On April 2, 2012, One Goh, a former student at Oikos University, in Oakland, California, opened fire on the campus, killing seven people and wounding three others. That incident happened nearly five years to the day after the April 16, 2007, mass shooting at Virginia Polytechnic Institute and State University (Virginia Tech), in Blacksburg, Virginia. It was a sad reminder that, though rare, shootings are a threat to universities large and small, and school authorities must be prepared to handle them.

In the Virginia Tech tragedy, a current student first shot two students in a dormitory; a few hours later, he entered an academic building and opened fire in several classrooms before turning the gun on himself. Thirty-three people were killed in the massacre, including the gunman, Seung-Hui Cho. The Virginia Tech community has been through much since that day. It has also attempted to learn important lessons to limit the chances of a similar tragedy in the future. Other campuses have taken note. Ahead is a look at some of the long-term lessons and evolving best practices for communications, sheltering in place, and threat assessment teams.

Communications

A key factor in the Virginia Tech shooting was that the gunman first murdered two students in the dorms in the morning. The university took more than an hour after that first incident to warn students that there had been a shooting on campus. The school was ultimately judged by the U.S. Department of Education (DOE) to have violated a provision in the applicable law, the Clery Act, which calls for “timely warnings” when reportable crimes occur on campus. Some examples of reportable Clery Act crimes are robbery, murder, and assault.

Virginia Tech officials disagreed with that judgment. According to Mark Owczarski, Virginia Tech’s director of news and information, while there was no clear definition of what constituted a “timely” warning at the time, precedent and DOE guidelines had those warnings coming out within 48 hours of the incident. An hour seemed reasonable in that context. Moreover, the Virginia Tech warnings were not more immediate because universities were expected to first determine the facts and then put as much information into the warning as possible, asserted Virginia Tech in its defense.

The reason for the delay was not accepted initially, and the school was fined $55,000. But in March 2012, the school got some vindication when the DOE’s chief administrative judge overturned the DOE fine. However, also in March, a civil trial jury awarded $4 million to two families of Virginia Tech victims who accused the school of negligence.

The fuzziness around the definition of what would be considered “timely” with regard to a warning prompted a legislative change in 2008, when the Clery Act was amended to include an additional responsibility for a more instantaneous emergency notification whenever a school has reason to believe that there is any imminent threat to the health and safety of students on campus. Situations meriting a notification might include chemical spills or even concerns about an infectious disease, in addition to crimes and active shooters.

Emergency notifications must be issued immediately even if all of the facts of the case are not yet gathered. The objective is to let people in and around the campus know that they may be in danger. “Immediate” is defined as meaning “as soon as law enforcement officers can confirm the threat,” says Owczarski.

The notification should be made by the police department as soon as possible after it responds to a call and confirms that there is a potentially threatening situation. When both an emergency notification and a timely warning would apply (Clery-reportable crimes, for example), the DOE has stated that a redundant timely warning is not necessary in addition to the emergency notification.

Conversely, when emergency notifications are not needed, the subsequent “timely warning” is still required under the law and should be issued after the school or police gather basic information. Schools have up to 48 hours to do that, but Owczarski says few, if any, institutions would wait that long today.

“The landscape has changed,” says Owczarski. “[I]n light of what happened five years ago, colleges and universities are far more likely to communicate first, think and respond second.”

Virginia Tech’s VT Alert system has about 10 mechanisms for disseminating information (more on these ahead). Each has its application. For example, outdoor sirens might be used for tornado warnings, but they would not likely be used in a timely-warning situation.

Communication is the most important aspect of security, says Paul Timm, PSP, president of RETA Security. Virginia Tech did have mass notification capabilities when the 2007 tragedy occurred, and it did use such mechanisms as e-mail to send out information about the shootings, but technology has made instant mass communications far easier since then.

For example, many notification systems in effect before the shooting did not use text messages. That was because it was complicated. “[Y]ou had to buy Sprint’s [service] or Verizon, or what have you, and you then had to carry their particular device,” explains Bob Lang, CPP, assistant vice president of safety and security at Kennesaw State University in Georgia.

A 2008 report called The Ripple Effect of Virginia Tech from the Midwestern Higher Education Compact found that nearly three-quarters of respondents whose schools did not previously possess the ability to send notification via text had since implemented a system capable of doing that or planned on implementing such a system.

Helping to facilitate this change is the fact that today’s notification systems can generally be used with all carriers, and most every student has a smartphone. Thus, it’s not just that mass notification systems are more widespread, says Timm, it’s that they are easier to implement and, therefore, end up being more useful.

Schools are also getting more students to sign up for notifications. That’s because “schools are speaking to other schools, and we’re learning from each other,” says Timm. “So we’re not just going to leave it up to the student to walk in and sign up. We’re saying ‘here, if you’re going to register for classes, the screen that you get before you’re allowed to register is the sign-up for mass notification.”

It is best practice to have numerous ways to reach members of the campus with pertinent information. In the International Association of Campus Law Enforcement Administrators (IACLEA) blueprint for safer campuses, “one of the things that we focused on was to have redundant systems so that if cell phones didn’t work because they were jammed, you had other ways of getting the word out to the campus if there was an imminent danger,” says Christopher G. Blake, IACLEA’s associate director and campus preparedness project director.

Virginia Tech’s current alert system includes text messaging, e-mail, message boards, sirens, and desktop alerts, among other mechanisms. “The bottom line to a lot of this is coming up with a layered approach to notifications,” says Lang.

Virginia Tech added digital message boards in classrooms and laboratories to its system after the 2007 tragedy. “Those are immediate; they literally will send a message within a second of deployment. Text messaging can take up to 20 minutes depending on cell phone service, the number of people, the number of subscribers, says Owczarski.

Owczarski says the university prioritized which classrooms would have the signs first, and the installation process is ongoing as opportunity and funding becomes available. For example, large lecture halls and the most widely used spaces received the signs initially. There are about 700 signs currently. University policy states that the boards must be included in new construction projects and renovations.

The notification process is ever-developing based upon technology improvements. For example, Virginia Tech has also added Twitter and Facebook to its cadre of notification media.

Content and context. Another issue universities have to wrangle with is exactly what the content of the message will be for any given situation.

Owczarski says that in these situations it is important to keep information updated, “because of the world in which we live in; people tweet, people Facebook, rumors go rampant.” He says that if 30 minutes goes by with no news, he will repeat what has been said or confirm that police are continuing to investigate.

For example, in December 2011, a campus police officer was shot on the Virginia Tech campus following a routine traffic stop. The police sent out the initial emergency notification when the shooting was confirmed and then quickly updated it when they knew the shooter had been spotted in a parking lot, says Owczarski. He says he then took over the communications to flesh out the warnings and information being delivered to the community. The emergency response plan was implemented, and the school was in a state of emergency response until police could confirm that the gunman was no longer a threat to the community.

Every situation will require different directives. In a potential or actual active-shooter situation, for example, the message might be to shelter in place, which simply means not to leave the building you are in. That was the case after the December shooting, though some media called it a “lockdown.”

Owczarski says that “lockdown” is a word that his school does not use, because it’s probably impossible to accomplish on a campus the size of a small municipality.

By contrast, it is feasible to advise anyone on campus to shelter in place, though that has its limitations as well. “It is not enforceable, and it might even be counterproductive if the people are in the same building as the shooter when they receive the warning,” says Owczarski.

Communicating is challenging when you have maybe a minute or two to make a decision about what to say, he says. And part of the challenge is that things are reported over Twitter and rumors and facts are often confused in the heat of a moment. “Yet what litigation and lawsuits will often say is you’re better off saying something, anything, and then reacting second. And that’s one of the great challenges that all of higher education in all municipalities face,” he says.

Virginia Tech has developed a Web portal with emergency messages for authorized individuals to send. The portal walks the user through a series of steps. The person would first put in information such as which campus the message is for and the delivery mechanisms to use (in an emergency, the default is to use them all).

There are about 30 templates of scenarios to provide a starting point for the notification. The template provides language appropriate to each type of incident and delivery mechanism; for example, e-mails might be longer and more conversational than text messages. The messages go out simultaneously. The language for the templates has been refined, and new templates have been created as drills and real-life emergencies have yielded lessons.

Threat Assessment Teams

Virginia Tech shooter Cho had behavioral issues that professors and mental health professionals knew about. After the fact, there were discussions about whether he should have been monitored more closely or removed from campus before the tragedy. It is impossible to know whether anything might have prevented that situation, but schools are trying to do what they can to focus on potentially risky situations—or people in need of assistance on or outside of their campuses—and to spot red flags that might signal trouble ahead.

The Virginia Tech incident led to a state law that requires colleges to have threat assessment teams for just that purpose. When that law came about, Virginia Tech was already putting together its behavioral threat assessment program.

Dewey Cornell, clinical psychologist and professor of education at the Curry School of Education, University of Virginia, thinks colleges traditionally have spent more resources on dealing with a tragedy than preventing it, so he sees the rise of threat assessment teams as a positive change. “I really think more emphasis should be given to prevention than just to crisis response,” he says.

Virginia Tech has spent a lot of time on refining its behavioral threat assessment team. The team consists of various individuals from different departments and disciplines.

Gene Deisinger joined Virginia Tech as threat management director in 2009. He says the school threat management team evaluates a few hundred cases a year, most of which are closed if no threat is perceived.

There are numerous ways a case can be opened, including reports from an individual on campus. When a case is reported, the team must examine the risks and the behavior in the context of whatever the individual is going through. The team will talk to the individual directly to assess and address any problems. The team also gathers information from various resources. One of the first orders of business is to determine whether the person is already being helped by other counseling or campus services. If that help is deemed to be adequate or the team determines that the person poses no threat, the case is closed.

Cornell points out that revisions to Virginia law and clarifications by the DOE have been made to facilitate information sharing with law enforcement and other groups, such as those in the medical professions. For example, a DOE clarification of the Family Educational Rights and Privacy Act (FERPA) states that school officials are not prohibited from sharing information obtained through school officials’ observation and personal knowledge, such as threatening remarks.

That is not considered part of student educational records, which makes it easier for the information to be shared.

The threat assessment team is separate from the CARE Team, which is a student aid team that was in existence prior to the 2007 shootings. The CARE Team will focus on student assistance issues, but some cases may go back and forth between CARE and threat assessment. For example, a financial-aid issue might start with CARE and then go to threat assessment if the student’s behavior becomes inflammatory. But both teams will not be working on the same case at once.

The threat assessment team is charged with identifying dangerous behaviors not just from students or faculty members but anyone who might pose a danger.

The threat assessment team mostly acts after concerns are reported, but Virginia Tech also introduced a proactive threat assessment element to the admissions process. During admissions, various background questions are asked in the application, and behavior is assessed during interaction with admissions officers.

If it is determined that an applicant has a history of violent offenses or other potentially disruptive behavior, for example, he or she would be referred to the threat assessment team. The team will then assess whether it’s possible to have a support plan to help that person be successful at the school. If the team doesn’t believe that’s possible, the applicant will not be permitted to attend the school. But, says Deisinger, “We recommend denial of very few applications.”

Red flags

The school also tries to provide some guidance to the campus community with regard to what red flags they should look for. These are listed on Virginia Tech’s Web site, but Deisinger emphasizes that there is no absolutely reliable list of behaviors, and all behavior must be taken in context. Just because a person was violent in the past doesn’t mean they will be in the future. Similarly, a person with no violent past might still pose a risk.

Deisinger says that simplistic ways of predicting who is going to be violent have not worked, and he doesn’t anticipate that changing. He adds that though most of the referrals to his team do not end up requiring long-term monitoring, they’re still helpful.

“One side of the equation is, is the subject of concern dangerous or significantly disruptive? Even if the answer is no, if they’re perceived that way, there’s still an issue, because others will continue to respond to them based on the perception. And so, for many of the cases, we’re not actively working the subject of concern so much as we are the persons who shared the concern,” Deisinger says. The objective is “to share to the extent it’s lawful and appropriate to do so, the information that would help mitigate their concerns.”

Deisinger adds that it’s the nature of the beast of dealing with potentially violent and disruptive behavior that it’s unlikely that any individual in the community would be in a position to know the whole story, “so we set up a process that we know will [yield] false positives, because that enables us to look at potential linkages across the institution.”

Awareness training. Schools also are seeking ways to make students comfortable with reporting any issues or concerns. At the University of Virginia, Cornell says, they hold a series of meetings with students to discuss such issues. The school also developed a Web site with videos that depict different kinds of situations where people might want to seek help.

Additionally, many universities have special Web sites or systems set up to receive information or concerns. Deisinger stresses how important it is to do community outreach, because the campus population is always changing. “The things we did for outreach or awareness last year do not mean that this year the community knows what resources are available to assist with concerns,” he says, adding “So that has to be a continual process.”

Response Coordination

Another key issue is how various authorities will work together in the event of a major incident where they all respond to the scene. Many schools had good relationships with local law enforcement prior to the Virginia Tech tragedy, but even with good relations, coordinating activity on the scene can be challenging.

The National Incident Management System (NIMS) and the Incident Command System (ICS) lay out protocols for such situations. In recent years, more schools are adopting the NIMS and ICS approaches even when they are not required to follow them.

The basic ICS course is actually tailored for administrators in higher education, says Timm. “Now, not enough of them are taking advantage of that, but…we’re on a crusade to help them at least be aware and then get on board,” he says. He adds that it helps them become more familiar with first responders and gets everyone speaking the “same language.”

IACLEA’s Blake stresses the importance of mutual-aid agreements and working with local law enforcement. “You don’t want to be introducing yourself to these folks at the scene [of an incident]; you want to have working relationships with them in advance.”

Five years after the 2007 shooting, Virginia Tech received high marks for its reaction to the police officer shooting, says Blake. “They were really applauded by the media and others about what a fantastic job they did of getting the word out, almost immediately, to the community, and they had regular updates and so forth.”

That proficiency was the result of lessons learned the hard way after the 2007 tragedy. But at least they have been learned. “Virginia Tech sadly has a degree of experience that hopefully will serve us in the future for when those instances will happen again,” says Owczarski, adding, “And if we can help others prepare better for the instances that have yet to occur, [we are] glad to do that.”