General Order






Active Threat Response




July 10, 2019









Sheriff of Monroe County






I.PURPOSE: The purpose of this General Order is to establish operational guidelines for responding to incidents involving active threat(s)/criminal mass casualty events in which person(s) are actively engaged in killing or attempting to cause death or great bodily harm, and for the Deputies to quickly and effectively resolve such incidents in a manner that will protect human life, prevent further injuries, expedite medical treatment for the injured and preserve property. This plan provides considerations that are specific to active threats/all-hazards incidents and is intended to be used in conjunction with the Emergency Operations Plan (EOP). Given the uncertainties and uniqueness of active threat incidents, it is not the goal of this plan to dictate operational specifics with unyielding compliance. Instead, this plan should be used as a base guideline in executing preparation, response and recovery to such events.

II.DISCUSSION: Due to the magnitude of an active threat/criminal mass violence event, it is important that law enforcement, EMS and Fire personnel understand each other’s roles and responsibilities to mitigate confusion and provide a cohesive unified response. The overall objective for law enforcement, EMS and Fire personnel is to save lives. This is achieved by law enforcement personnel utilizing rapid response tactics to mitigate the threat posed by the assailant(s), thus facilitating the access of the extraction team(s) to reach the injured. It may be necessary for law enforcement personnel to establish Causality Collection Points (CCP) to allow medical personnel to render immediate live saving intervention(s), triage, and consequently expedite the evacuation of most critical patients.

The case history of active threat(s) is very dynamic and no one set of procedures, policies, or guidelines can cover every single aspect. An active threat may quickly turn into a hostage/barricade situation and conversely a hostage/barricade situation or other situation may quickly escalate into an active threat incident. The Deputy must quickly adapt to the situation as it is presented and understand that this directive cannot be considered all inclusive, as each situation is unique and dynamic.

Historically most active threat incidents have been committed by a lone assailant; although, in some cases multiple assailants have been involved. Many of the active threat incidents have been committed in extreme close quarters, while a few have been committed at longer distances by a sniper. Tragic incidents experienced across the country suggest that the typical police response involving containment, isolation, specialty teams and negotiation are not adequate in cases of an active threat(s). Unlike most criminals, active threat(s) are likely to continue to use deadly physical force until intervention occurs. They knowingly engage in criminal acts aware that, multiple law enforcement officers will be in route to the event; and that they will not survive the event.

These situations require the initial Deputies arriving on the scene to have the authority, wherewithal and the capability to take immediate action without waiting for other Deputies, Supervisors, Command Staff or for the arrival of specialty units such as SWAT, Crisis Negotiators, etc.

049: 1 of 12


A.Active Threat: is defined by the U.S. Department of Homeland Security as suspect(s) who is/are actively engaged in causing or threatening to cause death or great bodily injury to others. In most cases, active threat(s) use firearm(s) and there is no pattern or method to their selection of victims. An event could also be facilitated by other improvised weapons such as knives, blunt objects, explosives, vehicles or any other weapon of opportunity. This should not undermine the Deputy’s perception of the seriousness of the event due to the lack of a known firearm. Most of these cases have occurred in locations where the shooter has been undeterred and unobstructed from carrying out their attack. Incident locations have often been described as soft targets with limited active security measures or armed personnel to provide protection for members of the public.

B.Casualty Collection Point (CCP): an area that is secured by law enforcement personnel to provide a safe environment for law enforcement, EMS and Fire personnel to begin treating and triaging patients. It should be defendable and if possible have secondary exits to the exterior of the structure. The location is unique and dictated based on the environment or the location of the incident. The location could be created and utilized before the assailant(s) have been eliminated, depending on the building/location/size, etc. This would not be created by the initial responding Deputies, but at a point after a Tactical Operations Center (TOC) has been established. The intent of the CCP is to package, stabilize and eventually evacuate the victims. This is not a substitute for definitive medical care.

C.Contact Personnel: Initial solo law enforcement officers or teams of officers that respond to the scene. They deploy immediately, moving rapidly through multiple avenues of approach and entry points with the goal of initiating contact to contain/eliminate the threat.

D.Hasty Planning:


a.MISSION (active shooter, warrant, hostage rescue, barricaded subject)

b.ENEMY (suspects) - how many, armed, disposition

c.TROOPS (resources available, capability, limitations)

d.TIME (how much time to plan, decision points, and time lines)


f.CIVILIANS (backdrop, secured, crowd and traffic control)


a.Obstacles: looked doors, booby traps, anything that impedes your path

b.Cover and Concealment: walls and shadows that will protect or disguise your approach

c.Observation and Field of Fire: a clear backdrop in which to engage the enemy

d.Key Terrain: securing parking lots leading into the entry point; securing hallways inside of a structure; securing multiple large areas within a structure AND always securing the high ground.

049: 2 of 12

e.Avenues of Approach: multiple entry points to secure structure faster, establishing warm zones/area for the Rescue Task Force (RTF) to be escorted into.

E.Tactical Operations Center (TOC): The location a Deputy or Supervisor determines to be an adequate place to begin controlling the scene. The TOC could become a preliminary Unified Command Post (UCP) with the first arriving Fire and EMS Battalion Chiefs, the post may be relocated to a different site, depending on the environment/scene. There should be a security element attached to the TOC.

F.Incident Command Post: Command Post established by the second responding law enforcement supervisor. This post will serve for the long-term coordination with Fire, EMS and other pertinent entities. This post should unify command when Mission, Enemy, Troops, Time and Terrain (METT-


G.Immediate Threat: the most immediate threat to the Deputy, civilians, and/or Fire/EMS at the time.

H.Indicators: items that suggest the path or last known location of the active threat(s). Examples: blood, blood trails, shell casings, etc.

I.Link-Up: Two armed elements (law enforcement) coming in contact with each other during an event or time of stress. After linking up, the elements can formulate a plan to join together or stay in original element and continue in different directions. Examples: two separate single officers linking up to become a two officer element, two separate two officer elements linking up to become a four person element, etc.

J.Trailer Team: Team of 4-6 law enforcement officers that the Tactical Operations Center will send into the scene for various missions. Missions could include identifying a CCP, locating victims, extricating victims to CCP, secondary searching or any other need of the Tactical Operations Center. Trailer teams could engage the assailant(s) if necessary.

K.Rescue Task Force: A team of law enforcement officers and/or EMS and/or Fire department personnel who enter the scene to begin triaging or treating victims. Law Enforcement personnel assigned to the extraction team are not contact team members who are charged to search for the assailant(s). Rescue Team law enforcement officers must protect EMS/Fire personnel.

L.Stimulus: anything that drives or directs a Deputy to the active threat(s) known location. This

should be treated as evidence that the active threat(s) are in a specific place. Example: gun fire, screaming, people pointing the direction of the suspect, etc.

M.Hot Zone: where a direct and immediate threat exists based on the complexity and circumstances of the incident. An area within range of direct gunfire or explosive devices or an unsecured or unsearched area where a suspect could be hiding is considered to be a Hot Zone. The Hot Zone is an Immediately Dangerous to Life and Health (IDLH) zone. Law enforcement resources (Contact Personnel, Trailer Teams, SWAT teams, etc) should be the only safety personnel operating in the Hot Zone.

N.Warm Zone: where a potential threat exists, but the threat is not direct or immediate. An area that has already been searched and secured by law enforcement or protective measures such as a blocking force or a safety cordon is in place is considered to be a Warm Zone. The threat may exist elsewhere in the building or venue, but law enforcement has either cleared and secured an area or provided protective measures, to which fire and EMS personnel may be brought in to render medical aid.

O.Warm Route: designated route from a cold zone into the warm zone in which Fire and EMS personnel can rapidly access the various locations of individual victims, and evacuate to a casualty

049: 3 of 12

collection point(s) or Triage area. Law enforcement has posted security over-watch officers at reasonable intervals along the route. This facilitates the rapid movement of a large quantity of medical responders into the Warm Zone.

P.Cold Zone: where no significant danger or threat can be reasonably anticipated. It may be determined by utilizing distance, geographic location or terrain with respect to the type of firepower or explosive potential. The Cold Zone is the appropriate location for the Incident Command Post, Triage/Treatment/Transport Areas, Staging and logistical functions of the incident.

Q.Critical Incident Traffic Checkpoints: are deployed as a means to be a containment procedure in response to a critical incident such as an active threat/shooter incident. The checkpoints may be part of the outer perimeter, or they may be established on roadways which provide an exit indispensable for vehicular traffic. Officers should immediately secure the area of the critical incident. Checkpoints may be established to ensure only authorized individuals enter the area. Critical incident traffic checkpoints cannot be used as a pretext for general crime detection.


A.Direct Action

1.Rapid Response to the active threat

2.Flood the area/structure through multiple entry points

3.Seize and hold key terrain; immediately address the on-going threat, and simultaneously, or in the absence of an active threat, seize key terrain; avenues of approach, security over-watch positions, interior points of domination.

4.Establish layered leadership in and around the Danger Zone, Tactical Operations Center and key leaders directing as more key terrain is established. Communicate with the TOC.

B.Indirect Action: Eight Critical Steps to Incident Management/Incident Command Post:

1.Assess the Situation

2.Establish the Danger Zone/Scene Safety

3.Establish Key Terrain positions

4.Establish Outer Perimeter

5.Establish Command

6.Establish Staging Area

7.Identify Additional Resources

8.Personnel Accountability


1.Agency members are familiar with this plan and have access to the plan for planning, preparation, training, and response activities.

2.Agency members will execute their assigned duties and responsibilities.

049: 4 of 12

3.For large scale active threat incidents, assistance beyond the MCSO’s resources will be utilized.

4.Active threat incidents have the potential for increased media presence and legal scrutiny.

5.Ensure members have legal authority (either by jurisdiction or enactment of mutual aid) to remain involved in the incident. (i.e. out of county assistance/adjoining tribal lands)

6.Members recognize that the emergency response of MCSO during circumstances requiring immediate and extreme action to preserve life should not be delayed in deference to this or any other plan.

7.External agencies will respond to the Incident Command Post, and proceed further in accordance with their own established guidelines.

D.Concept of operations: Incident Type: An Active threat event in Monroe County is a Type 1, Type 2, or Type 3 incident as identified by the Monroe County Sheriff’s Office Basic Emergency Operations Plan. All Command and General Staff positions will be filled. The MCSO Command Center and/or Mobile Command Center may become operational. An incident action plan is not required unless the incident extends into multiple operational periods.

1.Intelligence gathering/pre-event planning:

a.Review MCSO Emergency Operations Plan and up-date if necessary (Emergency Preparedness Coordinator).

b.Annually identify and review potential target sites in each district. (District Lieutenant)

c.Review active threat planning with other law enforcement agencies. e.g., Florida Highway Patrol (FHP), Key West Police Department, Miami-Dade Police Department, Miami Police Department, Dade County School Board Police, Florida Department of Law Enforcement (FDLE), County Departments and School District personnel (Youth Relations Bureau Lieutenant and Emergency Preparedness Coordinator).

d.MCSO deputies will thoroughly investigate and document all active threats.

e.All Intelligence information shall be documented and forwarded to the Criminal Intelligence Bureau for further dissemination.

f.Deputies shall receive ongoing active threat response training in fundamental tactical skills, tactical operations, incident command procedures and Tactical Combat Casualty Care (TCCC).

2.Personnel response:

a.Upon notification of a potential active threat event, all operational elements will increase general surveillance of all public/private schools/businesses/public/special events for specific signs of suspicious persons or suspicious activity, preparing for multiple attacks.

b.Patrol and Aviation assets will commence directed patrols of all districts in Monroe County.

c.Upon notification of an active threat incident involving an active shooter, all MCSO members in the vicinity of the affected area shall initiate an immediate emergency response.

049: 5 of 12

d.Upon direction of the Sheriff or Designee, and dependent upon the scope of the event, additional agency resources may be placed on alert for possible future activation.

3.General Considerations for first Deputy Response:

a.Upon notification of a declared or anticipated Active threat incident, the first Deputy on scene should immediately assess the situation.

b.If it is determined that an active threat event is occurring, the first Deputy on scene will relay all available information to MCSO Communications, and then will make every reasonable effort to neutralize the threat following the appropriate MCSO Response to Resistance Continuum.

4.General Considerations for First Responding Deputies:

a.Deputies responding to active threat(s) incidents shall attempt to protect the life of innocent persons through immediate tactical intervention to eliminate the threat in order to rescue victims, provide medical assistance to victims, preserve the crime scene and arrest the suspect(s). In such scenarios, the prioritization of activities in order of importance shall be:

1)Stop the Active Threats(s)

2)Facilitate access and evacuation of victims

3)Provide medical assistance

4)Arrest the suspect(s)

5)Preserve the crime scene

b.While it is important to provide first aid to the wounded, it is law enforcement’s public safety duty to first protect lives by stopping the actions of the active threat(s) engaged in the continuing criminal episode.

NOTE: An active threat event can still be a mass casualty/injury event with weapons other than firearms. They should all be treated with the same amount of due regard and still treated as an active shooter event.

c.The Monroe County Sheriff's Office shall provide training in specific tactics to initial deputies responding to an active threat(s). As mentioned previously, each event is unique and dynamic, deputies need to adapt to each and every situation. It shall further be understood that Immediate Action Rapid Deployment tactics are not a substitute for conventional response tactics to barricaded subjects, hostage situations or building searches or any other patrol situation. Overall incident management will follow ICS protocols, as provided in the Monroe County Sheriff’s Office Emergency Operations Plan and request additional public safety departments or other resources as needed.

ICS positions and functions should be stood up as the event dictates. Other supervisor responsibilities include:

1)First Responder Tactical Intervention (Contact Teams): as mentioned above, the Incident Commander can deploy more teams as needed if there is/are still an active threat(s).

049: 6 of 12

2)Trailer Team(s): priorities are to locate, recover and facilitate the evacuation process of victims to a safe area or to medical personnel for treatment. If there is a non- ambulatory victim who needs medical assistance, the trailer team is required to extricate him/her. The Tactical Command/Incident Commander will deploy trailer teams when reasonable and necessary. Trailer teams can be also utilized to locate and/or secure warm zones, Casualty Collection Point(s), support the engagement of secondary active threat(s), more thorough searching, or any other mission that the Command Post orders.

3)Responder Staging areas: location(s) must be identified, established and secured to control the high volume of personnel from surrounding jurisdictions and organizations. This is critical to ensure accountability and tracking of personnel entering/leaving the incident. Depending on size or nature of event, the staging area(s) could be very large in size or have more than one location. Staging area locations should attempt to accommodate both the Fire Department and Law Enforcement in the same area, if possible, allowing for quicker identification and forward deployment of LEO/FD/EMS resources when constructing multi-agency extraction teams. Communications Specialist should assist with facilitation of Staging area locations with early internal communications with the Fire Department and EMS.

4)Evacuee Staging/Shelter locations: A location must be identified, established and secured in order to control the egress of both Law Enforcement escorted victims, potentially unescorted victims or self-evacuating victims. It is possible a "sleeper" suspect could evacuate with the other victims or also pose as law enforcement.

a)Ensuring that the scene has an adequate perimeter established.

b)Ensuring that the command notifications are made.

c)Ensuring that the MCSO Emergency Management notifications are made. This includes EOC activation, on-scene liaison and external agency coordination to include FAA, local utility providers and other county agencies.

5)Ensuring the Aviation Division is contacted to manage the air space around scene.

6)Ensuring that the media has a staging area.

7)Ensure that a chronological, contemporaneous log is maintained by the log keeper/scribe/Tactical dispatcher.

5.General Considerations for General Crimes Bureau/Homicide Section:

a.Upon the confirmation of an active threat incident that requires a response from the General Crimes Bureau a Homicide Section Detective will respond to the scene.

b.The Homicide Section Detective will immediately initiate the investigative process as defined in the MCSO Operations Manual.


1.Incident Commander: will ensure that Command Staff is notified and made aware of the incident. The report to the Command Staff should include as much information about the event as possible, and a proposed plan of action.

049: 7 of 12

The MCSO Special Response Bureau Special Weapons and Tactics Team (SWAT), Bomb Squad and Hostage Negotiation Team should have been notified as part of the initial call. However, the Incident Commander should specifically request this notification upon initial arrival at the event scene.

Public Notifications will be delivered through Public Information Officer (PIO) office and if the active threat/all-hazards event deems it necessary, through the (code red) mass communication delivery system.

2.Liaison with Schools during Incidents:

a.If the active threat incident occurs at a public or private school or college, the Incident Commander/UC or his/her designated liaison will make contact with the principal or school administrator to assist in obtaining maps of the school, access to building keys, emergency passwords, personnel or student information, next of kin information or any other information deemed relevant to the incident.

b.The Incident Commander/UC and/or PIO will coordinate any public statement releases with the School Administrator, School Superintendent or Monroe County School Board Public Information Officer, prior to the release of information, so a coordinated message is delivered to parents, the community and media sources. The Incident Commander/UC will establish a location outside the incident perimeter for responding media to gather, and provide accurate and coordinated public information releases as the situation dictates.

c.If the need for an evacuation of a school facility occurs, the Incident Commander/UC or his/her designee will coordinate such evacuation with the school administrator or school board personnel and/or Youth Relations Deputy on scene. Requests for buses to mobilize students can be made to the Monroe County School Board Transportation Department or to the Monroe Public Transit. Students should not be mobilized until a location to accept the students has been identified. All buses carrying evacuated students will have a law enforcement officer on board to assist with the evacuation and provide security. The Incident Commander or his/her designee will coordinate security and traffic control for the receiving site to assist with responding parents and media personnel. The Incident Commander will request a sufficient number of Criminal Investigative Unit personnel respond to the receiving site, to identify/debrief potential eyewitnesses and obtain statements.

d.The reunion of students with their parents will be coordinated with school administration and a record listing the school, student name, date of birth, student ID number, date and time released and to whom will be maintained. Students will only be released to the affected school’s listed emergency contact listed persons. All subjects attempting to pick up a student will be required to provide proper identification, which will be recorded on the release record.

Students should not be released from the reunion site until CIU personnel have determined whether or not the student was an eyewitness to the events and whether the student needs to be interviewed/debriefed.

3.Liaison with Businesses during Incident:

a.If the active shooter incident occurs at a business or mall, the Incident Commander or his/her designated liaison will make contact with the business owner or property manager to assist in obtaining maps of the business, access to building keys, emergency passwords, personnel information, next of kin information or any other information deemed relevant to the incident.

049: 8 of 12

b.The Incident Commander and/or PIO will coordinate any public statement releases with the business owner when practical, prior to the release of information, so a coordinated message is delivered to the community and media sources.

c.The Incident Commander will establish a location outside the incident perimeter for responding media to gather, and provide accurate and coordinated public information releases as the situation dictates.

4.Treatment and Transportation of the Injured:

a.The treatment and transportation of injured persons will be coordinated initially with the first arriving On-Duty Monroe County EMS/Fire Battalion Chief. Upon arrival of the second EMS Battalion Chief he or she will assume the responsibility of the medical branch. In instances of mass casualties, triage will be established at a location near the incident scene, but at a distance far enough away to allow for the safe administration of care and coordination of transportation to area hospitals. The establishment of a triage site should be coordinate with the Incident Commander, and second the on-scene On-Duty Monroe County EMS Battalion Chief. The Incident Commander/UC will consider the need to provide security for the triage location and provide sufficient personnel to maintain security at the location.

b.Consideration should be given to the maintenance and collection of potential evidence at the triage site and a request for crime scene personnel to respond to coordinate such collection of evidence. The Transportation Officer shall be responsible for recording the name of subjects transported to area hospitals and the location that each subject was transported to, with address and telephone number contact information for each facility must be provided to the Incident Commander for tracking purposes and to ensure that this information is available to next of kin attempting to locate family members. In large incidents, the Incident Commander/UC should consider the need to establish a call center to process requests for information from family members or relatives.

5.Local Hospital Addresses and telephone numbers:

a. Lower Keys Medical Center (Key West)

(305) 294-5531


Fisherman’s Hospital (Marathon)

(305) 743-5533


Mariners Hospital (Tavernier)

(305) 434-1588

F.EVACUATION AND REUNIFICATION (Monroe County Public Schools):

1.General Considerations for Evacuation: Evacuation is a measure undertaken to prevent harm to people. Evacuation must be carefully considered before its initiation because there are potential dangers involved. Factors such as climate, traffic patterns, length of stay outside, lightning, accountability of students, staff and volunteers must be considered.

a.The Incident Commander should consider, unifying command with Monroe County Public Schools, and being a part of the planning and preparation for an evacuation, whether on or off campus, in a support role for public schools in this effort.

b.In the event that students, staff and volunteers are to be evacuated off-site the Unified Command should:

1)Identify the location of the assembly/staging area from school officials and provide security to this location.

049: 9 of 12

2)Identify the location of the Reunification Site and establish the desired evacuation route.

3)Establish an Incident Command Post at the Reunification Site and provide security. Unified Command should consider notifying the on-call MCSO Corrections Bureau Rescue Task Force to manage and assist with movement and security for the established Reunification site.

4)Provide escort to the Reunification Site.

2.General Considerations for Reunification: Reunification planning is critical to provide for a uniform, safe and effective return of students to their parents or guardians. The reunification process allows for an accurate accountability of all students, staff and volunteers.

a.Law Enforcement presence at the Reunification Site is critical to the orderly running and control of the reunification process.

b.Unified Command should be established at the Reunification Site. Notify state EOC for logistical assistance if needed.

c.Media representatives should not be allowed in the Reunification Site and should be directed to the Joint Information Center (JIC) or other location as directed by the Incident Commander.

d.Potential witnesses transported to the Reunification Site should be kept in a secure, comfortable location until they can be interviewed if at all possible. In the event that parents or guardians arrive for potential witnesses they should be allowed to see their child.


1.Command and General Staff Positions:

a.For a type 3 incident response, Command and General staff positions may be filled at or near the incident scene.

b.For type 2 incident response the Command and General Staff positions may activate at the MCSO Command Center and/or Mobile Command Center.

c.For specific guidance and direction related to Command and General Staff positions refer to the MCSO Emergency Operations Plan.

The Incident Commander/UC will ensure the protection of the crime scene(s) for processing, once the incident has been resolved.

The Incident Commander/UC will ensure that all members utilized in the response efforts are documented and their actions are documented in an event report or interviews by CIU personnel. In cases in which officers from multiple agencies engaged in lethal force, the Incident Commander/UC should confer with the affected Department heads to discuss which agency will take the lead on the investigation or if FDLE will take over as the lead in the investigation.

The Incident Commander/UC will ensure responding members are monitored and evaluated as needed for signs of post-traumatic stress related issues and should consider requesting the Critical Incident Peer Support Team or a CISM team from another agency to assist, if needed.

049: 10 of 12

2.Public Information Officer:

a.The PIO shall coordinate media releases with the Unified Command through the Joint Information Center (JIC) if activated.

b.In the event that the JIC is not activated the PIO shall act as liaison between the Field Command Post and the media. All requests by the media shall be coordinated through the PIO.

c.Information pertaining to the crisis situation shall not be released to the media or any private or public agency except by the Sheriff or his designee through the PIO.

d.Media representatives will be allowed such access as safety and law enforcement needs will allow during a crisis situation:

1)Under normal circumstances media representatives would not be allowed into the inner perimeter during a crisis situation. Any deviation from this guidance shall be approved by the Incident Commander before allowing the media access into the inner perimeter.

2)Under normal circumstances media representatives would not be allowed access to the Incident Command Post. A suitable location will be set up for the media by the PIO. Any deviation from this guidance shall be approved by the Incident Commander before allowing the media access into the Incident Command Post.


1.Dependent upon the scope and severity of the event, After Action Reports (AAR) may be required following this type event. AARs should be completed as outlined in the MCSO Emergency Operations Plan.

2.AAR will be completed by the Emergency Manager/ Sergeant evaluating and analyzing the overall response. Once approved by the Sheriff or designee, a debriefing will be held with personnel and agencies involved in the incident where the AAR will be made available to agency personnel for review and training purposes.

3.A debriefing and post incident review will be held at the direction of the Sheriff.


1.The MCSO Emergency Manager shall annually organize a review of this appendix for modification as needed.

2.Specific training related to this plan should be coordinated through MCSO Special Response Bureau and Emergency Manager.

J.ADMINISTRATION: STATE OF EMERGENCY DECLARATION BY THE GOVERNOR: Refer to MCSO Emergency Operations Plan for actions applicable to a State of Emergency Declaration by the Governor.


1.MCSO Emergency Operations Plan.

2.Division/Bureau/Section SOP’s as applicable

049: 11 of 12

3.Florida State Statutes

4.Incident Command System

5.Monroe County and State of Florida Emergency Operations Plan

049: 12 of 12