Lessons Learned from Uvalde

By Brian Higgins

The tragic events at Robb Elementary School in Uvalde, Texas, on May 24, 2022, are seared into my memory - not only because of the 21 lives lost, including 19 children, but also because of the failures that allowed the crisis to unfold as it did. As professionals in security and public safety, we have a responsibility to learn from what happened that day so we can do better. In this post, based on my recent webinar for Campus Security Today, I break down the critical lessons from Uvalde as outlined in the Department Of Homeland Security U.S. Customs And Border Protection Office Of Professional Responsibility Report Of Investigation, the Texas House of Representatives Investigative Committee on the Robb Elementary Shooting, and US DOJ Critical Incident Review, Active Shooter at Robb Elementary School along with how they can help us strengthen readiness, coordination, and leadership in a crisis.

1. Command and Control Must Immediately Be Established

Probably the most glaring failure at Uvalde was the absence of an established incident commander and Incident Command Post (ICP). Despite the rapid arrival of hundreds of law enforcement officers from multiple jurisdictions, no single person or agency took control of the scene. No perimeter was cordoned off. No staging area was created. And most critically, no central point for communication or decision-making was set.

This lack of command and control created an extremely chaotic environment in which lives were lost and misinformation continually spread. Many responders assumed Uvalde Consolidated Independent School District Police Department (UCISDPD) Chief Arredondo was in command - and he should have been as UCISDPD’s active shooter policy called for him to be the incident commander in any active shooter response - or believed the subject had already been neutralized. As incident commander, not only should Chief Arredondo have taken control of the scene, but he also should have done so away from the school.

In accordance with National Incident and Management System (NIMS) and ICS protocols, an incident commander should not be in the area near the active threat but rather should rather command all responding agencies from a remote location. Chief Arredondo’s own words reveal his failure:

“[W]hile you’re in there, you don’t title yourself … I know our policy states you’re the incident commander. My approach and thought was responding as a police officer. And so I didn’t title myself. But once I got in there and we took that fire, back then, I realized, we need some things. We’ve got to get in that door. We need an extraction tool. We need those keys. As far as … I’m talking about the command part … the people that went in, there was a big group of them outside that door. I have no idea who they were and how they walked in or anything. I kind of – I wasn’t given that direction.”

No one was directing the response to the shooting. This confusion resulted in delayed entry into the classrooms, despite gunshots continuing to be heard. Unified command is crucial in these types of situations. NIMS and ICS protocols help ensure coordinated communications and cohesive action. When those systems are ignored, the consequences can be catastrophic.

2. Standard Active Shooter Response Must Be Followed

The first priority in responding to an active shooter is to engage and neutralize the threat. In Uvalde, responders waited more than 70 minutes after first responders entered the school, and 27 minutes after hearing multiple gunshots inside classrooms 111 and 112, before they opened the door to room 111. Officers searched for keys, tested locked janitor closets, and called for breaching tools and drones - even after hearing gunfire.

Delays in decision-making and action meant 45 shots were fired while officers stood outside. This runs counter to every principle of active shooter response, which prioritizes speed, aggressiveness, and decisive action to save lives.

3. Training Is Key in Active Shooter Incidents

Many of the officers on the scene had not been adequately trained in active shooter response or in using NIMS and ICS frameworks. Their training on active shooter response procedures did not adequately prepare responding personnel to deal with this situation as the curriculum did not include the proper application of NIMS or ICS protocols and did not prepare them to address an active shooter behind a locked door. Additionally, U.S. Customs and Border Protection (CBP), who responded to the incident, and local personnel never practiced for a mass casualty incident.

Officers need to be trained to handle dynamic, high-stakes environments where split-second decisions can save or cost lives.

4. Layered Security Measures and Procedures Are Critical

Multiple investigations revealed that the door to Room 111 had a long-standing mechanical issue as it was difficult to lock. There were no work orders on file to repair it; however, teachers and administration knew the door wouldn’t reliably secure. Additionally, the school district had a known culture of complacency with regard to door security - exterior and interior doors were frequently left unlocked. Although door audits were conducted, they were not done systematically or documented. On the day of the shooting, ALL the exterior doors and at least eight interior doors of the West Building, where the incident took place, were unlocked. It was likely that the door to Room 111 was not locked, allowing the attacker to walk right in.

The school safety teams met infrequently, and annual safety plans were based largely on templated information that at times was inaccurate. The UCISD PD existed for four years and during this entire time it functioned without any standard operating procedures. Many school employees, including administrators and police officers, advised that they didn’t have any knowledge about the school police department’s policies and procedures.

Lockdown alerts at the school were also flawed. The Raptor alert system used by the school relied on Wi-Fi, which was inconsistent across campus. Many staff didn’t receive the alert or misinterpreted it as a less urgent "bailout" situation as the same sound for both was used. The school principal struggled to send the lockdown alert and did not use the intercom system to communicate with classrooms.

In short, both physical and digital security systems failed. These issues were documented, known, and unaddressed.

5. Clear Communication Is Imperative

Law enforcement communication on the scene was fragmented. Chief Arredondo reportedly had discarded both radios upon arriving at the school and communicated via cell phone or verbally. Responders struggled to identify who was in charge, and personnel did not receive accurate updates or direction.

There was no designated public information officer, and as a result, families received confusing and contradictory information. Parents who arrived at the school desperate for information were met with conflicting alerts. These miscommunications added unnecessary trauma to an already horrific situation.

An incident commander and command post for information sharing - both internally and with the public - is essential in a crisis.

6. Coordination Contributes to the Outcome

Response coordination was lacking. There was no clear plan for response support from multiple agencies, and no one established authority or took ownership during the incident. This resulted in challenges related to information sharing, lack of situational statuses, and limited-to-no direction for responders who were in the hallway or along the perimeter. There was no real continuity of effort.

Moving Forward: Building Resilience Through Reform

The tragedy in Uvalde underscores that our safety systems are only as strong as our response management, training, and security measures. If we are to honor the lives lost, we must commit to better training, stronger management policies and practices, and the right tools - such as NIMS, ICS, unified command, lockdown protocols, door security policies. But these mean nothing without proper implementation, oversight, and continuous assessment and improvement.

Let’s not remember Uvalde for what went wrong, but for the hard lessons it taught and the lives it took.