518 – Response to Active Attack Events

I. Purpose

The purpose of this policy is to establish the guidelines for personnel responding to the scene of an active attack or terrorist act within Harris County.

II. Definitions

Casualty Collection Point (CCP): A location for gathering victims that provides protection in moving from the warm zone for triage/treatment/transport. There may be multiple CCP’s based on the size of the event, the number of victims, and the location of victims.

Contact Deputy or Team: The first Deputy/Deputies at the scene of an active shooter/active attack event who are tasked with locating the suspect(s) and stopping the threat.

Tactical Speed: This speed is a medium-paced, very smooth, and quiet walk. Tactical speed is used when a contact team is covering the last few meters before arriving at the attacker’s assumed location. This is also the speed used by responders when they begin a systematic search of the location if there is no driving force present to drive them to the attacker’s location.

Direct-to-threat Speed: This speed is between a fast walk and a jog. It is used inside the attack site when responders have reason to believe that active threat/killing is taking place and they have intelligence directing them toward the attacker’s location.

Incident Commander (IC): The individual responsible for all incident activities, including the development of strategies and tactics. The IC has overall authority and responsibility for conducting incident operations and is responsible for the management of all operations at the incident site. Responsibilities of the IC may be assumed by any qualified deputy, ranging from the deputy handling the original call to the Sheriff, depending on the size, scope, and complexity of the event.

LCAN: Location – of the individual giving the information;
Condition – what is going on around you, what do you hear;
Actions – what are you about to do;
Needs – what do you need additional officers to do or EMS/Fire, etc.

Rescue Task Force (RTF): Comprised of Deputies and Fire/EMS personnel deployed together. An RTF will provide initial treatment and triage victims in the warm zone. Deputies are tasked with protection for RTF members and will not separate from them. RTF normally consists of two (2) Law Enforcement Officers and two (2) Fire or EMS personnel.

Notification Center – The notification center provides human and technological resources to reconnect individuals as quickly as possible following a disaster or incident.

Staging Area: An area or location near the incident, in the cold zone, where outside resources respond and are quickly inventoried for utilization and assignment at the incident. There may be more than one staging area per incident.

Unified Command (UC): is a process that brings together the Incident Commanders of multiple agencies involved in an incident to coordinate a response.

Warm Corridor: An area or pathway in the warm zone that is protected by law enforcement, allowing for freedom of movement for RTF members.

Warm Zone: An area where law enforcement has either cleared or isolated the threat to a level of minimal or mitigated risk. It can be considered clear, but not secure. This is where the RTF will deploy, with protection, to treat victims.

III. Policy

Law Enforcement personnel will respond to and control the scene of an Active Attack/Active Shooter event, which occurs within unincorporated areas of Harris County.
A. Priority of Life:

1. Civilians, Injured Victims, Hostages
2. Fire/EMS and other responders
3. Law Enforcement
4. Suspect

*Property is not a consideration.

B. Concepts and Principles

Safe, effective responses to active threats are based on the concepts and principles listed below. The Contact Deputy/Team while operating in tactical speed should:

1. Stay together as much as possible and enter the involved structure quickly.
2. Maximize communication by staying in close contact with other first responders.
3. Maximize threat coverage by maintaining tactical readiness against all threats that may appear around responders.
4. Visually search the affected area using 540 degrees of coverage around and above the team.
5. Evaluate rooms from the threshold (commonly referred to as threshold evaluation/slicing the pie).
6. Differentiate between Tactical and Direct-to-Threat Speeds and use the appropriate speed for the circumstances.
7. Use cover-contact principles when taking suspects into custody.
8. If the situation allows, establish a Casualty Collection Point and begin emergency medical care after security has been established.

IV. Procedures

A. Law Enforcement Response

1. Deputies and Supervisors will immediately respond to the scene.
2. Upon arrival if there is a driving force in the incident (i.e. Gunfire indicating injury, or actionable intelligence on the attacker(s) pointing to an immediate need to protect life) the Contact Deputy/Team WILL immediately and without hesitation address the situation by closing in the threat and attempting to stop it. A solo/single deputy response may be required under the circumstances.

a. The Contact Deputy/Team will have many responsibilities. How that deputy/team initially deploys and communicates can have a significant impact in the manner that follows on how responders deploy as well as the overall outcome of the event.

b. If there are no driving forces or actionable intelligence, the Contact Deputy/Team may wait for additional deputies. Such a situation might include a barricaded suspect with no innocent persons immediately in jeopardy.

c. The Contact Deputy/Team will establish incident command and provide an LCAN report.

3. Once adequate personnel have addressed the threat, the next available deputy and/or supervisor will establish a Unified Command Post and establish a staging location for regional partners. The supervisor will broadcast the staging location via radio.
4. In order to save as many lives as possible, Unified Command will form RTFs and deploy them to the warm zone to begin treatment of the injured and begin rapid casualty evacuation.
5. A deputy or supervisor on the scene will make contact with the property representative to assess the situation as soon as possible.
6. The Incident Commander will contact the Emergency Dispatch Center and request a “TAC” channel be reserved to coordinate all radio communications.
7. Deputies will ensure the safety of all victims and witnesses and make arrangements for any injured parties to receive medical treatment or transportation to a local hospital.
8. A determination will be made by the Unified Command Post to transport or confine all victims and witnesses in an on-site building or at a location that is off-site.
9. Once the crime scene has been secured, three (3) secured perimeter areas should be established as indicated below:

a. Inner Crime Scene Perimeter: Patrol Bureau personnel will seal off the actual area where the crime took place with crime scene tape.

i. If necessary, seal off the entire site or building by designating one door to be the entrance and exit point.

ii. A deputy will be posted at the door and record the names of any individual who enters the crime scene.

b. Outer “Police Only” Perimeter: This area will also be taped off providing a large enough area for the Command Post and law enforcement officers to stage and deploy the necessary personnel and equipment to complete the investigation.

c. Media Perimeter: This area should be set up away from the Outer Perimeter. The Sheriff’s Office Media Liaison will brief the media at this location at regular intervals.

B. Special Enforcement Bureau

1. Mobile Command will send a unit to the primary scene as well as the Notification Center. Location will be given while enroute. Equipment: two (2) Semi Tractor Trailers and two (2) mobile generators.
2. The SWAT and Bomb Unit will self-deploy and stage unless they are part of the initial response.
3. The Active Attack / Complex Coordinated Terroristic Attack (CCTA) Coordinator will deploy to all active attack and mass casualty events to provide guidance to the Unified Command.
4. The K9 Unit will deploy Explosives Detection K9s to the staging if they are needed to sweep the area for explosives.

C. Criminal Investigations Bureau Response/Homicide Division:

1. Upon notification of the above-described scenario, a sufficient number of detectives as determined by the assigned CIB supervisor will respond immediately to the Notification Center and the main scene.
2. The lead detective with Homicide will contact the District Attorney’s Office and request the presence of an Assistant District Attorney (Prosecutor) in order to coordinate our legal efforts with their office.

D. Special Investigations Bureau/Crime Scene Unit:

1. An adequate number of Crime Scene Unit Investigators as determined by the assigned CIB supervisor will respond to staging.
2. The Crime Scene Unit Supervisor will coordinate efforts with Patrol Bureau Supervisors, Criminal Investigations Bureau Supervisors, and personnel from the Harris County Institute of Forensic Sciences at the scene to effectively conduct the crime scene investigation in an efficient and timely manner.

E. High Tech Crime Unit (HTCU)

The HTCU will respond to the Notification Center to assist in the crime scene investigation.

F. Criminal Investigations Bureau/Child Abuse Unit

Detectives will respond to local hospitals to maintain security and obtain witness/victim information.

G. Criminal Investigations Bureau / Warrants

The VIPER/VCAT will respond to the Notification Center to provide security.

H. Neighborhood Policing Division / Behavioral Health Division

The Crisis Intervention Response Teams and the Behavioral Health Division will deploy to the Notification Center.

I. Support Services Bureau

a. Provide security at the Notification Center.

b. Control traffic in and around the center.

c. Coordinate Transportation for witnesses and survivors to the Notification Center.

J. Watch Command

1. Upon notification of an Active Attack, Watch Command will immediately send teletype to the Region.

a. Advise responding units to use MA-1 for incident communications.

b. Combine MA-1 and the primary radio channel of the impacted district.

c. Re-direct normal traffic to district secondary (back channel).

2. Instruct responding units to report to staging for assignments.

K. Executive Response:

1. The HCSO Media Liaison will immediately respond to the scene and conduct all media-related briefings within the designated media perimeter. He or she will be available at the Command Post when not conducting a news briefing.
2. Upon conferring with the Homicide Commander, the HCSO Media Liaison will only release approved information regarding HCSO matters, the investigation, or suspect information.
3. A representative of the property will answer questions regarding facility matters, staff/building occupants, and other pertinent information.

V. Annexes

See appendixes for roles and responsibilities.

Appendix A – Supervisors
Appendix B – Notification Center
Appendix C – Media/Outer Perimeter Center
Appendix D – Patrol Support Services Bureau
Appendix E – Watch Command

Revision:

This policy has been revised on the below listed dates:
March 1, 2025
March 4, 2025 (Technical Changes)

March 5, 2025 (Technical Changes)

March 6, 2025 (Technical Changes)

Appendix A (Supervisors)

The first arriving supervisor plays a vital role in the success of an Active Attack Event. Once sufficient personnel have entered the structure, a supervisor will conduct the following:

1. Establish a perimeter to contain the incident.
2. Designate a Command Post and Staging Area.
3. Provide notification of the location over the radio and to Watch Command and instruct all additional responding officers to check in at the staging area.
4. Serve as the scene supervisor and primary point of contact for the incident until relieved by a supervisor of superior rank.
5. Delegate additional tasks to follow on patrol sergeants and other personnel arriving.
6. Brief Watch Command as the incident progresses and start notifications.

Appendix B (Notification Center)

A supervisor will be assigned to any Notification Center or Staging Areas. More than one supervisor may be required depending on the scope of the incident. The supervisor of these areas will:

1. Record all law enforcement or EMS personnel entering and leaving.
2. Provide security for these areas as required.
3. Brief Watch Command.

Appendix C (Media/Outer Perimeter Activities)

A supervisor will be assigned to establish and control the outer perimeter once the vital functions of the incident on the inner perimeters have adequate supervision. The supervisor will:

1. Serve as a “gatekeeper” to ensure everyone, including responders, entering this perimeter is properly authorized, identified, and recorded.
2. Ensure responders on the scene are adequately identified and logged.
3. Record the location and details of any designated Reunification Centers and brief Watch Command and other supervisors on the scene of this.

Appendix D (Patrol Support Services Bureau)

A. During an Active Attack, the Support Services Bureau’s primary responsibility is to:

1. Establish and provide security at the notification center or staging area.

a. For school attacks, proceed to the designated notification center.

b. For non-school attacks, proceed to the incident staging location. The size and scope of the incident will determine if an off-site notification center is necessary or if adjacent businesses are sufficient.

2. To control traffic around the notification center.
3. Procure buses for witnesses/survivor transports to the notification center and provide security during transport.
4. Brief Watch Command.

Deputies and supervisors near the attack location should self-dispatch themselves to the event origin and assist in eliminating the threat in full uniform, wearing their soft body armor and assigned rifle plates. Rifle-certified employees should deploy their patrol rifles.

B. Upon Notification of an Active Attack (Deputies)

1. Deputies should confirm the location and proceed to the notification or staging area. Upon arrival:

a. Announce themselves onsite and make a note of their location/address and assignment.

b. Control the scene until a supervisor relieves them.

c. Control entrances/exits to the location.

d. Establish the location of the Notification Center Command Post.

e. Establish EMS and LE parking locations.

f. Establish where the witnesses/survivors will be staged.

g. Establish where families will be staged.

h. Provide security on transport buses.

2. Count evacuees entering bus.
3. Broadcast the number of evacuees being transferred and the bus number when in route.
4. Notify evacuees (see transport statement).
5. Broadcast number when arrived/delivered.

a. Identify site restrooms or request portables.

b. Brief Watch Command.

C. Upon notification of an Active Attack (Supervisors)

1. Supervisors should confirm the location and proceed to the reunification or staging area. Upon arrival a supervisor should:

a. Announce themselves on scene and make a note of their location/address and assignment.

b. Take control and ensure all deputy tasks above have been completed.

c. A supervisor assigned to a reunification center should use their vehicle as a security command post.

2. Monitor both the district primary and Central radio channels (reunification center communications should be reserved for Central so as not to interrupt the primary mission).
3. Assign a deputy to assist the supervisor and record pertinent information (by making rosters and lists, i.e. “scribing” as needed).
4. Contact HCSO Transportation and acquire two buses (transports should be broadcasted on the primary channel for dispatch recording).
5. Coordinate with Unified Command and determine if more buses are required and when to begin transport (contact local ISD and/or Metro as necessary for more buses).
6. Physically number buses (for example: use white shoe polish on the windshield) for safety and accountability and record the number of individuals transported in each bus.
7. Assign deputies to security on buses, preferably two (2) deputies per bus.
8. Make arrangements for water and possibly food delivery for deputies and civilians.
9. Additional supervisors should be constantly monitoring the safety and well-being of involved deputies and civilians (remind all to stay hydrated and seek EMS as necessary).
10. Brief Watch Command.

Appendix E (Watch Command)

Upon notification of an Active Attack, Watch Command will immediately send a teletype, through the Message Center, to the Region. Watch Command will:

1. Combine MA-1 and the primary radio channel of the impacted district.
2. Advise responding units to use MA-1 for communications
3. Ensure that normal traffic will be moved to the district secondary channel, i.e. “back channel”.
4. Instruct responding units to report to staging for assignments.
5. Execute all required notifications (command staff, etc.)

Was this policy helpful?

0 0

How can we improve this policy?

Submit