By David Pounder
The latest active shooter report from the FBI provides data to support what may have been easily observed – over the past five years, active shooter incidents – a subset of hostile events – are on the rise. The FBI “Active Shooter Incidents in the United States; 2021” report showed that since 2017, there has been an almost 100% increase in the number of incidents, and across industry. The last month, and even just this first weekend of June, have only further reinforced that no place is immune to this type of hostile event. Therefore, it is important for organizations to pull out data from this report to help understand their respective threat and risk environment and incorporate that into their employee training and their preparedness and security programs.
For the period 2017–2021, the FBI “Active Shooter Incidents in the United States; 2021” report revealed active shooter incident data is on an upward trend. The number of active shooter incidents identified in 2021 represents a 52.5% increase from 2020 and a 96.8% increase from 2017. This translates to 31 incidents in 2017 to 40 in 2020 and ultimately 61 in 2021. In and of itself, this is a worrisome trend, but a further breakdown of the data highlights additional data that could be useful for organizations. This data can help inform the risk as well as provide insight into some indicators that an organization may develop internal metrics and reporting around to identify potential high-risk behaviors and indicators to disrupt incidents before they occur. Some key areas include:
- Attacks are happening across industry, with over half of the 2021 incidents occurring in commerce locations.
- Data is broken down by calendar month, day, and time of day. Not surprisingly, the overwhelming majority occurs during what would be considered normal business hours.
- For 2021, the threat actor outcomes – 98% resulted in either apprehension or death of the threat actorwhich is expected considering the hostile events attack cycle planning and preparedness (see below).
- This data is helpful, but organizations are encouraged not to simply make decisions based on demographics. This information should be followed up with discussions and training on behaviors and suspicious activities.
Former Department of Homeland Security official (and Faith-Based ISAO Advisory Board member), William Flynn recently noted that “Unfortunately the number of these events continues to trend in a very disturbing upward direction.” Flynn now serves as the President of Garda Risk Management and is the co-founder of The Power of Preparedness. He noted that a multitude of stressors over the past two years have run up against an existing atmosphere of political divisiveness and an increase in conspiracy-theory extremism. Flynn further commented that for some organizations, what it means is an increasingly urgent need not only to develop an active-assailant response plan but also to collaborate proactively with local law enforcement and others.
One element that is missing from this FBI report, and is an important element for organizations to understand, is the motive or the triggering action that contributed to the attack. A triggering act is the event that caused the threat actor to cross the line and act. This act has been addressed in the Hostile Events Attack Cycle (HEAC) materials. And while not the purpose of this report, organizations are encouraged to review the HEAC white paper and associated references to understand indicators and behaviors for a hostile event.
Overall, 2021 saw the highest number of deaths since 2017, and a 171.1% increase from 2020. The increase from 2020 could be misleading due to the COVID restrictions that caused many organizations to close down for a large period of time, or transition to remote work. Even so, 2021 deaths were above the average (92.3%) for the period of 2017–2020. The 2017 number is somewhat of an outlier and higher largely as result of the Route 91 Harvest Festival shooting that resulted in 56 killed and 489 wounded.
| 2017 | 2018 | 2019 | 2020 | 2021 |
| 143 killed 591 wounded | 86 killed139 wounded | 102 killed156 wounded | 38 killed126 wounded | 103 killed140 wounded |
Month by Month. The data does not appear to reveal any real correlation between the month an incident occurred and motivation. December had the fewest number of incidents, whereas one may think that number could be higher given increased shopping activity, and, similar to 2020, June had the highest number of incidents. The FBI report also noted that when compared to 2020, April saw the biggest increase in incidents (from zero to 10).
| January | February | March | April | May | June | July | August | September | October | November | December |
| 3 | 2 | 5 | 10 | 5 | 12 | 4 | 7 | 6 | 2 | 4 | 1 |
Days of the Week. Unlike 2020, Active Shooter incidents occurred every day of the week. Like 2020, Saturdays saw the most incidents.
| Sunday | Monday | Tuesday | Wednesday | Thursday | Friday | Saturday |
| 6 | 7 | 12 | 7 | 11 | 4 | 14 |
Time of Day. Data shows that an active shooter incident is more likely to occur (63.9%) between 6:00 a.m. and 5:59 p.m. A key consideration for this is because daylight hours would most likely have more targets for the threat actor to engage.
| 12 am – 5:59 am | 6 am – 11:59 am | 12 pm – 5:59 pm | 6 pm – 11:59 pm |
| 11 | 16 | 23 | 11 |
States. The 61 active shooter incidents in 2021 occurred in 30 states. Twelve of the 61 incidents met the criteria cited in the federal definition of mass killings10 (three or more killings in a single incident).
| 6 | 5 | 4 | 3 | 2 | 1 |
| California | Georgia / Texas | Colorado / Florida | Indiana / Michigan / NC / Tennessee | 6 States | 15 States |
Threat Actor Outcomes. Within the Hostile Events Attack Cycle, we note that for a variety of reasons, threat actors do not always successfully escape from a hostile event. This can include that it is not part of their beliefs or ideology, that it is difficult to plan for the security response, or the attack was always meant to be the final act. The FBI data supports this assertion:
- Apprehended: 30 (13 at the scene and 17 at another location).
- Killed: 19 (14 by law enforcement, 4 by armed civilians, and 1 at another location in a vehicle crash).
- Suicide: 11 (4 at the scene before law enforcement arrived, 4 at the scene after law enforcement arrived, and 3 at another location before law enforcement arrived).
- At large. 1 – the incident was at a Houston Hookah bar yet no individual has been connected to the incident.
Threat Actor Demographics and Equipment.
- 60 were male, and 1 was female.
- 60 acted alone.
- The youngest was 12 years old; the oldest was 67 years old.
- 2 wore body armor, and 1 had four IEDs.
- 6 were employees, 4 were former employees, 2 were current students, 2 had past personal or professional relationships, and 1 shooter was a business owner.
Age Group of Threat Actors.
| 18 and under | 19 – 24 | 25 – 34 | 35 – 44 | 45 – 54 | 55 – 64 | 65 – 74 | 75 and up | Unknown |
| 2 | 14 | 18 | 10 | 9 | 6 | 1 | 1 | 1 |
An important element to preparedness is to ensure that organizations are making threat-based and risk-informed decisions. This speaks to the importance of this report. While the demographic data on the threat actors is important to understand, the data about the incidents, i.e., where they occur, the timing of the incidents, the triggering activity for the threat actor, and how they occur, can help organizations take appropriate actions to prepare their location against hostile events. Some threat-based and risk-informed areas to consider include:
- While the majority of incidents occur during normal business hours, there were still a large number of incidents that occur outside of this time frame, which may include less staff. Therefore, it is important that training, drills, and exercises should address incidents that occur outside business hours to ensure those on site have the same level of training and preparedness.
- The threat actor in a majority of incidents (70%) was either apprehended or died at the target location. Therefore, it is important that organizations ensure appropriate training is provided to employees to know how to respond. The CISA Run, Hide, Fight methodology is appropriate material. But training is only half of the response; organizations should also consider Run, Hide, Fight drills and exercises to ensure employees map out locations when they can run, where they can hide, and when they may need to fight.
- Understanding incidents that have occurred within your sector. This also includes knowing your surroundings and neighbors. Your organization may not be a target but neighbors may be and there could be indirect or associated risk. This means that the above level of training and awareness is critically important.
- Review training for all employees. This includes regular reminders about potentials threats and risks.
- Understand the threat environment in the local area – talk to neighbors and local law enforcement. Engage with fusion centers and share information through Information Sharing and Analysis Centers.
- Incorporate actions to take for customers, and other third parties.
- Incorporate resources:
- Ready.org Attacks in Crowded and Public Spaces
- U.S. Secret Service Mass Attacks in Public Spaces – 2019