Old Dominion University Shooting Review Produces Series of Recommendations
Mohamed Bailor Jalloh, a student at Old Dominion University (ODU) in Norfolk, Virginia, entered an ROTC class on 12 March 2026 and opened fire, shouting a phrase used in violent Islamic State (IS) terrorist attacks. Lieutenant Colonel Brandon Shah, the instructor, was shot multiple times while trying to disarm the assailant, and two other students were also injured. A small group of ROTC cadets rushed the assailant, stabbed him, and disarmed him. The assailant died in the attack. Shah also died from his injuries.
This week, ODU released the independent post-action review document, commissioned from law firm Cooley LLP, which concluded that the attack was an “unpreventable terror attack against the ROTC unit; commended the brave response of Lt. Col. Shah, the cadets, and the Old Dominion University Police Department; and confirmed the University had no prior knowledge of the shooter’s criminal history.”
Based on the report’s recommendations, the university is updating physical security, streamlining campus alert systems, expanding background checks for readmitted students, and enhancing threat assessment staffing and resources.
The Assailant
Jalloh was a former member of the Virginia National Guard and a readmitted student at ODU. He had previously been convicted of a federal terrorism offense in which he planned to use a gun to attack U.S. military personnel on behalf of IS. He served eight years in federal prison and was released in 2024. Law enforcement officials did not inform the university about Jalloh’s conviction.
Had ODU officials known about the potential risk Jalloh posed to military-affiliated students (who comprise 28 percent of the student body), it’s likely they would have sought his removal from campus, the report said.
Under Virginia law, ODU is not permitted to inquire about students’ criminal history prior to admission or readmission, but it could do so after a student has been admitted—although the university claims running checks on all admitted students is unfeasible due to time and legal constraints. The university could have asked readmitted students to voluntarily disclose their criminal history but did not at the time.
The Response
The Cooley report praised the university’s police department for its immediate response to the situation, coordinating with external law enforcement and “overcoming logistical challenges posed by 911 systems and issues accessing keys and locks within the building.”
University police officers rendered active care to injured victims, but emergency medical response and patient transport protocols could have been better, the report said.
ODU promptly issued an emergency alert about the active shooter and provided updates regularly. But the report found that ODU’s policy of allowing multiple individuals across departments to authorize emergency notifications created some misalignment and confusion about who was responsible for crafting and deploying alerts.
Recommendations
Cooley LLP made recommendations in four main areas: campus safety and security, emergency response, emergency notifications, and post-admissions risk assessment.
The report noted, though, that ODU already had a strong security presence, including campus police foot patrols by sworn campus police officers, 60 non-sworn unarmed security personnel, 2,500 surveillance cameras, 59 automated external defibrillator (AED) boxes, Stop the Bleed kits in some buildings, and a mix of electronic and physical key access controls, based on building upgrade schedules and infrastructure. The school’s threat assessment team—mandated by Virginia after the 2007 Virginia Tech shooting—meets weekly.
Campus Safety and Security
The report advised the school to focus on reinforcing a culture of emergency preparedness by encouraging all campus community members to participate in active threat training. While ODU provides “excellent and regular active shooter trainings,” the report noted that the sessions are optional and participation could be higher.
Classroom doors should be closed during class as a matter of practice.
ODU should continue to ensure every building has an effective Knox box—a small, wall-mounted safe that allows first responders to enter locked facilities with the use of a master key instead of breaking down doors or windows. ODU allocated funds to ensure that each building is equipped with a Knox box by November.
The university should keep migrating door locks to electronic key access, as feasible based on building age and infrastructure.
ODU should consider restricting access to classroom location information to those students enrolled in the course. “While students do need to know location information when selecting courses or in advance of the first weeks of classes, that need decreases over time,” the report said. “Keeping location information limited to those who need to know it would mitigate the risk of particular groups or classes being targeted.”
Emergency Response
ODU police should keep updating its 911 call system, the report recommended. The department should also consider incorporating joint training exercises with other law enforcement agencies, establish interagency radio operating capabilities, and work with partner agencies “to ensure consistent, dignified treatment of victim-witnesses in post-incident interviews.”
ODU should review current campus emergency medical services capabilities to enable quicker medical response. It can also establish clear protocols for nontraditional EMS medical transport, like driving victims in police vehicles to hospitals rather than waiting for ambulances.
ODU should continue and expand efforts to educate campus members about AED and “Stop the Bleed” kits, the report said.
Emergency Notifications
ODU should implement clear protocols about who has authority to send emergency notifications. Localizing authority within one department may be helpful. The university should also consider drafting guidelines about the content of emergency notifications.
ODU should consider increasing awareness and preparedness in the ODU Alert System.
ODU should evaluate and implement supplemental emergency alerts to reach individuals on or near campus not enrolled in the official alert system.
Post-Admissions Risk Assessment
“ODU should ensure that the Office of Threat Assessment has adequate staffing and budgetary resources to support personnel, training, equipment, and outreach,” the report said. As of 13 July, the office was overseeing 288 cases, and only one employee—the director—is dedicated to threat assessment, with other team members pulled in as needed. To alleviate resource constraint, the director already plans to hire at least one additional staff member this year.
In addition, ODU should take steps to learn relevant criminal history applicable to campus risk assessments, within the bounds of Virginia law.
Many of the recommendations are already in progress. In a public letter, ODU President Brian O. Hemphill, PhD, wrote that “The campus community has my complete assurance that we will act quickly to fully implement Cooley’s recommendations as we actively work to make our campus as safe and secure as possible.
“To enhance our physical security, we are upgrading cameras and locks, installing emergency Knox boxes for master keys in all buildings, and restricting access to specific information about classroom locations to the course level. We are upgrading our 911 dispatch system through the renovation of the ODU Inn as it becomes the University’s Public Safety Building, conducting joint training with regional law enforcement, and expanding the availability of AED and Stop the Bleed kits. We are streamlining our emergency alert system to speed up messaging and shifting employees to an opt-out default for alerts. We have expanded our post-admission criminal background questionnaire to include readmitted students, while also expanding staffing and strengthening resources to the Office of Threat Assessment.”
