Active Shooters Can Be Preempted

Posted By November 19, 2015 No Comments

Active shooter incidents appear to be on the rise in the United States and Canada, as demonstrated by several high profile attacks in 2015 (including a potentially catastrophic plot that was thwarted in Halifax, Nova Scotia in early 2015, which involved two Americans and a Canadian). Those engaged in law enforcement and public security are continuously searching for effective countermeasures to reduce fatalities as actual incidents occur or to prevent them during the crucial pre-incident phases. It is this article’s objective to highlight the benefits of four types of preventative measures that could potentially reduce this threat. The first two measures are intended to help identify troublesome individuals that might become active shooters for pre-incident preemption. The third measure focuses on deterrence to reduce a target’s physical vulnerability, and, when such preventative measures fail and an attack occurs, the fourth measure concentrates on the physical responses potential victims need to implement to minimize fatalities.

Most active shooter incidents occur in the United States, such as the epidemic in the latter half of 2015 with the shooting sprees at an historic black church in Charleston, SC (June: 9 fatalities, 1 wounded); two military facilities in Chattanooga, TN (July: 5 fatalities, 2 wounded); a movie theatre in Lafayette, LA (July: 2 fatalities, 9 wounded); a TV news crew in Roanoke, VA (August: 2 fatalities, 1 wounded), and Umpqua Community College in Roseburg, OR (October: 9 fatalities, 9 wounded).

Such active shooter rampages are not limited to the United States, however, as Canada has also faced several incidents and plots. In the most catastrophic incident, on December 6, 1989, Marc Lépine, aged 25, killed 14 women and wounded another ten women and four men at the École Polytechnique, at what became known as the “Montreal Massacre.” On June 4, 2012, Christopher Husbands, aged 23, carried out a shooting spree at the Eaton Centre shopping mall in Toronto, killing one person and injuring seven others.[1] This shooting spree was crime related and the victims included innocent bystanders. A primarily terrorism-related shooting occurred on October 22, 2014 in Ottawa. Michael Zehaf-Bibeau, aged 32, killed a soldier on guard at Parliament Hill and wounded two others.

In mid-February 2015 another incident was thwarted during its plotting phase. Randall Steven Shepherd, aged 20, of Timberlea, a suburb outside Halifax, and Lindsay Kanittha Souvannarath, aged 23, from Geneva, Illinois, were charged with plotting to carry out a mass shooting attack at a shopping mall on Valentine’s Day in Halifax, Nova Scotia (a third suspect, James Gamble, aged 19, died from a self-inflicted gunshot wound).

These incidents demonstrate that the threat of active shooter attacks against disparate targets ranging from military facilities, churches, schools, and movie houses to shopping malls is a persistent concern for all those tasked with protecting such facilities, and the victims who are directly and indirectly impacted by such violent rampages, regardless of their geographical location.

Defining Active Shooters

An active shooter is defined as an armed person (or several persons) who is in the process of engaging in a shooting spree, with the intent of harming others, whether in an open area or confined environment, such as inside a facility, for mostly personal, and in some instances politically-related, motivations.[2] Thus, gang-related shootings, murders that solely occur over domestic disputes and armed robberies, are excluded from this definition.

In an active shooter situation the perpetrator intentionally continues the shooting spree while having unrestricted access to additional victims, whether they are initially intended or random targets. Active shooters, therefore, generally arrive at the location of their targeted attack with the intent to commit mass murder, as opposed to intentionally killing a single victim, as might be the case in an instance of domestic violence or criminality. The victims of such mass shooter incidents, therefore, may be intentionally targeted (such as at a shooter’s workplace or school) or become what are termed random “targets of opportunity” who may be at the location of the shooting without any causal connection to the shooter or his/her grievance.

Some of these active shooter perpetrators, such as Major Nidal Hassan’s attack in Fort Hood, Texas in November 2009 (13 fatalities, more than 30 wounded), Muhammad Youssef Abdulazeez’s shootings in Chattanooga, TN, and Michael Zehaf-Bibeau’s shootings at Parliament Hill, Ottawa, could also be considered as “terrorists,” since their wrathful rage was motivated by political objectives.[i] Some terrorist attacks, such as the November 26 – 29, 2008 shooting and bombing attacks by the Pakistani-based Lashkar-e-Taiba in Mumbai, India, the September 21-22, 2013 attacks by Somali al-Shabaab against the Westgate shopping center in Nairobi, Kenya, and the November 13, 2015 shootings at the Bataclan concert hall in Paris allegedly by ISIS-directed gunmen, in which more than 130 people were killed and dozens injured, could also be considered as “active shooter” incidents. In the Mumbai attacks, civilians in hotels, a train station, and a Jewish community centre were deliberately and continuously targeted by the attackers, with 164 people killed and more than 300 injured. In the Nairobi attacks, the perpetrators continuously shot at their victims and took several hostage, a tactic that was repeated by the Bataclan concert hall shooters.

Finally, an active shooter differs from a hostage-taking barricaded gunman (or one possessing a bomb set to detonate) who poses a potential threat to commit injury or death to hostages, but is not in the process of actively causing their death or injury. Barricaded events, however, still need to be considered as potential active shooter threats because, as demonstrated by the Mumbai and Nairobi incidents, they might evolve into such incidents if the barricaded situation gets out of hand and the hostage taker begins to shoot (or threatens to shoot) his victims.

Motivating Factors

In terms of their motivation (in addition to their generally troubled psychological predisposition), active shooters are usually driven by an assortment of pent up grievances, anger and hatred towards their intended targets, as well as, in some cases, the notoriety and fame that such murderous rampages will generate for their horrific acts of “retributive justice” either in their lifetime or posthumously.

More specifically, different sets of motivations drive such perpetrators to attack different categories of targets. For example, those attacking schools might be driven by revenge for perceived bullying by other students or a sense of their own academic failure and hopelessness (i.e. Adam Lanza’s rampage at Sandy Hook Elementary School, in Newtown, CT) [3]; workplace violence might be driven by anger over job dismissal or a highly negative performance report (i.e. Vester Lee Flanagan’s targeting of the Roanoke, VA TV news crew)[4]; while attacking shopping malls (or movie theatres) might be driven by a combination of grievances and pent up anger against a wider, random population that congregates at such soft targets and are more vulnerable because of their reduced levels of security (i.e. James Holmes’ July 2012 deliberate targeting of a movie house as opposed to an airport and its tight security).[5]On the other hand, Paul Anthony Ciancia, aged 23, had targeted a relatively protected terminal at the Los Angeles International Airport for his shooting attack on November 1, 2013, (a U.S. Transportation Security Administration officer was killed and 7 were wounded) because of his perceived grievance against the TSA.[6]

As demonstrated by the disparate targeting of such attacks, public venues, whether government or commercial facilities, appear especially attractive to active shooters because they are generally highly congested with people, which make them difficult for security personnel to protect. Even military installations, while relatively well protected against non-military personnel, are vulnerable to attacks by insiders (such as Major Nidal Hassan’s attack in Fort Hood, Texas in November 2009; Aaron Alexis’s attack at the Washington Navy Yard in September 2013; and Ivan Lopez’s attack in Fort Hood, Texas, in April 2014) who exploit their access to such facilities as badged military personnel or contractors to carry out their shooting rampages. In the case of the shootings at the Chattanooga, TN, military recruiting station, the shooter, Muhammad Youssef Abdulazeez, exploited its relative lack of perimeter security to target his military victims from his car.[7] Such was also the case with the Michael Zehaf-Bibeau attack against Parliament Hill, in Ottawa, which was relatively unprotected at the time.

Active Shooter Attacks Can Be Preempted During the Pre-Incident Phases

As mentioned earlier, one of this article’s objectives is to demonstrate that potential active shooter incidents can possibly be preemptively prevented and their consequences mitigated if appropriate pre-incident threat and risk mitigation strategies and tactics are implemented by security managers and public safety officers. Such pre-incident prevention is possible because, first, the perpetrators that target their victims and their disparate venues tend to share certain noticeable early-warning precarious mindsets and behaviours although these will likely differ from one perpetrator to another. This makes it possible for people in contact with the potential shooters, whether directly or even indirectly, to identify them for preemptive countermeasures. Moreover, many incidents often occur within local communities where such perpetrators are known to their families, friends and co-workers.

For instance, prior to conducting attacks, those directly associated with would-be perpetrators might notice an abrupt change in their personal behaviour, such as homicidal or suicidal tendencies, a traumatic personal experience, such as expulsion from school or abrupt job termination, expressions of intense personal grudge and increase in ominous belligerence against others that might be expressed in person or in social media sites, a history of resorting to violence against others, and most important, a recent and unexplained acquisition of weapons and ammunition. In the case of Darion Marcus Aguilar, the Columbia, MD mall shooter, his purchase of the shotgun and ammunition in December 2013,[8] when combined with other risky behaviours such as his psychiatric problems that were marked by violent impulses,[9]should, in this author’s judgment, have raised warning flags about his intention to conduct a future shooting rampage, had they been identified by those who knew him at that crucial formative pre-incident phase.

Similar warning flags were evident in the case of Michael Zehaf-Bibeau, who was overheard the day prior to his attack by several bystanders engaging in an angry and loud discussion with an individual while waiting in a line that had formed outside the Service Ontario outlet at the Ottawa Westgate shopping mall about the justification of killing of civilians by soldiers, in which he stated that, “If soldiers bombed your family, wouldn’t you want to kill them?”[10] Angry statements along these lines, especially when directed against a stranger, should have raised warning signals that such an individual might act violently at some point.

Fortunately, there are numerous examples of best practices in such preemptive prevention. In one noteworthy case, in November 2012 a mother decided to turn her 20-year-old son to police authorities after discovering that he had purchased a pair of assault rifles and 400 rounds of ammunition.[11] The son, Blaec Lammers, had reportedly become so obsessed with James Holmes’ Colorado shootings at the Batman movie opening that he began to collect weapons and ammunition to carry out a similar mass shooting at the showing of “The Twilight Saga: Breaking Dawn: Part 2” at a movie theatre in Bolivar, Missouri.[12] It is reported that he even planned to escalate his shooting spree at a nearby Wal-Mart because it would have provided him access to additional ammunition.[13] Finally, like other active shooters, Lammers had spent time practicing his shooting skills at a gun range in Aldrich, Missouri.[14]

Lammers also shared a familiar ‘shooter’ psychological profile. As explained by his mother, he was “very quiet,” “very much a loner,” “had a hard time making friends,” and “felt like he was a failure.”[15]

In an example of how critical it is to preemptively prevent ‘known’ troublesome individuals who might conduct such horrific shootings, we turn to Vester Lee Flanagan, who killed the TV news crew in Roanoke, VA in late August 2015 and wounded a third person who was being interviewed in the live broadcast. He was known to his former colleagues at the news station as a highly troubled and vengeful individual, yet insufficient measures were taken to monitor his suspicious activities following his dismissal from the TV station in February 2013 which might have prevented the shooting incident more than two years later.[16]

Monitoring Social Media Postings for Early Warning Preemption

In the second type of pre-incident preemption, many active shooters tend to express their vengeful grievances and rage on social media prior to their attacks. If properly monitored, they can be identified for successful preemption. This has become an important tool for law enforcement and others charged with tracking such individuals because, whether prior to their attacks or as post-mortems, their social media ‘footprints’ are becoming a new kind of Rorschach inkblot test,[17] as a projective psychological test to produce a profile of individuals who might demonstrate an inclination to conduct active shooter attacks. One of the reasons such individuals are drawn to social media to express their grievances and in the most extreme cases, their violent intentions, is that as psychopaths, as explained by Dave Cullen, the author of a book on the April 1999 Columbine High School shootings, “they love giving us clues.”[18] As further explained by Mary Ellen O’Toole, a retired FBI profiler, this phenomenon can be explained by the term “leakage,” with social media emerging as the place for such individuals to “hint or even announce their plans far in advance of carrying them out.”[19] Monitoring such social media sites, “where most young people have a presence and share much of their lives,” therefore, can “pinpoint potential problems before they start.”[20]

Unfortunately, in hindsight, in many cases warning signs were identified on social media postings but they were not picked up or investigated for successful pre-incident preemption, although their attacks could have been thwarted if those in close contact with them had noticed such threatening postings and reported them to the appropriate authorities. These include the following cases (among numerous others):

  • Major Nidal Hassan, the Fort Hood shooter, had reportedly posted, months before the shootings, on the social website Scribd in defence of suicide bombers, writing that “If one suicide bomber can kill 100 enemy soldiers because they were caught off guard that would be considered a strategic victory.”[21] This posting was reportedly not pursued by U.S. counterterrorism agencies, as they were uncertain whether the author was Major Hassan and if it was intended to be followed by that writer’s violent act.[22]
  • Jared Lee Loughner, who shot former Arizona Representative Gabrielle Giffords (and killed 6 others) had posted threatening messages in MySpace and YouTube videos prior to his attack in early January 2011. These included a posting on December 30, 2010: “…..Dear Reader…I’m searching. Today! With every concern, my shot is now ready for aim. The hunt, a mighty thought of mine….”[23]
  • Adam Lanza, the Sandy Hook Elementary School shooter, prior to his December 14, 2012 attack, left anonymous posts in online message forums, such as opening a thread discussion with the question, “Was there any difference in saying someone had the devil in them, or someone was afflicted by psychopathy?”[24]
  • The purchase by Muhammad Youssef Abdulazeez, the Chattanooga, TN shooter, of an AK-47-style semi-automatic rifle with a 30-round magazine should have set off alarms among those who knew him, especially in light of his reported psychiatric disorders, and, most importantly, his extremist jihadi postings in social media.[25]
  • Finally, Chris Harper Mercer, aged 26, the Umpqua Community College shooter, had posted several extremist postings in social media prior to his rampage on October 1, 2015. These included an email, dated August 31, linked to the profile of “Lithium Love” on the website “KickAssTorrents,” where Mercer reportedly wrote about Vester Flanagan, the Roanoke, VA shooter, that “On an interesting note, I have noticed that so many people like him are all alone and unknown, yet when they spill a little blood, the whole world knows who they are….A man who was known by no one, is now known by everyone. His face splashed across every screen, his name across the lips of every person on the planet, all in the course of one day. Seems the more people you kill, the more you’re in the limelight.”[26]

In other cases threatening pre-incident postings on social media have been picked up for successful preemption of violence-prone individuals. These include the following:

  • In March 2012, Alexander Song, aged 19, a University of Maryland sophomore student, was arrested and charged with posting a threat on the Internet site that he planned to conduct a shooting rampage on campus to kill as many people as possible.[27]
  • In mid-September 2014, a 16-year-old male student at Salmen High School in Sleidell, LA, was arrested for posting a threatening note on Twitter to “shoot up” the school.[28] Although the threat had turned out to be a prank, it nevertheless caused “hundreds of students to be checked out of school.”[29]
  • On February 12, 2015, the Royal Canadian Mounted Police (RCMP), in Halifax, Nova Scotia, had received an anonymous tip that three youths were planning to commit a mass killing at the Halifax Shopping Centre.[30] Two of the suspects, Randall Steven Shepherd, aged 21 (and formerly from Nova Scotia), and Lindsay Kantha Souvannarath, aged, 23, both residing in Illinois, were apprehended at Halifax Airport when they attempted to enter Canada to connect with James Gamble, aged 19, a Canadian (and a friend of Shepherd’s) (who had died of a self-inflicted gunshot wound as police surrounded his family house). In a testament to the crucial role played by social media in both radicalizing susceptible individuals into carrying out such violent acts, as well as a tool for law enforcement to track such potentially violent individuals, these three individuals had previously met on the website Tumblr, where they often identified themselves as “Columbiners”[31] and used a “chat stream” to communicate about their shared obsession with death and mass killings.[32] Gamble posted a tagline on Tumblr on February 5th that “Valentine’s Day, it’s going down,” which was followed by their Tumblr usernames: “cockswastika” and “shallow-existences,”[33] thereby hinting to those associated with them of the would-be shooting.
  • In late May 2015, a 15-year-old High School female student in Winter Park High School in Florida was arrested and charged with posting six threatening messages against her teacher on Twitter.[34] It was an anonymous call to the high school that led to the student’s arrest, although the school had deployed a specialized software program that monitors social media postings related to the school.[35] It was then reported that the student was charged with “written threats to kill” and cyberstalking on Twitter.[36] In a later development, however, likely due to the student’s young age, the authorities decided not to prosecute her.[37]
  • In mid-October 2015, two students were arrested for posting threatening messages on the Internet to attack students and staff at Riverbend High School near Fredericksburg, VA.[38]

As demonstrated by these examples, it is crucial to be proactive in monitoring suspicious postings on social media websites in order to identify potential active shooters for preemptive arrest (or, in relevant cases, for mental health counseling), as opposed to being reactive in searching for evidence of intentions to attack in the aftermath of an incident. Such monitoring can be done in-house by tasking an organization’s staff to monitor social media sites manually or by installing social media threat alert software or contracting social media monitoring companies to crawl for threat-related contextual and actionable-relevant user-location data through websites such as Twitter, Facebook, and others that are widely used by such violence-prone individuals.[39]

Conducting Risk Assessment to Determine Threat and Vulnerability

In a third type of preemptive prevention, security officers and facility managers need to conduct risk and vulnerability assessments of their facilities’ security posture as a starting point in determining their specific situation and challenges, and to prioritize the types of defensive measures and technologies required to protect their critical assets. Although there is no one-size-fits-all solution, the principle of deterrence can generally be applied to make it difficult for potential active shooters to enter such potential targets.[40] For example, facilities that regard themselves as especially vulnerable might be hardened with concentric rings of exterior security to provide a layered defense around them, with each “ring” or layer of defense closest to the facility providing a heightened level of security.[41] This principle of establishing protective security rings can be applied to varying degrees of hardness to all categories of potential targets, ranging from schools, religious institutions, and shopping malls to military recruiting centres, even if their first ring is not a fence or a gate, as might be in the case of open public environments, since other types of security barriers can still be erected. These include devices such as surveillance cameras, motion detection sensors and doors with emergency locking mechanisms. When combined with periodic and random inspections by security personnel of such facilities, the hardened defensive measures might deter potential shooters to reconsider targeting these places.

In the final preventative measure, appropriate active shooter prevention procedures and protocols for personnel at such facilities also need to be implemented and regularly exercised by their security departments, such as continuously exercising the response procedures with the employees or students at such facilities once a violent intruder begins his attack. This includes an adaptation to their specific circumstances of two response components. The first is to train a facility’s employees, students/teachers, and others, in the widely used response protocols of “run, hide, and fight”[42] or ALICE (alert, lockdown, inform, counter, and escape).[43] This response measure is crucial because many active shooter incidents last between 5 to 15 minutes (or less),[44] which does not provide sufficient time for armed law enforcement to arrive and intervene. Thus, the survival of as many potential victims as possible depends on their ability to implement these response measures on their own during the onset of an active shooter event, whether by finding secure places to hide, or countering the shooter by throwing objects or attacking him (or her) to save other potential victims. In the second response measure it is crucial to establish and regularly exercise appropriate procedures for coordinating the response roles and notification protocols for nearby law enforcement and emergency personnel.


In conclusion, for effective preemptive prevention it is imperative for families, friends, and others associated with potential active shooters to continuously assess the risks associated with the troublesome mindsets and behaviours exhibited by such individuals who appear to be heading down the path towards homicidal violence to avenge their grievances and anger. If possible, this should be combined with proactive monitoring of social media websites for suspicious postings that may point to an individual’s intention to conduct a violent act to redress a ‘collection of grievances.’ These monitoring components will make it possible to preemptively intervene and deter such potentially violent individuals at the earliest possible phases by referring them to mental health services for counseling or law enforcement apprehension. Finally, defensive measures ranging from hardening a facility’s vulnerability to training and exercising employees and other personnel such as teachers and students in effective response measures can serve to substantially mitigate the impacts of potential active shooter events.

It is such preemptive and proactive intervention measures during the pre-incident and actual incident phases that constitute the crucial ingredients in substantially reducing the threat and impact of active shooter attacks.