Active Shooter Tabletop Exercise

1. Active Shooter Tabletop Exercise Dean Correia, Emeritus Faculty Security Executive Council National Food Service Security Council Annual Conference August 7, 2013

2. Outline • Introduction: Crisis Management • Tabletop Exercise: General Overview and Instructions • Tabletop Exercise: Joe’s Burger Shack • Segment One: Incident and Initial Response • Segment Two: Continued Response • Segment Three: Recovery 48 Hours Later 2

3. Introduction: Crisis Management

4. Critical Incidents… • Unplanned, any time, anywhere • Crisis Management Team – some may be away • May not be caused by your company • Require swift, decisive action involving multiple public sector components • May include rescue operations, special police response, and highly trained firefighters 4

5. Examples of a Critical Incident • External crime • Fires • Extortion • Supply chain disruption • Workplace violence • Severe weather • Foodborne illness • Product contamination • Loss of propriety information 5

6. Crisis Management Objectives • Protect Life • Protection Of The Environment • Protection Of Assets • Promote Effective Response • Promote Recovery To “Better Than Before” Operations 6

7. Decision Making Under StressJohnson & Johnson Tylenol Incident • Early 1980s in Chicago – 7 people died from taking Tylenol capsules that were filled with cyanide • Johnson & Johnson had no formal crisis mgt team • Formed team of senior managers who determined that product was not compromised during manufacture or shipping • Nation wide product recall performed • Spent considerable amount of money on development of tamper proof packages • Launched media campaign to regain consumer confidence • Emerged as a leader in tamper proof packaging and a forerunner in critical incident management 7

8. Organization: Structured to Provide the Following • Defined responsibilities • Speed of decision making • Effective communication system • An ability to continue business 8

9. Typical Crisis Management Team 9

10. CMT Interfacing Executive Decision Making Authority Public Sector IRT Team Rep Emergency Operations Center 10

11. Tabletop Exercise:General Overview and Instructions 11

12. Training Objectives • Identify roles & clarify responsibilities • Enhance skills • Measure resources • Build teamwork & Improve coordination • Validate emergency response plan • Provide feedback 12

13. Exercise Format • Enhanced Tabletop Exercise: • Generic site scenario • Public sector response is simulated • Presented in PowerPoint • Role cards at table?????? 13

14. Exercise Scope • Each segment contains time for individual assessment and group discussion • The Crisis Management Team participants will develop response priorities as the scenario unfolds • The Crisis Management Team will simulate coordination with emergency response personnel in a unified manner • In a real emergency, the local officials would have to assess the impact on community. May “take over” • Think – does my company have a resource to handle this response/recovery plan element? 14

15. General Instructions USE ONLY THE FACTS INTRODUCED IN THE SCENARIO • There are 4 segments • Segment 1 and 2: response segments • Segment 3: recovery segment • Segment 4: follow up points • Segment 1 – 2 (20 minutes) • Review the scenario • Take a few minutes to individually write down what initial actions should be taken • The Team Leader will direct a group discussion in the analysis portion of each segment • Priorities will be listed for the CMT • Segment 3 (20 minutes) • Scenario will forward in time 48 hours from the conclusion of the response segments • The private sector participants will group together for a discussion of the actions to be taken and to identify the responsibilities • Segment 4 (20 minutes) • Follow up points for discussion by the exercise participants • Document what actions should be taken to improve the crisis management plan 15

16. Tabletop Exercise:Joe’s Burger Shack 16

17. Scenario: Joe’s Burger Shack • Headquarters facility, with access control system, located on 400 acre campus in the City of Midsville. • Two level facility - 510,000 square feet and 1,400 employees • All Key Departments • IT (Main Data Center) • C-Level Executives • Human Resources • Security • Operations • Legal • Marketing/Global Communications • Facilities 17

18. City of Midsville • Upscale suburb of a major upper mid-west city • Population approximately 75,000 • Has a number of large office buildings and shopping malls • Local police supported by the county sheriff and the state police • Fire department has mutual aid agreement with nearby communities 18

19. Segment One Incident and Initial Response 19

20. Segment One ResponseCall to 911 About Shots Fired • It is business as usual at Joe’s Burger Shack HQ when a 911 operator receives a whispered call from an employee in the facility, who states that a gunman is randomly firing at any employee in sight. • The caller states that the shooting is taking place in the HR offices area on the upper level. • Security is notified and the police are dispatched 20

21. Segment One ResponseMore 911 Calls • Another caller reports to 911 that a man with a handgun was seen near the Data Center, on the main level • The police are updated on this latest report 21

22. Segment One Response Police Arrive • Midsville Police Department response units are arriving at the scene • The officers call for additional support as they realize the scope of the developing situation 22

23. Segment One ResponseInjuries • There are reports that several employees have been shot and some appear to be fatally injured • All EMS units have responded 23

24. Segment One ResponseJoe’s Burger Shack Emergency Response In view of the situation, the Joe’s Burger Shack Crisis Management Team is mobilizing in a secure conference room at HQ Operations are being set up in the command center, but not all CMT members have responded Details are just beginning to come in regarding the situation 24

25. Segment One ResponseCommand Center Activity • The city’s Emergency Response Command Center is activated • Information is pouring in from all public sector responders as well as from Joe’s Burger Shack employees • Officers at the scene report that there is no current information on the location of the gunman 25

26. Segment One Analysis & Discussion 26

27. Segment One Public Safety Response • Police and EMS services set up a unified command center, with the police taking the initial lead • Joe’s Burger Shack CMT have requested and been granted a representative at the command center • Police Special Response Team is mobilizing, but this will take time • Police and EMS support from mutual aid communities have been requested. Area hospitals are notified. • Traffic control points are being set up to clear access for emergency vehicles and expedite the evacuation process • FBI notified due to possible terrorist involvement 27

28. Segment One ResponseDiscussion Starters • How can the injured persons be located and evacuated for proper medical care? • What notifications should be made and how will they be made? • Should any additional security measures be taken? • How can the situation be stabilized? • How quickly can liaison be established with the public agency incident commander? • What are the priorities? 28

29. Segment Two Continued Response 29

30. Segment Two ResponseLocal Media Arrive • The local television media is at the scene attempting to interview Joe’s Burger Shack employees • Reporters indicate they have information that there is a gunman on the loose in the facility • Officials are pressed for comments 30

31. Segment Two ResponseMissing Employees • Due to the confusion surrounding the events, and panic during the evacuation, many employees are unaccounted for. It is unknown if there are still people in the facility. • A number of visitors are also missing 31

32. Segment Two ResponseHostage Situation • 911 receives a call - a gunman is holding a hostage in a conference room in the Accounting Dept. on the main level. This happened during the evacuation process, but the caller had problems getting a cell line. • The gunman was yelling that “Joe’s Burger Shack is paying the price for its ruthless actions” 32

33. Segment Two ResponseHostage Negotiations • The police have isolated the conference room and determined that the gunman is holding at least one hostage • Negotiators have opened a dialogue with the gunman by phone. He demands a live TV interview, which he can monitor, “So all will know that this is the fault of Joe’s Burger Shack .” 33

34. Segment Two ResponseRescue Operations Underway • With the gunman isolated by police on the main level, limited recovery operations are now underway to search for victims and survivors from the shootings 34

35. Segment Two ResponseMore From The Media Reporters persistently request statements from public safety agencies and want details about the shooting spree They are also pressing for statements from Joe’s Burger Shack officials 35

36. Segment Two ResponseEmergency Operators Flooded With Calls • Information about the shootings and hostage situation has been broadcast on radio and TV. The local 911 operators havebeen overwhelmed with calls from family members of employees and others with loved ones in the area. 36

37. Segment Two ResponsePressure From The Media • National cable news channels have picked up the story • Public officials from the local, county, and state levels are being questioned about the incident • Experts are appearing on the news discussing workplace violence and any possible terrorist aspects 37

38. Segment Two ResponseSuspect Sighting • A report is just now received that the shooter has been identified by witnesses as an employee of Joe’s Burger Shack • Based on initial information, he was just placed on sick leave 38

39. Segment Two Analysis & Discussion 39

40. Segment Two Public Safety Response • Police investigators request all information possible on the suspect employee • Mutual aid support has been arriving and deployed to the scene • Private ambulances have been requested to augment overburdened EMS units • Helicopters are needed to rush the critically injured to adequately staffed and equipped trauma centers • A joint news briefing is being set up to include public safety representatives and ranking officials from Joe’s Burger Shack and a representative of the Crisis Management Team 40

41. Segment TwoDiscussion Starters • How can the Crisis Management Team be more effective in locating missing employees and visitors? • What can be done to assist law enforcement investigative personnel regarding information about the suspect? • What can be done to better function in the severe weather? • How can the media best be accommodated? • Can the media be helpful in notifying family members of the ongoing situation? • How should Joe’s Burger Shack authorities be responding to and reporting on the incidents ? 41

42. Segment Three Recovery - 48 Hours Later 42

43. Segment Three Recovery Situation Concluded with Suicide • After a three hour standoff, a single gunshot was heard • The police entered the area and found that the gunman had shot himself • He was conveyed to the hospital and pronounced dead on arrival • The hostage was unharmed 43

44. Segment Three Recovery Casualties • The death toll on the day of the attack was as follows: • Four employees died from gunshot wounds • Two visitors suffered fatal heart attacks • A total of six other employees suffered non-fatal gunshot wounds. Two of these shooting victims are in critical condition. • Over 20 other people suffered from, cuts, broken bones, and abrasions due to the initial panic that ensued 44

45. The gunman was found to be armed with a Glock, 9 mm handgun plus an extra magazine of ammunition He was identified as an employee of Joe’s Burger Shack , who was recently placed on leave, but his access card had yet to be disabled Some of his co-workers stated that he had been brooding because he had been passed over for promotion Segment Three RecoveryInvestigative Findings 45

46. Segment Three Recovery Aftermath of the Attack • Joe’s Burger Shack employees are being scheduled to receive post traumatic stress counseling • Additional professional assistance will be needed to handle the volume of workers • Many others have called their employer with concerns about returning to the workplace 46

47. Segment Three RecoveryContinuing Coverage • The media continues to give coverage to this incident as funerals are being planned for the victims • Experts offer opinions on how to recognize and deal with potential violence in the workplace 47

48. Segment Three Analysis & Discussion 48

49. Segment FourDiscussion Items • What can be done to prevent such an incident from occurring in the future? • How did the members of the Crisis Management Team interact during the exercise? • Were there any difficulties in reaching team priorities? • What issues/gaps were uncovered during the scenario with your own company’s response plans that need to be addressed in a follow up manner? 49

50. Key Learnings • Proactively mitigate risks • Have a CMT and a local IMT • Build relationships outside of crisis – NFSSC, local responders, etc. • Have 2 designated meeting places • Crisis management is not cookie cutter. They are leadership opportunities.