Mitigating Active Shooter Risks Through Lessons Learned and Existing Standards

Imagine walking into a corporate office building that lacks a fire safety system—no smoke detectors, emergency strobes, or sprinkler systems. It’s hard to imagine because the likelihood of that happening is almost zero. Fire codes and regulations mandate many protections, and liability concerns drive compliance. Fire systems are routinely tested and drills are conducted to keep the building population aware of proper procedures to follow in an emergency.

Should companies have the same risk and concerns of liability about workplace violence as they do in a fire emergency?

While companies are generally well prepared for a fire-related emergency, what about a security threat, such as an active shooter or other workplace attack with an assailant intent on harming others? In 2022, there were 524 workplace homicides in the United States, according to the U.S. Bureau of Labor Statistics. Compare this to the 53 fatalities from fires in workplaces—an individual is 10 times more likely to die from an act of workplace violence than a fire-related injury while at work.

Mass shooting incidents can result in significant litigation exposure. Until recently, companies have not generally been held liable for mass shootings due to the unforeseeable nature of these events. However, there has been a shift away from this mindset concerning mass shootings and an increase in the belief that companies can be held liable, according to an article published by the American Bar Association in February 2020, “Liability for Mass Shootings: Are We at a Turning Point?”

Several ongoing cases may point to a change in how the courts are perceiving who is legally responsible after an active shooter event. The core factors of these liability claims are the foreseeability of an event and the actions taken—or not taken—to address it.

Following the 2021 workplace shooting that left nine people dead at a railyard in San Jose, California, a county superior court determined in August 2023 that a lawsuit could proceed against the Santa Clara Valley Transportation Authority (VTA).

“There is evidence indicating VTA knew that the shooter posed a danger to employees at the yard,” said Nick Rowley, an attorney representing the family of one of the victims. The family claims that the shooter demonstrated a pattern of insubordination, was involved in multiple altercations with coworkers, and that there were fears among staff that he might take violent action. However, VTA failed to investigate, discipline, or terminate him before the shooting. While this case is still pending, in 2022 VTA settled with the families of the eight other victims for $8 million. (Vicki Lane et al. v. Universal Protection Service, LP, et al., Superior Court of California for Santa Clara County, No. 22-cv-393348, 2024)

Similarly in November 2023, a court determined that a $40 million suit relating to a shooting could move forward against the Newport News School Board. School teacher Abigal Zwerner was shot by a 6-year-old student in January 2023. Zwerner alleged that administrators ignored multiple warnings about the boy having a gun on the day of the incident and had previously dismissed ongoing concerns about his troubling behavior. The court found reasonable cause to allow a claim of negligence to move forward. A trial date is set for January 2025. (Abigail Zwerner v. Newport News School Board et al., Circuit Court of the City of Newport News, No. 2301446H-00, 2024)

In both cases, plaintiffs allege that the organizations were made aware of a heightened threat and failed to take appropriate actions to prevent the incidents from occurring. It is hard for organizations to prove that a shooting is unforeseeable when they were informed of specific warning signs in an individual’s behavior that could indicate an elevated threat. 

Assume It’s Inevitable

No company, regardless of its size, is exempt from the risk of an active shooter—events often driven by a personal grievance related to disciplinary actions, workplace bullying, or domestic relationships. When conducting risk assessments companies should consider an active shooter as a possible event, instead of an unlikely one.

Having a plan in place to address threats is an essential first step. Investing in tools, technology, and training to support an active threat plan should be considered equal to investing in a fire system and conducting fire drills.

However, investing in systems and planning for an active shooter event does not absolve a company of all liability. Providing the resources and tools to support the plan and training personnel to execute the plan are essential elements to avoid negligence claims.

In January 2024, a Chicago hospital agreed to a $20 million settlement to end a lawsuit concerning the wrongful death of Dayna Less, a pharmacist who was killed by an active shooter in November 2018. The shooter, Juan Lopez, first killed his former fiancée, Dr. Tamara O’Neal, in the hospital parking lot. Lopez then entered the hospital and shot and killed Less as she exited an elevator.

The hospital previously recognized the foreseeability of a potential active shooter and took precautions by having on-site security, developing a plan to warn occupants of an active threat by using a coded alert (“Code Silver”), and conducting active shooter drills. But after Lopez shot O’Neal six times, there was no Code Silver sent out to the hospital employees.

The suit alleged that the hospital and its hired security company were liable due to a failure to follow established procedures and failure to warn occupants, including Less, about the shooting. The lawsuit claimed that the hospital was negligent by failing to implement a lockdown of the building after the initial shooting occurred. The root of the claim is that the Code Silver alert could have prevented Less’s death if it had been sent out in a timely manner, allowing her to take appropriate action to protect herself rather than enter the elevator and unknowingly walk directly into the shooter.

The technology available today can certainly help mitigate a level of risk. Emergency notification systems that utilize public speakers, email or cell phone notification systems, and desktop notifiers are commonly used. Often these systems are tied into fire systems for automated messaging but rely on manual actions to send a security related alert. Gunshot detection systems can be integrated with a notification system to automate the process in the event of an active shooter.

According to the ALICE Training Institute, 50 percent of active shooter incidents end in less than five minutes. This means that immediately alerting staff that an event is occurring can be crucial in saving lives and reducing liability claims against a business. Could an automated alert system have prevented Less’s death? For the Chicago hospital, that is the $20 million question. 

Joseph Ranucci, CPP, has worked in the security industry for 30 years, managing security operations in the financial, healthcare, telecommunications, and public utility sectors. In addition to the ASIS CPP certification, he has professional certifications in Information Security, Six Sigma, and is a certified active shooter response trainer with certifications from both A.L.I.C.E. and DHS/FEMA.