7.4 Weapon Emergencies & Active Threat Response
Key Takeaways
- An unarmed Ontario security guard's role in a weapon emergency is to recognize, alert, protect life, control access and hand the scene to police, never to confront, pursue or disarm an armed subject.
- Cover stops bullets while concealment only hides you: concrete, structural steel and engine blocks are cover, whereas drywall, glass and interior doors are merely concealment.
- The active threat priority is Escape first, Hide second, and Fight only as an absolute last resort where life is in immediate danger, with any force then assessed under Criminal Code Section 34.
- Lockdown, hold and secure, shelter-in-place and evacuation are four distinct responses to four distinct triggers, and a fire alarm must never be used to clear a building during an active attacker event because it drives occupants into predictable corridors and stairwells.
- On police arrival a guard must drop everything, show empty hands with fingers spread above the waist, comply instantly, and expect to be searched, handcuffed and detained until the threat is resolved.
Weapon Emergencies and Active Threat Response
Core Principle: Section 6 of the ministry syllabus lists weapon emergencies as a distinct category of emergency alongside fire, bomb, suspicious packages, and explosive devices. An unarmed Ontario security guard's role in a weapon emergency is not to confront, disarm, or engage. It is to recognize, alert, protect life, control access, and hand the scene to police. Every doctrine in this section flows from that single limitation.
Recognizing a Weapon Before It Is Drawn
Early recognition buys the seconds that decide outcomes. Trained indicators fall into three groups:
- Physical indicators: a persistent one-sided security check or touch to the waistband, hip, or ankle; an unnatural gait favouring one side; a jacket hanging heavier on one side; an arm held stiffly against the body; adjusting clothing repeatedly over the same spot; a printed outline through fabric.
- Behavioural indicators: target glancing at cameras and exits, pacing an entrance, refusing to remove outerwear in a warm building, arriving and leaving repeatedly over a short period, thousand-yard stare or extreme agitation, and hands kept hidden or in pockets when everyone else's are visible.
- Contextual indicators: an active domestic dispute, a recently terminated employee returning to site, an eviction or a labour dispute in progress, or a documented prior threat. Under OHSA Section 32.0.5 an employer and supervisor must give a worker information about a person with a history of violent behaviour where the worker can be expected to encounter them and is likely to be exposed to physical injury — that alert is precisely what makes contextual recognition possible.
Weapon Categories and Reaction Distance
| Threat Type | Immediate Reaction | Key Consideration |
|---|---|---|
| Firearm | Maximum distance, hard cover, immediate 911, lockdown | Cover stops bullets (concrete, engine block, structural steel); concealment only hides you (drywall, glass, doors) |
| Edged weapon (knife, machete, needle) | Create and hold a wide gap, place obstacles between you and the subject | Edged weapons are lethal at close range; distance and barriers are the only reliable defence for an unarmed guard |
| Improvised weapon (bottle, bat, tool, fire extinguisher) | Withdraw, control access, keep continuous observation | Almost anything on a work site becomes a weapon; do not close the gap to "secure" the object |
| Vehicle as a weapon | Move laterally and behind a substantial fixed barrier | Never run in the direction of travel; get off the line of attack |
Reactionary gap. For an unarmed guard the practical rule is that a close-range attack develops faster than a person can react and move. Distance is time, and time is the only resource you have. Whenever a weapon is present, opening distance and putting a barrier in place outranks every other tactical option.
The Response Framework: Escape, Hide, Fight
Canadian public safety agencies teach the same three-tier priority for an active attacker, applied in order of preference and not as a menu:
- ESCAPE. If there is a viable route away from the threat, take it and take others with you. Leave belongings. Keep hands visible. Do not stop to record video. Move to a designated assembly point well away from the building.
- HIDE. If escape is not viable: get out of sight, lock or barricade the door, kill the lights, silence phones completely (silent mode, not vibrate), move away from the door and out of the line of fire, spread out rather than clustering, and stay quiet until police physically open the door.
- FIGHT. Only as an absolute last resort, when life is in immediate danger and there is no other option. Any force used in that situation is assessed under Criminal Code Section 34 (defence of person) — the response must be reasonable in the circumstances given the nature of the threat.
Calling It In
The 911 call is the most valuable thing an unarmed guard does. Give, in this order: exact civic address and closest entrance, what is happening, weapon type, number of suspects, detailed description (using the head-to-toe method from Section 6.2), direction of travel and last known location, number and location of casualties, and whether the building is in lockdown. Then stay on the line. If you cannot speak safely, leave the line open so the dispatcher can hear.
Lockdown, Shelter-in-Place, and Evacuation Are Not the Same
Confusing these three is a frequent test item.
| Term | Meaning | Typical Trigger |
|---|---|---|
| Lockdown | Internal threat. Lock and barricade in place, no movement in corridors, no one in or out. | Active attacker inside the building |
| Hold and Secure | External threat nearby. Normal activity continues inside; perimeter doors are secured and no one enters or exits. | Police incident on the surrounding streets |
| Shelter-in-Place | Environmental hazard outside. Move inside, seal openings, shut down HVAC intake. | Chemical release, plume, severe weather |
| Evacuation | The building itself is unsafe. Move occupants out along protected routes to an assembly point. | Fire, structural failure, confirmed explosive device |
Exam Trap: Never pull a fire alarm to "clear the building" during an active attacker event. A fire alarm drives occupants into corridors and stairwells and toward exits the attacker can predict, unlocks stairwell doors, and can push people directly into the threat.
When Police Arrive
The first responding officers' sole mission is to locate and stop the threat. They will move past casualties without treating them. As a guard you must:
- Drop everything and show empty hands, fingers spread, above your waist. Anything in your hand — a flashlight, a radio, a clipboard — may be read as a weapon.
- Comply instantly and without argument. Expect to be shouted at, searched, handcuffed, and detained. This is threat resolution, not an accusation.
- Do not approach officers or move toward them quickly. Follow directions exactly.
- Give the tactical picture only when asked: suspect location and description, floor plans, master keys and fob overrides, camera feed access, occupant counts, and known casualty locations.
- Remember the uniform risk. A uniformed guard resembles a responder to some officers and a suspect to others. Announce yourself verbally, keep hands visible, and never carry an object that resembles a firearm.
After the Scene Is Cleared
- Preserve the scene. Establish an inner perimeter, hand it to police, and record who entered and when. This is the duty-of-care and crime-scene protection requirement in Section 7.3.
- Write while it is fresh. Notes first, then the occurrence report. Record exactly what you heard, saw, and did, with times — never speculation about motive.
- Report it under the OHSA. A weapon incident is workplace violence under Part III.0.1. A death or critical injury triggers the employer's notice obligations, and the Joint Health and Safety Committee investigates.
- Accept the debrief and the support. Critical incident stress after a weapon event is normal and is addressed in Section 4.4.
The absolute rule: an unarmed licensed security guard in Ontario does not disarm, does not pursue an armed subject, and does not attempt to talk down a person pointing a firearm. Weapon confrontation is a police function, and attempting it converts a survivable incident into a fatality — usually the guard's.
A guard in an office tower lobby hears gunshots from an upper floor. A colleague suggests activating the fire alarm to empty the building quickly. Why is that the wrong decision?
An unarmed guard sees an agitated man produce a large knife in a shopping centre concourse roughly twelve metres away. The man has not yet noticed the guard. What is the correct immediate action?
An emergency is declared because a chemical tanker has overturned two blocks away and a toxic plume is drifting toward the building. Which response is correct, and how does it differ from a lockdown?