situation manual template - sacoes.org active shooter mall s… · web viewthe mall is an active...

Virtual Tabletop Exercise (VTTX) - Active Shooter (Mall)Complex Terrorist Attacks & Non-Stafford Act Incidents Principals’ Objective (PO)

Situation ManualMarch 20, 21 & 22, 2018

This Situation Manual (SitMan) provides exercise participants with all the necessary tools for their roles in the exercise. Some exercise material is intended for the exclusive use of exercise planners, facilitators, and evaluators, but players may view other materials that are necessary to their performance. All exercise participants may view the SitMan.

Rev. April 2013HSEEP-DD05

Situation Manual Virtual Tabletop Exercise(SitMan) Active Shooter, Mall

EXERCISE OVERVIEW

Exercise Name Virtual Tabletop Exercise (VTTX) - Active Shooter (Mall)

Exercise Dates March 20, 21 & 22, 2018

ScopeThis is a discussion-based exercise, planned for four hours hosted by the Emergency Management Institute (EMI) and conducted with multiple remote video teleconference sites

Mission Area(s) Response and Recovery

Core Capabilities

Planning, Public Information and Warning, Operational Coordination, On-Scene Security, Protection and Law Enforcement & Healthcare and Emergency Management Services.

Objectives

This VTTX was written with no SMART objectives listed. SMART objectives are the responsibility of the agency taking part, if they wish to do so. As a discussion-based exercise, participating agencies discuss practicing group problem solving, familiarizing senior officials with a situation, conducting a specific case study, examining personnel contingencies, testing group message interpretation, participating in information sharing and assessing interagency coordination

Threat or Hazard Active Shooter

Scenario This VTTX was designed around the realistic scenario of an active shooter event-taking place at a shopping mall.

Sponsor FEMA – Emergency Management Institute (EMI)

Participating Organizations

Federal, state, tribal or local levels of government agencies while utilizing the whole community approach of including applicable representative organizations (such as private sector partners, voluntary agencies, school districts, etc.) within each jurisdiction.

Point of Contact

Douglas M. Kahn at [email protected] or 301-477-7645

General Inquires: [email protected] or call 301-447-1381

Exercise Overview 1 FEMA Emergency Management Institute

Homeland Security Exercise and Evaluation Program (HSEEP)


GENERAL INFORMATIONExercise Objectives and Core CapabilitiesThe following exercise objectives in Table 1 describe the expected outcomes for the exercise. The objectives are linked to core capabilities, which are distinct critical elements necessary to achieve the specific mission area(s). The objectives and aligned core capabilities are guided by elected and appointed officials and selected by the Exercise Planning Team.

Exercise Objective Core CapabilityAssist participants’ knowledge, skills, and abilities to effectively conduct all-hazards emergency response.

Planning, Public Information and Warning, Operational Coordination,

Allow participating locations to share preparation, response and recovery solutions with all participants.Enable participants to better coordinate response operations with counterparts from Federal agencies, State governments, local governments, private sector organizations, and nongovernmental agencies.

On-Scene Security, Protection and Law Enforcement & Healthcare and Emergency

Management Services

Table 1. Exercise Objectives and Associated Core Capabilities

Participant Roles and ResponsibilitiesThe term participant encompasses many groups of people, not just those playing in the exercise. Groups of participants involved in the exercise, and their respective roles and responsibilities, are as follows:

Players. Players are personnel who have an active role in discussing or performing their regular roles and responsibilities during the exercise. Players discuss or initiate actions in response to the simulated emergency.

Observers. Observers do not directly participate in the exercise. However, they may support the development of player responses to the situation during the discussion by asking relevant questions or providing subject matter expertise.

Facilitators. Facilitators provide situation updates and moderate discussions. They also provide additional information or resolve questions as required. Key Exercise Planning Team members also may assist with facilitation as subject matter experts (SMEs) during the exercise.

Evaluators. Evaluators are assigned to observe and document certain objectives during the exercise. Their primary role is to document player discussions, including how and if those discussions conform to plans, polices, and procedures.

Module 1: Incident Notification and Response 2 FEMA Emergency Management Institute



Exercise StructureThis exercise will be a multimedia, facilitated exercise. Players will participate in the following three modules:

Activity Time

Introductions 15 MinutesModule 1 – Incident Notification and Response 60 Minutes

Module 2 – Operations 60 MinutesModule 3 - Extended Response and Recovery 60 Minutes

Each module begins with a multimedia update that summarizes key events occurring within that time period. After the updates, participants review the situation and engage in functional group discussions of appropriate prevention/protection/mitigation/response/recovery issues.

Exercise Guidelines This exercise will be held in an open, low-stress, no-fault environment. Varying

viewpoints, even disagreements, are expected.

Respond to the scenario using your knowledge of current plans and capabilities (i.e., you may use only existing assets) and insights derived from your training.

Decisions are not precedent setting and may not reflect your organization’s final position on a given issue. This exercise is an opportunity to discuss and present multiple options and possible solutions.

Issue identification is not as valuable as suggestions and recommended actions that could improve prevention/protection/mitigation/response/recovery efforts. Problem-solving efforts should be the focus.

Exercise Assumptions and ArtificialitiesIn any exercise, assumptions and artificialities may be necessary to complete play in the time allotted and/or account for logistical limitations. Exercise participants should accept that assumptions and artificialities are inherent in any exercise, and should not allow these considerations to negatively impact their participation. During this exercise, the following apply:

The exercise is conducted in a no-fault learning environment wherein capabilities, plans, systems, and processes will be evaluated.

The exercise scenario is plausible, and events occur as they are presented.

All players receive information at the same time.

MODULE 1: Incident Notification and ResponseDate: Saturday, 12 December 2016




Time: 1200Location:

Your local mall is packed with shoppers trying to fulfill their last minute holiday gift lists. Throughout the holiday shopping season, there have been no threats or outbreaks of crime inside the mall complex.

Saturday, December 12 - 1210 hrsWithout warning, there is an explosion outside the Bass store, #710. Glass and scraps of metal from the bomb are hurled at tremendous velocity in all directions; becoming lethal projectiles. The explosion creates panic from shoppers inside the mall. Several small fires have also begun to burn in and around the blast area.

The 9-1-1 call center is inundated with phone calls as citizens call in to report the explosion. In addition, calls for assistance are made via radio to dispatch police patrols that are nearby at the time of the blast. The mall security service also calls 9-1-1 to confirm an explosion.

Saturday, December 12 –1213 hrs.Suddenly shooting is heard throughout the mall; coming from the Nike outlet, #500. The weapon is an AK-47. Calls to 9-1-1 change from a fire in the mall to shots fired with people down. Patrol units are several minutes from arriving. The dispatched Fire Department and EMS units are now being advised, by (local) police to stage at the north entrance of the mall.

A second explosion is heard in the mall, smoke is showing from the explosion. Mall security has advised 9-1-1 that the second blast has come from the Adidas store, #730.

Saturday, December 12 –1219 hrs.The first on the scene police patrol units are assessing the situation. There are still shots being fired as officers enter the mall from the entrance next to Customer Service, #99. One of the officers inside the mall broadcast that they can see many people down, shots fired at officers, and smoke filling the mall. Additional officers are requested and an Emergency Response Team (ERT) needs to be called out.

The Fire Department and EMS have begun to arrive. They are beginning their operations of providing emergency medical care to victims that have made their way outside the mall, as well as firefighting preparations. A police sergeant has arrived and has taken over as the Incident Commander. The on-scene fire officer is requesting a second alarm and mass casualty incident (MCI) box card assignment. The MCI alarm will bring an Ambulance Strike Team and two aeromedical evacuation helicopters.

Saturday, December 12 –1225 hrs.




The senior EMS officer on the scene provides an initial casualty estimate of 100-plus victims inside the mall, with an unknown number of injured victims. Police officers have exchanged gunfire with the suspect, who has now relocated to the Calvin Kline store, #480. The description of the suspect is “Person in black jeans, combat boots, black beanie hat and wearing body armor, with automatic weapons, 5’6, and 150 lbs.” The officers are also reporting many victims need immediate medical aid.

Television and radio stations interrupt their regular afternoon programming with news of the explosion and shootings:

“…there are few details at this time, but it seems that just minutes ago there were multiple explosions and shots fired at the mall. We have unconfirmed reports that hundreds of people have been injured and that the building itself is on fire. Several witnesses have reported that a second explosion occurred a few minutes after the first, which would suggest that this was not an accident, but an act of terrorism…”

Key Issues Two explosions and shootings reported at the mall injuring at least 100 people.

A mass casualty incident (MCI) has been declared.

News outlets are covering the incident and have crews on the scene.

QuestionsBased on the information provided, participate in the discussion concerning the issues raised in Module 1. Identify any critical issues, decisions, requirements, or questions that should be addressed at this time.

1. What preparations have been made to prepare for an active shooter? Have any involved private sector and businesses? Is there a police substation or dedicated patrol officer in the mall?

2. What actions have already taken place in your community to identify potential locations of active shooter events?

3. What are some suggested incident objectives for this operational period?

4. What potential coordination and policy issues could arise?

5. Do standard first responder protocols need to be reexamined at this time?

6. What information is vital to the safety of the public? How will the Joint Information System (JIS) assist in gathering, verifying, coordinating, and disseminating this public information?

7. How will a common operating picture be maintained within and across all jurisdictions of an incident? What is the role of policy and decision makers in this effort?




8. What enhanced security improvements could be put in place today at little or no cost?




MODULE 2: ResponseDate: Saturday, December 12, 2016Time: 1235Location:

The Emergency Response Team (ERT) has arrived and made entry into the mall. One entry point was the entrance near the Customer Service counter in store #99; a second team has made entry from the entrance near the Eddie Bauer store, #570. The ERT will be used to locate and engage the suspect; who is believed to be located within the Calvin Klein store, #480. Only one suspect has been located and identified. The ERT will direct people inside the mall to the designated exit. Once the people have self-evacuated, they will be searched outside the mall by sheriff deputies and police officers from surrounding areas that were called in from mutual aid. Medics (EMT’s and Paramedics) will be identifying critical patients and escorting those patients to the triage area once the areas are rendered safe by entry teams.

A main triage area has been set up a short distance from the mall’s east exits. Transporting victims from the on-site triage location to nearby hospitals remains problematic due to the number of victims, number of ambulances and distance to local trauma centers. Victims being evacuated from the mall include multiple gunshot wounds, blast injures, burns and shock. Paramedics, EMT’s and other first responders are transporting victims to the triage area from the mall exits using “gator” and golf cart type vehicles. Several medical doctors that were in the mall are now volunteering their services at the triage area. Many injured have tourniquets applied and several are “walking wounded” with symptoms of shock taking affect. Fire crews have not made entry into the mall as of yet, they are waiting for the ERT to take the suspect into custody.

Saturday, December 12 –1245 hrs.As the ERT gets closer to the suspect, the shooting has become erratic, suggesting the shooter may be preparing for a “last stand”. The ERT makes entry and engages the suspect, who has begun to shoot at close range. Before the ERT can make an arrest, the suspect commits suicide.

Saturday, December 12 –1300 hrs.News outlets, locally and nationally, continue to broadcast live footage from mall. News media and the public are clamoring for information on the incident some have broadcast unfiltered YouTube uploads. Reporters and news analysts openly speculate whether this is an isolated attack or merely the first in a coordinated series of attacks. Several wildly inaccurate stories based on poor or false information have been reported, including one that claimed a VBIED attack had been unsuccessfully attempted at a bank.

In addition to the influx of seriously injured patients being transported to the hospitals by EMS, a large number of “walking-wounded” are now arriving seeking medical attention. The surge capacity at the hospitals closest to the scene has been exceeded. Only the most critically injured victims in need of immediate life-saving care will be admitted to these hospitals, while other less seriously injured victims will be diverted to hospitals further away.

Module 2: Response 7 FEMA Emergency Management Institute



FBI Special Agents from the closest field office, along with a few Alcohol, Tobacco and Firearms (ATF) Special Agents have arrived at the scene and are coordinating with the (local) Police Department to conduct a preliminary investigation into this crime.


The Mayor has declared a local state of emergency and requested a gubernatorial declaration. Shortly thereafter, the State’s Emergency Management Agency informs the Mayor that the governor’s declaration is pending and expected to be signed shortly.

From the joint preliminary investigation, it is clear that the explosions and shootings were an intentional act of terrorism. The investigation has just started and the Mayor does not want any premature accusations’ that the event is terroristic in nature. The FBI has assumed the lead for the investigation, drawing on all their federal resources. They are working closely with the local government to uncover more details and apprehend anyone else who may have been involved in the planning or execution of the attack.

The (Local) Emergency Management office has set up a reunification (Family Assistance Center) location, which is being staffed by mental health professionals, chaplains, Red Cross members and police investigators. A local elementary school was chosen for its close location and secured facilities.

SUMMARY OF CASUALTIES**As of 12 December, 2016 - 1600 hrs

Estimated total casualties.....................................................................................230

Estimated fatalities.................................................................................................75

** The total numbers are inclusive of both blast and shooting.

Key Issues Shooter has been neutralized.

Local hospitals are being overwhelmed by the number of victims requiring treatment.

A local state of emergency and a governor’s emergency declaration has been requested.

The public and the media must be supplied with accurate and helpful information in order to reduce confusion and panic and promote safety and confidence.


1. What procedures are in place for joint operations of LE/Fire/EMS? Have there been training or exercises for joint operations?

2. Have all the responders been accounted for in the ICS structure?




3. What steps will be taken to develop and disseminate public communications and utilize the multi-agency coordination system and the Joint Information Center (JIC)?

4. When is the first public release of information going to be released and who is going to release it, e.g. Mayor, Emergency Management, Fire Chief, or Police Chief?

5. Are there any unmet needs at this time that would be requested either through mutual aid, state resources or Federal resources?

6. How do FBI and ATF fit into the ICS command structure?

7. Would your agency’s Critical Incident Stress Management (CISM) team be alerted and brought to the scene?

8. In addition to FBI and ATF, have any outside agencies been brought in for guidance or assistance?

9. Who is responsible for set up and staffing of a Family Assistance Center in your community?

10. Where would a casualty collection point be placed? Who would staff?

11. At what point will photos and videos of the explosions be released to the public and media?

12. Who would be required to build the Incident Action Plan?




MODULE 3: EXTENDED RESPONSE AND RECOVERYDate: Saturday, December 12, 2016Time: 1800Location:

A makeshift morgue has been set up at the incident site to handle all the remains. However, it is becoming overloaded; it does not have the proper means to store the remains. Identifications have been difficult to obtain in some cases where the bodies were fragmented; advanced testing will be required to make any positive identification.

The Mayor requests that a Disaster Mortuary Response Team (DMORT) be deployed to the area to assist the medical examiner.

People are swamping call centers and hospitals with inquiries about their loved ones who might have been in the area at the time of the explosion, meanwhile other frantic family members have made their way to the security perimeter to seek help in locating their missing relatives.


The mall is an active crime scene and the all of the entrances have been secured. Family members have been at the mall parking lot for the past 2-3 hours hoping to get word about their missing relatives.

All the injured patients have been evacuated from the mall, triaged and transported to a medical facility. Many of the fatalities are still in place inside the mall and will not be released until investigating officers/agents mark the location that the body was discovered as this will help build a timeline of the shootings.

None of the responding agencies (Fire/EMS/Police) have been released from service at the mall. Firefighting efforts are still ongoing with all fires having been attended to. It is estimated that these units will be released in approximately 4-6 hours.

The request for the DMORT was approved by the Governor, and the team and equipment is en route. They are expected to arrive within the next 2-3 hours.


The President makes a live statement from Washington, DC. The President announces that numerous Federal resources are being made available to the community and State to investigate the crime.

The President assures the American people that the Federal government is committed to rapid apprehension and prosecution of all of the perpetrators of this horrific terrorist attack.

The President, Governor, and several other high-level officials plan to visit the scene and the victims from the incident in the next few days.

Module 3: Recovery 10 FEMA Emergency Management Institute




The long-term health, both physically and mentally, of the citizens and first responders are of serious concern. Several ideas are being addressed such as mandatory CISM briefings and keeping the responders in a paid leave status for several days, and using mutual aid for the next few days for patrol, fire and EMS services. One member of the city council has even brought up the need to have the National Guard on hand in case of another attack.

Several victims were identified as schoolchildren ranging in age from 10-16. The school board has asked for assistance in finding additional CISM and grief counselors that can be at local school. The board has already announced schools will be closed until Wednesday.

Local internet postings have indicated the potential for rallies in support of gun control on Sunday afternoon at 1500 hrs near the mall.

The mall owners have announced that the mall will not reopen until all investigations are complete, no matter the length of the investigation. The mall will also need maintenance for locations that received fire and water damage. There are also rumors that the mall will never reopen; which would displace 350 employees.

SUMMARY OF CASUALTIES **As of 12 December, 2016 – 2200 hrs

Total Casualties....................................................................................................300

Fatalities.................................................................................................................98

** The total numbers are inclusive of both blast and shooting.

Key Issues Operations are ongoing and expected to continue for some time. All of the responders

will need relief and support during extended operations.

The DMORT team has been dispatched and will arrive in the next 2-3 hours.

The President, Governor, and other officials are expected to arrive in the next few days.

Economic impact to community

School closings

Mutual Aid use while community responders recover


1. What follow on response forces will be needed?

2. How long will this operational period last?




3. When should the management of communications and public information return to normal operations?

4. What are the plans for remembrance of the deceased? Any location discussed?

5. How does the arrival of the President or the Governor affect the work force, security and logistics used at the crime scene?

6. What will the community do to bring visitors/tourists/finances back to the area after this event?




APPENDIX A: EXERCISE SCHEDULETime Activity

12:00 p.m. Welcome and Opening Remarks12:15 Module 1: Briefing, Caucus Discussion, and Brief-Back 1:15 Module 2: Briefing, Caucus Discussion, and Brief-Back 2:30 Module 3: Briefing, Caucus Discussion, and Brief-Back 4:00 Closing Comments

Appendix A: Exercise Schedule A-1 FEMA Emergency Management Institute



APPENDIX B: EXERCISE PARTICIPANTSParticipating Organizations

Appendix B: Exercise Participants B-1 FEMA Emergency Management Institute



APPENDIX C: RELEVANT PLANS

Appendix C: Relevant Plans C-1 FEMA Emergency Management Institute



APPENDIX D: ACRONYMS Acronym TermAAR After Action ReportATF Alcohol, Tobacco and Firearms (DOJ) ARC American Red CrossCISM Critical Incident Stress Management COP Common Operating PictureDHS U.S. Department of Homeland SecurityDMORT Disaster Mortuary Operational Response TeamsDOJ Department of JusticeEDT Exercise Design TeamEEG Exercise Evaluation GuideEMI Emergency Management InstituteEMS Emergency Medical ServicesEOC Emergency Operations CenterERT Emergency Response TeamFBI Federal Bureau of InvestigationsFD Fire DepartmentFEMA Federal Emergency Management AgencyFOUO For Official Use OnlyHSEEP Homeland Security Exercise and Evaluation ProgramIC Incident Command ICS Incident Command SystemJIC Joint Information CenterJIS Joint Information SystemLE Law EnforcementMAA Mutual Aid AgreementMACS Multi-Agency Coordination SystemMCI Mass Casualty IncidentMOA Memorandum of AgreementMOU Memorandum of UnderstandingPD Police DepartmentPOC Point of ContactSA Situational Awareness

Appendix D: Acronyms D-1 FEMA Emergency Management Institute



Acronym TermSBA Small Business AdministrationSITMAN Situation ManualSME Subject Matter ExpertTTX Tabletop ExerciseUC Unified CommandUSAR Urban Search and RescueVBIED Vehicle-Borne Improvised Explosive DeviceVTC Video TeleconferenceVTTX Virtual Tabletop ExerciseWMD Weapon of Mass Destruction

Appendix D: Acronyms D-2 FEMA Emergency Management Institute


situation manual template - sacoes.org active shooter mall s… · web viewthe mall is an active...

Documents