11.2 Rapid Deployment to an Active Attacker
Key Takeaways
- Active-attacker doctrine prioritizes stopping the killing first, then stopping the dying, then casualty evacuation and investigation — containment-and-wait is the wrong default during ongoing murders.
- First officers move toward the threat; wounded victims may be bypassed temporarily while the attacker remains active, then medical priorities rise once the threat is stopped or held.
- Solo entry may be necessary when killing is ongoing and the first officer arrives alone; small-team movement is preferred when time and arrivals allow — know agency policy.
- Rescue Task Force concepts pair law-enforcement security with fire/EMS medical care to treat and extract casualties before a scene is fully cold.
- Post-event work includes confirming threat status, medical surge, evidence protection, reunification, secondary-device awareness, and critical-incident support for responders.
Rapid Deployment to an Active Attacker
When an active attacker is killing or attempting to kill people in a populated area, North Carolina BLET training emphasizes rapid deployment: move to the threat and stop the killing first. This block (commonly about 16 hours) is taught here at a cognitive and principles level. Agency firearms and scenario training teach physical skills. This section covers priorities, solo versus team concepts, medical integration including Rescue Task Force (RTF) ideas, communications, and post-event considerations — without graphic how-to that could be misused to cause harm.
Defining the Problem
An active attacker (historically often called an active shooter) is actively engaged in killing or attempting to kill people in a populated area, typically with firearms but sometimes with vehicles, edged weapons, or other means. The defining feature is ongoing deadly violence, not a static hostage/barricade where containment and negotiation may be primary. Surround-and-wait specialized-team doctrine is the wrong default while people are being murdered in real time.
Modern best-practice frameworks, including those associated with ALERRT and similar nationwide curricula, organize response as: stop the killing, then stop the dying, then support casualty evacuation and investigation. Medical care cannot succeed if the attacker remains free to murder victims and responders.
Priority One: Stop the Killing
The first arriving officer's mission is ending the assault. Doctrinal implications:
- Respond to the crisis site with purpose when an active killing is confirmed or strongly indicated — unnecessary distant staging while murders continue conflicts with rapid-deployment doctrine.
- Move toward sounds of violence or last known threat indicators rather than waiting indefinitely for a perfect team if policy and training authorize immediate movement. Know your agency's solo-entry rules.
- Bypass the wounded initially if the attacker is still active. This is emotionally difficult and must be trained. Continuing to the threat is how additional victims are prevented. Once the threat is stopped or held, medical priorities rise.
- Communicate threat location and direction of travel so units converge intelligently.
"Stop the killing" is not reckless disregard for innocent life. It means accepting managed risk, guided by training and lawful force, to end an ongoing massacre.
Solo Versus Team Entry — Cognitive Concepts
Solo officer rapid deployment recognizes that the first officer may arrive alone. If killing is ongoing, waiting for a full team can cost lives. When authorized and trained, solo movement prioritizes speed to the attacker. Tradeoffs include reduced firepower, fewer covered angles, and higher individual risk. Solo officers still use available cover, maintain weapons discipline, and update dispatch.
Team / small-element movement improves mutual support and space dominance as officers arrive. Doctrinal themes (not a how-to checklist) include staying together as practicable, moving with purpose toward the threat, using thresholds and angles thoughtfully, and clarifying roles to avoid crossfire and confusion. Protection comes primarily from stopping the attacker effectively — not from prolonged static hiding while victims remain exposed.
As more officers arrive, elements may continue to the threat; hold cleared areas; guide units; protect a casualty collection point; or form an RTF with fire/EMS once command establishes a workable corridor concept.
Exam takeaway: understand why solo movement may be necessary, why small teams are preferred when time allows, and how priorities shift as status changes from active killing to attacker down, unknown, or secured.
Rescue Task Force and Medical Integration
After the immediate threat is addressed — or in protected sectors under command — responders must stop the dying. Interoperability concepts include:
- Tactical Emergency Casualty Care (TECC) ideas for civilian mass violence: hemorrhage control and related life-saving interventions as soon as the environment allows.
- Rescue Task Force: mixed law-enforcement (security) and fire/EMS (medical) teams that enter areas not fully cold but sufficiently protected for treatment and extraction under armed escort. Local models vary; the principle is earlier medical access without waiting for a perfect crime-scene freeze.
- Casualty collection points and corridors designated by command for movement to ambulances or temporary treatment areas.
- If violence resumes during medical care, some officers return immediately to threat neutralization while others continue triage if safely possible — reflecting the enduring primacy of stopping the killing.
Patrol officers should direct medical personnel to victims they observed, apply bleeding-control skills consistent with training, and avoid blocking RTF movement.
Communications Under Stress
Active-attacker scenes destroy radio discipline unless officers force clarity:
- Declare the call type early (active attacker / shots fired / location) so the system escalates correctly.
- Transmit location, direction of travel, descriptions, and weapon indicators in short bursts.
- Identify command and staging as ICS organizes a multi-agency response.
- Protect priority traffic for units in contact; secondary units listen and move as directed.
- Expect interoperability needs with school radios, private security, and fire channels.
- Coordinate civilian lockdown or evacuate messaging through command so people do not walk into danger.
Do not assume everyone heard the last transmission. Repeat critical updates and seek acknowledgment when possible.
Post-Event Considerations
When immediate killing stops, work continues:
- Confirm threat status — search for additional attackers, secondary devices, or victims in hiding; do not declare the scene cold prematurely.
- Medical surge and accountability — continue care and account for occupants (especially schools and workplaces).
- Crime scene — preserve evidence for homicide and possible terrorism investigation; identify witnesses.
- Reunification and notifications — through command and victim services, not ad-hoc social media.
- Officer wellness — critical-incident stress is expected; use peer support and formal defusing resources, especially after morally heavy choices such as temporarily bypassing the wounded.
- After-action review — communications, arrival, medical integration, and public messaging.
Use-of-force review, possible federal interest, and media scrutiny will follow. Stick to facts, follow public-information protocols, and document promptly.
Doctrine Summary
Hierarchy: stop the killing → stop the dying → evacuate and investigate. Solo versus team entry is a risk/speed tradeoff governed by policy and whether killing is ongoing. Integrate fire/EMS through RTF and TECC concepts when security conditions allow. Communicate briefly. Afterward, treat the site as both mass-casualty and major crime scene, watch for secondary hazards, and care for victims and responders. Classroom doctrine prepares you to learn agency-specific tactics safely on the range and in scenarios.
During a confirmed active-attacker event with ongoing killings, which priority correctly comes first under rapid-deployment doctrine?
Why might first-arriving officers temporarily bypass visibly wounded victims while moving through an active-attacker scene?
What is the core purpose of a Rescue Task Force (RTF) concept in active-attacker response?