Scenario

Lifeline Technologies is a local Bay Area software company with approximately 75 employees. Lifeline Technologies' office is in a three-story commercial building that shares space with four other businesses. Lifeline Technologies is located on and occupies the entire third floor and can be accessed via elevator, main staircase, and emergency staircase leading to a back hall just around the corner from the main business entrance. Inside the main office of the company is an open glass door with a reception area. The office area behind reception is an open office environment, where employees mingle and interact in true IT fashion.

Over the course of six months employee John Raymond had been exhibiting strange behaviors that included bursts of anger toward management and other employees. He would often be heard yelling in the bathroom after interactions with his direct managers. He became more and more violent toward others and pushed a female coworker during an altercation. After several attempts by management to change his behavior, Raymond was subsequently terminated and escorted out of the building by the local police.

In the days following, Raymond made threats via email, Twitter, Facebook, and phone to several coworkers and the founders of the company. Raymond filed a lawsuit against the company, and he continued to make threats and taunted staff and ownership in various media outlets. Management and the company owners considered filing charges and were going to secure a restraining order but decided against it fearing it would cause more problems. Since Raymond's termination and subsequent threats, the organization did make some changes in the short term. They hired a security guard for the lobby area to patrol and escort employees. Police were asked to provide additional patrols and cameras were placed at the entrance to the business.

Since the lawsuit was filed, Raymond's threats seemed to subside but did reappear on occasion in social media and in email. Six months had passed since Raymond was terminated and the threats were subsiding, so the organization decided to no longer use security. Management made no other protocol or policy changes (secured door access, more cameras, etc.) and did not maintain the security cameras purchased after the incident. Two years later, Lifeline Technologies had been sold to another organization and the owners had retired.

Three years after Raymond's initial termination and threatening behavior, his lawsuit was dismissed. Raymond silently walked out of the courtroom and an hour later accessed the emergency stairwell leading to Lifeline Technologies' third-floor office. He burst through the front door with a shotgun and handgun, shooting and killing 10 people and injuring over 25 others. During the incident employees did their best to hide behind desks and filing cabinets, but it made little difference in the open environment. Some tried to escape through the emergency stairwell, but Raymond had blocked the door and employees were killed as they tried to get out. Police arrived in less than 90 seconds and the shooting spree ended when Raymond gave up as he was walking out of the building.

You have been hired as a security consultant for a similar technology start-up in the Bay Area. Hearing about this incident on the local news, the CEO requested you review their organization from a security manager's perspective and critically think about the security implications of this type of event in their workplace. You will review the scenario and produce an after-action report (AAR). This report will include an overview, observations, analysis of capabilities, and corrective actions. Watch the Active Shooter in the Workplace: Scenario Overview video. This video was developed using the active-shooter scenario and includes a diagram of the floor plan showing entry points and seating for the management and staff. The dialog runs through the events chronologically listing actions by the perpetrator and the organization's management. Carefully watch the video and examine the circumstances. Use your skills to identify ways this incident could have been prevented. Re-watch the video, stopping to examine each section on the timeline.

Directions

Address the following items in your after-action report and summary:

1. Contextualize: Provide a context for the incident.
2. Security Response Successes
   1. Analyze the behavioral response of all staff during the shooting in the case study.
   2. Was their response to the incident appropriate? Why or why not?
   3. Do the employees' reactions and the law enforcement response point to successful security responses to a crisis situation?
3. Continuity: Identify ways to maintain continuity of best practices.
4. Security Response Failures
   1. Analyze the behavior of all staff during the crisis in the scenario provided.
   2. Was their response to the incident appropriate? Why or why not?
   3. Does the behavior of the employees and the law enforcement response point to successful security responses to a crisis situation?
5. Mitigate Failures: Make recommended improvements to address each identified failure.
6. Lessons learned: Summarize the reasons it is important to stay vigilant about security threats, monitor current events, and think creatively. Use the following questions to write a complete response:
   1. How would you enact this mindset and practice?
   2. How do you keep your staff trained on all potential scenarios?
   3. Based on your reading, how frequently should policies and procedures be updated to reflect changes in society that impact security?
   4. What security management best practices and tools may help prevent this type of crisis?

Please use in-text citations and references .