DHS Infrastructure Protection Note: Performance Venues – Indicators of Violence and Protective Measures

The following information paper was released July 20, 2012 in response to the mass shooting at a movie theater in Aurora, Colorado earlier that day.


  • 2 pages
  • July 20, 2012


Performance venues include theaters, concert halls, auditoriums, and amphitheaters, ranging in size and function from small neighborhood movie theaters or community playhouses to high-capacity venues in major metropolitan areas. Performance venues are relatively open-access, limited egress facilities and have been successfully targeted in the past.

Potential Indicators of Violence

Potential attackers have a wide variety of weapons and tactics available to achieve their objectives. Specific threats of most concern to performance venues include:
• Active Shooter / Small arms attack
• Improvised explosive devices (IEDs)
• Vehicle-borne improvised explosive devices (VBIEDs)
• Arson/incendiary attack

Indicators are observable anomalies or incidents that may precede an attack. Indicators of an imminent attack requiring immediate action may include the following:
• Persons in crowded areas (e.g., theater or auditorium lobby) wearing unusually bulky clothing that might conceal suicide explosives or weapons
• Suspicious or illegally parked vehicles near a performance venue or where crowds gather prior to or following performances and events
• unauthorized entry to the performance venue or restricted areas of the facility
• Persons or teams of people attempting to
• Unattended packages (e.g., backpacks, briefcases, boxes) that might contain explosives. Packages may be left in open areas or hidden in trash receptacles, lockers, or similar containers
• Evidence of exit doors being in propped open or ajar thus allowing access from the exterior

Indicators of surveillance by potential attackers include:
• Persons using or carrying video/camera/observation equipment in or near the facility over an extended period
• Persons discovered with facility maps, photos, or diagrams with critical assets highlighted or notes regarding infrastructure or listing of personnel
• Persons parking, standing, or loitering in the same area over a multiple-day period with no reasonable explanation
• An increase in threats from unidentified sources by telephone, postal mail, or e-mail and/or an increase in reports of threats from outside known, reliable sources
• Evidence of unauthorized access to the HVAC system or suspicious substances near HVAC intakes

Protective Measures

Protective measures include equipment, personnel, and procedures designed to protect a facility against threats and to mitigate the effects of an attack. Protective measures for performance venues and theatres include:

Communication and Notification
• Develop a communication and notification plan that covers voice, data, and video transfer of information related to security
• Provide the ability to record incoming communications (e.g., telephone calls) to identify potential threats
• Develop a notification protocol that outlines who should be contacted in emergencies
• Conduct outreach to neighboring properties to confirm and discuss emergency procedures

Suspicious Activity Reporting and Emergency Notifications
• Be aware of your surroundings; make sure you are in the safest possible location prior to calling (out of harm’s way)
• Be calm and articulate; talk slowly
• State your name, location, and the nature of the emergency
• Provide high level details of your situation
• Advise if you are injured; provide details
− Suspicious Activity Awareness Video: What’s in Store: Ordinary People | Extraordinary Events available at www.dhs.gov/cfsector
• Ensure staff is aware of how to report suspicious activity
• The “If You See Something, Say Something™” campaign and the National Suspicious Activity Reporting Initiative encourage citizens to report suspicious activity to law enforcement
− More information can be found at http://www.dhs.gov/files/reportincidents/see-something-say-something.shtm

Planning and Preparedness
• Conduct regular evacuation drills with facility employees, clearly outlining the evacuation routes and outdoor assembly points
• Designate an employee as security director to develop, implement, and coordinate all security-related activities
• Conduct threat analyses, vulnerability assessments, consequence analyses, risk assessments, and security audits on a regular and continuing basis
• Establish liaison and regular communications with local law enforcement and emergency responders, state and federal law enforcement, public health organizations, and industry organizations to enhance information exchange, clarify emergency responses, track threat conditions, and support investigations
• Institute layers of security measures on the basis of the expected crowd level or performance type

• Maintain up-to-date security training with regular refresher courses
− Active Shooter – How to Respond training available at http://training.fema.gov/EMIWeb/IS/is907.asp
− Active Shooter Situation: Options for Consideration (Video) has been posted to the HSIN-Critical Sector (CS) portal at https://cs.hsin.gov/
• Provide security information and evacuation procedures to patrons before each performance. Advise patrons and staff to be alert to suspicious activity or items and on how to report such incidents

Monitoring, Surveillance, Inspection
• If warranted, evaluate the need to develop a monitoring, surveillance, and inspection program that is consistent with facility operations and security requirements
• Perform security sweeps of the entire facility before each show or performance
− Training Webinar: IED Threat Awareness and Detection available at www.dhs.gov/cfsector
• Consider limitations to patrons carrying bags/backpacks/gym bags, etc into the venue
• Consider screening of bags and persons wearing bulky clothing prior to venue entrance
− Training Video: Check It – What’s in the Bag available at www.dhs.gov/cfsector
• Confirm that all exit doors leading from venue to the exterior of the facility have operational locks and that they are locked
• Ensure the doors have not been propped open; consider active patrols around the exteriors and emergency exits just prior to the beginning of each show

Infrastructure Interdependencies
• Ensure that the facility has adequate utility service capacity to meet normal and emergency needs

Incident Response
• Review unified incident command procedures for responding to an event with local law enforcement, emergency responders, and government agencies
− Establish evacuation procedures and ensure the evacuation routes are clear of obstruction


Share this: