We thank Dr. Eric Sergienko for his contributions to the first edition of this chapter; portions of Dr. Sergienko’s prior chapter were used in the Historical Perspective section.
The Federal Bureau of Investigation (FBI) defines terrorism as “the unlawful use of force or violence against persons or property to intimidate or coerce a government, the civilian population, or any segment thereof, in furtherance of political or social objectives.” In total, 2608 terrorist attacks occurred in the United States between 1970 and 2011 (207 from 2001 to 2011). From 2001 to 2011, the most common targets of terrorists in the United States were businesses (62 attacks), private citizens and property (59 attacks), and government entities (43 attacks). Because the focus of this chapter is on operational response, the authors expand on the FBI definition of terrorism , and include random acts of mass violence, such as active shooter incidents (ASIs) and active violence incidents (AVIs), as acts of terrorism.
In 2004 Stephen Flynn wrote in Foreign Affairs that “Terrorism is simply too cheap, too available, and too tempting to ever be totally eradicated.” The pandemic of global civil strife and irregular warfare, coupled with the expanded Internet capability, is creating a complex and evolving threat matrix. Terrorists are now able to gain “on the job” training in any of a dozen “low-intensity conflicts” ongoing in every time zone. Alternatively, they can simply data-mine the Internet for bomb-making instructions or reviews of prior after-action reports on acts of terrorism.
From 2005 to 2014, the world witnessed a major evolution in the complexity and scope of terrorist attacks (e.g., Mumbai in 2005, the Westgate Mall in Nairobi, Kenya, in 2013, the Boston Marathon Bombing, in 2013, and numerous incidents in Pakistan, Iraq, and Syria). The majority of global terrorist attacks have been designed to destabilize existing political or social paradigms. This is true whether examining Al Qaeda (AQ) and their generational war philosophy, any of the myriad AQ affiliates (e.g., Abu Sayyaf, the Islamic State of Iraq and Syria, and Al Shabaab), domestic extremist groups, or lone-wolf attackers. This evolution emphasizes increasing coordination and sophistication of action; these “complex attacks,” by definition, include most or all of the following: diversion, attacks on first responders, use of explosives, use of fire as a weapon, impersonating first responders, and coordination among actors in multiple locations involved. Thus the need for coordination and cooperation among interagency partners in the first-response community has never been clearer.
In his 2001 book, Fooled by Randomness , Nicholas Nassim Taleb introduced the concept of “Black Swan” events in terms of financial crises. A Black Swan is defined as a major event that is considered in real time to be a surprise, and yet, once examined in hindsight, all of the relevant data reveal that it could have been expected and should have been prepared for. In the first-response community, most if not all of the active violence events since the turn of the century can be considered Black Swan events: they were all major events in their respective communities and were considered a surprise for the community in which they occurred, as well as for first responders, operationally. Yet, given that these events have occurred at a shockingly high frequency, the possibility of occurrence and the relevant data outlining the risk were never properly accounted for in the emergency-response plans and risk-mitigation programs.
Regardless of jurisdiction or geography, terrorist attacks should no longer be Black Swan events. Our response paradigms must evolve and be proactive rather than reactive, to address this ever-present threat. Successful prevention, response, mitigation, and recovery from terrorist events require a high-level of coordination between all disciplines of public safety, including law enforcement, emergency medical services (EMS), firefighters, and other rescue personnel. Everyone from the first care provider (FCP) through definitive care providers must have a common operating picture that allows for all links in the “violent event chain of survival” to be enacted. Now more than ever, interagency response to acts of domestic terrorism is essential.
This textbook deals extensively with biological, chemical, and radiological response, as well as the federal regulations governing disaster and terrorism response in the United States. This chapter concentrates on U.S. domestic response to terrorist incidents, with a primary focus on the operational aspects of local interagency response to complex terrorist incidents. That said, the chapter draws lessons from international experience with terrorist-incident response and has universally applicable lessons.
Since the 1980s, the terms consequence and crisis management have been used in differentiating between the roles of rescuers and investigators. The Federal Emergency Management Agency (FEMA) defines consequence management as taking action to protect public health and safety, restoring essential government services, and providing relief to governments, businesses, and persons affected by the consequences of terrorism. Crisis management, in contrast, is taking measures to identify, acquire, and plan the use of resources to anticipate, prevent, and resolve a threat or act of terrorism.
Consequence management is maintained at the lowest level of government possible. If the consequences of a terrorist incident can be met with resources from the local level, there should be minimal involvement of state or federal resources. If the local government is not able to manage the consequences of the incident adequately, it will turn to the state government for assistance. If the state cannot meet the needs of the incident, it will turn to the federal government. At the federal level, consequence management has been the responsibility of the agency providing civil defense. Since the 1970s, this has been FEMA.
In contrast, crisis management, since its conception, has been considered a function of the federal government. The concept of terrorism as a criminal act evolved from the realm of sabotage and espionage, where an individual, working as an agent of an enemy state, performs an action that is injurious to the government or its people. Acts of terrorism, by extension, are acts committed by transnational or nonstate organizations. Therefore the prosecution of alleged terrorists is conducted in the federal courts under U.S. code. The Department of Justice was appointed the lead federal agency for crisis management in the 1980s, and the FBI assumed lead responsibility for crisis management.
Having the two different response operations to the same incident led to conflicting objectives and incomplete situational awareness for all leaders. Conflict and vertical “stove-piping” of information followed. In an effort to address this challenge, the Stafford Act was passed in 1974, and amended in 1988, to delineate the federal response to a disaster. The Act was not made with a specific reference to terrorism. However, it states that nothing within the Act was to construe an investigatory role for any federal agency other than the FBI. In 1986, in response to the vice president’s Task Force on Terrorism, President Reagan issued the first guidance on responding to terrorism, naming the FBI as the lead agency for dealing with acts of terrorism.
The first paradigm-shifting act of terrorism on U.S. territory occurred in 1993. The World Trade Center was the site of an improvised explosive device (IED) detonation that resulted in six deaths and more than 1000 injuries. An area 150-feet wide and five stories deep was destroyed. The incident was initially felt to be a transformer explosion with a resultant fire. Accordingly, the Fire Department of the City of New York (FDNY) performed command and control (C2) of ground operations, drawing on mutual aid for the EMS response. Only later, did the response evolve into a crime scene. The area was then processed initially by four FBI evidence technicians and four Bureau of Alcohol, Tobacco, and Firearms evidence technicians working with a local New York Police Department chemist. After-action reports indicated a minimum number of conflicts between federal and local law enforcement officials. These reports attribute this to an already established joint terrorism task force (JTTF), which had been in existence in New York City since the 1980s. Subsequently, JTTFs have been established in 103 metropolitan areas, including all 56 major metropolitan areas that have FBI field offices. Each is made up of FBI special agents, special deputy U.S. marshals, and local law enforcement officers (LEOs). They share in the responsibility of gathering intelligence, investigating, and prosecuting terrorist-related crimes. Funding of the JTTF is largely through the FBI, although the local governments continue to pay the salaries of its officers.
In response to the Oklahoma City Bombing in 1995, President Clinton signed Presidential Decision Directive 39 (PDD-39). However, the response required was greater than the resources available to the local or state governments. Further, the incident was recognized nearly immediately as a criminal action. Although there was immediate involvement of federal agencies, there was little coordination between the consequences and crisis functions. PDD-39 established guidelines for federal C2 in the event of a terrorist incident. Specifically, it designated the Department of Justice as the lead federal agency for operational response and crisis management. The attorney general delegated this role to the FBI. It designated FEMA as the lead federal agency for consequence management. Further, it specified that crisis management would take precedence over consequence management—the FBI would remain in charge of the scene until the attorney general had turned the scene over to FEMA.
Presidential Decision Directive 62 (PDD-62) directed the federal agencies in their preresponse planning to counterterrorism and consequence management. It established a national-level coordinator for security, critical infrastructure protection, and counterterrorism. It provided guidance on the role of the Department of Justice, Department of Health and Human Services, and Department of Defense in preparing the Metropolitan Medical Strike Teams (now Metropolitan Medical Response System) in the first 120 cities that established them.
The Concept of Operations Plan (CONPLAN) for terrorism, signed in 2000, reaffirmed the role of the Department of Justice as the lead federal agency, a responsibility that is delegated to the FBI, in the response to terrorism. As such, the FBI remained the on-scene commander until the attorney general relinquished control to FEMA. However, there was much to do in terms of transitioning from a focus on crisis management to creating an environment centered on a unified command involving all agencies involved. The FBI would establish a Joint Operations Command (JOC) that would serve as a focus for crisis management in the unified response. It was intended to complement and work with the local agencies’ Incident Command System. Further, the National Incident Management System (NIMS) was established to define a common operating language and framework to assure interoperability of local, state, and federal assets.
In 2013 the United States updated the National Response Framework (NRF) to endorse an all-hazards approach to disaster response, which included terrorist incidents. Emergency Support Function #8 (ESF-8) provides a mechanism for the federal government to supplement state, tribal, and local resources in response to public health and medical disasters or potential incidents requiring a coordinated federal response. ESF-8 supports such core functions as rapid needs assessments, health surveillance, medical care personnel, patient evacuation, patient care, blood and blood products, food safety and security, and health, medical, and veterinary supplies. The secretary of Health and Human Services (HHS) leads all federal public health and medical response to public health emergencies and incidents covered in the NRF.
However, the old adage that “all disasters are local” is particularly applicable in the immediate response to a terrorist incident. The move from spectacular attacks to disseminated, “entrepreneurial” attacks (i.e., unaffiliated attackers), “lone-wolf” terrorists, and ASIs and AVIs creates highly dynamic and fluid situations that often do not allow for easy transition between crisis and consequence management. Moreover, areas without JTTF are increasingly at risk. For example, the mass shootings at Virginia Tech (2009) that killed 32 and wounded 17; the Aurora, Colorado, Century 16 shooting (2012) that killed 12 and wounded 70; and the tragic massacre in Newtown, Connecticut (2012), of 26 individuals victims, 20 were children, were all initially managed locally. The migration of terrorist incidents to lower-visibility areas demands immediate, effective, and well-practiced local interagency response to high-threat incidents. Accordingly, it is worth reviewing the evolution of the U.S. Fire Service, EMS, and law enforcement response to acts of terrorism and mass violence.
Development and History of Response
Organized over a century and a half ago, the U.S. Fire Service initially had the sole task of protecting against property loss from fire. However, in the 1960s and 1970s, as the number of structure fires dwindled—owing to stricter building codes, sprinkler systems, smoke detectors, fire resistant materials, and a push toward more fire prevention and code enforcement—the Fire Service began to evolve to address the operational gaps that were being defined in public safety and response. The concept of an “all-hazards” approach for the U.S. Fire Service was born.
Although commonly labeled as “200 years of tradition unimpeded by progress,” the U.S. Fire Service has actually evolved dramatically in the past 40 years. As new risks to public safety were being defined, brave members of the Fire Service often stepped forward to accept the risk associated with mitigation and response. For example, in the 1970s the Fire Service assumed primary lead for management of hazardous material (HazMat) response and developed highly specialized teams of responders trained in recognition of chemical release, decontamination procedures, incident command, and high-threat operations. During the 1980s, the Fire Service identified the need for specially trained personnel to conduct increasingly frequent high-threat rescue operations in urban environments. This gap analysis led to the development of technical rescue, a specialty that includes vehicle extrication, high- and low-angle rope rescue, confined-space rescue, and urban search and rescue (USAR). In the 1990s, the Fire Service took the lead in the development, training, and coordination for integration of prehospital medical personnel into law enforcement specialty tactical teams. As these new response specialties have matured in the Fire Service, regulatory and industry groups have developed guidelines and safety standards to be implemented in an attempt to reduce adverse outcomes and mitigate risk to responders during operations.
Given the history of changing the U.S. Fire Service mission to address operational gaps, it is not surprising that the Fire Service sits on the forefront of the need for joint operations with other public safety agencies to mitigate and respond to coordinated terrorism events. Yet, despite the clear operational gaps and the embraced all-hazards response paradigm, resistance remains among the Fire Service to adopting new roles in high-threat operations. This resistance must be addressed and broken down.
The July 7, 2005, coordinated bombings on the London public transportation system provide insight into the consequences of actual, or perceived, coordination gaps in public safety response to a complex attack. The response to the well-planned and well-coordinated bombings involved multiple agencies, including the London Fire Brigade, London Metro Police, City of London Police, London Transit Police, and London Ambulance Service. The official Coroner’s Inquest into the bombings revealed the same operational issues seen in almost every major incident: difficult communications, lack of real-time intelligence, equipment issues, and clear operational role tasking. The inquest, as a whole, states that all operational partners performed to the expected standard of their individual disciplines and specialties.
However, the public opinion after the incident was not as supportive. During the initial response to the bombings, citing operational limitations to ensure scene safety, the London Fire Brigade staged outside the train stations while other public safety agencies moved aggressively into the higher threat zone. Newspaper headlines and stories described multiple victims alive after the blast for significant periods, dying in blast wreckage and being tended to only by civilian bystanders or police, while the Fire Brigade staged. The public spokesperson for the victims’ families delivered strong critical statements about the Fire Brigade response to the event: “The fact of the matter is that on July 7, 2005, they were operating in the same environment as the other emergency responders and yet did not take or were not willing to take the same calculated risks that were being taken by, for example, British Transport Police at King’s Cross…. In our summation the sense has emerged from the inquest that the pendulum may have swung too far in favor of an overly cautious approach.” The London Fire Brigade, despite no official criticism, lost the battle in the court of public opinion and lost public confidence.
Public safety entities are a part of the most successful social contract between the government and the people. As such, public safety agencies have been given special status among the citizens; culturally, police, firefighters, and EMS personnel are heroes who are willing to risk their lives to come to the rescue of the people in their most dire times of need. Public safety agencies are expected to accept mitigated risk in their jobs. Therefore to let citizens die while standing by in the name of safety flies in the face of the social contract upon which these agencies are funded and supported.
In the wake of the event, the London Fire Brigade made rapid and profound operational changes. In preparing for the 2012 London Summer Olympics, their command-level personnel researched international best practices and worked with their public safety partners to develop and implement a new approach to high-threat scenarios (London Fire Brigade, personal communication, 2008). Even though the London Fire Brigade should be applauded for their current approach to high-threat scenario operations, including aggressive police-fire integration for medical rescue and fire suppression, the lasting effects of the loss of public confidence continues to affect the agency even 7 years after the 2005 attacks.
The historical precedent in the U.S. Fire Service is one of ready adoption of new roles once gaps in the public safety response matrix have been identified. The Fire Service of the twenty-first century is one for all hazards, one that researches, studies, and identifies the risks to the public it serves and then builds a response capability to address that risk. This process has started again regarding the gap in response to complex terror attacks on the public. New roles can be accepted and will be integrated into the public safety culture.
Emergency medical services
Development and History of Response
The modern EMS system was established in the late 1960s and 1970s, primarily because of a significant number of deaths resulting from motor vehicle collisions on the nation’s expanding highway system. The original focus of EMS was to recognize and provide basic care for certain injuries in the field and transport the injured to appropriate care. The role of EMS has evolved over the past 40 years, and it now expands beyond trauma care to include medical emergencies, prevention, education, and specialty services, such as critical care transport, air-medical services, and interfacility medical transports. In addition, EMS organizations are increasingly called upon to provide medical specialists to support technical, tactical, and other rescue activities. Expansion of the levels of certification to include advanced life support (ALS) providers was a pivotal factor in the growth of EMS. In various communities EMS may be provided by the Fire Service, as a stand-alone third service (private or public agency), or, in limited cases, by other public safety entities such as police departments.
In the 1990s, interagency leaders noted the need for specially trained medical personnel to support increasingly high-risk law enforcement special operations and tactical-team missions. These tactical emergency medical support (TEMS) medics, typically cross-trained firefighters or EMS personnel, but in many cases sworn LEOs, provide active medical capability during operations at or near the point of wounding. In many jurisdictions, the TEMS medics have also adopted the role of team occupational health provider, operational medical consultant, and preventative health expert. The role of these specialty providers continues to evolve and expand as their utility is validated across different mission profiles. ,
Similar to the Fire Service, EMS must change their paradigm of response and operational risk mitigation. The initiation of TEMS and the expansion of tactical medical support through the 1980s reflected an innovative mind-set to address a changing threat matrix. However, in the past 20 years, TEMS has evolved as a subspecialty of EMS, as opposed to a driving force of change within the specialty. TEMS practitioners have focused on developing support protocols for high-risk SWAT missions and the myriad challenges that accompany planned support in high-threat areas. The EMS community as a whole has remained very risk conscious.
Although scrutiny is generated due to large-scale events such as the 2012 Aurora, Colorado, Century 16 shooting, there has yet to be a sentinel event involving EMS response to drive the needed response paradigm change. Given the evolving terrorist and AVI threat, the national EMS community must embrace expanded, coordinated operations with other first-response disciplines. TEMS specialists have a potentially important leadership role in this transformation, as the designated interagency representatives.
Development and History
LEOs at all government levels have traditionally held primary responsibility for responding to terrorist attacks and AVIs. LEOs are commonly the initial first responders on scene in any major event, and they are trained early on in risk-mitigation and threat-elimination strategies. Historically, however, most agencies have mitigated risk to the general LEO population by limiting exposure to high-risk scenarios through the utilization of highly trained, specialized tactical teams such as SWAT teams or Violent Criminal Apprehension Teams (VCATs).
The 1966 University of Texas Tower shooting served as the impetus for the creation SWAT teams to address particularly high-risk and dynamic situations. The role of SWAT has expanded and evolved in the past five decades, and they remain an important law enforcement tool. SWAT teams play an important role in planned high-threat operations (e.g., warrant service), static high-threat scenarios (e.g., barricade suspect or bank robbery), and dynamic incidents (e.g., ASI). However, a majority of U.S. SWAT teams are designated “part time,” with several members “on call” while filling other roles (e.g., patrol or training). Therefore SWAT takes time to activate and respond. Although SWAT team members have been involved in the response to most domestic terrorism or AVIs since their inception, they have rarely been the first on scene. Even in the 2009 Virginia Tech Massacre, where two local SWAT teams were standing by on campus, the first response was by patrol officers.
Columbine was the sentinel event in LEO response to active threats. ASI and active killing events were a well-known public safety risk prior to the 1999 massacre at Columbine High School. However, these incidents were widely considered the responsibility of the highly trained Special Weapons and Tactics teams.
Prior to the Columbine event, the law enforcement response paradigm to ASI and active killing events was based on the concept that the intent of the shooter was not primarily murder and that the operational risk to responders and tactics required to successfully resolve the incident mandated the highly trained tactical teams as the primary responders. As a result, the law-enforcement patrol-officer community response to ASIs was based on the concept of the “five Cs”: contain the perpetrator, control the scene, call SWAT, communicate with the perpetrator, and come up with a response plan.
The assault on Columbine High School, which resulted in 12 dead and 24 wounded, forced a change in the LEO ASI response paradigm. The well-planned attack on the school included combined small arms and incendiary devices designed to create a structural collapse and fire that would drive evacuating students into a predesignated “kill zone.” The perpetrators planned to shoot these fleeing students as they exited the building. However, the devices did not explode as intended, so they changed their plan and went in on a shooting spree.
Police responded to Columbine very quickly. In fact, the shooters exchanged fire with LEOs 2 times during their attack: once with the school resource officer and again through the windows of the library, at the police units operating to rescue injured students in the parking lots outside. Tactically, according to the law enforcement paradigm of the day, the law enforcement response went well. As patrol officers responded, an immediate hard perimeter was established. SWAT was requested and was on scene within about 30 to 40 minutes. Plans were rapidly developed to put the SWAT teams into the building. Within an hour of the first shot being fired, SWAT entered the building. However, during the hour prior to LEO entry, as perimeters were established and tactical plans were developed, the shooters had free range of the building. They hunted students, shooting at will with little if any resistance. The two finally committed suicide approximately 46 minutes into the incident, and yet, no significant police entry into the building was initiated for another 15 + minutes.
Even after entry, the response into the school remained slow and methodical. The tactical teams moved slowly through the large and complex school footprint, completing a methodical clearing of the structure. It took almost 4 hours for the building to be declared “safe,” thus allowing medical rescue operations inside the building. It is well known that at least one victim died in the interim prior to the police and medical response. Coach David Sanders, during his actions to direct students to safety, was shot in the upper chest and shoulder, suffering damage to several major blood vessels. He was pulled into a room by fellow teachers and students, the door was barricaded, and they waited for rescue. Two hours later, as Coach Sanders’s condition became critical, the teachers and students in the barricaded room with him realized that his injuries were grave. In an attempt to communicate the gravity of the situation in the room, they wrote, “1 bleeding to death” on a wipe board, and posted it in the window where it was directly visible to the responding LEOs. Yet, no one came. Coach Sanders died in the classroom after several hours, ironically just minutes before the medical-response assets finally reached him.
The massacre and the perceived lack of action on the part of LEOs horrified the public. Criticism from the Governor’s Columbine Commission addressed this directly, “The 46 minute rampage … during that period, to the Commission’s knowledge, no efforts were made to engage, contain, or capture the perpetrators.” Moreover, the conclusions were strongly worded: “Law enforcement policy and training should emphasize that the highest priority of law enforcement officers, after arriving at the scene of a crisis, is to stop any ongoing assault. All law enforcement officers who may be first responders at a crisis, and all school resource officers should be trained in concept and skills of rapid emergency deployment….” Rapidly, the police paradigm of response to ASI and active killing incidents changed.
The new paradigm for law enforcement response became one of rapid deployment into the building or location to aggressively pursue the assailant, and stop the ongoing violence. This new response model was no longer relegated to the highly trained and tactically proficient SWAT teams but the first-arriving officers on scene, most often patrol officers with limited training, limited firepower, and often without high-level ballistic protection. The speed by which this new response paradigm was adopted and implemented by law enforcement agencies was impressive. However, even more impressive was the rapid and absolute acceptance of the burden of immediate response along with the subsequent increased risk by the patrol officer community. This response paradigm represented a completely new role for the patrol officer, and few hesitated at the implications of the job. As a result, the past 14 years have seen a significant shift in the training and culture of the patrol officer as it relates to ASI and active killing event response. Commonplace now across the vast majority of, if not all, law enforcement agencies is training for patrol officers in immediate deployment tactics, single and multiple officer teams, and long weapon training, as well as outfitting with advanced ballistic gear and more firepower.
Study of historical incidents and lessons learned can create a pathway forward to meet the new threat head on. SWAT experts continue to have an important role in the overall response but rarely in the early actions. Instead, the nonspecialized first responder’s immediate actions on scene will determine the success of the response. In the United States a majority of AVIs end with LEO and first-responder engagement of the perpetrator. The historical perspective shows that if the attack is not allowed to gain a foothold and develop as planned, there will be less carnage. Addressing this challenge requires a shift in mind-set and a change in risk tolerance. It is imperative that first-response agencies shift focus and training to meet this mandate.