The MetroWest Program: A Case Study in Proactive Public Safety

Map of MetroWest Orlando

The MetroWest Program: A Case Study in Proactive Public Safety

MetroWest is celebrating the seventh year of partnership with Critical Intervention Services (CIS), a Florida‐based security agency that specializes in enhancing public safety through its Safe Communities Programs.

The CIS Safe Communities Programs focus on two key principles to contribute to the overall public safety of the communities they help protect. First, CIS focuses on connecting with community stakeholders, residents, businesses, property managers, local law enforcement partners, and security providers. Second is the character of the officers hired, with the hiring process for Public Safety officers rivaling most law enforcement agencies by including intense screening/interviewing, testing, education and prior experience requirements.  

“Having officers with strong character is extremely important as our Public Safety Officers (PSO)  must establish trust with our community members,” said Shannon Bryson, MetroWest Public Safety Director. “MetroWest PSOs serve as community liaisons, building relationships with community members, businesses, the Orlando Police Department (OPD), and other law enforcement officials and entities.”

MetroWest Master Association General Manager Julie Sanchez became aware of CIS in 2013 when she was approached at a multi-family/community association management tradeshow.

“At first, I thought that CIS would be just another security provider vendor. Then I sat down with CIS to learn more about their community-based methodology and I realized that this was the partner MetroWest Master Association needed,” Sanchez said.

CIS was engaged by the MetroWest Master Association to take a deeper dive into the public safety issues MetroWest was experiencing. An 18-month study revealed the tremendous importance of community stakeholders – including law enforcement, local security, property managers, local businesses and residents – all working together for public safety. The study also showed a disconnect within the community with regard to the perception of crime versus the reality. During the 18 months of the study, CIS looked at  crime statistics for MetroWest specifically and engaged community members and stakeholders about their perceptions of crime in the community. The results showed that the perception of crime within MetroWest did not match the actual crime statics, letting CIS know this too would need to be addressed. 

As a result, the first of its kind in the country “Private Sector Led Public Safety Program” was born as part of the larger “Safe Communities Programs” that CIS focuses on throughout their operations. The program is based on the unique methodology of the Community and Character Based Protection Initiative (CCBPI), which focuses on establishing trust, building relationships and connections among community members. This unique methodology educates, allows and encourages community members and stakeholders to actively take a role in their own public safety.  

Building Relationships: The Key to Proactive Public Safety

MetroWest as a whole consist of 36 residential communities and more than 500 commercial businesses with more than 100 of those being retail. MetroWest Public Safety Officers travel within the communities and commercial areas on foot, bicycles, and in public safety vehicles to get to know community members, get them connected, and educate them about the Public Safety Program.

In 2019, MetroWest PSOs were involved in more than 22,000 community/business contacts within MetroWest, a clear indication that the program is unifying owners, businesses, managers and residents to promote the highest standards of public safety.

“Our Private Sector Led Public Safety Program is tailored to MetroWest’s specific needs and is based on establishing trust and building relationships and connections among community members,” said Bryson. “We have seen that creating and maintaining those community connections has strengthened the social capital of MetroWest.”


Proactive Public Safety Program Success

The success of the CIS Safe Communities Program is dramatically evident when comparing crime and resident turnover rates in the MetroWest area between 2013 (when the program started) and 2017:

      • 16 percent overall decrease in auto theft
      • 45.8 percent overall decrease in vandalism
      • 16.3 percent overall decrease in violent acts
      • 63.9 percent overall decrease in residential burglary
      • Residential property managers reported 95-98 percent occupancy rates and 65-70 percent renewals in 2017, with a 2-5 percent increase year-by-year of the program.

MetroWest Master Association and CIS, along with OPD, have also facilitated the process by which MetroWest communities can implement the principles of Crime Prevention through Environmental Design (CPTED) in order to achieve Crime Free Certification from OPD. Attaining Crime Free Certification is a three-phase process, requiring an eight-hour certification class, inspections by both the Orlando Police Department and Orlando Utilities Commission, and fulfilling Crime Prevention Through Environmental Design requirements.

In all, 11 MetroWest communities have received Crime Free Certification, with continued efforts to achieve the goal of all communities becoming Crime Free.

Since becoming the first community in the United States to adopt the CIS Private Sector Led Public Safety Program, MetroWest has built strong and effective partnerships with OPD, local residents, business owners and other community organizations, which have led to demonstrable positive results such as rental retention and increase rents and home values year over year.

“The MetroWest Public Safety Program is a cornerstone of our effort to make MetroWest a great place to Live, Work, Play and Connect,” said Sanchez. “We envision the continued success of our Public Safety Program because it has definitely proved since its conception that a connected community is a protected community.”

Simple tips for a safer community from MetroWest Public Safety:

    • Report! Your eyes and ears are value added to our public safety strategy.
    • Engage! Get to know your neighbors. If you look out for them, they are more likely to look out for you.
    • Be mindful! Unlocked homes and cars and open garages are an invitation for opportunistic criminals. Bicycles and valuable items left in yards can quickly disappear.
    • Think first! Do not confront or follow suspicious persons or individuals engaging in criminal activity. Call 911 or report the matter to the Orlando Police Department.
Share on facebook
Share on twitter
Share on linkedin
Share on email

We offer a range of services to assist communities in reducing crime and improving quality of life 

Learn more about the CIS Safe Communities Program and our proactive public safety strategies.

5 Common Issues Contributing to Premises Liability in Apartment Communities

Premises Liability and Apartment Communities

5 Common Issues Contributing to Premises Liability in Apartment Communities

When it comes to reducing premises liability in apartment communities and multi-family housing, an old adage provides best advice:

“An ounce of prevention is worth a pound of cure.”

Yet despite this wisdom, many in the apartment industry remain persistent targets of lawsuits with reliance on insurance and legal strategy as the main defense against premise liability.

Although these types of “consequence management measures” are a universal element of managing risk, we have witnessed numerous situations over the past few years where even the best legal defense did little to protect against multi-million dollar verdicts.

A Structured Approach to Reducing Premises Liability Risk in Apartment Communities and Multi-Family Housing

A more evolved strategy for reducing liability risk implements a structured approach to security and safety aimed at preventing lawsuits and establishing conditions that limit vulnerability in the courtroom. In addition to reducing liability, effective security can improve the quality of life for residents by reducing crime and improving the residents’ perception of safety. This has the added benefit of reducing resident turnover and increasing property values by reducing vandalism.

5 Common Security Negligence Issues Contributing to Premises Liability in Apartment Communities and Multi-Family Housing

As a security consultant, I work exclusively in aiding property owners and managers in reducing liability through effective security and safety. I do this by assessing properties for conditions of concern and presenting recommendations for security and environmental improvement and management practices which reduce crime and positively influence human behavior and resident perceptions.

Although every property I work with is unique, certain problems seem to be recurring themes during my assessment activities. For purposes of this article, I’ll narrow our focus to the five most common issues contributing to criminal confidence and social and physical disorder within residential properties.

1. Lighting


Ensuring that properties are well-illuminated is one of the most basic principles of natural surveillance in Crime Prevention Through Environmental Design (CPTED). A well-illuminated property:

      • Deters criminal activity by increasing the likelihood of a criminal being witnessed in the act.
      • Additionally, effective CCTV imaging requires adequate illumination to ensure proper documentation of persons and activity.
      • And beyond crime prevention, lighting is an important function of environmental safety and reduces the risk of nighttime accidents on property.

However, despite the importance of lighting and its potential influence on premise liability, this is a common issue in many of our property assessments.

To ensure lighting meets essential standards, it is recommended that a lighting assessment is conducted to systematically measure illumination levels in different locations using a light meter. Illuminance (the measure of how much the light illuminates a surface or area) is measured in foot-candles (FC) or lux. 1 FC is the amount of light that hits a 1 square foot surface when 1 lumen is shined from 1 foot away – which equates to 1 lumen per square foot.

Recommended Illumination Levels for Multi-Family Residential Properties

As consultants, we employ conservative CPTED guidelines and standards promoted by ASIS International as a basis for identifying locations with insufficient illumination. For instance:

CPTED & ASIS Illumination Guidelines

Although these guidelines are largely universal, many municipalities have lighting ordinances that may deviate from these guidelines and should be consulted as part of the assessment and design process.

Lighting Uniformity

Another important aspect of lighting is uniformity. Lighting uniformity affects our perception of the environment and our ability to safely navigate its features (e.g., walkways, stairs, etc.). Uniform lighting allows us to perceive the environment continuously and without sudden breaks caused by lighting level drops. Uniformity of lighting levels also impacts people’s perception of safety and security. Simply put, well-lit and uniformly illuminated areas make pedestrians feel more secure. A poorly lit parking lot, with severe variation (contrast) between peak and minimum illumination levels, feels darker, less secure, and may embolden criminal confidence.

To ensure uniformity, the type of light distribution pattern should be properly matched to the purpose. Following is a summary of light distribution patterns and recommended applications.

    • Type I distribution is a two-way lateral distribution having a preferred lateral width of 15 degrees in the cone of maximum candlepower and is great for lighting walkways, paths, and sidewalks. This type of lighting is meant to be placed near the center of the pathway. This provides adequate lighting for smaller pathways.
    • Type II light distributions have a preferred lateral width of 25 degrees and are used for wide walkways, on ramps and entrance roadways, as well as other long, narrow lighting. This type is meant for lighting larger areas and usually is located near the roadside. You’ll find this type of lighting mostly on smaller side streets or jogging paths.
    • Type III light distributions have a preferred lateral width of 40 degrees. This type has a wider illumination area if you make a direct comparison to type II LED distribution, and is meant for general roadway lighting, parking areas and other areas where a larger area of lighting is required.
    • Type IV distributions produce a semicircular light meant for mounting on the sides of buildings and walls. It’s best for illuminating the perimeter of parking areas and businesses. The intensity of the Type IV lighting has the same intensity at angles from 90 degrees to 270 degrees.

Modern LED light sources allow LED luminaires to more evenly dissipate light over large areas than HID (High-Intensity Discharge) light sources. Because LED lighting can more evenly illuminate an area, the space appears brighter and feels more secure. Replacing HID lighting with LED systems is a common recommendation in my reports. LED lighting also has excellent color rendition, meaning that light reflecting off the surface of objects displays the color more accurately. This makes it easier to accurately identify the color of a vehicle or the clothes an offender is wearing.

One of the most common issues I encounter during my assessments is insufficient illumination in places designated for human activity (e.g., sidewalks, playgrounds, parking lots, picnic areas, breezeways, mailboxes, residential building entrances, etc.). This is predominantly caused by the following issues:

    • Existing lights obstructed by trees, shrubbery, dirt, or insects.
Premises Liability and Apartment - Light Obstruction
    • Non-functional lights (e.g., burned-out light bulbs, damaged photocells, malfunctioning or incorrect ballasts, etc.)
Premises Liability and Apartment - Broken Lights
    • Incorrect usage of light types. For example, converting to LED lighting without properly retrofitting the fixture.
    • Insufficient illumination sources.
    • Incorrect light distribution types.
    • Light glare due to lack of shielding.
Premises Liability and Apartment - Glare Lighting

To assist clients in remedying lighting problems, we typically conclude our assessments by preparing a detailed lighting map identifying all luminaires on the property, the type of light fixtures in use, problematic lights, and metered illumination levels in locations so that problematic areas are clearly recognized. Specific recommendations for improvement are then submitted in the main body of the assessment report.

Lighting Map

2. CCTV / Cameras

Poorly designed and/or maintained CCTV systems are another common problem in residential properties. Common issues include:

    • Obstructed cameras
    • Improper positioning of cameras
    • Limited DVR storage
    • Insufficient illumination to support effective use of cameras
    • Malfunctioning or inoperative cameras

To address these problems, we recommend that property managers conduct a weekly camera inspection to ensure cameras are functioning properly and identify developing problems such as overgrown vegetation, etc. The inspection should ideally be conducted during nighttime since the cameras often appear to perform well during daytime, but may suffer under nighttime lighting conditions due to things like cobwebs, obstructions, and malfunctioning infrared illuminators.

Premises Liability and Apartment - CCTV Problems

We also commonly recommend using motion sensors for lights illuminating interior spaces under camera surveillance (e.g., clubhouses, fitness rooms, etc.). Lights activated by motion sensors can alert people when other individuals are present nearby, limit offender concealment, and provide indoor cameras with good illumination.

3. Landscaping

Landscaping design and maintenance also play an important role in crime prevention. As a symbolic barrier, landscaping can mark the transition between “zones,” define the property boundary, and discourage casual trespass. Landscaping can also serve as a barrier against committed intrusion when dense hedges or aggressive shrubbery are used.

When conducting assessments, I often encounter obstructed cameras and lights due to overgrown shrubbery, untrimmed trees, and other landscaping features. Overgrown shrubbery and untrimmed trees also provide an opportunity for offender concealment and embolden criminal confidence by restricting natural surveillance between residential units, parking lots and other areas designated for human activity. Overgrown shrubbery and untrimmed trees can result in liability issues.

A common recommendation in my reports is implementing a CPTED principle called the 2-feet/6-feet rule. Bushes and hedges are not to be taller than 2 feet, and tree canopies are not to be lower than 6-feet near areas designated for human activity. This approach ensures that visibility between three and six feet from the ground will always be relatively unimpaired.

CPTED Landscaping

4. Documenting crime, community rule violations, and nuisance activities

Reducing social disorder and evicting problematic residents is another critical aspect of crime prevention in multi-family housing. This includes ensuring we have good documentation of crimes on a property, community rule violations, and nuisance activities in preparation for potential eviction. In many properties I assess, it is just a handful of bad apples amongst the resident population which are responsible for many crimes on property and community perceptions of fear. Left unaddressed, this situation can lead to higher resident turnover rates, lower occupancy rates, property damage, and liability issues.

Documenting on hardcopy solely can lead to loss of documentation in case of fire, flooding, etc. so it is important to store your documentation in your property management software for example.

5. Security officers

Security officers are the property manager’s eyes and ears when the property manager is not on site. And if used correctly, it can function as a deterrent to crime and improve resident perceptions of safety.

Unfortunately, very few properties I assess effectively use security officers. Sometimes this problem results from security officers with inadequate training and skills. At other times, the property manager fails to define the officers’ duties and expectations for performance.

When contracting a security company or a courtesy officer for the property, the expectations and duties of officers should be clearly established. These expectations should be ideally defined in a ‘scope of work’ to the contract, or in the form of post orders for the property.

Security officers assigned to patrol the property need to be aware of locations where criminal or nuisance activity is common, and any units or residents of concern. Proper documentation by security officers in the form of a daily activity report increases the property manager’s awareness of activities occurring when the property staff is absent. The property manager can correspondingly take action to make the property a safer place.

Share on facebook
Share on twitter
Share on linkedin
Share on email

Anti-Personnel Barrier Materials and Construction

Anti-Personnel Barrier Materials and Construction

The following article is  provided as a design guide and technical reference to assist architects and security professionals in specifying new construction and/or evaluating the vulnerability of present barriers in situations aimed at reducing active shooter risk.

Table of Contents


Barriers Materials and Construction


Partition Design

Ideally, walls defining protective layers (e.g., secure lobbies, safe rooms, etc.) should be designed as full partitions extending floor-to-ceiling to minimize opportunity for easy access through drop ceilings. In high-risk situations or design applications where the intervention of security or police forces is expectedly delayed, full partition walls should be a basic requirement.

In low-risk applications and situations where the primary design objective is to simply frustrate adversary access, drop ceilings may be a justifiable compromise. As described in Part One of this article, armed attackers most often use visually-obvious portals (e.g., doors and windows) as their main pathways for movement. Although entry through drop ceilings is certainly possible, our research has not revealed any active shooter attacks to date where drop ceilings were exploited as a means of accessing people located in locked rooms.

Intrusion Resistance of Walls

In alignment with the principles of balanced protection, walls should ideally resist forced intrusion with similar delay times as doors, locks, and windows. In many commercial and academic facilities, walls protecting rooms commonly designated for use as safe rooms (e.g., offices, conference rooms, classrooms, etc.) are often secured by little more than two layers of gypsum board on wooden studs. Some sources suggest two-layered drywall partitions can be penetrated in 60 seconds by an adversary without use of equipment and 30 seconds with the assistance of hand tools.[1] Despite the poor performance of gypsum board walls, they may be a justifiable compromise in some situations, considering the rare frequency of active shooter attacks where walls have been used as a point of entry into locked rooms. In low-risk applications or situations where budget limits retrofit options, we rarely recommend replacement or upgrade of existing drywall.

In medium-high risk applications and safe room designs with delay time objectives over 45 seconds, walls should be constructed using intrusion-resistant materials. Some options for protective wall construction include reinforced concrete, filled masonry block, expanded metal mesh, and polycarbonate-composite wall panels.

Reinforced concrete walls provide the best delay time performance against adversaries using limited toolsets. According to tests documented by Sandia, 4-inches of reinforced concrete with No. 5 rebar on 6-inch centers will provide approximately 4.7 minutes of delay against penetration with hand tools (including saw).[2] If our threat definition is an adversary relying solely on firearm penetration and blunt object impact, reinforced concrete of any dimensions will provide almost indefinite delay.

Contrary to what many assume, unfilled concrete masonry unit (CMU) block walls provide minimal delay against forced entry and only slightly better performance than drywall against some methods of penetration. According to data published in the Barrier Technology Handbook, the mean delay time for penetrating an unfilled CMU block wall is only 36 seconds by the use of a sledgehammer.[3] Unfilled CMU block walls are also susceptible to damage by rifle projectiles and may crumble when struck repeatedly by gunfire.[4] For better performance in delaying forced entry, CMU block walls should be fully grouted and reinforced with rebar. According to tests documented by Sandia, filled 8-inch CMU walls with No. 5 rebar on 14-inch centers provide approximately 1.4 minutes of delay against penetration with hand tools.[5]

Supplementing exterior drywall layers with a securely attached inner layer of expanded metal mesh is one of the most common methods of retrofitting existing walls for improved resistance against forced entry. Expanded steel constructed of 9-gauge 3/4-inch diamond mesh is a common material specification for this purpose. In this type of wall design, the expanded metal mesh is installed on the inside of the protected room and secured to wall studs by using deep screws and fasteners specially designed for this purpose. The expanded metal barrier layer is then overlaid with gypsum board or plywood. According to Sandia, a wall constructed of two layers of 3/4-inch plywood, two layers of gypsum board, and an expanded metal mesh interlayer can provide as much as 6.5 minutes of delay against penetration with hand tools.[6] Despite the popularity of 9-gauge material as a safe room design specification, money can often be saved by using a lighter mesh without compromising performance. If the threat definition is an adversary equipped solely with a firearm, static and dynamic impact force will be the main mechanisms of penetration, and overall strength of the fastening system will be more important than thickness of the metal fabric.

Several manufacturers currently offer polycarbonate composite wall panel products marketed for security applications. Most products of this type are composed of a thin polycarbonate layer (0.08-0.125 inch) bonded to gypsum or cement board. Manufacturers of polycarbonate composite wall systems are generally cautious about describing the capabilities of these products. Most manufacturers only cite single-impact static force tests up to 3,200 ft-lbf. When addressing impact resistance, one manufacturer cites testing under ASTM D2394-83. However, ASTM D2394 relates to the performance of finish flooring against abrasion, friction, and indentation and offers no insight on protective value. Although the concept of these products is very appealing, their use in performance-based protective design is discouraged in the absence of more reliable and promising test data.

Ballistic Resistance of Walls

One of the best references for specifying construction of bullet-resistant walls is U.S. DoD UFC 4-023-07 (Design to Resist Direct Fire Weapon Effects). [7] According to UFC 4-023-07, walls constructed of 4-inches reinforced concrete, 8-inch filled CMU block (grouted full), and 8-inches of brick will resist penetration by 7.62x51mm ammunition.[8] UFC 4-023-07 also provides ballistic resistance specifications for steel plate barriers. However, at the thicknesses specified by DoD, steel is not a practical option in most indoor design situations due to structural load and construction challenges. 

A number of manufacturers also produce fiberglass wall panels rated for ballistic resistance under UL 752, ASTM F1233-08, and EN 1063.[9][10][11] Minimum specifications for protection against military small arms (5.56mm) would be UL 752 Level 7, F1233 R1, or EN 1063 BR5. More conservative specifications for 7.62x51mm include UL 752 Level 8, F1233 R3, and EN 1063 BR6.

In addition to fiberglass panels, Saab’s Barracuda Soft Armor offers an easy method for upgrading hollow walls into bullet-resistant barriers. The Barracuda Soft Armor is designed as 13mm ceramic balls used as infilling between wall boards. Thickness of the armor-filled wall cavity determines its ballistic resistance capabilities. According to Saab’s product literature, 100mm of Barracuda pellets is the technically-estimated specification for protection against 7.62mm FMJ projectiles and 120mm of Barracuda armor has been technically-verified as ~99% effective in resisting 7.62mm armor piercing ammunition.[12] Although Saab does not cite tested ratings according to UL 752 or EN 1063, 125mm Barracuda armor has been certified as STANAG 4569 Level 3 (7.62x54R and 7.62x51AP).[13]


If the risk level and design approach requires door systems rated for tested delay times, doors certified under SD-STD-01.01, ASTM F3038-14, CPNI MFES, LPS 1175 have been tested against a variety of forced entry methods and often exceed requirements for protection during short-duration armed events. If the threat definition identifies an adversary solely employing firearms and expedient tools, any door certified under SD-STD-01.01, ASTM F3038-14, CPNI MFES, or LPS 1175 will likely far exceed performance as suggested by its certified delay time rating.

Considering the cost of security doors and the number of rooms often desired for availability as safe rooms during armed attacks, many organizations do not have the budget or risk justification required for implementing security doors rated under forced entry standards. In this situation, specification may require choosing commercial door hardware with security features adequate to accomplish the design objective or retrofitting existing doors with cost-consciously selected upgrades for maximum benefit.

Intrusion Resistance of Doors

As a general rule, outward-swinging doors provide the best protection against exterior ramming force due to resistance of the rebate within the frame. Additionally, adversaries attempting to pull open locked outward-swinging doors without the aid of tools are at a great mechanical disadvantage. If rooms earmarked as potential safe rooms feature existing inward-swinging doors, door hardware (e.g., locks, strikes, and frames) should be carefully specified to ensure adequate resistance against ramming force.

Most security doors certified under forced entry standards are constructed of steel. However, indoor rooms potentially earmarked for use as safe rooms in office and academic facilities are often equipped with solid core wood or solid wooden doors. Solid core doors are constructed with a composite wood core and overlaid with hardwood veneer for aesthetic appearance. The times required to penetrate solid core and solid wooden doors using methods likely to be encountered during active shooter attacks has never been published. Considering the materials involved, solid wooden doors are preferable to solid core doors. Nevertheless, for application against a gunman employing impact force without additional tools, solid door leafs (regardless of construction) are unlikely to be the point of failure when compared to the potential vulnerability of locks, strikes, wooden frames, and vision panels.

Doors featuring glass vision panels are often highly vulnerable to forced entry. Tempered safety glass panels only provide about 10 seconds of delay against a gunman. Once broken, the intruder can simply reach through the window and manipulate the inner door handle or lock to gain entry. To limit this vulnerability, vision panels should be no wider than 1.5″ (3.8 cm) or constructed of intrusion-resistant glazing such as laminated glass, polycarbonate, or reinforced with anti-shatter film. If the delay time objective exceeds a few minutes, vision panels should be avoided completely. Although there are door sets rated under LPS 1175 and ASTM forced entry standards which feature vision panels, it is generally impractical to upgrade or replace vision panels on commercial doors to sufficiently achieve more than a few minutes of delay.

In situations where performance objectives exceed 15 minutes of delay or adversaries are expected to possess a diverse toolset, security hinges should be installed on safe room doors to reduce the risk of hinge pin removal or cutting. Security hinges with dog bolts can also aid in reducing vulnerability to some tool-aided methods of entry. All door frames on safe rooms (regardless of application) should be constructed of steel.

If the budget and risk level justify installation of doors rated under security standards, specifications for a basic level of forced entry resistance include EN 1627 RC4+ and LPS 1175 SR2+. For higher levels of protection, specifications using ASTM 3038, SD-STD-01.01, and CPNI MFES provide a more reliable basis for delay time performance.

Ballistic Resistance of Doors

Although the author is not aware of any comprehensive published ballistic tests of common commercial door products, it is safe to assume most commercial steel, wooden, and solid core doors are vulnerable to penetration by military small arms. If safe room design objectives require ballistic protection, doors rated UL 752 level 7+ or EN 1522 FB5+ should be specified. Additionally, all doors rated under SD-STD-01.01 have been tested against penetration by 5.56mm, 7.62x51mm, and 12-gauge shotgun.


 Simplified Locking

As a prerequisite criterion, all mechanical locks on safe room doors should feature thumbturns for ease of locking under stress. In several previous active shooter attacks, critical doors on rooms where people were seeking refuge remained unlocked during the event owing to absence of a key.[14] Additionally, good preparation for active shooter events should anticipate the effects of the Sympathetic Nervous System (SNS) on employee response. During high stress events, the SNS is often activated with impairing effects on cognitive function and fine motor coordination. These negative effects of the SNS can interfere with even simple tasks such as locating and manipulating keys.

Ironically, considering the history of active shooter attacks in American schools, locks classified by ANSI as “classroom function” (mortise F05 and bored F84) are perhaps the worst choice for safe room applications and should be avoided when possible. Classroom function locks are only lockable by a key from the outer side of the door. Not only do these locks require a key, but they also require the occupant to open the door and reach into the hallway to secure the lock.

 Intrusion Resistance of Locks

For protection against entry by buttstock impact and kicking, all lever and knob sets on safe room doors should ideally be rated ANSI/BHMA A156 Grade 1 or have a minimum Security Grade of 4 under EN 12209.[15][16] Mechanical locks rated ANSI/BHMA Grade 1 and EN 12209 Security Grade 4+ have been successfully evaluated under a variety of static force and torque tests.

If the design objective is to simply frustrate access by non-committed adversaries, doors secured only by ANSI/BHMA Grade 1 or EN 12209 Security Grade 4+ latch locksets may be sufficient. However, if the design objective is to delay penetration by a committed adversary or the threat definition includes a diverse range of entry tools, locksets should feature a deadbolt or augmented by the installation of an independent deadbolt lock. In medium security applications, single-point deadbolt locks are often adequate. In situations where greater delay times are required or adversaries are expected to employ improved toolsets for entry, multi-point deadbolt systems provide the best protection.

Surface-mounted deadbolt locks are generally superior to mortise and bored locks in resisting forced entry. Surface-mounted deadbolt locks can incorporate bolts unconstrained by the thickness of doors and require the adversary to entirely penetrate the door leaf to access the lock.[17] Surface-mounted deadbolt systems are also less vulnerable to prying due to the increased force necessary to lever the entire door frame.

Many surface-mounted deadbolt systems designed for high security applications feature auto-bolting locks. Auto-bolting systems lock automatically when the door is closed and often disengage automatically when the inside handle is operated for exit. Manually-bolted surface-mounted deadbolts require a manual unlocking operation to permit exit. Building and life safety codes should be reviewed to ensure permissibility before installing manually-bolted surface-mounted locks. Although some jurisdictions prohibit use of manually-bolted locks on school classroom doors, manually-bolted surface-mounted deadbolts are fully permissible in most locations except when installed on egress doors. This generally addresses most concerns regarding upgrading offices, conference rooms, and similar locations as safe rooms. Under International Building Code 2012, surface-mounted deadbolts are also permissible on egress doors in certain circumstances. For instance, IBC 1008.1.9.4 (Bolt Locks) contains a rule exception for use of surface-mounted deadbolt locks on egress doors with occupant loads of less than 50 persons in Group B (Business Group), F (Factory), and S (Storage) occupancies.[18]

Ballistic Resistance of Locks

Another issue to consider in safe room design is the vulnerability of door hardware to ballistic damage. Although forced entry by ballistic attack against locks and hinges has been rare during active shooter events, a number of incidents have occurred where adversaries forcibly entered/or attempted to penetrate rooms by destroying door locks with gunfire.[19]

The only product certification standard that specifically addresses door locks as a component of ballistic testing is the U.S. Department of State’s SD-STD-01.01.[20] Withstanding a handful of exceptions, most lock manufacturers do not subject standard products to ballistic testing in accordance with protocols such as UL 752 and EN 1522.

Furthermore, Sandia National Laboratories and similar research institutions have not published empirical test data to assist in estimating the ballistic vulnerability of locks commonly used in academic and commercial facilities. In the absence of definitive references, perhaps one of the best sources we have for estimating the performance of common door locks against firearm-aided penetration is the television program MythBusters Special 9 “Shootin’ Locks.”[21] Although the sample size tested by MythBusters was very small, the results of testing suggest that bored deadbolt locks are resistant to single-shot penetration by handgun calibers (9mm and .357 magnum) and vulnerable to defeat by high powered rifle (.30-06 cal.) and 12-ga. shotgun slugs. U.S. Army field manual FM 3-21 also states that a shotgun is effective at defeating door locks.[22] Regarding rifle calibers, FM 3-21 somewhat conflicts with the Mythbusters findings by stating that 5.56mm and 7.62mm “have proved to be virtually ineffective for breaching.”[23] From these limited sources, it’s reasonable to assume most locks will be resistant to critical damage by handguns, definitely vulnerable to shotguns, and susceptible to some rifle calibers (albeit, inconclusive as to exactly which rifle calibers and ammunition).

The best approach to this concern is specification of door sets rated under SD-STD-01.01. An alternative option is employing independent door and lock assemblies rated UL 752 level 7+ or EN 1522 FB5+. Surelock McGill, for example, offers a number of lock assemblies and cylinder guards rated EN 1522 up to level FB7.[24]

For organizations without the budget and/or risk justification to equip safe rooms with door sets rated under ballistic resistance standards, the next best option is installing surface-mounted deadbolt locks on the inside of solid wooden or steel doors. Although most solid wooden and steel pedestrian doors are vulnerable to penetration by small arms, the door material will provide some reduction in bullet velocity and conceal location of the lock to reduce hit probability. Augmenting existing locks with bullet-resistant cylinder guards certified under UL 752 and/or EN 1522 is another possible enhancement. Conventional steel wrap-around door knob plates are not bullet-resistant, but may offer a marginal benefit by reducing projectile velocity. Additionally, bored locks may be preferred to mortise locks due to their smaller target size. As an additional concern regarding mortise locksets, wooden doors may critically weaken when struck repeatedly by gunfire in the location of the mortise pocket due to the thin layers of wood in this area.

Electrified Locks and Access Control Design

If a facility is employing/or planning to use electrified locks on potential safe room doors, careful consideration should be used in configuration of the access control system and hardware specification. Although access control systems offer great versatility in security design, they often suffer from vulnerabilities in real world application, which can be problematic during active shooter attacks.

In many buildings the author has assessed over the past several years, facilities were designed as large workspaces with few offices, storage rooms, or conference rooms suitable for use as safe rooms. In some of these facilities, permissions were broadly granted to employees through the facility’s access control system to allow convenient access to conference rooms and shared offices. During an attack by an insider adversary, doors with broadly applied access privileges will not provide useful protection. Likewise, if the access control system in the facility employs card readers and an outsider adversary recovers an access badge from a fallen employee, all doors with universal access will be compromised.

Another common problem relates to the fail-safe/secure configuration of electrified locking systems. Building and life safety codes universally require that egress doors equipped with electromagnetic locks ‘fail safe’ (unlocked) during fire alarms.[25] Although safe room doors in most situations will not be classified as egress doors, the author has discovered a number of facilities during his consulting activity where all access-controlled doors were universally configured to fail safe due to poor system design. In this situation, all fire alarm pull stations in the facility are ‘virtual master keys’ and would compromise most doors if someone activated a pull handle. This is a very real concern. In a number of previous attacks, fire alarms were manually activated by building occupants to alert others (e.g., 2013 Washington Navy Yard) or used by adversaries to deceptively herd victims outdoors for ambush (e.g., 1998 Westside Middle School, 2013 UCF, 2015 North Africa Hotel, etc.).[26][27]

In addition to fire alarms, electromagnetic locks without emergency power support fail safe automatically during electrical failures. Electromagnetic locks also fail safe by virtue of basic function if electrical lines are damaged (such as during an IED attack). Doors employing mechanical locksets and electric strikes configured to fail secure during power disruption are less vulnerable to compromise by electrical failure and fire alarms, but may be more vulnerable to forced entry than doors solely equipped with mechanical locks. Consequentially, CPNI in the United Kingdom specifically discourages use of electric strike plates on security doors.[28]

 If designated safe rooms are already equipped with electrified locks, all aforementioned concerns can be mitigated by installing independent mechanical deadbolt locks for emergency use.


 As a general rule, window and door glazing should be avoided in high risk situations or applications where designers seek ambitious delay goals. Although there are glazing products capable of high delay times, such systems are quite expensive by comparison to the price of wall construction and doors. In low-medium risk applications and situations where glazing is an unavoidable element of architectural aesthetics, windows should be designed to adequately resist intrusion. As described in part one of this article, adversaries most often focus penetration efforts on visually-obvious portals, and windows are often perceived as a vulnerable point for entry. Consequentially, the performance of glazing should be a top priority and may even exceed the importance of delay provided by barriers along less obvious intrusion paths such as walls, floors, and ceilings. 

Window Dimensions (Unprotected Glass Windows)

In accordance with U.S. DoD recommendations, all unprotected windows on safe rooms should be 96 in2 (619 cm2) or smaller.[29] In addition the U.S. DoD guideline, we recommend that any unprotected glass windows or vision panels within arm’s reach (approx. 36″ or 91.5 cm) of door handles and locks have a width of no more than 1.5″ (3.8 cm).

Intrusion Resistance of Windows and Glazing

If window dimensions do not conform to the aforementioned guidelines, glass should be replaced or upgraded with intrusion-resistant materials. Tempered safety glass is generally only 4-5 times resistant to impact as annealed glass and provides minimal delay against forced intrusion. According to testing documented by Sandia, 0.25 inch tempered glass provides 3-9 seconds of delay against an intruder using a fire axe and the mean delay time for penetrating 1/8″ tempered glass with a hammer is 0.5 minutes.[30] Furthermore, impact testing documented by Sandia did not account for the fragility of tempered glass after first being penetrated by firearm projectile. In penetration tests Critical Intervention Services conducted of 1/4-inch tempered glass windows using several shots from a 9mm handgun prior to impact by hand, delay time was only 10 seconds.[31]

Some intrusion-resistant glazing options appropriate in low-medium risk applications include laminated glass, polycarbonate, and glass reinforced with properly attached anti-shatter film.

Laminated glass is a composite material constructed of two or more layers of glass bonded to a PVB or polycarbonate interlayer. According to Sandia’s test data, 1/4-inch laminated glass provides 18-54 seconds of delay against forced entry by fire axe and the mean delay time for penetrating 9/16-inch laminated security glass is approximately 1.5 minutes by hand tools.[32][33] Most glazing products tested and rated under forced entry standards UL 972 and EN 356 are constructed of laminated glass.

Polycarbonate is another option for intrusion-resistant windows. At thinner dimensions, polycarbonate provides decent impact resistance but comparable performance to tempered glass against fire axe attacks.[34] Polycarbonate truly distinguishes its benefit at thicknesses of 1/2-inch or greater. According to tests documented by the Nuclear Security Systems Directorate, 1/2-inch polycarbonate can delay hand tool penetration for up to two minutes.[35] Sandia cites 2-6 minutes of delay for penetration of polycarbonate by fire axe and sledgehammer.[36] Polycarbonate is relatively inexpensive and can be purchased as sheets and cut to dimensions as needed. The main disadvantages of polycarbonate are its limited resistance to scratch damage and susceptibility to discoloration and degradation from UV exposure.[37] Some tests also suggest polycarbonate may be vulnerable to fragmentation and shatter critically when penetrated by 12-gauge shotgun.[38]

In low risk situations or circumstances where budget does not permit replacing existing glazing, anti-shatter film properly attached and anchored to tempered or annealed glass may be a cost-effective alternative. Regretfully, Sandia never published data on the penetration times of film-reinforced glazing. In 2015, CIS participated in a series of tests of 1/4-inch tempered glass windows with mechanically-attached 11 mil window film. The tests involved penetration by firearm followed by impact (kicking and rifle buttstock). The delay times ranged from 62 to 94 seconds and deviated according to the aggression of our penetration tester.[39] Although the sample size was small, the CIS test times at least provide a reasonable expectation for performance of window film during active shooter attacks. If anti-shatter film is chosen as an upgrade, specifications should require mechanical or cement bond frame attachment.

To facilitate performance in safe room designs with delay time goals over 60 seconds, it is recommended that designers use glazing products rated for intrusion resistance under ASTM F1233-08, EN 356, and EN 1627. If the threat definition identifies firearm penetration and buttstock impact as the primary methods of entry, reasonable specifications include ASTM F1233-08 Class 2+ Body Passage, EN 356 P6B+, and EN 1627 RC4+. UL 972 is another option, but in the author’s opinion should only be specified in low-medium risk applications. See Part 4 of this series for a survey of window protection standards and their relevant merits and disadvantages in safe room design.

Ballistic Resistance and Windows

For ballistic resistance, specifications for protection against military small arms include EN 1063 BR5-BR7, UL 752 Level 7-9, and ASTM F1233-08 R1-R4AP.

Ceilings and Floors

Although penetration through ceilings or floors is possible, such paths of entry are least likely considering typical construction characteristics and adversary behavior as witnessed during previous armed attacks. However, in high risk design applications, floors and ceilings should provide balanced protection according to the safe room’s specified delay time objectives. For this purpose, Sandia’s Barrier Technology Handbook provides a good survey of penetration times for a wide range of ceiling and floor construction variations.[40]


[1] Hypothetical Facility Exercise Data. Hypothetical Atomic Research Institute (HARI). The Twenty-Sixth Annual Training Course. U.S. Department of Energy. N.p. N.d. pp. 48.

[2] Barrier Technology Handbook, SAND77-0777. Sandia Laboratories, 1978. pp. 4.2-6

[3] Ibid. pp. 4.5-2

[4] The vulnerability of unfilled concrete block walls to penetration and potential failure by gunfire is well demonstrated by numerous “backyard test” videos posted on YouTube. Most videos posted on YouTube display the vulnerability of stacked block walls without mortar. Finished walls will likely be more resistant to critical failure. Example:

[5] Barrier Technology Handbook, SAND77-0777. Sandia Laboratories, 1978. pp. 4.5-2

[6] Ibid. pp. 4.9-1,2

[7] UFC 4-023-07, Design To Resist Direct Fire Weapons Effects. US Department of Defense, N.p.: 2008.

[8] Ibid. pp 5-8

[9] UL 752, Standard for Bullet-Resisting Equipment. UL, N.p.: 2005.

[10] ASTM F1233-08, Standard Test Method for Security Glazing Materials And Systems. ASTM International, West Conshohocken, PA, 2013

[11] EN 1063:2000, Glass in building – Security glazing – Testing and classification of resistance against bullet attack. European Committee for Standardization, Brussels, 2000.

[12] Saab Barracuda Soft Armour. (Product Brochure). Saab Barracuda AB. N.p. N.d.

[13] Ibid.

[14] One example is the December 2017 shooting at Aztec High School. Matthews, Justin. “Substitute unable to lock doors during shooting.” KOAT Action News. 9 December 2017. Accessed 17 December 2017.

[15] ANSI/BHMA A156.13, Mortise Locks and Latches. Builders Hardware Manufacturers Association (BHMA), New York, NY, 2011.

[16] EN 12209, Building hardware – locks and latches – mechanically operated locks, latches and locking plates. European Committee for Standardization, Brussels, 2016.

[17] Door Security. A Guide to Security Doorsets and Associated Locking Hardware. Centre for Protection of National Infrastructure. N.p. June 2013. pp. 20

[18] 2012 International Building Code. Chapter 10 (Means of Egress). International Code Council. N.p. 2012.

[19] Examples include the 2013 shooting at the Santa Monica College Library and a 2015 attack against a hotel in North Africa (details confidential).

[20] SD-STD-01.01, Revision G. Certification Standard. Forced Entry and Ballistic Resistance of Structural Systems. U.S. Department of State, Bureau of Diplomatic Security, Washington, DC, 1993.

[21] MythBusters Special 9. Mega-Movie Myths 2-Hour Special. MythBusters. 2006.

[22] FM 3-21.8, The Infantry Rifle Platoon and Squad. Headquarters Department of the Army. Washington, DC. 28 March 2007. pp. F-20

[23] Ibid.

[24] High performance door solutions. NASL-017. (Product Catalog). Surelock McGill. N.p. 2017.

[25] 2012 International Building Code. Chapter 10 (Means of Egress). International Code Council. N.p. 2012.

[26] After Action Report. Washington Navy Yard. September 16, 2013. Internal Review of the Metropolitan Police Department. Metropolitan Police Department. Washington, D.C. July 2014. pp.14

[27] Harms, A.G. UCF After-Action Review. Tower #1 Shooting Incident. March 18, 2013. Final Report. N.p. May 31, 2013. pp. AAR-14

[28] Door Security. A Guide to Security Doorsets and Associated Locking Hardware. Centre for Protection of National Infrastructure. N.p. June 2013. pp. 27

[29] UFC 4-023-10, Safe Havens. US Department of Defense, N.p., 2010. pp. 42

[30] Barrier Technology Handbook, SAND77-0777. Sandia Laboratories, 1978. pp. 16.3-39

[31] Critical Intervention Services assisted window film manufacturer Solar Gard Saint-Gobain in 2015 in conducting a series of timed penetration tests of unprotected tempered glass windows and glazing reinforced with anti-shatter film. The author personally supervised and witnessed these tests.

[32] Barrier Technology Handbook, SAND77-0777. Sandia Laboratories, 1978.

[33] Garcia, Mary Lynn. Design and Evaluation of Physical Protection Systems. Burlington, MA: Elsevier Butterworth-Heinemann, 2007.

[34] Barrier Technology Handbook, SAND77-0777. Sandia Laboratories, 1978.

[35] Garcia, Mary Lynn. Design and Evaluation of Physical Protection Systems. Burlington, MA: Elsevier Butterworth-Heinemann, 2007.

[36] Barrier Technology Handbook, SAND77-0777. Sandia Laboratories, 1978.

[37] Tjandraatmadja, G.F., and Burn, L.S.  “The Effects of Ultraviolet Radiation on Polycarbonate Glazing. Durability of Building Materials and Components.” Institute for Research in Construction, Ottawa, ON. pp. 884-898

[38] Hutson, Bill. Hut’s Ballistic Tests.

[39] Results of original tests conducted by Critical Intervention Services in cooperation with window film manufacturer Solar Gard.

[40] Barrier Technology Handbook, SAND77-0777. Sandia Laboratories, 1978. pp. 16.3-27-16.3-32

Share on facebook
Share on twitter
Share on linkedin
Share on email

Egress Design and The Active Shooter Threat (Pt. 10)

Egress Design and The Active Shooter Threat (Pt. 10)

Egress planning is often regarded as a life safety matter with influence on security, but otherwise a discipline independent from physical protection. However, when preparing facilities for active shooter violence, egress design should be approached as an integral component of our protective strategy.

As discussed in earlier articles in this series, security measures and facility preparations should be carefully designed to augment and anticipate the actions of building occupants. For people located at ground level during an attack or in building locations without safe refuge options, escape (what DHS calls ‘Run’) is the preferred response. To effectively facilitate this response, escape routes should be readily available that permit fast and unobstructed egress to safe outdoor locations away from the facility.

Although all buildings are required to comply with life safety codes related to emergency egress, International Building Code (IBC), NFPA 101, International Fire Code (IFC), and municipal codes often fall short in considering the unique dynamics of evacuation during armed events. Historically, these codes were designed with fire as the focus and don’t fully account for issues such as severe impairment of evacuees due to sympathetic nervous system (SNS) activation, the unpredictable actions of mobile attackers, and lack of situational awareness that may render multiple exit routes unsafe or at least perceived by evacuees as potentially-dangerous.

Many facilities rely on the advice of fire marshals and the results of inspection reports as a measure of readiness. Candidly speaking, this is a major concern. Aside from the inadequacy of current regulations, I often find violations of existing code during my work as a consultant that have somehow survived years of inspection.

So let’s take a walk beyond IBC and NFPA and explore considerations for designing an egress plan optimized to support response actions during active shooter events.

Egress Routes

To ensure building occupants have options for escape regardless of an attacker’s location, alternate egress routes should exist from all normally-occupied areas providing versatile access to safe exits. In most situations, providing two or more alternate egress paths from each occupied area (routed in different directions) is sufficient.

In newly-constructed buildings, identifying alternate egress paths isn’t usually difficult. In facilities constructed before modern building code, options are often limited. 

During the 2008 assault on the Leopold Café in Mumbai, approximately 30 people were eating dinner in a narrow corridor of booths located on the second level when the attack commenced.[1] There was only a single stairwell and no room on the second floor capable of safe refuge. Fortunately for those on the second floor, the terrorists were satisfied after killing ten people and wounding numerous others and never noticed the unlocked door discreetly leading upstairs.

The Bataclan Theater in Paris, attacked by Islamic State terrorists in 2015, was another example of a building with limited escape options. At the time of the attack, there were three exits accessible to the public. One was the main entrance on Boulevard Voltaire and two emergency exits which discharged into an alley on the south-side of the building.[2] With the main entrance blocked by the terrorists’ presence, people located on the dance floor and north-side of the building had no way to escape without passing the attackers’ aim.

Bataclan Theater Exits

Installing new exits is the obvious solution to this problem. However, in situations where there are no options due to adjacent buildings (such as the Bataclan Theater) or similar circumstances, consider upgrading or constructing rooms for safe refuge purposes. As an additional measure, explore options for providing unconventional routes of escape as described later in this article.

The capacity of exits is another matter to consider. In situations where it is predictable that attackers will approach from a specific direction, expect a panicked reaction as everyone seeks to escape away from the gunman’s location. When faced with an imminent threat, people instinctively flee the direction of harm. Now if there are few people in the area, this type of reaction usually poses no special problems. But locations where this concern arises are often highly-populated and confined areas with limited exit options.

As discussed in Part 6 of this series, many armed attacks by outsider adversaries originate through public entrance doors and shooting commences immediately. This behavior has been very consistent in attacks against public buildings such as nightclubs, churches, and museums. In this situation, the natural reaction of people is to flee toward the opposite side of the room often resulting in tripping, trampling, and a bottleneck near whatever exit doors are present.

In some cases, the presence of furniture and other obstructions prohibit many from even reaching the exits. This situation has been especially common in attacks against church sanctuaries where the location of pews often block people from quickly reaching exits in the front of the room.

Church Attack Infographic Diagram

If this concern is foreseen during the initial design phase, solutions are often easy and don’t require major investment. For those with existing buildings, remedy often involves some expense.

If dangerous congestion is predicted at single-door exits, consider enlarging the present exits with the use of double-doors. If enlargement is insufficient or the situation prohibits modifying existing exits, consider installing new exits as illustrated in the following example.

Upgrading Church Sanctuary for Active Shooters

In some cases, the situation can be eased by simply working with what’s available. In several buildings we’ve assessed with this concern, locked doors were present in areas where congestion was predicted providing access to service corridors or private hallways. By unlocking these doors and equipping them with appropriate hardware, we can provide an additional route of escape and ease congestion at the existing exits. However, implementing this solution may require other measures to address new concerns about public access into previously secured areas.

As a final point about escape paths, egress routes should be intuitive and simple to navigate under high-stress conditions. Several years ago I conducted an assessment of a community center building during the final phase of a major renovation. Unfortunately, most construction was nearly finished before we had a chance to offer useful comment. One of my greatest concerns in this situation was the addition of a new building level (earmarked for after-school programs) featuring two stairwells that discharged one level below into a second-floor hallway. After exiting to the second floor, evacuees were required to proceed down the hall to access a different stairwell in order to reach the first-floor exits. Despite the approval of local authorities, this type of complex egress path should be firmly avoided in active shooter planning. In the absence of any alternatives, our advice was to build a robust safe room in the kids’ area with sufficient capacity and train staff that lockdown is their only safe response during an attack.

Exit Signage

Exit signage should be clearly visible inside all work areas and hallways and direct evacuees to the most accessible stairwells or discharge doors. These are obvious points, but this subject is a common problem in many facilities. Where I encounter this issue most frequently is in renovated buildings that have changed their original room configuration or created expansive workspaces with cubicle walls. When facilities reconfigure walls and don’t update exit signage correspondingly, the result is often chaos—Signage directing evacuees to dead ends or locked doors, signage leading into areas with no further direction, locations where no signage is visible, etc.

Exit Signage Problems

Another problem, albeit less common, are situations where signage was incorrect from the beginning. Some time ago, I encountered a facility where the exit signage plan was similar to a puzzle game. Most arrows directed me in a circuitous loop around the outside of the floor and nowhere near the exit stairwells (which were positioned in interior hallways). Realizing I was walking in a circle, I followed alternate directional arrows and found myself at a dead end elevator landing with no nearby exits. Bear in mind, we’ve been conducting assessments of this type for years. If I can’t find my way out of a building, it’s likely a deathtrap during an active shooter attack.

If a building is configured with tall cubicle arrangements or corridors constructed of glass walls, consider placing directional signage on the floor if overhead visibility is a problem. In facilities like this, ceiling-mounted exit signage is often difficult to locate due to obstruction or the hall-of-mirrors type atmosphere often created in narrow corridors lined by glass. In these cases, providing additional signage on floors is often effective.

Emergency Stairwells

Exit stairwells should be well illuminated and clear of obstructions. Although these points are universally mandated under building and fire codes, this is another common area of concern.

On the subject of stairwell lighting, IBC permits illumination levels of 1 fc (10.8 Lux) and NFPA dictates 10 fc (108 Lux).[3] [4] Regardless of your location and regulatory mandates, I strongly recommend adopting the NFPA specification of 10 fc (108 Lux) as a minimum guideline. Over the years, I have assessed a number of facilities (particularly in Europe and the Middle East) where stairwell illumination was so poor I needed to use a flashlight to safely navigate the stairs.

Obstruction is another common problem. In the absence of adequate storage rooms, many facilities resort to stairwell landings as convenient spaces for overflow.

Egress Obstructions at Exit Doors

The location of stairwells is another issue to consider. In armed attacks against multi-floor buildings, the ground-level is often where the attack originates and may be a dangerous location while an event is active. If building occupants are not aware of the exact location of the threat, the combined effects of fear and lack of situational awareness may make people hesitant to evacuate if they need to navigate through interior hallways to access exits. This issue is often compounded further by the effects of the SNS on problem-solving ability.

To address these concerns, emergency stairwells should ideally discharge directly outdoors through exit doors at ground-level. Stairwells that discharge into lobbies or central hallways should be strictly avoided. If a facility has stairwells that discharge into potentially hazardous areas, employees should be warned of which stairwells to avoid as part of their active shooter training.

Stairwell Escape During Active Shooter Events

If an exit stairwell has multiple doors at ground-level, signage should be clearly visible indicating the proper door for discharge. Although this is not a common problem, I occasionally encounter situations where there are multiple doors at the base of a stairwell and no clear indication of which is the proper exit door. In this situation, choosing the wrong door may be a fateful decision.

Another matter to consider is the possibility of stairwells being used by attackers in navigating the building. During attacks inside multi-level structures, adversaries frequently use stairwells to move between levels.  A few examples include attacks at the Virginia Beach Municipal Center (2019), Corinthia Hotel Tripoli (2015), and Washington Navy Yard (2013).[5]

Addressing this concern raises several challenges.

First, it is often cost-prohibitive to install CCTV cameras in stairwells in a manner suitable for tracking movement between floors (and especially in high rise structures). So if we have a control room employing CCTV to monitor the progress of attackers, stairwells are often a blind spot. Second, although IBC permits interior stairwell doors to be locked against entry from the stairwell side, code requires that interior stairwell doors are “capable of being unlocked simultaneously without unlatching upon a signal from the fire command center…[or] signal by emergency personnel from a single location inside the main entrance…” [6] NFPA regulations are different in detail, but the same concern is present. As discussed further in this article, the fail-safe operation of electrified locks is a major concern during active shooter attacks.

To address the possibility of adversaries navigating floors by stairwell, it may be permissible in some locations to install barriers inside existing stairwells featuring secured egress doors and exit bar devices to restrict upward movement. The photo below is an example of this type of barrier using wire mesh and an acrylic panel to prevent manipulation of the door handle. Although I like this approach in concept, code requirements should be carefully assessed before implementing this type of measure.

Stairwell Cage Barrier

If the Design Basis Threat is an outsider adversary and placing barriers inside stairwells is permissible, I recommend installing them between ground-level and the next higher floor. This recommendation is based on the fact that most attacks by outsiders initiate at ground-level. In the case of buildings with interior public staircases providing access to second or third levels (such as a hotel with a mezzanine), the placement of stairwell barriers should be adjusted accordingly.

Exit Doors

Exit doors should be clearly visible and identified by overhead signage. Although this is not a common issue of concern, situations occasionally arise where architects have visually concealed the exit doors to create a unified aesthetic appearance. Following is an image illustrating this concern provided by Lori Greene, Manager of Codes & Resources at iDigHardware (Allegion).

Avoid the use of electromagnetic locks on egress doors!

Although mag locks offer versatile benefit in access control design, they present several problems during active shooter attacks. First, building and life safety codes universally require that egress doors equipped with mag locks fail safe (unlocked) during fire alarms. In this situation, every alarm pull station inside the building is a ‘virtual master key’ and will compromise all doors equipped with mag locks with one pull of a handle.[7] We have had multiple attacks where fire alarms were manually activated by building occupants (e.g., 2013 Washington Navy Yard), activated by smoke or dust (e.g., 2018 Marjory Stoneman Douglas HS, 2008 Taj Mahal Hotel Mumbai, etc.), or used by attackers to deceptively herd victims outdoors for ambush (e.g., 1998 Westside Middle School, 2013 UCF, 2015 Corinthia Hotel Tripoli, etc.).[8] [9] [10]

In addition to fire alarms, mag locks also fail safe if electricity is disrupted for any reason such as an extended power outage or if lines are damaged during an explosion. This is a particular concern in situations where the Design Basis Threat includes terrorists employing body-worn IEDs.

As an added concern, electromagnetic locks require door-mounted exit hardware (e.g., switch, lever, etc.) or alternatively, an exit sensor to unlock egress doors when an alarm is not activated. In many facilities I encounter, solitary wall-mounted push-to-exit (PTE) switches are used for this purpose despite code requirements stipulating door-mounted hardware or exit sensors. Furthermore, PTE switches used for this purpose are often small in size and easily overlooked when people are trying to escape under high stress conditions. Poor placement of PTE switches compounds this problem even further. During assessments, I often find PTE switches mounted away from doors in a manner that requires evacuees to stop and scan the area for a switch.

As a tragic example of this concern, in the 2019 shooting at the Al Noor mosque in Christchurch, 17 people were killed while trapped at an exit door operated by a PTE switch. [11] It is unclear from news reports whether the door failed to open because of an electrical problem or if there was difficulty by evacuees in locating and operating the PTE switch.

Exit sensors for mag locks often pose a different problem. If an exit sensor is placed above doors in a high traffic area, every time someone passes the sensor the door is unlocked. I’ve encountered many facilities where intrusion was as simple as waiting outside a door for a few minutes and listening for a click.

An even greater concern is when facilities opt not to install PTE switches or exit sensors on doors as a means of restricting use for fire evacuation only. The image below displays a bank of controlled exit doors at the entrance of an expo hall. To direct patrons to a nearby revolving door, the facility management decided (in violation of code) not to install PTE switches or exit sensors. When I inquired about this matter, I was assured that the fire alarm and/or control room operator would disengage the doors during an emergency. Nevertheless, if the operator is disabled or delayed in responding to an attack, the consequences of mass evacuation through this area would be tragic.

For access control purposes, we generally recommend using electrified panic bar devices or electric strikes with mechanical hardware. During an evacuation, electrified exit bar devices operate identically to mechanical exit bars—push the bar and the door opens. Aside from ease of operation, doors equipped with electrified exit bars and electric strikes can remain secured during power disruption and fire alarms (withstanding stairwell doors and other situations as defined by code).  

As a final point about access control, avoid the use of delayed egress on exit doors. Many facilities employ egress delays (15-seconds or 30-seconds) as a means of discouraging occupants from exiting through doors reserved for emergency purposes. Although egress delays are often useful for channeling occupants to designated exits, any measure which delays escape during an attack increases the risk of avoidable casualties.

The following video illustrates how long 30 seconds is while standing at an exit door during an active shooter attack.

Unconventional Exit Options

When normally discussing the topic of egress, ground-level exit doors are presumed to be the main points of building discharge. However, during active shooter events, there are often many opportunities for escape that don’t meet the standards of fire code.

For people located on higher building levels, it is often safer to escape upward toward the roof than downward through stairwells. During the 2015 Charlie Hebdo attack, employees of a company located on the third floor above the Charlie Hebdo office sought safety on the rooftop due to concern about gunfire penetrating their office. In the 2004 attack at the Oasis Compound in Saudi Arabia, two people hid on a roof for two days before rescue. Several employees at Washington Navy Yard’s Building 197 also took refuge on a roof rather than risk harm below.[12]

As part of active shooter training, advise employees about the availability of the roof as a safe area. And if the roof is presently locked, consider placing an escape key near all rooftop doors specifically for use during an active shooter event. If safety concerns override the decision to place escape keys near doors, consider installing electrified locks on the rooftop doors that can be released through a lockdown event macro programmed in the building’s access control software.

Roof Top Escape Key

During an attack, any window less than three stories or aperture large enough to crawl is a potential route of escape. In the 2007 shooting at Virginia Tech’s Norris Hall, students in Room 204 escaped by jumping out the second story windows of their classroom.[13] During the 2016 siege at the Pulse nightclub, eight people escaped through an air conditioning vent with police assistance. In the 2013 attack at the Westgate Shopping Mall, people in a restaurant also escaped by crawling through an air vent.

Window Escape During Active Shooter Attacks

If our present building has windows and other unconventional escape opportunities, make note of these options and advise employees during active shooter training. Simply mentioning the examples already cited in this article calls attention to the possibilities and provides a point of reference if employees ever find themselves trapped during an attack.

Now if we are working with an existing structure, it usually doesn’t make sense from a cost-benefit perspective to install new windows or make other building alterations specifically to facilitate unconventional modes of escape. An exception to this might be situations like the Bataclan Theater (described earlier in this article) where the absence of exits is a major concern and there are no options for remedy.

When designing new facilities, consider placing windows in select locations where it is likely people will be trapped during an attack. One example is public restrooms. Although public restrooms rarely feature door locks, they are commonly used by people seeking refuge during active shooter attacks. If we anticipate this problem and the restroom is adjacent to an exterior wall at ground level, install a 24” tall horizontal sliding window just below the ceiling to provide anyone trapped in the restroom with a possible means of escape. If this had been done at the Pulse nightclub, thirteen people might be alive today.[14]

[1] Details provided by a confidential source during the author’s visit to the Leopold Café in 2016.

[2] Details confirmed during the author’s visit to the Bataclan Theater in 2018.

[3] 2015 International Building Code. Chapter 10 (Means of Egress). International Code Council. N.p. 2015.

[4] NFPA 101 (1)

[5] After Action Report. Washington Navy Yard. September 16, 2013. Internal Review of the Metropolitan Police Department. Metropolitan Police Department. Washington, D.C. July 2014.

[6] 2015 International Building Code. Chapter 10 (Means of Egress). International Code Council. N.p. 2015.

[7] As a caveat to that statement, NFPA 101 states that the pull stations don’t have to unlock the doors: The activation of manual fire alarm boxes that activate the building fire-protective signaling system specified in shall not be required to unlock the door leaves. (Comment by Lori Greene, iDigHardware)

[8] Initial Report Submitted to the Governor, Speaker of the House of Representatives and Senate President. Marjory Stoneman Douglas High School Public Safety Commission. January 2, 2019.

[9] After Action Report. Washington Navy Yard. September 16, 2013. Internal Review of the Metropolitan Police Department. Metropolitan Police Department. Washington, D.C. July 2014.

[10] Harms, A.G. UCF After-Action Review. Tower #1 Shooting Incident. March 18, 2013. Final Report. N.p. May 31, 2013.

[11] “’It doesn’t open’: Christchurch mosque survivors describe terror at the door” Stuff. March 28, 2019, Accessed 25 March 2020.

[12] After Action Report. Washington Navy Yard. September 16, 2013. Internal Review of the Metropolitan Police Department. Metropolitan Police Department. Washington, D.C. July 2014.

[13] Mass Shootings at Virginia Tech. April 16, 2007. Report of the Review Panel. Virginia Tech Review Panel. August 2007.

[14] Harris, Alex. “New details emerge about where the victims of the Pulse massacre died.” Miami Herald. June 14, 2017, Accessed 13 March 2020.

Share on facebook
Share on twitter
Share on linkedin
Share on email

Design Basis Threat and The Active Shooter (Pt. 2)

Design Basis Threat and The Active Shooter (Pt. 2)

Who exactly are we trying to protect ourselves against when we use the term “active shooter?”

For many, the answer to this question seems obvious—a “bad guy” killing people at random with a gun. However, this type of vague definition provides little guidance for developing an effective security design. A more useful definition considers:

    • How many adversaries would possibly be involved in an attack?
    • What is their level of skill?
    • What types of weapons would they bear?
    • What tools and methods of entry would they employ?
    • Would the attacker(s) likely be an insider, outsider, or potentially either?
    • Has the adversary employed any unique modus operandi in previous attacks?

Although many aspects of active shooter preparation are universal, these types of details have a major influence on the performance of our protective design and the benefit of system components (e.g., anti-personnel barriers, ballistic protection, etc.). Additionally, if our budget is limited, the answers to these questions can often guide us in prioritizing vulnerabilities of greatest concern.

As a security consultant, I’m frequently called on to assess facilities that have already invested in protective upgrades. In these situations, I frequently find examples of overlooked vulnerabilities, overconfidence in protective measures, or wasted expenditure. And these problems often stem from failing to define the attacker’s likely capabilities and methods as a driving factor in the original security design.

In professional approaches to security planning, this is the role of the Design Basis Threat (DBT) or Threat Definition. A DBT (or Threat Definition) provides a description of an adversary’s likely capabilities and tactics essential for determining the expected performance of security measures and identifying attack scenarios that should be addressed in security design.

Considerations for Developing a Design Basis Threat

Number of Attackers

The number of adversaries has a direct relationship to the potential effectiveness of our response force (i.e., Probability of Neutralization) and may influence the behavior of adversaries during attacks. One practical example is the likelihood of adversaries forcibly entering secured rooms to locate targets. Many documented incidents where adversaries forcibly entered locked rooms to seek targets involved more than one perpetrator.[1]

In the United States, the spectrum of active shooter adversaries has historically been quite diverse with most attacks committed by non-ideologically motivated perpetrators in alignment with Dr. Park Dietz’s definition of a pseudocommando.[2] The majority of these attacks are executed by a single attacker withstanding a handful of notable exceptions (e.g., 1998 Westside Middle School, 1999 Columbine High School, 2011 South Jamaica House Party, and 2012 Tulsa[3]). Historically, most terrorist-related active shooter attacks in the United States also involved only one perpetrator with exceptions including the 2015 San Bernardino and 2015 Curtis Culwell Center attacks.

Regional trends in adversary characteristics vary greatly in different parts of the world. In locations where terrorist attacks are the predominant concern, the number of perpetrators in attacks is often higher. In a study of 20 Marauding Terrorist Firearms Attacks (MTFA) conducted by the Critical Intervention Services in 2015, 1-2 perpetrators was most common in active shooter assaults in Europe with notable exceptions being events such as the 13 November Paris attacks.[4] In Africa, by contrast, terrorist groups such as Al-Shabaab frequently use teams of 4-9 attackers in assaults on civilian locations such as the Westgate Shopping Mall (2013), Garissa University (2015), and numerous hotels in Mogadishu.[5]

Relationship to the Facility/Organization

Is the adversary possibly an “insider” (e.g., current student, employee, etc.)? Or do the characteristics of our organization and environmental circumstances likely limit our concern to “outsider” adversaries? The answers to these questions often determine the relevance and priority of protective measures.

For instance, if the adversary is most likely an outsider, protective measures associated with perimeters, building facades, and entry controls are a high priority. By contrast, if the probable adversary is an insider, it is often wise to focus on indoor protective measures if the budget is a limiting concern. 

In school settings, the probable type of adversary is largely influenced by the age of students. Withstanding a handful of plots, shooting events in primary schools have been executed by adult-aged outsiders (e.g., 2017 North Park Elementary School, 2012 Sandy Hook, 2006 West Nickel Mines, etc.) and a handful of expelled students (e.g., 2016 Townville Elementary School). In secondary schools, the spectrum of perpetrators is more diverse including both current and former students, and to a lesser degree, adult-aged outsiders.

In closed workplace settings, the majority of mass shootings are committed by current or former employees (e.g., 2020 Molson Coors, 2019 Henry Pratt Co., 2019 Virginia Beach Municipal Center, etc.). Although less common than employee-related shootings, there have also been cases of nonemployees (outsiders) targeting businesses for reasons of personal or ideological grievance such as the 2018 shooting at YouTube headquarters and the 2015 Charlie Hebdo attack.

In attacks against houses of worship and ethnic cultural centers, outsider adversaries motivated by ideology or reasons of personal grievance have been most common. Some recent examples include attacks at the Poway Synagogue (2018), Tree of Life Synagogue (2018), First Baptist Church (2017), Burnette Chapel Church of Christ (2017), Emanuel AME Church (2015), and Overland Park Jewish Center (2014).

Outsiders have also been the dominant category of adversary in attacks against public entertainment venues such as nightclubs, theaters, entertainment districts, and festivals. In many of these situations, the venue is targeted due to mass casualty potential or the characteristics of its patrons. Examples in recent years include attacks at the Nels Peppers Bar (2019), Gilroy Garlic Festival (2019), Borderline Bar and Grill (2018), Jacksonville Landing (2018), Route 91 Harvest Festival (2017), Reina nightclub (2017), and Pulse nightclub (2016). Although most attacks in entertainment facilities are premeditated, there have also been cases of disputes among patrons escalating into mass violence such as the 2017 shootings at the Power Ultra Lounge and Cameo nightclub.

In situations where terrorism is the primary concern, outsider adversaries should be the first priority. Although there have been attacks executed by radicalized employees (e.g., 2019 Naval Air Station Pensacola, 2015 Inland Regional Center, 2009 Fort Hood, etc.), the overwhelming majority of terrorist armed assaults are executed by outsiders.

Entry Tools and Methods

 The delay time value of barriers (e.g., doors, locks, glazing, etc.) is directly related to the tools and methods adversaries may use to breach our barriers. Attacker tools and entry methods was one of the issues the CIS MTFA study team examined with the aim of creating a research-supported justification for defining threat capabilities.[6] Of the attacks assessed as part the study, in none of the events did attackers arrive equipped with tools (other than firearms) for the specific purpose of penetrating barriers. In case research conducted by CIS about other armed attacks against facilities over the past 20 years, the number of incidents where adversaries brought tools specifically for forced entry purposes was few. In the majority of attacks, forced entry was facilitated exclusively by blunt object impact (e.g., kicking, beating with rifle butt stock, etc.) and sometimes aided by bullet penetration or cutting with a bladed weapon.

For the purpose of designating or planning potential safe rooms, another issue worth considering is adversary effort and commitment to attack people located inside locked rooms. Joseph Smith and Daniel Renfroe describe their observations on this matter in an article on the World Building Design Guide web site: Analysis of footage from actual active shooter events have shown that the shooter will likely not spend significant time trying to get through a particular door if it is locked or blocked. Rather they move to their next target. They know law enforcement is on its way and that time is limited. [7] Separate case study research conducted by Critical Intervention Services also supports this perspective.

In a large percentage of attacks, adversaries focus solely on targets of easiest opportunity by using visually-obvious pathways and unlocked/unobstructed portals (e.g., doors, windows, etc) to facilitate indoor movement. This behavior may be due to perceived time pressure (“kill as many as possible before the police arrive”) or possibly diminished problem-solving ability resulting from activation of the Sympathetic Nervous System (SNS). In most documented attacks where adversaries committed effort to forcibly enter locked rooms, intervention by police or security forces was delayed and adversaries had exhausted all targets in accessible areas. 

When developing a DBT for use in a region where the main threat concern is a particular terrorist group, research should focus on identifying any unique tactics or preferences for entry methods demonstrated in previous attacks. Al-Shabaab, for instance, has employed disguise and deceptive entry tactics for gaining access through the outer perimeter of several protected facilities in Somalia. If we were developing a DBT for Al-Shabaab, it would be wise to consider attack scenarios employing deception and disguise in addition to overt entry methods.


Weaponry influences the potential effectiveness of our response force, and caliber and type of ammunition determines the effectiveness of ballistic barriers in resisting bullet penetration.

According to FBI statistics, handguns were the most powerful firearm used in most attacks (59%) with rifles constituting 26% of incidents.[8] Although the FBI has not published statistics on weapon calibers used in active shooter attacks, most mass casualty attacks where rifles were employed in the United States involved 5.56mm weapons with examples including assaults at the Pulse Nightclub (2016), Inland Regional Center (2015), Sandy Hook Elementary School (2013), and Aurora Century 16 Theater (2012).

Outside the United States, 7.62x39mm weapons (AK-47) have been most common.

Likelihood of a Hostage/Siege Event

Although not directly related to adversary capabilities, another possible factor to consider is the likely duration of an event. If the adversary is a terrorist group with a specific preference for hostage-taking or if we are located in a region where there has often been delayed intervention by police/security forces, circumstances may justify a more advanced level of preparation.

In the 2015 CIS MTFA study, 35% of all attacks escalated into a siege by police/security forces upon arrival. In a number of these incidents, intervention was delayed due to early confusion about the event (“hostage situation” versus “armed massacre”). Some events resulted in a siege when arriving police or security forces were overwhelmed by the adversary’s firepower and withdrew pending the arrival of more assistance. In other events, police and security forces made committed entry but the size of facility and movement of the attackers inside the building delayed location and neutralization of the adversaries (e.g., 2019 Virginia Beach Municipal Center, 2013 Washington Navy Yard, 2015 Corinthia Hotel Tripoli, etc.).

Incidents documented in the CIS study that escalated into a siege had a duration ranging between 2h 24m and est. 96 hours, with a mean duration of 21h 44m. Although most events resulting in siege durations over 2 hours were in Africa or West Asia, recent incidents have occurred in Western countries with effective response times over 2 hours such as the 2016 Pulse Nightclub shooting (194 minutes from first call to 911) and Bataclan Theater (~156 minutes from first call to 112).  

Developing a Design Basis Threat for Active Shooter Attacks

In the government community, many organizations promulgate official DBT statements to serve as a standardized reference throughout the organization. For instance, the Interagency Security Committee (ISC) in the United States produces a Design Basis Threat (DBT) document for use during risk assessments and security planning in Federal facilities. The ISC DBT includes several threat scenarios related to armed attack with narrative descriptions of the event, and adversary characteristics such as numbers of adversaries, weaponry, tactics, etc.

The US Department of Defense also provides similar guidance for DoD facilities in UFC 4-020-01 “DoD Security Engineering Facilities Planning Manual.”[9] In Table 3-27, DoD presents a generic DBT (Threat Parameters) including several categories of Aggressor Tactics and a system for defining progressive levels of threat. Each threat level is attributed a corresponding description of weaponry, toolset, and/or delivery method.

As a consultant, I am not an advocate of adopting generic DBTs unless required by official mandate. Instead, I prefer using a research-based approach which considers the specific characteristics of relevant adversaries, historical attack data, regional trends, and similar issues. This type of approach is often more laborious, but results in a custom DBT that is rational, justifiable, and specific to the threat situation.

When developing a custom DBT, I typically begin by collecting data about attacks against similar facilities in the region or attacks perpetrated by adversaries of relevance with focus on weaponry, number of attackers, and tactics. The following table illustrates how this type of data collection might be applied for a facility in Kenya where Al-Shabaab is the primary adversary of concern.

Al-Shabaab Attacks

After data has been collected, a threat definition is then developed representing likely adversary capabilities and modus operandi. In a basic approach, the DBT is written to match any capabilities well established by trend or average. In a cautious or very cautious approach, the DBT matches or exceeds the highest level of capability as demonstrated in previous attacks.

Al-Shabaab Design Basis Threat

Even in situations where there are no unique adversary groups to serve as a model, this same type of research-supported approach can be applied for creating a non-specific, but justifiable DBT. Following are some examples of reasonable threat definitions based on historical attack data and well-established trends in different regions of the world.

Active Shooter Characteristics by Region

[1] Examples including the 2015 Corinthia Hotel Tripoli attack and 2008 Taj Majal attack.

[2] Dietz, Park D. “Mass, Serial, and Sensational Homicides.” Bulletin of the New York Academy of Medicine.  62:49-91. 1986.

[3] Blair, J. Pete, and Schweit, Katherine W. A Study of Active Shooter Incidents, 2000 – 2013. Texas State University and Federal Bureau of Investigation, U.S. Department of Justice, Washington D.C. 2014. pp. 7. PDF. (The 2011 South Jamaica and 2012 Tulsa shootings are specifically noted as the only events involving more than one attacker in the FBI’s study of U.S. domestic active shooter attacks between 2000 and 2013.)

[4] Gundry, Craig S. “Analysis of 20 Marauding Terrorist Firearm Attacks.” Preparing for Active Shooter Events. ASIS Europe 2017, 30 Mar. 2017, Milan, Italy.

[5] Gundry, Craig S. “Threat Assessment Methodology and Development of Design Basis Threats.” Assessing Terrorism Related Risk Workshop. S2 Safety & Intelligence Institute, 25 Apr. 2017, Brussels, Belgium.

[6] Gundry, Craig S. “Analysis of 20 Marauding Terrorist Firearm Attacks.” Preparing for Active Shooter Events. ASIS Europe 2017, 30 Mar. 2017, Milan, Italy. (Presentation included results of an unpublished 2015 study by Critical Intervention Services.

[7] Smith, Joseph, and Daniel Renfroe. “Active Shooter: Is There a Role for Protective Design?” World Building Design Guide, National Institute of Building Sciences, 2 Aug. 2016, Accessed 22 Sept. 2017.

[8] Blair, J. Pete, Martaindale, M. Hunter, and Nichols, Terry. “Active Shooter Events from 2002 to 2012.” FBI Law Enforcement Bulletin. Federal Bureau of Investigation, 1 July 2014, Accessed 22 Sept. 2017.

[9] UFC 4-020-01, DoD Security Engineering Facilities Planning Manual. US Department of Defense, N.p.: 2008.

Share on facebook
Share on twitter
Share on linkedin
Share on email

Physical Security Design and The Active Shooter (Pt. 1)

Physical Security and Active Shooter Attacks

Physical Security Design and The Active Shooter (Pt. 1)

When many people think of physical security, the first ideas that come to mind are things like locks, alarm systems, screening with metal detectors, CCTV, etc.—hardware components or procedures. Although these elements play a role in physical security, they have no value outside the context of the overarching system design.

In the context of active assailant attacks, performance-based physical security design integrates Detection, Delay, and Response elements in a manner that mathematically reconciles the time required for an adversary to commence mass killing and the time required for detection and response by security or police.

Fundamentally, physical security design is a mathematics problem defined by several key times and probabilities. The main performance metric of a Physical Protection System (PPS) design is its Probability of Interruption, defined as the probability that an adversary will be detected and intercepted by a response force before he/she can complete their objective.[1] The most important elements determining the Probability of Interruption are the Adversary Task Time (total time required for an adversary to enter a facility and access their target) and response force time. If the total time for detection, assessment, communications, and response force intervention is longer than the adversary task time, the system will fail. Specific elements alone (such as having an access control system or CCTV cameras) mean nothing outside the context of the overall system design. Individual PPS elements must work together integrally to reconcile these key times or the adversary will succeed.

In the context of active shooter events, detection usually is the result of visual or audible observation when the attack commences. Detection may also result from an alarm signal generated by forced entry into secured spaces or gunshot detection systems. The Time of Detection during an attack is represented in figure 1 as TD.

The time the report is received by authorities and/or assessed by a security control room for deployment of on-site armed officers is represented in the diagram as TA (Time of Assessment).

After the 911/112 center or security control room is alerted, the response force is subsequently dispatched to intercept and neutralize the adversary. This is represented in the following diagram as the Time of Interruption (TI).

Physical Protection System Times and Functions

While the alert and response force deployment is in progress, the adversary advances through barriers and distance to access targets and initiate mass killing. The time mass killing is in progress is represented in the previous diagram as Time of Completion (TC). The Adversary Task Time is the cumulative time between the Time of Detection and the Time of Completion. If the Time of Interruption is before the Time of Completion, the Physical Protection System (PPS) is successful in its function of preventing mass killing.

In most previous active shooter attacks, deficiencies in one or more key functional elements (Detection, Delay, or Response) result in a situation where mass killing (TC) initiates before the response force intervenes (TI).

Based on data yielded during several studies of active shooter attacks, the consequences of the difference in time between commencement of mass killing and response force intervention (TC versus TI) can be estimated as one casualty per 15 seconds.[2] 

Physical Security and Active Shooter Planning

Although the ideal objective of PPS design is to interrupt mass killing before it commences, real world conditions often limit the possibility of achieving a high Probability of Interruption. This type of situation is often common in ‘soft target’ facilities due to the need for unobstructed public access and facilities reliant on the unpredictable response times of off-site police. Other real world challenges such as cultural expectations, branding, and budget boundaries often limit the feasibility of implementing ideal physical security measures. And if an attack is launched by an insider adversary (e.g., employee, student, etc.) already inside the facility, physical protection elements at outer protective layers (e.g., perimeter, building envelope, entrances, etc.) will have little or no benefit.

Nevertheless, all measures that increase Adversary Task Time and expedite response time have a direct benefit in reducing potential casualties by narrowing the gap between TC and TI.

Sandy Hook Elementary School, 14 December 2012: Case Study of Performance-Based Physical Security Principles in Practical Application

 At approximately 09:34, Adam Lanza used an AR-15 rifle to shoot through a tempered glass window adjacent to the school’s locked entrance doors and passed into the lobby.[3]

 After killing the school principal and a school psychologist and injuring two other staff members who entered the hallway to investigate, Lanza entered the school office. Meanwhile, staff members concealed inside the school office and nearby rooms initiated the first calls to 911. Staff located throughout the building were alerted when the ‘all-call’ button on a telephone was accidentally activated during a 911 call.

After finding no targets in the office, Lanza returned to the hallway and proceeded into the unlocked door of first grade classroom 8 where mass murder commenced (approx. 09:36).[4] In less than two minutes, Lanza killed two teachers and fifteen students.

Sandy Hook Elementary Attack Diagram

As the attack in classroom 8 was in progress, teacher Victoria Soto and a teaching assistant in classroom 10 attempted to conceal children in cabinets and a closet.

After exhausting targets in classroom 8, Lanza proceeded into classroom 10 and killed Ms. Soto, assistant Anne Murphy, and five children. Although the exact reason Ms. Soto did not lock the door to classroom 10 is unknown, all classrooms at Sandy Hook Elementary School featured ANSI/BHMA “classroom-function” (mortise F05 and bored F84) locks which can only be locked with a key from the hallway-side of the door.

The tragedy ended in classroom 10 when Lanza committed suicide at 09:40 while police were preparing for entry into the building.

As common in U.S. primary schools, Sandy Hook Elementary School relied on off-site police as their response force during emergency events. Response was first initiated at 09:35 when a staff member called 911 to report the crisis. At 09:36, an alert was broadcast by radio and police units were dispatched to the school. The first police unit arrived at 09:39, followed immediately by two other units. After assessing the scene and planning a point of entry, the officers organized into a contact team and made entry into the school at 09:44.

In the context of physical protection system performance, the adversary task time (time between when Lanza’s entry commenced and mass killing was in progress) at Sandy Hook Elementary School was approximately 23 seconds. The time between detection of the attack and on-site arrival of police was slightly less than three minutes. However, there was an additional 5-6 minutes of time as officers assessed the situation and organized before making entry and effectively moving indoors to neutralize the killer. When assessing incidents involving response by off-site police, arrival time at the scene is irrelevant. What matters is the time ending when police arrive at the immediate location of the adversary ready to neutralize the threat. This describes the contrast between On-Site Response Time and Effective Response Time. At Sandy Hook Elementary School, the Effective Response Time was approximately nine minutes.

As illustrated in the following table, the variation between Adversary Task Time and Effective Response Time witnessed at Sandy Hook Elementary School has been historically common during active assailant attacks. In each of the six events documented below, mass killing was in full progress within 1-3 minutes of the time the attacker entered the building or shot the first victim. By comparison, the Effective Response Times ranged between 7 and 38 minutes, with most events ending prior to intervention by police when the attacker(s) escaped or committed suicide.

Active Shooter Timeline Infographic

Mitigating the consequences of active shooter attacks through better physical security design and integration


In the Newtown tragedy, PPS failure was largely the result of inadequate delay in relation to the time required for response by off-site police. When the attack is analyzed using Sandia’s Estimate of Adversary Sequence Interruption (EASI) Model, the original PPS at Sandy Hook Elementary School would have had a Probability of Interruption of 0.0006 (Very Low).

Sandy Hook Shooting Timeline
Sandy Hook Shoting - EASI Attack Analysis

In the case of Sandy Hook Elementary School, there are a number of measures that could have improved overall system performance.

Upgrade the facade with intrusion-resistant glazing. Adam Lanza entered the building by bypassing the locked entrance doors and shooting a hole through the adjacent tempered glass window. He then struck the fractured window and climbed through the breach. Tempered safety glass is generally only 4-5 times resistant to impact as annealed glass and provides minimal delay against forced intrusion. According to testing documented by Sandia National Laboratories, 0.25 inch tempered glass provides 3-9 seconds of delay against an intruder using a fire axe and the mean delay time for penetrating 1/8″ tempered glass with a hammer is 0.5 minutes.[5] However, impact testing documented by Sandia did not account for the fragility of a tempered glass specimen after first being penetrated by firearm projectile. In penetration tests Critical Intervention Services conducted of 1/4-inch tempered glass windows using several shots from a 9mm handgun to penetrate glazing prior to impact by hand, delay time was only 10 seconds.[6]

Upgrading facade glazing with the use of mechanically-attached anti-shatter film could have improved delay time at the exterior protective layer by 60-90 seconds.[7]

Construct an interior protective layer to delay access from the lobby into occupied school corridors. Once Adam Lanza breached the exterior facade into the school lobby, there were no additional barrier layers delaying access into areas occupied by students and faculty. A significant percentage of active shooter assaults by outsider adversaries originate through main entrances and progress into occupied spaces.[8] Some examples include attacks at the Riena Nightclub (2017), Pulse Nightclub (2016), Charlie Hebdo Office (2015), Inland Regional Center (2015), Colorado Springs Planned Parenthood (2015), Centre Block Parliament Bldg (2014), and US Holocaust Memorial Museum (2009).
An ideal lobby upgrade would be designed to facilitate reception of visitors while securing the interior of the school through a protective layer constructed of intrusion-resistant materials. Depending on material specifications, an interior barrier layer could have delayed Adam Lanza’s progress into the school by an additional 60-120 seconds.
Sandy Hook Elementary School Lobby Concept

Replace “classroom-function” locks on school doors with locks featuring an interior button or thumbturn. All classroom doors inside Sandy Hook Elementary were equipped with ANSI “classroom-function” locks (mortise F05 and bored F84). These are perhaps the worst choice of locks possible for lockdown purposes during active shooter events. As witnessed in a number of attacks, doors equipped with classroom-function locks often remain unlocked due to difficulty locating or manipulating keys under stress. In addition to Sandy Hook classroom 10, another incident where this situation clearly contributed to unnecessary casualties was the 2007 Virginia Tech Norris Hall attack.[9] In these two events alone, 26 students and faculty were killed and 24 wounded specifically because the doors to classrooms could not be reliably secured.

Ideal specifications for door locks would be ANSI/BHMA A156 Grade 1 with an ANSI lock code of F04 or F82.[10] Mechanical locks rated ANSI/BHMA Grade 1 have been successfully evaluated under a variety of static force and torque tests. Locks coded as F04 and F82 feature buttons or thumbturns to facilitate ease of locking under stress.

Although there are no empirical sources citing tested forced entry times against ANSI/BHMA A156 Grade 1 rated locks, it is estimated that a committed adversary using impact force with no additional tools could penetrate improved locks in approximately 90-110 seconds.

Replace door vision panels with intrusion-resistant glazing. During the attack at Sandy Hook Elementary, Adam Lanza was able to enter classrooms 8 and 10 directly through unlocked doors. If these classrooms were secured, the tempered glass vision panels on all classroom doors could have been easily breached to facilitate entry in less than 10 seconds.

An effective approach to physical security specification would ensure that all barriers composing the classroom protective layer are composed of materials with similar delay time values. This could be accomplished by ensuring that vision panels are no wider than 1.5″ (3.8 cm) or constructed of intrusion-resistant glazing such as laminated glass, polycarbonate, or reinforced with anti-shatter film.

If the aforementioned barrier improvements were employed in the PPS design at Sandy Hook Elementary School, Adam Lanza’s access into occupied classrooms would have been delayed by an additional 162-312 seconds. This would have improved the overall performance of the PPS by potentially increasing the Adversary Task Time to 185-335 seconds before mass killing was in progress. Although this is a significant improvement from the original Adversary Task Time (est. 23 seconds), 335 seconds is still less than the estimated response time of police during the original event (est. 544 seconds).

In many cases, accomplishing the performance-based objective of interrupting an active shooter before mass killing commences requires a combined approach aimed at both increasing delay time and decreasing response force time. In the case of Sandy Hook Elementary School, decreased response time could have been facilitated by the use of gunshot detection technology or duress alarms, improved communications procedures, and similar improvements. Any measure that decreases alert notification and response times has a beneficial impact on system performance. Even if enhancements only reduce response time by 10 or 15 seconds, such improvements have the theoretical benefit of reducing casualties by one victim per fifteen seconds of decreased response time.

In the situation of Sandy Hook Elementary School, the greatest improvement could have resulted from having an on-site response force (e.g., armed school resource officer) capable of reliably responding anywhere on the school campus within 120 seconds of alert.[11] If this measure were implemented, the total estimated alert and response time could have been improved to 147-157 seconds. When compared to the increased Adversary Task Time of 206-316 seconds, the improved PPS design would have likely resulted in interruption before mass homicide commenced. When analyzed using Sandia’s Estimate of Adversary Sequence Interruption (EASI) Model, the improved PPS would have resulted in a Probability of Interruption of 0.87 (Very High).

The following table and spreadsheet models the PPS improvements described in this article to demonstrate how performance-based physical security design can influence the outcome of armed attacks.

Sandy Hook Elementary - Improved Security Design
Sandy Hook Elementary Physical Security

Threat Characteristics and Physical Security Performance

The delay time expectations of physical barriers cited in this article were based on the weaponry and methods of entry employed by Adam Lanza at Sandy Hook Elementary School. If Lanza had employed different tools or methods, the delay time of barriers would have correspondingly been different. The same principle is true for bullet-resistant barriers. The ballistic resistance of materials is directly relative to the caliber and type of ammunition used by an adversary.

To ensure a security design performs as expected, it is first necessary to establish a definition of the adversary’s likely capabilities and tactics. In Part 2 of this series, we’ll continue this discussion by exploring trends in the behavior of attackers, threat capabilities and methods, and approaches to developing a Design Basis Threat (DBT) suitable for security planning.

[1] Garcia, Mary Lynn. Design and Evaluation of Physical Protection Systems. Burlington, MA: Elsevier Butterworth-Heinemann, 2007.

[2] Anklam, Charles, Adam Kirby, Filipo Sharevski, and J. Eric Dietz. “Mitigating Active Shooter Impact: Analysis for Policy Options Based on Agent/computer-based Modeling.” Journal of Emergency Management 13.3 (2014): 201-16.

[3] Sedensky, Stephen J. Report of the State’s Attorney for the Judicial District of Danbury on the shootings at Sandy Hook Elementary School and 36 Yogananda Street, Newtown, Connecticut on December 14, 2012. Danbury, Ct.: Office of the State’s Attorney. Judicial District of Danbury, 2013. Print.

[4] Time estimated based on witness event descriptions and assessment of time required to walk through the school office and down the corridor to classroom 8.

[5] Barrier Technology Handbook, SAND77-0777. Sandia Laboratories, 1978.

[6] Critical Intervention Services assisted a window film manufacturer in 2015 in conducting a series of timed penetration tests of 1/4-inch tempered glass windows with mechanically-attached 11 mil window film. The tests involved penetration by firearm followed by impact (kicking and rifle buttstock). The delay times ranged from 62 to 94 seconds and deviated according to the aggression of our penetration tester.

[7] Ibid.

[8] Gundry, Craig S. “Analysis of 20 Marauding Terrorist Firearm Attacks.” Preparing for Active Shooter Events. ASIS Europe 2017, 30 Mar. 2017, Milan, Italy.

[9] Mass Shootings at Virginia Tech. April 16, 2007. Report of the Review Panel. Virginia Tech Review Panel. August 2007. pp.13.

[10] ANSI/BHMA A156.13, Mortise Locks and Latches. Builders Hardware Manufacturers Association (BHMA), New York, NY, 2011.

[11] CIS Guardian SafeSchool Program® standards define a performance benchmark of 120 seconds as the maximum time for acceptable response by on-site officers. However, achieving this type of response time in many facilities requires careful consideration of facility geography, communications systems, access obstructions, and officer capabilities (e.g., training, physical conditioning, etc.).

Share on facebook
Share on twitter
Share on linkedin
Share on email

The School Security Plan: A Holistic Approach

School Security Plan - A Holistic Approach

Effective school security plans begin with a strategy. To most, this sounds like an obvious point. However, some of the most common problems I encounter as a consultant are the absence of cohesive strategy in the design of school security plans and over reliance on a limited set of protective measures.

Fundamentally, preparation for active shooter violence is a process of risk management and conceptually no different from any other security and safety planning activity. The ultimate aim of any risk management program is to effectively characterize the risk to an organization’s assets and implement measures to reduce risk in alignment with the organization’s risk appetite while tending matters of operational needs, culture, branding, and budget.

An effective school security plan employs a combined approach to reducing risk probability and risk criticality. In the context of security risk, probability is the result of Threat (an adversary with intent and capability to cause harm) and Vulnerability (the state of conditions that would allow the adversary to succeed in causing the risk event). Proactive security measures aim to reduce Risk Probability by either reducing Threat or reducing Vulnerability. If proactive measures are implemented effectively, they may be successful in reducing Risk Probability, but there is always an element of uncertainty. To further reduce risk, reactive/mitigative measures are employed to reduce the harmful effect of risk events (Risk Criticality).

The School Security Plan & Multi-Layered Risk Management

In protective theory, this concept of multiple layers of proactive and mitigative measures is often described as concentric rings of protection. This concept is illustrated in the following diagram. The outermost rings of the diagram (colored in blue) represent proactive measures aimed at reducing probability by reducing Threat and/or Vulnerability. However, despite our best effort to mitigate the probability of active shooter attacks, no strategy to prevent events can guarantee success with certainty. To address this reality, additional preparations should be implemented to reduce the severity of attack events. Additional mitigative and reactive countermeasures are represented by the innermost red layers in the diagram below.

Risk Management and Security Strategy for Schools

In the context of school security planning, proactive risk management starts with reducing potential threat. This is first accomplished by reducing the potential conditions that contribute to advancement on the targeted violence pathway. Reinforcement of positive school culture, creating strong bonds between staff and students, mentoring students with problems, actively intervening in bullying situations, and restorative practices are all examples of measures aimed at reducing threat. Additionally, as promoted by the US Government’s Safe School initiative in 2000-2002, having a formal system in place to identify potential threats and warning behaviors, investigate and assess threats, and manage potential threatening situations before they result in violence is another critical element of reducing threat.

Positive school culture and threat assessment may be effective in reducing the threat of students escalating toward violence, but these measures have little effect on outsider adversaries who may target the school for reasons beyond the school’s influence. The only way to effectively mitigate probability in this risk situation is to establish an effective physical protection system. Effective physical security requires that a threat is detected early and delayed from accomplishing the objective long enough for a response force to intercept. If these three elements (Detection, Delay, and Response) are deficient or out of synch, the system will fail. In virtually every school attack perpetrated by an outsider (e.g., MSDHS, Sandy Hook, West Nickel Mines, Platte River Canyon, etc.), there was a major failure in one or more of these three key functional elements. As of present, very few schools in the United States have a physical security program that truly meets the criteria for performance effectiveness.

If an attack does occur, an effective school security plan integrates additional measures to mitigate the impact of the risk event. In school security, this starts by having a response force capable of effectively intercepting a threat before they can cause mass violence. If the effective response time of local police is longer than three minutes, it is usually impractical, if not impossible, to achieve enough delay time to prevent mass tragedy. Unfortunately, average police response times (effective response times) during active shooter events often range between 7 and 10 minutes (depending on cited source). The only way to guarantee an effective and reliable response is to have a reliable alert and communications system and an on-site response capability provided by School Resource Officers or well-trained armed security officers.

In addition to communications and tactical response, plans and preparations should be emplaced to manage the situation safely, effectively, and restore normal operations as quickly as possible. This starts with an effective and well-organized school emergency response plan. Despite the importance of having a solid and integrated emergency plan, this is one area where many schools have problems. School emergency plans are often a collection of memos with little integration or effective consideration to issues such as redundancy, feasibility under high stress conditions, and the many faces of “Murphy’s law” that emerge during crisis management.

Once the foundation is laid through effective response planning, teachers and faculty need to be trained in their functions and regularly drilled in response procedures. One of our clients, Shorecrest Preparatory School, conducts lockdown drills bi-monthly to ensure that teachers and staff members are instinctive in their response. When questioned about the frequency of lockdown drills versus legally-mandated fire drills, Mike Murphy (Headmaster at Shorecrest Prep) tells people that no kids have been killed in school fires in over 50 years but one only needs to watch this week’s news to be reminded of the last time school children were killed in an act of violence.

The Guardian SafeSchool Program® as a Model for Best Practices

The CIS Guardian SafeSchool Program® integrates all of these approaches to managing safety and security in schools while reinforcing school climate and culture. Our philosophy behind the design of the program is a holistic and multi-layered strategy that reduces risk by preventing acts of violence and mitigating the potential impact of events through effective preparation and response.

CIS is honored that John Jay College of Criminal Justice has peer reviewed the program and endorsed it as a model for best practices. It is our hope that states, school districts, and private schools will consider the methodology described in his article as they search for an effective and balanced solution to reducing risks of targeted violence while simultaneously fostering environments conducive to good education.

For more information about school security planning, protective strategy, and measures for reducing negative impact on school climate and culture, see the YouTube video at the bottom of the page.

Share on facebook
Share on twitter
Share on linkedin
Share on email