Active threat response

Three options in priority order

DHS's Run-Hide-Fight framework is the standard U.S. guidance for active threat situations. It is designed to give people a decision sequence they can act on immediately without requiring information about the threat's specifics.

Run is the first priority if an escape route exists and the path is reasonably clear. Leave the location, leave belongings, and move away from the threat. The instinct to gather possessions or wait for others costs time that matters most in the earliest seconds.

Hide is the second option when running is not possible. Find a room that can be locked or barricaded, move away from doors and windows, silence your phone, and stay quiet. Turn off lights. Do not open the door for anyone until law enforcement confirms safety.

Fight is the last resort, when hiding is no longer viable and the threat is immediate. The guidance here is aggressive action: use whatever is available, commit to it, and do not stop.

Why social media is unreliable in the first hours

During the first hours of a significant attack or incident, social media moves faster than verification. Eyewitness accounts are incomplete and contradictory. Deliberate misinformation sometimes circulates alongside genuine reports. Early casualty numbers, threat locations, and descriptions of perpetrators are frequently wrong and revised as the situation becomes clearer.

Ready.gov advises following local authorities, specifically local law enforcement and emergency management, during an unfolding event. These sources have access to ground-truth information from dispatchers, responding officers, and coordinating agencies. They communicate through official channels: the Emergency Alert System, NOAA weather radio, official social media accounts, and direct press briefings.

Calling 911 for non-emergency information during an active incident is counterproductive. Ready.gov specifically notes this: 911 lines handle emergency dispatch and medical coordination. Tying them up with information requests delays response to people with immediate needs.

Shelter, reunification, and recovery

After a significant attack, the area near the event becomes an active crime scene and may have secondary hazards: structural damage, gas leaks, or the possibility of a secondary device. Ready.gov advises following law enforcement guidance on evacuation versus sheltering, and not returning to the immediate area until cleared.

Reunification with household members who were separated is a planning issue, not a crisis response one. The best time to establish a meeting point and an out-of-state contact is before an incident. During one, cell networks frequently become overloaded from simultaneous calls in the affected area. Text messages sometimes succeed where voice calls fail because they require less bandwidth to complete.

Financial preparedness matters after a major incident as well. ATMs and card readers in an affected area may be offline due to power disruption or access restrictions. Cash, and a plan for where to shelter for a day or two if the immediate area is inaccessible, extends a household's options significantly.