ICS lessons learned from active shooter response training

By Colonel Richard Herrington and Major Richard Stuart Kuong

Much should have been learned since the Columbine high school shooting. In short, active shooters must be rapidly – not recklessly – engaged and neutralized to save lives! However, if the shooter’s location is not known or there are two or more shooters, law enforcement tactics, methodology and pace must change drastically.

While law enforcement receives Incident Command System (ICS) training, many law enforcement organizations don’t utilize ICS like fire and EMS. That’s because most police incidents are handled by one to three officers using departmental procedures and leadership by committee. And it works...until it doesn’t.

The police response to the Uvalde school shooting has unfairly labeled law enforcement as indecisive, failing to take timely and decisive action, even lacking courage – perception is reality.

How ICS is structured to always work

Often a lone, responding LEO (a patrol officer) will arrive on scene. Policy notwithstanding, that LEO becomes the incident commander (IC) until the incident is resolved or his/her role changes to the on-scene commander (OSC can still be the same as the IC), or the lone LEO enters the building and becomes a contact officer, thereby relinquishing incident command. The incident commander cannot be both contact officer and incident commander. The incident commander must be free to mentally grasp the situation in totality and manage it, not be solely focused on any one task or dimension of an incident. In this instance, a more senior officer (normally a sergeant or higher) assumes incident command (probably via radio versus face-to-face) while en route to or upon arrival on scene.

In the Uvalde school shooting, it appears that the incident commander entered to address the gunman (becoming the contact officer). He didn’t realize he was the incident commander and/or didn’t think to transfer incident command via radio before entering to locate the gunman. Once inside and in the company of about 19 LEOs, that chief should have organized the LEOs into strike teams (assigning strike team and assistant strike team leaders), then retrograded outside to set up his command post (with radios) and assume incident command (become the head football coach and not one of the assistant coaches or players). His lack of understanding of ICS contributed significantly to the “fog of battle.” Further, when the gunman appeared to have locked himself in a classroom, without considering all factors, that chief automatically switched from his active shooter playbook to a barricaded gunman playbook, which called for setting up a perimeter and waiting for SWAT and hostage negotiators, etc.

As an incident mushrooms and additional law enforcement resources are needed, span of control increases. Usually, more senior LEOs arrive, relieving the sergeant of incident command (possibly leaving him/her in place as on-scene commander, a subordinate commander to the new incident commander). Communications, via radio or face-to-face, facilitate the transfer of incident command from the patrol officer to the sergeant and then to the next senior LEO until the terminal incident commander assumes incident command.

The incident commander must have information flow from the on-scene commander and/or contact officer(s) to develop a mental picture of the incident to establish objectives and priorities, deploy available resources, and execute agency policies to achieve established objectives. The ICS process makes this transition understandable and allows those involved to concentrate on incident objectives, priorities and the tasks required to resolve the situation. But it takes more than understanding ICS; it takes practice (reps) and understanding the critical need to communicate tactically.

Active shooter course scenarios featuring an incident commander (IC)

Since 2004, Kilo1 Applications Group, LLC conducted numerous active shooter exercises. Mistakes identified during this training were mirrored in Uvalde.

Such exercises and limited force-on-force scenarios reveal invaluable lessons. Virtually every active shooter exercise or force-on-force scenario that featured an incident commander illustrated subpar communications from limited intelligence flow (usually from contact LEOs to incident command) that inhibited the incident commander’s ability to gain a mental picture and effect command/control responding personnel.

The ability to mitigate intel and communication dysfunction requires many more training reps than what is currently budgeted for agencies to achieve cohesive team functioning during an exigent circumstance. There are reasons to train continuously:

• Become proficient in tactics, equipment and procedures;
• Collectively learn from mistakes;
• Develop confidence and cohesion from training together repetitively.

Active shooter exercise participants experienced command/control degradation, which contributed to the “fog of battle” and blue-on-blue incidents, when one of the following eight circumstances occurred:

1. Incomplete or erroneous intel was shared via radio;
2. The incident commander did not consistently receive information/updates from the on-scene commander and/or contact officer(s);
3. Contact LEOs ignored the incident commander (in some cases turned their radios off);
4. Incident commanders issued orders not based on known information but on pre-conceived/untimely assumptions of a situation.
5. Incident commanders sometimes did not exercise strict radio net control and its authority to provide tactical direction. They instead monitored communications;
6. Instead of exercising unity of command, leadership by committee at the strike team level was practiced;
7. Available resources self-deployed. Worse, they didn’t request permission to enter when breaching the ‘hot zone;” 
8. No radio interoperability or plans existed;
9. Blue-on-blue resulted from no standardized, established Identification/link-up procedure;
10. An on-scene command post comprised of one LEO was undermanned. Therefore, span of control increased too quickly, which overwhelmed incident command as one LEO juggled too many balls concurrently;
11. During the incident commander’s absence from the command post, a leadership void ensued.

Further, many times incident commanders and subordinate leaders had no idea where all LEOs were located, which presented blue-on-blue situations.  On one occasion, an LEO (DT instructor) self-deployed from his strike team, ignored the intel, enveloped a four-person group and shot all four in the back. He even radioed in his position and status before it was pointed out to him that he just shot four LEOs from another police department in the back!

During the hot wash of the active shooter exercises, incident commanders could not articulate an accurate summary of the “incident.” Three primary reasons emerged:

1. Lack of information flow to the incident commander;
2. The incident commander received critical information but did not give that information attention;
3. Critical information, given to the command center, was not forwarded to the incident commander. Subsequently, orders issued often complicated and degraded a chaotic situation. It was learned that on occasion, LEOs in contact teams sometimes turned off radios to avoid being “disturbed” by incident command.

In all the active shooter exercises, when communications were inhibited, runners were not utilized.

Clarity of most active shooter training scenarios was only achieved when LEOs finally provided event situational information during the hot wash. Had the “missing pieces” been provided during the exercise, it could have allowed the incident commander to make timely decisions to affect a positive outcome. After each hot wash, subsequent active shooter training scenarios were conducted with ICS procedures closely followed – the results were always positive.

In virtually every active shooter force-on-force training scenario, strike teams without adequate incident command communications operated with leadership by committee instead of taking tactical direction from one clearly identified LEO, the strike team leader. This was observed repeatedly when communications with the incident commander became inhibited.

Not all LE organizations are the same, but the stress of active shooter situations can inhibit response. There is a proven “fix” to ensure command and control problems are minimized if not eliminated – continuous training to reinforce ICS procedures and to instill an understanding that critical information must flow both ways, to the incident commander and back to the contact officers.

About the authors

Major Rich Kuong, USMCR (ret), possesses over 30 years of experience in private and corporate security, US Marine Corps, first responder training, line and command post planning/operations, crisis response, emergency management, corporate management and law enforcement. He has developed and administered cutting-edge active shooter and counter-terrorism tactical training for first responders, military and private security personnel. Major Kuong has also consulted or provided training for municipal and city government, corporations, hospitals and educational institutions. Since 2004, he has regularly collaborated with, co-authored reports and worked on several projects with Colonel Rick “Skinny” Herrington, USMC (ret). Maj Kuong holds an MBA from Pennsylvania State University and is the principal of Kilo 1 Applications Group, LLC. Contact him at rkuong@k1ag.com.

Colonel Richard L. Herrington, USMCR (ret) served in the United States Marine Corps for 30 years. He enlisted and rose to the rank of corporal before being commissioned. Much of his military career was in aviation, flying helicopters, attack jets and fighter aircraft in support of Marines and specialized units. He commanded a Marine Corps fighter squadron, a Marine Corps Aircraft Group and was an outspoken advocate of the application of controlled violence in support of national security. Richard spent two tours of duty in the Pentagon as an aviation training specialist, operational planner, command and control specialist and acquisition professional. After retiring from the Marine Corps as a colonel, Richard worked as a commercial airline pilot flying B-737 aircraft and as the vice president for a large credit union. He subsequently became an operations manager for a Fortune 500 company where Richard’s extensive risk mitigation knowledge was used to ensure the safety of employees he took to extreme risk locations; he was responsible and accountable for risk mitigation actions while providing on-site specialized support to forward-deployed U.S. military forces.