The increase in ‘lone wolf’ cold and hot weapon and vehicle ramming attacks in public places in general and in places of worship in particular, is a phenomenon that unfortunately will continue to challenge security agencies. Those charged with accurately collecting and analyzing intelligence have unsuccessfully been trying to predict events that by their nature are typically not coordinated within a terror organization and so do not raise the necessary red flags. This makes it extremely difficult to foil the attacks. Nevertheless, as we have seen several times, the mitigation of the outcomes from events is very much influenced by the way in which the targets and people in the vicinity of these attacks respond and this response can make the difference between a serious attack and a catastrophic attack. This briefing looks at recent attacks and serves to provide insights from them that can help us change possible outcomes from future attacks.


In 1929, Walter Cannon coined the term “fight or flight” as a catchy and easily remembered description of the human response to a threat. This led to an assumption that fighting or fleeing were the only possible responses and the fact that the term is still in use 90 years later is a testament to the strength of his work. In fact, research has progressed and expanded on Cannon’s theory, and it is now generally understood that there is a sequence of 4 responses to a threat.

Fight Flight


The freeze response, also known as hypervigilance, is the stop, look and listen action associated with fear. It stems from the fact that the brain is conditioned to think that by avoiding movement, we will avoid detection.

Flight and Fight

The original fight or flight term coined by Cannon implied that the first instinct is to fight and only then to flee. In reality, it has been recognized that sequentially, the response is to flee and only if we do not succeed in escaping the predator, would we fight. More importantly, these two responses are the stages at which the brain is able to actively respond to events.


The final response is tonic immobility which is colloquially referred to as ‘playing dead’. Known as ‘fright’, when there is no possibility of escaping or winning a fight, we are hard-wired to exhibit extreme passivity as part of our survival response.

M.I.P. Security believes that a basic level of security awareness as described below helps depress or minimize the Freeze and Fright responses to allow the Flight and Fight response to enable the appropriate reactions to a threat event.


M.I.P. Security have long been advocates of security awareness in the general population. This awareness can be gained from training by external or internal security specialists and can be enhanced with drills.

It is interesting to note that with a perceived increase in the number of active shooter and other lone wolf events, even without specific training, the public have become more aware of the phenomena. This means that the increase in frequency of events appears to result in an increase in the efforts by those targeted to escape or challenge the attacker. Certainly, most people will still freeze or otherwise become immobile, but awareness of other possible outcomes helps others to shake off paralysis and take action. Arguable, this can be demonstrated by the fact that in the first major ramming attack in Nice on April 14th 2016, the casualty rate was significantly higher than in attacks that followed. We believe that when later attacks occurred, more people were able to overcome their shock and take some level of action because consciously or sub-consciously they were aware of the possibility of such an attack.

In active shooter events, we can certainly see a difference in the outcomes. If we compare the attack on the mosque in Christchurch on March 15 this year to the attack on the synagogue in San Diego on April 28th, we see that the targets in San Diego acted and responded. An event like this in New Zealand was almost unheard of and the outcome was catastrophic but now the level of awareness is higher there, we can hope that if a similar attack was to be attempted, that the outcome would be different. An event like this in the USA is already far too commonplace and therefore the levels of awareness there are much higher. The outcome in the San Diego synagogue attack was therefore far less severe.

Security awareness does not necessarily have to come from experience. It can be gained from training and seminars which help explain the threats and possible responses to both experienced security personnel and to lay people. If this is done correctly, it will help increase the chance that if they are ever faced with these threats, the level of surprise and shock will be minimized and they will have a better chance of acting and responding rather than freezing.

Security awareness focuses on a number of areas:


Clearly if it is possible to get out of the way of the threat and avoid the consequences, this is preferable, and it can be achieved in two ways:

Awareness of escape routes

Exiting the area will not only distance targets from the attacker but might also give them an opportunity to call for help.

Awareness of safe spaces

When referring to safe spaces, we do not mean highly secure hardened safe spaces which are not typically found in low-security domestic or commercial properties. We consider safe spaces to be closed or darkened rooms, hiding spaces or any space which shields the target from the attacker. This could mean concrete bench seating or planters, a side room or a closet to hide in. In recent attacks, we have seen active shooters move through a building, firing on anyone they see but typically not opening doors or searching out hiding places.

  • In the Christchurch attack, despite the prolonged time the attacker spent in the building, he did not appear to open doors and seek out worshippers who were hiding.
  • In the Pittsburgh synagogue attacks, worshippers hid in a closet.
  • A ramming car can be avoided by climbing onto a ledge or raised space which would be enough to save lives.

All of these responses benefit from a basic awareness of the space around you and a subconscious reflex to act accordingly.

Whether fleeing along an escape route or moving to a safe space, the action of one person can be multiplied and lives can be saved if he alerts or leads other people nearby to the route or safe space. This was demonstrated very clearly in the San Diego synagogue attack, when worshipers led young children into safe areas, saving their lives. In the October 2018 Pittsburgh synagogue shooting, the Rabbi helped worshippers escape through a side door.


While the weapons an attacker use may seem overwhelming, there are many situations whereby quick thinking by one of the targets or even a passerby has neutralized the attacker or at least caused him to flee.

Weapons fail

Guns are mechanical devices that fail regularly and there are many reasons that a gun may jam. In addition, magazines empty and need replacing. A jam or a magazine replacement, both offer a window of opportunity to thwart the attacker.

Action vs. inaction

Trolley Man

Michael Rogers the “Trolley Man” attacking the knife man in Melbourne 2018

There are plenty of examples where actions were taken by bystanders or targets of the attacker that mitigated outcomes or neutralized the attacker:

  • In 2016, a busker in Tel Aviv neutralized an attacker by hitting him over the head with his guitar.
  • In November 2018, a knife attack started on Bourke St in Melbourne. A bystander since dubbed “Trolley Man” rushed the attacker with his shopping trolley and helped neutralize the attack.
  • In the April 2019 Poway synagogue attacks in San Diego, the jamming of the attacker’s gun presented an opportunity for one of the worshippers to rush the attacker causing him to flee.


By studying and understanding the psychology and chronology of recent terror events, we can see that people who are not paralyzed with shock are able to take action, whether to save themselves and others, or to try and neutralize the attacker.

Security awareness programs help take people out of shock mode during an event, allowing them to take actions and not ‘freeze’. These programs also have been shown to improve a person’s ability to respond to a ‘Gut Feeling’ when an abnormal event occurs and thereby increase the chance of intervening before the attack fully evolves.

There should typically be at least three types of awareness programs for different audiences:

  • Security personnel
  • General Staff
  • Higher risk target populations (e.g. worshippers in mosques/synagogues)

With the right basic training in the form of an Awareness Program, people can also be a force multiplier for detection of threats and serve as an effective part of the emergency response if needed.

We have seen the positive outcomes of Security Awareness over the years in numerous events. Believing that a threat is possible and understanding what the threat may look like can make all the difference between life and death and between the outcome of an event being ‘merely’ serious rather than catastrophic.

Kind regards
The M.I.P Security team