Run, Hide and Fortify®: The keys to survival in an Active Shooter Incident

Run, Hide and Fortify®: The keys to survival in an Active Shooter Incident

22:33 27 September in Corporate Security, Crisis Response, Travel Safety, Workplace Violence

John Farrar is our guest blogger this month with a three-part series that will cover topics such as how to respond and what to do in an Active Shooter Incident (Part One), Individual Preparation and Situational Awareness when situations arise (Part Two) and finally A Recommended approach for Business continuity planning to deal with potential threats to a company be it manmade or a natural disaster (Part Three).


The concept of “Active Shootings” is rapidly going the same route as the concept of Terrorism with multiple definitions and the politicizing of its various elements. Each Federal Agency seems to have a different definition of what constitutes an “active shooter.” The various slants on the accumulating statistics seem to sow confusion more than it assists with grasping the bottom line on what can be done for the safety of those in the line of fire. No matter how you look at the statistics there are several glaring ones that jump out. They are tending towards a greater lethality and the suspects are increasingly utilizing better techniques and employing a greater range of weapons.

However, in my opinion, the most significant factor is how quickly these events are concluded. According to an FBI Study, “In 64 incidents where the duration of the incident could be ascertained, 44 (69.0%) of 64 incidents ended in 5 minutes or less, with 23 ending in 2 minutes or less. Even when law enforcement was present or able to respond within minutes, civilians often had to make life and death decisions, and therefore, should be engaged in training and discussion on decisions they face. As expected, therefore, many incidents ended before police arrived. Of the 160 incidents, at least 107 (66.9%) ended before police arrived and could engage the shooter, either because a citizen intervened, the shooter fled, or the shooter committed suicide or was killed by someone at the scene.”¹

I don’t want to get too deep into suspect motivations since entire books can be written about it, at this time the majority of these attacks seem to stem from some desire for revenge or extreme rage and the offenders generally appear to have very poor mechanisms for coping with the stresses of life and usually are socially isolated with few support mechanisms in place. However, I believe Terrorism is increasingly evolving into more of a “Think Global and Act Local” paradigm so the length of time of these events will eventually go up and there will be more confrontations with responding officers. The offenders might also make more of an attempt to escape and evade capture to further their goals and objectives.

Other items of interest have emerged from studying these incidents. In the majority of Active Shooters in Schools the suspect(s) have been students of that very school. In businesses that are generally closed off to public access (i.e. a business that isn’t a walk in store) the offenders are generally current or recently fired or laid off employees of the company.

“Run, Hide and Fortify”®

Most people seem to remember the simple “Stop, Drop, and Roll” concept of what to do if caught on fire. In the spirit of this, “Run, Hide, and Fortify”® is an easy to remember concept that encapsulates the ideas that provide the best chance for survival in these types of incidents. Their fast tempo demands quick thinking. Remember the phrase from Monty Python’s Holy Grail, “Run Away!” If at all possible leave, don’t worry about gathering belongings, and just get out as fast possible. Try and alert the people around you but if they want to argue and delay leaving its time to “” and get out of dodge. When you are out of the immediate danger area, notify 911.

If you are unable to Run from the threat, then it’s time to Hide. Find a location that doesn’t appear to be occupied. If possible darken the lights and hide in a non-obvious location. There have been numerous examples of shooters walking around to the back of desks to see if someone is hiding. Turn the lights off and silence your phone. Also be aware of the difference between cover and concealment. Cover provides better protection against small arms fire while Concealment just hides you. If possible get behind something that provides both. Once you are hidden stay there until you are absolutely sure that the event is over. Be aware of natural lines of sight and stay out of them. The offenders are generally in a hurry and will not be conducting detailed room searches but instead will be hastily going from room to room.

One of the tricks that the Westgate Mall terrorists did in Kenya was to call out Ma’am in various languages in hopes of getting someone to answer. Several people unfortunately answered and were shot in response. Another example was during the Mumbai Terrorist incident where a team of terrorists entered a high-end Hotel. According to at least one news report, they accessed the hotel’s guest list and began calling the rooms claiming to be the management in order to get the occupants to come down to the front desk. The terrorists also used phones to call their handlers for advice after they captured various people and had them query their names via the internet to ascertain who some of the guests were. At least one VIP was identified in this manner and was then murdered.

If there appears to be sufficient time to Fortify your hiding location do so. Not only lock the door but place chairs or a table behind the door. A bookcase could assist. Remember that you are not “bulletproofing” your location but just trying to delay the offender in gaining entry into your location. These obstacles can also assist with obscuring the shooter’s line of sight. High Caliber bullets can shoot through an amazing amount of material so it will be difficult to stop the penetration of rounds. If the offender does appear, get low and behind the best cover you can find. Stay a few inches off the walls. An old soldier’s tale is that rounds will sometimes ricochet off of walls and then parallel the wall until stopped. I have never verified this but still try and keep off walls as a habit while engaged in room clearing and building searches.

Calling 911

Prior to calling take a second to gather your thoughts because once the call is answered you will be barraged by a number of questions. The last known location of the shooter will be asked, as well as a description of the attacker. As the call taker is asking questions the call will be broadcasted so try not to get frustrated with all of the questioning from the call taker. The information is being relayed out as fast as they can take down the information.

If you did see the shooters try and remember the basics. Gender, Race, and a brief description need to get out to the first responders. Think of any quick defining aspect of their overall appearance. Baseball caps, backpacks, and shirt colors stand out but smart offenders such as bank robbers generally strip off the top layer of clothing after their immediate getaway. Footwear is generally not changed out for obvious reasons. I was taught to formulate descriptions as Gender, Race, Body Type, and clothing descriptions from the top down. An example would be if they are wearing a Baseball Cap or not, Eyewear, Style and Color of Shirt, Pants, and Footwear. The presence of Backpacks or Weapons and a short description is always preferred.

Telling First Responders that the suspect is armed with a long gun versus a handgun also can assist. Handguns are easier to conceal and have less effective engagement distance so officers can move in closer as they attempt to find and stop the threat. Another question that will be asked is the locations where you observed possible injured people.

If you are aware of the offender’s vehicle a tool to better remember key details is the acronym CYMBAL that stands for Color, Year, Make, Body and License. (Don’t forget the state if possible.) Body description can be as simple as 2 or 4 doors. I have found it to be very helpful with organizing information as I broadcast information during stressful situations.

When the Police Arrive

These are very volatile situations and a great deal of confusion is inevitable. Stay in place as the police arrive and don’t rush out to them. Once they are contacting you keep your hands out and visible. They don’t know you and have no clue that you are not with the bad guys. Obey their verbal commands as much as possible and try to be patient as they secure the scene. They have a lot to do while stabilizing the situation and their first priority is to make sure offenders have been located and stopped. The scene has to be secured prior to deploying Medical assets so it behooves everyone to just stay in place until the situation is secure.

Keep in mind that the Police might be in all states of dress. These are calls of the highest priority and everyone will be going. Some of these officers might have been engaged in some type of training including physical exercise. Some might remember the Hollywood Bank Shootout where the responding SWAT officers arrived in their Physical Training gear. Some officers might be assigned to plainclothes or undercover roles so at most they might have a badge or ID hanging around their necks. The offender in the recent Norway mass shooting had attempted to disguise himself in a Police Uniform but real officers were able to tell that his uniform wasn’t correct. Some officers in the area might also be in old uniforms because they retired before their Agency switched to a different one and were currently working in an off-duty capacity such as flagging traffic when the incident began. These situations are highly volatile and well-meaning people will be responding in droves.

One of the problems security forces had during the Beslan Terrorist Incident when Chechen Terrorists seized a Russian school, was that local residents and parents of the children responded with their own firearms and numerous shootouts resulted. The only way to separate the good from the bad in this situation is to focus on behavior. If the actions appear to be legitimate as opposed indiscriminate shooting the shooters are probably legit. During the Westgate Mall shooting, when Terrorists belonging to the terrorist group Al-Shabaab entered a Kenyan Mall and began massacring people, there were several incidents of mistaken identity and friendlies ended up getting injured and killed. The Military refers to these as blue on blue incidents. Unfortunately, when rounds are fired, they are stamped with, To Whom It May Concern, and mistakes can easily occur.


My hope is that people will become more aware of their surroundings. Terrorism is heading towards more of a “Think Global Act Local” paradigm where local cells and Lone Wolf type actors will be engaging in more frequent smaller scale acts and will be going for more singles and doubles instead of the infrequent “homerun”, to borrow an analogy from Baseball. Because of this, there is going to be not only more incidents but also ones of increasing complexity and sophistication with multiple offenders and improved utilization of weapons and tactics. If you can remember just one thing if “the barbarians” do end up at your gate, Run, Hide, and Fortify®.

About the Author

John Farrar, a graduate of the University of Washington, Infantry Officer in the U.S. Army, and a Police Officer for over 20 years with a large Metropolitan Department where he served in a variety of positions including Crime Analyst for 5 years.

John has training in a wide variety of fields including Interview/Interrogation, Surveillance, Eastern European Organized Crime, Crime Analysis, Terrorism Analysis, Terrorism Awareness and advanced training in Criminal Investigative Analysis (Profiling). His technical training consists of hardware/software, preservation of digital evidence, management of digital investigations and computer forensics as well as Cyber Terrorism on network security. He is also a graduate of the DEA Intelligence Analysis Course taught at Quantico, Virginia.

For further musings on Security, Terrorism and other items of interest, check out his blog at

¹Blair, J. Pete, and Schweit, Katherine W. (2014). A Study of Active Shooter Incidents, 2000 – 2013. Texas State University and Federal Bureau of Investigation, U.S. Department of Justice, Washington D.C. 2014., p.8-9