Two customers within radius of the incident who could have been affected
At 0939hrs our Intelligence Coordination Centre identified a potential incident involving an armed individual in Chatham, UK. Upon further investigation, the team discovered video evidence of an active shooter in the vicinity, triggering major incident response and enabling the team to geolocate the incident. The individual posed a high risk to the customers and colleagues of customers in the surrounding area, so it was vital that swift, accurate and actionable intelligence was shared with the relevant teams.
The individual was seen firing shots from a balcony, requiring armed police response. At 0953hrs, Twitter activity appeared to corroborate the earlier claims of an active shooter at the location. A GSOC Analyst verified the initial report and our major incident response protocols were initiated. Video footage enabled our Analysts to geo-locate the incident to a specific road in the area.
At 1002hrs a flash report was distributed to all customers with a presence in the geo-located area, detailing the presence of an active shooter and their approximate location, based on the available intelligence. Providing an initial flash report is the top priority, in order to give security teams notice of an incident and be prepared to act accordingly as more information becomes available.
Once this had been delivered, the GSOC Analysts focused on gathering additional intelligence to support customers’ decision making. In the first instance, this meant defining the location the shooter was present, in order to narrow down which customers’ people, assets and environments were most at risk. This is when it was discovered the shooter was 200m from two separate customer sites, one a large insurer, the other a national retailer, putting them within range of the individual.
A map was produced for the relevant clients to help inform their decision making, enabling them to specifically identify the location of the individual and assess the risk it posed to their people, assets and environment and take appropriate mitigation measures.
At 1022hrs an updated flash report was produced and delivered, providing additional information to our customers in order to enhance their decision making.
The incident was resolved at 1038hrs once the Police had arrested the gunman, at which point an updated and final flash report was produced to inform affected customers that no known threat remained.
Upon receipt of the initial flash report, one of the two customers closest to the individual took the decision to lock down their sites, which at the time was approximately 10 members of staff on-site.
Upon receipt of the final updated flash report informing the customer the individual had been arrested and no longer posed a threat, the customer lifted the lockdown of the site and staff could return to work.
In addition, the customer requested an additional security presence on-site to act as reassurance for staff for the remainder of the day.
Without the real-time intelligence provided by the GSOC, the clients near the incident would not have been able to manage the risks so swiftly and efficiently, which could have had more significant consequences.