12.1 Homeland Security & Active Threat Awareness
Key Takeaways
- NIMS and ICS give first-arriving Missouri officers a common language for command, span of control, and multi-agency coordination on large or complex incidents.
- Terrorism and suspicious-activity recognition feed Suspicious Activity Reporting (SAR) pathways; see something, document facts, and report through agency channels—do not invent plots or ignore indicators.
- Active threat response prioritizes stopping the killing, then stopping the dying; understand contact-team movement versus rescue-task-force (RTF) concepts without freezing in place for a perfect perimeter if lives are being lost.
- Missouri POST curriculum includes roughly 12 hours of homeland-security content in technical studies, and the Commission has studied expanding basic active-shooter/threat response training (MML FAQ notes subcommittee work).
- Bomb-threat and suspicious-package basics emphasize isolation, evacuation judgment, no unnecessary handling, and specialized response; Missouri critical infrastructure includes interstates, rivers, agriculture, and urban cores.
12.1 Homeland Security & Active Threat Awareness
Quick Answer: Missouri peace officers operate in a homeland-security environment even on “ordinary” shifts. Know NIMS/ICS roles for the first-arriving unit, suspicious-activity reporting, active-threat priorities (stop the killing, then stop the dying), bomb/package isolation basics, and Missouri’s critical infrastructure profile. Basic academies carry on the order of ~12 hours of homeland-security content within technical studies, and Missouri POST has studied expanding active-shooter/threat response in basic training.
This section closes the technical-studies arc of the Class A curriculum: large-scale coordination and worst-case violence. The written MPOLE will not put you in a live shooter scenario, but it will test whether you understand priorities, roles, and decision logic that academy skills and scenario hours drill into your body and brain.
Why Homeland Security Is a Peace-Officer Subject
“Homeland security” is not only federal agents and airport checkpoints. For a Missouri municipal, county, or state officer it means:
- Recognizing pre-attack indicators and suspicious activity.
- Reporting those indicators through proper channels.
- Responding to active threats with life-saving priorities.
- Coordinating with fire, EMS, neighboring agencies, and state/federal partners under a common system.
- Protecting soft targets and critical infrastructure without overreacting to every rumor.
Missouri’s geography—interstate corridors (I-70, I-44, I-55, I-29, I-35 and connectors), major rivers (Missouri and Mississippi systems), agriculture and food-supply chains, and dense urban cores (St. Louis metro, Kansas City metro, Springfield, Columbia, and others)—creates both opportunity and vulnerability. Terrorists, targeted attackers, and criminals who exploit mass panic all look for soft targets: schools, houses of worship, malls, stadiums, transit hubs, and government buildings.
Academy technical studies typically include roughly ~12 hours of homeland-security-related instruction. That is not a full counterterrorism degree; it is officer-level awareness so you do not become the weak link when a real incident begins.
Missouri POST Interest in Expanding Active-Threat Training
Public-facing discussions of Missouri’s basic curriculum (including Missouri Municipal League FAQ material quoting POST Program leadership) have noted subcommittee and Commission attention to expanding or refining active shooter / active threat content in basic training. Treat that as a signal of priority, not as a promise of a specific hour count on your exam paper. For candidates: expect active-threat concepts to matter in skills blocks, scenario training, and professional judgment—not as optional trivia.
NIMS and ICS: Common Language for Chaos
The National Incident Management System (NIMS) is the national framework for how agencies prepare for, respond to, and recover from incidents of all sizes. The Incident Command System (ICS) is the on-scene management structure inside NIMS.
You do not need to be a Type-1 Incident Commander to pass the MPOLE. You do need to know what first-arriving officers contribute:
| ICS concept | Officer-level meaning |
|---|---|
| Incident Command | One person (or unified command) directs the overall response |
| Span of control | Supervisors manage a manageable number of subordinates (commonly taught around 3–7) |
| Unity of command | Each person reports to one supervisor in the structure |
| Common terminology | “Staging,” “ICP,” “triage,” “hot/warm/cold zones”—shared words reduce radio chaos |
| Modular organization | Structure expands as resources arrive |
| Transfer of command | Command can transfer with a clear briefing when a more qualified person arrives |
First-Arriving Officer Responsibilities (High Yield)
When you are first on a complex scene (active threat, large fire with evacuations, multi-vehicle pileup with hazmat, major civil disturbance):
- Assess from the best available position—do not drive into a kill zone blindly.
- Communicate a clear size-up: location, type of incident, known hazards, approximate casualties, resources needed.
- Establish initial command (even if temporary) and announce it on the radio.
- Request resources early: additional units, supervisors, SWAT/ERU if available, fire/EMS, traffic control, air support if used in your region.
- Deny unnecessary civilian access; protect the outer perimeter as resources allow.
- Be ready to transfer command cleanly when a supervisor or designated IC arrives—give a brief, factual handoff, not a novel.
Exam trap: Believing the first officer must personally solve the entire incident before anyone else arrives. First-arriving work is stabilize, communicate, and set structure—not ego command forever.
Exam trap: Confusing ICS with “only for terrorism.” ICS applies to everyday multi-unit responses: major crashes, weather disasters, large crime scenes, and school emergencies.
Terrorism Indicators and Suspicious Activity Reporting (SAR)
Terrorism for officer awareness is the unlawful use of force or violence against persons or property to intimidate or coerce a government or civilian population in furtherance of political or social objectives. You will also encounter targeted violence that is not classic ideology terrorism but produces the same mass-casualty problem (workplace shooters, school attackers). Training treats behavioral indicators and pre-attack surveillance seriously for both.
Indicators Worth Noticing (Fact-Based, Not Profiling Stereotypes)
| Domain | Examples of concerning activity (context matters) |
|---|---|
| Surveillance | Repeated photography/video of security cameras, employee entrances, shift changes without legitimate purpose |
| Elicitation | Unusual questions about security staffing, response times, lock-down procedures |
| Tests of security | Probing fences, alarms, badge access, or emergency exits |
| Acquiring capability | Unexplained bulk purchase of precursors, weapons, or tactical gear combined with other indicators |
| Dry runs | Practice approaches, timing of doors, parking for quick egress |
| Funding / logistics | Unusual storage of materials, unexplained large cash activity tied to other red flags |
Critical professional rule: Race, religion, or ethnicity alone is not reasonable suspicion or a SAR basis. Document behaviors and facts. Biased “looks wrong to me” reporting destroys trust and fails legal and ethical standards you studied in cultural-awareness and constitutional chapters.
Suspicious Activity Reporting Pathway
Missouri officers typically:
- Observe and, when safe, investigate within legal limits (consensual contact, Terry if RS exists, PC if developed).
- Document who, what, when, where, how—not conclusions like “obvious terrorist.”
- Report through agency intelligence / fusion / SAR channels as policy directs (many agencies connect to state fusion-center processes and national SAR concepts).
- Protect sensitive investigative information—do not post operational details on social media.
SAR is not a substitute for emergency response. If an attack is underway, you respond first; paperwork follows when the scene is controlled.
Active Threat / Active Shooter Response Concepts
Modern doctrine for an active threat (a person actively engaged in killing or attempting to kill people in a confined and populated area—often with firearms, sometimes with vehicles, edged weapons, or explosives) prioritizes two sequential missions:
| Priority | Phrase | Meaning |
|---|---|---|
| 1 | Stop the killing | Locate, isolate, and neutralize the threat as quickly as reasonably possible |
| 2 | Stop the dying | Provide rapid medical intervention and evacuation of casualties once the threat is addressed enough to allow rescue |
Older “surround and wait for SWAT while people die” thinking has been rejected nationwide after mass-casualty lessons. First responders who can safely move toward the threat are expected to act, not to build a perfect perimeter while gunfire continues.
Contact Team Awareness
A contact team (or similar agency term) is a small element of officers who move toward the last known threat location to stop the killing. Principles taught at awareness level:
- Move toward the sounds of violence / last known location when it is tactically appropriate.
- Maintain communication, muzzle discipline, and target identification—not every person running is a shooter.
- Expect chaos: smoke, alarms, screaming, false reports of multiple shooters.
- Do not stop for every wounded person if the shooter is still active and you are the contact element—medical follows when the threat allows (rescue task force / medical extraction concepts).
- Solo officer response may be required if you are first and lives are being lost; agency policy and training govern when and how you enter alone versus waiting seconds for a partner. Know your academy and agency doctrine; the MPOLE tests the life-saving priority, not a single brand-name tactic system.
Rescue Task Force (RTF) Awareness
A Rescue Task Force concept pairs law enforcement protection with fire/EMS medical providers to enter warm zones (areas not fully cleared but where residual risk is managed) to treat and extract casualties after or alongside contact efforts, depending on doctrine and threat status.
Officer-level points:
- Police protect medics; medics treat patients—roles stay clear.
- Warm-zone medicine can save lives that would be lost waiting for a fully cold scene.
- RTFs do not replace contact teams; they complement them once entry for rescue is authorized by command/tactics.
- Radio discipline and marked corridors matter; friendly-fire and blue-on-blue risks rise in multi-agency entries.
Zones Language (Common Training Vocabulary)
| Zone | Rough meaning |
|---|---|
| Hot | Direct threat area; primarily law enforcement contact mission |
| Warm | Residual risk; RTF-type operations may occur under armed security |
| Cold | Secure area for staging, triage expansion, family reunification, investigation support |
Exact agency SOPs vary. MPOLE cares that you know why zones exist: to organize risk, not to create bureaucratic delay.
Integrating Force Law You Already Know
Active-threat force decisions still sit under Fourth Amendment objective reasonableness (Graham) and deadly-force limits (Garner concepts when flight without ongoing deadly threat is the only issue). An active shooter presenting an ongoing deadly threat to others is the classic defense-of-others / imminent death or serious injury justification. Friendly-fire, misidentification, and shooting into crowds remain catastrophic failures—identification before shots, when humanly possible under stress.
Bomb Threats and Suspicious Packages
Bomb incidents are rare relative to ordinary calls—but mismanagement is career-ending and life-threatening.
Bomb Threat Basics
- Take every threat seriously until assessed—do not laugh off “prank” claims without process.
- Preserve the report: who received it, exact wording, caller ID, background noise, time, target location.
- Notify supervisors and specialized resources per policy (bomb squad / EOD, fire, facility security).
- Evacuation decisions are often a joint call among facility managers, command, and bomb technicians—blind full-building evacuations can walk people past the device; “shelter in place” can be wrong if the device is nearby. Follow trained decision protocols; do not freelance explosive disposal.
- Search (if assigned) is systematic and often uses people who know the area’s “normal”—staff who can spot what does not belong.
Suspicious Package Basics
| Do | Do not |
|---|---|
| Isolate the area and keep people back | Pick up, shake, open, or “sniff” the item |
| Note packaging, leaks, wires, odd odors from a safe distance | Use radio/cell immediately next to a suspected device if policy warns of RF initiation risk—follow bomb-tech guidance |
| Establish cordons and staging | Drive over possible IEDs or park command posts on top of them |
| Call specialized response | Assume “if it were real, it would look Hollywood” |
Secondary devices targeting first responders are a known attacker tactic after primary explosions or at drawn-in emergency scenes. Stay alert for second packages, vehicles, or persons after the first crisis draws a crowd of uniforms.
Critical Infrastructure Awareness in Missouri
Critical infrastructure means systems and assets so vital that their destruction or disruption would have a debilitating effect on security, economy, public health, or safety. Missouri-relevant examples for officer awareness:
| Sector theme | Missouri examples / implications |
|---|---|
| Transportation | Interstate system, bridges, rail yards, airports, river ports—traffic chaos and cargo risk |
| Waterways | Missouri and Mississippi river commerce, locks/dams, flooding interactions with security |
| Agriculture / food | Farms, elevators, processing plants, livestock facilities—economic and public-health impact |
| Energy | Power substations, pipelines, fuel terminals—cascade failures and copper-theft intersections |
| Government / public safety | Courthouses, city halls, 911 centers, academies—symbolic and operational targets |
| Urban soft targets | Schools, stadiums, malls, hospitals, houses of worship |
| Cyber-physical | Attacks that start digital and end with physical outages officers must manage on the street |
Your job is rarely “harden a nuclear plant alone.” Your job is to notice anomalies, secure scenes, control traffic and crowds, liaise with facility security, and report intelligence that specialists need.
Putting It Together: A Missouri Scenario
You are first unit to a suburban Missouri high school for “shots fired.” You hear ongoing gunfire. Your size-up goes out: location, active shooting sounds, unknown casualty count, request for all available units, fire/EMS to stage. You form a contact element with the next two arriving officers and move toward the gunfire to stop the killing. A supervisor later assumes ICS command, establishes staging, and coordinates RTF entry for stop the dying. Meanwhile, a second call reports a backpack “with wires” at the stadium entrance—specialists isolate it as a possible secondary. That chain—threat stop, medical rescue, command structure, secondary-device awareness—is the homeland-security mind-set the academy is building.
Common Exam Traps
- Waiting outside for a perfect SWAT setup while an active shooter continues killing (priority failure).
- Treating NIMS/ICS as “federal only” or “terrorism only.”
- Filing SAR reports based on ethnicity instead of behavior.
- Handling a suspicious package yourself to “be a hero.”
- Forgetting secondary devices and responder self-protection after the first blast or first shots.
- Confusing contact-team mission (stop the killing) with RTF mission (protected medical rescue).
Master first-arriving ICS habits, SAR discipline, stop-the-killing / stop-the-dying priorities, package isolation, and Missouri infrastructure context—and you will handle the homeland-security knowledge layer of the MPOLE and the first minutes of a career-defining call.
As the first-arriving officer at a large multi-agency incident, what is the best initial ICS-oriented action set?
Which pair best captures modern active-threat response priorities taught to peace officers?
What is the best description of a rescue task force (RTF) concept at officer-awareness level?
Which action best matches suspicious-package and bomb-threat response basics?