7.1 Active Threat Response, Incident Command & Critical Incident Management

Active Threat Response, Incident Command & Critical Incident Management

Critical incidents—ranging from active shooter massacres to hazardous material disasters and multi-jurisdictional barricaded hostage crises—require peace officers to transition seamlessly between aggressive tactical engagement and structured incident command. The evolution of modern active threat doctrine emphasizes rapid, decisive intervention to stop active killings, followed immediately by multi-agency Rescue Task Force operations and tactical trauma medicine.

---

1. Evolution of Active Threat & Active Shooter Response Doctrine

An Active Threat / Active Shooter is defined as an individual actively engaged in killing or attempting to kill people in a confined and populated area, typically using firearms, edged weapons, or improvised explosives with no pattern or method to their selection of victims.

+--------------------------------------------------------------------------+
|              PARADIGM SHIFT IN ACTIVE SHOOTER DOCTRINE                   |
|                                                                          |
|  HISTORICAL MODEL (Pre-1999 Columbine)   MODERN MODEL (Post-Columbine)   |
|  • Surround and contain                  • IMMEDIATE ACTION RAPID DEPLOY │
|  • Establish outer perimeter             • Solo / Small-Team (2-4) Entry │
|  • Await SWAT mobilization               • Direct drive to active gunfire│
|  • RESULT: Unopposed civilian slaughter • RESULT: Rapid shooter neutral-│
|                                            ization and lives saved       │
+--------------------------------------------------------------------------+

Historical Evolution

• Pre-Columbine (Containment & Staging): Prior to the 1999 Columbine High School shooting in Jefferson County, Colorado, standard police doctrine dictated establishing a perimeter, containing the scene, and waiting 45–60 minutes for specialized SWAT teams to assemble. This strategy resulted in catastrophic civilian casualties because active shooters continue murdering victims until confronted.
• Immediate Action Rapid Deployment (IARD): Post-Columbine analysis established that active shooters kill a victim every 10 to 15 seconds. Law enforcement adopted four-officer quad formations to enter immediately.
• Modern Standard (Solo / Two-Officer Rapid Entry): Under current ALERRT (Advanced Law Enforcement Rapid Response Training) and Colorado POST standards, the first arriving officer DOES NOT WAIT FOR BACKUP if active gunfire is heard. A single officer or two-officer team must make immediate, aggressive entry to locate, isolate, and neutralize the threat.

The Priority of Life Scale

Every tactical decision during an active critical incident is governed by the strictly ordered Priority of Life Scale:

1. Innocent Victims, Hostages, and Civilians (Highest Priority)
2. Responding Peace Officers & First Responders
3. Suspect / Perpetrator (Lowest Priority)

Core Operational Priorities: "Stop the Killing" vs. "Stop the Dying"

• Phase 1: Stop the Killing (Neutralize Threat):
  • Contact teams move with relentless momentum directly toward the sound of gunfire, screaming, or explosive stimulus.
  • Contact teams must bypass deceased victims, wounded individuals begging for aid, locked non-threat doors, and secondary hazards (fire alarms, activated sprinklers, chemical odors).
  • Stopping to treat victims while the shooter is active allows the gunman to continue executing civilians.
  • The active threat is stopped when the suspect is killed, wounded/arrested, contained in a barricade, or driven to suicide.
• Phase 2: Stop the Dying (Casualty Care & Extraction):
  • The moment the active threat is neutralized or contained, the mission transitions instantly to tactical emergency medicine, triage, Rescue Task Force deployment, and casualty extraction.

---

2. Rescue Task Force (RTF) Operations & Tri-Zone Geometry

Historically, Fire and EMS personnel staged miles away in Cold Zones until SWAT declared a multi-acre building 100% secured, causing treatable victims to bleed to death from extremity hemorrhage and tension pneumothorax. Modern integrated response utilizes the Rescue Task Force (RTF) model.

┌──────────────────────────────────────────────────────────────────────────┐
│                     TRI-ZONE OPERATIONAL ARCHITECTURE                    │
├───────────┬──────────────────────────────────────────────────────────────┤
│ Zone      │ Security Status & Authorized Operational Personnel           │
├───────────┼──────────────────────────────────────────────────────────────┤
│ HOT ZONE  │ Active lethal threat / uncontained active gunfire.          │
│           │ • Sworn tactical law enforcement contact teams ONLY.         │
├───────────┼──────────────────────────────────────────────────────────────┤
│ WARM ZONE │ Initial threat neutralized or bypassed; area cleared of      │
│           │ active shooters but not fully secured for secondary traps.   │
│           │ • Rescue Task Force (Armed Police Escorts + Fire/EMS Medics).│
├───────────┼──────────────────────────────────────────────────────────────┤
│ COLD ZONE │ Command Post, Casualty Collection Point (CCP), Staging Area. │
│           │ • Unarmed medical, triage personnel, transport ambulances.   │
└───────────┴──────────────────────────────────────────────────────────────┘

Rescue Task Force (RTF) Team Composition

• An RTF is a hybrid team consisting of 2 to 4 armed Law Enforcement Force Protection Officers providing 360-degree security around 2 to 4 Fire/EMS Paramedics or EMTs.
• The RTF enters Warm Zones under armed police escort to deliver point-of-wounding care (tourniquets, wound packing, needle decompressions, chest seals) and rapidly carry non-ambulatory casualties to the Casualty Collection Point (CCP) in the Cold Zone.

---

3. Incident Command System (ICS / NIMS) for Law Enforcement

The Incident Command System (ICS), structured under the National Incident Management System (NIMS), provides a standardized, scalable on-scene organizational management structure for critical incidents.

                      INCIDENT COMMAND STRUCTURE

                        [ INCIDENT COMMANDER ]
                                  │
          ┌───────────────┬───────┴───────┬───────────────┐
          ▼               ▼               ▼               ▼
    [ OPERATIONS ]   [ PLANNING ]   [ LOGISTICS ]   [ FINANCE / ADMIN ]
    Tactical action   Resource track  Equipment &     Cost accounting &
    & field rescue    & demob plans   communications  claims management

ICS Principles & Span of Control

• Manageable Span of Control: ICS mandates that any single supervisor oversees between 3 and 7 subordinates, with 5 being optimal. If span of control exceeds 7, the supervisor must divide the group into divisions (geographic) or groups (functional).
• Plain Language Communications: The use of 10-codes, agency-specific numeric jargon, and signals is strictly prohibited. All radio and inter-agency communications must utilize clear, plain English.

Initial Responding Officer & Supervisor Responsibilities

1. Establish Initial Command: The first arriving officer on scene assumes Incident Command (IC) until formally relieved by a higher-ranking supervisor via verbal transfer of command.
2. Command Post (CP) Establishment: Must be established in the Cold Zone, outside the line of sight and line of fire, uphill and upwind from hazardous materials, with clear ingress and egress routes.
3. Perimeter Control:
   • Inner Perimeter: Established directly around the crisis site/structure. Manned by tactical officers behind hard cover to isolate the suspect, contain the threat, and prevent suspect escape.
   • Outer Perimeter: Established at a wider radius surrounding the inner perimeter and Command Post. Manned by patrol officers to manage civilian traffic, exclude onlookers and media, secure emergency ingress/egress corridors, and establish media/family staging areas.

---

4. Casualty Care Integration at a Critical Incident

Active threat incidents produce casualties faster than EMS can reach them, so the incident commander must plan casualty flow at the same time as threat suppression. The medical doctrine itself — the phases of care, the M.A.R.C.H. assessment, the PACE hemorrhage strategy, tourniquet and chest seal technique, drags and carries, and remote medical assessment — is taught in Unit X and is covered in the next two sections of this chapter. What belongs to this block is the command-side integration.

The recurring failures at real incidents are not medical. They are command failures: no designated CCP, so casualties accumulate wherever they fell; no casualty report, so EMS stages without knowing how many patients exist; and no secured evacuation corridor, so ambulances refuse to enter. The officer who ensures medical aid is rendered under C.R.S. § 18-1-707(2)(c) at a mass-casualty scene does so mostly by making these command decisions early.