The Cybersecurity & Infrastructure Security Agency (CISA) of the U.S. Department of Homeland Security has developed the COVID-19 Recovery CISA Tabletop Exercise Package (CTEP) to assist private sector stakeholders and critical infrastructure owners and operators in assessing short-term, intermediate, and long-term recovery and business continuity plans related to the COVID-19 pandemic. Approved by the White House Task Force, and with input from the Federal interagency, this CTEP also provides organizations the opportunity to discuss how ongoing recovery efforts would be impacted by concurrent response operations to a potential “second wave” of global pandemic infections.
Three words you never want to hear in a row – but ones you need to plan forwell in advance. We believe the phase “Lockdown” should be a universal call to action – which has different actions, depending on where you are and where the threat is. Similar to a fire or chemical spill within (or near) a commercial high-rise office building, there may be some places where it is safer to shelter-in-place and some where it is safer to evacuate. But unlike those and any other threats – there may be a moment/place/time when you are confronted directly by the active assailant – with “no where to run and no where to hide” (apologies to Holland, Dozier and Holland) – and you will have to fight to defend your own life and maybe the lives of others.
A Lockdown should be different from a Secure and Hold. A Secure and Hold order is when the Active Assailant is near your location, but not (yet!) a direct threat to you. When a building or a school goes on Secure and Hold, it should mean that the threat is not on campus and no one goes in and no one comes out (except as authorized by emergency services). Secure and Hold orders can become Lockdowns, when the threat does move to your building. This may happen very quickly – and if it does, try to get the words “Lockdown, Lockdown, Lockdown” out over public address systems, text messages targeted to people in the building, etc. Also any info which can help identify the attacker(s); the more intelligence provided, the better – such has what the attacker(s) look like, weapons, which entrance they came in, where they might be now, etc. We encourage the three calls of the word “Lockdown!” back to back, this way it is very distinctive, and in case someone missed hearing the word “Lockdown” the first time. And by the way, there is no reason not to keep announcing where the threat is located – only if you are in a safe place to do so. Offsite security/law enforcement teams who have access to your public address system and/or text alert system can perform this as well. Note, we do recommend that cell phones be put on silent when you are temporarily ‘hiding’ or denying access, in a safer location – and those folks should remain quiet to avoid directing the attacker to their location.
Think of this threat, like it’s radioactive. If you heard there was a briefcase full of radioactive material in the lobby of your building, you would want to get as far away from it, as quickly as possible. So, for two of the three actions (evacuation and sheltering in place) associated with a Lockdown, look to limit your time near the threat, increase the distance from the threat, and use shielding from the threat:
Run/Avoid – Add Time and Distance from the Threat
This is shorthand for evacuate away from the threat to a safer area until the situation is ended; and let your team or emergency responders know of your location and status. That includes a very important checklist point to “running/avoiding” away from an Active Assailant (or any other threat where you are evacuating): Accountability. Please let your supervisor, or emergency action team leader know where you are and your status (injured, not injured, etc.) when you have moved to someplace safer.
If your office, school, work location, etc. has emergency assembly areas – use them when you are evacuating – even for Active Assailant Attacks. At least that’s the plan. If you escape out the back of the building towards the Assembly Point, and see there are other attackers there – well, then go somewhere else! That may mean back into the building. Every Emergency Action Plan should have multiple emergency assembly areas/points – including contingency ones if the primary ones are unsafe. This is a key element to Crisis Action Planning.
Hide/Deny – Add a layer of Shielding, until you can Escape or the Threat is Ended
Also shorthand for finding a safer place to be, one that provides Cover at best and Concealment at a minimum.
Fight/Defend
This is the tough one. Not something we recommend for people under 18 (K12 schools probably use a different protective methodology for Response by the public to an active assailant attack, such as A.L.I.C.E.). Here’s a really good video from the U.S. Federal Bureau of Investigation (FBI) which sums up “Run, Hide, Fight” (Note: some may find this video disturbing or uncomfortable, watch at your own discretion and liability):
What comes next: More elements of Response and Recovery
Police may still be searching the building, injured and wounded people need to be triaged, treated and possibly transported to hospitals. Investigations needs to start. There may be a friends and family reception center for people to meet up with people who evacuated from the scene. Media will be on-scene. And More.
Now is the time to figure out the second-best places to conceal yourself or use concealment features to hide from an active assailant threat at your location. True, we understand this is not something you really want to have to think about – but just as we recommend to always figure out two different exits from every place you go, you should have a plan for where you would go if you had to run and/or hide as part of of the “Run, Hide, Fight” actions associated with a Lockdown or other incident where you need to protect yourself from harm.
Think of an active assailant (active shooter) like you would a radioactive bomb – you want to get away from it as quickly as possible – increasing the distance between you and the threat. And when you cannot, you will want to use shielding to help protect you, until you can get away.
The best option is to not be there (evacuate!) at all, but sometimes there is not enough time or distance between you and the threat for this to work – so you have to consider hiding (also known as shielding). If you have to hide from a threat, the better option is locations that provide Cover. Cover has physical protective properties that concealment does not.
Having a full cinderblock wall between you and the threat is a form of Cover. Having just a curtain – or even a drywall wall or fabric partition of a cubicle is only Concealment.
Adding Distance, Cover and Concealment to provide safety
What is key about Concealment is that it provides only some protection against the attacker, as long as they cannot find you.
Concealment is better than just being out in the open, but not as good as Cover. When evacuating, stay low and near solid objects that can provide you cover. If you have to stop, put the solid object between you and the assailant.
2017 Las Vegas Concert Shooting – Note that there were very few areas of Concealment, let along Cover, based on height and angle of shooter location. Source: Wall Street Journal
We welcome suggestions on ways to use Concealment and to make this blog post better. Please add them to the chat here. All posts will be moderated/edited for content and applicability. No commercial links or sales, please.
Now is the time to figure out the best places to take cover or use cover, if an active assailant attack comes to your location. True, we understand this is not something you really want to have to think about – but just as we recommend to always figure out two different exits from every place you go, you should have a plan for where you would go if you had to run and/or hide as part of of the “Run, Hide, Fight” actions associated with a Lockdown or other incident where you need to protect yourself from harm.
Having a full cinderblock wall between you and the threat is Cover. Having just a curtain – or even a drywall wall or fabric partition of a cubicle is only Concealment.
Adding Distance, Cover and Concealment to provide safety
What is key about Cover is that it provides protection against the attacker, as well as hides you from the attacker. Cover is solid walls, structures, etc. which cannot be penetrated by bullets, etc. Our suggestions for Safer Rooms, include aspects of Cover.
Concealment is better than just being out in the open, but not as good as Cover. When evacuating, stay low and near solid objects that can provide you cover. If you have to stop, put the solid object between you and the assailant.
2017 Las Vegas Concert Shooting – Note that there was very few areas of Cover, based on height and angle of shooter location. Source: Australian Broadcast Corporation
We welcome suggestions on ways to use Cover and to make this blog post better. Please add them to the chat here. All posts will be moderated/edited for content and applicability. No commercial links or sales, please.
Also known as Emergency Assembly Points, Evacuation Assembly Areas, Emergency Assembly Station, etc.
These are the designated areas (or area) outside of a work facility where people should go, if the building needs to be evacuated. Check in with first-responders or members of your Crisis Action Team. Do not go back into the building until instructed to do so. These locations should be safer than staying inside of the building, during an evacuation incident – your life safety is the top priority. They may be located on-property or off-property, depending on the site selected by your organization’s leadership, facilities management and/or emergency management teams. They may also be marked with a sign – or not – but at a minimum your crisis action plan should include a floor plan/location map which shows where each of these Emergency Assembly Areas (EAA) are located.
Example signage
If there are more than one EAA location, you should be designated to a primary location and a backup one, if possible. A multi-story office building may have multiple EAAs by floor or company or some other method. When you evacuate, go to your primary EAA if possible – what is key is that you check in with the Crisis Action Team or other responders for accountability. There may be further instructions – or even further evacuations or transportation – at that EAA.
If the EAA is unsafe (for example, if it is too close to an ongoing threat in the building, like a fire), go to the alternate EAA. If you have to leave the building due to an active assailant attack, go anywhere that is safer, contact first responders (like 9-1-1) and ask them where to go.
We prefer the term “safer” rather than “safe” – a Safer Room (TM) in an office (or perhaps even a home, school, or other business) is one where people can go to during any shelter-in-place event or incident and they will be saferthan they would be at their normal work/residence/school location. Safer Rooms are not as elaborate or expensive as “Panic Rooms” (although Panic Rooms are generally designed with the same features as Safer Rooms, except for one critical aspect: they usually do not have a second way out – an emergency exit). Safer Rooms should be designed to have some very specific features, which make them more conducive for a number of people to shelter-in-place – or even “conceal” themselves during an active assailant attack (i.e., provide both cover and additional safety, plus the option to escape away from the threat) – all at the same location within a building. One other critical goal for a Safer Room is to be available for all types of sheltering-in-place Hazards – so people know to go to the same place, regardless of the threat that requires a shelter-in-place action. Just as one would use the fire stairways – and not elevators – for a building evacuation due to fire, chemical spill, gas leak, etc., they should utilize Safer Rooms for tornado warnings, blizzards, hail storms, etc. in addition to being the location they should choose if they cannot evacuate safely from an active assailant on-site or to go to, if there is an active shooter on or near their facilities campus (outside of building). There are very real differences between a “Lockdown” – when the active assailant is right there, and a “Secure and Hold” when the threat is nearby. Follow the instructions of emergency management and public safety officials as to what to do, and absent any intelligence (or conflicting intelligence), go with what you determine is best for your own personal safety.
We recommend using a small symbol on a removable magnet to indicate which are the Safer Rooms. This would be known to the staff only (and communicated on demand to visitors, as needed) and should be consistent to all of the work locations so that staff who visit other locations know what to look for. During a Lockdown, if Safer Rooms are used to “Hide” or provide Cover/Concealment, once all the people have evacuated into the Safer Room, the last person takes the symbol magnet off, so that anyone else (like a threat actor) does not know this is a Safer Room. Everyone inside needs to follow their organization’s Lockdown protocols as to when to end the use of the Safer Room and what to do next.
Safer Rooms should:
Have a second way out. This might be a conference room with two doors (ideally an interior one where the doors are in different hallways, leading to building exits). If it is a storage room in the middle of the building, explore if it can be retrofitted/reconstructed with a second exit-only door (no handle on the outside). Make sure to follow all local building codes, including ADA compliance for egress equipment and door sizing. The further you can move yourself and others away from the threat, the better.
Have solid walls and a lockable solid door – so that someone from the outside cannot easily see in or get in. Small windows on the door should have a curtain or some other device to block inward view quickly. This helps provide Concealment.
If possible, have the room built with reenforced walls and confirm with architects/building designers that it is one of the better places to be, in terms of the structural supports of the building against severe weather threats, for example. Have large items to block walls and doors (such as cabinets or tables). This helps provide Cover. Also small items to throw at an attacker (like staplers, trash cans, etc.) if necessary.
Have a light switch to turn off the lights – it helps to have the room number marked on the light switch, so you can let emergency responders know where you are located.
Have at least one working power outlet, power strips, and a number of chargers and cables for cell phones
Have a landline (or VOIP) phone – in case cell service is spotty or poor. This also provides a way for first responders to communicate with you.
Have a laminated signal page with green on one side and red on the other to either slip half-way under the door or post in the exterior window – use only if instructed by your leadership or first responders (via your communications devices, not from someone “shouting out” commands in the hallway) – the green side up (or out) indicates everyone in that room is okay, the red side indicates urgent medical/health emergencies exist in the Safer Room.
Have some bottled water and sweet snacks – people might be in this room for a while and need to take medications or have low blood sugar, etc.
If the room has a window and is on a floor where someone could escape the room through that window, have a device to break the window (a hammer, for example) if the window does not normally open enough on its own to let someone exit. While these rooms are not the best for All-Hazards Safer Rooms, due to the hazards which can come from the window breaking during the threat, they still need to be outfitted to help support a second way out for evacuation.
*Safer Room is a trademark of York Drive, LLC. Used with permission. Barton Dunant can help you design your crisis action plans, make recommendations for Safer Rooms and provides table-top and functional exercises for your organization to test your plans. Learn more about starting a crisis action plan by clicking here.
