Active Armed Offender Guidelines for Crowded Places (Download)

Appendix A (Download)

Appendix B (Download)

Appendix C (Download)

Full Australian National Security copy below (edited for web):

Active Armed Offender Guidelines for Crowded Places

ISBN: 978-1-925593-94-5 (Print)
ISBN: 978-1-925593-95-2 (Online)
© Commonwealth of Australia 2017
With the exception of the Coat of Arms and where otherwise stated, all material presented in this publication is provided under
a Creative Commons Attribution 4.0 International licence (www.creativecommons.org/licenses).
For the avoidance of doubt, this means this licence only applies to material as set out in this document.
The details of the relevant licence conditions are available on the Creative Commons website as is the full legal code for the
CC BY 4.0 licence (www.creativecommons.org/licenses).
Use of the Coat of Arms
The terms under which the Coat of Arms can be used are detailed on the Department of the Prime Minister and Cabinet
website (www.dpmc.gov.au/government/commonwealth-coat-arms).

Table of Contents

Introduction…………………………………………………………………………………………………………………………3
Purpose ……………………………………………………………………………………………………………………………..3
Glossary of terms ………………………………………………………………………………………………………………..5
Threat context……………………………………………………………………………………………………………………..6
Characteristics of active armed offender incidents …………………………………………………………………..7
General features ………………………………………………………………………………………………………………7
Weapons…………………………………………………………………………………………………………………………7
Primary objectives ……………………………………………………………………………………………………………….8
Prevention…………………………………………………………………………………………………………………………..9
Preparedness ……………………………………………………………………………………………………………………..9
Contingency planning………………………………………………………………………………………………………..9
Combined and coordinated management…………………………………………………………………………….9
Assessment …………………………………………………………………………………………………………………..10
Application …………………………………………………………………………………………………………………….10
Response………………………………………………………………………………………………………………………….10
Initial response……………………………………………………………………………………………………………….10
Transitionconsiderations ………………………………………………………………………………………………….11
Police response………………………………………………………………………………………………………………11
Recovery…………………………………………………………………………………………………………………………..12
Public information……………………………………………………………………………………………………………12
Crime scene and investigation activities…………………………………………………………………………….12
Business continuity …………………………………………………………………………………………………………13
Useful links ……………………………………………………………………………………………………………………….13
Version control…………………………………………………………………………………………………………………..13

ACTIVE ARMED OFFENDER GUIDELINES
FOR CROWDED PLACES

Introduction

It is the responsibility of both Government and private sector stakeholders to work collaboratively to ensure that integrated and effective plans and arrangements are in place to prevent or reduce the impact of these incidents.

Crowded places pose a broad range of security challenges for owners, operators and those responsible for providing a protective security overlay. They have been specifically identified – nationally and internationally – as attractive targets by those wishing to engage in terrorism, as well as disgruntled or mentally impaired individuals. Active armed offender attacks have occurred, and continue to occur, in crowded places around the world such as sporting stadiums, transport hubs and
entertainment venues.

Crowded places present a particularly attractive target for terrorism, due to the ready access to large numbers of potential victims. Attacks which occur in crowded places are particularly insidious because crowds using these places are often distracted by the venue event, reducing their situational awareness of their immediate environment.

The Active Armed Offender Guidelines for Crowded Places are intended to increase understanding of the threat that active armed offender incidents pose in crowded places. The Guidelines seek to illustrate the key role that owners and operators of crowded places can play in developing and implementing appropriately informed prevention, preparedness, response and recovery arrangements to reduce the risks posed by such a threat.

The guidance material has been developed by the ‘Crowded Places Advisory Group’ (CPAG) on behalf of the Australia-New Zealand Counter- Terrorism Committee (ANZCTC). It should be read in conjunction with Australia’s Strategy for Protecting Crowded Places from Terrorism; Improvised Explosive Device Guidelines for Crowded Places, Chemical Weapon Guidelines and the Hostile Vehicle Mitigation Guidelines for Crowded Places.

Purpose

These Guidelines aim to increase the awareness of owners and operators of crowded places of the dynamic terrorism threat, while providing guidance on the issues and options which can be considered during risk mitigation and contingency planning activities.

These Guidelines set out several broad guiding principles which public and private sector stakeholders should consider to reduce the vulnerability of their site to the threat of terrorism. The Guidelines aim to supplement and build upon some of those broad areas of focus, with particular emphasis on the following two principles:

  • Prevention and preparedness arrangements should be underpinned by an intelligence-led, risk management approach.
  • Effective security outcomes in complex crowded place environments require cooperation and coordination among stakeholders.

Gaining a better understanding of the risk environment, and options for preventing and dealing with active armed offender incidents, will enable owners and operators in the private sector in particular to more effectively contribute to the collective national efforts to manage the active armed offender threat to crowded places. It is intended that this knowledge will lead to the development of ‘contingency plans’ or sub-plans to supplement existing emergency response plans and arrangements at facilities and venues.

Glossary of terms

Active Armed Offender: An armed offender who is actively engaged in killing or attempting to kill people, and who demonstrated their intention to continue to do so while having access to additional potential victims (1).

Concealment: Prevents a person from being seen or observed, but does not provide protection from physical harm.

Cover: Concealment that provides physical protection from harm.

Crowded Places: Crowded places are locations or environments which are easily accessible by large numbers of people on a predictable basis.

Crowded places include, but are not limited to, sports stadia, transport hubs, shopping centres, pubs, clubs, places of worship, tourist attractions, movie theatres, and civic spaces. Crowded places do not have to be buildings and can include open spaces such as parks and pedestrian malls.

A crowded place will not necessarily be crowded at all times: crowd densities may vary between day and night, by season, and may be temporary, as in the case of sporting events, open air festivals, or one-off events.

Emergency Management: The plans, structures and arrangements that are established to bring together government agencies, voluntary groups and private organisations in a coordinated way to deal with emergency needs, including prevention, response and recovery.

Evacuation: The process of relocating people from dangerous or potentially dangerous areas to safer areas. The purpose of an evacuation is to use distance to separate people from the danger created by the emergency.

Police First Responder: A police officer who provides the initial policing response to a call for police assistance (2).

Hostile Vehicle: A hostile vehicle is generally one whose driver is determined to access a restricted or unauthorised area or location in order to cause damage to buildings and structures, cause injury/death to people, disrupt business or effect publicity for a cause. A hostile vehicle may be used to carry an explosive device or the vehicle itself, travelling at speed, may present the primary danger (3).

Improvised Explosive Device: A device made or placed in an improvised way that incorporates
destructive, lethal, noxious, pyrotechnic or incendiary chemicals and is designed to destroy,
incapacitate, harass or distract.

Improvised weapon: An object that is not designed to be a weapon, but can be used as a means to
kill or inflict serious injury.

Mitigation: Measures taken before, during, or after an event to decrease or eliminate its impact on
people, property or a location.

Police: Sworn officers of a State, Territory or Federal Police Force.

Police Tactical Group (PTG): A highly trained police unit that tactically manages and resolves highrisk incidents, including terrorist incidents.

***

(1) NSW Police Force Active Armed Offender Manual ver.2
(2) Ibid
(3) NSW Police Force Safe Places Vehicle Management Guide

***

Prohibited weapon: A weapon that is prohibited or restricted by law in relation to its manufacture, dealing, possession, or use.

Rapid deployment: The swift and immediate deployment of police and other emergency services personnel to an ongoing situation where delayed deployment could result in death or serious injury (4).

Situational awareness: The ability to quickly recognise and interpret an event, make sound decisions based on those interpretations, and establish early, effective and continuous lines of communication between the incident site and the controlling agency in order to provide ongoing accurate information about the situation to responders.

Terrorist act: An act or threat committed with the intention of advancing a political, ideological or religious cause, and which is intended to coerce or intimidate an Australian government, a foreign government, or sections of the public, which causes serious physical harm or death to a person, endangers a person’s life, causes serious damage to property, creates a serious risk to the health and safety of the public, or seriously interferes with, seriously disrupts, or destroys, an electronic system (5).

Threat context

Active armed offender attacks continue to be one of the most common tactics adopted by terrorists and other criminals around the world. This is, in part, due to the relative ease of access to weapons, including edged weapons and firearms – although the availability of such weapons varies between countries.

In Australia, the use of firearms in a terrorist attack is considered feasible even though these weapons are well regulated. Recent overseas experiences, such as the April 2017 attack on London Bridge and the Borough Market, demonstrates the ability of terrorists to use edged weapons to inflict multiple casualties and injuries.

Terrorist propaganda continues to encourage individuals, particularly those based in Western countries, to conduct attacks at home if they are unable to travel to conflict zones. Terrorist propaganda – and other sources of violent extremist guidance available both online and offline – can provide simple, practical guidance on how to prepare for and conduct a terrorist attack. Australia and New Zealand are not immune to active armed offender attacks. Several attacks targeting places like shopping centres, universities and public spaces have been disrupted. Firearms have featured in three terrorists attacks in Australia since 2014. Active armed offender attacks in Australia remain a real, persistent and substantial threat to the community.

Violent Islamist extremists are not the only source of active armed offender threat. Any extremist ideology can give rise to this tactic and some offenders may not be motivated by ideology at all. The deadliest mass casualty shooting in Australia – the 1996 Port Arthur massacre – was perpetrated by an individual with no links to an extremist ideology.

The current security context assessment is contained at Appendix A

***

(4) NSW Police Force Active Armed Offender Manual ver.2
(5) Criminal Code Act 1995 (Cth)

***

Characteristics of active armed offender incidents

An active armed offender attempting to kill and injure as many people as possible within the shortest period of time will generally target places with the most number of people in close proximity, i.e. crowded places.

The sudden, unpredictable, and rapid development of active armed offender incidents often means the first responders to these incidents may include uniformed and/or plain clothes police, protective service officers or security guards.

An active armed offender incident does not generally include a hostage situation, but can potentially transition into one, particularly during the police resolution phase. Attackers took hostages in two of the three terrorist attacks involving firearms in Australia since 2014.

General features

Current research has not identified any consistent trends in active armed offender incidents, particularly in the Australian-New Zealand context. However, there are some common elements for the majority of active armed offender incidents; namely:

  • Incidents often occur in crowded places where the offender has access to a large number of potential victims;
  • Most incidents will evolve rapidly and are often reach resolution quickly;
  • Many active armed offenders will continue to attempt to harm victims until confronted by law enforcement personnel or some other type of intervention occurs; and
  • Most incidents will not be effectively resolved through negotiation or peaceful means.

Weapons

Firearms

Historically, active armed offender incidents in Australia have involved the use of long arm weapons (rifles and shotguns), although the use of handguns has become more prominent over the past decade. Firearm ownership restrictions introduced by the government following the Port Arthur massacre significantly reduced the number of semi- automatic weapons in the country. However, some licensed firearms, and firearms acquired through illegal means, continue to pose a genuine threat to the public. Domestic and international experience emphasises that well- planned and coordinated attacks using high powered firearms remain an enduring threat.

Prohibited Weapons

Laws have been changed to make our community safer by reducing the number of items in the community that are easily concealed, easily carried, and are designed to kill or injure people. These laws make it an offence for a person to have prohibited weapons, unless exempted in special and limited circumstances. Although illegal, many prohibited weapons can still be purchased without license and exist in significant numbers in the community. An active armed offender has relatively
easy access to these weapons, including edged weapons such as large knives, machetes and swords.

Improvised Weapons

Improvised weapons are commonly used by attackers when they are unable to obtain conventional weapons such as firearms and/or prohibited weapons.

Anything can be an improvised weapon if it is carried with the intention of hurting someone or if it is being carried in a threatening way. Any common or every day item such as a knife, bottle, screwdriver, baseball bat, or even a motor vehicle can be an improvised weapon.

A motivated individual can easily use such items to kill or inflict serious injury. Improvised weapons are only limited by an individual’s imagination. It should be noted they could also be used to defend against an active armed offender as a last resort.

Primary objectives

In most incidents, active armed offenders need freedom of movement and ready access to victims in order to achieve their objective. Therefore, minimising the offender’s access to potential victims should be the primary objective of any plans or strategies. This is most likely to be achieved through the following activities:

  • Initiating immediate response arrangements;
  • Minimising the duration of the incident;
  • Restricting the offender’s movements;
  • Moving people from danger;
  • Preventing people from entering the scene; and
  • Helping police to locate and isolate the active armed offender.

TIME + FREEDOM OF MOVEMENT = INCREASED CASUALTIES
Australia’s National Counter-Terrorism Plan recognises the need to prevent, prepare for, respond to and recover (PPRR) from terrorist acts. The Plan can be found on the National Security website. The PPRR concept does not represent a consecutive set of activities and many elements of PPRR will often occur concurrently. Event organisers and owners and operators of crowded places are strongly encouraged to ensure their own prevention, preparedness, response and recovery arrangements align with those of emergency service agencies, and in that regard, the following information provides useful guidance on how PPRR activities might best be developed, particularly in terms of active armed offender situations.

Prevention

Not all risks or emergencies can be prevented. The concept of prevention should therefore have a broad meaning to encompass activities that may reduce the severity or impact of the emergency event. General prevention-related activities can include gathering and analysing intelligence, developing strategies to reduce the impact on life and/or property, and identifying or eliminating vulnerabilities at potential target sites. This can be largely achieved through business-to-business and business-to- government engagement.

For most types of active armed offender attacks, prevention activities should aim to:

  • Assess the threat and risk to address vulnerabilities;
  • Develop a proactive protective security posture;
  • Deter a would-be attacker – by providing obvious physical and electronic security measures, coupled with good risk management practices;
  • Detect an intrusion – by providing alert and visual detection systems; and
  • Delay or limit the intrusion for a sufficient period to allow a response force to attend – by putting in place measures that will potentially limit the movement of the offender and reduce access to further victims.

For active armed offender attacks, prevention- related activities specifically aimed at mitigating or reducing the severity of the incident should also be considered. The main focus of those activities should be on restricting the movement of the offender/s while reducing their access to further victims. How to best achieve this will depend on many variables, such as the physical design and security features of the crowded place, the movement of the offender/s and the opportunities for victims to escape or shelter in place.

Not all crowded places will share the same risk profile or have similar vulnerabilities, so the principle of proportionality should generally be applied to any prevention-related activities. This means that protective security measures not only need to be proportionate to the level of assessed risk, they should also strike a reasonable balance between protecting the public and, where possible, preserving the public’s use and enjoyment of these places. When measuring proportionality it should be recognised that prevention and mitigation activities related to terrorism may also provide broader crime prevention and public safety benefits.

Preparedness

Activities associated with preparedness include risk assessment, emergency planning, resourcing, capability development, and testing of preparedness arrangements. Risk management activities are generally focused on the development of standing plans for known or expected incidents, threats or emergency events. However, for unexpected and dynamic events, such as active armed offender incidents, crowded place owners and operators should consider adopting a ‘contingency planning’ approach.

Contingency planning

The aim of contingency planning is to enable a situational approach to responding to emerging threats in unexpected situations. Contingency plans supplement or complement general emergency response plans and arrangements, and are often designed as sub-plans. Some of the basic features of contingency plans are outlined below.

Combined and coordinated management

Contingency plans should be based on a multi-stakeholder approach. They should consider and, where possible, integrate venue plans and arrangements with responding agency response plans and arrangements.

Assessment

Factors to consider when designing contingency plans include the characteristics of the crowded place and the potential consequences of an attack at that location. Information and intelligence relevant to the likelihood of a particular target being subject to that type of threat should also be considered during the risk assessment process. Owners and operators should avoid a ‘one size fits all’ approach, as the design and physical layout of each crowded place will be different.

Application

Contingency plans should provide a range of options to deal with a number of foreseeable scenarios. There is no one set of plans that can be applied to every emergency situation, therefore arrangements need to be sufficiently flexible and scalable so they may be appropriately applied according to the nature and impact of the crisis. However, there are some common objectives that characterise the application of emergency response arrangements. These include:

  • Saving and protecting life;
  • Facilitating the evacuation of those at risk;
  • Containing the incident or threat; and
  • Supporting the emergency response and investigation activities.

Contingency plans should form part of overall emergency planning and briefing arrangements. All emergency plans should be tested and reviewed on a regular basis to ensure they are well understood, contemporary and effective. Guidance for initial
response considerations for crowded places is contained at Appendix B.

Response

Initial response

Because of the dynamic and unpredictable nature of active armed offender incidents there is no
single best practice that crowded place owners and operators can build into their plans, arrangements
and training activities. The primary objective of any initial response planning should be to minimise
the offender’s access to victims. Therefore owners and operators should develop and practise
strategies aimed at evacuating people and isolating the offender.

Active Armed Offender attack – initial action advice for individuals Refer to Appendix C for
further details.

Escape: The priority is to remove victims from close proximity to the offender. Occupants of crowded places should consider evacuating the site if it is safe to do so. People should leave behind most belongings and determine the safest escape route before beginning to move. Maintaining situational awareness and making good use of available concealment or cover while
moving is also important.

Hide: If unable to safely evacuate, shelter in place ensuring people take advantage of available concealment or cover from offender.

If safely evacuating the venue is not possible, occupants of crowded places should attempt to hide in a secure area where they can lock the door, blockade the entrance with heavy furniture, cover windows, turn off lights and remain silent. Mobile phones or other personal electronic devices should also be turned to silent. Avoid congregating in the open.

If the option of hiding is adopted, individuals should continually re-assess the situation and their opportunities to safely evacuate or better secure themselves within the premises. They may also need to consider options to incapacitate the active armed offender in the event they are located. This can include using or throwing available objects or using aggressive force when confronted. Such action should only be taken as a last resort and in order to protect life.

Tell: The more information people can pass on to the police or owners and operators the better, but NEVER at the expense of an individual’s own safety or the safety of others.

If it is safe to do so information should be provided immediately to the police via 000. People passing on information to law enforcement may be asked to remain on the line and provide any other information or updates that the operator requests.

Consideration should always be given to providing information and advice to others who may be unfamiliar with the site, the nature and extent of the threat, or what they should do to remain safe.

Transition considerations

Responsibility for implementing and coordinating initial response activities will, in most instances, be
assumed by the management or security staff of the crowded place pending the arrival of police first
responders. A critical aspect of managing the initial response and transitioning responsibility to police
will be the ability to gain ‘situational awareness’.

Police need an accurate picture of a situation and how it has developed. To enable this, owners and
operators need to establish quick, effective, and continuous lines of communication from the incident
site to police. Understanding the requirements of police first responders will also enable a faster
transition of incident management from owners and operators to police. Planning and staff
capability/training activities should include:

  • Developing strategies that allow designated staff to safely maintain situational awareness of the incident and relay any new information to responding police; and
  • Training staff and occupants on how to react when police arrive on scene.

Guidance for initial response considerations for affected staff and occupants is contained at
Appendix C.

Police response

The Australian Federal Police, and law enforcement in each of the states and territories, have robust systems and inter- agency arrangements in place that guide their response to a range of natural and manmade emergencies. Whilst these procedures are designed to reflect the specific needs, capacity and capabilities of each jurisdiction’s operating environment, common amongst them are requirements for police to employ:

  • Operational response strategies that are designed to defeat, or at least mitigate, a range of specific threats;
  • A use of force model supported by operational principles, skills, tactics and training.

There are a number of differences in emergency management arrangements, processes and terminology across the states and territories. It is therefore critical that the owners and operators of crowded place and major event stakeholders develop a firm understanding of the emergency service arrangements that apply to the jurisdiction in which they are operating. Information on arrangements in each state and territory can be found at www.nationalsecurity.gov.au/WhatAustraliaIsDoing/Pages/
StatesandTerritories.aspx.

Due to the often unpredictable and dynamic nature of active armed offender incidents, highly trained police tactical group operators may be unable to respond to a scene immediately. As such, police first responders will generally provide the initial response to most active armed offender situations and may potentially manage them to their conclusion. It is expected that the following objectives will guide initial response actions in all jurisdictions:

Saving lives and minimising risk of serious injury: This will generally be achieved through a rapid deployment strategy, the purpose of which is to defeat or mitigate the threat posed by the active armed offender as quickly as possible.

Locate and isolate: The focus of police first responders will be to locate the offender(s) with a view to reducing their area of operation and access to further victims.

Resolve: When responding to an active armed offender incident, police first responders are trained to move toward the threat at a sustained pace to defeat or disarm the offender. In doing so, they may initially need to keep moving past panicked and injured people. Their primary goal is to prevent the offender killing or causing serious injury to further victims.

Command and Control

In active armed offender situations it may not be possible to establish traditional command and control arrangements in the first instance. As a consequence, it is more likely that the formal implementation of command and control will become  secondary priority that is undertaken by police attending the scene in the wake in the first responders.

Recovery

To ensure a smooth transition from response to recovery, arrangements that commenced during the response phase should be gradually devolved and integrated. This will include aspects such as media and information management, impact assessment, rehabilitation of the built environment and restoring community and staff confidence.

While many recovery-related matters are similar across the majority of emergency events, significant or traumatic events such as terrorist acts may add extra complexity to recovery procedures. Key recovery considerations following an active armed offender incident may include:

  • Public information and community confidence;
  • Scene preservation and investigation activities; and
  • Business continuity challenges.

Public information

Media or public information activities must support operational policies and actions. To achieve this, a co-ordinated public messaging strategy should be developed between law enforcement and the owners and operators of the affected crowded place. This is particularly important in situations where an offender has been taken into custody or charged with offences relating to the incident.

Information should be provided regularly to keep the public informed and should only be restricted in the interests of public safety and/ or operational security. Matters relating to consequence management, such as providing assistance to victims, should be clearly identified as separate from the actual incident or security issue. As a general rule:

  • An agency must only comment upon matters for which it has responsibility; and
  • A log of all public information activities and decisions should be maintained.

Crime scene and investigation activities

A major investigation will always follow a police response to an incident involving an active armed offender. This could involve criminal and forensic investigations in relation to potential criminal offences (including acts of terrorism), as well as inquires conducted on behalf of the coroner. These investigative processes will need to be extremely thorough and may often be protracted, particularly where death or serious injury has occurred, the incident has taken place over a broad geographical
area, or involves significant forensic challenges.

During the investigation phase the police may also seek assistance from owners and operators of crowded places to help identify potential sources of evidence or witnesses. This could include CCTV footage, radio, telephone, or decision-making logs. Recovery or business continuity plans should identify a suitable liaison officer, at an appropriately senior level within the organisation, who can work with the police to help facilitate these types of requests.

Business continuity

The ability of owners and operators of crowded places to return to business-as-usual following a terrorist attack, or other disaster, depends on how effectively they can devise and implement their business continuity arrangements.

Through their contact with investigating police, the nominated liaison officer will generally be in a position to obtain information about the likely duration of the crime scene examination, allowing the venue to start implementing their business continuity arrangements. While the actual process may not change significantly, the amount of time it takes often will.

Useful links

Australian national security: www.nationalsecurity.gov.au

Australia’s Strategy for Protecting Crowded Places from Terrorism: www.nationalsecurity.gov.au/crowdedplaces

Emergency management section on the AGD website: www.ag.gov.au/emergencymanagement

ASIO Business and Government Liaison Unit: www.bglu.asio.gov.au

Version control

This document is endorsed by the Australia-New Zealand National Counter-Terrorism Committee (ANZCTC) and maintained by the Attorney-General’s Department (AGD). AGD is responsible for the version control of this document. To preserve the integrity and currency of this document:

  • major amendments must be endorsed by the ANZCTC;
  • minor amendments, for example to correct spelling or grammar, should be documented and forwarded to the Attorney-General’s Department to be implemented and then
  • a revised version sent to the CPAG to be endorsed before it is distributed.

Appendix A: Current security context

In September 2014, the Australian Government raised the national terrorism threat level for Australia to HIGH. While a significant elevation, there was no indication that a terrorist attack was imminent. On 26 November 2015, a new five level terrorism threat advisory system was introduced and the national terrorism threat level set at PROBABLE. This means that
credible intelligence, assessed to represent a plausible scenario, indicates violent extremists in Australia have an intention and capability conduct terrorist attacks in Australia. Recent low-capability terrorist attacks and disrupted plots in Australia and overseas reinforce the elevated threat and provide cogent examples of the enduring terrorist threat.

The principal threat to Australia comes from individuals and small groups who adhere to the violent extremist ideologies associated with groups such as the Islamic State of Iraq and the Levant (ISIL), al-Qaida, and their affiliates. These groups have dedicated media organisations and are adept at utilising social media to inspire, encourage, and in some cases direct, attacks in the West, including in Australia. The conflict in Syria and Iraq and the notion of ISIL’s so-called caliphate continue to appeal to those susceptible to the extremist rhetoric of these groups. Individuals who are attracted to the jihadist narrative, including a cohort prevented from travelling, as well as a small number of Australians involved with violent extremist groups overseas, present long term security challenges.

Self-directed ‘lone actors’ attacks using firearms, homemade explosives, or basic weapons are increasing in the West and by
their nature present a significant challenge for security and law enforcement agencies. Such attacks are often spontaneous and utilise easily acquired weaponry that requires no specific skill to use effectively. The lone actor threat is not confined to Islamist extremists.

While the symbolic appeal of an attack against a government or authority – such as the military, police, and security agencies – elevates the threat to these entities, members of the public and locations where large crowds congregate could also be attacked indiscriminately. Attacks against the general public in crowded places are designed to cause injury or death and are aimed at disrupting lives and causing fear – even a simple attack can meet this objective.


Appendix B: Active armed offender attack – advice for owners and operators of crowded places

Response priorities: During an Active Armed Offender incident the primary response objectives and the potential actions for achieving them may include:

1. Saving and protecting life
a. Appoint an incident manager to coordinate activities until police arrive.
b. Use the built environment to restrict or deny access.
c. Commence CCTV surveillance and track the offender(s).
d. Communicate appropriate escape or hide options to those present.
e. Identify and establish a safe medical triage/first aid location.
f. Restrict further vehicle access to the site (bollards, gates, road closures, etc).
g. Restrict physical access to the site or general vicinity.

2. Facilitating the evacuation of those
at risk
a. Notify key staff of the incident through prearranged messages/codes and methods.
b. Appoint an evacuation manager and ensure they have situational awareness
c. Provide guidance on safe routes (considering cover & concealment) for those who are selfevacuating.
d. Assess the suitability and potential safety of normal evacuation routes.
e. Evaluate the safety of standing evacuation muster points and change if necessary.
f. Identify potential safe places or strong holds for those unable to evacuate

3. Containing the incident or threat
a. Consider electronic/ mechanical isolation systems to constrain the movement of the offender/s or restrict access to potential victims.
b. Identify and establish a suitable perimeter for securing the location.
c. Use the existing built environment to best advantage for safety and containment action.
d. Consider restricting escape options for the offender/s if these may endanger others.

4. Supporting emergency response and investigation activities
a. Initiate and establish communications with police agency through ‘000’ or other means.
b. Identify and communicate safe access routes/form up points for emergency services.
c. Consider using CCTV and other remote methods where possible to enable situational awareness.
d. Commence incident and decision-making logs.
e. Nominate a suitable emergency services liaison officer to meet/brief the police.
f. Ensure access to site plans and CCTV footage (where possible).
g. Clearly identify when incident management has transitioned to the police.
h. Provide ongoing support to the emergency response action as requested.

It is important to regularly practise these and any additional initial response activities so that key managers and staff clearly understand the priority actions and are able to perform these actions in a high-stress and dynamic environment.


Appendix C:Active Armed Offender attack – initial action advice for individuals

When attacks involving firearms and other weapons occur it is important to be prepared to react quickly. Considering your potential options and actions in advance will help you to make more informed decisions quickly in a stressful and chaotic environment. The following advice may help with pre-planning your response options.

ESCAPE

Your priority action should be to remove yourself and others from close proximity to the offender/s, or areas that they might reasonably access. The following actions may influence the decisions you make in safely assessing your available options: 

Under immediate attack – Take cover initially, but attempt to leave the area as soon as it is safe to do so.

• Leave most of your belongings behind (except for mobile phone).
• Do not congregate in open areas or wait at evacuation points.
• Provide guidance to people that might be unfamiliar with the area.
• Make good use of available cover and concealment opportunities.
• Consider (only as a last resort) options for arming yourself with improvised weapons to defend yourself in the event that you are located by the offender.

Nearby attack – Leave the area immediately and move quickly from where the attack is located, but only if it is safe to do so.

Cover from gunfire

• Brickwork or concrete walls;
• Vehicles (engine block area);
• Large trees & fixed objects; and
• Earth banks/hills/mounds.

Concealment from view (in addition to above options)

• Building walls and partitions (internal and external);
• Vehicles;
• Fences and other large structures; and
• Blinds/curtains.

HIDE

If you don’t believe you can safely evacuate, then you may need to consider sheltering in place. Constantly re-assess the situation and your options based on the best available information.

• Avoid congregating in open areas, such as corridors and foyers;
• Consider locking or barricading yourself and others in a room or secure area;
• Secure your immediate environment and other vulnerable areas;
• Move away from the door, remain quiet and stay there until told otherwise by appropriate authorities, or you need to move for safety reasons;
• Silence mobile phones and other devices that may identify your presence;
• Try to contact police (000) or others to advise of your location and situation;
• Assess and re-assess better options for sheltering in place either within your current location or at an alternative location;
• Choose a location which may enable access to a more secure area; and
• Consider (only as a last resort) options for arming yourself with improvised weapons to defend yourself in the event that you are located by the offender.

TELL

The more information you can pass on to the police or owners and operators the better, but NEVER at the risk of your own safety or the safety of others.

If it is safe to do so, think about obtaining the following information:

• Exact location of the incident;
• Description of the offender/s and whether they are moving in any particular direction;
• Details of any weapons being used;
• Number of people in the area and any that have been injured; and
• The motive or intent of the offender/s (if known or apparent).

Provide this information immediately to the police via 000 if this can be achieved safely. You may be asked to remain on the line and provide further that the operator requests or if the situation changes.

Consider providing information and advice to others that may be in your area that may be unsure of the current location of the threat and what they should do. Whether you are able to safely do this, and the communication methods available to you, will be determined by the circumstances and your own assessment of the situation.

Police response

In an Active Armed Offender scenario a police officer’s priority is to protect lives. One of their priority actions to achieve this will be to locate the offender and effectively manage that threat as quickly as possible, which could mean initially moving past people who need help.

As more police resources become involved they will attempt to quickly provide support and guidance to persons affected by the incident.

At some stage they will conduct a ‘clearance’ search of the location to ensure that all persons involved or impacted by the incident are located, and to make the scene safe.

Please remember:

• Upon arriving at the scene, it is possible police officers may initially not be able to distinguish you from the offender(s);
• Police officers will be armed and could point guns in your direction;
• Avoid quick movements or shouting and keep your hands in view;
• They may initially move past you in search of the offender/s;
• Be aware that police may enter your location at some stage to secure the building and locate people that have hidden from the threat; and
• Promptly follow any instructions given by emergency responders.

Information and advice

In life-threatening situations or in the case of an emergency, dial 000.

Suspicious or unusual behaviour should be reported to local police by phoning 131 444 or by contacting the National Security Hotline on 1800 123 400, if the information is not time-critical.

For all other inquiries, contact police in your jurisdiction. Contact details can be found at www.nationalsecurity.gov.au/crowdedplaces.