Active attacker: what to do¶

An active attacker incident is an unpredictable, rapidly evolving event where one or more individuals actively engage in killing or attempting to kill people in a populated area. These events typically unfold over a span of 10 to 15 minutes, frequently before law enforcement personnel can arrive on scene. Because the earliest minutes dictate survival, individuals caught in such an incident must rely on immediate, decisive personal actions.

This guide provides operational guidance based on official doctrine from the United States Department of Homeland Security (DHS), the Federal Bureau of Investigation (FBI), the United Kingdom National Counter Terrorism Security Office (NaCTSO), and international tactical emergency response frameworks.

Do this now¶

If gunfire, explosions, or violent attacks break out nearby:

1. Escape immediately if an accessible path is clear. Do not pause to gather personal belongings, laptops, coats, or identification.
2. If escape is blocked, seek immediate shelter. Secure and barricade the door, turn off all lights, silence all digital devices including vibration settings, and spread out along walls away from windows and door frames.
3. If trapped and your life is in imminent peril, commit fully to disabling the attacker using aggressive physical action and improvised weapons.
4. Call your emergency number as soon as you reach relative safety (911 in the United States and Canada, 112 in the European Union, 999 in the United Kingdom). If you cannot speak without revealing your location, leave the line open so emergency dispatchers can track your coordinates and listen to ambient audio.
5. When armed law enforcement officers breach the area, keep your hands elevated, fingers spread wide, and hold zero objects. Follow all verbal commands without hesitation.

Active attacker response flowchart¶

                   GUNFIRE, EXPLOSION, OR WEAPON REPORT
                                     │
                     Can you identify a safe exit route
                     leading directly away from the sound?
                                     │
                    ┌────────────────┴────────────────┐
                   YES                                NO
                    │                                 │
           ┌────────┴────────┐               ┌────────┴────────┐
           │     RUN / ESCAPE│               │       HIDE      │
           └────────┬────────┘               └────────┬────────┘
                    │                                 │
        1. Leave belongings behind           1. Lock and barricade door
        2. Warn others as you move           2. Block door hinge / closer
        3. Prevent others entering           3. Lights off, blinds down
        4. Move toward solid cover           4. Silence phone + vibration
        5. Keep hands open & high            5. Disperse, stay low
        6. Call emergency services           6. Prepare improvised items
                    │                                 │
        Reach exterior safety                Is your room breached
                                             and life threatened?
                                                      │
                                             ┌────────┴────────┐
                                            YES                NO
                                             │                 │
                                    ┌────────┴────────┐  Remain silent
                                    │  FIGHT / RESIST │  Monitor door
                                    └────────┬────────┘  Treat wounds
                                             │
                                    1. Total commitment
                                    2. Swarm attacker
                                    3. Disarm and pin
                                    4. Do not hold weapon

International response doctrines¶

Government agencies around the world maintain standardized public safety doctrines to guide civilian survival. While national terminology varies slightly, all core frameworks prioritize rapid evacuation, followed by fortification, with physical resistance reserved as an absolute last resort.

       COMPARISON OF INTERNATIONAL CIVILIAN CRISIS PROTOCOLS
┌──────────────────────┬──────────────────────┬──────────────────────┐
│ United States (DHS)  │ United Kingdom (NaCTSO)│ Australia / Canada │
├──────────────────────┼──────────────────────┼──────────────────────┤
│ 1. RUN               │ 1. RUN               │ 1. ESCAPE            │
│ 2. HIDE              │ 2. HIDE              │ 2. HIDE              │
│ 3. FIGHT             │ 3. TELL              │ 3. TELL / ACT        │
└──────────────────────┴──────────────────────┴──────────────────────┘

The United States doctrine explicitly incorporates "Fight" as the final contingency when escape and concealment have failed. The United Kingdom doctrine emphasizes "Tell" to rapidly mobilize specialist armed counter-terrorism assets, while still acknowledging that physical defense may be necessary in extreme close-quarters survival situations.

Protocol 1: Run (evacuation)¶

Evacuation is always the primary tactical objective. Increasing distance between yourself and the threat offers the highest mathematical probability of survival.

Tactical evacuation principles¶

• Maintain continuous situational awareness: Never assume the sound of gunfire is fireworks or stage effects. Treat all loud, repetitive percussive noises as an active ballistic threat until proven otherwise.
• Identify primary and secondary exits: When entering any public venue, commercial building, or transit terminal, immediately locate at least two distinct exits, including emergency service corridors and loading docks.
• Leave all material possessions behind: Do not stop to pick up backpacks, purses, wallets, or jackets. Carrying large baggage impedes running speed, restricts mobility through choke points, and can cause responding law enforcement officers to mistake you for an armed assailant.
• Urge others to follow, but do not hesitate: Instruct bystanders firmly to run with you. If someone freezes, refuses to leave, or insists on searching for possessions, abandon them immediately and continue your egress.
• Keep your exit path clear of bottlenecks: Avoid central elevators, escalators, and narrow primary turnstiles. Utilize emergency stairwells that lead directly to ground level exterior exits.
• Prevent oncoming civilians from entering: As you escape into surrounding perimeter zones, warn approaching individuals not to enter the facility.

Cover versus concealment during movement¶

While escaping, navigate through the environment by differentiating between cover and concealment:

Never remain stationary behind pure concealment if an escape route toward hard cover is accessible.

Protocol 2: Hide (fortification and barricade)¶

If gunshots are directly outside your corridor or all identified exit routes are physically blocked, immediately transition to fortification. The goal is to make your room appear unoccupied, impenetrable, or too time-consuming to breach. Active attackers generally search for rapid, high-density targets and rarely spend extensive time attempting to force open heavily secured doors.

Step-by-step room fortification¶

1. Close and lock the door: Engage deadbolts, cylinder latches, or security locks immediately.
2. Secure the door closure mechanism:
3. For inward-opening doors with an overhead hydraulic scissor arm, tightly bind the hinge joint of the scissor arm using a leather belt, heavy electrical cable, ratchet strap, or paracord. This prevents the door from opening even if the latch handle is turned or destroyed.
4. For doors lacking internal locks, jam heavy furniture beneath the door handle at a 45 degree angle to create a mechanical wedge.
5. Construct a structural barricade: Pile heavy desks, filing cabinets, solid oak tables, and steel shelving directly against the door. Stack heavier furniture at the bottom and lighter items on top.
6. Eliminate visual recognition:
7. Turn off all overhead lights, desk lamps, and computer monitors.
8. Draw all window blinds, roll down shades, or cover glass panels with jackets, cardboard, or opaque tape.
9. Place a heavy coat or dark towel along the bottom threshold of the door to prevent shadows, flashlight beams, or movement from being detected in the hallway.
10. Eliminate audio cues:
11. Place mobile phones, smartwatches, tablets, and laptops on complete silent mode. Do not leave devices on vibrate: the vibration motor buzzing against a wooden desk or tile floor produces an audible signature that reveals human presence.
12. Turn down screen brightness to lowest settings to prevent light casting onto ceilings.
13. Instruct all occupants to remain completely silent. Do not whisper unless communicating life-critical medical instructions.
14. Disperse throughout the room:
15. Never huddle together in a corner or cluster against a single wall. Clustered groups create high-density targets if rounds penetrate walls.
16. Spread out individually along structural walls, crouching behind solid furniture or concrete columns out of the direct line of sight of exterior and interior windows.
17. Lie flat on the floor behind solid objects to minimize your physical exposure to ricochets and wall-penetrating rounds.

Protocol 3: Fight (extreme last resort)¶

Physical confrontation is an absolute last resort, authorized only when an attacker directly breaches your barricade or traps you in an enclosed space with no escape. At this juncture, hesitation is fatal. You must commit to neutralizing the threat with maximum physical aggression.

Mental framing and commitment¶

• Act with singular purpose: Overcome survival fear by focusing entirely on incapacitating the assailant. Partial resistance or compliance will not protect you against an active killer.
• Disrupt the attacker OODA loop: An attacker relies on an Observe, Orient, Decide, Act loop. Sudden, violent civilian counter-attacks disrupt their sensory orientation, forcing them into a defensive, disoriented posture.
• Utilize numerical advantage: If multiple individuals are trapped, silently coordinate a simultaneous swarm tactic before the door is breached. Designate roles: one person targets the weapon, others tackle the legs and head.

Improvised weapons and tactics¶

Look around the immediate space for objects that function as force multipliers:

• Fire extinguishers: Discharge the pressurized chemical agent directly into the face, eyes, and airway of the attacker from 2 to 3 meters (6 to 10 feet) away. The cloud blinds the attacker, triggers uncontrollable coughing spasms, and creates a dense visual smoke screen. Once discharged, use the heavy steel cylinder as an impact tool targeting the head, collarbone, or hands.
• Heavy blunt instruments: Metal chairs, heavy ceramic bookends, loaded backpacks, desktop computer towers, and fire irons provide reach and kinetic impact.
• Edged and penetrating tools: Scissors, pens, tactical flashlights, screwdrivers, and broken glass can be targeted at vital vulnerable zones.
• Distraction missiles: Throw hot coffee, water bottles, heavy textbooks, and shoes in rapid succession directly at the attacker face while rushing forward. Humans have an involuntary blink and flinch reflex when objects fly toward their eyes, preventing accurate weapon aiming for 1 to 2 seconds.

Swarming and weapon control¶

If the attacker enters the room: 1. Ambush from the fatal funnel: Position yourself on either side of the doorway, outside the immediate cone of entry. Never stand directly in front of the door threshold. 2. Attack the weapon first: As the weapon enters the room, seize the barrel or slide, forcing the muzzle toward the ceiling or down into the floor. Never pull the weapon toward your body. 3. Execute a simultaneous body tackle: Multiple defenders must tackle the attacker lower torso, waist, and knees simultaneously to drive them to the floor. 4. Pin the limbs: Use full body weight to pin the attacker wrists, arms, and neck to the floor. 5. Secure the weapon: Once the weapon is dislodged, kick or slide it far away. Cover it with an upturned metal wastebasket or heavy bucket. Never hold or wave the weapon in your hands: arriving police officers will identify anyone holding a firearm as an active threat and open fire.

Immediate trauma care in shelter (Stop the Bleed)¶

Severe hemorrhage from ballistic trauma can cause fatal hypovolemic shock in under 3 minutes. While barricaded and awaiting tactical rescue, provide immediate self-care and buddy-care using tactical emergency casualty care principles.

                  SEVERE BALLISTIC HEMORRHAGE PROTOCOL
┌───────────────────────────────────────┬────────────────────────────┐
│ Injury Site                           │ Immediate Intervention     │
├───────────────────────────────────────┼────────────────────────────┤
│ Extremities (Arms, Legs)              │ High and tight tourniquet  │
│ Junctional Zones (Groin, Armpits, Neck│ Wound packing + pressure   │
│ Chest, Upper Back, Torso              │ Vented occlusive chest seal│
└───────────────────────────────────────┴────────────────────────────┘

1. Arterial limb bleeding: If blood is bright red and spurting rapidly from an arm or leg, immediately apply a commercial windlass tourniquet (such as a CAT or SOFTT) 5 to 7 centimeters (2 to 3 inches) above the bleeding site, directly on bare skin. If the exact wound origin is obscured by clothing, place the tourniquet as high and tight on the limb as possible. Tighten the windlass rod until the arterial bleeding stops and the distal pulse disappears, then secure the windlass lock.
2. Junctional wound packing: Tourniquets cannot be placed on the groin, neck, or armpit. For these injuries, pack the wound cavity firmly with hemostatic gauze or clean fabric, driving the material deep toward the ruptured vessel. Apply continuous, direct, two-handed pressure on top of the packed wound for a minimum of 3 continuous minutes (or 10 minutes if using non-hemostatic gauze).
3. Penetrating chest injuries: If a bullet penetrates the ribcage, air may enter the pleural space, creating a life-threatening tension pneumothorax. Seal the wound with an occlusive chest seal or plastic wrap taped securely on three sides to allow air to vent outward during exhalation without letting air back in during inhalation.
4. Maintain body temperature: Ballistic trauma impairs systemic blood coagulation (the lethal trauma triad of hypothermia, acidosis, and coagulopathy). Cover injured individuals with coats, blankets, or emergency space blankets to preserve core body heat.

Interacting with responding law enforcement¶

When tactical police teams (such as SWAT, firearms officers, or armed response units) breach the building, their primary mission is not medical evacuation; it is finding and eliminating the armed threat. Understanding their tactical posture prevents fatal misunderstandings.

What to expect from responding officers¶

• Aggressive entry: Officers enter rapidly, wearing heavy body armor, ballistic helmets, night vision gear, and carrying rifles or carbines.
• Loud verbal commands: Officers will shout commands, direct people with profanity, and order individuals to the ground.
• Tactical non-assistance: In the opening minutes, contact officers will bypass wounded and crying victims. They cannot stop to provide first aid until the threat is eliminated. Rescue Task Forces (paramedics protected by armed guards) enter in subsequent operational waves.
• Presumed threat status: Because attackers often disguise themselves as civilians or victims, officers view every individual as a potential combatant until cleared.

Rules of civilian conduct during breach¶

• Keep your hands completely visible: Immediately raise your hands above your head with empty palms open and fingers spread widely apart.
• Drop all items: Instantly drop bags, phones, water bottles, keys, jackets, and flashlights. Do not attempt to hold or conceal anything in your hands.
• Never make sudden physical movements: Do not run toward officers, do not reach toward their tactical vests, and do not attempt to hug or grab them for comfort.
• Avoid pointing or shouting: Do not point fingers or wave your arms to direct officers toward the attacker. If you have critical intelligence, state it calmly and concisely using short sentences: "Attacker on second floor, black hoodie, armed with rifle."
• Expect to be detained: You may be pushed to the floor, handcuffed, searched, or escorted out with hands placed behind your head. Cooperate fully and do not resist.

Reporting critical intelligence to emergency dispatch¶

When calling emergency dispatch (911, 112, or 999), provide structured tactical information using the METHANE or SBAR reporting framework:

• Exact location: Facility name, street address, building number, floor level, and specific room identifier.
• Threat description: Number of attackers, clothing, physical build, and observed weapons (handguns, long rifles, shotguns, explosive vests, bladed weapons).
• Current sound signature: Direction of travel, last heard gunfire location, or explosive detonations.
• Casualty count: Number of wounded individuals and critical medical conditions (uncontrolled arterial bleeding, unconsciousness).
• Barricade status: Your room number, number of uninjured civilians sheltering with you, and whether the door is secured or breached.

If speaking aloud compromises your hiding place, utilize text-to-911 services where supported by regional emergency infrastructure, or whisper directly into the microphone.

Recovery and psychological aftercare¶

Surviving an active attacker incident carries intense, prolonged psychological trauma for victims, witnesses, and responders:

• Acute stress reactions: Shaking, auditory exclusion, tunnel vision, nausea, hyperventilation, and emotional numbness are normal biological responses to extreme survival stress.
• Secondary safety debriefing: Remain at designated emergency family reunification centers until cleared by law enforcement investigators. Provide official statements when requested.
• Professional counseling: Seek trauma-informed psychological support or cognitive behavioral therapy. Symptoms of post-traumatic stress disorder (PTSD) such as intrusive flashbacks, severe nightmares, hypervigilance, and depression require timely clinical intervention.

Frequently asked questions¶

What is the difference between cover and concealment during an attack?¶

Concealment hides you from an attacker view but cannot stop bullets. Examples include drywall partitions, cubicle dividers, curtains, and interior hollow-core doors. Cover provides a physical barrier that stops or deflects ballistic rounds. Examples include reinforced concrete walls, brick pillars, structural steel columns, and the engine block of a motor vehicle. Always prioritize cover over concealment.

Should I pull a fire alarm to evacuate a building during an active shooter?¶

Generally, no. Do not pull a fire alarm unless you are certain of an immediate fire danger. Pulling a fire alarm can activate strobes and sirens that drown out the sound of gunshots, making it impossible to track the attacker movements. Furthermore, fire alarms cause occupants to stream into hallways and stairwells, channeling large crowds into central bottlenecks where an attacker may be waiting.

What should I do if an officer enters our hiding room with a weapon drawn?¶

Freeze immediately, drop anything you are holding, and raise your hands high in the air with your fingers spread wide. Keep your palms facing the officer so they can verify you are unarmed. Remain completely motionless, do not shout or point, and obey all verbal instructions instantly. Understand that officers may treat everyone as a suspect until the scene is fully secured.

Can an improvised tourniquet stop arterial bleeding from a gunshot?¶

Improvised tourniquets made from belts, shoelaces, or neckties often fail because they lack the mechanical leverage to generate enough circumferential pressure to occlude a deep femoral or brachial artery. A commercial windlass tourniquet is far superior. If only improvised materials are available, use a wide cloth strip (at least 4 centimeters or 1.5 inches wide) with a rigid stick or metal rod twisted to form a makeshift windlass until bleeding ceases.

How do I report my location if I cannot safely speak on the phone?¶

Call your local emergency number and leave the line open without speaking. Emergency dispatchers are trained to listen to background audio, track caller location via cellular triangulation or landline addresses, and dispatch tactical units. In many jurisdictions across the United States, Canada, and parts of Europe, you can also send a silent SMS text message to 911 or 112 detailing your exact location and threat details.

Related guides¶

• Severe bleeding and tourniquets
• Civil unrest and crowd safety
• Home break in defense
• Cardiopulmonary resuscitation (CPR)
• Emergency phone numbers by country