One year after Dorner: 3 levels of command in a large-scale critical incident

Major incidents can occur in a jurisdiction of any size, including small venues with limited response assets


Law enforcement has been described as 99 percent routine and one percent panic. We rarely respond to incidents involving so many agencies and so large an area as the Chris Dorner killing spree, which began one year ago today. Several agencies will reflect on that event a year later and as a profession we should always analyze major incidents with an eye toward improving our next response. 

One traditional shortcoming is the organization and leadership evident in our response to major incidents. This article will not discuss any details of the Chris Dorner incident, so do not take this piece as a criticism of any agency’s response. 

Instead, the dot points below are a compilation of the analysis of numerous critical incidents across the country.

Three Levels of Command
During the “Crisis Phase” of a critical incident (the first 60 minutes, more or less), decision making must be pushed down to the lowest possible level. The controlling factor is time. The on-scene tactical leader doesn’t have time to hold a meeting or wait for multiple levels of approval before choosing a course of action. Senior commanders must delegate to their tactical leaders the authority to make decisions based on available information (aka: trust).

Major incidents are managed at three levels: Tactical Command (on-scene), Forward Command (Command Post, CP) and Strategic Management (Emergency Operations Center, EOC). Tactical Command is the first to arrive and must operate independent from higher level management until the scene is stabilized. Incidents involving federal agencies may have more layers. The more layers of management an incident has, the more likely we will see degraded communications and debilitating micro-management (analysis paralysis).

• The Tactical Command level is a “leadership” environment and tactical decision making must occur at this level. Tactical Command should be established upon the arrival of the first officer who is not pinned down in the situation. 

Planning timeframe: “What do we need to do right now?”

• The Forward Command level is a “management” environment which should focus on the coordination of all on-scene response assets. The Command Post should be sited outside the Hot/Kill Zone (ICS/NIMS specifies the term “Hot Zone” for the incident scene. We prefer the use of “Kill Zone” for a human threat and “Hot Zone” for a non-human threat such as fire, HazMat, flood).

The Incident Commander (IC) will establish Unified Command with decision makers from all response agencies (including Fire, EMS, Public Works, etc.). Forward Command should be established as soon as possible and independent of the tactical response. The Incident Command System (ICS/NIMS) should be established at this level. 

Planning timeframe: “What do we need to be doing 30 minutes from now?”

• The Strategic Management level is primarily an oversight environment to determine the overarching incident response strategy and ensure all necessary assets are staged or deployed as needed. A fully staffed ICS organization must be utilized at this level. In the case of multiple tactical scenes, this management level will allocate resources and determine priorities. 

An EOC should be stood up whenever a critical incident will exceed a single operational period (shift). 

Planning timeframe: “What do we need to be doing X hours or X days from now?”

Major incidents can occur in a jurisdiction of any size, including small venues with limited response assets. For that reason, every department should pre-plan for a major incident and develop mutual aid agreements with all agencies that can assist. 

We used to joke in small agencies that if we ever had “the big one” we would key up a radio and simply say, “Y’all come!” 

The reality is, you must pre-plan for any eventuality for when you do have “the big one” and issue that “y’all come!” request. 

They will come. The question becomes, how will you manage the response when they arrive?

Next month’s column will cover tactics for combining Fire/EMS/Police assets to conduct downrange EMS Operations.

About the author

Dick Fairburn has more than 30 years of law enforcement experience in both Illinois and Wyoming, working patrol, investigations and administrative assignments. Dick has also served as a Criminal Intelligence Analyst and as the Section Chief of a major academy's Firearms Training Unit and Critical Incident training program. He has a B.S. in Law Enforcement Administration from Western Illinois University and was the Valedictorian of his recruit class at the Illinois State Police Academy. He has published more than 100 feature articles and two books: Police Rifles and Building a Better Gunfighter.

Contact Richard Fairburn

  1. Tags
  2. Active Shooter
  3. Active Shooter Response

Recommended Christopher Dorner

Join the discussion