First 30 Group

08/13/2026

Coordinating the Blue Tsunami

Mass attack responses frequently involve overconvergence - dozens or even hundreds of officers arriving quickly, often from multiple jurisdictions and agencies.

Speed matters - but large numbers of officers operating inside a Hot Zone without coordination can create serious risk.

The Washington Navy Yard attack (2013) illustrates this clearly.

A total of 117 officers from multiple agencies entered Building 197 during the initial search for the attacker - many without coordination with Command and many in plain clothes.

During the response, eight officers from five different agencies discharged their weapons.

The After Action Report noted:

“It was reported that at least one law enforcement officer indicated that he and his colleagues were federal officers and the Navy Yard was a federal facility; therefore, they did not need ‘permission’ to respond to the incident and enter the scene. Despite the truth of that statement, the officer is ignoring the much greater implications and 𝐢𝐧𝐜𝐫𝐞𝐚𝐬𝐞𝐝 𝐫𝐢𝐬𝐤 𝐜𝐫𝐞𝐚𝐭𝐞𝐝 𝐛𝐲 𝐚𝐧 𝐮𝐧𝐜𝐨𝐨𝐫𝐝𝐢𝐧𝐚𝐭𝐞𝐝 𝐫𝐞𝐬𝐩𝐨𝐧𝐬𝐞.” (emphasis added)

Uncoordinated entry with multiple agencies operating independently can result in an ineffective use of resources and raises the risk of blue-on-blue incidents.

✅ Train officers to deploy deliberately, not reflexively
✅ Establish and enforce Staging early in the response
✅ Actively control who enters the Hot Zone

Packing the Hot Zone with cops isn’t the solution.

Managing it is - and that can be a heavy lift.

Does your training address overconvergence?

08/01/2026

60 years ago today: One of America’s earliest mass attacks unfolded at the University of Texas when a man, using sniper tactics from the top of the tower, killed 15 people before police and a civilian stopped him.

✅ Pre-attack murders: Before climbing the tower, the attacker killed his mother and wife. Similar pre-incident killings occurred in other attacks, including Charles University (Prague, 2023), Virginia Tech, VA (2007), Isla Vista, CA (2014), and others.

✅ Attacker access: The attacker hid weapons and ammunition in a large footlocker, used a rented dolly to move it through the tower, and disguised himself as a maintenance worker. An associate professor recalled seeing him and assumed he was simply a “workman with dolly and equipment.”

✅ Attacker barricading: To delay arriving police, the attacker used furniture and wedged a dolly against a door leading to his position.

✅ Sniper tactics: Positioned 231 feet above ground, the attacker fired on pedestrians below - wounding a man from over 500 yards away. The survivor later commented that he had underestimated the sniper’s effective range.

✅ Monitoring response: Equipped with an AM/FM radio, the attacker listened to live news reports to track developments during the assault.

✅ Concerns of multiple attackers: Heavy gunfire and constant movement on the tower led many to believe multiple shooters were involved.

✅ Public safety response: With limited training and resources, it took 96 minutes for police to end the attack. Officers were outgunned—some retrieved hunting rifles from homes and ammunition from hardware stores. An armored truck assisted in evacuating the wounded. Lack of command and control further hindered response efforts.

✅ Aircraft use: A deputy piloting a small plane with a police sharpshooter onboard, responded above the tower. Turbulence prevented accurate fire on the sniper. The attacker fired at the plane, striking it twice, but not hitting the occupants.

✅ Bystander intervention: Armed citizens retrieved personal rifles, returned fire, and one civilian ultimately helped police neutralize the attacker.

✅ Early lockdown tactics: Long before “Run, Hide, Fight,” civilians improvised barricades. Eight people, including two nuns, blocked a doorway using a blackboard and desk for protection.

✅ Legacy and change: The unprecedented nature of this event helped spur the development of SWAT teams to handle catastrophic incidents more effectively.

07/30/2026

𝐅𝐢𝐫𝐬𝐭 30 𝐓𝐓𝐗 𝐢𝐬 𝐧𝐨𝐰 𝐚𝐯𝐚𝐢𝐥𝐚𝐛𝐥𝐞.

Mass attack after-action reports continue to identify familiar operational challenges: establishing Unified Command, prioritizing limited resources, coordinating across disciplines, and making critical decisions during rapidly evolving incidents.

The First 30 TTX Series, developed by First 30 Group, was designed to help public safety agencies and schools prepare for these challenges through realistic, objective-driven tabletop exercises built on lessons learned from real-world incidents and nationally recognized incident management and exercise principles.

The series includes:

✅ Active Shooter
✅ Complex Coordinated Terrorist Attack (CCTA)
✅ School Safety (all-hazards)

Each kit includes large vinyl maps, hundreds of role-specific resource chips, scenario injects, a comprehensive facilitator guide, and supporting resources to help agencies design and facilitate meaningful tabletop exercises that strengthen coordination, command, and decision-making.

Every exercise is an opportunity to identify gaps, improve coordination, and strengthen preparedness before a real incident occurs.

Additional information about the First 30 TTX Series is available in the comments. If you have any questions, feel free to reach out.

07/22/2026

It was a pleasure speaking with hundreds of police, fire/EMS, and school safety professionals about the importance of an integrated response during mass attacks at schools. Using real-world case studies, we examined lessons learned from past incidents and discussed how coordinated planning and response can save lives.

Greg Pass, Director of Training and Research, First 30 Group, presenting "From Classroom to Command Post: Integrating School Critical Incident Response"

05/28/2026

Not Just Street Cops: Integrating Non-Traditional Law Enforcement Officers during Active Shooter Response

In the early moments of a mass attack, you use the resources immediately available.

As minutes pass and mutual aid pours in, the challenge shifts - from getting help to 𝐮𝐬𝐢𝐧𝐠 𝐡𝐞𝐥𝐩 𝐰𝐢𝐬𝐞𝐥𝐲.

History shows that help doesn't always fit the mold of “traditional” first responders. Real-world examples highlighting both successes and challenges of non-traditional law enforcement response include:

✅ Inland Regional Center (San Bernardino, CA – 2015): Probation officers monitoring police radio traffic responded within minutes. As additional probation officers arrived, Command integrated them into casualty care and building security, allowing other units to focus on critical tasks.

✅ University of Nevada, Las Vegas (Las Vegas, NV – 2023): A LVMPD police report notes that a Division of Motor Vehicles investigator who responded to the active shooter call “accidently discharged one round into a three-panel glass wall; no one was injured.”

✅ Robb Elementary School (Uvalde, TX – 2022): The response included hundreds of officers, many of whom came from non-traditional law enforcement roles - Texas Parks and Wildlife officers, a junior college police officer, and a fire marshal among them. Ultimately, a Border Patrol team stopped the attacker.

You may see responders you don’t routinely train with - game wardens, regulatory investigators, and other unconventional law enforcement units.

These are legitimate law enforcement professionals; but their missions, experience, and operating environments may differ.

That’s not criticism - it’s reality.

The takeaway:

▪️ Use the help that arrives - but use it wisely
▪️ Leverage people based on what they do best
▪️ Assign roles intentionally, not by badge alone
▪️ Plan ahead for how specialized units will be integrated
▪️ Train with non-traditional agencies to understand their capabilities

Does your training address how non-traditional law enforcement partners would be integrated into the response?

03/06/2026

Managing 17 Crime Scenes: Lessons from the Isla Vista Attack

This graphic, based on information from the Santa Barbara County Sheriff’s Office investigative summary of the 2014 Isla Vista mass attack, illustrates the complexity of responding to an event with 17 separate crime scenes.

In this incident, six people were killed and more than a dozen others were wounded.

The attacker used three weapons:

1️⃣ Knife
2️⃣ Handgun
3️⃣ Vehicle

The attacker remained highly mobile throughout the attack: killing three victims with a knife in an apartment complex then shooting pedestrians, conducting multiple drive-by shootings, and striking pedestrians with his vehicle.

Coordinating a rapid and effective response across 17 dynamic, dispersed locations is a tremendous challenge for any agency - regardless of size.

Even when agencies have sufficient resources, effectively managing them during a fast-moving, multi-weapon attack requires practiced decision-making and strong command coordination.

Replicating an attack of this scale and complexity in a full-scale exercise is extraordinarily difficult - which is why tabletop exercises (TTXs) offer such value.

TTXs allow agencies to rehearse these challenges using maps of their jurisdiction and scenarios informed by real-world attacks. Working with a finite set of chips to represent law enforcement, fire/EMS, casualties, and attackers helps participants visualize constraints, pressure-test decisions, and strengthen interagency coordination - at a fraction of the time and cost of a full-scale exercise.

At First 30 Group, we specialize in creative tabletop exercises that integrate first responders and simulate real-world attacks based on lessons learned from after-action reports.

Contact us today to discuss how we can help your organization prepare for complex incidents.

01/30/2026

The Data Is Clear: Mass Attacks Are Increasing

While the term “mass attacks” may be more appropriate for the ability to capture violence that can produce mass casualties (regardless of the weapon used) several credible groups use a range of terms:

✅ Mass shooting (The Violence Prevention Project)
✅ Active attack (Advanced Law Enforcement Rapid Response Training (ALERRT))
✅ Active shooter (Federal Bureau of Investigation (FBI))
✅ Mass attack (United States Secret Service)

One group producing exceptional research is the Violence Prevention Project, which defines a “mass shooting” as:

“Four or more people shot and killed, excluding the shooter, in a public location, with no connection to underlying criminal activity such as gangs or drugs.”

The graph below - based on their data - shows a rise in these incidents over more than 50 years.

But here’s the important part:

💡 No matter which dataset you examine, they all point to the same conclusion - mass attacks are increasing.

And while our understanding of these events has improved, the need for continued research, sustained funding, and robust training remains critical.

Preparing first responders and the public is essential if we want to reduce casualties and, in many cases, prevent attacks entirely.

If you work in mass attack prevention, preparedness, or response, we highly recommend the book "How to Stop a Mass Shooting Epidemic" by Jillian Peterson and James Densley, the researchers behind the Violence Prevention Project. It’s packed with evidence-based insights, and their website offers additional valuable resources.

What factors do you believe are driving this long-term upward trend?

01/20/2026

The Key to Faster Response

As employees evacuate their workspace during a mass attack, there’s one simple action that can shave precious seconds off the law enforcement response:

🎯 Offering up their key.

In law enforcement and security, one of the first recommendations we give the public is to maintain strong access controls.

In simple terms, keep the doors locked. It’s good advice.

But in an emergency, when every second matters and police need to get inside quickly, locked doors can slow things down.

In some incidents, officers have had to break windows or use breaching tools to enter. In extreme cases, officers even used fi****ms to gain entry. For instance, a responding officer at Aztec High School (Aztec, New Mexico - 2017) forced his way in by shooting out a window.

Yet consider this: Almost every employee who is evacuating likely has a key they could give to arriving officers.

That’s precisely what occurred at Covenant School (Nashville, TN - 2023). While responding to a mass attack at the school, Officer Rex Engelbert’s body-worn camera captured an employee that recognized that officers needed immediate access and handed over his key. Seconds later, Engelbert used it to enter the building - and his contact team ultimately stopped the attack.

And this isn’t the first time employee keys made a critical difference.

The After-Action Report from the Virginia Beach Municipal Center attack (Virginia Beach, VA - 2019) noted that officers “could not access Building 2 employee entrances… until they acquired access cards from employees fleeing the building.”

The takeaway?

💡 Employees should recognize that police don’t have access to their secured building - and that offering their key to responding officers can save lives.

💡 For police and security professionals, this message should be built into every civilian active shooter training program.

12/29/2025

The First Step Toward Order: Announcing Command

When we study previous active shooter responses, clear patterns emerge - and one lesson in particular seems to appear over and over again.

🎯 Command was not clearly established.

When command isn’t established (and communicated), chaos takes its place - costing time, coordination, and sometimes lives.

This might be the first and last time we use "Paul Blart: Mall Cop" in a discussion about command - but it fits.

In one scene, SWAT Commander James Kent (pictured below) arrives at a hostage situation and declares:

“I’m ready to take on-scene command in 3…2…1. I’m in charge.”

The countdown is clearly for dramatic effect, but there’s no question about who’s in command.

Establishing command doesn’t take much. A quick radio transmission establishing command is all it takes to start. Just skip Commander Kent’s dramatic flair and use the word “command” rather than “in charge.”.

After-action reports from incidents at Robb Elementary School (Uvalde, TX) and others show that when those words weren’t clearly spoken early on, the response suffered as a result.

✅ For example, the AAR from Marjory Stoneman Douglas High School (Parkland, FL) states: “While on-scene personnel would presume that upon [Broward County Sheriff's Office Captain] arrival at the scene she would be the incident commander, there was no transmission that she was indeed on scene, identifying that she was the incident commander or that she had established a command post.”

✅ The Century 16 Theatre (Aurora, CO) AAR also highlights the need for clear establishment of command in their recommendation: “The Incident Commander should announce his status and location on all pertinent radio talk groups (channels) or have the information rebroadcast by the Communications Center.”

💡 Order begins the moment someone steps up and clearly announces they are in command.

What does your agency do to ensure command is established early, clearly, and confidently?

12/09/2025

Choosing the Right Rescue Model During a Mass Attack

When we think about assisting the wounded during a mass attack, most immediately think of the Rescue Task Force (RTF) model.

However, other models exist.

The real question is: Which approach fits your agency’s needs, tolerance of risk, and the situation on the ground?

Here are three commonly used models:

1️⃣ Law Enforcement Rescue: Law enforcement teams provide medical care and extract victims from Hot or Warm Zones.

2️⃣ Protected Islands & Corridors: Law enforcement establishes a secure perimeter or pathway that allows Fire/EMS to enter the Warm Zone for care and extraction.

3️⃣ Rescue Task Force (RTF): A joint team of Law Enforcement and Fire/EMS working together in the Warm Zone to deliver care and evacuate victims.

Each model has advantages and trade-offs.

These models are adaptable. Hybrid approaches can be applied, and multiple models may be used within a single incident.

Choosing the right one depends on the scope of the attack, number of casualties, available resources, and capabilities of responding agencies.

Which model best aligns with your agency’s culture and risk tolerance?