Those Terrible First Few Minutes

Revisiting Active-Shooter Protocols for Schools

By Michael E. Buerger, Ph.D., and Geoffrey E. Buerger, Ph.D.
Revolver on Spiral Notebook

The term active shooter entered the national lexicon in the wake of the fatal shootings at Columbine High School, a tragic capstone to similar devastation in other locales. The dynamics of Columbine redefined police response practices and spawned a constellation of in-school prevention initiatives. The educational community has placed considerable focus on having a plan in place against a dire eventuality. The industry standard protocol is geared to targeted school violence by an aggrieved student, which has been the modal category of school shootings in recent years.1 However, incidents meeting this definition represent only one of the potential active-shooter threats.

Although a tendency exists to argue that “you cannot plan for every conceivable situation,” the history of school invasions, in fact, has encompassed a wide range of contingencies. For example, a fire alarm pulled by an accomplice emptied classrooms into the playground, providing a clear field of fire for a shooter concealed in the woods. In another incident, a shooter targeted his tormentors during a voluntary prayer meeting just before the start of school. Several different cases have seen shooters focus on administrators or teachers. Still other schools have been invaded by adults armed with a variety of weapons.2

The authors assert that enough contingencies have occurred to justify developing flexible response plans that can account for and adjust to several broad categories of incidents. While even a limited plan is better than no plan at all, neither schools nor police should confine themselves to a “one size fits all” planning protocol. To this end, the authors address that time period between the first contact with an armed intruder on school grounds and the arrival of help. By examining this from the perspective of school personnel, they suggest that the police should be considered second responders. Unless a situation begins with the shooter confronting a school resource officer, the first reaction will come from individuals whose professional orientation is far removed from armed conflict. The authors’ goal is to promote the development of better tactical and training options for the civilians whose reactions will define the incident until the police arrive.


Most active-shooter protocols contain the same advice: implement lockdown procedures, minimize the target profile, and wait for the police to neutralize the situation. Teachers and students should hide quietly, lock or barricade doors, and turn off lights and electrical equipment that would attract the shooter’s attention. If possible, they should provide detailed information via 911 contact to guide authorities and, then, remain quiet until a recognized voice advises that it is safe to move.

The rationale for the existing active-shooter protocols is obvious. Once a school is in lockdown, “hide and hope” defensive actions minimize the chances of being a target and maximize police latitude in clearing the building. Concealment and cover reduce potential casualties. The chaos of moving, screaming bodies provides a target-rich environment, as well as camouflage, for a shooter.

Lockdown procedures encourage the shooter to search for softer, more accessible tar- gets within a large physical plant. That interval coincides with police response time, delays the perpetrator’s engagement with any targets, and keeps the person in open space. When discovered, the shooter is isolated against the background, a single target for law enforcement officers. If intruders seek concealment from the police, they abandon the search for victims, increasing the overall safety of the school community.

Two tacit assumptions are inherent in the protocols. First of all, operationally, the concept of lockdown hinges upon a notification that occurs with students in standard classrooms. Second, school authorities will control the scene with police as the sole actors in the response. Embedded in both are presumptions of orderly, effective communication of the emergency and a methodical compliance with the school plan upon notification.

Nonstandard Circumstances

In primary and secondary schools, students are not always in classrooms. Recess and lunchtime take them out of their classrooms and often put them under the direction of adults who are not their regular teachers. School assemblies and other special events create similar conditions. In high schools, the intervals between class periods have corridors full of students changing classrooms.

In an emergency during a transition period in a high school, administrators could direct students to report to their next class or to the nearest classroom. During their research, the authors discovered no protocols that addressed potential problems arising from overcrowded classrooms (e.g., those adjacent to cafeterias) or rooms in lockdown when students arrived from more distant locations. Because it is statistically probable that the shooter is a student, a person seeking entry to a classroom in lockdown could be the perpetrator. Procedures for handling contingency situations, such as late-seeking refuge, must be developed and clearly communicated to all school staff.

Lunchtime creates a different dynamic, as do library periods, study halls, and similar nonclassroom times. The physical layouts of lunchrooms, libraries, and other common areas vary widely. Gym classes, locker rooms, and open bathroom facilities do not provide the same degree of cover that a locked classroom might. School-specific protocols need to cover these vulnerable, and predictable, times.

In addition, the protocols the authors reviewed seemed geared to college-age students in campus environments or to large high schools. But, reactions expected from a college population are quite different from those from a combined K-3 class. Young students are easily upset, and teachers cannot quell their crying by logical reminders why they should remain quiet. In the event of an evacuation, maintaining orderly flight and regrouping with younger or mixed-age school populations can prove much more difficult than directing older students.

In high schools and colleges, shutting off cell phones is desirable but probably impossible to implement. Cell phones provide a way to communicate information to the outside world, but the ring of one alerts an intruder to the presence of people inside a room, elevating the danger. Parents hearing of a situation likely will call their child, increasing the probability that cell phones will be ringing throughout the school and defeating the “hide and hope” approach to lockdown.

Situational Considerations

Most school entrances have open space nearby, populated offices with transparent glass windows, and corridors. It is entirely possible that an invader’s first victims will be the administrators and staff charged with initiating the emergency procedures. In that case, the first notification that an emergency is underway may be the sound of gunshots and screams.

If administrative personnel are killed or driven to take cover, no one may be able to initiate a formal alert, thereby forcing teachers and other staff to make autonomous decisions for the protection of their charges. School policy and related police response protocols must be adaptable. Specific parameters when teachers have the freedom to initiate a lockdown of a classroom, even in the absence of formal notification from the office (i.e., when shots or shouts are heard), and under what conditions lockdown should be abandoned and evacuation initiated should be developed at the local or district level.

Faced with a school-invasion situation, school staff will have to make a quick assessment of the threat and take multiple steps in response. They must disseminate appropriate information to the school and to outside authorities and initiate available defensive mechanisms.

A number of dynamic elements exist at the point of first contact with a potential shooter. The intruder may be a member of the school population (including an adult staff member), a resident of the surrounding community, or a complete stranger. The shooter may be acting on impulse, under the influence of drugs, or mentally ill. The intruder may have a specific target in mind or simply be intent on random violence.

Not all of these factors will be evident, nor will they necessarily be meaningful in terms of the reactions of staff in the first moments. Undoubtedly, overt visual and verbal cues will provide a rough “flash” image that determines the initial staff response. From a police tactical perspective, none of these issues are relevant once the shooting starts; safety precautions and search patterns presume the worst-case scenario. For school personnel, however, they may be critical.

Assuming that an attack does not ensue immediately, a person with only minimal training and an orientation far different from that of police officers will handle the first contact. This individual may be the principal, a teacher, a secretary or other staff member, a parent or other volunteer, a substitute teacher, or a student. The last three are most problematic because they are least likely to be aware of the protocol and less prepared to pick up on the nonverbal cues an intruder might display. Their initial reaction most likely will range from initial surprise and recovery to shock and outright panic.

The most important duty of the person making first contact is to communicate the potential danger to others. That communication must be in a nonthreatening manner that does not escalate the situation, but it must be clear and specific, even if the school protocol uses coded language. If that cannot be done and the intruder refuses to be engaged by conversation, the first notice of the event may be gunshots or screams.

If the invader is a student, either visibly armed or visibly disturbed, the likelihood that a teacher or administrator will engage them is fairly high. School personnel are familiar with each student’s baseline behavior and would be sensitive to changes under most conditions. They also have a background relationship to help them. Even if the indicators suggest severe emotional upset, the teacher’s approach is likely to be student focused, perhaps deflecting or distracting the individual and hopefully calming the student down. Confrontation runs the risk that the person who first approaches the intruder will become the first casualty.

Collateral risks include an untrained adult or a well-meaning student exacerbating a situation that might have been controlled by a different approach. As police know, the first contact with a visibly disturbed citizen always is risky. Determining the motivation and potential risk depends first upon the intruder’s willingness to engage in conversation and then upon the intervening individual’s ability to interpret the responses and react in an appropriate manner.

Notification has two stages: internal notice to effect the lockdown procedures and communication of the emergency to police authorities. School-intruder situations have no equivalent of the fire alarm, which initiates both notifications simultaneously. Instead, notice is volitional, with an expected hierarchy of action invested presumptively in a central administrative office. Because not all events begin with the office, however, planning needs to encompass circumstances in which notification is executed by other staff.


Neither police nor school officials should consider the national “best practices” protocols as either complete or sufficient. They are a place to begin, a platform from which to examine the exceptions that apply to each individual school. Planning, training, and contingency protocols should proceed from a variety of plausible scenarios that draw upon both historical events and knowledge of local situations.

Information Transmission

Incapacitation is not the only void in a hierarchy: principals may be out of the office, even off the school grounds for district meetings or other functions. Response plans cannot be strict chain-of-command protocols that gridlock in the absence of key hierarchical personnel. Authority and responsibility must be fluid and flexible. A large part of that flexibility requires mutual trust among school employees, from principal to custodian, and, as in all human institutions, that trust may not be pervasive.

Information transmission is critical to any protocol, but none, aside from “shots fired,” may exist. The directive to seek quiet concealment can conflict with the need to develop and provide more information to responding authorities. Primary and secondary schools have an inherent in loco parentis responsibility for their minor charges not present in postsecondary institutions. By implication, expectations oblige school principals to develop as much on-scene information as possible, even at the risk of their own safety. Whether that devolves to secretaries or others in the absence of an administrator is less clear.

Information in the first few moments may be scant, fragmentary, and sometimes ambiguous. If lockdown is ordered swiftly and clearly in large schools, the associated protective factors take effect almost immediately. If such action is not an automatic response because of uncertainty, the intruder gains an advantage that expands risk to the school population.

A backup plan is needed for a more diverse reporting responsibility if the first contact is gunshots. Teachers tend to communicate with the central office for clarification, a momentary but understandable delay; in the absence of a response from the central office, autonomous lockdown should be the default protocol.

“Most active-shooter protocols contain the same advice: implement lockdown procedures, minimize the target profile, and wait for the police to neutralize the situation.”

Student in Front of School with Gun in Waistband of Pants (Stock Image)

Many rural schools are located in small, isolated towns served by only state police or sheriff’s departments. The far-flung patrol responsibilities and limited staff levels of those agencies make a 20- to 30-minute response time an optimistic best-case scenario; in reality, it may take 45 minutes to an hour before authorities arrive.

A longer wait for police response extends the period of vulnerability. The smaller size of rural schools compresses both distance and time, making confrontations more intimate and dramatically altering the dynamics of refuge and escape. The advantage of lockdown quickly evaporates, tipping the advantage to the armed invader. At several schools known to the authors, the entire physical plant can be explored in less than five minutes. An armed intruder can check the doors of every office and classroom within two minutes and, if thwarted by locked or barricaded doors, could easily move outside to enter classrooms through a window or proceed around the perimeter, shooting into the interiors of classroom after classroom.

Special Vulnerabilities

The potential for a shooter neutralizing the school’s administrative staff can prove even more pronounced in rural schools. Principals often have regular teaching duties or cover teacher absences out of necessity and may be away from the office at the critical moment. Teachers and other staff will be forced to make autonomous decisions for the protection of their charges.

The special vulnerabilities of isolated rural schools with a limited physical plant make flight a viable option under some conditions. When authority has devolved to the level of the individual classroom, teachers must decide whether shelter in place or flight gives their charges the greatest chance of surviving the incident. The intruder who has just rattled the locked classroom door may be a minute away from appearing at the windows with a clear view of the interior of the classroom and only a glass pane barring access.

The dispersal of students during an escape presents additional problems. The best chance for surviving an active-shooter situation may be to scatter but also may increase individual vulnerability to other hazards. It can increase the difficulties of accounting for students, elevating parents’ anxieties and compounding the recovery stage. For example, some schools may have fences or be situated next to natural barriers, such as streams or rivers, that can prove dangerous to students. Schools located outside the settled area, rather than within it or at its border, may have no effective rallying point that provides shelter. In many rural areas, extreme temperatures also may expose children to danger if secondary shelter is not readily accessible.

Young populations (K-3 especially) cannot be counted on to react the same as older students; the hazard to them and to their teachers is correspondingly greater. Keeping them in a group is more natural and might be the only way to effectively evacuate the area. Even if the target density increases the risk, dispersal may represent a better option than remaining in a contained space.

Armed Citizen Responders

The arrival of armed citizen responders (ACR) at a rural school under siege should be anticipated. The chances of parental response are elevated and more complex in rural communities. Many families own firearms, and residents often serve on volunteer emergency squads with around-the-clock notification of unfolding events. The odds are great that the first responders to arrive at the scene will be concerned parents, amateurs with an emotional investment in the event, little training, and no coordination. Even those trained as first responders may not have the skills needed for a coordinated defense of a school, which becomes a special complicating factor for rural active-shooter responses. It also places a premium on broadcasting information about the intruder: identity if known or at least a reliable description.

Further complications could arise in areas where older students have some kind of weapon in their vehicles for after-school activities (e.g., during hunting season). Some students may travel with firearms for protection if they live in an area populated with dangerous wildlife (e.g., bears in Alaska). Because rural students tend to be familiar with firearms and hunting knives, rural response may involve other students assuming an ACR role in reaction to an attack.

Police normally discourage citizen intervention in dynamic scenes for the same reason they recommend lockdown and silence: unidentified citizens introduce an element of confusion into a highly volatile landscape. Any person carrying a weapon may be the shooter and, thus, a target for other ACR and for arriving law enforcement officers.


Rural schools share the same risks as their urban and suburban counterparts. Their situations are exacerbated by longer delays in the probable arrival of police and the smaller, more compact physical plant that undercut the assumptions of most response protocols. Rural settings are more likely to see an ad hoc armed citizen response to school incidents, with the potential for friendly fire and collateral injuries. As such, their planning needs are even more complex and may potentially extend to the community, as well as the school.

Secondary Protocols

While lockdown provides a solid foundation, it is not sufficient in itself. Police and emergency response personnel must work with school officials to develop supplemental plans to address gaps.

The most glaring gap involves non-classroom locations and activities. A robust active- shooter protocol must encompass outdoor recess, lunchtime groupings in the cafeteria, assemblies, and transition times. Other points of vulnerability include the unloading and loading of school buses. Students outside for recess or getting on or off school buses might be better served by flight and regrouping at a secondary location than by attempting to find or return to a classroom.

In addition, plans must address both age differences and the surrounding geography. The behavior expected of students has a powerful influence on the viability of elements of standard protocols. Older, compact school facilities in densely populated urban settings pose different tactical challenges than newer, more spread out campuses in suburban and rural settings. Nearby environmental hazards—whether outdoor propane tanks, busy highways, or watercourses and other natural barriers—all create different dangers in the event of flight.

Finally, developing a local plan can run afoul of compet-ing interests. One question that arises immediately is whether to evacuate a school if the fire alarm is pulled during lockdown. Fire officials are oriented to the perspective that premises always should be evacuated when a fire alarm is activated, but lockdowns are initiated only when danger is known to be present. Because the recent history of school shootings includes one incident where the alarm was pulled by an accomplice to generate targets, three schools must conclude that without evidence of a fire, lockdown overrides the fire alarm. Other forms of resistance may come from the community or from within the school itself. “It can’t happen here” and “You cannot plan for every emergency” are standard rebuffs to attempts to create innovative responses. It may help to remind communities that all but a pair of high-profile school shootings took place in “it can’t happen here” locales.

Intervention Training

In-service training for educators cannot be expected to turn them into effective hostage negotiators. Nevertheless, some overview of danger signals, drawn from the library of postshooting reports that has grown over the past two decades, might be considered. The recent history of school shootings involves students in all but a handful of incidents, so knowledge of second-tier or contingency emergency protocols must be limited to staff. Some form of code phrase, or an alternative that conveys “a situation” has occurred to staff within earshot, could be developed.

Schools have a fluid pop-ulation, however, including substitute teachers, aides, student teachers, and other guests. Their more limited connection to the student body makes it less likely they would recognize behavior changes and have the personal connection to engage a student, much less an adult, intruder. Whether, and how, to incorporate transient staff in an emergency protocol depends largely upon local circumstances.

For the police, the practical application of this is not a single presentation to school staff but a more robust and ongoing interactive process. Describing what the police are trained to do is merely the starting point for discussing the realities perceived by the school staff. The process should craft a viable framework for multiple contingencies and help create a mind-set that facilitates adaptation. Moreover, the police must open their “first responder” mind-set during the preparation stage, recognizing that, in fact, they are the second responders. In school-invasion situations, the first responders are the school personnel who will manage the incident until the police arrive.


Three basic assumptions underlie existing active-shooter protocols for schools. First, police resources will arrive promptly and with overwhelming numbers to alter the dynamics of the situation. Second, a tacit assumption, lockdown and concealment will protect students and staff, rather than endanger them. Third, also tacit but inherent in the structure of the protocols, the authorities will control the scene and be the sole actors in the response.

Given the astronomical odds against a shooting event happening in any one particular location, these considerations might seem academic. The list of school shootings continues to grow, however, and school administrators, law enforcement personnel, parents, and concerned citizens must consider all possibilities. An effective response requires school-specific planning and coordination grounded in local conditions. To open a discussion on and promote the development of options for action during those first few minutes when hiding quietly and waiting for help may not be viable are paramount goals for all communities.

Dr. Michael Buerger, a former police officer, is an associate professor of criminal justice at Bowling Green State University in Ohio and a member of the Futures Working Group, a partnership between the FBI and the Society of Police Futurists International.

Dr. Geoffrey Buerger, a school administrator for 25 years, is the principal of Princess Alexandra School, Hay River, Northwest Territories, Canada.

The views expressed in this article reflect those of the authors and should not be considered as representing an official position of the FBI.

“Faced with a school-invasion situation, school staff will have to make a quick assessment of the threat and take multiple steps in response.”


U.S. Department of Justice, Federal Bureau of Investigation, National Center for the Analysis of Violent Crime, Critical Incident Response Group, The School Shooter: A Threat Assessment Perspective (Quantico, VA, 2000); U.S. Department of Education, Office of Safe and Drug-Free Schools, A Guide to School Vulnerability Assessments: Key Principles for Safe Schools (Washington, DC, 2008); and Bryan Vossekuil, Marisa Reddy, Robert Fein, Randy Borum, and William Modzeleski, U.S. Secret Service National Threat Assessment Center, Safe Schools Initiative: An Interim Report on the Prevention of Targeted Violence on Schools.
For additional details, see Stephen R. Band and Joseph A. Harpold, “School Violence: Lessons Learned,” FBI Law Enforcement Bulletin, September 1999, 9-16.
Logic suggests that pulling the alarm is the quickest way for an intruder to neutralize lockdown, flooding the corridors with targets. This is a greater problem in a rampage shooting, with a generalized target base, than it is for individually targeted shootings. (Washington, DC, 2000).