WWW.EVERBRIDGE.COM

by Steve Crimando | July 2017

ACTIVE SHOOTER INCIDENT CONSEQUENCE MANAGEMENT & THE ROADMAP TO RECOVERY

WWW.EVERBRIDGE.COM

Overview On July 22, 2011, in the deadliest attack on Norway since World War II, Anders Behring Breivik detonated a vehicle borne explosive in the government district of Oslo, killing 8 and injuring another 209. He then moved on to Utøya Island where he attacked a youth summer camp run by a rival political party, methodically shooting and ultimately killing 69 teens before surrendering to police. In court testimony Breivik claimed that he began planning the attack in 2002.i It is known from the study of hundreds of Active Shooters incidents that these are a predatory form of violence, and that Active Shooter incidents begin long before the first shot is fired. The actual shooting incidents tend to evolve quickly and about 70% of the cases end within 5 minutes.ii The shooter, applying the principles of surprise, speed and violence of action, seeks to create the highest casualty count possible before the police arrive. When the shooter transitions from being the hunter to hunted, he loses his tactical advantage, and the incidents end one way or another quickly thereafter. Understandably, much of the attention has been given to those five minutes of terror in the “response gap,” that time between the first shot is fired and when the first police arrive. This is a time when the action of victims, witnesses and bystanders can be the difference between life and death. But sadly, we have also learned from experience that the psychological, social and economic damage done by a shooting incident can continue to impact individuals, families, organizations and communities for decades after the incident. Much less attention has been given to understanding and proactively planning to manage the post-incident consequences of an active shooter attack. By understanding the critical challenges and action steps associated with the post-shooting environment leaders and decision-makers can better map out the road to recovery. As with other critical incidents it is helpful to apply a phase-specific approach to identify the mile markers along that road to ensure a timely and effective response to the complex post-shooting environment. Planning Along the Event Timeline As the first law enforcement personnel respond to 911 calls and reports of shots fired, they will quickly take command and control of the tactical aspects the situation. It will be necessary to proactively establish liaison between the organization’s leadership team and the law enforcement command structure (Incident Command System). There will be information and support needed from the organization to aid the police response. Floor plans and access to CCTV feeds or files can greatly help tactical leaders gain a better

WWW.EVERBRIDGE.COM

understanding of the operating environment, improve officer safety, and hasten the process of finding and stopping a shooter. Law enforcement officials are likely to give little instruction about how the organization should address the other pressing post-shooting challenges in the immediate response phase. Immediate Response/Pre-Recovery Phase The immediate phase is the first minutes to hours of the crisis. Life safety and survival are the top priorities. In the immediate aftermath of an Active Shooter incident, as the smoke begins to clear, there are a number of foreseeable challenges that can be addressed through pre-planning. For example:

1. Assembly and accountability of evacuees: In the initial attack, many people including employees, guests and visitors, vendors and anyone else who may have been onsite at the time of the incident, may have self-evacuated or followed instructions given by the organization or responding police to evacuate. Individuals in this group should be directed to per-determine assembly or muster points. Such assembly points should not be in adjacent parking areas since it is possible that the attacker(s) may have also left improvised explosive devices (IEDs) in vehicles. Upon arrival at an assembly point evacuees should check in so to begin an accountability process.

WWW.EVERBRIDGE.COM

Employees arriving at assembly points should also be asked and/or quickly looked over to make sure that they have not been hurt. Endorphins, often associated with the “runner’s high sensation are powerful neuro-hormones that activate the body's opiate receptors, causing an analgesic effect. This means that an injured person may not necessarily know that they have been hurt. There are examples of this even with gunshot wounds. Attend to basic needs, such as water and warmth or cooling, basic emotional support in the form of Psychological First Aid, and connection to loved ones as early as possible. These individuals may also be witnesses, and as such, law enforcement officials may wish to interview and take statements from them before they leave. Coordinate the release of these employees with the law enforcement Incident Command structure. Evacuating employees gathered in assembly points should also be instructed to redirect any media questions to the Public Information Officer within the command system and not to speak to the media themselves.

2. Locating and Communicating with Non-Evacuating Employee:

Law enforcement officers employ a slow and meticulous clearing process to search the facility after an attack. They are always cautious that there may be other suspects and that the attacker(s) have carried other hazardous devices or substances into the environment. Employees who may have taken refuge in offices, closets or conference rooms should remain in place until informed by the responding officers that it is safe to move. It will be important therefore, for the organization’s leaders to establish some channel of communications with those barricaded employees since they are unlikely to know the status of the event while in hiding. Informing the law enforcement command team of the whereabouts and

WWW.EVERBRIDGE.COM

status of those hunkered down can help them prioritize the discovery and release of those employees, and/or speed medical support to them if someone has been injured.

3. Family Reunification: The organization’s plans should also envision the need for a Family Reunification Center since loved ones of those in the targeted facility are likely to begin arriving quickly after learning about an attack. Planners should consider indoor venues or the ability to relocate to an indoor venue in inclement weather. Current models of Family Reunification Centers now assume the possibility of up to 8-10 friends and family members converging on the reunification point given how quickly and widely information travels through new media channels. It will be important to control incoming traffic from family members attempting to reach the workplace and located loves ones. Having pre-printed signage (banners, placards, etc.) identifying the various functional areas (e.g., First Responder Staging, Media, Family Reunification, etc.) can help speed initiating and operating the reunification center and leaders should anticipate operating such a center for at least 24-hours post shooting. It will be important to identify the anticipated needs in such an environment, train and prepare some employees to provide leadership and support in those places, and/or develop relationships with community partners and other providers of post-disaster support services to ensure successful operations of such a complex and dynamic environment. EMS and emotional support must be made available for overwhelmed family members. Depending on the duration of family support operations it is helpful to bring Employee Assistance Providers and more formal sources of mental health support, as well as clergy members into the mix.

4. Media Management: Leaders should anticipate local, national and possibly international media to descend on the location. Crisis communications is generally concerned with crafting the right message for various stakeholder groups in the wake of critical incident. Media management is focused on the logistics and interface with representatives of media outlets. Both functions are important since any shooting incident is likely to draw a significant and immediate media response. While the Public Information Officer within the law enforcement command staff will be coordinating the interface with the media in terms of press conferences and the general release of information, it will still be critical for communications professionals within the affected organization to be working in concert with the

WWW.EVERBRIDGE.COM

PIO to coordinate the message and logistics. For example, the media may prefer to position camera teams near the family reunification site or in a place near evacuating employees, but by negotiating with the PIO, the organization may be better able to protect the dignity and privacy of employees by limiting movement of reporters during and immediately following an incident. Coordinate with the Incident Command Staff to limit helicopter news crew access to air space immediately above the workplace. Be thoughtful as to the backdrop for news cameras when selected a Media Staging Area. Media often seek backdrops of the organization’s facilities or distressed individuals and families if not redirected. In the immediate phase messaging from the organization must clearly communicate care, concern and compassion for the victims of the attack and those family members affected. Later messages can transition to themes of restoring normal operations as soon as possible and assuring employees that the organization is a safe place for them to continue to work. By working closely with the PIO the organization’s communicators will have a better sense of timing and when to begin the shift the tone and content of messages. It is critical for every leader to remember that the shooting incident was a crime, that there will be and investigation, and likely litigation, potentially both civil and criminal. Legal counsel should be included in communications decisions as soon as reasonably possible.

5. IT and Communication Challenges: This is a critical area of concern and an intersection with business continuity concerns. There are several potential IT and telecommunications challenges:

a. Key IT and/or telecom equipment may have been damaged or disabled in the attack.

b. Access to data centers and server rooms, as well as other IT hubs may be limited or denied for hours or days.

c. Local cell towers may be inundated with volume.

It may be necessary to use automated Information lines and the organization’s website to provide updates, and to repurposing telephone call centers to help handle to flood inquiries about the incident or the status of employees.

WWW.EVERBRIDGE.COM

Early Recovery Phase The early phase includes the next hours-to-days along the incident timeline. While each active shooter incident is unique, there are commonalities in these situations that allow us to foresee several likely concerns in the various phases. In the early phase, these include:

1. Liaison with receiving hospitals: It will be important for the organization to position a representative at each of the hospitals treating the wounded. Such representatives should focus their attention on the needs of the wounded and their families, such as transportation, lodging, meals and information about the incident and the organization’s response. It will be necessary to work out a schedule to rotate these representatives to provide adequate coverage, but also to protect the representatives from the emotional power of the situation and families’ reactions, including anger at the organization for a perceived failure to keep their loved one safe. It will be important for the representative or liaison to connect with and coordinate support with hospital-based mental health resources, clergy and crime victim assistance personnel to ensure that support is comprehensive and integrated.

2. Mental health support: Mental health support will be necessary for nearly all exposed or affected employees, and should be extended to their loved ones as well. If the organization has a contracted Employee Assistance Program (EAP), that provider may have the capability to provide onsite support in the form of one-on-one and group sessions. The Incident Command staff from the emergency response agencies may also have information and connections to the local disaster mental health and crime victim assistance programs. If the organization has no formal relationship mental health service providers, the National Disaster Distress Helpline can be a viable resource. The helpline is operated by the federal Health and Human Services (HHS)-Substance Abuse Mental Health Services Administration (SAMHSA) on a toll-free, anonymous and confidential basis, 24/7/365. The number is 800-985-5990, and for those who would prefer to communicate by text, the phrase “TalkWithUs” can be texted to 66746. There is also a TTY line at 800-846-8517.

WWW.EVERBRIDGE.COM

In addition to onsite mental health support for affected employees and their families, it will be important to remember that depending on the severity of the attack, there may be spontaneous vigils, funerals and memorial services in the early days after an attack, and emotional support may be important to provide at those places as well.

3. Crime Victim Assistance: While Crime Victim/Witness Advocates from county, state and federal agencies offer an array of important support services, a primary function is compensation to innocent victims for their out-of-pocket losses associated with the crime. This compensation is broad and comprehensive, particularly in the area of long-term medical benefits, and can provide some financial relief to victims who often suffer long-term financial loss in addition to the harm caused by the crime itself In many instances, crime victim support personnel can initiate services within the first several hours of an incident. Immediate financial support may be in the form of assistance with funeral expenses, or helping relatives from outside of the area quickly come to their loved ones who may have been injured. Crime victim assistance may begin in the early phase, but may continue through the long process of recovery and the many legal-justice challenges that victims can find overwhelming.

4. Business Continuity: There are a number of business continuity challenges specific to the early phase. These include:

a. Loss of workplace (part or all) due to damage, crime scene concerns and psychological trauma.

b. Diminished workforce: Dead, injured, grieving, attending funerals, frightened to re-enter workplace.

c. Loss of technology due to ballistic damage, water and smoke, other forces.

d. Loss of critical supplies and equipment. e. Disruption of supply chain, both up and downstream.

Depending on the scope of the crime scene and degree of damage to the facility, alternate worksites or arrangements may be necessary to sustain or quickly resume essential functions. Having a robust continuity plan in place prior to any

WWW.EVERBRIDGE.COM

Active Shooter incident will help in the recovery process.

5. Disaster Restoration/Crime Scene Clean Up: Once the physical location of the attack is no longer deemed a crime scene and is handed back over to the organization, it will be important to have all damage and physical evidence of the attack repaired before bringing the workforce back into the environment. It is strongly recommended that an organization hire a qualified and reputable disaster restoration or crime scene clean up service to handle such a task and not allow the organization’s own janitorial or custodial staff to do the cleanup and repair. In addition to the biohazards involved in the cleanup, it is potentially traumatizing to have employees who routinely have and will need to continue to clean and maintain your facilities exposed to the graphic post-shooting environment. Spare them that experience and let the pros handle it.

6. Human Resource Concerns:

There are several likely human resource issues likely to emerge in the first days and spilling into the first weeks following a shooting incident. Some of the HR concerns naturally overlap with business continuity concerns, including:

a. Reduction of workforce: Injured, killed, traumatized, grieving, and otherwise unable or

b. Legal, moral and ethical challenges related to continuing payroll, extending sick leaves, continuing medical benefits, etc. How will the organization handle absences due to emotional trauma? Will employees be asked to use up their sick time or vacation time if they require weeks or months before they are able to return to work? Will the organization hold their jobs?

c. Time off for responders: As the days begin to move to weeks, the operational tempo will shift from a sprint to marathon mode. Those involved with the organization’s crisis management efforts will likely have been running a full speed, with little rest and high levels of stress. It is wise to consider some down time and a period of decompression before returning to their normal duties. Operational stress control will be an important consideration and those operating at high stress levels for days on end can begin to show signs of wear and tear, sometime affecting judgement and performance. Be realistic in what you expect of crisis team members. These are just a few of what will likely be a long and complex list of HR issues. There are no easy answers to such questions. Organizations must

WWW.EVERBRIDGE.COM

struggle to find the right response based on their unique culture, vision and philosophies.

7. Management of Political Response:

Mass violence is a social issue, as well as an organizational issue. Shooting incidents often become politicized. Mayors, Governors, at times, even Vice Presidents and Presidents have visited the sites of mass shootings to make statements and support the victims and survivors of such events. VIP visits from politicians and celebrities can be highly disruptive. While some survivors may appreciate the show of support from a powerful leader or well-known personality, others find it disrespectful, even shameful, as the attention may be turned away from the victims as the lights and cameras are directed at the special guest. Such VIP visits are a possibility and require active involvement by the organization’s leaders in concert with civic leaders and emergency managers.

8. Return personal affects: In the immediate phase, employees most likely were running for their lives. As per their training in Active Shooter Response, they may have left many important personal effects behind including car keys, purses or handbags, eyeglass, medications, laptops, phones and other devices, all of which can prove to be disruptive to daily life. Since the location will be classified as a crime scene, investigators will need to look over or through everything left behind. They will also be hesitant to allow employees back into the facility to retrieve their belongings. It will be important to work with the Incident Command staff and investigators to determine the timing and method of returning personal belongings to employees. It will be even more important to work out the return of personal effects to those who may have been injured, or to the families to those who were killed. Law enforcement agencies, medical examiners/coroners, and crime victim assistance workers are familiar with this tricky task and can help an organization’s leader facilitate or enable this process.

WWW.EVERBRIDGE.COM

Mid-Recovery Phase The weeks-to-months following an active shooting incident can be considered the mid-phase of recovery. The organization may have returned to somewhat normal business operations, but there will still be many vivid reminders of the incident. Some of the injured may still be hospitalized or in rehabilitation facilities. Some may still not have returned to work due to the powerful emotional effects. There are other likely milestones in the recovery process the will represent challenges for individuals and for the organization.

1. Civil and/or criminal litigation: A harsh reality of workplace shootings is that every bullet comes with a lawyer attached. If the shooter surrendered or survived the police response to the event, criminal proceedings are likely to begin in the weeks to months after the attack. Media coverage of the trial or various processes leading up to a trial can be painful for victims and survivors, and trigger a host of different reactions that can be uncomfortable and disruptive at home and at work. Civil litigation in the form of negligence suits or wrongful death cases can be expensive and time consuming. They can also affect employee morale, recruitment and the organization’s brand/reputation.

2. Ongoing medical and psychological care: It will be important to actively support and coordinate ongoing support for victim’s families, survivors and witnesses, including medical and psychological care. Some situations will evolve into worker’s compensation or disability cases. HR and legal must be mindful of ADA issues related to employees with traumatic stress conditions and the impact on job performance, attendance and other issues.

3. Develop an After-Action Report: Done too quickly after the event, the fog of war can cloud memory, judgement and decision-making. Waiting too long can result in important lessons fading from memory. The weeks or early months after an active shooter incident are a reasonable time frame to gather a working group to create an After-Action Report (AAR) to capture important lessons learned and develop a corrective plan to make any needed changes to the organization’s violence prevention/ active shooter prevention and response plans. This is an important, and

WWW.EVERBRIDGE.COM

sometimes painful process, since it means revisiting the details of the incident and critiquing the response in a constructive manner. It is equally important that any findings or recommendations be acted on quickly since failure to do so can create additional legal risk.

4. Planning the anniversary: The one-year anniversary of a shooting incident can be an important milestone in individual and organizational recovery, but it can also be complicated and emotional. As such, it cannot be ignored, and any planning to commemorate the anniversary or to handle it in a deliberate low-key manner must begin early. Anniversary events or memorials should be done with employees, not to them. A violent attack represents a loss of control and feelings of extreme powerlessness and vulnerability. Any activities to commemorate the incident should involve a high-level of employee involvement. The anniversary represents an opportunity to take stock of the accomplishments of both individuals and the organization; reassess the needs of the organization; enhance and strengthen connections with stakeholders and continue creating partnerships that promote resilience and create a legacy. Forming a committee or working group in the months before the actual anniversary will give the group enough time to gather feedback and support for their plans. Depending on the magnitude and the effects of the shooting on the surrounding community, it may be important for the planning team to communicate and coordinate with civic leaders and others who may be planning anniversary events separate from the business.

Long-Term Recovery Phase Long-term recovery is typically considered the one-year anniversary and beyond. As mentioned in the opening paragraphs of this paper, the physical and emotional impact of an active shooter incident can linger for decades, and sometimes an entire lifetime. It is important for leaders and decision-makers to understand the long-term effects of shooting incidents.

WWW.EVERBRIDGE.COM

For example, the prevalence of post-shooting diagnoses (predominantly PTSD) in studies ranges from 10% to 36%iii as compared with about 11%-15% of the affected population developing such diagnoses after natural disasters.iv And compared with other types of critical incidents, mass shootings represent the greatest risk for acute traumatic stress disorder:

The rates of Acute Stress Disorder following traumatic incidents vary, with higher rates human-caused trauma.

• Typhoon 7% • Industrial accident 6% • Mass shooting 33% • Violent assault 19% • MVA 14% • Assault, burn, industrial accident. 13%v

Lessons-learned Among the many types of crises that can affect an organization and its people, mass shooting incidents are some of the most disruptive and devastating. While the attack may be a surprise, the necessary action steps to effectively respond to the incident are not; Proactive leadership is required to anticipate and address the post-incident consequences in a competent and compassionate manner. Crisis events are moments of truth: employees, the community, key stakeholders and the media will remember how you handled the incident for a very long time. It is important to prepare for the complex post-shooting environment well before the first shot is fired.

WWW.EVERBRIDGE.COM

About the Author Steven Crimando is the Principal of Behavioral Science Applications, training and consulting firm focused on human factors in crisis prevention and response. Mr. Crimando is a Board-Certified Expert in Traumatic Stress (BCETS), and holds Level 5 Certification in Homeland Security (CHS-V). He serves as a consultant and trainer for many multinational corporations, government agencies, major city police departments and military programs. Mr. Crimando was deployed to both the 9/11 and 1993 World Trade Center attacks, as well as New Jersey’s anthrax screening center and other acts of international terrorism. He is a Deputy and Police Surgeon with the Atlantic County New Jersey Sheriff’s Office, an Advisor to the Morris County Active Shooter Rescue Force, and has an extensive background in EMS and emergency management. i Taylor, M. "Norway gunman claims he had nine-year plan to finance attacks". (25 July 2011). The Guardian. London. ii Federal Bureau of Investigation. A study of active shooter incidents in the United States between 2000 and 2013. 16 Sep 2014. www.fbi.gov/news/stories/2014/september/fbireleases-study-on-active-shooter-incidents/pdfs/a-study-of-active-shooter-incidents-inthe-u.s.-between-2000-and-2013. iii Norris, F.H. (2007).“Impact of mass shootings on survivors, families, and communities”, PTSD Research Quarterly, Vol. 18, No. 3, 1-8. iv Norris, F.H. et al. (2002). “60,000 disaster victims speak: an empirical review of the empirical literature: 1981-2001. Psychiatry, 65: 207-239. v Bryant, R.A. (2000). Acute stress disorder. PTSD Research Quarterly, 11(2), 1-7.

WWW.EVERBRIDGE.COM

About Everbridge Everbridge, Inc. (NASDAQ: EVBG) is a global software company that provides critical event management and enterprise safety applications that enable customers to automate and accelerate the process of keeping people safe and businesses running during critical events. During public safety threats such as active shooter situations, terrorist attacks or severe weather conditions, as well as critical business events such as IT outages or cyber incidents, over 3,000 global customers rely on the company’s SaaS-based platform to quickly and reliably construct and deliver contextual notifications to millions of people at one time. The company’s platform sent over 1.5 billion messages in 2016, and offers the ability to reach more than 200 countries and territories with secure delivery to over 100 different communication devices. The company’s critical communications and enterprise safety applications, which include Mass Notification, Incident Management, IT Alerting, Safety Connection™, Community Engagement™, Secure Messaging and Internet of Things, are easy-to-use and deploy, secure, highly scalable and reliable. Everbridge serves 8 of the 10 largest U.S. cities, 8 of the 10 largest U.S.-based investment banks, all four of the largest global accounting firms, 24 of the 25 busiest North American airports and 6 of the 10 largest global automakers. Everbridge is based in Boston and Los Angeles with additional offices in San Francisco, Lansing, Beijing, London and Stockholm. Visit www.everbridge.com to learn more.