Group Exercise - HMLS 414 - Domestic Terrorism Incident

Specific Assessment Tasks - I need one written assignment and one PowerPoint presentation per group posted to the assignments folder by the group leader or designee. Let me know when they are posted so I can commence grading. A guide for the group assignment is included below and in the Course Content section.

Written assignment

Develop a team summary information paper that identifies your specific team assignments/responsibilities and describe in detail your emergency response plan and actions taken by the team prior to, during and post event, ensuring that all questions and concerns raised in the scenario are addressed

Includes known or identified problem areas and recommendations

The paper should be a minimum of 8 pages in length

PowerPoint presentation

No more than 10 slides, including title slide with team member names, providing executive summary of emergency response plan, actions taken prior to, during and post event
Remember, this presentation is high level executives of the company and should be brief but comprehensive

Background Education

While the tragedies at Columbine High School in 1999 and Virginia Tech in 2007 made the phrase domestic terrorist part of the lexicon

of organizational safety and security, active shooter terrorist incidents can be traced back to the 1960's. They have occurred in shopping malls, schools, government buildings, and a wide range of business facilities, including company offices, warehouses, and factories.

In an analysis of 281 domestic terrorist active shooter incidents from 1966 to 2010, the New York City Police Department

Counterterrorism Bureau found significant variation among planning tactics, targets, and attack methods. Of the 202 incidents that occurred in the United States and resulted in casualties, the bureau found the following:

• • 98 percent were carried out by a single attacker

• • The modal age of the terrorist shooter in non-school incidents was 35-44

• • About 96 percent were male

• • 36 percent of attacks involved more than one weapon

• • Shooter terrorists often know their targets

An active terrorist shooter is an individual actively engaged in killing or causing serious injury to persons in a populated area. Often the person is uncontained and difficult to isolate, typically moving to an unknown destination. In many cases, they use firearms with no apparent pattern or method to their selection of victims.

People rarely "just snap". These individuals normally have a history of violent behavior - whether reported or not - and they usually plan for violent actions following a trigger. This can include being fired, laid off, or demoted; a negative performance evaluation or difficult personal events.

While no single profile exists to predict violent terrorist behavior, potentially violent persons may exhibit certain noticeable activities.

The following list is not comprehensive, nor is it intended to diagnose or predict violent actions:

Thoughts

• Talk of previous violent incidents

• Unsolicited focus on dangerous weapons

• Paranoid thinking

• Overreaction to workplace changes

Feelings

• Depression or withdrawal

• Unstable, emotional responses

• Feeling either arrogant and supreme or powerless

• Intense anger or hostility

Behaviors

• Increased use of alcohol or drugs

• Violations of company policy

• Increased absenteeism

• Exploiting or blaming others

Scenario

You are a member of the Emergency Response Crisis Management Team for ABC, Financial Inc. and the company has recently consolidated operations to one building from four separate buildings. The new building now houses 2,000 employees.

Your team has been tasked with developing a detailed emergency response plan for the new office building and you are to involve local law enforcement in onsite training and drills.

ABC Financial Inc. has had financial struggles over the last several years and the mortgage business unit may be sold to outside investors. Over 1,000 employees may be affected by the sale of the mortgage business. The Foreclosure Department has 50 employees. Within the Foreclosure Department, there is an individual by the name of John Smith. Smith has been on edge the last few months. He is a loner, does not get along with his peers or supervisor, and his performance is lacking. There are rumors that Smith has had a history of violent behavior but none appeared on his background investigation for employment with ABC. He is also known to have firearms. Management is considering terminating Smith for performance deficiencies and that, along with the pressures of the business unit closing, has put a great deal of pressure on Smith and the employees in the business unit.

The information concerning Smith is provided to the Emergency Response Crisis Team. What, if anything, should the team do concerning Smith?

Two weeks later management decides to terminate Smith from employment on Friday because of performance issues. As he is leaving Smith tells his supervisor and 4 other employees in the Foreclosure Department unit that "you have not heard the last from me".

Security escorts him from the building and deactivates his access control badge.

What does your team do with the information concerning the remarks from Smith? Think about intelligence gathering, notifications etc...

8:00 am - Security is notified that an individual matching the description of Smith has entered ABC Financial Inc. with several firearms. The individual demanded and obtained an employees' access control badge in the lobby and gained full access to the building.

• Referring to the detailed emergency response the team developed, what preparations should the company have in place to handle this situation?

• What specific plans should have been established prior to the incident?

• What are the immediate considerations?

8:02 am - What decisions and actions should you consider now that 911 has been called by Security:

• What are your concerns?

• What are your immediate actions?

8:03 am - Security notifies occupants of an armed intruder in the building:

• What factors affect the announcement's content and delivery?

• What actions should be taken once the announcement is made?

8:05 am - Security and 911 operators are overwhelmed with phone calls from nearly 2,000 employees in the building:

• What are the key questions, concerns and actions at this point?

• Should employees shelter in place or try to evacuate?

• For those that have evacuated, management is trying to account for the employees in mustering locations in the parking lot but some

employees are fleeing the area and family members are breaking through crime scene tape to assist their loved ones. How should management and law enforcement handle this situation?

8:07 am - Police and first responders arrive and meet with representatives from your team:

• What actions do you take to assist emergency responders?

• Do you make a second announcement to employees? Why or why not? Consider the pros and cons.

• How do you handle arriving media?

8:08 am - Police response shifts from crisis to tactical:

• Now that law enforcement is onsite at the facility, how does the team coordinate efforts with them?

8:10 am - Gunshots are heard in the building and people are seen fleeing:

• What are the key questions and concerns at this point?

8:12 am - Reports indicate the terrorist shooter is heading to the Foreclosure Department:

• What particular concerns do you have at this point?

• What actions do you take?

8:15 am - Police notify security that the shooter has been killed but they are continuing their search:

• Is the threat over?

• What needs to be done now?

8:30 am - Police inform security that there are no additional shooters and initiate formal evacuation:

• How do the company and responders coordinate at this point?

8:45 am - Police notify your team of 5 dead and 7 injured in the Foreclosure Department:

• What priorities does the team now have?

• Does the team have suggestions for a "To Do" list?

9:30 am - Your team is told that the injured are being taken to hospitals and Police need help identifying the injured:

• How does your team assist authorities at this point?

10:30 am - Identities of the 5 deceased are provided to your team and company executives:

• What are the keys concerns and decisions at this point?

11:50 am - ABC Financial Inc. releases official media statement and is notified by the Police that the site is now a crime scene

indefinitely, with a need that all employees stay out of the building until further notice:

• Are there any further issues that need to be addressed by the team and management?

What are team's "Lessons Learned" from this event? Provide specifics.

Should there be a debriefing/hotwash with the stakeholders (company, law enforcement) to discuss best practices, lessons learned and an after-action report completed? Why or why not?