Active Shooter Tabletop Exercise

©2012 Security Executive Council. All Rights Reserved. Content cannot be copied or distributed in any format without the express written consent of the Security Executive Council.

Active Shooter Tabletop Exercise

Dean Correia, Emeritus FacultySecurity Executive Council

National Food Service Security Council Annual Conference

August 7, 2013


Outline• Introduction: Crisis Management

• Tabletop Exercise: General Overview and Instructions

• Tabletop Exercise: Joe’s Burger Shack

– Segment One: Incident and Initial Response– Segment Two: Continued Response– Segment Three: Recovery 48 Hours Later

2


Introduction: Crisis Management

3


Critical Incidents…• Unplanned, any time, anywhere

• Crisis Management Team – some may be away

• May not be caused by your company

• Require swift, decisive action involving multiple public sector components

• May include rescue operations, special police response, and highly trained firefighters

4


Examples of a Critical Incident

• External crime• Fires• Extortion• Supply chain disruption• Workplace violence• Severe weather• Foodborne illness• Product contamination• Loss of propriety information

5


Crisis Management Objectives• Protect Life

• Protection Of The Environment

• Protection Of Assets

• Promote Effective Response

• Promote Recovery To “Better Than Before” Operations 6


Decision Making Under StressJohnson & Johnson Tylenol Incident

• Early 1980s in Chicago – 7 people died from taking Tylenol capsules that were filled with cyanide

• Johnson & Johnson had no formal crisis mgt team• Formed team of senior managers who determined that

product was not compromised during manufacture or shipping

• Nation wide product recall performed• Spent considerable amount of money on development of

tamper proof packages• Launched media campaign to regain consumer confidence• Emerged as a leader in tamper proof packaging and a

forerunner in critical incident management

7


Organization: Structured to Provide the Following

• Defined responsibilities

• Speed of decision making

• Effective communication system

• An ability to continue business

8


Typical Crisis Management Team

Crisis MgtTeam

Team Leader

InfoSystems

FinanceMediaLegal

Operations

Security& Risk Mgmt

HumanResources

Facilities

9


CMT Interfacing

Crisis MgtTeam

Team Leader

InfoSystems

FinanceMediaLegal

Operations

SecuritySafety

HumanResources

FacilitiesPublicSector

IRT Team Rep

EmergencyOperations

Center

Executive DecisionMaking

Authority

10


Tabletop Exercise:General Overview and Instructions

11


Training Objectives• Identify roles & clarify responsibilities

• Enhance skills

• Measure resources

• Build teamwork & Improve coordination

• Validate emergency response plan

• Provide feedback12


Exercise FormatEnhanced Tabletop Exercise:

• Generic site scenario

• Public sector response is simulated

• Presented in PowerPoint

• Role cards at table??????

13


Exercise Scope• Each segment contains time for individual assessment and

group discussion

• The Crisis Management Team participants will develop response priorities as the scenario unfolds

• The Crisis Management Team will simulate coordination with emergency response personnel in a unified manner

• In a real emergency, the local officials would have to assess the impact on community. May “take over”

• Think – does my company have a resource to handle this response/recovery plan element? 14


General Instructions USE ONLY THE FACTS INTRODUCED IN THE SCENARIO

There are 4 segments• Segment 1 and 2: response

segments• Segment 3: recovery segment• Segment 4: follow up points

Segment 1 – 2 (20 minutes)• Review the scenario• Take a few minutes to individually

write down what initial actions should be taken

• The Team Leader will direct a group discussion in the analysis portion of each segment

• Priorities will be listed for the CMT

Segment 3 (20 minutes) • Scenario will forward in time 48

hours from the conclusion of the response segments

• The private sector participants will group together for a discussion of the actions to be taken and to identify the responsibilities

Segment 4 (20 minutes)• Follow up points for discussion by

the exercise participants • Document what actions should be

taken to improve the crisis management plan

15


Tabletop Exercise:

Joe’s Burger Shack

16


Scenario: Joe’s Burger Shack• Headquarters facility, with access control system,

located on 400 acre campus in the City of Midsville. • Two level facility - 510,000 square feet and 1,400 employees• All Key Departments

IT (Main Data Center) C-Level Executives Human Resources Security Operations Legal Marketing/Global Communications Facilities 17


City of Midsville • Upscale suburb of a major upper mid-west city• Population approximately 75,000• Has a number of large office buildings and

shopping malls • Local police supported by the county sheriff

and the state police• Fire department has mutual aid agreement

with nearby communities

18


Segment One

Incident and Initial Response

19


Segment One ResponseCall to 911 About Shots Fired

• It is business as usual at Joe’s Burger Shack HQ when a 911 operator receives a whispered call from an employee in the facility, who states that a gunman is randomly firing at any employee in sight.

• The caller states that the shooting is taking place in the HR offices area on the upper level.

• Security is notified and the police are dispatched

20


Segment One ResponseMore 911 Calls

• Another caller reports to 911 that a man with a handgun was seen near the Data Center, on the main level

• The police are updated on this latest report

21


Segment One Response Police Arrive

• Midsville Police Department response units are arriving at the scene

• The officers call for additional support as they realize the scope of the developing situation

22


Segment One ResponseInjuries

• There are reports that several employees have been shot and some appear to be fatally injured

• All EMS units have responded

23


Segment One ResponseJoe’s Burger Shack Emergency Response

• In view of the situation, the Joe’s Burger Shack Crisis Management Team is mobilizing in a secure conference room at HQ

• Operations are being set up in the command center, but not all CMT members have responded

• Details are just beginning to come in regarding the situation

24


Segment One ResponseCommand Center Activity

• The city’s Emergency Response Command Center is activated

• Information is pouring in from all public sector responders as well as from Joe’s Burger Shack employees

• Officers at the scene report that there is no current information on the location of the gunman

25


Segment One

Analysis & Discussion

26


Segment One Public Safety Response

• Police and EMS services set up a unified command center, with the police taking the initial lead

• Joe’s Burger Shack CMT have requested and been granted a representative at the command center

• Police Special Response Team is mobilizing, but this will take time

• Police and EMS support from mutual aid communities have been requested. Area hospitals are notified.

• Traffic control points are being set up to clear access for emergency vehicles and expedite the evacuation process

• FBI notified due to possible terrorist involvement

27


Segment One ResponseDiscussion Starters

• How can the injured persons be located and evacuated for proper medical care?

• What notifications should be made and how will they be made?

• Should any additional security measures be taken?• How can the situation be stabilized?• How quickly can liaison be established with the public

agency incident commander? • What are the priorities?

28


Segment Two

Continued Response

29


Segment Two ResponseLocal Media Arrive

• The local television media is at the scene attempting to interview Joe’s Burger Shack employees

• Reporters indicate they have information that there is a gunman on the loose in the facility

• Officials are pressed for comments

30


Segment Two ResponseMissing Employees

• Due to the confusion surrounding the events, and panic during the evacuation, many employees are unaccounted for. It is unknown if there are still people in the facility.

• A number of visitors are also missing31


Segment Two ResponseHostage Situation

• 911 receives a call - a gunman is holding a hostage in a conference room in the Accounting Dept. on the main level. This happened during the evacuation process, but the caller had problems getting a cell line.

• The gunman was yelling that “Joe’s Burger Shack is paying the price for its ruthless actions”

32


Segment Two ResponseHostage Negotiations

• The police have isolated the conference room and determined that the gunman is holding at least one hostage

• Negotiators have opened a dialogue with the gunman by phone. He demands a live TV interview, which he can monitor, “So all will know that this is the fault of Joe’s Burger Shack .”

33


Segment Two ResponseRescue Operations Underway

• With the gunman isolated by police on the main level, limited recovery operations are now underway to search for victims and survivors from the shootings

34


Segment Two ResponseMore From The Media

• Reporters persistently request statements from public safety agencies and want details about the shooting spree

• They are also pressing for statements from Joe’s Burger Shack officials

35


Segment Two ResponseEmergency Operators Flooded With Calls

• Information about the shootings and hostage situation has been broadcast on radio and TV. The local 911 operators have been overwhelmed with calls from family members of employees and others with loved ones in the area.

36


Segment Two ResponsePressure From The Media

• National cable news channels have picked up the story• Public officials from the local, county, and state levels

are being questioned about the incident• Experts are appearing on the news discussing

workplace violence and any possible terrorist aspects

37


Segment Two ResponseSuspect Sighting

• A report is just now received that the shooter has been identified by witnesses as an employee of Joe’s Burger Shack

• Based on initial information, he was just placed on sick leave

38


Segment TwoAnalysis & Discussion

39


Segment Two Public Safety Response

• Police investigators request all information possible on the suspect employee

• Mutual aid support has been arriving and deployed to the scene

• Private ambulances have been requested to augment overburdened EMS units

• Helicopters are needed to rush the critically injured to adequately staffed and equipped trauma centers

• A joint news briefing is being set up to include public safety representatives and ranking officials from Joe’s Burger Shack and a representative of the Crisis Management Team

40


Segment TwoDiscussion Starters

• How can the Crisis Management Team be more effective in locating missing employees and visitors?

• What can be done to assist law enforcement investigative personnel regarding information about the suspect?

• What can be done to better function in the severe weather?

• How can the media best be accommodated? • Can the media be helpful in notifying family members of

the ongoing situation? • How should Joe’s Burger Shack authorities be responding to

and reporting on the incidents ?

41


Segment Three

Recovery - 48 Hours Later

42


Segment Three Recovery Situation Concluded with Suicide

• After a three hour standoff, a single gunshot was heard

• The police entered the area and found that the gunman had shot himself

• He was conveyed to the hospital and pronounced dead on arrival

• The hostage was unharmed

43


Segment Three Recovery Casualties

The death toll on the day of the attack was as follows:• Four employees died from gunshot wounds • Two visitors suffered fatal heart attacks

• A total of six other employees suffered non-fatal gunshot wounds. Two of these shooting victims are in critical condition.

• Over 20 other people suffered from, cuts, broken bones, and abrasions due to the initial panic that ensued

44


• The gunman was found to be armed with a Glock, 9 mm handgun plus an extra magazine of ammunition

• He was identified as an employee of Joe’s Burger Shack , who was recently placed on leave, but his access card had yet to be disabled

• Some of his co-workers stated that he had been brooding because he had been passed over for promotion

Segment Three RecoveryInvestigative Findings

45


Segment Three Recovery Aftermath of the Attack

• Joe’s Burger Shack employees are being scheduled to receive post traumatic stress counseling

• Additional professional assistance will be needed to handle the volume of workers

• Many others have called their employer with concerns about returning to the workplace

46


Segment Three Recovery Continuing Coverage

• The media continues to give coverage to this incident as funerals are being planned for the victims

• Experts offer opinions on how to recognize and deal with potential violence in the workplace

47


Segment Three

Analysis & Discussion

48


Segment FourDiscussion Items

• What can be done to prevent such an incident from occurring in the future?

• How did the members of the Crisis Management Team interact during the exercise?

• Were there any difficulties in reaching team priorities?

• What issues/gaps were uncovered during the scenario with your own company’s response plans that need to be addressed in a follow up manner?

49


Key Learnings

• Proactively mitigate risks• Have a CMT and a local IMT• Build relationships outside of crisis

– NFSSC, local responders, etc.• Have 2 designated meeting places• Crisis management is not cookie

cutter. They are leadership opportunities.

Documents

Active Shooter Tabletop Exercise