www.iacsp.

com

(ITRR)
(ITRR)
(ITRR)
(ITRR)

Palestinians
pray as
posters depicting
Palestinian gunman
Ali Abu Dhaim hang in a
tent near his house in the East
Jerusalem neighbourhood of Jabal
Mukaber March 13, 2008. Abu Dhaim, who
killed eight Israelis in a seminary, has been buried
in the dead of night, after a delay because of fears by
Israeli authorities that a public funeral might trigger protests
and violence. REUTERS/Yiorgos Karahalis (JERUSALEM)

Vol.14, No.3
Journal of Counterterrorism & Homeland Security International
A terrorist infiltrated and attacked the Inside the city, there are minimal checkpoints
Yeshivat Merkaz HaRav Kook in the Kiryat
Moshe neighborhood near the entrance to
Jerusalem on Thursday, 06 March 2008 at
approximately 2045 local time. The attacker
opened fire with an automatic weapon and
discharged large amounts of ammunition
on a study hall, killing eight people and
wounding 11. At the time of the attack,
the students were about to begin a party
celebrating Jewish period of happiness prior
to the holiday of Purim. Using deception Based on the terror operation, it is apparent
and cover tactics, the adversary entered the attacker did extensive surveillance on the
the facility and began firing at the students.
The adversary was neutralized by security
forces in the middle of his attack. The
purpose of this paper is to discuss lessons
learned by law enforcement and emergency
medical services (EMS) when responding
to an active shooter incident.
Adversary Background
Since the shooting attack, it is known that Israeli
police have arrested eight people. Currently, it
remains unclear whether the shooter had acted
alone. The “Galilee Freedom Brigades,” an
Israeli-Arab group, has claimed responsibility
for the attack as a Hezbollah proxy. The mili-
tary wing of the Hamas, Izz ad-Din al-Qassam
Brigades, also claimed responsibility in a phone
call to the news agency, Reuters Group, PLC
and announced over mosque loudspeakers in
the Gaza Strip.
The attacker, Ala Abu Dhaim of East Jerusalem,
engaged to be married, had not been known to
law enforcement and had apparently worked as a
driver for a number of private clients in the city.
Recently, Abu Dhaim had become religious but
he did not appear to have any affiliations with
radical organizations.
Target Identification
Abu Dhaim had a number of advantages that
enabled him to identify his target and effec-
tively gather thorough intelligence. Because he
was a resident of Jerusalem, Abu Dhaim could
move throughout the city with minimal delays
at checkpoints established by Israeli authorities
to identify adversaries entering into the city.
and roadblocks. Outside, the city is surrounded
by checkpoints and roadblocks as well as the
security fence intended to keep terrorists from
penetrating local towns and cities.
As a vehicle driver, Abu Dhaim may have trans-
ported children to the targeted school (as well
as other sites) on numerous occasions; thereby
enabling him to identify potential targets. In
Israel there is a tendency for drivers to use
“minivan” vehicle services as an alternative form
of transportation (similar to a taxi cab service).
The vehicle that Abu Dhaim drove (Ford Transit)
conformed to the environment (a vehicle com-
mon for the transport of students) at all hours
of the day and is a vehicle model widely seen
throughout the city.
location, and at all hours of the day and night,
in order to tactically identify the ideal moment
for assault. As a result of his planning and
intelligence gathering, the terrorist was able
to choose the time and day when
there would be a large presence of
students on location.
Tactics
and Weaponry
The 26-year-old gunman had taken
considerable time to plan his attack.
Recent patterns of attacks inside
Jerusalem included simultaneous
assaults of an educational institution
and a police checkpoint. Such at-
tacks, utilizing all types of weapons,
should be monitored in an attempt to
identify future patterns and reasons
for this type of assault as opposed
to explosive devices and suicide
bomber tactics.
According to Israeli police, the
gunman had packed weapons and
ammunition inside a cardboard
television box, allowing him to ad-
vance to the target freely and without
alerting suspicion. There were initial
reports that students believed he was deliver-
ing a package to the school. As the attacker
advanced to the target, he was aware of the
fact that, unlike most educational institutions
in the country, there was no security presence
at the entrance to the facility. Ultimately, he
entered the school unchallenged.
Attack Phase the school to engage the attacker.
Leaving his place of residence with the weapons
(an AK-47, two handguns, ammunition, and a com-
mando knife) the adversary advanced to the target
unhindered. He was familiar with the route, did not
require an escort to lead him to the site, and was
able to park the vehicle in the vicinity of the school.
Based on Abu Dhaim’s knowledge of the school
layout, it is likely that he was aware of the loca-
tion of the students and systematically advanced
floor-by-floor to the library. Upon approach to the
library entrance, the attacker began his assault on
students that were outside of the room.
Response Phase
The response by law enforcement and security
forces was immediate. Initial reports, relayed
to patrol units enroute to the scene, indicated
that this was an incident of “firecrackers.”
Immediately, it was reassessed by civilians on
location as a terror related attack. Patrol, plain-
clothes officers, and special tactical units were
dispatched—operating under an active shooter
response. The priority response for incoming
police units to an active shooter scenario is to
engage the shooter as fast as possible, pulling
the fire away from civilians and toward the law
enforcement officers. An off duty security officer
Based on the terror operation, it is
apparent the attacker did extensive
surveillance on the location, and at all
hours of the day and night, in order to
tactically identify the ideal moment for
assault. As a result of his planning and
intelligence gathering, the terrorist was
able to choose the time and day when
there would be a large presence of
students on location.
(R1), a neighbor of the school, was closest to the
scene. Upon hearing the shots fired, he went to
R1, familiar with ingress and egress points of
the building, entered the school through a rear
door and began sweeping the facility, listening
for the sound of the gunfire. A student of the
seminary, who left the library 10-15 minutes
www.iacsp.com
prior to the attack (R2), heard enter the hostile environment Israel National Police, under most
the shots and decided to take a or the need to acquire autho- mass casualty incidents, have
high ground position rization. been mandated to control overall
with his personal command of such a scene. The
weapon. Lying on Emergency medical establishment of an incident com-
the balcony of the personnel are acutely mand structure within the police
school, R2 awaited ...two terrorists dressed in security guard aware of the threats department includes operational
for an opportunity associated with the
when the attacker
uniforms infiltrated a religious school in a small entrance in to a hos-
units, investigatory offices, ex-
plosives experts, and intelligence
would enter his line community south of Jerusalem. The terrorists, tile scene until law units. Among the responsibilities
of site to employ le- armed...were challenged immediately by enforcement can as- for law enforcement personnel on
thal force against the sure scene safety. the location of a terror attack (and
gunmen[JDP1]. civilians on location and who opened fire on Such awareness al- at any other large incident) is the
the attackers. During the attack, the terrorists lows for the swift neutralization and rendering safe
The first arriving operational response
units included a
were able to stab two Israeli civilians, injuring by EMS personnel
of any imminent threats and the
establishment of secure perimeters
plainclothes unit them moderately. The civilians were able to in the evacuation for the first responders. Ingress
(R3) assigned to thwart a terror attack that could have had similar and rescue of the and egress to the scene, as well as
major crimes and injured. Likewise, between the scene and the medical
the Central Com- results as the Jerusalem school massacre, by law enforcement uti- treatment facilities, are secured by
mand of the National immediately interdicting with lethal force... lizes the maximum highway and patrol units.
Police. This unit amount of resources
immediately entered to secure the perim- Operating under these conditions,
the structure, as per History has shown that during an active shooter eters with a series of inter-agency training is a critical
police policy to ex- incident it is a matter of seconds, not minutes, that over watches, patrol, component to mitigation of the
peditiously engage checkpoints, and incident. Common inter-agency op-
the attacker. The off will determine the number of lives lost or at risk. plainclothes units. erating plans must be reviewed and
duty security officer Bomb squad units exercised at the command and field
(R1) arriving from and tactical teams levels in order to apply a measure
his home did not have operate with great speed of strategic response. Commanders
any means to readily iden- and discretionary caution. must display a level of confidence
tify himself upon entering the to ensure all active emergency
scene. As a result, the officer Results personnel are able to operate under
(R3) that entered the building clear guidelines for such a threat.
passed a police duty hat to R1 The quick response by law An active shooter response needs to
for identification. The primary enforcement and security be aggressive, mission specific, and
means of communication and building outside the main entrance. personnel possibly prevented a proactive to a situation where any
coordination between R1 and R3 Evacuation under gunfire was much worse scenario resulting delay only increases the adversary’s
were relayed verbally, while R3 begun by first arriving EMS units. in more casualties. First ar- success. A tactical concept that all
maintained communications via This was an attempt to maintain the riving law enforcement units responders must understand is the
the EOC’s dedicated emergency golden response rule of the evacua- immediately engaged the at- need to engage the attacker in order
channel. The terrorist was engaged tion of all non-ambulatory injured tacker with the assistance of to draw active gunfire away from
initially by R2 from a distance. R1, within 20 minutes. Jerusalem hos- an off duty soldier and student civilians. Such a concept should
from the hallway, eventually neu- pitals went on MCI (Mass Casualty already on location. The fear include clear operational guidelines
tralized the gunman in coordination Incident) alert status immediately of possible secondary attack- and policies, communications,
with R3 from the library study. upon notification of the shooting. e r s o r d e v i c e s o n l o c a t i o n which assist in mitigating injury to
Hospitals received timely updates was handled by teams that are civilians and emergency personnel.
In any terror related attack, Jeru- as to the medical evacuation sta- trained for clearing buildings When tactical decisions are made in
salem Police begin searching for tus by the Jerusalem Police EOC under similar circumstances. an instantaneous fashion, immedi-
additional attackers, secondary (Emergency Operations Center), Such teams include a tactical ate goals are met and the system
devices, and any accomplices flee- as well as from the Incident Com- element followed by explosive operates efficiently, with minimal
ing the scene. This includes the manders at the Unified Command ordinance technicians. loss and a quick return to normalcy
clearing of the entire building by established near the attack site. for citizens.
special teams comprised of tacti- Interactions between police and The established response plans as-
cal personnel and the bomb squad. EMS dealt with scene safety and sociated with all law enforcement Lessons Learned
It was initially believed there was suspicious items and individuals and EMS responders addressed the for American Law
at least one additional terrorist on identified by EMS. need for neutralization of the threat Enforcement
location, resulting in a delay of (active shooter) and the immediate
medical evacuation by EMS. All Medical response was initiated by evacuation of the injured from the To effectively respond to an active
additional threats were ruled out in EMS and incident command was scene. Rescue of the non-ambula- shooter incident, law enforcement
approximately two hours. established with law enforcement tory injured by medical personnel and EMS need to train and conduct
personnel taking primary scene com- is based on the need to remove the field exercises in conjunction with
Medical Response mand. The response was expedited injured from the scene of potential other relevant agencies. The need
by all agencies. The central EMS secondary threats, while minimiz- for first responders to aggressively
Approximately 50 EMS units re- headquarters was minutes away and ing the amount of time on location. respond to an active shooter inci-
sponded to the scene from the Jeru- the system was supported by a rapid This minimizes the amount of time dent requires that those responders
salem area. First arriving units were response of local volunteers. There needed to transfer the injured to and their respective agencies follow
met by fleeing students from the was no delay in organizing teams to a medical treatment facility. The guidelines that address the tactics, tech-

56 Vol.14, No.3
Journal of Counterterrorism & Homeland Security International
niques and procedures that support
such a response.
A case study, pointing to the need
for enhanced training exercises is
the Trolley Square Mall shooting
that occurred in Salt Lake City,
Utah on 12 February 2007. In this
case, the aggressive actions of a lone
off duty officer diverted the deadly
actions of the active shooter away
from civilians and towards himself.
This action resulted in the saving of
numerous civilian lives and assisted
law enforcement by pinning down
the shooter until a tactical response
was organized.
On 24 January 2008, at approxi-
mately 2200 hours local time, two
terrorists dressed in security guard
uniforms infiltrated a religious
school in a small community south
of Jerusalem. The terrorists, armed
with what appeared to be a firearm
and sharp instruments, were chal-
lenged immediately by civilians
on location and who opened fire
on the attackers. During the at-
tack, the terrorists were able to
stab two Israeli civilians, injuring
them moderately. The civilians
were able to thwart a terror attack
that could have had similar results
as the Jerusalem school massacre,
by immediately interdicting with
lethal force.
History has shown that during an
active shooter incident it is a matter
of seconds, not minutes, that will
determine the number of lives lost
or at risk. Therefore, the current
industry standard for patrol re-
sponse to an active shooter incident
should be re-examined. Most law
enforcement agencies and tactical
organizations have trained police
personnel in rapid response to active
shooter drills. These drills have been
focused on a team concept (three to
four person configurations). Some
considerations of implementing a
one or two officer team response
have been discussed and even
trained, but the lingering discus-
sion of “officer safety” continues
to surface. Many law enforcement
agencies and tactical organizations
have adopted the three to four team
concept to maximize officer safety.
This response was designed under
the premise that in an active shooter
incident the first responder at or on
the scene is going to be a School Re-
source Officer (SRO) or a patrol of-
ficer. This was designed for officers
who have less tactical training than
SWAT team personnel and who need
to deploy in a team configuration to
maximize their own safety.
Officer safety has been and will
continue to be a top priority for
all law enforcement agencies and
tactical organizations. However,
the law enforcement community
must weigh officer safety against
the loss of civilian lives in an active
shooter incident. The Columbine
High School Massacre in April,
1999 forced law enforcement to re-
evaluate its response protocols to the
active shooter and new tactics have
since evolved to address the issue.
Now, after almost ten years of ad-
dressing the tactical issues of active
shooter incidents, law enforcement
and the civilian communities must
address the lessons learned from
these incidents and re-evaluate their
current tactics and procedures.
The law enforcement community
should consider a more aggressive
response to an active shooter inci-
dent which may require a one or two
person response team to engage the
threat. This response may need to be
carried out by a SRO, patrol officer,
or an off duty officer. When seconds
make the difference in saving lives,
officers can no longer afford to wait
minutes for back-up units to arrive.
Law enforcement officers have a
proud tradition and moral obligation
that puts them at risk to save the
lives of innocent civilians.
Discussion
The authors of this article recognize
the inherent risk to police officers
while implementing these tactics,
but we believe that those risks can be
minimized if officers adhere to the
following basic tactical principles
of “speed, surprise, and violence
of action.”
There are also some common sense
actions that need to occur prior to
officer response. Once the arriving
officer has assessed the situation,
formulated an action plan, steps
must be taken to communicate
their tactics to other responders.
This can be accomplished by police
radio, cell phone[JDP2] or through
a third party (i.e. victim/witness).
This action – identification of non-
uniformed personnel – is especially
critical for off-duty personnel and
plain clothes officers.
In the assessment process, each
officer should make an evaluation
of the threat and their ability to
neutralize the threat. The possibility
of multiple suspects with automatic
weapons should be assumed but
should not prevent a rapid response
by law enforcement.
In February, 1997 during the North Hollywood Shootout, the Los Angeles
Police Department was clearly out-gunned by bank robbers Larry Phillips,
Jr. and Emil Matasareanu. The aggressive actions of the patrol officers
held the robbers at bay, preventing their escape, and eventually brought
about their demise.
Those actions saved innocent lives and improved critical response time
for responding police assets. Through proper training and the issuing of
necessary equipment (tactical rifles/shotguns w/slings, light systems for
all weapons and mechanical breaching tools for patrol) law enforcement
personnel will be able to respond immediately to such incidents like the
North Hollywood Shootout, allowing them to save lives.
By no means are we advocating that law enforcement agencies discard
their current active shooter training programs. In fact, current poli-
cies and procedures support the very tactics we are advocating. For
example, when an officer responding to an active shooter incident
moves towards the gunfire and the gunfire subsequently ceases, we
do not advocate that the officer transition into a lone officer search
mode. The officer should hold a position of cover nearest to the area
where they last heard gunfire. The officer should request assistance
at their location, and when assistance arrives, begin searching for the
suspect. While waiting for assistance, if the suspect becomes active
and engages in deadly behavior, the officer should move toward the
gun fire and neutralize the threat. Likewise, if the active shooter takes
a hostage and becomes barricaded in a position of advantage, the of-
ficer should follow their department’s barricaded suspect protocol. If
the situation were to become prolonged and as other officers arrive
on location, the officer would then transition into a contact/rescue
team configuration.
The following key recommendations are derived from the Yeshivat Merkaz
HaRav Kook shooting incident:
1. Regular training sessions can assist in preparing for the proper response
and ease the coordination and collaboration of the responding agencies.
Training should include techniques to identify plainclothes officers
and off-duty officers operating in such an arena.
2. Immediate response considerations need to address fleeing suspects
within the crowd of victims.
3. Clear training, policies, and procedures need to address the engaging
of the attacker through the basic tactical principles of “speed, surprise
and violence of action.”
• Tactical movement of officers.
• Police vs. police crossfire issues.
• Appropriate weaponry and equipment to engage the threat.
• Tactical rifles/shotguns w/slings.
• Light systems for all weapons.
• Additional ammunition and magazines .
• Mechanical breaching tools .
4. Different response scenarios should be addressed both at the policy and
procedure stages as well as “going out” and testing the plan.
5. Success is dependent upon a number of considerations which include
inter-agency cooperation between all of the relevant agencies at all
levels of incident command. In addition, there is an inherent need to
initiate an expedited dissemination of information to other security
agencies assisting in the interdiction of the threat.
6. Regular inter-agency training, with open dialogue and cooperation
between all agencies, clear planning, and effective communications
using incident command.
7. Command level ability to make strategic and tactical decisions based
on the needs of the district, and the specific incident.
8. Planning must include clear guidelines for perimeter security, security
at other sensitive locations, as well as medical treatment facilities and
the protection of staging points.
9. Training and exercise objectives should include an evaluation of emer-
gency communications between agencies for evacuation of personnel
from unsafe scenes. Communication procedures should include the
integration of plainclothes officers, off-duty officers, and other
relevant agencies.
For more information about ITRR vist: www.terrorresponse.org