Ep 111: Three Scenes
Episode 111
Published Mar 31, 2025
Last updated Feb 18, 2026
Duration: 25:44
Episode Summary
In an active shooter event, where the shooting happened is a crime scene, but it’s not the only one.
Episode Notes
Every active shooter incident involves a minimum of three crime scenes: the location of the shooting, the suspect's mode of transportation, and their residence. But these scenes are just the beginning—additional challenges like jurisdictional coordination, evidence preservation, and responder safety add layers of complexity to these high-stakes situations.
Topics covered include:
- Identifying and managing multiple crime scenes.
- The role of area command in resource allocation.
- The importance of digital forensics and intelligence gathering.
- Challenges posed by mobile attackers and spree events.
- Effective delegation and communication strategies during incidents.
- The critical role of hospitals and reunification centers in response efforts.
Whether you're a first responder, incident commander, or simply interested in emergency management, this episode provides valuable insights into handling these dynamic and resource-intensive events.
View this episode on YouTube at: https://youtu.be/6yfIizr-oJs
Transcript
00:00:00:00 - 00:00:19:22Unknown
In every active shooter event, there's a minimum of three crime scenes. And where the shooting happened is a big one, but it's not the only one, and the others can get really complicated. That's today's topic. Stick around.
00:00:20:00 - 00:00:33:18
Unknown
Welcome to the Active Shooter Incident Management podcast. My name is Bill Godfrey, your podcast host. I am joined by three of my fellow instructors here at the National Center for Emergency Response on my left, Coby Briehn. Good to have you back, Coby. Thanks, Bill. Great to be here. Thanks for having us. We got Adam Pendley in the house.
00:00:33:18 - 00:00:54:05
Unknown
Adam, good to see you. Good. And nice to see you. And Juan Atan back again. It's good to see you brother. Same here brother. All right. So today's topic is the three, minimum three crime scenes of an active shooter event. Obviously, where the shooting occurred is one of them. What are the other two? Adam. Well, at a minimum, we need to think about pretty early on,
00:00:54:05 - 00:01:13:02
Unknown
we need to think about how did the suspect get there, what was their mode of transportion, because that vehicle is going to be something that has to be secured, and it's very likely that it's somewhere in the parking lot. And our Fire EMS folks might have pulled right up next to it, you know? So we need to identify that pretty quickly just to make sure that there's not an additional threat in the vehicle.
00:01:13:04 - 00:01:39:11
Unknown
And then obviously, this suspect came from somewhere. They have a residence or they live somewhere. And that's also a really important thing to track down pretty quickly, because in a lot of different stories, the active shooter maybe had done something to their family, to a family member at that house prior to going to another location or that there's, you know, a threat there as well that has to be tracked down.
00:01:39:13 - 00:02:03:00
Unknown
Yeah, we've seen that. It's not been super high frequent, but at the shooter's home or residence, wherever they're, you know, sometimes even, you know, they're living with mom and dad, there's certainly evidence, but also, in some cases, IEDs, bomb making materials. You got a little experience on that side of the house, Coby. How big a deal is that
00:02:03:00 - 00:02:23:01
Unknown
when you're the follow on responder, going to check the residence? Could be no big deal. Or it could be the worst deal that you've dealt with if you don't, I should say plan forward or other than just ripping the door open and going right in, let's evaluate. Let's look at what what could we possibly see.
00:02:23:01 - 00:02:48:13
Unknown
So what we've seen in the past, in some instances, is it's set up as an area denial system. So the attacker had set the residence up to be examined by, they know responders are going to come there. So that's the way to attack the follow on responders instead of at the scene waiting for them to get to the residence where it may be their guards let down a little bit.
00:02:48:13 - 00:03:16:07
Unknown
They think they're just going to go in and examine the forensics, the computer forensics, or the physical forensics around the house. But maybe it's set up to injure them and in turn destroy, eradicate that evidence. So it could be set up that way. So just keep your head on a swivel. Still, even though there's no known physical danger there as far as a person could very well be set up as a area
00:03:16:07 - 00:03:36:14
Unknown
denial or evidence eradication, event. So, Adam, when you develop the intel to figure out where the shooter's residence is, is that, a SWAT team deployment? Is that a SWAT team function to go do that? How does that unfold? What does it look like? Who's going to manage it? How does it relate to the primary incident?
00:03:36:15 - 00:03:55:07
Unknown
Well, I mean, again, we, you know, pretty early on that it's something that's going to have to be checked. And I think, so when we initially respond as we train around the country to respond to the crisis site itself, that's where the bulk of our training is. So it's very easy for those early supervisors in command to focus entirely on the crisis site.
00:03:55:12 - 00:04:19:04
Unknown
And it's going to take that up and out thinking for somebody to stop and say, hey, wait a minute, how did he get here and where does he live? And try to develop that intelligence, like you said, try to get that information fairly quickly, but then you have to ask yourself if you're the incident command at the crisis site, do you have the capacity to also now manage something that is very likely to be a good distance away? In fact, it might even be in somebody else's jurisdiction?
00:04:19:04 - 00:04:38:13
Unknown
Right? Absolutely. Right. So, you know, that's the first thing. So let's say, you know, if you're maybe you're a college campus environment and you're all one jurisdiction, and the dorm is very close by and very manageable with the same set of resources, you may very be able to manage yourself, but that's you. That's not likely the case. It's very likely that they've come from somewhere else.
00:04:38:13 - 00:04:56:22
Unknown
And then in many areas of the country, jurisdictions are so chopped up in a county or even within a state that not only could it be in another municipality, it could be in another county, it could be in another state. So, how do you manage that? Having the jurisdictional authority over that second location is another thing that you have to ask yourself.
00:04:56:22 - 00:05:25:03
Unknown
So very quickly, you're going to probably realize that you don't have either the capacity or the authority to be the one in charge of the residence or the other location. It's an interesting question. It also makes me wonder, though, state to state aren't there very different rules of engagement on making entry to the house based on having a search warrant, not having a search warrant, exigent circumstances, doesn't that vary from state to state?
00:05:25:03 - 00:05:49:01
Unknown
Oh, certainly. Certainly. And then it could even involve are you going to interject, your federal assets, are they going to support you in any way in that they have their own set of guidelines, SOPs, rules of engagement or general orders, GO’s how to deal with that? And what do they need to get signed off by judges, to go in.
00:05:49:01 - 00:06:09:05
Unknown
And if they have to have a warrant to go in there and what are times that they can go in and do thi,s because sometimes there are certain business hours that are set up for that team to be or that judge, that district to be able to respond to it. And then but yes, the city's talking to cities is different then you incorporate states, talking to different states.
00:06:09:07 - 00:06:30:18
Unknown
And then you have everybody that's going to be just separated by their own property boundaries of who's going to be able to do what, and do they want to and do they want to cooperate with each other and actually help. I'm not saying that they're going to be intentional, failure to act that I'm not going to help that state.
00:06:31:00 - 00:06:49:16
Unknown
It's just the getting the right people talking at the right time of the day to get it done the fastest way. And it may be more urgent than just an investigation. And in fact, it might even be your fire EMS guys that like when you're at crash scene and and all times the officers get focused on the car that's really crushed up bad.
00:06:49:22 - 00:07:06:03
Unknown
The police do. And then it'll often be a fire EMS guy that says, hey, where's the other vehicle? Right? Because they want to make sure that person is okay too. So in the command post, the fire EMS folks might say, hey, where did he come from? Did he hurt anybody else? Right? So they might be even the ones that are prompting to want to go see where the residence.
00:07:06:03 - 00:07:26:21
Unknown
What's that route? What was the route? Yeah. The other challenge that comes up on the fire and EMS side is, you know, we get called to a hazard, unknown hazard. Maybe it's a hazardous materials, maybe it's an IED. Maybe it's a little bit of both. We don't really know. Our first reaction is to roll in and take command.
00:07:26:21 - 00:07:48:16
Unknown
And we're in charge. Only this is an arm of a very significant, active law enforcement event. What kind of conversations is that going to generate at the command post Juan? Oh very exciting conversations and being there also. But yeah, we have to realize the fire EMS, right, that this is a law enforcement event.
00:07:48:18 - 00:08:04:07
Unknown
This is their scene where we're as an asset to them to assist them in this scene. Seeing that it was a hazmat scene, we're going to help them. Hey, what what do you need from us to take care of it, not go and start doing an arm wrestling match that I got command or you got command.
00:08:04:09 - 00:08:27:06
Unknown
This is a law enforcement. Well, we have to realize that this is a law enforcement event. It is not a fire event. This is a law enforcement event. They still have command. We're there to assist them in helping mitigate the situation. And this runs us. So we've we've talked a little bit about hitting their house, but I'm going to take us on a slightly different tangent that has similar interesting challenges as well.
00:08:27:08 - 00:08:53:19
Unknown
So when we look at the data, and we just talked about this recently on another podcast looking at the data, the number of suicides is on the decline and the number of people fleeing the scene is on the rise. So now you've got a manhunt, and in some cases it may be, you know, the guys in the woods, whatever, and not actively engaged, but in some cases they're fleeing and they're causing more injuries and destruction in multiple locations.
00:08:53:19 - 00:09:15:16
Unknown
It's like this string.. It's a string of crime scenes. of attacks that fire EMS has to be engaged on. Law enforcement has to be engaged on, you know, and God help us if the guy drives through three different jurisdictions, how do we get our arms around all that? So obviously, the first thing that comes to mind is it's going to be resource intensive.
00:09:15:18 - 00:09:35:19
Unknown
We know we have all trained so much to respond to active shooter events that it's very likely there's going to be a large convergence of resources from multiple jurisdictions to that first event. And that's what I try to, when I talk about this with other responders, I say you need to, that's the language, not the site or the event or the active shooter scene,
00:09:36:00 - 00:09:56:16
Unknown
it's you're responding to the first event because we are seeing increases where there could very well be an intentional, coordinated attack, where there's going to be a second location or just the guy's on a spree, right? He's going to go from one location to the next. So you again, it comes back to some resource management where you need to think about, are we over converging on scene number one?
00:09:56:16 - 00:10:21:08
Unknown
Right? Because at a minimum, we know we're going to have potentially a vehicle to deal with that they arrived in and we're going to have the the location where they live. Hospitals are going to be a scene. So the initial shooting site is just scene number one. Now add additional jurisdictions to that. Add additional tactical decisions that have to be made like a manhunt or surrounding a house or, the investigative side of it.
00:10:21:10 - 00:10:41:15
Unknown
You now have resources in multiple locations and the tool in the toolbox for that is potentially an area command. The idea of an area command is not to take over the individual decisions that are being made at these multiple scenes, but to say, hey, we are we're going to coordinate up here at this extra level to say, we only have so many bomb squads, we only have so many available law enforcement officers.
00:10:41:15 - 00:11:00:08
Unknown
We only have so many available engines and rescue units. How are we? Which scene needs them the most and which needs them first? Right? So they start making some critical resource decisions to manage these multiple scenes. And it all comes back to the same thing as the original scene. It's all about time, you know, managing the clock, getting ahead of it.
00:11:00:08 - 00:11:15:15
Unknown
So, you know, so the suspect can't keep surprising you at every new scene you want to get ahead of it. You want to start building some responses that think about, hey, we're going to put a package together. So the next suspicious call we get, we have a package to send to it. That can all happen at more of an area command level.
00:11:15:15 - 00:11:34:18
Unknown
Yeah. And the thing with the area command that we have to be aware of that where as an area commander, we're not running scene number one, scene number two or scene number three. Those individual incident commanders are running those scenes. Me as an area commander, as an example, I'll contact Adam on scene one would, you know, give me a
00:11:34:18 - 00:12:03:17
Unknown
What are you doing? What do you got and what are your needs? And we'll go from there. Same thing with scene number two. What do you got? What do you need? And scene number three. And then being you know that resource dependent let's say we're talking about multi-jurisdictional. Hey you probably might have an emergency manager there next to you that knows the ropes and goes, hey, can you get resources X amount of resources for scene number two or scene number three.
00:12:03:17 - 00:12:25:04
Unknown
And that way we could start coordinating those mass of resources that each individual incident needs. So that's one of the things when we talk about area command is not hey, I'm not running these three scenes. You are capable of running those three scenes. I'm here to divvy you up the resources that you need. And sometimes, hey, are you done with your resources on scene number two
00:12:25:04 - 00:12:55:05
Unknown
that I could give to give to scene number 2 or 3. And we could work to coordinate that. That way. Yeah certainly. You know, we've had a number it's not a huge number, but it has happened with enough frequency to make you pay attention to it. Adam, you use the phrase spree, where you've got a mobile attacker that's leaving behind them a wake of damage, multiple sites, 3, 4, 5, six different sites that they've hit.
00:12:55:07 - 00:13:16:17
Unknown
And what we've typically seen is there's only 1 or 2. It's oneies, twosies. Then move to the next site. Oneies, twosies, kind of the next site. But it creates this chaos in the dispatch center for Law Enforcement for fire EMS. What are some of the challenges, Coby, when you're watching that kind of a fast moving attack to figure out what's going on?
00:13:16:20 - 00:13:36:03
Unknown
Yeah, it's the trying to attack the unknown, you know, what are we looking at? I said before is we plan for the worst and hope for the best. So this is obviously a worse if where they haven't been able to stop them at one location they've moved from instead of 1 to 2.
00:13:36:04 - 00:14:05:19
Unknown
That's ideal. Before we get them to two, they've gone to three and four. It's what they've caused there. And what are the likely, rabbit holes? So to say that LE is going to be responding down of, is it always going to come in as that's the right suspect description when they see people fleeing? So that we could be chasing, 4 or 5, 6 different, you know, suspect vehicles are looking for this second, third, fourth person when it's actually the same one or they're confusing responders with the suspect.
00:14:06:01 - 00:14:28:20
Unknown
So it's that. It's just the, it's the fear of the unknown and somebody trying to eventually piece it together. Like what are we actually looking for? And then where are they going? What is their intent?. Is there any pattern to that? Again, that's probably going to become at some point. And then an area command incident command that's going to start putting us together is what are we looking at?
00:14:28:20 - 00:14:56:20
Unknown
Is this a truly planned event or are they just simply running and it's just a random locations out there that they're hitting, along the way? And I think one of the things that we in law enforcement do well, let's say, is, let's say that same spree suspect, you know, Bonnie and Clyde, are going from bank to bank to bank, we are actually pretty good about probably communicating their description and their their last known direction of travel.
00:14:56:20 - 00:15:19:20
Unknown
And some jurisdictions can get ahead of that. Right? And they might be able to figure out, you know, capture them before they rob yet another bank right. They're on a spree. But when active shooters happen, when active shooter type events happen, sometimes again, we get bogged down in scene one. And getting that information out to other jurisdictions is a little slower because we have to fight through the the fog of what's going on.
00:15:19:22 - 00:15:34:00
Unknown
And again, I think that's something we need to think about. We need to think about the idea that if our suspect is not here right now, and folks are telling us that this is the vehicle, this is the description, that we get out to our networks, whether it's dispatch, talking to other dispatch center or regional dispatch or fusion centers,
00:15:34:00 - 00:15:53:20
Unknown
whatever the case may be, you need to get that information out quickly because there's some patrol officer in a neighboring county that's going to see a car acting weird and pull him over just thinking that he's got a traffic stop. But the reality is the suspect knows they're the ones that just did this terrible act two jurisdictions over, and that officer is going to be in a, you know, in a terrible shootout because they never had the information.
00:15:53:20 - 00:16:22:04
Unknown
Right. You said something interesting, Adam. You brought up the role of the dispatch center. Isn't the dispatch center the most likely first opportunity to piece together, whoa, wait a minute. These things are connected, right? Is that. What do you think? Absolutely. So I've had the opportunity to work around some dispatch centers and understand that, they are really good about communicating with each other.
00:16:22:07 - 00:16:42:04
Unknown
And then there's the first line of defense is there's a supervisor that's kind of hearing more than one thing, and they're like, wait a minute, those things sound similar. And they start putting it together. But, you know, dispatch is very different across the country. We have some dispatch centers where there's one dispatcher on duty at night, and she's responsible for the police, fire and EMS of that small community.
00:16:42:10 - 00:17:00:04
Unknown
And they might have a hotline to a neighboring community. They may not. And then you have regional dispatch centers that are responsible for, you know, 10, 12 jurisdictions, all built together. Either of those methods work as long as there's a process for starting to say, hey, wait a minute, this sounds different. Let me make sure I get the information, out there to the to the right folks.
00:17:00:04 - 00:17:24:23
Unknown
And making sure that that the dots are connected. But one of the other tools in the toolbox that I've heard about having good success with is when you do get that initial active shooter event and you are dispatching your special response teams, that one sworn member of one of those teams actually goes to the dispatch center to help them start putting the dots together to help recognize that, hey, these things are related and this sounds like this type of event.
00:17:25:04 - 00:17:48:04
Unknown
And let me help you start making some calls to get the right people to start spinning up a bigger response. Juan this is gonna sound like a crazy tangent here, but it's kind of connected, to this. I'm reminded of an incident that occurred in the fire service where there was a series of arson fires started in multifamily dwellings.
00:17:48:05 - 00:18:12:11
Unknown
Yes. There were, six different fires started within less than ten minutes of each other, all within less than 6 or 8 blocks of each other, all of them in occupied multi-family dwellings. And it was very taxing for the fire service, but ironically started from a shooting event and the intent to cover up the shooting event.
00:18:12:13 - 00:18:39:15
Unknown
What kind of a challenge does that become when that's your incident? Oh, very, very challenging. And boy, you remind me on this. I know. It sticks out. It's sticks out because I just say I was there responding. But yeah, going back, it's very challenging because again, that's where that area command comes into play because you had multiple incidents happening all over the community itself.
00:18:39:15 - 00:19:06:08
Unknown
So it was very taxing for the resources because you had, you know, fire engines going here, fire and police going to you. It was taxing for everybody. So yeah, dispatch plays very a vital role there in putting those things to that puzzle together. And very important when, you know, we talked in a different podcast about that intelligence group, you know, make sure that intelligence group is embedded in the dispatch center to start.
00:19:06:10 - 00:19:28:14
Unknown
Hey, with a supervisor, what information did you get here and what information you got here? And that was one of the things going back to that incident, how they put that puzzle together very quickly because they embedded intelligence in dispatch and started working together, and they were communicating with everybody involved, saying, this happened, this happened, and they put everything together.
00:19:28:14 - 00:20:02:07
Unknown
So, so yeah, but thanks for bringing back the. You're welcome. So the the moral of the story here is that even the simplest of active shooter events has got a minimum of three crime scenes. The place where the shooting was done, the vehicle or mode of transportation in which they arrived, and then their residence. Minimum. And depending on what happened or triggered the triggering event, there might be another family residence where there's other shooting victims, potentially fatalities.
00:20:02:09 - 00:20:19:00
Unknown
Have I have I left any out? We talked about the manhunt. What have we left out? What have we missed? Well, I mean, I want to circle back to the vehicle just a little bit, you know, in the sense that, oftentimes, you know, I know for many times we've been trained, like, wherever you're going to set up your command post, you need to make, you know, check for secondary devices and things like that.
00:20:19:00 - 00:20:38:03
Unknown
That was a mantra that's been in training for a while. But, you know, it's kind of incumbent on all responders and especially supervisors that when they get there, again, those first teams are going to be focused on the active stimulus that's happening right now. But somebody can take a pause and say, wait a minute, does anybody know which one of these vehicles is his?
00:20:38:03 - 00:21:04:01
Unknown
Because in a sense, it's potentially a secondary device. Right. So if you've set up tactical triaging transport right next to the red, you know, Nissan that happens to be, you know, the suspect vehicle, you got a problem there right. You know, so and it reminds me again of a real world incident I had where, you know, as that information came out, it was put out over the radio and one of our civilian traffic, that does just civilian traffic stuff,
00:21:04:03 - 00:21:19:17
Unknown
she said, hey, I have that vehicle right here. And it was two blocks away, so we we had her on a, you know, an outside perimeter thing, just blocking traffic. And next thing you know, we have a potential threat, right? You know, a civilian that's got a vehicle five feet away from her. So, you know, those are things that need to be uncovered
00:21:19:17 - 00:21:55:19
Unknown
pretty quickly. But like the rest of it that you talked about, the other one that I wouldn't say is left out, but it's something we've talked about before, is in addition to the three minimum scenes, if you have injured your hospitals become places that have to be managed as well. They become ad hoc reunification centers. They become, you know, sometimes the, you know, the people that are injured there, the hospital staff don't know, they don't know the story, so don't know whether they've got suspects or survivors or, you know, so it... All the clothes, any evidence pulled out of them, bullets, shrapnel, anything like that.
00:21:55:23 - 00:22:25:15
Unknown
So that becomes a whole nother branch of your incident response that has to be managed. And again, I think it's a best practice to very early on put a ranking supervisor just in charge of the hospitals to manage evidence, to manage, you know, family issues and, and all of those sort of things. Yeah. And, you know, if you're listening, you're following along and you're thinking, man, that seems like an awful lot for the guy that's trying to manage the crisis site to have to manage all that too.
00:22:25:17 - 00:22:47:04
Unknown
Yeah. Welcome to Incident Command of active shooter events. It's not... Plan for the worst, hope for the best. Yeah, it's not a simple task, but there are tools and mechanisms to make that a little bit better. Final thoughts on this topic? Coby. You're up. One thing to also think about as we didn't hit here is, but is the digital forensics that are going to be out there, phones, computers.
00:22:47:04 - 00:23:07:05
Unknown
How did they learn about this? What's that tell us? Were they live streaming it? If it's that kind of event, who are they talking to? If it wasn't that kind of event, with somebody telling them to go to this area, to the nth degree of that. So that's something to look at too, is what's on them, could lead to another crime scene. Just like car keys
00:23:07:05 - 00:23:31:19
Unknown
lead to a car, phone could lead you to to their computers, to that whole digital footprint out there. But yeah, this is a this is a great one because it could go into rabbit holes of all the evidence that's eventually going to be tied it together. And how fast can we scrub it and start getting that, that Reader's Digest. I don't know if any of the kids nowadays know the Reader's Digest.
00:23:31:21 - 00:23:38:08
Unknown
The CliffsNotes readers.
00:23:38:09 - 00:24:01:22
Unknown
They got ChatGPT the summary, Juan final words. The other thing also is, the messaging. Make sure that we put that PIO out there or that press briefing when if things like this are happening so that the community is aware of what's going on. Because that's one thing with this day and age, with social media that we discussed in an earlier podcast, is that they get that information very quickly.
00:24:01:22 - 00:24:26:08
Unknown
So we want to make sure that if we're the incident commander, area commander, that we have that PIO saying, hey, I need a press briefing out as quickly as possible so they know exactly what's going on and thinking about that reunification as well. I mean, if they go into the hospital, start thinking ahead, hey, we got to start putting these families together and explain what's going to be happening kind of thing.
00:24:26:10 - 00:24:45:23
Unknown
Adam, wrap it up for us. Don't be afraid to delegate. If you're that incident commander who is getting overwhelmed with multiple sites, multiple jobs that need to get done, I'm a fan of giving away big chunks of your incident. Create that reunification branch director. Create the, put a SWAT commander in charge of the suspect's residence.
00:24:45:23 - 00:25:07:02
Unknown
Give the whole thing to them. This is their address. Go figure it out. And delegate big chunks of your incident to another ranking supervisor of some sort, who can then take that part of the incident and report back to you what they've learned. Fascinating stuff. Thank you, gentlemen, for coming in to talk about this. If you have some questions, send them our way.
00:25:07:02 - 00:25:29:20
Unknown
We're always happy to engage and expand on the topics. Thank you to our producer, Karla Torres. Like, and subscribe to the podcast. Let your people know that you work with about it. Until next time, stay safe.