Active Shooter

Introduction

Before the Police Arrive

Most active shooter attacks are over before police get inside the building. In two thirds of the events the Federal Bureau of Investigation studied, the shooting had ended before officers arrived or engaged. The people already in the room determine how many of them survive, and they determine it in the first minute or two, on incomplete information, with a body that is not working normally.

That is not a criticism of police. Officers are dispatched after the shooting starts. They drive to an address, park, form up or do not, find a door, and move toward the sound. Those steps take several minutes, and most attacks do not last that long.

So the useful question is not what the police response looks like. It is what a person standing in a hallway does in the ninety seconds before anyone can reach them.

Every chapter ends with a checklist, and Appendix A is a one page field card meant to be printed and folded.

I teach this material, I hold firearms instructor and emergency management credentials, and I have been retained on firearms reaction time in a mass shooting and bombing matter. Reaction time is where the science in part two and the law in part four meet.

This field repeats figures nobody can source. Where I could not trace a number to a primary document, I say so and leave it out, so that what remains is something you can put in front of a jury.

Chapter 1

What the Data Says

Most people believe these attacks happen mostly in schools, that the typical attacker uses a military style rifle, that casualty counts run to the dozens, and that the numbers rise every year. The incident data the Federal Bureau of Investigation publishes annually contradicts all four. Every dollar spent on hardening is spent against a mental picture of the threat, and if the picture is wrong the money goes to the wrong doors.

The report series, and what it counts

The series begins with A Study of Active Shooter Incidents in the United States Between 2000 and 2013, published in 2014 by J. Pete Blair of the Advanced Law Enforcement Rapid Response Training Center at Texas State University and Katherine W. Schweit of the Federal Bureau of Investigation, which set the counting method. Annual reports have followed, along with a twenty year review covering 2000 through 2019.

Counts in the two combined year reports are totals for the pair, not annual figures. "Not stated" means the casualty split was not captured in the source material used for this book, not that it was zero.

Where these attacks happen is not where you think

Across the twenty year review, the largest single location category was business open to pedestrian traffic, with 96 of 333 incidents, followed by open space with 50, schools serving prekindergarten through twelfth grade with 44, and businesses closed to pedestrian traffic with 41. Government properties accounted for 21, institutions of higher education 18, health care 15, houses of worship 15, residences 13, malls 10, and military properties 9.

Schools carry a disproportionate share of the worst events but are not where most attacks happen. In 2023, of 48 designated incidents, 28 occurred in open space and 14 in commerce, against 3 in education. In 2024, of 24 incidents, 12 occurred in open space and 4 each in commerce and education.

The handgun, not the rifle, is the common weapon

In 2024, 25 shooters used 29 firearms across 24 incidents: 17 handguns, nine rifles, three shotguns. In 2023, 49 shooters used 60 firearms: 43 handguns, 16 rifles, one shotgun. In 2022, 61 firearms were used: 29 handguns, 26 rifles, three shotguns, three not identified.

Hardening built around the image of a rifle attack in a school corridor prepares for the minority of events. A handgun also stays concealed until the attack begins, which is why one screened entrance does more than most facility managers credit.

The typical event is small, and the averages hide that

The Advanced Law Enforcement Rapid Response Training Center's database of 597 attacks from 2000 through 2024 records 4,055 casualties, 1,415 killed and 2,640 wounded. The median victims per attack was four, the median killed one, the median wounded two.

The mean is dragged upward by Las Vegas in 2017 and Pulse in 2016. A plan built on it prepares for a mass casualty event and neglects the likelier one: one attacker with a handgun, a small number of people shot, and an outcome settled within a few minutes by the people already there.

Who the attackers were, in the aggregate

The twenty year review identified 345 shooters, 332 male and 13 female, of whom 16 wore body armor. In 2024, of 25 shooters, 22 were male and three female, ages 14 to 73, the largest band 35 to 44. In 2023, of 49 shooters, 48 were male, ages 17 to 72, largest band 25 to 34. In 2022, ages ran 15 to 70, largest band 19 to 24.

There is no age profile. Sex is the only demographic that holds, and nothing else in the aggregate data supports a usable physical description in advance. What is available in advance is behavior, which is chapter 4.

Why two credible sources publish different totals

The Federal Bureau of Investigation designation excludes incidents tied to gang activity, drug trade, and domestic disputes; other compilations include them. The Advanced Law Enforcement Rapid Response Training Center counts non firearm attacks in its recent data, and the Crime Prevention Research Center compiles from news reports and reaches a substantially larger count for the same years. None is dishonest. They count different populations, and a number lifted from one and compared against another produces a false conflict. Chapter 3 works that problem in detail.

Chapter 2

How Long You Have

Most of these events, not just the worst ones, are over before police can engage. That fact sets who determines the outcome, what a plan should optimize for, and where a school or employer should spend money.

Two thirds ended before police could engage

From A Study of Active Shooter Incidents in the United States Between 2000 and 2013, by J. Pete Blair and Katherine W. Schweit, published by the Federal Bureau of Investigation:

At least 107 (66.9%) ended before police arrived and could engage the shooter, either because a citizen intervened, the shooter fled, or the shooter committed suicide or was killed by someone at the scene.

J. Pete Blair and Katherine W. Schweit, A Study of Active Shooter Incidents in the United States Between 2000 and 2013, Federal Bureau of Investigation and Texas State University, 2014

The Advanced Law Enforcement Rapid Response Training Center at Texas State University, which maintains the Active Attack Data Explorer, puts the same measure at 58.2 percent, or 347 of 597 attacks from 2000 through 2024. Its summary: half the time the event ends before law enforcement arrives, because the attacker is stopped by civilians or stops himself.

The two figures are not in conflict. The Bureau's 66.9 percent covers 2000 through 2013 under the Bureau's definition, and the Center's 58.2 percent covers 2000 through 2024 under a broader one that includes non firearm attacks in the later years.

The workplace subset behaves the same way. The Center's 2017 study counted 105 workplace events from 2000 through 2015, with 619 people shot and 282 killed, and found 55 percent ended before police arrival.

Most of them end in under five minutes

The duration finding comes from the same 2014 study, with a limitation most people who quote it drop:

In 63 incidents where the duration of the incident could be ascertained, 44 (69.8%) of 63 incidents ended in 5 minutes or less, with 23 ending in 2 minutes or less.

J. Pete Blair and Katherine W. Schweit, A Study of Active Shooter Incidents in the United States Between 2000 and 2013, Federal Bureau of Investigation and Texas State University, 2014

That finding rests on 63 of 160 incidents, the 39 percent where somebody could establish a start and an end. The limit cuts in an unknown direction, because events with clean timelines have surveillance coverage, dispatch recordings, and heavy investigation, which is not a random sample. It remains the best available finding and matches the case studies, but it is not a precise distribution and should not be presented as one.

What arrival actually looked like in three documented events

Three events are documented to the second in official reviews. Use those intervals instead of an average nobody can source.

The pattern in those three events is not that police were slow. The first deputy at Parkland was outside the building 99 seconds in, and the attack was over 138 seconds later. Officers at Uvalde were inside in under three minutes, and the killing in the classrooms had already happened. Even fast arrival could not prevent the casualties in the opening minutes.

Nobody has published a casualty rate per minute

No primary source quantifying victims per minute could be located for this book, and it is the number a plaintiff's expert wants in a negligent security case and the number a school board wants when weighing a two minute improvement in lockdown time. What exists are anchors from individual events, which bound the question without inventing a rate. At Parkland, 17 people were killed and 17 wounded in 4 minutes 19 seconds. At Uvalde, more than 100 rounds were fired into two connected classrooms between 11:33:24 and 11:36:04, a span of 2 minutes 40 seconds, before any officer was inside the building. At Las Vegas in 2017, 1,058 rounds were fired in about 10 minutes. The nearest peer reviewed work is a 2020 Homicide Studies article on correlates of the number shot and killed in active shooter events, which models casualty counts against covariates. Whether it models time as a predictor could not be confirmed for this book.

Where the ninety second frame comes from, and what it is not

This book teaches to a ninety second frame. The frame is a planning device, not a research finding, and presenting it as a research finding would repeat the error described above.

It rests on the measured facts above: 23 of 63 events over in two minutes, roughly seven in ten over in five, 35 seconds at Parkland before anyone called 911, 99 seconds before a deputy reached that building, and 175 seconds before officers were inside at Uvalde with the classroom killing already done. Ninety seconds is not a prediction of when officers arrive. It states who is present during the part of the event that produces the casualties: the people who were already there.

Chapter 3

How These Attacks End

An attack stops for one of six reasons: the attacker leaves, the attacker kills himself, police shoot him, police take him into custody without shooting, a civilian physically stops him without a gun, or a civilian shoots him. The proportions are published, and they are the subject of the loudest statistical fight in this field. Get them wrong in one direction and you build a plan that waits for a rescue that will not arrive in time; wrong in the other and you build one that assumes an armed defender who is usually not there.

The cleanest available breakdown

The Advanced Law Enforcement Rapid Response Training Center at Texas State University publishes an ending category for each of the 597 attacks in its database covering 2000 through 2024, the most complete breakdown available.

The Bureau's own numbers on civilians, year by year

The Federal Bureau of Investigation study of 2000 through 2013 found that in 21 incidents, or 13.1 percent, the situation ended after unarmed citizens safely and successfully restrained the shooter, and in five, or 3.1 percent, after armed individuals who were not law enforcement personnel exchanged gunfire with the shooters. In the 2016 and 2017 report, citizens confronted the shooter in ten incidents; in eight of those, one or more citizens safely and successfully acted to end the shooting, four unarmed and four armed with valid permits. The Bureau's assessment was that their selfless actions likely saved many lives.

The Bureau noted four incidents involving civilian intervention in 2023 and eight involving citizen confrontation in 2022. Civilian action is not rare. Civilian action with a firearm is uncommon.

Why the Crime Prevention Research Center reaches a different number

The Federal Bureau of Investigation reports that armed citizens stopped 4.6 percent of incidents from 2014 through 2022, or 14 of 302. John R. Lott Jr. of the Crime Prevention Research Center puts the figure at 35.7 percent, or 157 of 440 incidents, and at 41.3 percent for 2022 alone. The gap is a factor of nearly eight, and both camps cite it in legislative testimony.

Three separate mechanisms produce that gap. Keep them distinct, because they are not equally strong.

The denominator. The Center identifies 440 incidents where the Bureau identifies 302, and Lott states that the Bureau missed 138 cases. The Bureau excludes incidents connected to gang activity, drug trade, and domestic disputes; the Center's news-based compilation is broader. A larger and differently composed denominator is a different population, not a correction of the Bureau's arithmetic. If the added cases are disproportionately the kind of shooting a bystander with a permit is present for, the percentage rises without anyone being wrong about a single fact.

Classification of specific cases. The Center asserts that a handful of Bureau designated cases were misclassified. That is a checkable case by case dispute, the part of the argument most amenable to resolution, and the smallest share of the gap.

A normative move dressed as a statistic. The Center also reports 63.5 percent for 2022 after removing from the denominator every location where carrying was prohibited, reasoning that law abiding citizens obey posted prohibitions. That figure estimates a conditional rate among places where an armed citizen could lawfully have been present. It is an argument about opportunity, and it may be a good one, but it is not a measurement of how attacks ended.

The Center states its own limitation plainly: there is no reason to think the news media covers every case where civilians stopped attacks. A media search method will miss quiet successes and over-weight events that generated coverage.

The claim about bystanders, stated precisely

Lott has written that an armed citizen has yet to accidentally shoot an innocent bystander. Accept the claim and it still does not make armed intervention safe, because it addresses the wrong risk. The documented harm is not usually the defender shooting a bystander. It is the defender being shot by arriving police in the seconds after he has won, which chapter 13 works out through the case of Jemel Roberson. Whether armed defenders hit the wrong person and whether they survive the arrival of police are two questions with two different answers.

Chapter 4

The Warning Signs Nobody Reported

These attacks are planned, and planning leaves observable traces. The Federal Bureau of Investigation published Pre-Attack Behaviors of Active Shooters in the United States, 2000 to 2013, a study of 63 cases built to catalog what was visible in advance. It and every behavioral threat assessment program built since rest on one premise: the attacker is a person whose behavior changed in front of people who noticed. The failure is almost never that nobody saw anything, but that what was seen went nowhere.

Leakage is the term you need first

At Marjory Stoneman Douglas High School, a student named Chris McKenna described being warned by the attacker directly. His account, in the Public Safety Commission's initial report, was that he was told something bad was about to happen and to run. The target population was told, by the attacker, in advance, in plain words.

Grievance, planning, and preparation are separate stages

Threat assessment separates a person who is angry from one who is preparing, because both the intervention and the legal authority to act differ by stage.

Grievance. A specific, personalized sense of injustice, usually attached to a person, an institution, or a category of people. It is common and not predictive by itself.

Ideation. Violence enters the person's stated or written vocabulary as an answer, including fixation on prior attacks or attackers.

Research and planning. Target selection, schedule study, site visits, sketches, questions about door locks, questions about response times.

Preparation. Acquisition of weapons, ammunition, body armor, or a vehicle for the attack. The 16 of 345 shooters in the twenty year review who wore body armor had to acquire it in advance.

Breach and attack. The final approach. Prevention has run out, and part two of this book starts here.

Why the report never gets made

People fail to report for ordinary, predictable reasons, and a program that does not design against them gets no reports.

They do not want to ruin a life. The reporter expects the consequence to be expulsion, arrest, or a permanent record for a friend who is struggling. Programs that lead with support rather than punishment get more reports.

They do not know where it goes. If the only channel is "tell a teacher" or "tell human resources," the reporter is guessing what happens next. A named channel with a stated process gets used.

They assume someone else already reported it. The more people who witnessed the behavior, the less likely any one of them acts.

They tried once and nothing happened. A single report that produced no visible response teaches an entire population that reporting is pointless, and it is what kills most programs.

They fear retaliation. Anonymous intake solves some of this and creates another problem, because anonymous reports are harder to triage and impossible to follow up.

What a reasonable organization does with a report

The standard is not perfection. It is a documented process, applied consistently, with a decision recorded at each step. That record is also what makes the organization defensible later, because notice of a specific risk followed by no response is the fact pattern that creates liability. Chapter 20 works it out.

Four things make that structure real. Staff it with a team rather than one administrator: an administrator, a mental health professional, and a law enforcement liaison. Write down every decision, including decisions not to act, with the reasoning at the time. Name a case manager who owns the file until it closes. Set a closing standard, because open cases nobody has looked at in two years are worse than no file at all.

Contact with the subject is part of the process, not the end of it

Interviewing the person of concern gathers information available nowhere else and tells the subject the behavior was noticed. It also carries risk, because a badly handled contact can accelerate someone who was drifting. Gather collateral information first, then give the interview to a trained team member rather than whoever is available.

Management after contact is where most programs quit. A meeting does not close a case. A case closes when the grievance has been addressed or has faded, when the subject has stable connections and supervision, and when the team has reviewed the file against that standard.

Chapter 5

Doors, Locks, and Alarms

Physical security buys time and nothing else. Nothing on the market stops a determined attacker at the door, but good products delay him, turning a ninety second problem into a three minute problem. The evidence base is thinner than the sales literature implies, and the two best documented failures are both about doors and alerts rather than equipment nobody had.

The two failures that teach the most

At Robb Elementary School in Uvalde on May 24, 2022, the Advanced Law Enforcement Rapid Response Training Center's timeline records a teacher propping the west exterior door with a rock at 11:27:14, and the attacker entering through that unlocked door at 11:33:00. A rock placed for convenience defeated every dollar of hardening on the building.

At Marjory Stoneman Douglas High School in Parkland on February 14, 2018, the fire alarms activated at 2:22:39 p.m., about a minute after the first shots. The Public Safety Commission's initial report found that on the third floor well over 100 students were in the east end of the hallway with no indication that a shooter was in the building, because no Code Red was called. The second floor treated the incident as an active assailant response rather than a fire evacuation, and students in those classrooms were not in the attacker's line of sight to be shot. One building, one four minute event, two opposite outcomes, produced by whether the people on each floor were told what was happening.

Alerting is the highest value dollar in the building

An alert has to do three things. Reach everyone, including people outdoors and in restrooms and gymnasiums. Say what the threat is in plain language. Reach people fast enough to matter inside the ninety second window.

Plain language beats coded language. A code that requires translation adds a step when cognitive load is highest, and it fails entirely for substitute teachers, contractors, visitors, and new employees. Name the threat and the location.

The ability to initiate the alert has to be distributed. If only the front office can call it, the person who sees the attack cannot. Silent panic alarm systems that any staff member can activate from a phone or a badge solve that, and several states have mandated them under legislation commonly known as Alyssa's Law. Chapter 21 covers the statutory side, including what could not be verified for this book.

Guard against the alert conflict Parkland produced. A fire alarm during an attack sends people into hallways, so any facility with both systems needs a written, trained rule: while an assailant alert is running, the fire alarm does not mean evacuate through the corridor.

Doors decide who gets into the room

The most valuable piece of hardware in a school or an office is a lock that can be secured from inside the room without opening the door. A teacher who must step into a hallway with a key is being asked to enter the threat to escape it. Classroom function locksets, which lock the corridor side while allowing free egress from inside, solve that, as do interior thumb-turn or push-button locks.

Two constraints govern any door modification. Egress must remain free from the inside without a key, tool, or special knowledge, and the door must remain openable by an authorized responder. Aftermarket barricade devices that violate either create a life safety problem in fires and a hostage problem in abuse cases. Consult the authority having jurisdiction and the fire and accessibility codes before installing anything.

No product fixes propping. Doors get propped for deliveries, smoke breaks, a class going out to the field and back, and a door that latches badly. Propping is a maintenance and culture problem, and it defeats everything else. Door position sensors reporting a held-open condition to a monitored panel are cheap next to the alternative.

Glass, sight lines, and the geometry of a corridor

Glazing is where money disappears fastest. Security film delays a person breaking through a vision panel; it does not stop bullets and should never be sold as if it does. Rated attack-resistant glazing does substantially more, costs substantially more, and only performs if the frame and anchorage are rated to the same standard. Glass that holds while the frame tears out of the wall buys you nothing.

Sight lines matter more than glass ratings in most buildings. If a corridor door has a vision panel, ask what is visible through it and from how far. Arranging a room so the occupied zone sits out of the line of sight from the door glass costs nothing. Chapter 11 covers where in the room people should be.

What is theater

These products and practices consume budget and produce no delay.

Ballistic backpacks and clipboards. They require the user to orient a small panel toward an unpredictable threat direction while under a startle response, which is a human problem the panel cannot solve.

Response posters as a program. A poster reminds people who have been trained. It is not training.

A single unarmed greeter at an unlocked entrance. A customer service position described in security language. If the role is security, staff and equip it as security. If not, do not count it in the plan.

Camera systems bought as prevention. Worth the money for what they do, which is chapters 16 through 18, and not worth counting as a preventive control.

Any measure that has never been timed. If nobody has run a stopwatch on how long it takes to lock down the building, the number in the plan is fiction.

The prison question, answered directly

Any of these measures can be installed in a way that makes a place feel like a facility under siege, and that cost does not appear on a security budget. A classroom lockset, a door position sensor, a distributed panic alarm, a laminated vision panel, and a furniture layout are invisible on a normal Tuesday. Screening lines, fencing, armed patrols, and lockdown drills that traumatize are not. Buy the invisible ones first, and the visible ones only where the risk assessment for that site supports them.

Chapter 6

Drills and Plans

Training does not make anyone calm or stop the startle response, the tunnel vision, or the shaking hands. It shortens the time between the stimulus and the first useful movement, and that interval decides the outcome, because a person who has already decided what to do only has to recognize the situation. That claim has empirical support, and the literature behind it is thinner and more vendor-influenced than the field admits.

What the research supports, and how strongly

Stress inoculation training. The meta-analysis in this area is Saunders, Driskell, Johnston, and Salas, "The Effect of Stress Inoculation Training on Anxiety and Performance," Journal of Occupational Health Psychology, 1996, covering 37 studies and 70 separate analyses. Its finding, that graduated exposure to stressors reduces state anxiety and improves performance under stress with effects that generalize across stressors and tasks, is the empirical foundation for rehearsal. The effect sizes could not be retrieved for this book. Read the paper before putting a magnitude on a slide.

Rehearse under stress, not just rehearse. Nieuwenhuys and Oudejans, "Training with anxiety: short- and long-term effects on police officers' shooting behavior under pressure," Cognitive Processing, 2011, tests that distinction. Practicing a skill calmly and then performing it under threat is not the same as practicing it under threat.

Pre-decision, measured in advance, predicts performance. Landman, Nieuwenhuys, and Oudejans, "Decision-related action orientation predicts police officers' shooting performance under pressure," Anxiety, Stress and Coping, 2016, found that the disposition to act rather than deliberate, assessed beforehand, predicted shooting performance under pressure. That is the strongest empirical support for this book's central instruction: decide in advance, so that in the moment you are executing rather than choosing.

Officers themselves are not of one mind on immediate entry. A 2023 study in the Journal of Experimental Criminology surveyed 796 officers across more than 43 states on whether to wait for backup, and a factorial survey experiment in the Journal of Criminal Justice put more than 15,800 fictional scenarios to citizens on the same question. The doctrine is settled on paper and contested in practice, which chapter 19 takes up.

The comparative outcome evidence is weak, and you should say so

Whether multi-option training produces better outcomes than lockdown-only training is the thinnest part of the doctrine fight. Two studies carry it, and both reach this book secondhand.

The first appeared in the Journal of School Violence in 2018, across 13 sites over ten months in 2016 and 2017. The ALICE Training Institute cites it as finding that in classroom simulations the average number of people shot dropped by roughly 50 percent when participants used a multi-option response instead of lockdown only, and by 58 percent in open areas such as hallways and libraries. The second appeared in Victims and Offenders, and the same organization cites it as finding that 85 percent of students in grades four through twelve reported no change or an increase in their feelings of safety after training.

What a drill is for

A drill has five jobs, none of which is to frighten anyone.

Build the map. Every participant should leave knowing at least two ways out of the space they usually occupy, and where those ways go.

Make the decision in advance. Each participant should have answered, before the day, what they will do first from the places they spend time. That is the pre-decision the 2016 action orientation study supports.

Rehearse the mechanics. Locking the door, moving furniture, getting below the line of sight, opening a window, applying a tourniquet. Mechanics degrade under stress, so keep them simple and practiced.

Test the systems. Does the alert reach the gymnasium. Does the classroom lock work on the third door in the east wing. How long did the lockdown take. A drill is where the stopwatch numbers chapter 5 asks for come from.

Find the plan's failures while they are free. Every drill generates a written list of what did not work, with an owner and a date.

Do not run unannounced simulated attacks

Drills that simulate an attack without warning, using actors playing gunmen, blank-firing weapons, or staged casualties, produce injuries, lasting psychological harm, and occasionally armed responses by people who believed it was real. They add little over an announced drill, because the mechanics practiced are the same.

I have run these programs for teachers through Tactical Choices. Announce the drill in advance to staff, students, and parents. Never deceive anyone about whether the event is real. Never use simulated gunfire, blood, or actors playing an attacker in a drill with students in it. Give staff and students an opt-out, with no penalty and no explanation required. Debrief afterward with an adult present. For the youngest children, keep it to practicing quiet movement and following an adult, not discussing killing.

Run full-scale exercises with role players and simulated injuries only as scheduled exercises for responders and staff, without students, with medical support present and a stated purpose.

A plan that survives contact

Most written emergency plans fail the same way. They are long, written in the language of compliance, assign tasks to people by name, and assume the plan will be read during the event, which it will not be.

Assign roles to positions rather than individuals, because individuals resign, take vacation, and are sometimes the first casualty, and give every role a successor. Write the immediate action card in plain language with no acronyms, because the reader may be a substitute, a contractor, or a visitor. Then test it: hand the card to someone who has never seen it and ask them to do what it says.

Document the program, because it will be discovered

Every drill date, attendance record, after-action item with its owner and closure date, and risk assessment belongs in a maintained file. In litigation a documented but imperfect program defends well, and an undocumented one is indistinguishable at trial from no program.

Chapter 7

The First Ninety Seconds

The numbers in chapter 2 show that the people already in the building settle the outcome. What they do comes down to three decisions in order: recognize, move, act. That is the framework the rest of part two uses. When escape exists, escape is almost always right. The failure that kills people is not choosing wrong. It is not choosing at all.

Decision one: recognize, and do it on weak evidence

The first problem is classification, not fear. A person hears a sound that does not belong and runs it against every ordinary explanation first: a dropped tray, a slammed locker, construction, a car backfiring, fireworks. At the Route 91 Harvest festival in Las Vegas in 2017, much of the crowd took the gunfire for fireworks, and the Las Vegas Metropolitan Police Department's investigative report describes the attacker beginning with single shots before firing in bursts, the acoustic pattern fireworks make. Picking the likeliest explanation is correct nearly all the time and fatal here. The instruction is not to identify the sound correctly. It is to act on ambiguity.

What to act on. Sharp, flat, repeated concussive sounds indoors. Any repeated sound accompanied by people running or dropping. Screaming that spreads. A crowd moving as a unit away from something. The direction people run is usable information before you have identified anything.

What not to do. Do not go and look, wait for a second opinion, wait for the alert, or film it. At Parkland, four people were already down when the first 911 call was placed 35 seconds after the first shots.

The cost of acting on a false alarm is embarrassment. Tell employees that directly, because what stops most people from moving is the fear of looking foolish.

Decision two: move, and make the direction the only question

Movement produces all three of the things that protect you. A moving target is harder to hit than a static one, a point Tannenbaum draws out, and movement also puts distance and barriers between you and the attacker. The question is not whether to move but which way, and you answer it with a rule, not an evaluation. Move away from the sound. If you cannot tell where it came from, move with the crowd, unless the crowd is moving toward it. Pick the nearest exit, not the best one and not the one you normally use. Leave your belongings. Do not wait for anyone to agree with you.

If no exit exists, you still move: into a room you can secure, out of the line of the doorway, or toward the attacker. Chapters 10, 11, and 12 cover those three in order.

Decision three: act, and match the action to the room you are in

The layout of the space you are in, not the order of words in a slogan, determines which of the four actions is available to you.

Leave. If a route gets you out and away, take it. This is right more often than the other three combined.

Secure. If no route exists, put a locked or blocked door between you and the threat, get out of the line of the doorway, and expect the door to fail. Chapter 11 covers it, and it is not hiding.

Counter. If the attacker is coming into your space and you can neither leave nor secure, fight immediately, with whatever is in the room, with other people, and against the weapon rather than the man. Chapter 12 covers the mechanics, which are a trainable skill rather than a last resort.

Treat. Once the threat is out of your space, bleeding is what kills next, and it kills within minutes. Chapter 14 covers it.

Why not choosing is the thing that kills

The Parkland floor comparison, described in chapter 5, is the cleanest natural experiment in this literature: one building, one attacker, four minutes, and opposite outcomes on the second and third floors. Nothing about the attacker changed between those floors. What changed was whether the people there had classified the event correctly and acted on that classification.

Chapter 8

What Fear Does to Your Body

People who freeze during a sudden violent event are not cowards. Freezing is a stage in a neurologically mediated sequence that runs whether or not the person approves of it, and understanding the sequence is the only route to shortening it. The training industry is least rigorous on this material, and the most famous claims in the field are among the worst sourced.

The defense cascade, in order

The clinical framework is set out in Kozlowska, Walker, McLean, and Carrive, "Fear and the Defense Cascade: Clinical Implications and Management," Harvard Review of Psychiatry, 2015, which maps a sequence of arousal, freezing, flight or fight, tonic immobility, and collapsed immobility. Related work includes Volchan and colleagues on immobility reactions under threat in Neuroscience and Biobehavioral Reviews, 2017, and Abrams and colleagues on the measurement of human tonic immobility in Depression and Anxiety, 2009.

Two things follow. The freeze is real and normal, so a response model with no answer for it has a hole in it, which is the first criticism of Run, Hide, Fight in chapter 9. And freezing is a stage rather than an endpoint: the sequence keeps running, and an external cue can interrupt it, whether an instruction, a person moving, or a shove. One person who moves decisively will pull other people with them.

What actually happens to perception, with numbers

The best hard dataset available is Alexis Artwohl's survey of 157 officers involved in shootings between 1994 and 1999, published as "Perceptual and Memory Distortion During Officer-Involved Shootings" in the Federal Bureau of Investigation Law Enforcement Bulletin, October 2002.

Artwohl's conclusion carries part three of this book. Memory is not a video recording, so when a witness account diverges from the physical record, the usual explanation is stress distortion rather than dishonesty. That is why witness estimates of shot counts and timing cannot be used as a clock, which chapter 18 works out in detail.

Tunnel vision and loss of fine motor control are widely taught and consistent with what people report, but this book's research located no controlled sources establishing thresholds for either, so none is asserted here. Build procedures that work with gross motor movement and a narrowed visual field.

The heart rate zones, stated precisely

The most repeated model in the industry assigns performance bands to heart rate: an optimal band around 115 to 145 beats per minute, degradation of fine motor skill above that, and a breakdown state above roughly 175 beats per minute, often labeled Condition Black. It is associated with Dave Grossman and earlier work by Bruce Siddle, and is taught constantly to police, instructors, and civilians.

The critiques in the literature are aimed at Grossman's broader work and his training program, not at the heart rate zones specifically. Robert Engen, in the Canadian Military Journal, concluded that although On Killing and On Combat form an excellent starting point, there are too many problems with their interpretation for them to be considered the final word on the subject. Samuel Walker, a criminal justice professor at the University of Nebraska Omaha, said the training is unacceptable for domestic policing and that the best police chiefs in the country do not want anything to do with it. The mayor of Minneapolis banned fear-based training including these seminars in 2019, and Minnesota enacted a statewide ban in 2020.

The practical instruction does not depend on the model being true. You lose precision under stress with or without a number attached to it.

The interval you can actually shorten

Why people hear gunfire and think of something else

Indoors, a gunshot is a sharp concussive report that reverberates off hard surfaces and loses its directional cues. Outdoors, at distance, and especially in a crowd with music, it flattens into something that sounds like fireworks or construction, which is why much of the Las Vegas crowd accepted the fireworks explanation in 2017.

No psychoacoustic study of gunshot identification by untrained listeners was available for this book. What exists is the measured aggregate: 35 seconds at Parkland between the first shots and the first 911 call, with four people already down, in a building staffed by people whose job is supervising others. Do not try to identify the sound. Act on the possibility.

What to do about all of it

Pre-decide. The 2016 action orientation study found that the disposition to act rather than deliberate, measured beforehand, predicted performance under pressure. Deliberation is the block in the diagram you can delete.

Choose gross motor actions. Push a door, throw a chair, grab a barrel, pull a windlass. Nothing in your plan should require fine precision.

Give yourself a verbal trigger. A single word said out loud is an external cue, and external cues interrupt the freeze. Saying "go" out loud works for that reason.

Move first, refine second. Any movement in a survivable direction beats a better movement thirty seconds later.

Rehearse under some stress. Time pressure, noise, and unpredictability in a drill are what the 2011 police shooting study was testing.

Expect distortion, and plan for the record. You will miss sounds, lose track of time, and misremember details, and your account will differ from the video. Note the clock time as soon as you can. Chapter 18 covers how that conflict gets handled in litigation.

Chapter 9

Run, Hide, Fight and Its Critics

Run, Hide, Fight is the most widely taught civilian response model in the United States. For an untrained person it is a reasonable baseline, and it is wrong in four specific ways. The people who documented those four flaws work inside homeland security, not outside it.

Where the model came from and what it actually says

Run, Hide, Fight was created and trademarked by the City of Houston Office of Public Safety and Homeland Security, funded through the Department of Homeland Security Urban Area Security Initiative grant program and the Regional Catastrophic Preparedness Initiative. The video that carried it into national use is widely reported as produced in 2012, a date that could not be confirmed from the City's current page and appears in the punch list. The City's wording and the Federal Bureau of Investigation's wording differ in one word that matters.

Quote whichever body you name. The distinction between immediate and imminent is small in ordinary speech and large in a courtroom.

The Bureau's Active Shooter Event Quick Reference Guide also instructs initial responding officers to prioritize threat containment over assisting injured persons, with rescue teams following. Chapter 14 is built on the consequence.

The case for the model, stated at full strength

It is memorable. Its most careful critic concedes this first. Suzanne Tannenbaum, in Prepare to Fight: Is the National Active Shooter Response Model Due for an Upgrade?, Homeland Security Affairs, Naval Postgraduate School Center for Homeland Defense and Security, September 2020, writes that the current model is memorable, which is helpful during a frightening situation. Three words survive a startle response. A decision matrix does not.

Escape genuinely is the best answer most of the time. The model puts the highest value option first, and it is right to.

Untrained people cannot safely hunt a gunman. This is the Bureau's serious argument. A civilian who goes looking for an attacker in a building is likely to be shot by the attacker, likely to be shot by police, and unlikely to correctly identify what he is looking at. Ordering escape first is not timidity. It is a correct read of what an untrained person can actually do.

It scales. A model that can be taught to a hundred thousand employees in a fifteen minute video has a reach no scenario-based curriculum will match, and institutional adoption is near universal. Yale University's emergency management program, one example among thousands, publishes active assailant guidance built on the same three steps.

The criticisms, in full

It does not address the freeze. The model tells a person what to do and says nothing about the state they will be in when it is time to do it. Chapter 8 sets out the defense cascade: arousal, freezing, flight or fight, tonic immobility. A response model with no mechanism for breaking the freeze is missing its first step. This is my own criticism, supported by the physiology literature; as far as this book's research found, the published critics of the model do not make it explicitly.

It reads as sequential when it is not. This is Tannenbaum's central point. Running does not have to be the first response, hiding does not need to follow running, and fighting is not the last resort. She proposes a continuous situational assessment model in which the person keeps reading the situation and moves between the three modes as the event dictates, on the tactical premise that a moving target is harder to hit than a static one.

Lockdown gets applied where it does not fit. John Whitney IV, in Active-Shooter Response: Defensive Tactics and Tactical Decision-Making for Elementary School Teachers and Staff, Homeland Security Affairs, December 2017, writes that lockdown should be an option, not the solution, and that response strategies need to evolve beyond the basics of lockdowns. Lockdown was designed for a threat outside the building, and once a shooter is inside it is the wrong tool. Once staff commit to an area they believe is secure, they have limited chances to re-evaluate and change what they are doing. His instruction is three phrases: do not delay, be decisive, move with a purpose.

Hiding, done as concealment rather than as denial of access, gets people killed. The Advanced Law Enforcement Rapid Response Training Center states it flatly: whether you live or die while playing dead is a matter of chance. Attackers commonly re-engage people on the ground. Its curriculum cites Virginia Tech, where rooms in which occupants played dead had much higher fatality rates, and names Kristina Anderson, shot again there while appearing incapacitated, and Natalie Hammond, who at Sandy Hook used a brief playing-dead tactic and then barricaded.

Not everyone can run. Vertical evacuation from a high-rise is not available in the ninety second window, a problem examined by James Seebock in Responding to High-Rise Active Shooters, Homeland Security Affairs, December 2018. Neither is running available to a wheelchair user, a person with an infant, a nurse with a ventilated patient, or a teacher with twenty-four six-year-olds.

The competing models, and what their names concede

Avoid, Deny, Defend was developed in 2004 by the Advanced Law Enforcement Rapid Response Training Center at Texas State University and is delivered through the Center's Civilian Response to Active Shooter Events course, a four hour train-the-trainer program. Avoid starts with state of mind: pay attention to your surroundings, have an exit plan, move away from the source of the threat as fast as you can, and prefer more distance and more barriers. Deny is about access: keep distance, build barriers that stop or slow the threat from reaching you, turn the lights off, stay out of sight and quiet, silence your phone. Defend is stated without qualification: if you cannot avoid or deny, defend yourself, be aggressive and committed, do not fight fairly, this is about survival.

The word changes are themselves an argument. Avoid was chosen over Run to accommodate people who cannot run. Deny was chosen over Hide because denying access is stronger and more active than concealment. Defend was chosen over Fight partly because many campuses prohibit fighting as a disciplinary matter. A doctrine author conceded three of the four criticisms above in its own naming decisions.

ALICE stands for Alert, Lockdown, Inform, Counter, Evacuate, and is delivered by the ALICE Training Institute, which reports 18,000 certified instructors across all 50 states. The Institute states that its program aligns with National Fire Protection Association Standard 3000, the standard for an active shooter and hostile event response program. Its Counter element is not framed as fighting; it is noise, movement, and distraction to disrupt the intruder's focus. The organization states that its training is not sequential and is not a checklist.

The one comparative study in circulation, covered in chapter 6, reaches this book only through a vendor summary and describes simulations rather than field events. Label it that way wherever you use it.

What Israeli practice teaches, and what does not transfer

Israeli security practice and civilian defense training are commonly described as emphasizing immediate neutralization: closing distance, charging, disrupting, and overwhelming an attacker rather than waiting, with trained armed civilians expected to engage quickly and an active collective response cultivated in place of quiet concealment.

Two of the sources supplied for this section, the Jewish Policy Center piece and the Rexhepi piece, are opinion and advocacy rather than data, and this book treats them as such.

The structural context can be documented, and it cuts against the naive version of the argument. Israeli firearms licensing has historically been restrictive and needs-based, with a license required to acquire, possess, sell, or transfer. Before 2018, eligibility was largely limited to retired military and police, residents of the West Bank, and licensed hunters, and a 2018 reform extended it to citizens with combat training and a rifleman qualification. Requirements include minimum age with military or national service, three years of residency, criminal, health, and mental background checks, a stated genuine reason, a training course, and a home safe. Roughly 40 percent of applications were rejected. Before October 2023, only about 2 percent of Israeli civilians were armed. After the attacks of October 7, 2023, the National Security Minister issued emergency directives sharply expanding access, and the government called on armed civilians to form protective groups.

The pre-2023 Israeli model was not mass civilian armament. It was a small, heavily vetted, trained, and legally obligated armed population in a society with near-universal conscription and a shared threat model. The transfer problem to the United States is therefore not mainly about the availability of guns. It is about selection, training standard, legal duty, and shared recognition protocols between armed civilians and responding police. That last variable is what kills armed defenders in this country, and chapter 13 works it in detail.

What I teach

I prefer an active response, for the reason in chapter 2 rather than any philosophy of self reliance. If most events end before officers can engage, the people present are the response, and a doctrine that trains them to wait trains them for a phase of the event that will already be over.

Keep the mnemonic, because a memorable model survives a startle response, and fix what is around it. The three words are options rather than stages, and which options are available is set by the space you are in: whether a route exists, whether a barrier exists, and whether the attacker is entering your space. Teach the freeze explicitly, so people know what is happening to them and have a cue to break it. Teach counterattack as a real skill with mechanics. And teach the decision in advance, because the interval you can compress is deliberation, not startle.

Chapter 10

Getting Out

Leaving is the highest value option, and because everyone treats it as obvious, almost nobody teaches it. One rule governs it: the first exit is usually better than the best exit, because time spent selecting a route is time spent standing still in a building with a shooter in it.

The exit you never noticed is the one you will need

People leave buildings the way they entered, and under stress that habit hardens, so crowds pile into one familiar door while three other routes stand empty. In any room where you spend time, find the exits that are not the main entrance: service corridors, kitchen doors, loading docks, stairwell doors, alarmed emergency exits, ground floor windows.

An audible alarm on a door is a social barrier, not a physical one. Push it. The alarm becomes useful information for everyone else in the building.

Learn where each exit puts you relative to where you are, and where you come out. A door that leaves you in an enclosed courtyard is not an exit, it is a smaller room.

Choosing a direction with incomplete information

You will not know where the attacker is. You will have sound, movement, and possibly an alert naming a location.

Move away from the sound. A bad estimate of direction beats no estimate. Indoors, reverberation makes direction unreliable, so treat the estimate as weak and update it.

Put distance and structure between you and the sound. Distance is the most useful protection available to an unarmed person. Structure means load-bearing walls, masonry, and vehicle engine blocks, not drywall and not interior doors.

Do not converge on the alarm or the crowd. If the crowd is moving toward the noise, do not join it.

Do not double back for anything. Not a bag, a phone, or a coworker who said they were coming.

Keep going. The parking lot outside the door is not the destination. Distance, then structure, then stop.

Moving with other people

Groups do two useful things and one dangerous thing: they spread information, they physically move people who are frozen, and they clump into a dense target.

Lead by moving. The most effective instruction to a frozen room is a person walking through the door and saying one short thing loudly. "This way. Now." works. Long explanations do not.

Do not negotiate. The official wording, in both the City of Houston and Bureau versions, is to evacuate regardless of whether others agree to follow. You can take a person by the arm as you go. You cannot hold a debate.

Spread out once you are moving in the open. A tight cluster crossing a lobby is a target that requires no aiming.

Keep hands visible and empty from the moment you approach the exterior, which is chapter 15's subject.

People who cannot run

Every plan has to answer this before the day, because it cannot be solved in ninety seconds. The list includes a wheelchair user, a person on oxygen, a patient in traction, a resident with dementia, an infant, a toddler class, a person with a broken leg, and a person who is simply very old.

Assign it in advance. Name in writing the position, not the person, responsible for each individual who will need assistance, with a named successor.

Prefer denial of access over movement for people who cannot move fast. A secured room reached in fifteen seconds beats an evacuation route that takes four minutes. This is where lockdown is the right answer rather than the default one.

Know the equipment. Evacuation chairs in stairwells, transfer sheets, and rolling office chairs are all faster than carrying. The Committee for Tactical Emergency Casualty Care's bystander guidance says the same about moving casualties: common items can be used, such as sheets, chairs, blankets, and lightweight tables.

Practice the assisted route once with the person, if they consent. It will change your plan.

Windows, drops, and what a fall actually costs

A ground floor window is a normal exit, not a desperate one. Know which windows open, which are fixed, and what is on the other side.

Breaking glass is harder than film suggests. Tempered glass fails at a corner or edge rather than the center, and a chair leg or fire extinguisher works better than a body. Clear the frame before anyone goes through, and put a jacket or coat over the sill.

Above the ground floor the calculation changes. A drop from a second story window onto turf is survivable and frequently injurious; a drop onto concrete, a railing, or landscaping with hard edges is a different event. Hang from the sill by your hands first, which removes most of a body length from the fall. A drop from above the ground floor is a genuine last resort.

Crossing open ground

Once outside, the instinct is to stop and look back. Do not. You gain distance for as long as you keep moving.

Move at an angle to any window line or elevated position rather than straight away, and put solid objects between you and the building: vehicles at the engine block, masonry walls, concrete planters, retaining walls. Cars are concealment, not cover, over most of their surface, so keep moving between them.

Set the rally point in advance, and set it far. A point across a street and behind a structure, several hundred feet out, works. A point at the edge of the parking lot collects targets and obstructs arriving units.

Do not go back in for anyone. Tell arriving officers where you last saw the person and describe them. Re-entry gets civilians shot, both by the attacker and by responders who now have an unknown adult moving toward the threat.

Chapter 11

The Barricade

Hiding depends on the attacker not looking. Barricading physically prevents him from getting in quickly and includes a plan for what happens if he does.

The Advanced Law Enforcement Rapid Response Training Center puts the concealment side of it plainly: whether you live or die while playing dead is a matter of chance. Chapter 9 gives the case evidence.

Which way the door swings decides your method

Look at the hinges. If you can see the barrels from inside the room, the door swings toward you and mass will block it. If they are on the other side, the door swings away, mass does nothing, and you need tension.

Inward-swinging door. Lock it first if it locks, then load mass against it: desks, tables, filing cabinets, a bookcase on its side pushed tight. Mass works better low and wide than tall and narrow, because a tall cabinet falls over. Wedge more furniture between the barricade and a fixed object across the room if the geometry allows, because a wedged column resists far more than loose furniture.

Outward-swinging door. Mass is useless. Secure the closer arm or handle with tension: a belt, cord, charging cable, bicycle lock, tourniquet strap, or bag strap, tied to the closer arm and something anchored. Doubling the strap and twisting it tight converts stretch into resistance. The overhead closer arm on most commercial and school doors is the strongest attachment point available.

The latch is the weak point, not the door. Most interior doors fail at the strike plate, where three-quarters of an inch of steel is held by two short screws into a hollow frame. Locking is still the fastest thing you can do in seconds. With thirty seconds, add mass or tension on top of the lock.

Where to put people once the door is set

The mistake is to move everyone into a corner. Corners feel protected and are not. What matters is the cone of space visible and shootable from the door, including through the vision panel and the door itself, since interior doors do not stop bullets.

Put people out of that cone, along the same wall as the door and on both sides of it. A person standing flat against the wall two feet from the hinge side of the door is invisible from the corridor and is standing exactly where they need to be if the door opens.

Keep people off the floor in the middle of the room. Prone in the open is the playing-dead position the case evidence argues against.

Light, sound, and phones

Turn the lights off. Both the Advanced Law Enforcement Rapid Response Training Center's Deny guidance and the standard hide guidance say so. A lit room with a vision panel advertises occupancy. A dark room does not.

Silence phones fully, including vibrate, which is audible against a hard desk. The Bureau's guidance adds silencing the cell phone to the Hide step.

One person calls 911, quietly, then leaves the line open and the phone down rather than talking. Everyone else texts, because text gets through when networks are saturated and makes no noise. If you cannot speak, dial and leave the line open so the dispatcher can hear the room, a documented dispatcher practice that also produces usable audio for chapter 17.

Say nothing to the door, and do not answer a voice in the corridor asking whether anyone is inside. Responding officers identify themselves and will not make you open the door to prove you are there.

Barricading is not waiting. It is preparing

Use the interval behind a secured door.

Everyone picks up something. Fire extinguisher, chair, laptop, hot coffee, scissors, a heavy stapler, a wall-mounted whiteboard, a mop handle. Chapter 12 covers what to do with them. What matters here is that they are in hands rather than on desks.

Position for the door. The two strongest people stand on the hinge side, closest to where the door opens, which produces contact at maximum surprise and minimum distance.

Identify the second way out. Windows, connecting doors, ceiling access to an adjoining space. Check them before you need them; a window onto a survivable exit may change your decision entirely.

Count and account. Know who is in the room. Chapter 15 will need that list.

Treat bleeding now. If anyone in the room is bleeding heavily, that is the immediate priority behind a secured door, and chapter 14 is the procedure.

When the barricade becomes a trap

A secured room is a good decision under three conditions: no escape route existed, the door is genuinely secured, and the occupants are prepared to fight if it fails. Without all three, you are shut in a room with no plan for what comes next.

John Whitney IV's criticism in chapter 9 applies here: once staff commit to an area they believe is secure, they have limited opportunities to re-evaluate and change what they are doing. If a door has held for four minutes and the shooting has moved to another wing, start looking at the window and the corridor again.

Reassess on a loop: is the threat still near, has a route opened, is the door still holding, is anyone bleeding. If a survivable exit becomes available and the threat is elsewhere, go.

Chapter 12

Fighting Back

Unarmed civilians ended 53 of 597 attacks by physically subduing the attacker, against 27 ended by a civilian firing a weapon. Physical intervention is the more common form by roughly two to one and deserves the same specificity as anything else here.

The instruction from Avoid, Deny, Defend is the right one, in its own words. Be aggressive and committed to your actions. Do not fight fairly. This is about survival.

Control the muzzle, not the man

Everything the attacker can do to you passes through the muzzle. Get it off your body and the fight becomes a wrestling match, which is survivable.

Both hands on the weapon, not on the attacker. Grab it and drive it down and away, toward the floor and past the attacker's centerline. Down is better than up, because up puts rounds through the ceiling into the floor above.

A semiautomatic pistol can be stopped with your hands. The slide has to move for the weapon to load the next round. A firm grip on the slide, or pressure that pushes it back out of battery, produces one shot at most and then a malfunction that takes both hands and several seconds to clear. That is a property of the design, available to anyone who can grip the gun.

A revolver stops if the cylinder cannot turn. A hand wrapped around the cylinder prevents rotation, which prevents the next shot.

A long gun is a lever, and you have the long end. Grab the barrel or handguard and drive it in an arc, using leverage the attacker does not have. After several shots the barrel will be hot enough to burn you. Take the burn.

Do not fight for possession. Taking the weapon away is slower than keeping it pointed at the floor. Direction is the objective; possession comes later or never.

The closing problem, and why distance decides

A person who acts first at contact distance has an enormous advantage, because the attacker has to perceive the movement, decide, and respond while you are already moving. That advantage disappears with distance: crossing a room toward a person already looking at you and holding a firearm gives him the whole interval to aim.

Three conditions make an approach viable. He is looking somewhere else. Something breaks his view of you as you move: a display, a partition, a doorway. He is doing something with both hands.

Reloads and malfunctions are the openings

Two moments take a shooter's hands and attention off shooting: a reload and a malfunction. Both are recognizable by sound, because the firing stops and what follows is metallic and rhythmic rather than concussive. A reload takes both hands and a look at the weapon; a malfunction takes both hands, a look, and often several seconds. That is when you move, and when a room behind a door goes through it. Do not wait for a perfect pause. The best moment is the one where he is not looking at you, and it will not be announced.

Swarm, do not queue

One person attacking a shooter is a fight. Four attacking at once is an overrun. The difference is simultaneity, not courage: sequential attackers get handled one at a time, which is what the attacker is equipped for.

Assign before you go, in four words. "I take the gun." Everyone else takes a limb, the head, or the legs.

Go together on a cue. A word, a count, or the door opening all work, so long as everyone has the same one.

Drive him to the ground and stay on him. Weight on the chest and hips, arms controlled, weapon separated and moved away rather than held by anyone standing. Chapter 15 explains why the person holding a gun when officers arrive is in the greatest danger in the building.

Do not stop early. The common failure in a group intervention is disengaging when the attacker stops moving. Hold him until officers physically take over.

Weapons of opportunity, ranked by what they do

Mass and reach beat sharpness. A blunt object that reaches farther than his arms is worth more than a sharp one that requires you to be inside them.

Targets that actually work

Under stress, fine targeting fails, so aim for large unprotected structures. Eyes and throat produce involuntary reactions no resolve overrides. The groin is defended by instinct and is not reliable. Knees and ankles collapse structure and are useful with a striking object that has reach. All of it is secondary: the weapon is the primary target, and striking buys you the grip.

Chapter 13

The Armed Defender

I run a firearms training center and I teach this skill. A person who carries a gun should get the real odds in both directions and then decide for himself. Three problems govern armed intervention: hitting what you aim at under lethal stress, being recognized as the defender rather than the attacker, and being present with a weapon at all. Each is harder than it sounds, and the second is what gets defenders killed.

What the data says about civilian gunfire ending attacks

Of the 597 attacks the Advanced Law Enforcement Rapid Response Training Center logged from 2000 through 2024, a civilian shot the attacker in 27, or 4.5 percent, and subdued him without gunfire in 53, or 8.9 percent. Chapter 3 sets out the Bureau figure of 4.6 percent, the Crime Prevention Research Center figure of 35.7 percent, and why they differ.

Whichever figure you use, the conclusion is the same. Armed civilian intervention happens, it saves lives when it happens, and it is not the mechanism by which most of these events end.

Accuracy under stress, and the number nobody has

The hit rate figures that circulate in this field, including the frequently cited police shooting statistics, could not be verified from primary sources for this book, so no number is asserted here. The direction is supported: Nieuwenhuys and Oudejans, in Cognitive Processing, 2011, found that training with anxiety matters, which only makes sense if performance degrades under anxiety. Add the perceptual distortions in Table 8.1. A person in that state is not shooting the way they shoot on a square range.

Then add the conditions a range does not have: people moving across your line of fire, a moving target, an unknown backdrop, bystanders behind the attacker, and legal exposure for every round that misses. Hitting a moving target under lethal stress is a military or police grade skill. What you have to meet is a training standard, not a purchase.

Greenwood Park Mall is the ceiling, not the expectation

On July 17, 2022, at the Greenwood Park Mall in Indiana, a 22 year old named Elisjsha Dicken engaged an attacker 15 seconds after the first shot. He fired 10 rounds and hit the attacker 8 times from about 40 yards. He had no police training and no military training; he was taught to shoot by his grandfather. The attacker had fired 24 rounds and killed three people and injured two. Greenwood Police Chief James Ison described him as a responsible armed citizen who took action very quickly, and described his shooting as very proficient.

That performance is an extreme outlier against everything known about shooting under stress. It belongs in the record, as the ceiling rather than the expectation. Plan against the floor.

The identification problem is the one that kills defenders

On November 11, 2018, at Manny's Blue Room Bar in Robbins, Illinois, a 26 year old armed security guard named Jemel Roberson subdued a shooter and pinned him to the ground. An officer from the neighboring Midlothian department arrived and shot Roberson multiple times, and his death was ruled a homicide. Witnesses said the officer fired not even five seconds after ordering him to drop his gun, and that bystanders were shouting that he was security. Illinois State Police stated that he wore plain black clothing with no markings. No criminal charges were brought, a decision announced in 2020, and the City of Midlothian settled for $7.5 million in July 2022. He had won the fight and had the attacker on the ground, and he was holding a gun when an officer arrived who had no way to know who he was, in a dark bar, with people screaming, seconds after being dispatched to a shooting.

Two additional cases are widely reported as following the same pattern of an armed civilian who stopped an attacker and was then killed by a responding officer. Neither could be verified for this book, and both are named in the punch list. If the pattern holds across all three, it is the central operational risk of armed civilian intervention, and it is not what most carry permit courses spend their time on.

John Lott's claim that an armed citizen has yet to accidentally shoot an innocent bystander, even accepted in full, does not address this risk, because the harm here runs in the opposite direction. The documented cost of armed intervention has mostly been paid by the defender.

Access, and why the question often does not arise

Most public spaces prohibit firearms, including schools, courthouses, federal buildings, hospitals, stadiums, many workplaces, and any private property that posts a prohibition. A person who complies, which is most permit holders, is unarmed in exactly the locations where these attacks concentrate. That is the Crime Prevention Research Center's argument in chapter 3, and it is an argument about opportunity.

For most readers, in most of the places they will be, the armed option will not exist. Everything in chapters 10, 11, 12, and 14 will.

If you carry, these are the rules that keep you alive afterward

The shooting is not the hard part. The ninety seconds after it are.

Do not hunt. Moving through a building looking for an attacker is what most often gets a defender shot by police, and it is what the Bureau warns about when it says untrained people cannot safely hunt a gunman.

Know your backdrop before you press the trigger. Every round that misses keeps going, and in a mall, a school corridor, or a church it keeps going into people.

The instant the threat stops, the gun goes away. Holster it, or set it down and step away. Do not stand over the attacker holding it, and do not walk toward sirens holding it. That is the Roberson fact pattern.

Hands empty, open, and high, above shoulder level. Fingers spread. Nothing in either hand, including a phone.

Comply instantly and completely. Officers will treat you as a threat until they decide otherwise. Do not explain while moving, reach for identification, or turn toward them. Expect to be handcuffed.

Say the short version. "I am a civilian. I am unarmed now. My gun is on the floor behind me." Everything else waits.

Expect to be a suspect first and a witness second. That is not a failure of the system, it is the system working with the information available.

Chapter 14

Bleeding Control

The Federal Bureau of Investigation's own quick reference guide instructs that initial responding officers prioritize threat containment rather than assisting injured persons, with rescue teams following afterward. That is correct doctrine, and its consequence is that the first officers who go past you are not coming to help you. Whoever is still standing in that room has to stop the bleeding.

Bleeding is the number one cause of preventable death after injury, according to the American College of Surgeons Stop the Bleed program, which also reports that 80 percent of operating room deaths within 24 hours of trauma are due to severe blood loss. The program runs under license from the United States Department of Defense, has trained more than five million people in 168 countries, and reports that 17 states have passed bleeding control legislation.

Three phases, and what you do in each

The Committee separates care by what the threat is doing, because the correct action changes with it.

Direct threat care. The Committee's language is that in the presence of a direct threat to life, you take definitive action toward mitigating that threat, ensuring everyone's safety, and facilitating rescue of injured persons. The bystander document names Run, Hide, Fight among the appropriate established emergency procedures. Under direct threat the medical work is small. Control life threatening external bleeding if you can do it without exposing yourself, and move.

Indirect threat care. The threat is not immediately present, and this is where the work happens. The Committee organizes it as MARCHE: Major hemorrhage, Airway, Respirations, Circulation, Head and hypothermia, Everything else. Tell injured and uninjured people alike to move to a safer position if able and to apply self aid. Confirm 911 has been called. Give psychological support through encouragement, reassurance, and by explaining the care you are giving.

Evacuation care. Moving casualties. The Committee notes that common items can be used, such as sheets, chairs, blankets, and lightweight tables.

Hypothermia is on that list because a bleeding casualty loses temperature fast and cold blood clots poorly. A jacket or a blanket is a medical intervention.

Tourniquets, and the high and tight rule

The Committee's technique language, quoted rather than paraphrased because paraphrasing it has done harm in the field. Apply it as high as possible on the limb, either directly to the skin, or, if unable to fully expose the wound, over the clothes. Not over joints, not over protruding bones, not over bulky items in a pocket. If bleeding continues, apply a second tourniquet closer to the torso. And the rule people get wrong under pressure from a screaming casualty: a tourniquet should not be released or loosened because of pain. On equipment: a proven commercial tourniquet is always the first tourniquet choice if available, and improvised tourniquets do not always work and may be difficult to make under stress.

Packing a wound that a tourniquet cannot reach

Tourniquets work on arms and legs. They do not work at the neck, shoulder, armpit, groin, or buttock, and those junctional areas bleed catastrophically. The Committee instructs you to pack the wound with gauze or a hemostatic agent before a pressure dressing goes on, and for junctional wounds to pack with a hemostatic agent and apply direct pressure per the manufacturer's directions.

The mechanics, in order. Find the source of the bleeding inside the wound, which usually means putting a gloved finger in it. Push gauze deep onto that point and keep feeding it in until the cavity is packed tight. Hold hard direct pressure there for at least three minutes without lifting to check, then bandage over it while maintaining pressure. If it bleeds through, leave the packing, pack more on top, and press harder.

Do not pack a chest or abdominal wound. Those are pressure and rapid transport problems, not packing problems.

The evidence for tourniquets, and where to read it

Prehospital tourniquet use has a substantial civilian literature. If you are building a program or testifying about one, read it directly. Relevant papers include Teixeira and colleagues on civilian prehospital tourniquet use and survival in patients with peripheral vascular injury, Journal of the American College of Surgeons, 2018; Henry and colleagues on increased prehospital tourniquet use and patient survival in a Los Angeles countywide study, same journal, 2021; Smith and colleagues on decreased transfusions and limb complications, Journal of Trauma and Acute Care Surgery, 2019; and Thai and colleagues on improved functional outcomes, Surgery, 2023. Two systematic reviews cover the field: Eilertsen and colleagues in Prehospital and Disaster Medicine, 2021, and Kauvar and colleagues in Journal of Trauma and Acute Care Surgery, 2018. The military foundation is Beekley and colleagues on tourniquet use in Operation Iraqi Freedom, Journal of Trauma, 2008.

This book quotes no survival percentages from those papers, because the outcome figures were not extracted from the primary sources for this project. The direction of the literature is consistent and favorable; take the magnitudes from the papers.

What to carry and where to put it

A kit in a closet on another floor is a kit you do not have.

On your person. One commercial tourniquet, in a pocket or on a belt, and a pair of gloves. That is the personal minimum and it fits in a jacket pocket.

In a bag or a vehicle. Two tourniquets, two packages of gauze, at least one with a hemostatic agent, a pressure bandage, gloves, and trauma shears.

In a building. Public access bleeding control kits mounted beside automated external defibrillators, in numbers matched to the occupancy, checked on the same schedule as fire extinguishers. Put every kit on the floor plan, and give the floor plan to responders.

Training with it. Open one and apply it to your own leg over jeans, hard enough that it hurts. Carrying a tourniquet you have never taken out of the package is not the same as being able to use one.

Chapter 15

After the Shooting Stops

The shooting stopping does not end the danger. Officers are entering a building where they cannot tell who is who, families are converging on the site, and people are listed missing who are not. Every decision in the next hour will be examined for years, and almost no civilian training covers any of it.

How not to get shot by the people who came to help

Responding officers arrive with a dispatch description that is often wrong, sounds they cannot localize, and people running toward them. Everyone in the building is an unknown, and the proving takes about a second.

Hands empty, open, and high. Above shoulder level, palms out, fingers spread. Nothing in either hand. An officer at twenty feet sees a shape in your hand, not a phone.

Stop moving when told, and do exactly what you are told. Do not walk toward officers. Do not point. Do not grab anyone. Do not reach for a wallet or a badge or a pocket for any reason.

Do not expect to be believed immediately. Expect to be searched, separated, and possibly handcuffed. It is a sorting procedure, and it ends.

Say the shortest true thing. Where the shooter is or was, and what he looks like. Then stop talking and follow instructions.

If you were armed, chapter 13 governs. The gun is on the ground and you are away from it before officers can see you.

Know in advance what the officers will do, because it looks like indifference and is not. Under the containment doctrine in chapters 9 and 14, they will step over people who are bleeding and will not stop for someone screaming for help, because the fastest way to cut the total casualty count is to stop the shooting.

Accounting for people, which is harder than it sounds

The list of who is missing will be wrong, because people left through exits nobody watched, drove home, went to a hospital in a private car, or are standing in a different parking lot. Each puts a name on a missing list, and each name puts a family through the worst hour of their life.

Account by roster, at a designated point, in writing. Not by memory, not by shouted headcount, not in a group text.

Collect names of people last seen, and where. This is the most useful information you can give an incident commander, and it belongs on paper with a time on it.

Do not send anyone back inside for any reason.

Push the roster to one place. Partial lists held by several supervisors produce false missing persons. One list, one person maintaining it.

Track people who self-transported. One person calling each receiving hospital closes more missing person cases in the first hour than anything else.

Reunification is a separate operation, run at a separate place

Families will arrive within minutes, at a site that is simultaneously a crime scene, a medical operations area, and a staging area for responders. The reunification site has to be somewhere else, named in the plan before the day.

Every review raises the same two practical points. Cell service at the site will fail from load, so plan a channel that does not depend on it, and the reunification site needs its own security, because it gathers the same population in an unprotected place.

The first hour, in order

The Incident Command System, the standardized management structure used across American emergency response, exists because the first hour produces parallel decision makers who do not know about each other. Chapter 19 shows what happens when nobody sets it up. Someone has to be in command, named out loud, and everyone else has to know who it is.

Establish command and say who has it. Even a small organization needs one named person working with the incident commander.

Give responders the building. Floor plans, keys or badge access, camera access, the location of bleeding control kits and utility shutoffs, and someone who knows the building standing next to the commander.

Preserve the record. Suspend every automatic purge. Chapter 17 depends on data deleted within days, and the decision has to be made in hour one by someone not yet thinking about litigation.

Designate one spokesperson. One voice, one channel, on a schedule. Correct errors rather than ignore them, and never speculate about the attacker, the count, or the cause.

Get the uninjured somewhere warm, private, and away from cameras.

Start the support process the same day, not with a memo two weeks later. Everyone present, including staff who did their jobs perfectly, will need somewhere to go.

Write it down before it decays

Chapter 8 established that memory under stress fails in specific and predictable ways. Your account will change, in the direction of what you hear from other people.

Write your own account as soon as you are physically able, before you talk to other witnesses, with a real clock time on it. Record what you saw and heard, not what you concluded. Write "three or four shots" if that is what you have. Do not estimate distances or durations with false precision. Note what you did and when. That document gives investigators a statement made before contamination, and years later, when you are a witness in a case you did not ask to be part of, it gives you a record of what you knew at the time.

Chapter 16

Working the Scene

An active shooter scene is the largest and most trampled crime scene most agencies will ever process. It is created during a mass casualty medical operation, walked through by dozens of responders who had to walk through it, and handed to investigators whose findings will be litigated for a decade. A civil case tried in 2030 will be tried on the photographs, measurements, and recordings taken in the first 72 hours.

The scene is bigger than the shooting

The evidentiary scene includes the approach route, the vehicle, the entry point and its hardware, every room entered, every round fired including those that hit nothing, the treatment areas, the evacuation routes, and the command post. It also includes the dispatch recordings, radio traffic, video systems, access control logs, and the mass notification system's log of what it sent and when. Two categories get lost most often: door and lock hardware, which often decides the negligence case, and digital records, which are deleted automatically on a schedule nobody suspends.

Evidence categories, and what each one can actually prove

Mapping, and the limits of what cases on the floor tell you

Document the scene three ways before anything is moved: overall photography with scale references, a measured map, and a three-dimensional record by laser scanning or photogrammetry. The measured map is what allows a reconstruction to be tested, and a scene documented only by photographs can be argued about indefinitely.

Cartridge case positions are useful and routinely oversold. A case ejects in a direction and distance that varies with the weapon, the ammunition, the grip, the angle, and what it hits after it leaves, and then it bounces, rolls, gets kicked, and gets carried away on a boot. A cluster indicates a general area where firing occurred. It does not fix a shooter's feet on a tile. Say that plainly in the report, because opposing counsel will find the overstatement and the correction costs more than the point is worth.

Sequencing shots, and what physics allows

Sequencing decides whether a defender fired before or after the attacker, whether a door was open or closed at a given moment, and whether a person was standing or already down.

Glass fractures sequence themselves. A radial fracture from a later impact stops when it reaches an existing fracture. That termination relationship establishes order between two impacts on the same pane, and it is one of the few reliable sequencing methods available.

Trajectory work establishes geometry, not order. Rods, strings, and lasers through paired defects give a line, and a line plus a second defect gives an origin zone. Angular uncertainty grows with distance, so report the origin as a volume rather than a point.

Overlapping defects establish order. Where one bullet path disturbs material that a second path passes through, the relationship can sometimes be read directly.

Audio establishes order and interval, and it is the strongest tool available. Chapter 18 covers it.

Witness accounts do not establish order. Chapters 8 and 18 explain why.

Firearms examination, stated at the level it deserves

Firearms and toolmark examination associates fired cases and bullets with a specific weapon by comparing microscopic marks. It is useful and has been criticized for overstated conclusions, so the reporting language matters. Function testing matters more than identification here, because the questions that decide these cases are whether the weapon malfunctioned, how many rounds the magazines held, how many reloads occurred, and whether the trigger required separate deliberate presses.

Round count is a reconstruction, not an observation. It comes from recovered cases, recovered bullets, defects, magazine capacity, and audio, each of which undercounts in a different way.

Where the criminal case and the civil case collide

The criminal investigation controls the evidence and the civil case depends on it, which produces predictable friction.

The evidence is held, sometimes for years. Criminal proceedings, or an open investigation where the attacker is dead and no prosecution will occur, can keep physical evidence and records out of civil discovery for a long time. Move early for preservation rather than production, because preservation is what cannot be fixed later.

Public records requests are a parallel track. Dispatch audio, agency policies, inspection records, and after-action documents are often obtainable outside civil discovery, and faster.

Repairs destroy the premises case. The building will be repaired and reoccupied, sometimes within weeks, because people need to go back to work or school. Doors get replaced, walls patched, glass swapped. If door hardware matters, and in a school or workplace case it almost always does, identify, photograph, measure, and preferably retain it before the building is restored.

Third-party vendors hold critical data. The camera system, access control platform, and mass notification service are usually outside contractors with their own retention policies and no notice of the litigation, so each needs its own preservation letter.

Chain of custody has to survive the chaos. The scene was worked by multiple agencies under emergency conditions. Documenting who collected what, when, and where it went is what allows any of it to be admitted five years later.

Chapter 17

Building the Timeline

Two official reviews show what a second-level timeline is worth. The Advanced Law Enforcement Rapid Response Training Center's assessment of Robb Elementary School fixes a door propped at 11:27:14, a vehicle crash at 11:28:25, firing through classroom windows at 11:32:08, entry through the unlocked west door at 11:33:00, more than 100 rounds fired between 11:33:24 and 11:36:04, three officers entering at 11:35:55, officers approaching and retreating at 11:37:00, the scene declared contained at 11:38:37, and the subject neutralized at 12:50:03. The Marjory Stoneman Douglas High School Public Safety Commission fixes first shots at 2:21:38 p.m., the first 911 call at 2:22:13, fire alarms at 2:22:39, the school resource deputy arriving at 2:23:17, and the end of the attack at 2:25:35.

Neither came from a witness. Both were built by aligning independent recordings on a single clock, and in litigation the side with the better timeline sets the terms of the argument.

Every source has its own clock, and none of them agree

Each system stamps time from its own internal clock. Video recorders drift. Access control panels are set at installation and never corrected. Body-worn cameras synchronize to a dock on an irregular schedule. Cell phone video carries the phone's clock, usually network-synchronized and usually good. Computer-aided dispatch is typically the best-disciplined clock in the set. Offsets of minutes are routine, and offsets of hours occur when daylight saving changes or time zones are set wrong. A reconstruction that takes stamped times at face value produces a sequence that is confidently, precisely wrong.

The method, step by step

Pick the master clock and name it, usually the dispatch system. Every time in the exhibit is stated on that clock, and the footer says so.

Inventory every source with its native start time and duration. Include sources you will not end up using, because their absence will be asked about.

Find shared events, meaning anything that appears in two independent records: a gunshot audible on a 911 call and on a phone video, a radio transmission heard behind a body-worn camera, a door opening visible on camera and stamped in the access log, a fire alarm on multiple recordings, a vehicle arriving in two camera views.

Compute the offset for each source, and write it down. Camera 4 runs 3 minutes 12 seconds fast against dispatch. That documented number is what makes the reconstruction auditable.

Check each offset against a second shared event. If two shared events give different offsets, the clock is drifting and the offset varies with time. That is common with older recorders and must be modeled rather than averaged away.

State the uncertainty for every entry. An event fixed by a video frame at 30 frames per second is good to a fraction of a second; one fixed by an emergency medical services narrative is good to a few minutes. Both belong on the timeline, marked differently.

Keep derived events visually distinct from recorded events. A recorded event was captured by a system; a derived event was inferred. Mixing them is the flaw an opposing expert finds first.

What each source is actually good for

Dispatch and 911 audio. The best combination of accurate timestamps and content. Gunfire audible behind a 911 call is often the most valuable artifact in the case, because it carries both a reliable clock and the acoustic record chapter 18 analyzes.

Radio traffic. Establishes what responders were told and when, the core of the response-adequacy question in chapter 19 and in any claim against a public entity.

Video. Establishes position and movement. Frame timing is precise relative to itself even when the stamped clock is wrong, so video is an excellent interval measure and an unreliable absolute clock until synchronized. Cell phone video fills the gaps fixed cameras do not cover.

Access control and alert logs. Establish door states, often the whole premises liability case: whether a door was propped, whether it locked, whether a badge was used, whether an exit alarm fired. Alert logs establish when a notification was sent, to whom, and by what channel, and the gap between the first shot and the alert is a number juries understand immediately.

Building the demonstrative that wins

A jury cannot hold twelve simultaneous facts. The exhibit that works is a single horizontal clock with a few labeled tracks, built so one relationship dominates: the gap between two events.

Show intervals, not just times. The number that persuades is not 2:22:13. It is 35 seconds.

Use one clock and say so on the face of the exhibit.

Color separate sources consistently, and keep derived entries visually distinct.

Build it so it can be taken apart. Every entry needs a source available on cross-examination: recording, file, timestamp, and applied offset.

Do not animate anything you cannot defend frame by frame. An animation is testimony, and every element of it will be examined as testimony.

Show the uncertainty. Say which entries are precise and which are approximate. Opposing counsel cannot impeach a limitation you disclosed.

Chapter 18

Sound, Video, and Reaction Time

I have been retained on firearms reaction time in a mass shooting and bombing matter. The questions are narrow and nearly always the same. How long did this take. Could this person have perceived it and acted differently. What did the recording capture. Each has a defensible method and a set of ways to get it wrong.

What a gunshot is, acoustically

A firearm discharge produces a muzzle blast, a pressure wave from expanding gas at the muzzle. A projectile traveling faster than sound also produces a ballistic shock wave, heard as a sharp crack, which for a listener near the bullet's path arrives first. A microphone downrange of the shooter records two events per shot; one behind him records one.

Sound travels roughly 1,100 feet per second in air at ordinary temperatures, so a recording made 550 feet from the muzzle captures the report about half a second late. In a reconstruction measuring tenths of a second, propagation delay is not a rounding error, and it differs for every device in the case.

Indoors, the report reflects off hard surfaces and arrives repeatedly, which is why a single shot in a corridor can be counted by a witness, and sometimes by an analyst, as two or three, why direction is unreliable indoors, and part of why people misclassify the sound, as the Las Vegas crowd did in 2017.

A recording establishes that shots occurred and the intervals between the impulses captured. It does not establish the total number of shots fired, and an opinion that it does will not survive a competent cross-examination.

Why witness accounts of counts and timing cannot build a clock

Alexis Artwohl's survey of 157 officers involved in shootings, published in the Federal Bureau of Investigation Law Enforcement Bulletin in October 2002, produced the perceptual distortion figures in Table 8.1. Her conclusion is the one to put in front of a jury: memory is not like a video recording of an event.

That finding is about trained, armed professionals who knew what a gunshot was, and it applies with more force to a civilian witness. Shot counts are unusable as counts. Duration estimates are unusable as durations, and they skew long because of the slow motion effect. Sequence is sometimes usable and must be corroborated. Location and identification are frequently usable and are what a witness is for.

Say this without impugning the witness. Divergence between an account and the physical record reflects a documented perceptual effect, not dishonesty. A cross-examination that treats an honest witness as a liar loses the jury; one that explains auditory exclusion keeps them.

Video timing, and the mistake everyone makes

Video is the best interval measure in the case and one of the worst absolute clocks.

Measure by frames, not by the burned-in clock. The displayed timestamp comes from a drifting system clock; the frame sequence comes from the recorder's capture cadence and is far more reliable for intervals.

Verify the actual frame rate from the file, not the specification. Many systems record at a variable rate, drop frames under load, or use different rates on different channels. Frames divided by an assumed rate produces a confident wrong number.

Know the difference between recorded rate and displayed rate. Export and playback software frequently resample.

Use the original file. Exported clips and re-encoded copies lose metadata and can alter timing. Get the native format from the recorder with the manufacturer's player.

Understand rolling shutter and motion blur before opining on position. A fast-moving object photographed by a sensor that scans line by line is geometrically distorted in the image.

State the resolution of your measurement. At 15 frames per second, no event can be placed more precisely than about a fifteenth of a second, and that limit belongs in the report.

How reaction time analysis is actually done

Reaction time analysis answers a bounded question: given a stimulus at a known moment, what is the earliest a person could have completed a specified response. It is not an opinion about what someone was thinking.

Break the response into components. Stimulus onset is when the information physically became available, established from the recordings rather than assumed. Perception is the interval before it registers. Decision runs longer when the person must choose among options than when the response is single and prepared, and longer still when the stimulus is ambiguous. Motor initiation and movement is measurable and depends on the physical action. In a firearms case, add the weapon's mechanical time and the projectile's flight time.

This book asserts no numeric latency values, because none were verified from primary sources for this project. In a case, the values come from the peer-reviewed literature applicable to the specific task, from testing, or from both, and every value gets disclosed with its source and its population.

One reliable field-measured interval is available. At Parkland, 35 seconds elapsed between the first shots and the first 911 call, in a building with four people already down. That is recognition plus decision plus action, measured in an official document, and it is the number I would put in front of a jury to explain why nobody moved sooner.

Defending the opinion

Reaction time testimony draws challenges, and it should. The opinions that hold up share six features.

The stimulus is established, not assumed. Show from the record when the sound or sight reached the person's position, including propagation delay and line of sight.

The task is specified precisely. "Recognize gunfire, turn, and move three steps" is a task. "React appropriately" is not.

The population matches. Data from trained officers does not transfer to an untrained civilian, or the reverse, without saying so.

The method is reproducible. Another expert with the same recordings should reach the same intervals. Provide the files, the offsets, and the frame counts.

The uncertainty is stated in the opinion, not extracted on cross.

The opinion stays inside its lane. An expert can say the earliest possible completion of a specified response was a stated interval after the stimulus. An expert cannot say what a particular person perceived, believed, or intended.

The last one is where most challenges succeed. Perceptual and cognitive limits are general; an individual's state of mind is not an engineering question, and the moment an opinion crosses into it, everything before it becomes vulnerable.

Chapter 19

What the Reviews Keep Finding

Official reviews of these events, written by different bodies in different years about different agencies, keep producing the same findings. Command was not established. Communications failed. Entry was delayed because the event was reclassified. The alert did not go out, or went out wrong. A door that should have been locked was not.

Three reviews could be sourced for this book and only those are used: the Department of Justice Office of Community Oriented Policing Services critical incident review of Robb Elementary School, 2024; the Advanced Law Enforcement Rapid Response Training Center's assessment of the same event, June 30, 2022; and the Marjory Stoneman Douglas High School Public Safety Commission initial report, January 2, 2019. The Pulse nightclub review is named in the sources, but its primary document could not be retrieved and nothing is attributed to it.

Failure one: the event gets reclassified, and entry stops

The Department of Justice review states the doctrinal rule in one sentence.

An active shooter with access to victims should never be considered and treated as a barricaded subject.

Critical Incident Review: Active Shooter at Robb Elementary School, United States Department of Justice, Office of Community Oriented Policing Services, 2024

The same review found the most significant failure was that responding officers should have immediately recognized the incident as an active shooter situation. Once they retreated after being met with gunfire, they began treating it as a barricaded subject scenario.

The Center's timeline records officers entering at 11:35:55, being fired on and retreating at about 11:37:00, and the scene declared contained at 11:38:37. The subject was neutralized at 12:50:03, which the Department of Justice review puts at 77 minutes after the first officers entered. The standard the reclassification violated was neither new nor obscure: the Center's assessment quotes the 2020 joint position of its own program and the Federal Bureau of Investigation, that we expect officers to assume risk to save innocent lives.

Failure two: nobody is in command

The Department of Justice review found that none of the law enforcement leaders at the scene established an incident command structure to provide timely direction, control, and coordination. The Center's assessment reached the same conclusion independently two years earlier: it does not appear that effective incident command was established during this event. Its summary of the consequence is that momentum was lost, and it took more than an hour to regain momentum.

The Center's assessment also documents an officer outside the building who had a rifle on the suspect and asked his supervisor for permission to shoot. By the time he turned back, the suspect had entered. An absent command structure produces exactly that: a trained person seeking authorization no one was positioned to give.

Failure three: the people inside are not told

At Parkland, the Public Safety Commission found that on the third floor well over 100 students were in the east end of the hallway, with no indication that a shooter was in the building because no Code Red was called. Many were smiling and apparently engaged in casual conversation. The fire alarms had activated at 2:22:39 p.m., sending people into corridors under a fire evacuation model, while the second floor treated the incident as an active assailant response. That contrast is why chapter 5 ranks alerting above every other hardening expenditure. For everyone outside the room where the shooting is happening, the alert is the response.

Failure four: a door

The Center's Uvalde timeline records a teacher propping the west exterior door with a rock at 11:27:14, and the subject entering through the unlocked west door at 11:33:00.

The same door findings appear in review after review: doors propped for convenience, doors that did not latch when pulled closed, classroom doors that could only be locked from the corridor side and required a teacher to step into the hallway, and doors whose locks were known to be broken and were on a work order.

Every one of those is cheap to find and cheap to fix, and every one of them is a documented plaintiff's exhibit.

Failure five: the response to the wounded

Doctrine has initial officers bypass casualties to stop the shooting, with rescue teams following. That is correct, and it means the interval between the end of the shooting and the arrival of medical care is a planned one. When command is not established, that interval extends, because nobody is authorized to bring medical personnel into a space not declared secure. Chapter 14 exists because of that interval, and chapter 15 because families and staff read it as abandonment unless somebody told them in advance.

Why the same findings recur

The recommendations are published, consistent, and taught. They recur anyway, for three structural reasons.

Training is not the same as rehearsal under stress. Chapter 6 makes this point about civilians and it applies to responders. An officer who has taken a course has knowledge; an officer who has run the scenario has a behavior.

Multiple agencies converge with incompatible assumptions. Uvalde involved school district police, city police, county deputies, state police, and federal agents, each with its own doctrine and radio system. Interoperable communications and a single command fix this, and both must exist before the day.

Reclassification is psychologically comfortable. Treating an event as a barricade converts an emergency into a procedure with time in it, and relieves the demand to enter a room where people are shooting. That is why doctrine states the rule as an absolute, and why the Department of Justice review states it as never.

These reviews describe competent, trained, courageous people producing a delayed response under confusion. If you are not a police officer, plan on the basis that the same thing can happen where you are.

Chapter 20

Negligent Security and Foreseeability

A negligent security claim asserts that a property owner or occupier failed to take reasonable measures to protect people on the premises from a foreseeable criminal act by a third party. It is ordinary negligence with one hard problem in the middle: the immediate cause of the harm was a deliberate crime by someone else.

The four elements, and where these cases are won

Duty. The general common law rule is that a person has no duty to protect another from the criminal acts of a third party, so duty arises from a relationship or from circumstances. The relationships commonly recognized include business owner to invitee, landlord to tenant, innkeeper to guest, common carrier to passenger, school to student, and employer to employee. Which ones a state recognizes, and how far the duty extends, varies.

Breach. Whether the measures taken fell below the standard of care. This is where chapters 5 and 6 become evidence.

Causation. Whether the failure caused the harm. This is the hardest element in almost every one of these cases and where most of them are defended.

Damages. Rarely disputed in an attack case, which is why the other three are fought so hard.

Foreseeability is the threshold, and states use different tests

Foreseeability does most of the work, because in most jurisdictions it governs whether a duty existed at all. Four approaches appear in American law, and they produce different results on identical facts.

Two features matter more than the labels. The same facts can produce a duty in one state and no duty in the next, so the choice of forum can settle the case before any evidence is heard. And the prior similar incidents approach interacts badly with active shooter facts, because these attacks are statistically rare at any location. A shopping center with a documented history of armed robbery may or may not have foreseen a mass shooting, depending on the test and on how the court characterizes the category of harm. That is the strongest defense argument in the field: a location with no history of anything resembling this attack, in a category of event that is rare nationally, may not have been on notice.

What actually proves notice

Notice is proved with documents, and in most cases they already exist.

Prior incidents at the property and nearby. Police calls for service, incident reports, and internal security logs. Calls for service reach further back and cover more than reported crimes.

Threat reports the organization received. The threat assessment file from chapter 4 is the most direct notice evidence there is, and it will be produced.

Complaints. From employees, tenants, parents, or customers, about doors, lighting, loitering, or a specific person.

The organization's own risk assessments. A security assessment recommending measures the owner declined is the most damaging document in this category, and it is common, because assessments get commissioned and then partially funded.

Work orders. A broken lock on a work order for eight months is notice, breach, and causation in one page.

Insurance and vendor communications. Carrier loss control recommendations and vendor proposals that were not accepted.

Proving the standard of care

There is no single national standard for physical security, which cuts both ways. Five sources get used.

The organization's own policies. The most persuasive standard in the room is the one the defendant wrote for itself and did not follow. Juries understand that immediately.

Consensus standards. National Fire Protection Association Standard 3000, the standard for an active shooter and hostile event response program, is the consensus document most likely to be cited in this space. Confirm its current edition, scope, and adoption status directly. It is in the punch list.

Regulatory requirements. State school safety mandates, panic alarm statutes, and licensing requirements for particular facility types, covered in chapter 21.

Industry practice. What comparable properties in the same market actually do, established through discovery and through expert testimony.

Expert testimony. What measures were available, what they cost, what they would have delayed, and what the timeline would have looked like with them in place.

Causation is where these cases are actually decided

Assume the defendant should have installed classroom locks and did not. The defense answer is that the attacker would have shot the same people anyway, that the lock would have been open, that the door would not have been reached in time, or that a determined attacker defeats any measure. That argument has real force, and it is why plaintiffs lose on causation more often than on duty.

The counter to that argument is the timeline. Part three is how you build the causation case.

Establish the intervals by the method in chapter 17: when the first shot occurred, when the alert went out or did not, where each victim was, and when the attacker reached each door.

Establish what the missing measure would have changed, in seconds. A lock that engages in two seconds, an alert that reaches a wing forty seconds sooner, a door that latches instead of standing open. Then show from the timeline where the people were during those seconds.

Show the comparison inside the same event where one exists. The Parkland floors are the model, and an internal comparison neutralizes the argument that nothing could have mattered.

Do not overclaim. The honest opinion is usually that a measure would have reduced exposure for a defined group during a defined interval, not that it would have prevented the attack. Overclaiming here loses credibility on everything else.

The defenses that appear in every one of these cases

Superseding cause. The intentional criminal act of a third party broke the chain. Whether it did turns on whether that act was the very thing that made the defendant's conduct negligent, a question courts answer differently.

No duty because unforeseeable. Discussed above, and often dispositive at summary judgment.

Compliance with all applicable requirements. Persuasive but not conclusive, because code compliance does not automatically establish reasonableness.

Comparative fault. Rarely aimed at victims in these cases, and dangerous to attempt.

Governmental immunity. For public schools and public entities, immunity doctrines, discretionary function exceptions, damages caps, and notice-of-claim deadlines frequently decide the case before the merits. Those deadlines run in months and are jurisdictional. Check them first, for every potential public defendant.

Chapter 21

Schools, Employers, and Venues

Three categories of defendant carry duties from somewhere other than ordinary premises liability. Employers have a federal statutory duty, schools have state statutory mandates and a custodial relationship, and venues have contracts, crowd management obligations, and a shifting set of security vendors. Each produces its own documents, and the documents are the case.

The employer's federal duty is one sentence long

The Occupational Safety and Health Administration has no standard specific to active shooter events. It has the General Duty Clause, Section 5(a)(1) of the Occupational Safety and Health Act:

Each employer shall furnish to each of his employees employment and a place of employment which are free from recognized hazards that are causing or are likely to cause death or serious physical harm to his employees.

Occupational Safety and Health Act, Section 5(a)(1), as published by the Occupational Safety and Health Administration

Everything about workplace violence enforcement runs through the word "recognized." A citation generally requires that a hazard existed, that it was recognized, that it was causing or likely to cause death or serious physical harm, and that a feasible means of abatement existed. Recognition can come from the employer's own knowledge, the industry's, or common sense knowledge of the hazard. Confirm those elements against current enforcement directives before arguing them; the agency's workplace violence guidance could not be retrieved for this book and is in the punch list.

Whether an employer recognized a hazard is answered from its own documents: prior incidents, threat reports, security assessments, employee complaints, and internal policies identifying the hazard. An employer with a written workplace violence prevention program has recognized the hazard by definition. One without a program may still have recognized it, through its industry or its own history.

What the employee can and cannot sue for

An injured employee's claim is usually channeled into workers' compensation, which in most states is the exclusive remedy for workplace injury and bars a tort suit against the employer. Exceptions vary by state, commonly including intentional conduct and, in some states, a substantial certainty standard. That channeling is why these cases so often proceed against the property owner, property manager, security contractor, alarm or camera vendor, or an unrelated third party. Identify every entity with a contractual or possessory relationship to the space early, because the employer may be the one defendant who is immune.

Separate from workers' compensation, employers face claims for negligent hiring, negligent retention, and negligent supervision when the attacker was an employee, and those claims turn on what the employer knew about that person and when.

Schools carry a custodial relationship and statutory mandates

Schools occupy a different position because students are required to be there and are in the school's custody. The duty framework generally recognized includes reasonable supervision, reasonable measures against foreseeable harm, and compliance with state statutes. The statutory layer is entirely state by state, and these are the categories to check.

Drill requirements. Many states set a minimum number of lockdown or emergency drills per year, sometimes with specified content and record-keeping.

Safety plan requirements. A written plan, filed with or approved by a state agency, and sometimes required to be updated annually.

School safety officers and threat assessment teams. Several states require districts to establish behavioral threat assessment teams and follow a defined process, which converts chapter 4 from best practice into a legal obligation.

Panic alarm mandates. Legislation commonly called Alyssa's Law requires silent panic alarms linked directly to law enforcement in some states. The state list, effective dates, and any 2025 and 2026 amendments could not be verified for this book and are in the punch list. Confirm your state's current requirement from the statute.

Facility standards. Some states specify door hardware, entry vestibules, or camera requirements, often tied to funding.

The governmental immunity and notice of claim doctrines in chapter 20 dominate school cases, and immunity frequently turns on whether the challenged decision was discretionary or ministerial. Both are addressed at the start of a case or not at all.

Venues, contracts, and the security vendor

A venue is a premises case with three complications: crowds, contracts, and an outsourced security function.

Crowd management is its own hazard. Ingress and egress capacity, screening point locations, and crowd behavior under alarm are engineering questions, and in several documented events injuries came from crowd movement as much as from the attack. A venue's plan should address what happens to a crowd when an alert is announced, and usually does not.

The contract allocates the duty and the money. The venue's agreement with its security contractor, the promoter agreement, the tenant lease, and the ticket terms all matter. Look for scope of services, required staffing levels, indemnity provisions, additional insured status, and any limitation of liability, then compare the staffing the contract required to the staffing the payroll records show.

Delegation does not automatically transfer the duty. An owner who hires a security contractor may retain a nondelegable duty depending on the jurisdiction and the relationship. Verify locally.

Screening creates its own record. If a venue screens, the protocol, training records, equipment maintenance logs, and queue design all become evidence, and the question is whether screening was performed as designed.

The 2025 and 2026 changes, stated honestly

Legislation and standards moved during 2025 and are moving in 2026. This book's research could not verify what changed, and no specific change is asserted. Check three things before relying on this chapter: state school safety and panic alarm statutes amended in the 2025 and 2026 sessions, the current edition and adoption status of National Fire Protection Association Standard 3000, and any state level workplace violence prevention requirements, which in some states now reach beyond health care.

Chapter 22

Defending the Defender

A person who intervenes faces three legal exposures: criminal prosecution, civil suit by the attacker or the attacker's estate, and civil suit by anyone else injured. They run on different standards and timelines, and a person can be cleared of the first while losing the second. The rules are state law and vary more than the public debate suggests. The state counts below come from the National Conference of State Legislatures compilation Self-Defense and Stand Your Ground, last updated September 23, 2025.

The elements that every self defense analysis shares

Whatever the jurisdiction, five questions recur.

Reasonable belief. Did the person reasonably believe force was necessary to prevent death or great bodily harm. The standard is generally objective, or a hybrid of what the person believed and what a reasonable person would have believed.

Imminence. The threatened harm must be immediate or imminent, not anticipated. A threat that has ended is not a justification for force.

Proportionality. Deadly force requires a threat of death or serious bodily harm.

Absence of provocation. A person who provoked the confrontation generally loses the justification, sometimes regaining it by withdrawal.

Retreat, where required. Whether the person had a duty to retreat before using deadly force, if retreat was safely possible.

In an active shooter event the first three are usually satisfied on the facts. The exposure comes from rounds that missed, people hit who were not the attacker, mistaken identification of the attacker, and force used after the threat had stopped.

Duty to retreat, by state category

The National Conference of State Legislatures identifies 31 states, plus Puerto Rico and the Northern Mariana Islands, with no duty to retreat under stand your ground provisions: Alabama, Alaska, Arizona, Arkansas, Florida, Georgia, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Michigan, Mississippi, Missouri, Montana, Nevada, New Hampshire, North Carolina, North Dakota, Ohio, Oklahoma, Pennsylvania, South Carolina, South Dakota, Tennessee, Texas, Utah, Washington, West Virginia, and Wyoming.

Two states are identified as imposing a duty to retreat outside the home through case law rather than statute: New Jersey and Rhode Island.

Eight states are identified as permitting deadly force in self defense through court decisions or jury instructions rather than by statute: California, Colorado, Illinois, New Mexico, Oregon, Vermont, Virginia, and Washington.

Florida's statutory formulation illustrates the structure: a person who is in a dwelling or residence in which the person has a right to be has no duty to retreat and has the right to stand his or her ground and use or threaten to use nondeadly force against another when and to the extent that the person reasonably believes that such conduct is necessary to defend himself or herself or another against the other's imminent use of unlawful force.

Civil immunity is separate from criminal justification

Being cleared criminally does not end civil exposure unless a statute says so. The National Conference of State Legislatures identifies 23 states with civil immunity provisions attached to justified self defense: Arizona, Arkansas, Colorado, Florida, Georgia, Idaho, Illinois, Indiana, Kentucky, Louisiana, Maryland, Michigan, Montana, New Hampshire, North Carolina, North Dakota, Ohio, Oklahoma, Pennsylvania, South Carolina, Tennessee, West Virginia, and Wisconsin.

It also identifies six states in which a criminal acquittal does not by itself confer civil immunity: Hawaii, Missouri, Nebraska, New Jersey, North Dakota, and Tennessee.

Immunity provisions differ in what they cover, how they are invoked, whether a pretrial hearing is available, who bears the burden, and whether attorney fees are recoverable. An immunity statute is the beginning of the analysis, not the end.

The third row gets overlooked. Self defense justifies force against the attacker. It does not answer for a round that struck a bystander, which sounds in negligence, where the standard is what a reasonable person would have done, bringing in backdrop, target identification, distance, and training. Chapter 13's rules exist for legal reasons as well as tactical ones.

Defending someone else is a different question, and the answer varies

Defense of others turns on a doctrinal split that decides cases and that most people have never heard of.

The reasonable belief rule. The defender is justified if they reasonably believed the person they were defending was entitled to use force, even if that belief turns out to be mistaken.

The alter ego rule. The defender stands in the shoes of the person defended and is justified only if that person actually had the right to defend themselves. A reasonable mistake is no defense.

With an armed defender of ambiguous status, that distinction is decisive. Consider a bystander who sees two men struggling over a gun, one of them an off-duty officer, and intervenes on the wrong side. Under a reasonable belief rule the analysis is about the reasonableness of the perception; under an alter ego rule it is about who was actually in the right.

The good Samaritan who intervenes without a weapon

Unarmed intervention, which chapters 3 and 12 show is about twice as common as civilian gunfire, deserves the same legal analysis.

The justification framework is the same: reasonable belief, imminence, proportionality. Exposure arises from injuries to the attacker after the threat has ended, from injuries to bystanders during the struggle, and, for a person acting in an employment capacity, from the employer's policy.

Good Samaritan statutes exist in every state and generally protect a person who renders emergency medical aid in good faith without compensation. Their scope varies, and they are not a general shield for intervening physically in a fight. Verify your state's statute before assuming coverage for anything beyond rendering aid.

What to do in the hour after you intervene

The Roberson case in chapter 13 is the reminder that the physical danger continues after the fight ends. The legal exposure begins at the same moment.

Secure the weapon and separate from it. A survival step and the first fact in the report.

Identify yourself to officers as a civilian, and comply completely.

Ask for counsel, plainly and politely. It is not an admission of anything.

Give the short public safety information immediately. Where the attacker is, whether anyone else is armed, where injured people are. That saves lives and is not a confession.

Then stop, and give the full statement after you have counsel. Chapter 8 explains why an account given in the first hour contains errors that are perceptual rather than deceptive, and why those errors will be used later.

Preserve what you can. Note the time, do not wash your hands or change clothes before you are told to, and do not post anything.

Chapter 23

Experts and Trial

I have testified for plaintiffs and for defendants, and the work that holds up comes from refusing cases and refusing opinions I cannot support. An expert who will say whatever a case needs is worth nothing to that case after the first deposition.

Six experts, and what each one can actually prove

Cases in this field get staffed badly. One expert is asked to opine on security standards, police tactics, wound ballistics, and human perception, then gets dismantled on the three outside his competence. The six scopes are distinct.

Two of those scopes overlap in my own work, firearms and reaction time. The question is a single chain: when the stimulus occurred, how long a specified response takes, what the weapon mechanically does, and where the projectile went. Splitting it across two experts creates a seam for opposing counsel to open.

Getting admitted, and staying admitted

Expert testimony in federal court is governed by Federal Rule of Evidence 702 and the reliability analysis associated with the Daubert line of decisions. Many state courts follow a comparable standard; others follow the general acceptance test associated with Frye. Rule 702 has been amended, so read its current text directly. That item is in the punch list, with the reminder that state standards differ. What survives challenge shares six features.

A method that existed before the case. Timeline synchronization, trajectory analysis, and acoustic measurement are established. An approach invented for this matter invites the question of why.

Inputs another expert can verify. Provide the recordings, frame counts, offsets, measurements, and calculations. Reproducibility is the strongest answer to a reliability challenge.

Stated uncertainty. An origin volume rather than a point, an interval with a resolution attached, a range rather than a figure implying precision the data does not support.

Opinions inside the discipline. A firearms expert who opines on what a person was feeling has put the entire report at risk of exclusion.

Consistency with prior testimony. Everything you have written and said is available, and a position taken five years ago will be read to the jury.

No unsourced statistics. The three figures named in the punch list, on average event duration, average police response, and time to death from arterial bleeding, cannot be traced to a primary source. A prepared cross-examiner will ask where the number came from, and there is no good answer available in the witness chair.

What a jury can hold

A jury can absorb one clock, three numbers, and one comparison. The rest is context they will not retain.

One clock. All times on the master clock from chapter 17, stated on the face of every exhibit.

Three numbers, chosen deliberately. In most of these cases they are an interval, a distance, and a count: thirty-five seconds before anyone called, forty yards, four minutes and nineteen seconds.

One comparison, which is what makes the numbers mean something. The best comparisons are internal to the event, because they control for everything else. The Parkland floors are the model.

Demonstratives follow the same rule: one horizontal timeline with a few tracks, one floor plan with the relevant sight line drawn, and one physical object if the case allows, whether a lock, a door closer, a tourniquet, or a magazine. Jurors remember objects they watched a witness handle.

Where these opinions get destroyed

Overclaiming causation. The defensible opinion is that a measure would have changed exposure for a defined group during a defined interval. The indefensible one is that a measure would have prevented the attack.

Treating a witness account as data. Chapter 18. Shot counts and durations from witnesses are perceptual reports, not measurements.

Taking timestamps at face value. An expert who did not compute clock offsets has produced a sequence that may be wrong by minutes.

Ignoring the alternative explanation. An alternative first raised on cross is fatal. The same alternative addressed and rejected in your own report reads as rigor.

Reaching outside the record for the attacker's state of mind. Nobody knows why. Do not opine on it.

Failing to inspect. Inspect the site, examine the weapon, and handle the actual hardware. An opinion about a door written from photographs is answered by anyone who went and looked at it.

What I have learned at trial

Concede early and concede fully. Every case has facts against it. A witness who volunteers them holds the jury for the facts that matter; one who defends the indefensible loses everything else at the same moment.

Teach, do not argue. The expert's role is to let the jury evaluate the evidence themselves. Advocacy from the witness stand reads as bias.

Bring the object. I have built, fired, rigged, and detonated the systems I testify about. When a jury watches a witness handle a door closer, thread a tourniquet, or show what a slide out of battery means with an actual pistol, they learn it in a way no slide deck achieves.

Answer the question that was asked, then stop. The pause after a complete answer belongs to the examiner, not to you.

Say "I do not know" when you do not know. It costs one answer and it buys credibility for every other answer in the deposition.

Write the report you would want to cross-examine. State the method, inputs, assumptions, uncertainty, and the alternatives you considered and rejected. A report that discloses its own limits cannot be impeached with them.

Decline the case you cannot support. An expert's credibility is built by turning down the matters where the honest opinion does not exist, not by winning hard ones.

Appendix A

Field Card

Print this page, cut along the two panels, and carry it. Everything on it appears elsewhere in the book with its reasoning attached.

Appendix B

Glossary

Every term introduced in this book, defined once.

Active shooter

The category the Federal Bureau of Investigation applies when designating incidents for its annual reports, centered on one or more people actively engaged in killing or attempting to kill in a populated area. It excludes categories other researchers include, which is why counts differ between sources.

Advanced Law Enforcement Rapid Response Training Center

A center at Texas State University that trains law enforcement in active attack response, maintains the Active Attack Database, and developed Avoid, Deny, Defend and the Civilian Response to Active Shooter Events course.

ALICE

Alert, Lockdown, Inform, Counter, Evacuate. A commercial response model delivered by the ALICE Training Institute, which states that the elements are not sequential and not a checklist.

Alter ego rule

In defense of others, the rule that the defender stands in the shoes of the person defended and is justified only if that person actually had a right to use force. A reasonable mistake is not a defense. Contrast the reasonable belief rule.

Auditory exclusion

The perceptual loss or attenuation of sound under high stress. Reported by 84 percent of officers in Artwohl's survey of 157 officers involved in shootings.

Automatic gain control

A recording circuit that lowers the recording level after a loud sound. It can make later gunshots on a recording appear quieter or disappear entirely.

Avoid, Deny, Defend

The response model developed in 2004 by the Advanced Law Enforcement Rapid Response Training Center. Avoid is distance and exit planning, Deny is denial of access, Defend is committed physical resistance.

Behavioral threat assessment

A structured process for evaluating whether a specific person is on a pathway to violence, based on what that person is doing, and for managing the case over time. Not profiling.

Castle doctrine

The rule that a person in their own home, and in some states their vehicle or workplace, has no duty to retreat before using force.

Chain of custody

The documented record of who collected an item of evidence, when, and everywhere it went afterward. Without it, evidence may not be admissible years later.

Choice reaction time

The interval to respond when more than one response is possible and the correct one must be selected. Longer than simple reaction time, which is a single prepared response to a single expected stimulus.

Civil immunity, self defense

A statutory provision barring civil suit against a person whose use of force was justified. Twenty-three states have such provisions according to the National Conference of State Legislatures compilation updated September 23, 2025.

Civilian Response to Active Shooter Events

A four hour train-the-trainer course delivered by the Advanced Law Enforcement Rapid Response Training Center, teaching the Avoid, Deny, Defend model.

Committee for Tactical Emergency Casualty Care

The body that publishes civilian trauma care guidance adapted from military combat casualty care, including separate guidelines for active bystanders, first responders with a duty to act, and medical providers.

Crime Prevention Research Center

An organization headed by John R. Lott Jr. that compiles its own active shooter incident data from news reports and reports substantially higher rates of armed citizen intervention than the Federal Bureau of Investigation.

Dead space

The area of a room that cannot be seen or shot from the doorway, generally along the same wall as the door, on both sides of it, where people go during a barricade.

Defense cascade

The sequence of responses to extreme threat described in the clinical literature: arousal, freezing, flight or fight, tonic immobility, collapsed immobility.

Door closer arm

The hinged metal arm at the top of a commercial door that pulls it shut automatically, and the strongest tie-off point in most rooms.

Duty to retreat

The requirement, where it applies, that a person retreat if safely possible before using deadly force. Thirty-one states plus two territories have stand your ground provisions removing it.

Foreseeability

In negligent security, the threshold question of whether a criminal act was sufficiently predictable to create a duty. States apply the specific harm rule, the prior similar incidents test, the totality of the circumstances test, or a balancing test.

General Duty Clause

Section 5(a)(1) of the Occupational Safety and Health Act, requiring each employer to furnish employment and a place of employment free from recognized hazards likely to cause death or serious physical harm. The only federal hook for workplace violence.

Hartford Consensus

A series of consensus documents on improving survival from intentional mass casualty and active shooter events. They could not be retrieved for this book and nothing is attributed to them here.

Hemostatic agent

A gauze or granular product that accelerates clotting, used for packing wounds that a tourniquet cannot reach.

Incident Command System

The standardized emergency management structure used across American response agencies, designating a single incident commander and a defined chain of responsibility so that units from different agencies operate under one plan.

Junctional wound

A wound at the neck, shoulder, armpit, groin, or buttock, where a limb or the head joins the torso. A tourniquet cannot be applied, so the treatment is packing and direct pressure.

Leakage

Communication to a third party of an intent to do harm, before the act, and the most actionable pre-attack behavior because someone received it.

Line of the doorway

The cone of space in a room that is visible and shootable from the door, including through the vision panel and through the door itself, since interior doors do not stop bullets.

Master clock

The single time reference chosen for a reconstruction, usually the computer-aided dispatch system, onto which every other recording is brought by a computed offset.

MARCHE

Major hemorrhage, Airway, Respirations, Circulation, Head and hypothermia, Everything else. The order of treatment in the Committee for Tactical Emergency Casualty Care indirect threat phase.

Muzzle

The open end of a barrel, where the bullet leaves. Its direction is the only variable that determines who gets hit, and the objective of a physical counterattack.

Negligent security

A premises liability claim asserting that an owner or occupier failed to take reasonable measures to protect people from a foreseeable criminal act by a third party.

Notice of claim

A statutory prerequisite to suing a public entity, requiring written notice within a short period. Jurisdictional in most states, and frequently fatal when missed.

Offset

The difference between a recording device's internal clock and the master clock, computed from an event captured in both records and stated explicitly in the report.

Plain language alert

A notification naming the threat and the location in ordinary words rather than a color or numeric code, requiring no translation.

Pre-decision

Deciding, in advance and in a specific place, what you will do first. It removes deliberation, the compressible part of the delay between the first shot and the first useful movement.

Propagation delay

The time for sound to travel from source to microphone, about one second per 1,100 feet in air at ordinary temperatures. It differs for every recording device in a case and must be corrected before intervals are compared.

Reasonable belief rule

In defense of others, the rule that a defender is justified if they reasonably believed the person defended was entitled to use force, even if that belief was mistaken. Contrast the alter ego rule.

Reunification

Returning children or employees to authorized family members after an incident, at a site separate from the scene, with identity verification and documented releases.

Run, Hide, Fight

The most widely taught civilian response model in the United States, created and trademarked by the City of Houston Office of Public Safety and Homeland Security and adopted by the Federal Bureau of Investigation.

Stand your ground

A statutory provision removing the duty to retreat anywhere a person has a lawful right to be, extending the castle doctrine beyond the home.

Stop the Bleed

The bleeding control training initiative created by the United States Department of Defense and operated under license by the American College of Surgeons.

Stress inoculation training

Teaching a skill and then practicing it under progressively increasing stress, so that the skill survives when the stress is real.

Superseding cause

A defense asserting that an intervening act, here the attacker's deliberate crime, broke the causal chain between the defendant's conduct and the harm.

Time distortion

The perception that events ran in slow motion or sped up. Reported in slow motion form by 62 percent of officers in the Artwohl survey and in accelerated form by 17 percent.

Tonic immobility

An involuntary state of motor inhibition under extreme threat, in which a person is conscious and aware but cannot move or speak. Not a decision, not compliance, and not consent.

Tourniquet

A device that compresses a limb circumferentially to stop arterial bleeding. Applied high and tight, tightened until the bleeding stops, timed, and never loosened.

Trajectory analysis

Determining the path of a projectile from paired defects, producing a line and, with additional defects, an origin volume rather than a point.

Weapon of opportunity

Any object in the environment used as a weapon. Mass and reach matter more than sharpness: fire extinguisher, chair, pole, hot liquid.

Wound packing

Filling a wound cavity with gauze or hemostatic gauze pressed directly onto the bleeding source, followed by sustained direct pressure and a pressure dressing.

Appendix C

Sources by Chapter

Live links, grouped by the chapter that relies on them. Sources marked advocacy are opinion pieces, treated in the text as argument rather than data. Sources marked unretrieved could not be read for this book and nothing is attributed to them.

Chapter 1, incident data

• Federal Bureau of Investigation, active shooter safety resources and report series index: https://www.fbi.gov/how-we-can-help-you/active-shooter-safety-resources
• Active Shooter Incidents in the United States in 2024: https://www.fbi.gov/file-repository/reports-and-publications/2024-active-shooter-report/@@download/file
• 2023 report: https://www.fbi.gov/file-repository/reports-and-publications/2023-active-shooter-report-062124.pdf/@@download/file
• 2022 report: https://www.fbi.gov/file-repository/reports-and-publications/active-shooter-incidents-in-the-us-2022-042623.pdf/@@download/file
• 2021 report: https://www.fbi.gov/file-repository/reports-and-publications/active-shooter-incidents-in-the-us-2021-052422.pdf/@@download/file
• 2016 and 2017 report: https://www.fbi.gov/file-repository/reports-and-publications/active-shooter-incidents-us-2016-2017.pdf/@@download/file
• Active Shooter Incidents 20-Year Review, 2000 to 2019: https://www.fbi.gov/file-repository/reports-and-publications/active-shooter-incidents-20-year-review-2000-2019-060121.pdf/@@download/file
• Blair and Schweit, A Study of Active Shooter Incidents in the United States Between 2000 and 2013: https://www.fbi.gov/file-repository/reports-and-publications/active-shooter-study-2000-2013-1.pdf/@@download/file

Chapters 2 and 3, duration, response, and endings

• Active Attack Data Explorer, Advanced Law Enforcement Rapid Response Training Center: https://activeattackdata.org/ and https://activeattackdata.org/1_visuals.html
• What Are We Talking About? Definitional Confusion Within Active and Mass Shooting Research, Journal of Mass Violence Research, 2022: https://doi.org/10.53076/jmvr47829
• Active-Shooter Events in the Workplace: Findings and Policy Implications, 2017: https://doi.org/10.69554/lcym6472
• Center research index: https://alerrtresearch.org/public_output.html
• Crime Prevention Research Center, August 2023 analysis: crimeresearch.org, August 2023
• Correlates of the Number Shot and Killed in Active Shooter Events, Homicide Studies, 2020: https://doi.org/10.1177/1088767920976727

Chapters 5, 6, and 19, official reviews and training research

• Critical Incident Review: Active Shooter at Robb Elementary School, Department of Justice Office of Community Oriented Policing Services, 2024, landing page: https://cops.usdoj.gov/uvalde
• Executive summary: https://portal.cops.usdoj.gov/resourcecenter/ric/Publications/cops-r1143-pub.pdf
• Robb Elementary School Attack Response Assessment, Advanced Law Enforcement Rapid Response Training Center, June 30, 2022: https://alerrtresearch.org/resources/reports/report_2022_uvalde_aar.pdf
• Marjory Stoneman Douglas High School Public Safety Commission Initial Report, January 2, 2019: http://www.fdle.state.fl.us/MSDHS/CommissionReport.pdf
• Public Opinion and the Immediate Entry Dilemma, Journal of Criminal Justice: https://doi.org/10.1016/j.jcrimjus.2025.102578
• Wait for backup or not? Journal of Experimental Criminology, 2023: https://doi.org/10.1007/s11292-023-09592-8
• Saunders, Driskell, Johnston and Salas, The Effect of Stress Inoculation Training on Anxiety and Performance, Journal of Occupational Health Psychology, 1996, PubMed identifier 9547044

Chapters 8 and 18, physiology, perception, and reaction time

• Artwohl, Perceptual and Memory Distortion During Officer-Involved Shootings, Federal Bureau of Investigation Law Enforcement Bulletin, October 2002: https://www.ojp.gov/ncjrs/virtual-library/abstracts/perceptual-and-memory-distortion-during-officer-involved-shootings
• Kozlowska, Walker, McLean and Carrive, Fear and the Defense Cascade, Harvard Review of Psychiatry, 2015, PubMed identifier 26062169
• Volchan and colleagues, Immobility reactions under threat, Neuroscience and Biobehavioral Reviews, 2017, PubMed identifier 28131873
• Abrams and colleagues, Human tonic immobility: measurement and correlates, Depression and Anxiety, 2009, PubMed identifier 19170102
• de Heer and Jones, Tonic Immobility as a Defensive Trauma Response to Rape, Violence Against Women, 2024, PubMed identifier 37203155
• Nieuwenhuys and Oudejans, Training with anxiety, Cognitive Processing, 2011, PubMed identifier 21431863
• Landman, Nieuwenhuys and Oudejans, Decision-related action orientation predicts police officers' shooting performance under pressure, Anxiety, Stress and Coping, 2016, PubMed identifier 26215425
• Dave Grossman, biography and criticism, including the Engen and Walker comments and the Minneapolis and Minnesota policy actions: https://en.wikipedia.org/wiki/Dave_Grossman_(author)
• 2017 Las Vegas shooting, including the initial misidentification of gunfire as fireworks: https://en.wikipedia.org/wiki/2017_Las_Vegas_shooting

Chapter 9, the doctrine fight

• City of Houston, Run. Hide. Fight.: https://www.readyhoustontx.gov/suspicious-activity/run-hide-fight/
• Federal Bureau of Investigation, Active Shooter Event Quick Reference Guide: https://www.fbi.gov/file-repository/active-shooter-event-quick-reference-guide_2015.pdf/@@download/file
• Federal Bureau of Investigation, Active Shooter Attack Prevention and Preparedness: https://www.fbi.gov/how-we-can-help-you/active-shooter-safety-resources/active-shooter-attack-prevention-and-preparedness-asapp
• Tannenbaum, Prepare to Fight: Is the National Active Shooter Response Model Due for an Upgrade?, Homeland Security Affairs, September 2020: https://www.hsaj.org/articles/16661
• Whitney, Active-Shooter Response: Defensive Tactics and Tactical Decision-Making for Elementary School Teachers and Staff, Homeland Security Affairs, December 2017: https://www.hsaj.org/articles/14451
• Seebock, Responding to High-Rise Active Shooters, Homeland Security Affairs, December 2018: https://www.hsaj.org/articles/14976
• Avoid, Deny, Defend: http://www.avoiddenydefend.org/ and https://alerrt.org/page/CivilianResponse
• ALICE Training Institute: https://www.alicetraining.com/
• Yale University emergency management, active assailant response: https://emergency.yale.edu/be-prepared/active-assailant-response-run-hide-fight
• Police1, Why Run, Hide, Fight is flawed. Unretrieved; the site blocks automated access: https://www.police1.com/active-shooter/articles/why-run-hide-fight-is-flawed-dN5jnl7NS8NMJl82/
• Jewish Policy Center, Run, Hide, or Fight: A Poor Strategy for an Active Shooter, May 13, 2019. Advocacy: https://www.jewishpolicycenter.org/2019/05/13/run-hide-or-fight-a-poor-strategy-for-an-active-shooter/
• Rexhepi, The Israeli Response to Active Shooter Situations. Advocacy: https://ardianrexhepi.com/the-israeli-response-to-active-shooter-situations/
• British Broadcasting Corporation news coverage supplied for the Israeli section: https://www.bbc.com/news/world-us-canada-64643047
• Gun politics in Israel, licensing framework and post October 2023 changes: https://en.wikipedia.org/wiki/Gun_politics_in_Israel

Chapter 13, the armed defender

• Greenwood Park Mall shooting: https://en.wikipedia.org/wiki/Greenwood_Park_Mall_shooting
• Cable News Network coverage of the Greenwood intervention, July 19, 2022: https://www.cnn.com/2022/07/19/us/eli-dicken-indiana-mall-shooting-bystander/index.html
• Jemel Roberson: https://en.wikipedia.org/wiki/Jemel_Roberson
• Chicago Tribune, July 14, 2022, on the $7.5 million settlement: chicagotribune.com, July 14, 2022

Chapter 14, medicine

• Stop the Bleed: https://www.stopthebleed.org/
• Tactical Emergency Casualty Care Guidelines for Active Bystanders, November 25, 2024: https://www.c-tecc.org/images/F_TECC_ActiveBystander2024_FINAL.pdf
• Committee guidance index: https://www.c-tecc.org/our-work/guidance
• Teixeira and colleagues, Journal of the American College of Surgeons, 2018, PubMed identifier 29605726
• Henry and colleagues, Journal of the American College of Surgeons, 2021, PubMed identifier 33895335
• Smith and colleagues, Journal of Trauma and Acute Care Surgery, 2019, PubMed identifier 30358768
• Thai and colleagues, Surgery, 2023, PubMed identifier 37735036
• Eilertsen and colleagues, Prehospital and Disaster Medicine, 2021, PubMed identifier 33138876
• Kauvar and colleagues, Journal of Trauma and Acute Care Surgery, 2018, PubMed identifier 29432381
• Beekley and colleagues, Journal of Trauma, 2008, PubMed identifier 18376169

Chapters 20 through 22, legal

• Occupational Safety and Health Act, Section 5(a)(1): https://www.osha.gov/laws-regs/oshact/section5-duties
• National Conference of State Legislatures, Self-Defense and Stand Your Ground, updated September 23, 2025: https://www.ncsl.org/civil-and-criminal-justice/self-defense-and-stand-your-ground

Appendix D

Verification Punch List before Publication

Every item that still needs a primary source, with where to get it, ranked by how much the book depends on it. The research was assembled under a constrained search budget, disclosed here rather than papered over.

About the Author

Steve Wolf

Steve Wolf is an expert witness in firearms, pyrotechnics, stunts, fire, on-set safety, wildfire, theatrical rigging, diving, and explosion cases. He has spent his career in production, building, firing, rigging, and detonating the systems he now testifies about. He founded RangeMaster, Tactical Choices, Wolf Stuntworks, Pyro School, Team Wildfire, Wildfire Labs, Stunt Ranch, and Science in the Movies. He is a patented inventor in applied physics, fluid dynamics, thermodynamics, and combustion engineering, most of it in fire suppression. He is a published author and a Columbia University graduate. He is retained by attorneys nationwide, on both sides, in civil and criminal matters.

On this subject he is a National Rifle Association and state certified firearms instructor and a firearms instructor trainer, a certified Refuse To Be A Victim instructor, and an Anti-Crime Driver Training instructor. He founded RangeMaster, a firearms training center, and Tactical Choices, the first school to tailor firearms training to teachers. He holds a Class 1 Federal Firearms License and a Federal Explosives Manufacturing License. He is certified by the Federal Emergency Management Agency in Active Shooter Response, Incident Command Systems, Incident Management, National Emergency Response, Mass Casualty Incident protocols, Hazardous Materials Handling and Emergency Response, Emergency Planning, Public Information Officer for Disasters, and Disaster Management Command Structure, and he holds Explosives Entry Techniques and Advanced Tactical Pistol training. He has served as a Navy Special Warfare Department contractor and a Secret Service contractor, on Federal Emergency Management Agency Task Force 1, Rescue Division, and with the Shelby County Sheriff's Office Emergency Services Unit. He is an emergency medical technician with first aid and cardiopulmonary resuscitation certification, and has served as Safety Chairman for the Screen Actors Guild and for the International Alliance of Theatrical Stage Employees. He has been retained on firearms reaction time and explosives in a mass shooting and bombing matter, Doe v. United States, Oklahoma City.

Available to attorneys nationwide. SteveWolfExpertWitness.com