Active Shooter vs Active Aggressor: An Analysis of Survival Methods

1. Introduction

Active shooters are individuals who use firearms to kill or attempt to kill in confined and populated environments such as schools, businesses, recreational areas, and other similar settings. According to the Cybersecurity & Infrastructure Security Agency (CISA)[1], there is no defined pattern or method for selecting victims; the primary objective is to create chaos and maximize casualties during the attack. Due to the rapid and unpredictable nature of these incidents, the impact can be significant, depending on the shooter’s skill level, the weapon used, the chosen caliber, and the amount of ammunition, as well as the number of people present particularly vulnerable individuals, such as children, the elderly, and people with disabilities. The duration of an attack can ranges from seconds to a few minutes, typically lasting between 10 to 15 minutes, followed by an attempt to escape to avoid confrontation with law enforcement.

This type of situation can be analogized to an acute disaster, which has a clearly defined starting point and results in a number of casualties, including those with minor injuries who may overwhelm hospital systems, followed by severely injured victims who are transported by emergency vehicles to urgent care units, as noted by Puryear and Gnugnoli [2].

According to Schwerin, Thurman, and Goldstein [3], most of these incidents are premeditated, with the shooter having already accepted the possibility of being killed by the police or planning to escape to avoid capture, always aiming to maximize the number of victims. As Capellan1 [4] points out, most active shooters act alone and are driven by an extreme ideology that motivates them to commit such acts.

In this context, it is important to distinguish between an active aggressor and an active shooter. The “Columbine Massacre,” which occurred on April 20th, 1999, received extensive media coverage. On that day, teenagers Eric Harris and Dylan Klebold, students at Columbine High School, entered the school heavily armed, resulting in the deaths of 13 people (12 students and 1 teacher) and injuring 21 others (20 students and 1 teacher). Tragically, the massacre gained enormous media attention, directly and indirectly influencing similar incidents in world since then [5].

In Brazil, two high-profile massacres were the Realengo attack in Rio de Janeiro on April 7th, 2011, and the Suzano attack in São Paulo on March 13th, 2019. Both were inspired by the actions of the Columbine shooters [6]. These attacks involved armed individuals, leading to the use of the term "active shooter" to refer to the perpetrators of these mass killings.

However, on March 27th, 2023, a different incident occurred at a school in São Paulo, where a 13-year-old student armed with a knife fatally stabbed a teacher and attempted to injure other students trying to escape. The attack was stopped by a physical education teacher who managed to disarm the aggressor [7]. In this case, the student was labeled an active aggressor rather than an active shooter because a firearm was not used. It is worth noting that while every active shooter is also an active aggressor, the reverse is not necessarily true, depending on the weapon used. Therefore, the term "active aggressor" is broader than "active shooter" as it also includes attacks in which the perpetrator uses other means to carry out violent actions [8].

Lockdown drills are conducted in schools, hospitals, businesses, and shopping centers with high foot traffic. However, according to Zullig [9], if these drills are not properly executed, they can negatively impact the mental health of participants, particularly adolescents in U.S. schools. If not handled appropriately, these students may experience trauma due to simulations and fear of a potential attack, especially since some of the primary targets of active shooters are schools, including those where students have experienced physical or psychological violence, or schools near their homes. According to Moore-Petinak [10], 68.5% of young people who participate in active shooter drills experience some form of negative impact, whether intentional or not. Only 6.7% reported a positive experience with the recommended "run-hide-fight" training when it was conducted appropriately.

However, Berglund [11] supports continuous training, the development of a crisis management plan by the school, and the integration of a district emergency management coordinator.

According to Liu, Becerik-Gerber, and Lucas [12], these drills are more effective when conducted using virtual reality rather than solely through videos, especially when participants have not undergone any prior training.

A study by Zhu et al. [13] revealed that during simulations conducted in realistic settings, individuals tend to protect others while simultaneously responding to the fight-or-flight instinct. In school settings, students were more likely to attempt to escape, while teachers showed a heightened sense of responsibility, trying to protect as many students as possible. Meanwhile, administrative staff expressed concern for their coworkers.

In this context, it is also important to consider that optimizing exit routes and evacuation paths involves complex decisions that go beyond the location's geography or the building’s layout where the active shooter is present. Factors such as victim’s panic, misinformation, potential blockages, the spread of conflicting information, and the dynamics between a leading evacuee and their followers must all be considered, as highlighted by Lavalle-Rivera [14].

Interestingly, Livingston and Grombly [15] point out the lack of designated points in training for where to crouch, shelter, and take cover, as well as the absence of non-defensible spots that could be modified to enhance safety for those present.

Arteaga et al. [16] support the evacuation dynamic led by a leader, even in situations with few leaders. It is most effective when each room has an assigned evacuation leader, especially if direct communication between the leader and the victims is established, minimizing interference from other evacuees.

In another literature review, the issue of hospital evacuation was addressed, with Haghpanah [17] categorizing patients into four groups: immobile patients, immobile patients who can get out of bed, immobile patients who could get out of bed with relative ease, and mobile patients. In such situations, it is necessary to assess which area of the hospital is under attack and the feasibility of evacuating patients, as evacuation from an ICU or surgical center can be nearly impossible.

Kenney et. al. [18] observes that the commonly taught reactions of run-hide-fight are consistently applied in these settings during active shooter situations. Fortunately, healthcare professionals prioritize patient protection in about 87% of cases. The same study noted that female healthcare workers are more likely than their male counterparts to instinctively protect patients.

Inaba et al. [19] suggest that staff, visitors, and patients should follow the run-hide-fight strategy if they are capable of doing so. For healthcare professionals, the decision to stay and fight depends on their risk assessment and personal value system, as noted by Iserson et al [20].

A significant issue with active shooters is the variability in weapon use. In most cases, they carry more than one weapon, often starting with long guns such as semi-automatic rifles and shotguns before switching to handguns like pistols or revolvers. According to Jager et. al. [21], incidents involving semi-automatic rifles, either alone or in combination with a handgun, resulted in the highest number of casualties. This choice is influenced by the ease of handling, the ability to fire multiple shots consecutively, and the capacity to carry more magazines.

Another under-examined factor is the shooter’s use of a three-dimensional position, being above or below the victims. Law enforcement officers are typically trained to respond in a two-dimensional environment, expecting the shooter to be on the same plane as the victims and engaged in direct confrontation. This approach overlooks scenarios where the shooter is positioned at a higher vantage point, such as in a building targeting victim below, as occurred on October 1st, 2017, in Texas [22]. Additionally, it ignores the possibility of a shooter emerging from tunnels in underground attacks, a tactic more commonly seen in military operations during wartime.

In the case of an active shooter, implementing the TCCC (Tactical Combat Casualty Care) protocol is crucial for casualties in hot or red zones. This protocol is typically trained by military personnel and rapid response police teams. Its primary goal is to prevent fatalities in high-risk environments by addressing critical issues such as extremity hemorrhage, tension pneumothorax, and airway obstruction. According to Usero-Pérez et al. [23], the application of this protocol by law enforcement and healthcare providers is essential in active shooter situations to increase the survival chances of the injured.

Jacob et al. [24] emphasize the importance of rapid first aid training as a preventive measure to reduce severe casualties, noting that hemorrhage is the leading cause of death in active shooter incidents. If the TCCC protocol is implemented in conjunction with the integrated response of the THREAT protocol (Threat suppression, Hemorrhage control, Rapid Extraction to safety, Assessment by medical providers, and Transport to definitive care), the survival chances of victims and rescuers are significantly increased. According to Jacob et al., when applied with strong commitment and leadership, this protocol has resulted in a high number of lives saved, following the military rescue planning used in conflict zones.

The wide range of locations targeted by active shooters, characterizing them as mass murderers rather than serial killers, indicates that the choice of setting is not solely about maximizing casualties but also about creating psychological impact on society. Blair's [25] study examined the locations and frequency of active shooter incidents from 2000 to 2013.

Blair's data shows a total of 160 attacks during this period, averaging 11,6 incidents per year in the U.S.A, resulting in 1043 victims, including the shooters themselves. Of these victims, 486 were fatalities, and 557 survived.

The study also reveals that 45.6% of the attacks occurred in commercial areas, 24,4% in educational institutions, 10% in government buildings, 9,4% in public spaces, and the remainder in other locations.

According to Anklam et al. [26], the most effective way to reduce casualties in schools during an active shooter incident is to have a police officer on-site. This approach is already practiced in Brazil through the presence of School Patrols during student arrival and dismissal times or Municipal Civil Guards in public schools.

Another immediate response strategy would be to arm teachers and staff to prevent attacks. However, this measure is controversial among parents and society. It would also require regular and effective training for teachers and staff to assess their shooting proficiency and mental readiness to carry or possess a firearm in a sensitive environment like a school or educational center.

2. Materials and Methods

For this review, scientific articles published in renowned journals were used, with searches conducted across three databases: PubMed/MEDLINE: The search for the term "active shooter" yielded 430 results, which were refined to 132 free full-text articles. From these, 12 articles were selected for use. Scielo: No relevant results were found for this research. Capes Journals Portal: The search returned 683 documents, of which 276 were open-access. From these, 8 were selected. And Google Scholar: The same search was conducted, yielding 888 results, with 13 articles chosen for inclusion.

3. Results and Discussion

Active shooters are not a recent phenomenon. While the Columbine school attack in 1999 highlighted the severe risks within educational institutions [27], notes that decades earlier, in 1966, Charles Whitman killed 16 people by shooting from a tower at the University of Texas before being neutralized by authorities. However, campuses are not the only targets of such attacks.

Research conducted between the 1980s and 1990s indicated that homicide was one of the leading causes of death in various professions, including executive, administrative, transportation, and sales occupations. Notably, 80% of workplace homicides involved firearms. Additionally, according to Kelleher, 75% of the victims were white, and 80% were men, reflecting the male dominance in the workforce during that period.

Despite the decline in overall homicide rates in recent decades, incidents involving active shooters have significantly increased in number and frequency. According to Cohen, Azrael and Miller [28], between 1984 and 2011, these incidents occurred on average every 200 days. However, this interval drastically decreased between 2011 and 2014, with attacks happening every 64 days. Additionally, Blair and Schweit [29] noted that the annual average of active shooter events was 6,4 between 2000 and 2007 but surged to 16,4 between 2007 and 2013. Between 2013 and 2016, this type of violence grew at an alarming rate of 20% per year. These statistics illustrate the intensification of the problem, suggesting not only an increase in frequency but also a shift in the dynamics and impacts of the attacks, necessitating more effective prevention and response strategies.

In Brazil, the Ministry of Education highlighted that attacks on schools were rare and isolated incidents in the country. However, since 2017, there has been a sharp increase in cases, making it the most significant and dramatic manifestation of violence against schools. Since the first attack in Salvador (BA) in 2002, there have been 35 more attacks resulting in fatalities, including the deaths of several attackers, totaling 36 cases [30].

The 36 cases analyzed in the latest report involve attacks on basic education schools, ranging from early childhood education to high school, in both public and private institutions. The report does not include the attacks in Macaúbas (BA, 2001) and Janaúba (MG, 2017) as part of the extreme violence phenomenon against schools. This exclusion is due to the fact that both incidents do not meet the criteria outlined in Section 1 of the report published by the Ministry of Education to characterize this type of crime [31], although they may be considered imitation crimes to some extent.

The following table (Table 1), based on the work of Catarina de Almeida Santos and Letícia Oliveira, summarizes the attack data. It is noteworthy that the study already includes information on the latest attack in Fortaleza, Ceará, on October 25, 2023 [32].

Based on this study, it is also possible to tabulate the age profile and the type of aggressor. The graph below highlights the predominance of young aggressors, particularly in the age range of 12 to 14 years, with a significant peak at the age of 13. This concentration suggests a correlation between school age and the incidence of aggressive behaviors, indicating the need for early interventions to address youth violence.

There is a noticeable trend of decreasing aggressors as age increases, reflected in the reduction of active individuals after the age of 14. However, the cumulative percentage line, which reaches almost 100%, indicates that a considerable number of aggressors persist into older ages, pointing to the continuation of violent behaviors over time.

These findings emphasize the importance of multifaceted strategies and public policies aimed at preventing violence, highlighting the need for social and educational support for at-risk youth (Figure 1).

Regarding the type of aggressor, the graph below presents a comparison between the proportion of active aggressors (53%) and active shooters (47%). The relative closeness of the two groups illustrates a concerning reality regarding violence in Brazil, suggesting that both aggressive behaviors and the use of firearms are nearly equally present. The predominance of active aggressors indicates that physical violence is more common, while the near parity with active shooters highlights the need for attention to issues related to the use of firearms, particularly since the majority of attacks were perpetrated by minors who should not have access to such weapons.

This information is essential for informing public policies that not only address armed violence but also tackle strategies for preventing and intervening in aggressive behaviors. It underscores the importance of an integrated approach to reducing violence in a comprehensive and effective way.

It is worth recalling that, as Lima and Coelho (2023) state, while every active shooter is also an active aggressor, the opposite does not necessarily apply depending on the weapon used. In this sense, it can be said that the term "active aggressor" is broader than "active shooter," as it also refers to attacks where the aggressor uses other means to carry out their violent actions (Figure 2).

According to research conducted by the FBI [33] from 2000 to 2019, important data was collected. During this period, 333 attacks were reported, with 2851 victims, excluding the shooter in case of their death. There were 345 shooters, with a concentration of 332 men and 13 women (Figure 3).

Thus, we observe the lower percentage of female participation in violent attacks, indicating that this is more of a male propensity. During this period, attacks carried out in public and private buildings, as well as against civilians and pedestrians, resulted in a massive number of civilian victims. The number of dead and injured among the civilian population was 2726, while 109 law enforcement officers who confronted these shooters became victims. Lastly, 16 security personnel, who were present at the attack locations or in their surroundings but actively involved in attempting to manage the crisis, were also victims (Figure 4).

The increase in active shooter incidents has also prompted researchers to investigate, particularly focusing on the microprofiles of active shooters after incidents, with an emphasis on psychological explanations for individual behaviors, as highlighted by Bonanno and Levenson Jr., 2014 [34]. These studies reveal that many aggressors in school contexts shared experiences of bullying, a sense of threat, severe depression, and a history of suicidal thoughts or attempts. However, there are significant differences that complicate the prediction of who is most likely to carry out an attack. While some came from structured families, others grew up in foster homes; some were exemplary students, while others faced academic failures; and while some showed behavioral changes before the attacks, others did not exhibit clear signs.

Duque, Rivera, and LeBlanc (2019) [35] emphasize that, although these psychosocial factors and possible provocations are important, they manifest in varied ways, culminating in an attack under different circumstances. Still, the authors argue that an exclusive focus on micro perspectives overlooks the broader effects of organizational, social, and global factors, which also influence these events. Thus, it is essential to expand the focus of analyses to better understand the multiple levels of influence that contribute to the occurrence of attacks.

Additionally, Twenge (2017) [36] points out that intensive digital technology use has been associated with issues such as isolation, unhappiness, depression, and even suicidal tendencies, especially among Generation Y, who grew up in a world already dominated by the Internet. Jasinski and Navarro (2012) [37] add that digital addiction can expose individuals to increased social tensions, both online and offline, including situations of jealousy and bullying. This scenario can contribute to intermittent episodes of losing self-control, which, in extreme cases, may result in fatal acts. These digital dynamics are exemplified by the case of the Parkland shooter, who, according to reports, actively used online platforms, even posting a message alluding to the attack he was planning to carry out. Despite this, although the FBI was alerted about the post, crucial information was not passed to local authorities in time to prevent Cruz's attack, highlighting failures in monitoring and responding to suspicious behaviors in digital environments.

The increase in incidents involving active shooters in public places has led to intensified research on prevention, response, and recovery in such events. Recent studies indicate that these incidents, characterized by high lethality and short duration, require integrated responses involving law enforcement, medical teams, and the community itself. Furthermore, understanding the psychological profile of perpetrators has been crucial for predicting and mitigating future attacks, as pointed out by Blair and Schwieit (2014) [38] in their study on the behavior patterns of aggressors.

Training and preparation have been highlighted as key areas of focus in the literature. Approaches such as the "Hartford Consensus," studied by Jacobs et al. (2013), suggest that the integration of medical and tactical training increases survival chances in high-lethality incidents. Similarly, Sanchez, Young and Baker (2018) [39] discuss how specific simulations for emergency personnel, especially in hospitals, have proven effective in reducing harm. However, simulation practices in schools, widely adopted, have been criticized for their emotional impact on children and adolescents, as reported by Huskey and Connell (2021) [40].

Another relevant aspect is the dissemination of information and coordination during events. Researchers like (Mazer et. al.) [41] explored the role of social networks in incidents involving active shooters, highlighting their importance in real-time communication and alert dissemination. However, the authors warn of the risks of misinformation and panic generated by unverified information. This underscores the need to balance the use of digital technologies with traditional response strategies.

To deal with the threat of active shooters, many organizations and institutions have implemented training programs and response strategies. The "Run, Hide, Fight" protocol, developed by the U.S.A. Department of Homeland Security, is widely publicized as an approach to maximize safety in shooting situations. "Run" should be the first reaction, seeking to escape danger; "Hide" is recommended if escape is not possible; and "Fight" should be the last resort, in case of direct confrontation with the shooter [42].

As previously mentioned, the "Run; Hide or Fight" protocol analyzed by Martins and Martins (2023) [43] is an essential strategy for dealing with active shooter incidents, particularly in the initial moments when police response is not yet possible. Developed by the U.S.A. Department of Homeland Security, the protocol aims to guide vulnerable victims in adopting rational survival actions. Furthermore, Martins and Martins [43] emphasize that training in this protocol is crucial, as it equips victims to overcome the psychological and physiological effects of extreme stress, ensuring conscious and effective responses in critical situations.

In the Brazilian context, Martins and Martins [43] emphasize the need to adapt the "Run; Hide or Fight" protocol to local particularities, such as the use of smaller caliber firearms and specific characteristics of attacks. They highlight the importance of implementing this training in schools and public spaces, which are often targeted by active shooters, to increase the sense of security and prepare potential victims. Moreover, the training is presented as an effective preventive measure, not only to protect lives but also to discourage aggressors, who tend to choose more vulnerable targets. Thus, training and awareness emerge as key elements to maximize survival chances and promote quick, conscious responses in crisis situations.

Lima and Coelho (2023) [8] propose strategies to increase the chances of success in confrontations with active aggressors, particularly in extreme situations where hiding and escaping options have been exhausted. In these cases, the victim should consider attacking the aggressor as a last resort, using all available means to ensure survival. From improvised weapons, made from nearby objects, to hand-to-hand combat techniques, any resource can be crucial in incapacitating the aggressor and stopping the attack.

The literature and experiences with self-defense workshops suggest that classes focused on specific techniques for facing armed individuals could better prepare students, teachers, and staff, increasing their chances of survival [44]. Although direct confrontation with an armed person presents a significant risk, proper training can improve the effectiveness of these actions. Thus, even when at a disadvantage, it is necessary to attempt to neutralize the aggressor using any available means.

Sousa et al. (2021) [45] recommendations are clear when advising: "ENGAGE, whenever there is no chance of escape or hiding, the active shooter/aggressor with objects or weapons within your reach. However, remember that this is the last option, as the firearm will have the advantage at a distance, and the probability of being injured or killed will increase significantly. Legitimate, proportional, and progressive use of force is only advised in extreme situations." While valid, some observations must be made. The author highlights the use of legitimate, proportional, and progressive force only in extreme situations. However, it is understood that, in the presence of an active aggressor, whether armed with a firearm or a bladed weapon, the force progression gradient has already reached its maximum limit, given the high level of danger involved. In this context, it is crucial to incapacitate the aggressor quickly to prevent the continuation of the attack. It is also important to target vital areas, such as the head and eyes, to disorient the aggressor, or the hand holding the weapon, aiming to disarm him effectively.

According to Briggs and Kennedy (2016) [46], combatants are likely to save lives by confronting and hitting an active shooter, but they put themselves at greater risk. Attention, which is considered a scarce commodity, is diverted from the shooter when he faces resistance, reducing his ability to aim and fire at other victims. The strategies of "Run" and "Hide" aim to occupy the shooter's time and attention, allowing law enforcement to arrive, organize an entry, and neutralize the threat. However, as evidenced in the incident reports from the Virginia Tech and Sandy Hook shootings, shooters often move on to easier targets when they encounter resistance, such as barricaded rooms. Moreover, hiding without adequate protection, like crowding in a corner of the room, can make it easier for the shooter to inflict more casualties with fewer shots, as happened at Sandy Hook Elementary School.

These analyses highlight the complexity of dealing with incidents involving active shooters. Effective strategies require not only well-coordinated emergency interventions but also public policies that address long-term prevention and the psychological impact on affected communities. The literature suggests that the challenge of confronting these events should be approached with a combination of technical preparation, psychological support, and policies based on solid evidence.

4. Conclusions

Authors should discuss the results and how they can be interpreted from the perspective of previous studies and of the working hypotheses. The findings and their implications should be discussed in the broadest context possible. Future research directions may also be highlighted.

The analysis of active shooters reveals a complex and multifaceted phenomenon that is not limited to a single profile or motivation. Attacks, often characterized by prior planning and a desire to cause maximum casualties in public spaces, have become more frequent and lethal over the years. Events such as the Columbine massacre and the attacks in Realengo and Suzano in Brazil demonstrate the influence of previous cases, suggesting a pattern of imitation that spreads globally.

Thus, the response to these incidents requires an integrated approach that involves not only public security but also the preparation and training of communities and institutions. Protocols like "Run, Hide, Fight" are crucial for empowering individuals to act effectively in crisis situations, although the implementation of simulation exercises should be done carefully to avoid psychological trauma.

Additionally, the literature highlights the importance of understanding the psychosocial factors that may lead individuals to commit such acts, including experiences of bullying, isolation, and mental health issues. Digital technology also plays a significant role, contributing to increased isolation and unhappiness among young people.

Finally, the need for public policies that address both prevention and long-term response is evident. A combination of technical training, psychological support, and effective communication strategies is essential to mitigate the impacts of these events and increase the chances of survival for victims.