(U//FOUO) DHS-FBI Bulletin: Recent Active Shooter Incidents Highlight Need for Continued Vigilance

DHS-FBI Joint Intelligence Bulletin

5 pages
For Official Use Only
December 27, 2012

(U//FOUO) This Joint Intelligence Bulletin (JIB) is intended to provide information on the recent active shooter incidents that have taken place in the Homeland. This information is provided to support the activities of DHS and FBI and to assist private sector security officials and federal, state, local, tribal, and territorial law enforcement in identifying protective and support measures relating to active shooters.

(U//FOUO) For the purpose of this report, an “active shooter” is defined as one or more individuals participating in a random or systematic killing spree demonstrating their intent to harm others with a firearm. An active shooter’s objective is that of mass murder, rather than committing traditional criminal acts, such as robbery or hostage-taking. Active shooter attacks are dynamic incidents that vary greatly from one to another.

…

(U) Key Findings

(U//FOUO) Recent shootings underscore the need for private sector security officials and law enforcement to ensure that protective and crisis response measures are in place and up-to-date.

(U//FOUO) The FBI analyzed 154 active shooter events in the United States between 2002 and 2012 (to date) that included three or more individuals being shot.*

(U//FOUO) Motivations for active shooting incidents are difficult to fully determine. The shooter was deceased after 51 percent of these events (43 percent committed suicide and 8 percent were shot and killed by responders). Forty-five percent of active shooters were arrested and 4 percent remain unidentified. A clear motivation was never determined in 40 percent of cases analyzed; however, the most common identified motivations were found to be workplace retaliation (21 percent), domestic disputes (14 percent), and academic retaliation by a current or former student (7 percent).

(U//FOUO) The shooter was male in 96 percent of cases analyzed. The shooter acted alone 96 percent of the time. Active shooter events most commonly occurred in a workplace environment (37 percent) or academic setting (17 percent).

(U//FOUO) From investigations and analysis, many active shooters were described as social isolates, harbored feelings of hate and anger, and/or had some reported contact with mental health professionals. Mental illness is commonly referenced as a potential contributing factor, but its causal impact on the attack can only be speculated. Very few active shooters had previous arrests for violent crimes. Common catalysts or triggers observed include: loss of significant relationships, changes in financial status, loss of a job, changes in living arrangements, major adverse changes to life circumstances, and/or feelings of humiliation or rejection on the part of the shooter.

(U) Suggested Protective and Crisis Response Measures

(U//FOUO) The following protective and crisis response measures may assist or augment existing safety, security, and counterterrorism efforts at commercial and public facilities. Facilities should review and update existing emergency and crisis management procedures using these measures. Officials should consider the following measures for everyday security:

— (U//FOUO) Review, update, and validate all emergency and crisis management plans.
— (U//FOUO) Coordinate response plans across functional disciplines (e.g. police, fire, EMS, hospitals, school districts, and private sector) and regions to maximize response in a large incident.
— (U//FOUO) Conduct exercises of emergency and crisis management plans.
— (U//FOUO) Raise awareness among employees by conducting “all hazards” awareness training.
— (U//FOUO) Raise community awareness of potential threats and vulnerabilities.
— (U//FOUO) Ensure the staff are aware of their roles and responsibilities during a crisis and exercise these responsibilities.
— (U//FOUO) Ensure that emergency communications equipment is present and operable. Practice emergency communications plans and systems.
— (U//FOUO) Report suspicious activity to proper authorities, to include missing or stolen weapons.

(U) Long-Term Protective Measures

(U//FOUO) Protective measures in the long term should emphasize physical safeguards, including building enhancements that present a more robust deterrent and provide a more survivable environment. Officials should consider the following measures:

— (U//FOUO) Install secure locks on all external and internal doors and windows with quick-release capability from within for emergency escape.
— (U//FOUO) Install window and external door protection with quick-release capability from within for fire escape.
— (U//FOUO) Consider establishing safe areas within the facility for assembly and refuge during crises.
— (U//FOUO) Consider establishing/implementing an emergency communications system such as phone trees or text messages for personnel.

(U) Indicators of Surveillance

(U//FOUO) The following activities may suggest surveillance of facilities. Independently, each indicator may represent legitimate recreational or commercial activities; however, multiple indicators could suggest a heightened threat:

— (U//FOUO) Overly interested in entry points, peak days and hours of operation, security personnel, surveillance assets (including cameras), and access controls such as alarms, barriers, doors, gates, or locks.
— (U//FOUO) Loitering, parking, or standing in the same area over multiple days with no reasonable explanation.
— (U//FOUO) Observing security reaction drills or procedures (may cause an incident to observe response).
— (U//FOUO) Having an unusual interest in speaking with building maintenance personnel or security guards.
— (U//FOUO) Attention to or avoidance of surveillance cameras.
— (U//FOUO) Attempts to disguise appearance from visit to visit (change in hair color, style of dress).
— (U//FOUO) Interest without justification in obtaining site plans, ingress and egress routes, and information on employees or the public.
— (U//FOUO) Garments not appropriate for weather/seasons.
— (U//FOUO) Unusual behavior, such as staring at or quickly looking away from personnel or vehicles entering or leaving facilities or parking areas.
— (U//FOUO) An increase in anonymous telephone or e-mail threats in conjunction with suspected surveillance incidents, indicating possible surveillance of threat reaction procedures.
— (U//FOUO) Discreet use of still cameras and video recorders or note taking or use of sketching materials that would raise suspicion in a reasonable person.

(U//FOUO) Law enforcement agencies, security personnel, and administrators should be aware of and remain alert to indicators of surveillance activities. Officials are encouraged to review and update their evacuation plans and security and emergency policies.