Security Officer Posting and Active Shooter Attacks

By Craig S. Gundry, PSP, cATO, CHS-III

Few would debate that one of the most important factors in mitigating active shooter attacks is the speed in which response forces (police or armed security personnel) intercept and neutralize the adversary. The importance of response time is well supported in studies, such as Purdue University’s 2014 Mitigating Active Shooter Impact Study,[1] and case analysis of incidents using the basic mathematical principles of physical security design. The true performance measure of any Physical Protection System (PPS) is its Probability of Effectiveness, most simply described as the probability of a response force intercepting an adversary (Probability of Interruption) and stopping the intruder before the adversary can complete his objective (Probability of Neutralization). [2] Although there are many factors contributing to the Probability of Interruption, the success of a protective design ultimately hinges on Adversary Task Time in relation to Response Force Time.

Recognizing the importance of rapid intervention, many organizations in recent years have opted for contracting or assigning armed security or police on-site to serve a dual role as deterrent and response force in the event of an active shooter incident.

Although having an on-site response capability offers great potential to mitigate the consequences of an armed attack, the manner in which security or police are employed is critical if they are expected to perform their function reliably when needed. As a consultant working with many clients the past decade that have adopted the use of armed security or police personnel for this purpose, one of the most common problems I observe consistently is the assignment of officers without proper consideration for tactical reaction time. Where this concern emerges most frequently is in situations where a facility has a small sized armed security force and has assigned critical officers to stationary posts near entrances without additional control measures.

The vulnerability of posting critical response officers near entrances is illustrated by a number of attacks over the past few decades where armed officers were shot by surprise or unable to react effectively quickly enough to stop the attacker from entry. As a few examples:

    • In the early morning of 01 January 2017, gunman Abdulkadir Masharipov killed 39 people and wounded 70 others at the Reina Nightclub in Istanbul. Although public details about the event are limited as of date, reports claim the attack was initiated when Masharipov shot a former police officer, Fatih Cakmak, and bystander outside the entrance. News reports indicate two other security officers, Hatice Karcilar and Burak Yildiz, also were killed during the attack but little information is available currently about whether the two officers were armed or what their response was during the incident.[3][4]
    • During the June 2016 attack at the Pulse nightclub in Orlando, a contracted off-duty police officer, Adam Gruler, was posted inside the club when Omar Mateen entered and opened fire on patrons. Gruler engaged Mateen but was reportedly outgunned and driven to retreat which allowed Mateen to bypass Gruler’s position and enter deeper into the club.[5] Altogether, 49 patrons were killed and 53 wounded before police made entry and neutralized the killer.
    • During the May 2003 Al-Qaida attack at the Dorrat Al-Jedawal residential compound in Riyadh, a Royal Saudi Air Force guard and unarmed security officer were killed by surprise when they approached the terrorists’ vehicle as it pulled into the north-side entry gate. [6] With the only armed officer at the entry control point killed, the remaining unarmed security force was forced to flee for their survival.

In each of the above cases, security personnel did not have ample opportunity to recognize an attack was underway and react effectively before being killed or overwhelmed due to tactical disadvantage.

Security officers assigned to protecting facilities against armed assaults require a theoretical minimum of two seconds to perceive and initiate a tactical response effectively. According to studies of human reaction time, it requires approximately .20 to .30 seconds for a person to recognize a situation visually and mentally process a reaction.[7] It then requires approximately 1.7 seconds to draw a weapon from holster, aim, and fire.[8] It is also important to consider the level of awareness of the officer assigned to a security post. The two-second theoretical response time as described assumes optimal conditions and is based on research where test subjects were in a heightened state of arousal and anticipating a provocative stimulus. To describe this by using Jeff Cooper’s color codes of awareness, officers participating in research tests and firearms drills usually are in Condition Orange (specific alert). [9] In the real world when an officer is assigned at a post for extended periods without any threat to arouse awareness, the officer is most likely in Condition Yellow (relaxed alert) or possibly even Condition White (unaware). If we add to this situation additional distractions common at entry control points such access control activities and discussion with building entrants, reaction time to an armed threat could be notably longer than two seconds. An officer seated in a chair would be at even greater disadvantage.

Several options exist to approach this problem in security planning.

The most ideal option is to augment officers assigned at entry points with additional armed officers located inside more tactically advantageous locations to serve as the reliable response force if an attack occurs. In the June 2009 attack at the United States Holocaust Memorial Museum in Washington DC, James von Brunn shot Special Police Officer Stephen Johns as Johns was opening the door for him.[10] Other armed officers posted nearby were able to respond and neutralize von Brunn before he was able to pass the lobby.

Many organizations do not have the budget for more than one armed officer. In this situation, ensuring a reliable response by a lone officer requires posting him in a location that will provide two seconds or more of reaction time. If a single armed officer was posted previously in a vulnerable location near an entrance, it may be more prudent to reposition that officer in the building interior and away from entrance doors. This suggestion is often resisted when first proposed to clients that believe the armed officer is a useful deterrent when posted visibly near an entrance. It is true that perceived vulnerability is a common factor contributing to terrorist target selection, but the deterrence value of armed officers at entry control points likely is overestimated considering the frequency of attacks against facilities visibly protected by armed personnel. Although attacks have occurred where adversaries altered their plan once in execution due to newly perceived resistance at entry points (e.g., 2015 attack at the Krudttønden Cultural Centre in Copenhagen, 2015 Stade de France, etc.), we are not aware of many events where adversaries abandoned their attack intentions specifically because of the presence of armed officers at entrances.

Deterrence resulting from presence of easily observed security elements is often effective in preventing criminal actions. But when dealing with active shooters (terrorists and non-ideological perpetrators), we should assume that attack preparation will involve a more sophisticated assessment of our vulnerabilities. When securing a facility against a committed and often highly-capable adversary, deterrence as a system design goal should be regarded as the byproduct of an effective performance-based protective system.

In addition to choosing post locations that provide effective response time, armed personnel responsible for defense at entry control points should be provided with pre-positioned cover in the event of a force engagement. Cover is simply defined as an object that will shield an individual from firearm projectiles. What defines cover is determined by the adversary’s weapon system and the ballistic resistance of the object’s material and construction. In building lobbies, for example, cover for stationary security posts can be facilitated discreetly by the use of planters, bullet-resistant trash receptacles, half-walls, or security desks constructed of bullet-resistant materials. Some examples of materials appropriate for use as cover against military small arms include:

      • UL 752 rated glazing and wall construction panels[11]
      • EN 1063 rated glazing and wall construction panels[12]
      • ASTM F 1233-98 rated glazing[13]
      • NIJ 0108.01 rated materials[14]
      • Reinforced Concrete, 4″ or more[15]
      • Brick Masonry, 8″ or more[16]
      • Mild Steel Plate, 14mm[17]
      • Armor Steel Plate, 11mm[18]

To further mitigate risks at building entry control points, open entrances and public lobbies ideally should be protected by an inner layer of intrusion-resistant barriers to delay adversaries regardless of the presence of armed officers. Even a large group of security personnel in proximity of an entrance doesn’t guarantee reliable interception. Speed and surprise provide the attacker with a huge advantage in these events. This point was demonstrated in the 2014 attack at Parliament Hill in Ottowa. After wounding an unarmed officer at the Centre Block building entrance doors, gunman Michael Zehaf-Bibeau was shot by another officer located nearby and was able to run successfully through the Rotunda and Hall of Honour corridor past two rooms occupied by members of Parliament before being contained and neutralized.[19] Had the entrance design at the Centre Block building employed a secure layer of full-height intrusion resistant barriers (e.g., walls, lexan turnstiles, etc.), it is not likely Zehaf-Bibeau would have made it past the lobby.

Share on facebook
Share on twitter
Share on linkedin
Share on email

Copyright © 2017 by Craig S. Gundry, PSP, cATO, CHS-III

CIS consultants offer a range of services to assist organizations in managing risks of active shooter violence.  Contact us for more information.


1] Anklam, Charles , Adam Kirby, Filipo Sharevski, and J. Eric Dietz. “Mitigating active shooter impact: Analysis for policy options based on agent/computer-based modeling.” Journal of Emergency Management 13.3 (2015): 201-16. Web. 6 Mar. 2017.

[2] Garcia, Mary Lynn. Vulnerability Assessment of Physical Protection Systems. N.p.: Butterworth-Heinemann, 2006. Print.

[3] O’Brien, Zoie. “First images of Turkey nightclub attack victims as police officer and student identified.”, 02 Jan. 2017. Web. 06 Mar. 2017. <>.

[4] Michael, Tom, and Jon Lockett. “Families weep for dead as identities of Istanbul nightclub attack victims emerge.” The Sun. The Sun, 02 Jan. 2017. Web. 06 Mar. 2017. <>.

[5] Harris, David. “Cops give harrowing account of rescues during nightclub shooting.” N.p., 14 June 2016. Web. 06 Mar. 2017. <>.

[6] Braden, Wallace. “Attack at Jedawal: Critical Lessons for AT Professionals.” 2005. S2 Online Academy. Web. 2005. | AUTHOR’S NOTE: Surprise assault against entry control point guards was a common and successful modus operandi in AQAP attacks inside Saudi Arabia throughout the early-mid 2000’s. Some other noteworthy examples include attacks at the Vinnell Corporation compound (May 2003), Al-Muhaya compound (November 2003), and the Al-Abqaiq oil processing facility (February 2006).

[7] Welchman, Andrew E., James Stanley, Malte R. Schomers, R. Chris Miall, and Heinrich H. Bülthoff. “The quick and the dead: when reaction beats intention.” Proceedings of the Royal Society of London B: Biological Sciences. The Royal Society, 03 Feb. 2010. Web. 06 Mar. 2017.

[8] “Edged Weapon Defense: Is or was the 21-foot rule valid? (Part 1).” PoliceOne. N.p., 23 May 2005. Web. 06 Mar. 2017. <>. | AUTHOR’S NOTE: The 1.7 second time cited by PoliceOne for drawing and aimed fire is also very consistent with the experience of the S2 Institute’s firearms training team during timed tactical handgun drills.

[9] “Cooper’s colors: A simple system for situational awareness.” PoliceOne. N.p., 09 Aug. 2010. Web. 06 Mar. 2017. <>

[10] Ruane, Michael E. , Paul Duggan, and Clarence Williams. “At a Monument of Sorrow, A Burst of Deadly Violence.” The Washington Post. WP Company, 11 June 2009. Web. 06 Mar. 2017. <>.

[11] For protection against military small arms, optimal specifications would be UL 752 Level 7 (five impacts, 5.56x45mm) or Level 8 (five impacts, 7.62x51mm)

[12] For protection against military small arms, optimal specifications would be EN 1063 BR5 (three impacts, 5.56x45mm), BR6 (three impacts, 7.62x51mm soft core ammunition), and BR7 (three impacts, 7.62x51mm hard core ammunition). Although EN 1063 does not specifically encompass 7.62x39mm (AK47) ammunition, most manufacturers of EN 1063 rated materials claim the EN 1063 BR5 level is effective for protection against 7.62x39mm soft core ammunition.

[13] ASTM F 1233 establishes test procedures for the evaluation of the resistance of security glazing materials and systems against several types of threats: ballistic impact, blunt tool impacts, sharp tool impacts, thermal stress, and chemical deterioration. For purposes as ballistic cover against military small arms, ideal material specifications under ASTM F 1233 would specify Class/Level R3 equating to successful ballistic testing against .308 Winchester (7.62mm, M80 Ball).

[14] The NIJ 0108.01 standard is applicable to all ballistic resistant materials (armor) intended to provide protection against gunfire. Optimal specifications for protection against military small arms would be Level III (7.62mm FMJ) and Level IV (7.62mm AP).

[15] Unified Facilities Criteria. Design to Resist Direct Fire Weapons Effects. UFC 4-023-07. U.S. Department of Defense. 7 July 2008. pp. 5-8. | AUTHOR’s NOTE: Construction specifications as described in the article text are for a ‘MEDIUM’ threat level (7.62mm NATO) as defined in UFC 4-023-07.

[16] Ibid.

[17] Ibid.

[18] Ibid.

[19] O’Malley, Kady, and Hannah Thibedeau. “Ottawa shooter’s movements tracked in security video as questions remain.” CBCnews. CBC/Radio Canada, 24 Oct. 2014. Web. 06 Mar. 2017. <>.