Case Study · Terrorism & Active Threats · 1999
On April 20, 1999, 13 people were killed at a Colorado high school. The response failures that day changed law enforcement training, school safety architecture, and public preparedness guidance for the next 25 years. Understanding what changed — and why — is the preparedness lesson.
Apr 20, 1999
Date
13
Lives Lost
21
Injured by Gunfire
Jefferson Co., CO
Location
Active Threat
Event Type
Columbine · April 20, 1999
At 11:19 a.m. on April 20, 1999, two students at Columbine High School in Jefferson County, Colorado, began an attack on their school. In the 49 minutes that followed, 12 students and one teacher were killed, and 21 more students were injured by gunfire. Several more were injured escaping through windows and falls.
During most of those 49 minutes, law enforcement officers were outside the building. The protocol in 1999 called for establishing a perimeter, containing the scene, and waiting for a SWAT team before entry. It was the standard response to any violent incident in an occupied building — designed for hostage situations, where patience reduces risk. It was not designed for what Columbine was: a mobile, ongoing attack by individuals who were not taking hostages and not attempting to escape.
The attack ended at 12:08 p.m. when both perpetrators died by suicide in the school library. No law enforcement officer entered the building as an active response during the attack. The last victims were killed at approximately 12:05 p.m. — more than 45 minutes after the attack began, and in many cases after law enforcement had arrived on the perimeter outside.
This case study focuses on what the response failures revealed, what changed because of them, and what those changes mean for how people in public spaces — schools, workplaces, shopping centers, houses of worship — can respond to active threat events today. The attack itself is documented history. The preparedness legacy is what every household needs to understand.
What the Research Shows
FBI data on active shooter incidents in the United States from 2000–2023 shows a consistent pattern: most events end within 5 minutes. Many end before law enforcement arrives. The average law enforcement response time to an active shooter event is 3–5 minutes. The implication — which post-Columbine research made explicit — is that bystander action and early individual response matter enormously in the outcome of these events. The protocol that exists for public spaces today is built directly on this research.
The FBI's analysis also found that 12% of active shooter events are stopped by armed citizens, and 4.4% are stopped by unarmed citizens — typically by rushing the attacker as a group. The most important variable in most events is whether people are moving or frozen. People who move — whether to run, barricade, or as a last resort confront — consistently fare better than those who remain stationary in the open.
The U.S. Secret Service's National Threat Assessment Center conducted exhaustive post-event analysis of targeted violence incidents in schools, workplaces, and public spaces. Their consistent finding: in the overwhelming majority of cases, the perpetrator had communicated their intentions in advance — to a classmate, friend, online, or in a journal. The Columbine perpetrators were no exception. They had made statements and online posts that, in retrospect, communicated what they intended.
The concept that emerged from this research — behavioral threat assessment — is not about profiling or predicting violence from demographic characteristics. It is about creating institutional mechanisms to receive, evaluate, and respond to communicated threats before they become violent events. The school counselor or workplace HR manager who receives a report and knows how to escalate it is the first line of defense the research identifies.
The pre-Columbine response protocol was designed for barricaded subject situations — an armed person who has taken a position and is not actively shooting. The protocol's logic was sound for that scenario: time is the ally of law enforcement in a barricade, because the subject runs out of resources and options, while negotiation possibilities increase. An active shooter situation is the inverse: time is the ally of the perpetrator, because every minute of continued operation produces additional casualties. Columbine was the event that made this distinction visible to law enforcement planners in a way that produced immediate, permanent change.
Timeline
Jefferson County Sheriff's records later revealed that a complaint had been filed in 1998 regarding online posts and statements that, in retrospect, described planning for the attack. The complaint was not acted upon. In the months before April 20, both perpetrators made statements and online posts that communicated their intentions to classmates. Post-event interviews established that multiple students had been told something was going to happen. No formal threat assessment process existed to receive and evaluate this information.
At approximately 11:10 a.m., improvised explosive devices placed in a field south of the school were intended to detonate and draw emergency response away from the school. They did not function. At 11:14 a.m., additional devices in the cafeteria — also intended to detonate — also did not function. At 11:19 a.m., the attack began at the school's west entrance. The first 911 call was received at 11:23 a.m. The first Jefferson County sheriff's deputy arrived at 11:24 a.m.
The attack moved through the parking lot, the school's exterior, and into the building over 49 minutes. Law enforcement established a perimeter and exchanged fire with the perpetrators from the parking lot at multiple points. No law enforcement entry of the building as an active response to the ongoing attack occurred. Students and teachers barricaded themselves in classrooms, the auditorium, and other spaces. The attack ended at 12:08 p.m. when both perpetrators died by suicide in the school library.
Law enforcement entered and cleared the building after 12:08 p.m., treating it as a crime scene with possible remaining threats. Victims who had barricaded in the building — some of them wounded — were not reached for hours. The last confirmed victim was killed before law enforcement entry. The post-event investigation, conducted by the Jefferson County Sheriff's Office and the FBI, took 16 months and produced the most comprehensive analysis of an active threat event in American law enforcement history to that point.
Human Decisions
In classroom after classroom, students and teachers who locked or barricaded doors, turned off lights, moved away from windows, and stayed quiet were not found. The barricade actions taken by individuals throughout the building — without any training or prior protocol, acting on instinct — demonstrated that placing a locked door between a threat and a group of people is an effective protective action. This observation was central to the post-Columbine development of formalized lockdown and Run-Hide-Fight protocols.
Teacher Dave Sanders ran through the school warning students and directing them away from the threat before he was shot. His actions moved hundreds of students to safer areas of the building. Sanders later died from his wounds after waiting for medical attention for several hours in a classroom where students had barricaded and were providing first aid. His actions are the documented case for the value of clear adult direction in the first moments of an active threat event.
The perimeter-and-contain protocol followed by Jefferson County law enforcement was the correct response to a barricaded subject situation. It was the wrong response to an active shooter situation. No fault lies with the individual officers who followed established training. The fault lies in the gap between the protocol's design assumptions and the actual event type. This distinction — and the need for immediate action protocols for active shooter events — became the central lesson law enforcement took from Columbine.
The 1998 complaint filed with the Jefferson County Sheriff's Office documented online statements describing specific violent plans. A formal behavioral threat assessment process — had one existed — would have required a structured evaluation of that complaint. No such process existed at the school, the county, or in law enforcement at the time. The Secret Service's post-Columbine research identified this gap as the specific institutional failure that behavioral threat assessment programs were designed to close.
Columbine's most significant legacy is not what happened — it is the gap between what happened and what the response protocol assumed would happen. Every protocol change that followed — immediate action rapid deployment, Run-Hide-Fight, behavioral threat assessment teams, lockdown drills, ALICE training — traces directly back to the specific failures the Jefferson County and FBI investigations documented. The attack's long shadow in American public safety is not about the event itself. It is about the institutional changes the event's response failures forced.
What Changed
Within two years of Columbine, law enforcement training across the country was revised to teach immediate action rapid deployment (also called active shooter response or contact teams). The protocol: the first officer on scene does not wait for backup or SWAT. They enter and move toward the threat immediately, alone if necessary. This is a fundamental reversal of the perimeter-and-wait protocol. Its basis is the data showing that most casualties in active shooter events occur before SWAT arrives, and that moving toward the threat stops the shooting faster than containing it.
The DHS-endorsed Run-Hide-Fight protocol emerged from research and training development that began after Columbine and was formally published by DHS in 2008. FEMA incorporated it into public preparedness guidance. CISA (Cybersecurity and Infrastructure Security Agency) now offers free workplace and school training in the protocol. It is taught in most U.S. schools, most large workplaces, and is the basis for active threat preparedness guidance in more than 100 countries.
The Secret Service's National Threat Assessment Center, building on Columbine research, published its first threat assessment guidelines for schools in 2002. By 2023, more than 40 U.S. states had enacted legislation either requiring or encouraging behavioral threat assessment teams in K–12 schools. The research base is consistent: the majority of targeted violence attackers communicated their intentions in advance. A functioning threat assessment team that receives, evaluates, and responds to that information is the institutional prevention mechanism the research identifies as most effective.
If It Happened Today
What You Can Do Now
The goal of this preparation is not to live in fear of public spaces. It is to spend 30 minutes learning protocols so that you do not have to think through them during the 90 seconds they matter.
CISA offers a free 45-minute online active shooter preparedness course at cisa.gov. Run: evacuate if a safe path exists — do not wait for others, leave belongings behind. Hide: if you cannot run safely, get behind a locked door in an interior space, silence your phone, turn off lights, and stay quiet. Fight: if the threat enters your space, commit fully to disrupting the attacker using whatever is available. This is a last resort, not a first choice — but knowing it removes one variable in the moment.
Active threat preparedness resourcesSecurity professionals call this pre-event situational awareness — identifying exit routes before you need them. In any venue: a restaurant, a theater, a shopping center, a place of worship. Find the two nearest exits when you arrive. Note the path from your seat. This is not a state of anxiety. It is the same habit that pilots use when they board a commercial flight as passengers — a 30-second mental exercise that removes the need to search for an exit while under stress.
Situational awareness basicsBehavioral threat assessment works only when people report what they observe. The Secret Service research finding is consistent: someone knew before the event. The specific preparation is knowing how to report a concern at your workplace or school — the HR contact, the threat assessment team, the anonymous tip line, or the local law enforcement non-emergency number. Reporting a concern is not an accusation. It is putting information into a system that is designed to evaluate it.
Community safety and preparednessThe Stop the Bleed campaign — launched by the White House in 2015, developed from military trauma medicine experience — teaches civilian hemorrhage control: how to apply direct pressure, pack a wound, and apply a tourniquet. Dave Sanders, Columbine's teacher who died after directing students to safety, waited hours for medical care while students did their best to keep him alive. Stop the Bleed training is free, takes 90 minutes, and is offered through hospitals, fire departments, and the American Red Cross.
First aid and community preparednessDuring the Columbine response, parents flooded the area attempting to reach their children. Cell networks in the area became overloaded. A family reunification plan — a pre-agreed physical meeting point that does not require a phone call, a text, or cell service — removes this point of failure. The plan should designate: a primary meeting point near the school or workplace; a secondary location farther away if the primary is inside the response perimeter; and a designated out-of-state contact both parties can call from different locations to relay status.
Family emergency communication planNew World Survival participates in affiliate programs. When you purchase through links on this site, we may earn a small commission at no additional cost to you. This does not influence our editorial recommendations.
Ready to prepare?
CISA's free online training covers Run-Hide-Fight. A family reunification plan takes 15 minutes to write. Stop the Bleed training is 90 minutes and available in most communities. The Columbine research tells us exactly what preparation works — it is not complicated.
Active threat and local risk preparedness