents.
Further Reading: FBI Active Shooter Safety Resources
Local hospitals received victims rapidly due to their proximity, but the scale of the event overwhelmed their initial capabilities. Emergency notifications among school staff were inconsistent, and communication with families was chaotic and delayed. Parents arrived on site before the incident was resolved and clashed with law enforcement, leading to further disorder. There was no pre-planned reunification point for major incidents.
Robb Elementary had security measures in place, including fencing and emergency plans, but these were not consistently applied. The attacker exploited a known vulnerability: a door that did not latch properly.
Layered security, including secure perimeters, controlled access points, and camera monitoring, is essential. Physical security must be coupled with behavioral threat assessment programs that identify individuals of concern and intervene early.