Safe Rooms and The Active Shooter Threat (Part I)

By Craig S. Gundry, PSP, cATO, CHS-III

Preceding Note

Few terms in the security industry and emergency management community evoke as many different definitions as the word “Safe Room.” For professionals in the executive protection community, this often means a room engineered to provide significant delay against intrusion by a committed adversary employing advanced tools and entry methods, ballistic protection, and equipped with fire protection and life safety systems, multiple modes of communications, supplies to sustain extended refuge, and similar features. For organizations such as FEMA, the term is often broadly applied to any room or indoor shelter area designed to protect occupants from a hazard (e.g, tornados, outdoor hazardous materials incidents, armed adversaries, outdoor IEDs, etc.). 

In S2’s Anti-Terrorism Officer (ATO) course and my work as a consultant over the past ten years, I also often applied this term with a broad definition when referencing different applications. However, I discovered that vague definition often caused confusion when describing criteria for “safe rooms” appropriate for use in different situations and levels of performance that can be achieved with specific design approaches. A few years ago I started standardizing my use of language to describe different types of safe refuge areas and clarify applicability of prescriptive measures. The terminology I now use is as follows:

    • Safe Room – Room specifically designated and/or designed to provide protection of occupants against armed adversaries.
    • Bomb Shelter Area – Indoor location designated and/or designed to provide protection of occupants against outdoor explosive threats (e.g., suspected VBIEDs, etc.)
    • Shelter-In-Place Room – Indoor room designated and/or designed to minimize air exchange during outdoor airborne hazardous materials events (e.g., toxic industrial chemical accident, vapor or aerosol CB attack, radiological attack, etc.)
    • Severe Weather Shelter Area – Indoor location designated and/or designed to provide protection of building occupants during outdoor weather emergencies (e.g., tornados, hurricanes, sudden severe storms, etc.)

The importance of clear terminology is more than simply a matter of semantics. As a consultant, I spend considerable time reviewing emergency action plans for clients. I frequently encounter plans that universally use the term “safe room” or “shelter area” for multiple types of emergency situations without careful consideration for the unique requirements of each different application. Quite often shelter areas appropriate for use during severe weather are not optimal (or even minimally suitable) for use during outdoor hazardous materials events, and so on.

Many US Government publications provide a starting point in establishing design criteria for safe refuge areas for specific situations. Some of these manuals include FEMA 543, FEMA 428, FEMA P-361, FEMA P-431, UFC 4-023-10, UFC 4-024-01, UFC 4-010-03, and EPA-400/R-17/001.[i][ii][iii][iv][v][vi][vii][viii] Although these manuals provide quite a bit of useful information, the measures they prescribe in some cases are limited in depth or outside the practical reach of many private organizations (and many government clients I have worked with internationally too). For most organizations outside the well-funded US Government community, compromises are often necessary that reconcile risk reduction goals with real world budget and operational constraints. 

In this upcoming series of articles, I will describe my approach to this problem and survey different levels of protection, risk considerations, design rationale, and specifications to achieve different optional levels of performance. 

The first article in this series focuses on safe rooms for use in providing building occupants with protection during armed intrusion events (e.g., active shooter events, terrorist armed assaults, etc.). The design strategies and physical security principles outlined in this article are applicable to all facilities concerned about active shooter attacks including government and commercial office buildings, schools, hotels, community centers, etc. In upcoming articles I will address practical considerations for planning and designing refuge areas for other types of emergency events.

Due to the length of the articles, we will be dividing each article into parts and separate posts. 

Safe Rooms and The Active Shooter Threat

Most organizations concerned about active shooter attacks have adopted the US Department of Homeland Security’s Run-Hide-Fight doctrine or variations promoted by the U.K. and other governments (Run-Hide-Report) as the basis for designing facility emergency action plans and training employees. This simplified response guidance is designed to be regarded as a prioritized list of preferred protective responses when an active shooter attack is recognized. “Run,” for instance, should always be the first option when the opportunity is present. If “Run” is not possible, then “Hide” is the next prioritized option. 

Although “Run” is generally the most preferred response, there are circumstances where “Hide” may be a necessary default action owing to the impracticality of rapidly evacuating a group of people unable to take actions for their own personal safety such as kindergarten students or nursing home residents. Additionally, there are many situations where attempting escape may be more dangerous than simply remaining in place. A good example is a multi-story building when an attack is launched at ground level. Rarely during attacks do people in the “hot zone” have accurate and real-time knowledge of the attacker’s location and safe routes of escape. In this situation, trying to evacuate through lower levels of the building where possible massacre is in progress may be far more dangerous than barricading in a nearby safe location. 

In recent years, DHS has modified its presentation of active shooter education with more detailed guidance about circumstances that warrant a preferred response. Although “Run-Hide-Fight” is easy for the public to remember, the simplified terminology used in the original DHS awareness campaign could result in unsafe actions in some cases. “Hide,” for instance, is vague and implies no other essential protection than concealment. In our seminars and employee training programs, we use the term “Barricade” which we believe describes the recommended action more clearly. Simply put, hiding should never be regarded as a safe action unless the location provides adequate protection against forced intrusion.

Implementation of active shooter response actions should be supported by effective facility infrastructure, physical security, and life safety design. One of the most basic facility preparations is ensuring adequate availability of safe rooms for people to take refuge if escape is not feasible. For this purpose, safe rooms should be identified or designed capable of providing adequate delay against forced entry considering the methods and tools likely to be employed by attackers and, if risk-justified and cost-feasible, ballistic protection against gunfire through walls, glazing, and doors.

So how much delay is necessary for a safe room to be considered “safe?”

The U.S. Department of Defense’s Unified Facilities Criteria UFC 4-023-10 answers this simply: “For the Forced Entry tactic, specify the required protection time based on the response time of the security forces determined in security forces evaluation in addition to the DBT [Design Basis Threat] and the LOP [Level of Protection].”[ix]

Simply stated, a safe room should delay an adversary from forced entry into the room long enough to allow the response force to intervene and neutralize the adversary. The necessary delay time being determined by the response force time and the methods and tools likely to be used by the adversary in penetrating the room.

From the perspective of performance-based physical security design, this is the correct answer and should be the ideal objective. However, implementing this approach properly requires first having a reliable and accurate response force time. If the facility does not have an armed response force on-site, establishing an effective delay time specification based on the expected response times of off-site police or government security forces can be quite difficult. Unless we have a reliable base of reference data from previous and similar emergency dispatches in the local area, the best guidelines we have for estimating response times for off-site police and government security forces may be derived from research studies of previous active shooter attacks:

    • In an FBI-published analysis of 51 active shooter events in the US between 2000 and 2012 where data on response times was available, police response times ranged between 0-15 minutes with a median response time of 3 minutes.[x] However, this analysis does not necessarily describe the true Effective Response Time. I define Effective Response Time as the total time from commencement of the attack and subsequent emergency notification to the time that the security or police forces located and neutralized the perpetrator. For example, at Sandy Hook Elementary School, police officers arrived on scene at 09:37 (~2.5 minutes after the first 911 call and only 3-4 minutes after Adam Lanza opened fire). However, officers did not tactically clear the building and arrive at Lanza’s location until 09:44 (~4 minutes after Lanza committed suicide).[xi] In many incidents we’ve case studied over the past several years, the police dispatch and arrival times aligned with the findings of the FBI analysis, but there was at least an additional 2-5 minutes of time before officers made entry and located the attacker.
Previous Active Shooter Events Timelines
    • As part of the incident data collection process during Purdue University’s 2014 Mitigating Active Shooter Impact study, researchers collected information about response times related to 24 school shootings and 41 workplace shootings in the United States. The report describes: “The fastest police response time noted in these events was 5 to 6 minutes, with most taking much longer.”[xii]

Based on information from these two studies, a safe room delay time goal in the United States with realistic expectation of off-site police intervention would be between 5 and 10 minutes.

A more cautious approach would also consider the possibility of an event escalating into a siege by police upon arrival and thus further delayed intervention. In 2015, Critical Intervention Services conducted a short study of 20 terrorist active shooter/MTFA attacks with the intention of creating an empirical and research supported justification for establishing Design Basis Threat (DBT) capabilities.[xiii] Although the sample size was small, the results did yield some useful points to consider.

In the CIS study, 35% of all attacks escalated into a siege by police/security forces upon arrival. In a number of these incidents, intervention was delayed due to early confusion about the event (“hostage situation” versus “armed massacre”). Some events resulted in a siege when arriving police or security forces were overwhelmed by the adversary’s firepower and withdrew pending the arrival of more assistance. In other events, police and security forces made committed entry, but the size of the facility and movement of the attackers inside the building delayed location and neutralization of the adversaries (e.g., 2013 Washington Navy Yard, etc.).

Incidents documented in the CIS study that escalated into a siege had a duration ranging between 2h 24m and est. 96 hours, with a mean duration of 21h 44m. Although most events resulting in siege durations over 2 hours were in Africa or West Asia, recent incidents have occurred in Western countries with effective response times over 2 hours such as the 2016 Pulse Nightclub shooting (194 minutes from first call to 911) and Bataclan Theater (~156 minutes from first call to 112).[xiv][xv][xvi]

Adversary Behavior and Capabilities: Adopting a rational and research supported approach to threat definition

The delay time provided by safe room barriers (e.g., doors, locks, glazing, etc.) is directly related to the tools and methods adversaries use to breach our barriers. Of the sample set assessed during our 2015 study of terrorist armed attacks, in none of the events documented did adversaries arrive equipped with tools (other than firearms) for the specific purpose of penetrating barriers. In case research conducted by CIS about other armed attacks against facilities over the past 20 years, the number of incidents where adversaries brought tools specifically for forced entry purposes was few. In the majority of attacks, forced entry was facilitated exclusively by blunt object impact (e.g., kicking, beating with rifle butt stock, etc.) and sometimes aided by bullet penetration or cutting with a bladed weapon.

Another issue worth considering is adversary effort and commitment to attack people located inside locked rooms. As described previously, optimal safe room designs specify delay time objectives based on the expected effective response time of police or on-site security forces. However, in some situations, simply providing enough delay to frustrate adversary attempts to gain entry may be a justifiable and practical compromise. Joseph Smith and Daniel Renfroe describe their observations on this matter in an article on the World Building Design Guide web site: Analysis of footage from actual active shooter events have shown that the shooter will likely not spend significant time trying to get through a particular door if it is locked or blocked. Rather, they move to their next target. They know law enforcement is on its way and that time is limited. [xvii]

Separate case research conducted by Critical Intervention Services also supports Smith and Renfroe’s perspective. In a large percentage of attacks, adversaries focus solely on targets of easiest opportunity by using visually-obvious pathways and unlocked/unobstructed portals (e.g., doors, windows, etc) to facilitate indoor movement. This behavior may be due to perceived time pressure (“kill as many as possible before the police arrive”) or possibly diminished problem-solving ability resulting from activation of the Sympathetic Nervous System (SNS). In most documented attacks where adversaries committed effort to forcibly enter locked rooms, intervention by police or security forces was delayed and adversaries had exhausted all targets in accessible areas. 

An effective DBT or ‘Threat Definition’ for physical security design purposes should also consider the number of potential adversaries and likely weapons. The number of attackers has a direct relationship to the potential effectiveness of our expected response force (Probability of Neutralization) and may also influence the likelihood of adversaries forcibly entering secured rooms to locate targets. Many documented incidents where attackers forcibly entered locked rooms to seek targets involved more than one perpetrator.[xviii] Weaponry also influences the potential effectiveness of our response force, and caliber and type of ammunition determines the effectiveness of safe room barriers in resisting ballistic penetration.

In the United States, the spectrum of active shooter adversaries has historically been diverse with most attacks committed by non-ideologically motivated perpetrators in alignment with Dr. Park Dietz’s definition of a “pseudocommando.”[xix] The overwhelming majority of these attacks to date have been executed by a single attacker withstanding a handful of notable exceptions (e.g., 1998 Westside Middle School, 1999 Columbine High School, 2011 South Jamaica House Party, and 2012 Tulsa).[xx] Additionally, most terrorist-related armed attacks in the United States to date also involved only one perpetrator with exceptions including the 2015 San Bernardino and 2015 Curtis Culwell Center attacks. According to FBI statistics, handguns were the most powerful firearm used in most attacks (59%) with rifles constituting 26% of incidents.[xxi] Although the FBI has not published statistics on weapon calibers used in domestic active shooter attacks, most mass casualty attacks where rifles were employed in the U.S. involved 5.56mm weapons with examples including assaults at the Pulse Nightclub (2016), Inland Regional Center (2015), Sandy Hook Elementary School (2013), and Aurora Century 16 Theater (2012).

Regional trends in adversary characteristics vary greatly in different parts of the world. In locations where terrorist attacks are more frequent than non-ideological targeted violence, the number of perpetrators in attacks is often higher and 7.62x39mm weapons (AK-47) have been most common. According to the Critical Intervention Services 2015 MTFA study, 1-2 perpetrators was most common in terrorist firearms attacks in Europe with notable exceptions being events such as the 13 November Paris attacks.[xxii] In Africa, by contrast, terrorist groups such as Al-Shabaab frequently use teams of 4-9 attackers in assaults on civilian locations such as the Westgate Shopping Mall (2013), Garissa University (2015), and numerous hotels in Mogadishu.[xxiii] Al-Shahbab’s modus operandi has often been quite advanced and often employs disguise, distraction, or IEDs to breach outer protective layers of target facilities.

By considering the historical characteristics of adversaries and event dynamics as demonstrated in previous attacks, we can develop a threat definition for safe room design purposes that is rational and justifiable. Following are some examples of reasonable threat definitions appropriate in different circumstances based on historical adversary modus operandi.

By considering the historical characteristics of adversaries and event dynamics as demonstrated in previous attacks, we can develop a threat definition for safe room design purposes that is rational and justifiable. Following are some examples of reasonable threat definitions appropriate in different circumstances based on historical adversary modus operandi.

Share on facebook
Share on twitter
Share on linkedin
Share on email

Copyright © 2017 by Craig S. Gundry, PSP, cATO, CHS-III

CIS consultants offer a range of services to assist organizations in managing risks of active shooter violence.  Contact us for more information.


[i] FEMA 453, Safe Rooms and Shelters: Protecting People Against Terrorist Attacks. FEMA, U.S. Department of Homeland Security, Washington, DC, 2006.

[ii] FEMA 428/BPIS-07, Primer to Design Safe School Projects in Case of Terrorist Attacks and School Shootings. U.S. Department of Homeland Security, Washington, DC, 2012.

[iii] FEMA P-361, Safe Rooms for Tornadoes and Hurricanes: Guidance for Community and Residential Safe Rooms. FEMA, U.S. Department of Homeland Security, Washington, DC, 2015.

[iv] FEMA P-431, Tornado Protection: Selecting Refuge Areas in Buildings. FEMA, U.S. Department of Homeland Security, N.p.: 2009.

[v] UFC 4-023-10, Safe Havens. US Department of Defense, N.p., 2010.

[vi] UFC 4-024-01, Security Engineering: Procedures For Designing Airborne Chemical, Biological, And Radiological Protection For Buildings, US Department of Defense, N.p., 2008.

[vii] UFC 4-010-03, Security Engineering: Physical Security Measures For High-Risk Personnel. US Department of Defense, N.p., 2011.

[viii] EPA-400/R-17/001, PAG Manual: Protective Action Guides and Planning Guidance for Radiological Incidents. U.S. Environmental Protection Agency, Washington, DC, 2017.

[ix] UFC 4-023-10, Safe Havens. US Department of Defense, N.p.: 2010. pp. 11.

[x] Blair, J. Pete, Martaindale, M. Hunter, and Nichols, Terry. “Active Shooter Events from 2002 to 2012.” FBI Law Enforcement Bulletin. Federal Bureau of Investigation, 1 July 2014, Accessed 22 Sept. 2017.

[xi] Report of the State’s Attorney for the Judicial District of Danbury on the Shootings at Sandy Hook Elementary School and 36 Yogananda Street, Newtown, Connecticut on December 14, 2012. Office Of The State’s Attorney Judicial District Of Danbury, Stephen J. Sedensky III, State’s Attorney, N.p., 25 November 2013

[xii] Anklam, Charles, Adam Kirby, Filipo Sharevski, and J. Eric Dietz. “Mitigating Active Shooter Impact: Analysis for Policy Options Based on Agent/computer-based Modeling.” Journal of Emergency Management 13.3 (2014): 201-16. Web.

[xiii] Gundry, Craig S. “Analysis of 20 Marauding Terrorist Firearm Attacks.” Preparing for Active Shooter Events. ASIS Europe 2017, 30 Mar. 2017, Milan, Italy. (Presentation included results of an unpublished 2015 study by Critical Intervention Services. As of August 2017, an improved study is underway addressing a wider spectrum of data points and larger sample set. The results of the new study (ASAD – Active Shooter Attack Dynamics Study) will be published when complete. For information about the ASAD Study, visit:

[xiv] Lotan, Gal Tziperman, Minshew, Charles, Lafferty, Mike, and Gibson, Andrew. “Orlando nightclub shooting timeline: Four hours of terror unfold.” Orlando Sentinel, 31 May 2017, Accessed 22 September 2017.

[xv] “What happened at the Bataclan?” BBC News, 9 December 2015, Accessed 22 September 2017.

[xvi] Aubourg, Lucie. “Terror in Paris: This Is What Happened at the Bataclan Concert Hall During the Paris Attacks.” Vice News, 25 November 2015, Accessed 22 September 2017.

[xvii] Smith, Joseph, and Daniel Renfroe. “Active Shooter: Is There a Role for Protective Design?” World Building Design Guide, National Institute of Building Sciences, 2 Aug. 2016, Accessed 22 Sept. 2017.

[xviii] Examples including the 2008 Taj Majal attack and a hotel in North Africa [details confidential].

[xix] Dietz, Park D. “Mass, Serial, and Sensational Homicides.” Bulletin of the New York Academy of Medicine.  62:49-91. 1986.

[xx] Blair, J. Pete, and Schweit, Katherine W. A Study of Active Shooter Incidents, 2000 – 2013. Texas State University and Federal Bureau of Investigation, U.S. Department of Justice, Washington D.C. 2014. pp. 7. PDF. (The 2011 South Jamaica and 2012 Tulsa shootings are specifically noted as the only events involving more than one attacker in the FBI’s study of U.S. domestic active shooter attacks between 2000 and 2013.)

[xxi] Blair, J. Pete, Martaindale, M. Hunter, and Nichols, Terry. “Active Shooter Events from 2002 to 2012.” FBI Law Enforcement Bulletin. Federal Bureau of Investigation, 1 July 2014, Accessed 22 Sept. 2017.

[xxii] Gundry, Craig S. “Analysis of 20 Marauding Terrorist Firearm Attacks.” Preparing for Active Shooter Events. ASIS Europe 2017, 30 Mar. 2017, Milan, Italy.

[xxiii] Gundry, Craig S. “Threat Assessment Methodology and Development of Design Basis Threats.” Assessing Terrorism Related Risk Workshop. S2 Safety & Intelligence Institute, 25 Apr. 2017, Brussels, Belgium.