LIP – Life Safety, Incident Stabilization and Property Protection.
What is LIP? It’s an acronym for Life Safety, Incident Stabilization and Property Protection – and those three areas – in that order are the top-line Priorities or Objective Categories of any incident response operation. They must always occur, and be prioritized in that order when it comes to creating Strategies and Tactics on the Operation. When you are considering a Mission Assignment, ask yourself: Does it fit this criteria? Are we making sure our team is safe at all times? Remember Responder Life Safety is always the number 1 priority.
While the concept of social reengineering – influencing people to change their behaviors and patterns of action/inaction – is typically applied in the corporate world (think advertising and marketing), it is also a concept applicable to emergency management.
Emergency Managers want people to better prepare themselves for emergencies and disasters. The fact of the matter is, there are not enough rescuers and resources for all the people who need rescuing – especially if some people can rescue themselves. There is also the “reengineering” part – which is changing existing (or non-existent) behaviors – and in the case of Emergency Management it is usually to reprioritize for life safety above incident stabilization, above property/asset protection. For example, the Post-Katrina Emergency Management Reform Act (PKEMRA) and the Pet Evacuation and Transportation Standards Act (PETS) both of 2006, had elements designed to change the way people should evacuate instead of sheltering-in-place because they have pets.
Sometimes it is complex changes in the way government operates which can impact/implement social reengineering, and sometimes it’s simple mantras, such as
The rock band “The Clash” have a song entitled “Should I Stay or Should I Go1” – which is about a relationship between two people. It’s also a quick summary of Emergency Action Planning – should you shelter-in-place or evacuate?
The emergency management answer to this question is “Depends on what the emergency is” – and its possible the answer may be different over time, distance and shielding from the hazard. That means if you are in a house that’s on fire, it’s best to evacuate no doubt, but if it’s a 30-story office building, it might depend on where the fire is, as to what you do next. And it can get more complicated as time and distance from the hazard changes. If you view all hazards like this, you can make the best decisions for your own life safety and help others, too. The priorities should always be in this order: life safety, incident stabilization, and then property/asset protection. If your house is on fire, the fire department will work to rescue you and your pets first, then make sure the fire does not spread to other homes. You will probably notice they are not concerned with getting water on your big screen tv.
Here are the basics we see for the public actions of emergency action planning: Sheltering-In-Place, Evacuation, and Active Assailant (which may combine both depending on time, distance and shielding). And our basic emergency action plan template covers all three, from an all-hazards perspective. Everyone should organize, equip, train, and exercise themselves to all three actions, they are responsible for themselves.
Sheltering-In-Place
Sheltering-In-Place means staying where you are and not evacuating. And the “you” we describe in this post can mean you and your family, you and your co-workers, you and your pets, you and your personal care assistant, etc. You be you – and please take into consideration all the unique aspects of you we may forget to mention specifically. Sheltering-In-Place could mean you moving to a safer room in the building or a safer location in the complex or on the campus – but generally this an easier decision where and when to go, when there is existing Planning, Organization, Equipment, Training, and Exercising associated with this action. We call that a POETE process. Planning means having a plan as to where you would go, knowing what you would need there for an extended stay perhaps, and how you would communicate with others if circumstances of the emergency change (for the better or worse). Organization means knowing who is doing what – who may be needed to help you shelter-in-place and then get you back to “normal”. Equipment, as mentioned before is the stuff you need to shelter-in-place. We call it a “Stay Box”. This can hold everything from food/pet food, medicine, battery-powered cell charger, flashlight, water, change of clothes, sleeping bag, whatever. And this is stuff you need to have everywhere you might shelter-in-place, not just at home. So you will need multiple stay boxes. Training is the process of reviewing the plan, asking questions, taking classes, and attending seminars on personal preparedness (the American Red Cross has these for free, so does FEMA) and asking questions of your leadership at work about emergency preparedness and response. And finally Exercising is the practice, practice, practice that everyone needs to do for emergency action planning. Practice your plan, practice using your equipment, practice with others, and practice some “what ifs” from your training.
Evacuation
Evacuation means leaving where you and not sheltering-in-place. It could mean evacuating the entire building, complex, or campus – or just evacuating to a safer place. For that high-rise building fire, residents on the upper floors may evacuate to a different floor which has more fire protection and/or access to a fire stairwell, for example. Residents with mobility concerns may evacuate to what’s called an Area of Refuge, which is a meeting spot for residents to be further evacuated by the fire department. The building may have a designated Emergency Assembly Point outside, for people to meet together for accountability (where officials help make sure everyone has safely evacuated the building). Here’s the POETE process for Evacuations. It is going to sound somewhat familiar to Sheltering-In-Place. Planning means having a plan as to where you would go now and also the “what-ifs” for if you are able to return or not, knowing what you might need while you wait at the Emergency Assembly Point, and how you would communicate with others if circumstances of the emergency change (for better or worse). Organization means knowing who is doing what – who may be needed to help you evacuate and then get you back to “normal”. Equipment, as mentioned before, is the stuff you need to evacuate. “Need” is the operative word. We call it a “Go Bag”. This can hold everything from food, medicine, battery-powered cell charger, electric wheelchair charging devices, flashlight, small amount of water, glow stick, whatever. And as with the Stay Box, you need a Go Bag in different places, too. A purse or backpack you carry with you everywhere will do. Training is the process of reviewing the plan, asking questions, taking classes, and attending seminars on personal preparedness (the American Red Cross has these for free, so does FEMA) and asking questions of your leadership at work about emergency preparedness and response. And finally Exercising is the practice, practice, practice that everyone needs to do for emergency action planning. Practice your plan, practice using your equipment, practice with others, and practice some “what ifs” from your training.
Note that the steps and actions for Evacuations should sound familiar to those for Sheltering-In-Place. We designed this to be similar, for muscle-memory and consistency. There is a lot of preparing work involved for both, but it will be worth it. The point is to act on your plan, and not to panic. The last set of emergency response actions we have put into our all-hazards Emergency Action Plan template is associated with an Active Assailant. This one can combine elements of both sheltering-in-place and evacuation, plus one more which is really difficult to plan for: possibly fighting for your life.
Active Assailant
Active Assailant means the threat to your life is right there. Time has run out, and maybe so has distance and shielding. Most people have heard of the Active Shooter threat and maybe even phrases such as “Run, Hide, or Fight” or “Avoid, Deny, Defend”. You see on the news: schools and office buildings going into “lockdown” when there is a nearby threat. This is mis-labeled in our opinion. Those sites where the threat is not (yet) right there are in a “Secure and Hold” alert phase (secure everyone in, hold them in a safer place, and lock out everyone else until the threat has cleared) – they want to put distance and shielding between themselves and the threat. A site can be designed in a “Secure and Hold” phase for other reasons besides an Active Assailant (chemical hazard, infectious disease threat, A secure and hold is the exact opposite of an evacuation, as far as what the public should be thinking.
A Lockdown now means something more.
We define a “Lockdown” as the combined set of response actions by the public to a direct active assailant. If the threat is coming through the front door and you can escape safely through the back door – then it is an evacuation for you. If you are nearer the front with no immediate clear/safe way out, then you may choose to shelter-in-place hopefully in a Safer(TM) Room, until you can – and should – evacuate. And if the threat is right upon you – you will need to fight for your own life using any means necessary. It is always better to quickly (time) put as much as much space (distance) between you and the threat, as safely as you can (shielding).
We believe the active assailant threat/hazard is very complex and can include other threats besides a shooter. The actions of first responders are turned upside down for active assailant attacks: fire and emergency medical services are held back until the “scene is safe” and police are reprioritized to “neutralize the threat” above saving the lives of people who have been injured. Here’s the POETE: Plan your actions towards the “Avoid, Deny, Defend” model – you need to incorporate your sheltering-in-place and evacuation planning wherever you are, plus plan to switch actions if necessary. There is no sequential order to “Avoid, Deny, Defend” – nor is there a limit to how many different actions you can take. Focus on life safety – yours. When it comes to Organization, you are pretty much on your own. If you can safely help others, please do so. Please also follow the instructions of first responders to the letter. The fact is for them, unless proven otherwise, you are a threat, too. When you are evacuating from an active assailant incident, the police may not know if you are part of the ongoing threat or an evacuee. The Equipment is not much more than what you already have with a go bag and a stay box. When you are barricading yourself in a safer room, you need to consider how to keep the door closed and possibly how you might have to break a window to escape, or to signal for help. You may also need a bleeding control kit to help with injuries. There is a ton of Training on active assailant for the public, out there. Find some yourself or ask your organization’s leadership to host a class or two. Same for Exercises. We recommend a stair-stepped approach – start with a “Hide” table-top exercise where you discuss what everyone should do for the sheltering-in-place actions, then do a Hide game (internally, where you do not involve any calls to 9-1-1 or any outside responders), then do a Hide functional exercise where you do invite the first responders to help evaluate your exercise (and also gain knowledge of your site and the physical layout, security features, etc.). Any and all Active Assailant exercises of any kind must be scheduled in advance, as well as announced to your staff and visitors, and will include after-action discussions to make sure folks feel more comfortable and confident after each type of exercise. For many, just practicing this exercise in any way, will be extremely stressful. Failing to coordinate with local officials, keeping your own team in the loop, etc. will have significant risks itself. Barton Dunant can help your organization assess their emergency action plans and design an exercise series around active assailant threats, on a fee basis.
And by the way, people should think of wildfires and hurricanes as active assailants, too. You may start out sheltering-in-place, but then the circumstances change – your time, distance and shielding from the threat become compromised – and its time to evacuate. Or be rescued if the first responders can get to you. In active assailant threats, you are first-and-foremost responsible for your own life-safety. Do what you have to do to survive – you will have little control over the incident stabilization aspects of this type of threat – and put the life safety of yourself and your family above your property protection or anything else. Stuff and buildings can always be replaced. People cannot.
These are the basics of Emergency Action Plans – and you can download a template at our website, which you can use for your home, your job, even your vacation plans elsewhere. And please let us know any questions or thoughts you may have on all of this – we welcome feedback from our clients and are always looking to improve what we offer. Should you stay or should you go, when there is an emergency? Hopefully now you have a better understanding of how simple the answer is, and also how complex it can be, too.
Michael Prasad, MA, CEM®
Senior Research Analyst
Barton Dunant – Emergency Management Training and Consulting.
This is a term from the U.S. military – first noted by Anderson in Stars & Stripes in 2004 and then further explored by Miller in 2012 for his senior service college fellowship at the U.S. Army War College. The term is a description of micro-management from afar and by politicians – in these cases, from the White House directly to the line command of a military operation.
In Emergency Management, the equivalent could also be the White House (or a state’s/territory’s governor’s office) reaching down to a DR’s Command and Control (possibly through FEMA’s National Response Coordination Center (NRCC), the State Emergency Operations Center, or now by video link from anywhere), instead of only receiving updates and intelligence via the External Relations function. This is not like MAC Groups or Unified Command, where there are Emergency Management-qualified people in an offsite advisory role, helping those who are in charge. With politicians, there may be a question of their prioritization of Life Safety over Incident Stabilization over Property/Asset Protection.
FEMA itself has this challenge when it comes to supporting the states/territories/tribal nations. Each FEMA Region has a Regional Response Coordination Center (RRCC) and also imbeds FEMA Incident Management Teams with the local jurisdiction to be closer to the incident site(s). There are times when the NRCC can act like a 6,000 mile screwdriver, to the RRCC and their support provided locally.
The After-Action Report/Improvement Plan (AAR/IP) is a document that organizations (including FEMA) use to assess their ability to meet both real-world incidents and exercise objectives and capabilities. The AAR/IP generally has two components:
After-Action Report (AAR): Captures observations of an exercise and makes recommendations for post-exercise improvements.
Improvement Plan (IP): Identifies specific corrective actions and assigns them to responsible parties.
The AAR/IP also aligns incident command (or exercise) objectives with preparedness doctrine and related frameworks and guidance. It includes information required for preparedness reporting and trend analysis.
The World Health Organization (WHO) maintains a database of international public health (i.e., equivalent for U.S. ESF#8) after-action reports at this site.
Some of the After Action Reports (AARs) on major incidents or GO/NGO councils/committees, we have found on the web.
Do you know of any others available as OSINT (Open Source Intelligence – items available – TLP: Green/Clear- to the public, not classified or sensitive)? Please add in the comments. If any of these links are broken, please let us know via an e-mail to [email protected].
Table of After-Action Reports (AARs) – if any of these links are broken, please let us know.
There are also pracademic perspectives on some of the AARs we have noted above. We have provided links to those as well. If you know of others – please let us know!
After Action Reporting is a formal process conducted after both real-world incidents and exercises. It involves an independent review of the actions and gaps (strengths and opportunities) of those groups responding, based on their plans. Barton Dunant can help your organization with independent After Action Reporting – drop us a line to learn more.
We believe the worst-case scenario disaster which will fall on Emergency Management is the Electro-Magnetic Pulse wave (EMP) from a low-atmospheric detonation of a nuclear device over the United States. This will have catastrophic impacts to the continuity of operations / continuity of government (COOP/COG) for emergency management (EM). It is the maximum of maximums (MOM).
We have built an advanced table-top exercise for this scenario and welcome your thoughts and comments. It will be usable by single entries, any level jurisdiction, all the way up through an international multi-player exercise. The concept is the same: When you have no comms and no modern transportation and of course no electricity nor electronic devices, what do you expect/order your staff to do next? Take care of themselves and their families or do everything they can to get to work/stay at work? And do they know now what they are supposed to do if such a scenario should occur?
Three words you never want to hear in a row – but ones you need to plan forwell in advance. We believe the phase “Lockdown” should be a universal call to action – which has different actions, depending on where you are and where the threat is. Similar to a fire or chemical spill within (or near) a commercial high-rise office building, there may be some places where it is safer to shelter-in-place and some where it is safer to evacuate. But unlike those and any other threats – there may be a moment/place/time when you are confronted directly by the active assailant – with “no where to run and no where to hide” (apologies to Holland, Dozier and Holland) – and you will have to fight to defend your own life and maybe the lives of others.
A Lockdown should be different from a Secure and Hold. A Secure and Hold order is when the Active Assailant is near your location, but not (yet!) a direct threat to you. When a building or a school goes on Secure and Hold, it should mean that the threat is not on campus and no one goes in and no one comes out (except as authorized by emergency services). Secure and Hold orders can become Lockdowns, when the threat does move to your building. This may happen very quickly – and if it does, try to get the words “Lockdown, Lockdown, Lockdown” out over public address systems, text messages targeted to people in the building, etc. Also any info which can help identify the attacker(s); the more intelligence provided, the better – such has what the attacker(s) look like, weapons, which entrance they came in, where they might be now, etc. We encourage the three calls of the word “Lockdown!” back to back, this way it is very distinctive, and in case someone missed hearing the word “Lockdown” the first time. And by the way, there is no reason not to keep announcing where the threat is located – only if you are in a safe place to do so. Offsite security/law enforcement teams who have access to your public address system and/or text alert system can perform this as well. Note, we do recommend that cell phones be put on silent when you are temporarily ‘hiding’ or denying access, in a safer location – and those folks should remain quiet to avoid directing the attacker to their location.
Think of this threat, like it’s radioactive. If you heard there was a briefcase full of radioactive material in the lobby of your building, you would want to get as far away from it, as quickly as possible. So, for two of the three actions (evacuation and sheltering in place) associated with a Lockdown, look to limit your time near the threat, increase the distance from the threat, and use shielding from the threat:
Run/Avoid – Add Time and Distance from the Threat
This is shorthand for evacuate away from the threat to a safer area until the situation is ended; and let your team or emergency responders know of your location and status. That includes a very important checklist point to “running/avoiding” away from an Active Assailant (or any other threat where you are evacuating): Accountability. Please let your supervisor, or emergency action team leader know where you are and your status (injured, not injured, etc.) when you have moved to someplace safer.
If your office, school, work location, etc. has emergency assembly areas – use them when you are evacuating – even for Active Assailant Attacks. At least that’s the plan. If you escape out the back of the building towards the Assembly Point, and see there are other attackers there – well, then go somewhere else! That may mean back into the building. Every Emergency Action Plan should have multiple emergency assembly areas/points – including contingency ones if the primary ones are unsafe. This is a key element to Crisis Action Planning.
Hide/Deny – Add a layer of Shielding, until you can Escape or the Threat is Ended
Also shorthand for finding a safer place to be, one that provides Cover at best and Concealment at a minimum.
Fight/Defend
This is the tough one. Not something we recommend for people under 18 (K12 schools probably use a different protective methodology for Response by the public to an active assailant attack, such as A.L.I.C.E.). Here’s a really good video from the U.S. Federal Bureau of Investigation (FBI) which sums up “Run, Hide, Fight” (Note: some may find this video disturbing or uncomfortable, watch at your own discretion and liability):
What comes next: More elements of Response and Recovery
Police may still be searching the building, injured and wounded people need to be triaged, treated and possibly transported to hospitals. Investigations needs to start. There may be a friends and family reception center for people to meet up with people who evacuated from the scene. Media will be on-scene. And More.
Now is the time to figure out the second-best places to conceal yourself or use concealment features to hide from an active assailant threat at your location. True, we understand this is not something you really want to have to think about – but just as we recommend to always figure out two different exits from every place you go, you should have a plan for where you would go if you had to run and/or hide as part of of the “Run, Hide, Fight” actions associated with a Lockdown or other incident where you need to protect yourself from harm.
Think of an active assailant (active shooter) like you would a radioactive bomb – you want to get away from it as quickly as possible – increasing the distance between you and the threat. And when you cannot, you will want to use shielding to help protect you, until you can get away.
The best option is to not be there (evacuate!) at all, but sometimes there is not enough time or distance between you and the threat for this to work – so you have to consider hiding (also known as shielding). If you have to hide from a threat, the better option is locations that provide Cover. Cover has physical protective properties that concealment does not.
Having a full cinderblock wall between you and the threat is a form of Cover. Having just a curtain – or even a drywall wall or fabric partition of a cubicle is only Concealment.
Adding Distance, Cover and Concealment to provide safety
What is key about Concealment is that it provides only some protection against the attacker, as long as they cannot find you.
Concealment is better than just being out in the open, but not as good as Cover. When evacuating, stay low and near solid objects that can provide you cover. If you have to stop, put the solid object between you and the assailant.
2017 Las Vegas Concert Shooting – Note that there were very few areas of Concealment, let along Cover, based on height and angle of shooter location. Source: Wall Street Journal
We welcome suggestions on ways to use Concealment and to make this blog post better. Please add them to the chat here. All posts will be moderated/edited for content and applicability. No commercial links or sales, please.
Also known as Emergency Assembly Points, Evacuation Assembly Areas, Emergency Assembly Station, etc.
These are the designated areas (or area) outside of a work facility where people should go, if the building needs to be evacuated. Check in with first-responders or members of your Crisis Action Team. Do not go back into the building until instructed to do so. These locations should be safer than staying inside of the building, during an evacuation incident – your life safety is the top priority. They may be located on-property or off-property, depending on the site selected by your organization’s leadership, facilities management and/or emergency management teams. They may also be marked with a sign – or not – but at a minimum your crisis action plan should include a floor plan/location map which shows where each of these Emergency Assembly Areas (EAA) are located.
Example signage
If there are more than one EAA location, you should be designated to a primary location and a backup one, if possible. A multi-story office building may have multiple EAAs by floor or company or some other method. When you evacuate, go to your primary EAA if possible – what is key is that you check in with the Crisis Action Team or other responders for accountability. There may be further instructions – or even further evacuations or transportation – at that EAA.
If the EAA is unsafe (for example, if it is too close to an ongoing threat in the building, like a fire), go to the alternate EAA. If you have to leave the building due to an active assailant attack, go anywhere that is safer, contact first responders (like 9-1-1) and ask them where to go.
We prefer the term “safer” rather than “safe” – a Safer Room (TM) in an office (or perhaps even a home, school, or other business) is one where people can go to during any shelter-in-place event or incident and they will be saferthan they would be at their normal work/residence/school location. Safer Rooms are not as elaborate or expensive as “Panic Rooms” (although Panic Rooms are generally designed with the same features as Safer Rooms, except for one critical aspect: they usually do not have a second way out – an emergency exit). Safer Rooms should be designed to have some very specific features, which make them more conducive for a number of people to shelter-in-place – or even “conceal” themselves during an active assailant attack (i.e., provide both cover and additional safety, plus the option to escape away from the threat) – all at the same location within a building. One other critical goal for a Safer Room is to be available for all types of sheltering-in-place Hazards – so people know to go to the same place, regardless of the threat that requires a shelter-in-place action. Just as one would use the fire stairways – and not elevators – for a building evacuation due to fire, chemical spill, gas leak, etc., they should utilize Safer Rooms for tornado warnings, blizzards, hail storms, etc. in addition to being the location they should choose if they cannot evacuate safely from an active assailant on-site or to go to, if there is an active shooter on or near their facilities campus (outside of building). There are very real differences between a “Lockdown” – when the active assailant is right there, and a “Secure and Hold” when the threat is nearby. Follow the instructions of emergency management and public safety officials as to what to do, and absent any intelligence (or conflicting intelligence), go with what you determine is best for your own personal safety.
We recommend using a small symbol on a removable magnet to indicate which are the Safer Rooms. This would be known to the staff only (and communicated on demand to visitors, as needed) and should be consistent to all of the work locations so that staff who visit other locations know what to look for. During a Lockdown, if Safer Rooms are used to “Hide” or provide Cover/Concealment, once all the people have evacuated into the Safer Room, the last person takes the symbol magnet off, so that anyone else (like a threat actor) does not know this is a Safer Room. Everyone inside needs to follow their organization’s Lockdown protocols as to when to end the use of the Safer Room and what to do next.
Safer Rooms should:
Have a second way out. This might be a conference room with two doors (ideally an interior one where the doors are in different hallways, leading to building exits). If it is a storage room in the middle of the building, explore if it can be retrofitted/reconstructed with a second exit-only door (no handle on the outside). Make sure to follow all local building codes, including ADA compliance for egress equipment and door sizing. The further you can move yourself and others away from the threat, the better.
Have solid walls and a lockable solid door – so that someone from the outside cannot easily see in or get in. Small windows on the door should have a curtain or some other device to block inward view quickly. This helps provide Concealment.
If possible, have the room built with reenforced walls and confirm with architects/building designers that it is one of the better places to be, in terms of the structural supports of the building against severe weather threats, for example. Have large items to block walls and doors (such as cabinets or tables). This helps provide Cover. Also small items to throw at an attacker (like staplers, trash cans, etc.) if necessary.
Have a light switch to turn off the lights – it helps to have the room number marked on the light switch, so you can let emergency responders know where you are located.
Have at least one working power outlet, power strips, and a number of chargers and cables for cell phones
Have a landline (or VOIP) phone – in case cell service is spotty or poor. This also provides a way for first responders to communicate with you.
Have a laminated signal page with green on one side and red on the other to either slip half-way under the door or post in the exterior window – use only if instructed by your leadership or first responders (via your communications devices, not from someone “shouting out” commands in the hallway) – the green side up (or out) indicates everyone in that room is okay, the red side indicates urgent medical/health emergencies exist in the Safer Room.
Have some bottled water and sweet snacks – people might be in this room for a while and need to take medications or have low blood sugar, etc.
If the room has a window and is on a floor where someone could escape the room through that window, have a device to break the window (a hammer, for example) if the window does not normally open enough on its own to let someone exit. While these rooms are not the best for All-Hazards Safer Rooms, due to the hazards which can come from the window breaking during the threat, they still need to be outfitted to help support a second way out for evacuation.
*Safer Room is a trademark of York Drive, LLC. Used with permission. Barton Dunant can help you design your crisis action plans, make recommendations for Safer Rooms and provides table-top and functional exercises for your organization to test your plans. Learn more about starting a crisis action plan by clicking here.
What is LIP? It’s an acronym for Life Safety, Incident Stabilization and Property Protection – and those three areas – in that order are the top-line Priorities or Objective Categories of any incident response operation. They must always occur, and be prioritized in that order when it comes to creating Strategies and Tactics on the Operation. When you are considering a Mission Assignment, ask yourself: Does it fit this criteria? Are we making sure our team is safe at all times? Remember Responder Life Safety is always the number 1 priority.
And for our healthcare professional folks – our “LIP” is different from the LIP you may be familiar with: Licensed Independent Practitioners.
