Major Incidents, Terrorism & Active Shooter

EMS Preparation and Response to Complex Coordinated Attacks

Issue 9 and Volume 42.

Active shooter incidents, defined by United States government agencies as “an individual actively engaged in killing or attempting to kill people in a confined and populated area,”1 have had a significant impact on preparedness efforts within the first responder community.

The FBI defines terrorism as, “The unlawful use of force or violence against persons or property to intimidate or coerce a government, the civilian population, or any segment thereof, in furtherance of political or social objectives.”2

Although “complex coordinated attack” hasn’t been explicitly defined, it can be described as several terrorist actions occurring in close succession.

Actions may include the use of firearms, explosive devices or other methods to inflict injury and death upon a population.

The multitude of incident locations—and the resulting confusion among both responders and the public—can quickly overwhelm response capabilities. A significant challenge associated with a complex coordinated attack is determining if evolving events, which may initially seem unrelated, are linked to a larger terrorist plot, potentially involving multiple locations.

The emerging threat of complex coordinated attacks, such as those that have occurred in Mumbai, Paris and Brussels over the last 10 years, puts the safety and security of the public at risk, and will have a significant impact on EMS preparedness and response.

Mumbai, India, 2008

Beginning the night of Nov. 26, 2008, 10 men associated with the Lashkar-e-Tayyiba terrorist group conducted multiple attacks in Mumbai, India. The terrorists traveled from Pakistan to India together, and then divided into four tactical units.

The first team of two terrorists initiated an attack at approximately 9:21 p.m. at the Chhatrapati Shivaji Terminus railway station. By firing into the crowds present at the station, the terrorists were able to kill 58 people over the course of 90 minutes. After exiting the station, they killed six police officers in an ambush attack. They killed 10 more people before law enforcement was able to kill one of the terrorists and capture the other.

The second site attacked was Nariman House, operated by the Jewish Chabad Lubavitch movement. The attack began on November 26 at 9:30 p.m. when the gas station next to the house exploded. Two terrorists fired on the building and then entered to take hostages. It took three days and several tactical engagements to rescue the hostages and kill the terrorists.

The Leopold Café was the site of the third attack, which began on November 26 at approximately 9:30 p.m. Four of the terrorists entered the cafe and opened fire, killing 10 people.

The cell then traveled to the Taj Mahal Palace and Tower Hotel to continue the attack. The siege, which killed 31 people, would continue for three days.

The fourth attack was at the Oberoi-Trident Hotel. Two of the terrorists entered the hotel restaurant on November 26 at 9:57 p.m. and opened fire on the crowd. The siege continued within the hotel until afternoon the following day. Approximately 30 people were killed.3

Paris, France, 2015

The Islamic State militant group killed 130 and injured hundreds more by conducting a series of attacks around Paris within a 20-minute period. The attacks began when a suicide bomber detonated explosives outside of the Stade de France during a soccer match. Two additional suicide bombers would detonate explosives outside of the stadium within the next 35 minutes.

Five minutes after the first bomb was detonated, gunmen opened fire in a different area of the city at the Le Carillon bar and the Le Petit Cambodge restaurant. Approximately seven minutes later, gunmen opened fire in front of a pizzeria and a cafe located several blocks away.

Five minutes later, the terrorists traveled by car to La Belle Equipe bar, where they opened fire on patrons. Within minutes, a suicide bomber detonated explosives at the restaurant Le Comptoir Voltaire.

Simultaneous to the detonation of this suicide bomber, three men entered the Bataclan concert hall and opened gunfire on the crowd. Police engaged with one of the attackers, causing his suicide bomb to detonate. The other two terrorists in the concert hall detonated their explosives while engaging with police.4

Brussels, Belgium, 2016

A coordinated attack by Islamic State-inspired terrorists took place in Brussels, Belgium, on March 22, 2016. Two suicide bombers detonated explosives within a minute of each other in the departure lounge of the Brussels Airport in Zaventem.

One hour later another suicide bomber detonated an explosive on the Brussels subway. The attacks killed 31 and injured 300.5

Preparation & Response

Response to a complex coordinated attack is challenging. Responders may not initially be aware that they are responding to a terrorist event. Also, first responders have no way of knowing if the attack is isolated or part of a larger plot—or if they are the intended target of the attacks. The uncertainty of these elements makes it difficult to assess the safety of the scene.

The Department of Homeland Security (DHS) Office of Health Affairs has provided several recommendations for improving incident response management within the First Responder Guide for Improving Survivability in Improvised Explosive Device and/or Active Shooter Incidents. Key recommendations include institutionalized use of the National Incident Management System (NIMS), effective patient triaging and increased integration between EMS, the fire service and law enforcement.6

The DHS Office of Health Affairs has identified additional opportunities to improve incident response management which are reliant upon a robust emergency preparedness program. Opportunities include expanding Public Safety Answering/Access Point (PSAP) intake procedures, developing interoperable communications between all first responders and receiving hospitals and a continuous training and exercise program to maintain competency for these low-frequency, high-consequence events. Training and programs should be integrated between EMS and law enforcement agencies.6

The All Hazards Disaster Response (AHDR) course provided by the National Association of EMTs also covers these essential functions for frontline EMS practitioners.

The Hartford Consensus IV: A Call for Increased National Resilience has recognized that there’s a crucial response asset often present prior to the arrival of professional first responders: the uninjured bystanders. Bystanders have demonstrated a willingness and capacity to provide immediate lifesaving care prior to the arrival of the formalized EMS agency. They’re a crucial component in increasing survivability and there should be further development of the capacity for the general public to provide emergency medical care.7

Victims of terrorist attacks typically have trauma that’s more complex than other trauma patients, and there’s an increased prevalence of vascular trauma.8 Clinical care for injured patients should be directed by evidence-based guidelines outlined within courses such as Prehospital Trauma Life Support (PHTLS) or Tactical Emergency Casualty Care (TECC).

Tourniquets are also identified as a safe and effective treatment to prevent exsanguination from a bleeding extremity injury.9

A recent study found the injury patterns of civilians in mass shooting events differ from soldiers in combat operations and “a treatment strategy that goes beyond use of tourniquets is needed to rescue the few victims with potentially survivable injuries.”10


Complex coordinated attacks present a serious threat to EMS, and a robust emergency management program is necessary to prepare practitioners for operational and clinical response to the events.

There’s also an opportunity for EMS systems to support The Hartford Consensus IV by developing the capacity and resilience of immediate bystanders to provide lifesaving care during these events. Developing resilience within the general public is an invaluable capability EMS can work to cultivate..


1. Blair JP, Schweit KW. A study of active shooter incidents, 2000–2013. Texas State University and FBI: Washington, D.C., 2014.

2. Terrorism, 2002–2005. (n.d.) FBI. Retrieved July 13, 2017, from

3. Mumbai terror attacks fast facts. (Nov. 24, 2016.) CNN. Retrieved May 3, 2017, from

4. Paris attacks: What happened on the night. (Dec. 9, 2015.) BBC. Retrieved May 3, 2017, from

5. Hume T, Ap T, Sanchez R. (March 25, 2016.) Here’s what we know about the Brussels terror attacks. CNN. Retrieved May 3, 2017, from

6. First responder guide for improving survivability in improvised explosive device and/or active shooter incidents. (June 2015.) U.S. Department of Homeland Security Office of Health Affairs. Retrieved July 13, 2015, from

7. Jacobs LM, Carmona R, Butler F, et. al. (March 1, 2016.) The Hartford consensus IV: A call for increased national resilience. Bulletin of the American College of Surgeons. Retrieved July 13, 2017, from

8. Heldenberg E, Givon A, Daniel S, et. al. Terror attacks increase the risk of vascular injuries. Front Public Health. 2014;2:47.

9. Inaba K, Siboni S, Resnick S, et. al. Tourniquet use for civilian extremity trauma. J Trauma Acute Care Surg. 2015;79(2):232–237.

10. Smith ER, Shapiro G, Sarani B. The profile of wounding in civilian public mass shooting fatalities. J Trauma Acute Care Surg. 2016;81(1):86–92.