Document text
UVU Independent External Review — After-Action Report on the Sept 10, 2025 TPUSA Event (158 pp.) (Part 1 of 2)
Primary document, NOT a court record: commissioned and published by Utah Valley University, the host institution; conducted by Robert L. Davis LLC, Doherty Advisory LLC, The Lake Forest Group and Brownstein Hyatt Farber Schreck LLP. Ten key findings on event planning, security and emergency response, addressing both UVU and Turning Point USA. Released Sept 25, 2026 (PDF dated Sept 24, 2026; SHA-256 d237c79ce10400c90b3f2c827ad197aec3ff4d5824e3ac87856b608d56db8f93). Text extracted from the published PDF (https://www.uvu.edu/externalreview/docs/after-action-report.pdf).
After-Action Report for Utah Valley University
1
TABLE OF CONTENTS
Introduction ....................................................................................................... 4
Objectives of this Assessment ................................ ................................ ................................ ...... 4
Context Regarding the Nature of the Incident ................................ ................................ ............... 5
The Project Team ................................ ................................ ................................ ......................... 5
Cooperation and Access to Information ................................ ................................ ........................ 6
Actions Taken During the Assessment ................................ ................................ .......................... 7
Documents and Evidence Reviewed ................................ ................................ ............................. 8
Professional Standards and Guidance Sources ................................ ................................ .............. 8
Executive Summary: Key Findings ..................................................................... 10
Timeline ........................................................................................................... 17
Pre-Event Planning and Preparation (July 10-September 9) ................................ ......................... 17
Incident Day Timeline (September 10) ................................ ................................ ........................ 19
Post-Incident Response and Recovery ................................ ................................ ........................ 22
After-Action Report .......................................................................................... 25
1. Governance, Policies, and Preparedness Framework ................................ ............................... 25
1.1 Overview of Policies, Protocols, Plans, and Evidence Reviewed .............................................. 25
1.2 Policy 425 and Major Event Review Framework ...................................................................... 25
1.3 UVUPD Policy Manual and Departmental Procedures ............................................................. 26
1.4 Emergency Operations Plan, EOC Framework, and Active Assailant Protocols ....................... 27
1.5 ICS, NIMS, and Event Action Planning ...................................................................................... 28
1.6 Training, Exercises, and After-Action Learning ......................................................................... 29
1.7 Mutual Aid and External Support Framework .......................................................................... 31
1.8 Crisis Communications and Media Response Planning ............................................................ 32
1.9 Organizational Alignment, Staffing, and Professional Standards ............................................. 34
2. September 10 TPUSA Event Planning, Response, and Interagency Coordination ....................... 37
2.1 Prevention and Preparedness Practices for High-Profile Events ............................................. 37
2.2 Major Event Classification and MEAC Review .......................................................................... 38
2.3 Venue, Ticketing, and MEAC Planning Decisions ..................................................................... 39
2.4 Pre-Event Security Coordination and Intelligence.................................................................... 41
2.5 Day-of Security Posture and Operational Adjustments ........................................................... 44
2.6 Initial Interagency Response and Campus Searches ................................................................ 48
After-Action Report for Utah Valley University
2
2.7 Transition to State and Federal Investigative Command ......................................................... 49
2.8 Fire, EMS, and Emergency Management Interagency Support ............................................... 51
2.9 Key Interagency Lessons ........................................................................................................... 52
2.10 Assessment and Preparedness Gaps ...................................................................................... 52
3. Event Security Planning and Operations ................................ ................................ .................. 54
3.1 Event Security Planning and Security Assessment ................................................................... 54
3.2 Event Security Operations ........................................................................................................ 57
3.3 Access Control, Screening, and Credentialing .......................................................................... 58
3.4 Protective Operations and Line-of-Sight Planning for Outdoor Events ................................... 62
3.5 Traffic, Parking, and Perimeter Management .......................................................................... 64
3.6 Fixed and Temporary Site Security Measures .......................................................................... 66
4. Incident Command, Emergency Management, and Emergency Response Implementation ....... 68
4.1 Application of ICS and Event Action Planning .......................................................................... 68
4.2 Implementation of the Emergency Operations Plan and Active Assailant Protocols .............. 70
4.3 EOC Activation, Situational Awareness, and Decision Support ................................................ 72
4.4 Interagency Coordination and Mutual Aid Implementation .................................................... 74
5. Communications, Security Technology, and Protective Intelligence ................................ ......... 77
5.1 Communications and Mass Notification .................................................................................. 77
5.2 Physical Security Technology .................................................................................................... 82
5.3 OSINT, Web, and Social Media Monitoring .............................................................................. 86
5.4 Information Sharing and Protective Intelligence...................................................................... 89
6. Behavioral Threat Assessment and Threat Management ................................ ......................... 92
6.1 Team Structure, Governance, and Case Management ............................................................ 92
6.2 Information Sharing, OSINT, and Protective Intelligence ......................................................... 95
6.3 Integration with Security Planning and Protective Measures .................................................. 97
6.4 Training, Professional Development, and Continuous Improvement ...................................... 97
6.5 Intervention Resources and Related Policies ........................................................................... 98
7. Post-Incident Recovery, Corrective Actions, and Preparedness Enhancements ....................... 101
7.1 Post-Incident Recovery and Community Support .................................................................. 101
7.2 Support for UVUPD Personnel and First Responders ............................................................. 102
7.3 Awareness, Training, and Preparedness Improvements ........................................................ 102
7.4 Crisis Communications Planning and Public Trust .................................................................. 103
7.5 Interagency Security and Preparedness Enhancements ........................................................ 104
7.6 Post-Incident Actions Taken or Initiated ................................................................................ 107
7.7 Overall Assessment ................................................................................................................. 111
After-Action Report for Utah Valley University
3
8. Legal Considerations ................................ ................................ ................................ ............ 112
8.1 Legal and Regulatory Framework ........................................................................................... 112
8.2 Event Classification, External Use, and Fronting .................................................................... 112
8.3 First Amendment Considerations ........................................................................................... 113
8.4 Firearms and Security Screening Considerations ................................................................... 114
8.5 Clery Act and Emergency Notification Considerations ........................................................... 115
8.6 Legal Review of Findings and Recommendations .................................................................. 116
9. Recommendations ................................ ................................ ................................ ............... 117
Appendices .................................................................................................... 129
Appendix A: Project Team Bios ................................ ................................ ................................ . 129
Core Law Enforcement and Security Risk Management Team .................................................... 129
Core Brownstein Team ................................................................................................................. 130
Advisory Board .............................................................................................................................. 131
Communications Lead .................................................................................................................. 132
Appendix B: Incident Command System (ICS) Roles and Responsibilities ................................ ... 133
Appendix C: OSINT and Protective Intelligence Technical Considerations ................................ ... 135
Appendix D: Event Security Planning and Protective Measures Reference Guide ....................... 140
D.1: Event Security Planning Framework for High-Profile Events ................................................ 140
D.2: Event Screening Operations Planning Considerations .......................................................... 141
D.3: Access Control, Ticketing, and Credentialing Considerations ............................................... 142
D.4: Common Event Security Posts and Functions ....................................................................... 144
D.5 Protective Operations Considerations for Outdoor Events ................................................... 146
D.6: Traffic, Parking, and Perimeter Security Considerations ...................................................... 147
D.7: Fixed and Temporary Site Security Measures ....................................................................... 150
D.8: Announcements and Scripted Response Protocol Messages ............................................... 151
D.9: Physical Security Technology Technical Considerations ....................................................... 153
D.10: Post-Event Review Considerations ..................................................................................... 156
After-Action Report for Utah Valley University
4
Introduction
Objectives of this Assessment
This external and independent assessment was done at the request of Utah Valley University (UVU).
The purpose of the assessment is to establish a clear, factual, and evidence-based understanding of
the events leading up to, during, and immediately following the fatal shooting of Charlie Kirk at UVU on
September 10, 2025. The assessment was designed to evaluate the University's1 planning, preparedness,
decision-making, operational response, interagency coordination, and post-incident actions related to
the event. By its very nature, an after-action report has the benefit of hindsight. This is important to
acknowledge when assessing actions or omissions that took place prior to an unexpected tragedy.
The objective of this review is not to examine political viewpoints or speculate regarding motivations.
Rather, it is to provide an independent assessment of the incident, identify lessons learned, and offer
practical recommendations to strengthen security, preparedness, response capabilities, and
organizational resilience for future events.
This independent assessment was conducted following the tragic death of Charlie Kirk
during a September 10, 2025 event at Utah Valley University. We recognize the
profound impact this incident has had on Mr. Kirk's family, friends, colleagues,
supporters, event attendees, first responders, and the broader community.
Consistent with the objectives outlined in the UVU Request For Proposal 2026-1172 and the Project
Team’s proposed methodology, the assessment sought to:
▪ Establish a validated timeline of events and key decision points.
▪ Analyze circumstances and operational considerations associated with the incident.
▪ Evaluate security, emergency management, and response protocols, including coordination among
University personnel and external public safety partners.
▪ Assess communications, command structure, staffing, deployment, and resource allocation
associated with the event and response efforts.
▪ Identify strengths, effective practices, and actions that contributed positively to the incident
response.
▪ Identify vulnerabilities, gaps, and areas for improvement to enhance future preparedness and
operational readiness.
▪ Develop practical, prioritized, and actionable recommendations aligned with recognized practices
in higher education safety, emergency management, event security, executive protection, and
behavioral threat assessment.
▪ Support UVU’s ongoing commitment to exceptional care, exceptional accountability, and
exceptional results through a transparent and independent review process.
1 We use both University and UVU to refer to Utah Valley University.
After-Action Report for Utah Valley University
5
▪ Review and analyze legal issues related to both the event and the incident: these include University
policies (ranging from event planning, safety and security, and emergency response), risk, reporting,
Clery Act compliance, campus police protocols and resources, and First and Second Amendment
challenges unique to a public university.
Context Regarding the Nature of the Incident
The Project Team that performed this assessment views it as unique in one significant respect. Most of
the high-profile shooting incidents that have occurred on college campuses over the last several decades
have been perpetrated by “insiders” – students, former students, staff or former staff, often motivated
by perceived grievances. Research shows there are aspects of such incidents that seem to recur and can
be informative in examining how educational institutions can best assess possible threats on their
campuses. As a consequence, over the last two decades, primarily in the aftermath of the Virginia Tech
shootings in 2007, American colleges and universities, including UVU, have developed comprehensive
policies and protocols to assist in identifying on-campus behavioral threats. A Behavioral Threat
Assessment and Management (BTAM) Team exists at virtually every public college and university in the
country, including UVU.
However, this current assessment and after-action report involves violence alleged to have been
perpetrated by someone unaffiliated with UVU and presents issues outside the internal threat
assessment framework of the University. Campus firearm violence perpetrated by “outsiders” is much
less frequent than by insiders and a political assassination on a college campus is exceptionally rare. This
distinction is important because threats originating outside the campus community are inherently more
difficult for universities to identify and assess through internal reporting, behavioral threat assessment,
and intervention processes. External threats may not involve prior contact with the institution, may not
appear in campus records, and may not generate observable warning behaviors known to University
personnel before an incident occurs.
The Project Team
The Lake Forest Group (LFG) assembled a highly qualified core team to support Utah Valley University
(UVU) in this important review of the September 10, 2025 TPUSA event held at UVU. This core team
brought expertise in law enforcement operations, physical and site security assessment, emergency
preparedness, and behavioral threat assessment and management. In addition, six subject matter
experts conducted a focused review and provided insight in specialized areas relevant to the
assessment, including campus safety, security technology, open-source intelligence, counter-sniper
tactics, behavioral threat assessment, and crisis communications.
Brownstein Hyatt Farber Schreck, LLP (Brownstein) led the review and analysis of legal issues related to
the event, the incident, and the broader legal and policy framework applicable to public institutions of
higher education. The attorneys from Brownstein have extensive experience and expertise in conducting
external investigations of the nature requested by UVU. That experience includes assessments of
several campus-related shooting incidents.
After-Action Report for Utah Valley University
6
Together, these professionals formed the Project Team responsible for preparing this After-Action
Report for UVU. The Project Team’s work was further supported by a communications and report-
development team that helped organize, synthesize, edit, and present the assessment findings in a
clear, integrated, and professionally documented report. Biographies for the Project Team can be
found in Appendix A.
Cooperation and Access to Information
The Project Team appreciates the cooperation and assistance UVU provided throughout this
independent review. University personnel facilitated timely access to relevant documents, video
recordings, policies, procedures, and other materials necessary to conduct the assessment. UVU
representatives responded to requests for information, answered questions posed by the Project Team,
and coordinated interviews with employees and other individuals possessing relevant knowledge of the
events under review.
The Project Team also interviewed numerous local, county, state, and federal government officials.
We appreciate their cooperation, insights, and detailed information regarding the days surrounding the
September 10 TPUSA event.
This cooperation enabled the Project Team to conduct a thorough, fact-based evaluation of the incident
and the University’s planning, preparedness, response, and recovery efforts. Although UVU fully
cooperated with the assessment process, the findings, observations, and recommendations contained
in this report are solely independent and those of the Project Team.
The Project Team also sought information from non-UVU individuals and organizations with relevant
knowledge of the September 10 TPUSA event, separate from the local, county, state, and federal
government officials interviewed as part of this review. The purpose of this outreach was to better
understand the actions taken before, during, and after the TPUSA event at UVU, and to obtain any
additional information, insights, or perspectives that may have differed from, or supplemented,
information provided through UVU and government sources.
Despite repeated outreach attempts, the Project Team did not receive responses from the following
individuals or other representatives of their organizations. This information is included solely to
document outreach efforts and to provide transparency regarding the scope of information available
to the Project Team.
▪ The Project Team reached out to Brian Harpole, who was identified as the leader of the Integrity
Solutions security team working with TPUSA to provide executive protection for TPUSA CEO Charlie
Kirk. The Project Team attempted to reach Harpole by telephone and certified letter. The certified
letter explained the purpose of the outreach and provided the Project Team’s contact information.
The Project Team did not receive a response.
▪ The Project Team also reached out to Dan Flood, TPUSA Security Supervisor, and Maycee Crofts, a
TPUSA Senior Field Representative. Flood was identified as the person who coordinated security for
the organization with Brian Harpole of Integrity Solutions. Flood was present at UVU on September
10 and had phone and text communications with UVU Police Chief Jeff Long a few days before and
the morning of the event. Crofts was identified as a Senior Field Representative of TPUSA and
After-Action Report for Utah Valley University
7
participated online in the Major Events Assessment Committee (MEAC) planning meeting held on
August 25 regarding the September 10 TPUSA event. Neither Flood nor Crofts responded to phone
calls or voicemail messages. In Flood’s case, the Project Team also sent a certified letter. The Project
Team did not have a current address for Crofts.
▪ The Project Team further contacted senior-level staff members at TPUSA in Phoenix seeking
assistance in connecting with Dan Flood and Maycee Crofts. The Project Team did not receive a
response to those email and telephone outreach efforts.
▪ The Project Team also reached out to the then-head of the UVU TPUSA Club, who invited Charlie
Kirk to speak at UVU. The Project Team sought his insights and perspectives regarding planning for
the September 10 TPUSA event. He did not respond to the Project Team’s various outreach efforts,
which included a certified letter seeking his cooperation.
▪ A Utah risk management official had communications with an executive of TPUSA and urged that
the above-named individuals who were associated with TPUSA on September 10, 2025 cooperate
with this assessment by being interviewed by the Project Team. There was no response.
Actions Taken During the Assessment
To complete this assessment, the Project Team conducted a comprehensive review process that
included the following activities:
▪ Conducted a formal project kickoff meeting and coordinated ongoing communication with
University leadership and designated stakeholders.
▪ Developed a structured assessment methodology, interview strategy, and document request
process.
▪ Conducted over 70 interviews with University leadership, faculty, staff, students, UVU Police
Department personnel, and external public safety partners with knowledge of the event and
related operations.
▪ Reviewed thousands of pages of policies, procedures, plans, training and training records,
operational records, and other relevant documentation associated with the incident and related
preparedness efforts.
▪ Examined digital and technical evidence, including video footage, Dispatch and communications
records, electronic communications, and related investigative materials.
▪ Evaluated event planning, security operations, emergency response actions, interagency
coordination, and decision-making processes associated with the September 10, 2025 event.
▪ Assessed relevant UVU practices against applicable policies, operational expectations, and
recognized emergency management and higher education safety frameworks, including National
Incident Management System (NIMS) and Incident Command System (ICS) principles.
▪ Developed and validated a detailed timeline of significant events, operational actions, and
critical decisions.
▪ Analyzed legal issues related to UVU policies, risk, reporting, Clery Act compliance, campus police
protocols and resources, campus speakers, possession of weapons on campus, and First and Second
Amendment challenges unique to a public university.
After-Action Report for Utah Valley University
8
▪ Identified operational strengths, contributing factors, gaps, and opportunities for improvement.
▪ Developed findings and recommendations intended to enhance future preparedness, coordination,
safety, and emergency response capabilities.
▪ Provided regular verbal project progress updates to University representatives throughout the
assessment process.
▪ Prepared a comprehensive After-Action Report and supporting materials for University leadership
and public release.
Documents and Evidence Reviewed
The Project Team reviewed a broad range of documents, records, communications, and digital evidence
relevant to the planning, response, investigation, and follow-up associated with the September 10, 2025
event. These materials included University and Utah Valley University Police Department (UVUPD)
written policies and procedures, emergency management and crisis communications plans, event
planning and scheduling records, security planning materials, behavioral threat assessment and
management protocols, training materials and records, mutual aid and dispatch-related records,
incident reports, interview summaries, communications logs, emails, social media monitoring materials,
and available video, audio, and digital evidence. Document review occurred throughout the assessment
as additional materials were identified, requested, and provided. The information was considered
alongside interviews, timelines, and other evidence reviewed by the Project Team.
Professional Standards and Guidance Sources
The observations, findings, and recommendations contained in this report were informed by research,
standards, and guidance developed by leading public- and private-sector organizations specializing in
law enforcement operations, campus safety, behavioral threat assessment, targeted violence
prevention, protective intelligence, emergency management, workplace violence prevention, executive
protection, and security operations. Key sources consulted include:
Law Enforcement Operations
▪ International Association of Chiefs of Police (IACP)2
▪ International Association of Chiefs of Police, University/College Police Section3
▪ Major Cities Chiefs of Police Association (MCCA)4
▪ Police Executive Research Forum (PERF)5
▪ United States Department of Justice, Civil Rights Division, Office of Community Oriented Policing
Services (COPS Office)6
2 https://www.theiacp.org/about-iacp
3 https://www.theiacp.org/working-group/section/universitycollege-police-section
4 https://majorcitieschiefs.com/
5 https://www.policeforum.org
6 https://cops.usdoj.gov/
After-Action Report for Utah Valley University
10
Executive Summary: Key Findings
The Project Team again acknowledges that an after-action review is necessarily conducted with the
benefit of hindsight and without the uncertainty, urgency, and confusion that often exist when
responding to a crisis. Nevertheless, such a review can be of considerable benefit to an organization
committed to learning from past events and preparing to meet the challenges of the future.
The Team also believes it is important, in considering the findings and recommendations in this report, to
recognize that on September 10, 2025, UVU was operating within a state legal framework, as detailed in
Section 8, that limited some of the security options available to the University.
The Team also recognizes that the September 10 incident was unusual in that the alleged perpetrator
was unaffiliated with UVU, placing the event largely outside the University’s traditional behavioral threat
assessment framework. Threats originating outside the campus community are inherently more difficult
for universities to identify and assess because they may involve no prior institutional contact, campus
records, or observable warning behaviors known to University personnel.
This Executive Summary: Key Findings section is intended to provide a high-level overview of the
principal conclusions that emerged from the Project Team’s review. These findings reflect themes and
issues that are examined in greater detail throughout the report and form the basis for many of the
recommendations that follow. Accordingly, this section may be read as an executive summary of the
report, while the subsequent sections provide the underlying facts, analysis, context, and supporting
detail.
It is the opinion of the Project Team, based on our review of all available
information, that at no time during the events leading up to the assassination of
Charlie Kirk, or in its aftermath, did any employee or agent of UVU act in bad faith
or in willful and wanton disregard for the safety of others.
With the benefit of hindsight, however, the Project Team identified several actions,
omissions, circumstances, and institutional practices that warrant attention as UVU
considers how to strengthen the safety and security of campus events in the future.
The high-level findings that follow capture those principal areas for improvement. They recur throughout
the report’s more detailed analysis and, together with the recommendations in the final section, are
intended to assist UVU in strengthening its planning, preparedness, coordination, communication, and
security practices for future campus events.
After-Action Report for Utah Valley University
11
UVU has established a substantial foundation of policies, plans, committees, reporting pathways,
emergency procedures, and public safety resources relevant to major event planning, emergency
response, threat assessment, and campus safety. These include Policy 425, the Major Events
Assessment Committee (MEAC) process, the Emergency Operations Plan (EOP), emergency
communications protocols, the Behavior Assessment Team (BAT), UVUPD Dispatch, UVUPD
procedures, and multiple physical security and notification technologies.
However, the September 10 TPUSA event demonstrated that established frameworks were not always
implemented in a consistent, documented, or operationally integrated manner. UVU was not operating
without relevant policies, capable personnel, physical security technologies, or an established order of
authority. Rather, the primary gap involved the translation of existing policies, structures, and
capabilities into disciplined, repeatable, and documented practice for a controversial speaker and high-
profile event involving elevated security considerations. This distinction is important.
For example, the MEAC process was initiated on August 21 to determine whether the event should
proceed and to identify security concerns. However, several key event-security decisions were deferred
to the TPUSA field representative even though UVU staff members raised concerns, including concerns
related to holding the event in the outdoor Fountain Courtyard area and using TPUSA’s ticketing
process. TPUSA preferred to hold the event in the Fountain Courtyard and use its own ticketing system
rather than the University’s system. Those decisions placed the event in an area that was more difficult
to control and limited UVU’s ability to obtain reliable, real-time information regarding anticipated
attendance and crowd size. Because the event was held on UVU’s campus, UVU should have retained
decision-making authority over key security-related issues, including venue selection, ticketing, access
control, and other conditions necessary to support campus safety.
After the shooting occurred and the Emergency Operations Center (EOC) was opened, UVU also
experienced challenges implementing written plans and procedures for EOC operations and emergency
communications. The review identified confusion regarding who was responsible for managing the
EOC at various points, who had authority to issue prompt emergency alerts through UVU’s notification
systems, and what terminology should be used to communicate protective actions to the campus
community. This created confusion for some personnel working within the EOC and for individuals on
campus awaiting direction from authorities.
These issues do not reflect the absence of planning or commitment by UVU personnel. Rather, they
demonstrate the need to strengthen implementation, documentation, role clarity, and operational
integration so established policies and plans function effectively during major events and critical
incidents. These and related implementation gaps are addressed in greater detail throughout the report.
KEY FINDING 1: UVU Has a Strong Foundation of Policies and Procedures, but Implementation
Was Significantly Inconsistent Before and During the September 10 TPUSA Event
After-Action Report for Utah Valley University
12
The September 10 TPUSA event presented several characteristics that warranted a more formal event
security planning process, including a high-profile speaker, anticipated protest activity, an open
outdoor venue, uncertainty regarding attendance, external entity involvement, a private security
team, elevated vantage points, and significant public attention.
Although some coordination occurred among University stakeholders, UVUPD, UVU Event Services,
and TPUSA representatives, the club event was not supported by a comprehensive written Security
Assessment or Event Action Plan which would have identified staffing assignments, command
relationships, post responsibilities, Incident Command System (ICS) roles, communications procedures,
access-control decisions, protective operations coordination, emergency response procedures,
contingency plans, or mutual aid resources specific to the event.
Policy 425 and the MEAC process provide an important foundation for evaluating major events, but
future high-profile events would benefit from a more structured framework that connects event
classification, site selection, ticketing, attendance forecasting, access control, screening considerations,
protective operations, communications, emergency response, and interagency coordination. A more
comprehensive event security framework would help ensure that safety and operational considerations
are documented and elevated before key event decisions are finalized.
The outdoor location insisted upon by TPUSA for their event created significant protective operations
considerations. The speaking area was located in an open-access campus environment surrounded by
buildings, elevated areas, pedestrian routes, and multiple vantage points. These conditions made line-
of-sight assessment, elevated-position review, building access control, arrival and departure planning,
crowd control, protest management, and fixed-post assignments especially important.
UVU personnel recognized and responded to some of these concerns, including the Hall of Flags outdoor
pedestrian walkway above the speaking location. However, the planning process did not include a
documented line-of-sight assessment, protective operations considerations, pre-event briefing,
structured walk-through with all key security stakeholders, or clear coordination process with the
speaker’s private security team and external law enforcement partners.
A site-specific coordination meeting involving UVUPD and the TPUSA protection detail should have
occurred several days before the event to assess vulnerabilities, clarify responsibilities, and determine
whether available personnel and resources were sufficient to support the security plan. If UVUPD or the
TPUSA protection detail lacked sufficient staffing or specialized equipment to address identified
vulnerabilities, additional law enforcement support, equipment, or technical resources, such as drone or
aerial observation capability, should have been considered or requested when legally permissible and
operationally appropriate.
KEY FINDING 2: High-Profile Event Planning Requires a More Formal and Integrated Event
Security Framework
KEY FINDING 3: Protective Operations and Line-of-Sight Planning Were Not Sufficiently
Formalized for the Outdoor Venue
After-Action Report for Utah Valley University
13
A face-to-face pre-event briefing and walk-through with UVUPD Chief Long and the TPUSA protection
detail leadership and TPUSA Security Supervisor Flood should also have occurred on campus in the hours
before the event began. Such a meeting would have provided another opportunity to review roles,
confirm post assignments, address concerns, identify changes in conditions, and ensure that both
groups had a shared understanding of the security posture. Chief Long texted Dan Flood to meet on
the Hall of Flags outdoor pedestrian walkway at 11, however this face-to-face meeting did not occur.
This finding does not suggest that every outdoor event must be moved indoors or treated as a high-risk
security operation. It does mean that when an outdoor event involves a high-profile speaker, anticipated
protest activity, private security, elevated vantage points, or significant public attention, UVU should
have a documented process for evaluating whether the venue can be adequately controlled and what
mitigation measures are required, including whether the event should be moved to a more secure or
controllable location.
The September 10 response placed immediate pressure on UVU’s Incident Command Post, EOC,
UVUPD Dispatch, emergency communications, decision-making, and notification systems. UVU
personnel responded quickly and made substantial efforts under extremely difficult conditions.
However, the response also exposed challenges involving role clarity, EOC leadership, succession and
delegation of authority, law enforcement representation in the EOC, message approval, emergency
terminology, and situational awareness.
Several of these issues were not entirely new. A prior active assailant tabletop exercise had identified
communication and situational awareness challenges involving the EOC and Policy Group and
recommended additional exercises. Similar issues resurfaced during the September 10 response,
suggesting that prior lessons had not been fully implemented, validated, or institutionalized.
Emergency communications were among the most visible challenges. No immediate campus alert was
activated by the UVU Police Chief as Incident Commander. Subsequent campus alerts were inconsistent
and contradictory. Delays, changing guidance, suspect-status information, and confusion with the term
“secure-in-place” affected campus understanding during a fast-moving incident. UVU’s emergency
notification systems are important assets, but their effectiveness depends on clear authority, plain-
language terminology, accurate contact data, tested templates, scripted response protocols, and regular
exercises under realistic conditions.
UVU has several valuable physical security and communications technologies, including video
surveillance, access control, Rave, Alertus, public address capabilities, remote lockdown capabilities,
radio communications, license plate readers, and related systems monitored or supported through
UVUPD Dispatch. These tools provide an important foundation for campus safety and incident
response.
KEY FINDING 4: Incident Command, Emergency Operations Center (EOC) Operations, and
Emergency Communications Need Greater Standardization and Exercise-Based Validation
KEY FINDING 5: Security Technology and Situational Awareness Capabilities Should Be More
Effectively Integrated Into Real-Time Operations
After-Action Report for Utah Valley University
14
The September 10 TPUSA event demonstrated, however, that existing technology was used more
effectively as a post-incident investigative resource than as a real-time situational awareness tool.
Security camera footage was valuable after the shooting, but no individual had been specifically
assigned to monitor relevant camera feeds in real time for event security purposes. Similarly, the
broader physical security technology environment would benefit from more integrated workflows
that connect alarms, video, access control, mapping, notification, and Dispatch response.
For major events and critical incidents, technology should support a common operating picture for
Dispatch, command staff, field personnel, the EOC, and public safety partners. UVU’s future planning
should include video analytics configured to detect human activity on rooftops or in restricted areas,
clarify who monitors relevant systems, which camera views and alerts are prioritized, how information
is shared, and how physical security technology is incorporated into Event Action Plans, security plans,
and emergency response procedures.
UVU has several useful intelligence and monitoring resources, including Campus Sonar, Sprout Social,
Meltwater, law enforcement databases, and access to the Utah Statewide Information and Analysis
Center (SIAC). These resources provide valuable visibility into media coverage, public sentiment, social
media activity, criminal justice information, and threat-related intelligence.
However, these resources are primarily designed for social listening, media monitoring, communications
awareness, and law enforcement information sharing. They are not a substitute for a dedicated subject-
focused protective intelligence capability. When a specific individual, group, communication, or
behavior of concern requires deeper review, UVU needs a formalized process, dedicated capability, or
specialized platform for conducting comprehensive open-source investigations or access to an external
partner.
This capability gap affects both event security planning and behavioral threat assessment. Subject-
focused OSINT and protective intelligence can help identify warning behaviors, grievances, fixation,
leakage, stalking, escalation, target focus, prior violence, affiliations, and other information relevant
to prevention and intervention. UVU would benefit from documented procedures, trained personnel,
authorized investigative accounts, legal and privacy guardrails, and defined workflows for collecting,
documenting, analyzing, retaining, and disseminating relevant intelligence.
External public safety partners responded quickly and professionally after the September 10 shooting.
Orem Police Department, Orem Fire Department, Utah Department of Public Safety (DPS), Utah
Highway Patrol, Utah County Sheriff’s Office, the FBI, and other local agencies provided essential
support during a complex and fast-moving incident. Interviews reflected strong working relationships
between UVUPD and Orem Police Department, and those relationships were important during the
response.
KEY FINDING 6: Protective Intelligence, Open Source Intelligence (OSINT), and Subject-
Focused Investigative Capabilities Are Not Yet Fully Developed
KEY FINDING 7: Interagency Coordination Was a Response Strength, but Mutual Aid and
Statewide Campus Safety Coordination Should Be Formalized
After-Action Report for Utah Valley University
15
However, the event also demonstrated the need to formalize mutual aid, resource-request thresholds,
specialized capability planning, and interagency integration before major events and critical incidents
occur. UVU had access to potential outside resources, including additional sworn personnel, fire and
EMS support, emergency management assistance, investigative resources, tactical assets, traffic-control
support, and drone capability, but those resources were not fully integrated into pre-event planning.
Post-incident efforts to strengthen interagency coordination are promising. These include steps toward
a written mutual aid agreement with Orem Police Department, proposed joint active assailant exercises,
Orem Emergency Management’s willingness to support UVU planning and preparedness, and emerging
statewide efforts to improve coordination among Utah public institutions of higher education. These
efforts should be formalized, exercised, and sustained.
UVU is a large and growing public university with a complex risk environment that includes major
events, public speakers, protests, open campus spaces, commuter populations, student activities,
athletics, and broad community access. These conditions require public safety functions that are
appropriately positioned, staffed, trained, and integrated into University leadership and planning.
The review identified concerns regarding UVUPD staffing levels, training structure, organizational
placement, and visibility within the University’s leadership framework. The Police Chief is not positioned
within the organization in a manner typical for a public safety leader at a large institution of higher
education, and UVUPD staffing appears limited when compared to the scale and complexity of the
University’s operations and event environment. UVU should consider a senior campus safety leadership
role, such as a Vice President or Associate Vice President for Campus Safety and Security, with
responsibility for all public safety operations, including emergency management. This individual would
report either directly to the President or a senior executive leader who reports directly to the President.
UVUPD personnel complete required training hours, but the department would benefit from a formal
training needs assessment and written annual training plan aligned to the University’s actual risk profile.
Particular training attention should be given to the Incident Command System (ICS), event security,
active assailant response, protective operations, emergency management coordination, mutual aid,
crowd management, and campus-specific public safety practices. UVU should also evaluate professional
standards opportunities, including IACLEA accreditation, as part of a broader commitment to public
safety maturity and continuous improvement. UVU would also benefit from a formal staffing and pay
analysis to help determine the proper staffing levels for its police department, as well as to identify the
proper pay scales that would allow it to be competitive in its law enforcement recruitment and
retention efforts.
KEY FINDING 8: Organizational Alignment, Staffing, and Training Should Be Evaluated
Against UVU’s Size and Risk Environment
After-Action Report for Utah Valley University
16
Following September 10, UVU and its partners took meaningful steps to support students, improve
campus safety awareness, strengthen crisis communications planning, update emergency
preparedness materials, improve training, and advance interagency coordination. These efforts
reflect a serious commitment to organizational learning and campus recovery.
Student and community support efforts were particularly important. UVU Mental Health Services,
community providers, and the FBI Victim Assistance Program provided or supported post-incident
services. UVU also advanced awareness and preparedness efforts, including classroom posters, updated
flipcharts, website and app improvements, employee training, campus safety outreach, and crisis
communications planning. At the same time, post-incident support for responding police personnel and
other first responders appeared less structured and less visible than support provided to students and
the broader campus community. UVU is benefiting from an ongoing review of processes, assignment of
responsible owners for improvements, establishment of timelines, and are now tracking
implementation, and validating improvements through drills, exercises, and future event planning.
Utah public safety and higher education leaders have initiated several efforts to strengthen
intelligence gathering, information sharing, and multi-agency collaboration related to campus safety.
These include the Utah Department of Public Safety (DPS) assigning a SIAC analyst to focus on public
safety concerns affecting Utah’s public schools and institutions of higher education; the Utah Board of
Higher Education creating a Campus Safety Task Force to identify ways to enhance public safety
operations across the statewide higher education system; and the University of Utah Department of
Public Safety assigning personnel to support the Real-Time Crime Center being established by the Salt
Lake City Police Department.
These efforts are significant because they provide UVU with opportunities to better leverage external
intelligence, public safety resources, training, and collaborative planning. UVU took basic steps to plan
for the September 10 TPUSA event, but the event was not supported by a written Event Action Plan that
fully incorporated available external resources, intelligence, mutual aid, or specialized capabilities. More
active participation in statewide information-sharing and campus-safety initiatives would help UVU keep
university-centered public safety concerns at the forefront when planning for high-profile events,
evaluating threats, conducting Security Assessments, and developing Event Action Plans.
Utah DPS Commissioner Beau Mason’s SIAC initiative, Utah Commissioner of Higher Education Geoffrey
Landward’s Campus Safety Task Force, and University of Utah Chief Safety Officer Keith Squires’ work
co-leading the Task Force with statewide campus police leaders reflect a broader effort to improve
consistency, collaboration, and readiness across Utah’s public institutions of higher education. UVU
should proactively participate in these efforts, identify appropriate representatives to engage with SIAC
and statewide working groups, and incorporate lessons, tools, resources, and intelligence-sharing
practices into its own event planning, emergency management, threat assessment, and public safety
operations.
KEY FINDING 9: UVU Made Meaningful Post-Incident Efforts, but First Responder Support
and Continuous Improvements Need Additional Attention
KEY FINDING 10: Utah Is Expanding Public Safety Intelligence and Collaboration Efforts,
and UVU Should Proactively Engage in Those Efforts
After-Action Report for Utah Valley University
24
Illustration: Utah Valley University Campus – Key Locations Referenced in this Review
After-Action Report for Utah Valley University
25
After-Action Report
1. Governance, Policies, and Preparedness Framework
1.1 Overview of Policies, Protocols, Plans, and Evidence Reviewed
A key component of this assessment involved evaluating the policies, procedures, plans, and governance
structures that guided Utah Valley University's preparation for, response to, and recovery from the
September 10, 2025 incident. Effective preparedness depends not only on having documented plans
and protocols in place, but also on ensuring those plans are aligned with recognized practices,
understood by personnel, practiced regularly, and implemented consistently during real-world events.
To assess the quality of these policies and procedures, the Project Team reviewed University and Utah
Valley University Police Department (UVUPD) policies, emergency plans, communications protocols,
training records, after-action reports, event planning documents, and threat assessment and
management procedures. Particular attention was given to those documents governing event planning,
emergency management, emergency communications, First Amendment activities, behavioral threat
assessment, and law enforcement response.
The Project Team also evaluated the extent to which these policies and procedures aligned with
recognized practices in higher education safety, emergency management, behavioral threat assessment
and management, and law enforcement operations, as well as how effectively they were implemented
before, during, and after the September 10 incident.
This section of the After-Action Report first summarizes the policy, protocol, training, and preparedness
framework in place before September 10. It then provides a narrative review of the planning, response,
and interagency coordination associated with the September 10 TPUSA event. Later sections of this
report provide deeper analyses of specific operational components, including event security planning,
access control, protective operations, communications, open-source intelligence (OSINT), emergency
management, and mutual aid.
1.2 Policy 425 and Major Event Review Framework
UVU Policy 425 provides the formal framework for evaluating whether the September 10 TPUSA event
should be classified and managed as a major event. The narrative that follows then uses that policy
framework as the starting point for assessing how the event was reviewed, planned, and supported.
After-Action Report for Utah Valley University
32
▪ Address liability, authority, and operational responsibilities before an incident occurs.
▪ Clarify reimbursement and cost-sharing considerations.
▪ Improve planning and coordination for both emergency incidents and high-profile events.
The importance of mutual aid is also reflected in Utah legislation. Utah Code §53H-3-304 provides
additional authority to institutions of higher education when addressing safety concerns and responding
to campus disturbances or emergencies. The statute states: "If a law enforcement agency or security
department of an institution of higher education lacks sufficient manpower to deal effectively with a
condition of unrest existing or developing on a campus or related facility of the institution of higher
education ... the chief administrative officer may call for assistance from the county sheriff of the
county, a city law enforcement agency, or the Department of Public Safety."16
The statute further provides that upon such a request, responding agencies: “must render all necessary
assistance without expense to the institution of higher education."17 This legislation underscores the
State's recognition that institutions of higher education may require external support during significant
incidents and that coordinated response capabilities are essential to campus safety.
While these statutory authorities provide an important framework for emergency response, formal
mutual aid agreements remain a best practice. Such agreements facilitate planning, establish
expectations before an incident occurs, and provide a mechanism for accessing specialized resources
during both planned events and unforeseen emergencies.
UVUPD and the Orem Police Department have already begun efforts to formalize written mutual aid
agreements, which is commendable. UVUPD has formalized a mutual aid agreement with the Utah
County Sheriff’s Office. Expanding these agreements to include additional neighboring law enforcement
and public safety agencies will strengthen preparedness, improve resource coordination, and provide
greater access to specialized capabilities that can enhance both event security and emergency response
operations.
1.8 Crisis Communications and Media Response Planning
Crisis communications planning is a fundamental component of emergency management in higher
education. Effective plans enable institutions to provide timely, accurate, and coordinated information
that protects life safety, supports emergency response operations, reduces misinformation, maintains
stakeholder trust, and supports compliance with federal emergency notification and timely warning
requirements.
Higher education institutions must communicate with diverse internal and external audiences during
rapidly evolving incidents, including students, employees, families, visitors, public safety partners, public
officials, media, and the broader community. A well-developed crisis communications plan establishes
clear roles, responsibilities, communication channels, approval processes, spokesperson designations,
16 Utah 53H-3-304 (4)(a) Powers of chief administrative officer to order individuals off an institution of higher education’s
property, Renumbered and Amended by Chapter 8, 2025 Special Session 1.
17 Utah 53H-3-304 (4)(b) Powers of chief administrative officer to order individuals off an institution of higher education’s
property, Renumbered and Amended by Chapter 8, 2025 Special Session 1
After-Action Report for Utah Valley University
33
and message templates before an emergency occurs. These elements are particularly important during
active threats, natural disasters, fires, public health emergencies, cyberattacks, hazardous material
incidents, protests, and other events that may affect life safety, campus operations, or institutional
reputation.
Crisis communications planning also extends beyond the initial emergency notification. Institutions must
be prepared to provide operational updates, address misinformation, coordinate with public safety
partners, communicate campus closures or operational changes, communicate available mental health
and support resources, and explain recovery efforts. Transparent and consistent communication during
and after a crisis strengthens stakeholder confidence and supports institutional resilience.18
The Project Team reviewed UVU’s Crisis Communications Playbook – Controversial Speaker Invited to
Campus, updated in February 2024. The existence of this playbook reflects a proactive effort to prepare
for high-profile speakers, protests, media scrutiny, reputational risks, and related operational concerns.
The document identifies key stakeholders, outlines communications workflows, provides audience
mapping, and includes pre-developed messaging regarding free speech, academic freedom, and protest
activity. These elements are consistent with recognized crisis communications practices and
demonstrate that the University devoted meaningful attention to communications planning prior to
September 10, 2025.
The playbook is particularly noteworthy because it outlines several protocols that, if fully
operationalized, would support planning and preparation for major on-campus events such as the
September 10 TPUSA event. These include designation of a communications lead, intelligence gathering,
development of a coordinated communications strategy, and continuous monitoring of media and social
media activity.
Despite the existence of this guidance, the Project Team identified limited evidence that these practices
were consistently implemented before or during the incident. Communications responsibilities were not
always clearly defined, particularly when key leaders were off campus or operating remotely, adding to
uncertainty regarding message development, approval, and dissemination on September 10.
The Project Team also identified limited evidence of a formal intelligence-gathering process being used
to support communications planning and decision-making prior to the September 10 TPUSA event.
UVUPD did communicate with the Utah Statewide Information and Analysis Center (SIAC) regarding
potential threat information to help guide planning and preparation. However, there was limited
evidence of a broader multidisciplinary effort that incorporated social media monitoring, analysis of
security concerns arising from previous TPUSA events across the country, or a structured assessment of
operational risks associated with similar events held elsewhere.
Available information suggests that monitoring efforts prior to September 10 were focused primarily
on protest activity and reputational concerns rather than being integrated into a broader process to
identify security implications, emerging threats, or operational vulnerabilities. Such information could
18 Federal Emergency Management Agency. (2021). Comprehensive preparedness guide (CPG) 101: Developing and
maintaining emergency operations plans (Version 3.0). U.S. Department of Homeland Security; Centers for Disease Control
and Prevention. (2018). Crisis and emergency risk communication (CERC) manual. U.S. Department of Health and Human
Services; International Association of Campus Law Enforcement Administrators. (2023). Standards and accreditation
program. IACLEA.
After-Action Report for Utah Valley University
34
have helped inform communications planning, venue and security discussions, staffing decisions, crowd
management strategies, and consideration of additional security resources or technology support.
The playbook provides a strong foundation for future crisis communications planning. The primary
opportunity for improvement is ensuring that crisis communications guidance is operationalized through
training, exercises, clear role designation, defined message approval authority, and closer integration
with emergency management, law enforcement, intelligence, and event security planning functions.
UVU has also developed an in-progress draft of a Crisis Readiness Plan and Guidebook 2026. Because
that document was not in place before the September 10 TPUSA event, it is addressed more fully in
Section 7.4 as a post-incident preparedness enhancement. The draft Guidebook appears to be a
significant and comprehensive improvement that, once finalized and aligned with the Emergency
Operations Plan and related templates, should strengthen UVU’s crisis communications, life-safety
alerting, media response, and post-crisis review processes.
1.9 Organizational Alignment, Staffing, and Professional Standards
Campus public safety functions are most effective when they are appropriately positioned within the
University’s organizational structure, sufficiently staffed for the institution’s size and risk environment,
supported by clear professional standards, and integrated into senior-level planning and decision-
making. At large public universities, the Police Chief or senior public safety leader typically has sufficient
access to executive leadership to ensure that public safety considerations are incorporated into event
planning, emergency management, resource allocation, facilities planning, student affairs,
communications, and institutional risk decisions.
Organizational alignment is not merely an administrative issue. It affects how quickly public safety
concerns are elevated, how consistently public safety participates in strategic planning, how resources
are prioritized, how emergency preparedness is coordinated, and how senior leaders understand the
operational realities facing campus police, emergency management, and security personnel.
Staffing is also a core element of public safety readiness. Universities should periodically evaluate
whether sworn staffing, Dispatch capacity, emergency management resources, and physical security
staffing are aligned with the institution’s size, geography, event profile, call volume, risk environment,
and community expectations.
Professional standards frameworks, including those identified through higher education-specific
resources such as the International Association of Campus Law Enforcement Administrators (IACLEA),
can support policy development, accountability, risk reduction, operational consistency, and continuous
improvement.
UVU is a large and growing public university with a complex public safety environment. The University
hosts major events, public speakers, athletic events, student activities, and public gatherings while
operating in an open campus environment with significant commuter activity and broad community
access. These conditions require public safety functions that are visible, integrated, appropriately
staffed, and positioned to participate in institutional planning and decision-making.
After-Action Report for Utah Valley University
35
The Project Team identified concerns regarding the organizational placement and visibility of UVUPD
within the University’s leadership structure. The Police Chief does not appear to be positioned in a
manner typical for the senior law enforcement official at a large public university. The Police Chief’s
current reporting structure appears to place several organizational layers between UVUPD and the
University’s senior executive leadership. This structure may limit routine visibility into senior decision-
making and reduce opportunities for public safety considerations to be integrated early into planning for
major events, emergency preparedness, facilities use, and institutional risk management. At a minimum,
to align itself with what are considered best practices for a university with the size and operational
scope of UVU, the Police Chief should be reporting to someone who answers directly to the President of
the University.19
This concern is not a reflection on the professionalism or commitment of UVUPD personnel. Rather, it is
an organizational alignment issue. For a university of UVU’s size and complexity, public safety leadership
should have a sufficiently direct connection to senior administration to ensure that campus safety,
emergency preparedness, law enforcement operations, event security, and risk-management issues are
regularly considered and understood at the appropriate level.
The Project Team also identified concerns regarding UVUPD staffing. UVUPD has a limited number of
sworn personnel relative to the size of the University, the scale of campus operations, and the number
and complexity of events that may occur on campus. While staffing needs cannot be determined
through a simple formula, the University would benefit from a formal staffing analysis that considers
student population, campus geography, call volume, event activity, patrol coverage, supervisory needs,
investigative responsibilities, Dispatch demands, mutual aid assumptions, emergency management
needs, and major-event security requirements. While a formal study is recommended to identify the
appropriate staffing level, it was nevertheless clear to the Project Team that a total sworn staff of 13 is
not sufficient for a university of UVU’s size and the types of events and activities occurring across its
campus.
The Project Team’s review also identified an opportunity for UVU to evaluate
IACLEA accreditation20 as part of UVUPD’s broader professional standards and
continuous improvement efforts. IACLEA provides training, research, policy
guidance, conferences, accreditation standards, and professional resources
specifically focused on higher-education public safety. IACLEA accreditation
provides an externally validated framework for assessing campus police policies,
operations, training, administration, accountability, and continuous
improvement. For UVU, IACLEA accreditation could provide a structured roadmap for evaluating UVUPD
against nationally recognized campus public safety standards.
19 The Project Team notes that after discussions with UVU leadership concerning this issue during our assessment work, they
acted promptly, and the UVU Police Chief now reports directly to Val Peterson, VP of Administration and Strategic
Relations, who reports directly to the UVU President.
20 https://iaclea.org/accreditation/accreditation-process/ - Outlines the IACLEA Accreditation Process.
After-Action Report for Utah Valley University
36
UVU should also consider leveraging no-cost resources available through the
Cybersecurity and Infrastructure Security Agency (CISA). Colleges and
universities are part of the Education Facilities Subsector within the nation’s
critical infrastructure framework, and CISA provides tools, assessments, and
technical assistance intended to help institutions strengthen physical security,
cybersecurity, emergency preparedness, and infrastructure resilience.
Relevant CISA resources may include Protective Security Advisor engagements,
physical security assessments, infrastructure resilience tools, cybersecurity vulnerability assessments,
tabletop exercises, and targeted violence prevention resources. These services can help UVU identify
vulnerabilities, prioritize mitigation strategies, evaluate preparedness, and align campus safety and
security planning with recognized critical infrastructure protection practices.21
21 Cybersecurity and Infrastructure Security Agency. (2024). Critical infrastructure security and resilience. U.S. Department of
Homeland Security. https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience
Recommendations related to the issues addressed in this section are included in Section 9.
After-Action Report for Utah Valley University
37
2. September 10 TPUSA Event Planning, Response, and
Interagency Coordination
The review and assessment of the formal UVU policies, plans, training records, training exercises, and
communications protocols summarized above provides the framework for evaluating how well UVU
prepared for and responded to the September 10 TPUSA event. The following narrative reviews in
greater detail the planning process, day-of security posture, initial response, and interagency
coordination that occurred before and after the September 10 TPUSA event. This detail includes
reviewing how well specific policies were followed and implemented.
2.1 Prevention and Preparedness Practices for High-Profile Events
Effective event-security preparation for a high-profile speaker requires early risk identification,
structured event classification, venue assessment, protective intelligence, coordination with event
organizers, public safety partner engagement, access-control planning, staffing analysis,
communications planning, and documented decision-making. When a proposed event involves political
activity, large attendance, public visibility, potential protests, or an elevated threat environment,
planning should begin early enough to allow security concerns to influence venue selection, ticketing,
credentialing, staffing, mutual aid, intelligence collection, and emergency response planning.
Recognized practices include:
▪ Classifying high-profile, political, controversial, or large-attendance events through a formal review
process.
▪ Conducting a documented security assessment before finalizing venue, ticketing, access-control,
and staffing decisions.
▪ Reviewing a speaker’s profile, as well as the outcomes of a speaker’s prior events, associated protest
activities, online social media discourse, and known threats.
▪ Coordinating directly with the event organizer and any private or executive protection team.
▪ Establishing attendance projections and access to ticketing or registration data.
▪ Evaluating venue suitability, line-of-sight exposure, crowd flow, emergency access, and controlled-
entry options.
▪ Developing access-control, credentialing, screening, and staffing plans based on the event’s risk
profile.
▪ Engaging local law enforcement, fire, EMS, emergency management, and other public safety
partners when additional resources or expertise may be needed.
▪ Assigning personnel to monitor relevant security systems, video feeds, communications channels,
and emerging conditions during the event.
▪ Documenting key decisions, assumptions, resource needs, and unresolved security concerns.
▪ Notifying local, state and federal authorities including Utah SIAC, FBI, Secret Service, and the DHS
Protective Security Advisor, when warranted.
After-Action Report for Utah Valley University
39
UVU policy was followed regarding the process to seek approval for an event. The UVU TPUSA Club
President received guidance from Event Services while working to submit the event as a co-sponsored
event involving the UVU TPUSA club and the national TPUSA organization, consistent with Policy 425 §
3.7.1, which defines how University entities may request use of University facilities for University or co-
sponsored events. However, UVU did not invite the speaker for this event. It was coordinated through
the UVU TPUSA Club. The University is legally required to allow student clubs to bring speakers on
campus.
UVU’s adherence to Policy 425 § 4.1.5 is also relevant because it requires individuals planning, hosting,
or attending events, including guests, vendors, and contractors, to follow University policies, Event
Services guidelines and protocols, and applicable law. For co-sponsored events involving external
entities, these provisions underscore the need to clearly define planning responsibilities, compliance
obligations, access to event information, and coordination expectations. After the application was
processed, University officials recognized that the event should be reviewed as a major event. On
August 21, 2025, Event Services sent an email to those required to attend the MEAC meeting scheduled
for August 25, 2025. This appears to have been the point at which UVU Police Chief Long first became
aware of the event.
The MEAC process outlined several issues relevant to security planning, including the nature of the
event, the requested outdoor location, anticipated attendance, protest activity, ticketing, staffing, and
site-control concerns. However, the MEAC review did not lead to the creation of a documented Security
Assessment that evaluated whether the event posed a significant threat of harm to people or property
or that documented the operational implications of the requested venue and event configuration.
This documentation gap is important because the Security Assessment is the mechanism through which
identified concerns should be translated into planning decisions, venue recommendations, staffing
levels, access-control measures, communications needs, Command Post planning, Emergency
Operations Center readiness, mutual aid considerations, and, when appropriate, an Event Action Plan.
Without completing a documented Security Assessment, it becomes more difficult to identify security
concerns and evaluate them, consider mitigation measures, determine who is responsible for
implementation, and identify why certain planning decisions were made.
The September 10 TPUSA event planning process also reflected considerable deference on UVU’s part to
TPUSA’s expressed desires regarding event logistics, including the Fountain Courtyard as the venue and
the ticketing process. While the University was required to permit the lawful expressive activity to be
conducted at an event on the campus, it had the ability to impose reasonable time, place, and manner
restrictions on the event. Future MEAC processes should more clearly balance accommodating
expressive activity with the need to retain control over site selection, ticketing processes, security
requirements and operational conditions necessary to protect students, staff, and visitors on campus.
2.3 Venue, Ticketing, and MEAC Planning Decisions
During the August 25 MEAC Teams meeting, Maycee Crofts,22 a Senior Field Representative for TPUSA,
participated at the request of TPUSA. UVU participants raised concerns regarding TPUSA’s requested
22 The Project Team made multiple attempts to contact Maycee Crofts to obtain her perspective and recollection regarding
the August 25 MEAC meeting, including what was discussed and decided during that meeting. These outreach efforts
After-Action Report for Utah Valley University
41
Policy 425 § 4.1.3 and Policy 161 are also relevant because security planning for political or controversial
events must balance safety, lawful expression, access to University facilities, and operational control. In
this context, security-related decisions regarding venue selection, access control, protest locations,
screening, signage, and crowd management should distinguish between lawful expressive activity and
conduct that creates safety, security, or operational concerns.
2.4 Pre-Event Security Coordination and Intelligence
On August 21, the UVU TPUSA Club President emailed the Clubs Office a completed MEAC
questionnaire, indicating that it provided answers “straight from the TPUSA team.” The questionnaire
projected approximately 600 attendees, described the event as primarily student-focused with some
potential public interest, represented no risk factors/ safety/security concerns or need for emergency
medical services, and offered to connect UVUPD with TPUSA’s head of security. That same day, the UVU
Free Speech Committee flagged the event because of the potential for protests and noted that a small
Emergency Operations Center (EOC) had been used for a prior TPUSA event on UVU campus.
After the August 25 MEAC meeting, Chief Long took the lead on security planning, with support from
Event Services staff. Over the next 16 days, Chief Long and other UVU personnel took steps to prepare
for the event, including attempting to identify TPUSA security points of contact, communicating with
TPUSA representatives, addressing TPUSA concerns about the Hall of Flags outdoor pedestrian walkway
above the speaking location, contacting the Utah SIAC for threat-related information, and arranging
UVUPD staffing.
During the MEAC process, Chief Long provided his contact information to Maycee Crofts and asked that
she share it with the appropriate TPUSA representative so that he could coordinate security matters
directly with the organization’s security team. When he did not hear from Crofts or a member of the
TPUSA security team following the MEAC meeting, Chief Long attempted to follow up but did not have
Crofts’ direct contact information. On September 2, he emailed a staff member in the University’s Clubs
Office seeking contact information for TPUSA’s security representative because no member of the
TPUSA security team had contacted him following his request to Crofts.
On September 3, Chief Long received a call from Dan Flood, TPUSA Security Supervisor.23 Chief Long
asked Flood what was needed by TPUSA from the UVU police. Flood stated that approximately 10 to 12
TPUSA security personnel would attend, which was an increase from the eight referenced during the
August 25 MEAC meeting. Flood asked Chief Long to arrange for TPUSA staff to park as close as possible
to the canopy location in the Fountain Courtyard where Charlie Kirk would speak and facilitate his entry
to and exit from the venue.
Later on September 3, Chief Long called Flood again to ask whether the event was ticketed. Flood
confirmed that TPUSA’s national office in Phoenix was handling ticketing so TPUSA could gauge how
many people planned to attend. Chief Long also asked whether Charlie Kirk would speak at any other
23 The Project Team made multiple attempts to contact Dan Flood to obtain his perspective and recollection regarding his
telephone call with the UVU Police Chief, subsequent text message exchanges, and discussions that occurred in the hours
before the September 10 TPUSA event. These efforts included telephone calls with voicemail messages, email requests, and
outreach to the TPUSA national office in Phoenix seeking assistance in facilitating contact. The Project Team also sent Flood
a certified letter requesting an interview. Flood did not respond to these outreach efforts.
After-Action Report for Utah Valley University
45
Two plainclothes officers from Utah State University (USU) were also present. Those officers had
previously contacted Chief Long and arranged to observe the event because the same TPUSA tour
was scheduled to occur at USU on September 30. The two USU officers were not assigned specific
operational duties during the September 10 TPUSA event and were reportedly located outside the
second-level area of the Fugal Building when the shooting occurred.
Between approximately 11:20 a.m. and 11:30 a.m., UVUPD Chief Long, UVUPD Sergeant Beveridge, and
Officer Bagley went to the Hall of Flags outdoor pedestrian walkway above the canopy where Charlie
Kirk would be speaking. They cleared the area of individuals who had gathered there and placed security
tape in two locations on either side of the canopy below to prevent the estimated 80 to 100 protesters
from entering the area directly above the speaker’s location. According to Chief Long, most individuals
complied with officers’ directions, and some protesters complied with a request to remove a large
LGBTQ flag that had been hung from the railings in that area. Chief Long stated Sergeant Beveridge and
Officer Bagley remained in the area to maintain compliance.
Chief Long then went to Room 204 on the second floor of the Fugal Gateway Building, where a
Command Post had been established. The room had floor-to-ceiling windows and provided visibility over
the event area and surrounding buildings. Chief Long and other UVU officials planned to use the location
to observe the event and coordinate operations.
At approximately noon, Charlie Kirk arrived and began moving toward the canopy where he would
speak. Chief Long reported hearing protesters who were positioned behind the police tape on the
second-level Hall of Flags outdoor pedestrian walkway shouting profanities toward Charlie Kirk. Charlie
Kirk looked up toward the protesters but did not respond verbally. He then began engaging with the
crowd, including throwing TPUSA baseball caps to attendees.
Before entering the Command Post, Chief Long spent time addressing an access-control issue inside the
Fugal Gateway Building. Students and other attendees had entered the administration building and
proceeded up a stairwell from the second floor to the third floor to access a balcony area outside the
University President’s Office, where they hoped to observe the event. After removing those students,
Chief Long secured the area and stationed a staff member from the Director of Emergency Management
and Safety’s staff on the second level to prevent people from entering the stairwell and accessing the
third-floor balcony area. Chief Long then entered the second-floor Command Post and joined other UVU
officials as Charlie Kirk began speaking. Chief Long was present in the Command Post when, at
approximately 12:23 p.m., he heard the gunshot and saw Charlie Kirk get shot.
The section on the following pages summarizes statements made by Brian Harpole regarding the
September 10 TPUSA event.
After-Action Report for Utah Valley University
49
leaving the roof area, and follow-up search activity nearby led to the recovery of a rifle believed to
have been used in the crime.
Members of the Orem Police Department, together with Orem Fire Department personnel trained in
emergency medical services, arrived almost immediately. OPD command personnel stepped in quickly
to help lead certain operations within the Command Post. Their assistance helped address the urgent
need to search the campus for suspects while also ensuring there were no additional victims in UVU’s
many buildings across the large and sloped campus terrain.
The Project Team also interviewed Orem Police Chief B.J. Robinson. That interview indicated that a
positive and collegial relationship existed between OPD and UVU before, during, and after the events
of September 10. Chief Robinson responded to the scene after receiving information suggesting that a
suspect was in custody. Once he made his way to the command post, he took steps to provide the
resources his command personnel and others needed, including support for sweeping searches of the
campus.
Chief Robinson also confirmed that OPD and UVU had operated under an informal mutual aid
understanding to assist one another as needed. Since the incident, he has taken steps to formalize that
relationship through a written mutual aid agreement between OPD and UVU. At the time of the
interview, drafts of that agreement were being developed. This is an important post-incident
enhancement and is addressed in Section 7.
Based on interviews conducted for this assessment, representatives from the Orem Police Department,
the Utah DPS, the Utah County Sheriff’s Office, the Utah Highway Patrol, Orem Fire Department, and
other local agencies who responded were competent, capable, and professional in their response. Their
collective actions reflected the type of coordinated law enforcement, fire, EMS, and public safety
support a community would hope to see during a tragic and fast-moving incident.
2.7 Transition to State and Federal Investigative Command
Commissioner Beau Mason of the Utah Department of Public Safety acted quickly upon learning of the
shooting while at DPS headquarters approximately 35 miles northwest of UVU. He immediately began
mustering key personnel from his department, including personnel from the State Bureau of
Investigation (SBI), the Utah SIAC, and the State Crime Lab. He directed DPS personnel to assist in any
way possible and left for UVU within approximately 15 minutes of learning about the shooting and after
meeting with the staff he had gathered.
While en route, Commissioner Mason attempted to call Chief Long to coordinate but was unable to
connect because Chief Long was occupied with urgent command responsibilities at the scene.
Commissioner Mason then contacted Utah County Sheriff Mike Smith to discuss tactical resources that
may be needed to locate and confront a suspect or suspects, along with other pressing operational
needs.
Upon arrival at UVU, Commissioner Mason immediately engaged with other law enforcement officials
to help determine what actions needed to be taken. He coordinated with state leadership, local law
enforcement leaders, and FBI representatives as the response transitioned from UVUPD’s initial campus
response to a larger state and federal investigative operation.
After-Action Report for Utah Valley University
51
2.8 Fire, EMS, and Emergency Management Interagency Support
The Project Team also interviewed Chief Marc Sanderson of the Orem Fire Department. Chief Sanderson
was in Wisconsin on September 10 coordinating the building of a new fire truck for the department, but
he provided detailed information regarding Orem Fire’s response.
Fire personnel from Station One and Station Three were initially dispatched to the scene of the shooting.
Personnel from Stations Two and Four also responded because the extent of medical need was not yet
known. While en route, the Station Three fire truck passed near the SUV being used by the TPUSA
security team to transport Charlie Kirk to Timpanogos Hospital. Station Three personnel provided that
information over the radio. Station Two then rerouted to Timpanogos Hospital, where the Fire Captain
from Station Two assisted in providing CPR to Charlie Kirk at the hospital.
In addition, one Orem Fire Captain went to the UVU Command Post to provide assistance, and two
Orem Fire paramedics joined a police officer on scene to help search for victims who may have needed
medical assistance.
Chief Sanderson also advised that he had recently spoken with Chief Robinson about approaching UVU
with an offer to conduct a joint active shooter training exercise. The purpose of such an exercise would
be to help ensure that UVU, OPD, and Orem Fire are able to operate as efficiently and effectively as
possible should another major public safety incident occur on campus.
The Project Team also interviewed Keith Stevenson, Emergency Management Director for the City of
Orem. The purpose of this interview was to understand what role Orem Emergency Management played
on September 10, what mutual aid assistance may have been available, and how Orem Emergency
Management may be able to support UVU in the future. Stevenson demonstrated strong familiarity with
the National Incident Management System (NIMS) and the Incident Command System (ICS) framework,
both of which are national standards for multi-agency emergency response.
When Stevenson learned of the shooting moments after it occurred, he recalled from a prior Local
Emergency Planning Committee (LEPC) meeting that UVU Emergency Management Director Robin
Ebmeyer was scheduled to be out of state on vacation that day. The LEPC meets twice a month at the
Utah County Sheriff’s Office, and Ebmeyer is a member. Stevenson estimated that he called Ebmeyer
approximately 20 minutes after the shooting and offered any assistance he could provide. According to
Stevenson, Ebmeyer declined assistance.
Because he was not asked to respond to UVU, Stevenson remained at the Orem EOC located within the
Orem City Hall complex. From there, Orem City officials coordinated fire operations for personnel
dispatched to UVU and remained prepared to assist if requested. Stevenson advised that those present
in the Orem EOC included the City Manager, Assistant City Manager, a Deputy City Manager, and
personnel from the Police and Fire Departments. He also advised that Orem Emergency Management
remains willing to assist UVU with future emergency management policy development, training, and
preparedness efforts.
After-Action Report for Utah Valley University
53
At the same time, the preparation process revealed several important gaps. There was limited time
between Chief Long first learning of the event and the event date. The Security Assessment process
did not result in documented requirements for venue modification, University-controlled ticketing,
controlled access, credentialing, screening, or additional staffing. UVU did not have reliable access to
ticketing or registration data. Coordination with TPUSA’s security team was very limited and did not
include a structured pre-event briefing or site walk-through before or on September 10 between Brian
Harpole, Dan Flood, and UVUPD. Chief Long did not initiate a mutual aid request to the Orem Police
Department or other local public safety partners before the event, and additional external resources
were not requested after the crowd size became apparent. There also was not a dedicated assignment
for real-time security video monitoring by UVUPD Dispatch personnel or others from another
operational location during the event.
The primary security concern among many UVU officials appeared to be potential disruption or safety
issues associated with student or non-student protest activity. That concern was reasonable given the
First Amendment nature of the event, addressed in Policy 425 § 4.1.3, and UVU Policy 161. However, a
broader site Security Assessment was warranted. Protest activity, crowd size, open access, line-of-sight
exposure, the speaker’s public profile, the external organizer’s control over ticketing, and the
involvement of private security all should have prompted a more comprehensive Event Action Plan and
earlier coordination with public safety partners. TPUSA was the final decision maker for the event site
selection, but this authority should be with the University.
In the Project Team’s assessment, the preparation for September 10 reflected committed efforts by
UVU personnel but also demonstrated the limitations of relying on informal coordination, ad hoc
decision-making, and available internal staffing and equipment for a high-profile outdoor event. The
event required a more structured planning process, stronger documentation of security decisions under
Policy 425, earlier protective intelligence review, more formal coordination with external security and
public safety partners for personnel and technology resource assistance, and a clearer process for
elevating unresolved concerns to University leadership before final venue and operational decisions
were accepted.
Recommendations related to the issues addressed in this section are included in Section 9.
After-Action Report for Utah Valley University
57
3.2 Event Security Operations
Recognized Practices
Event security operations translate planning assumptions into real-time protective measures designed
to maintain safety, facilitate lawful activity, manage crowds, and support effective response if conditions
change. For major or elevated-risk events, operational planning should connect Security Assessment,
venue conditions, staffing, post assignments, access control, communications, executive protection
coordination, emergency response procedures, and contingency planning.
A well-designed event security plan uses layered protection across the outer, middle, and inner
perimeters. The outer perimeter generally encompasses public areas, the middle perimeter controls
access to the event, and the inner perimeter includes the event space and restricted areas. This layered
model supports deterrence, detection, delay, response, and recovery.
Illustration: The Layered Event Security Model
UVU Application and Assessment
Based on interviews, documentation, and available video evidence, UVUPD personnel were deployed
throughout the event area and performed a range of security functions before, during, and after the
event. Officers monitored crowd activity, supported event operations, managed protest-related
concerns, and responded to emerging incidents. However, while UVUPD coordinated some security
issues with event organizers just prior to the event, such as the concern of the Hall of Flags outdoor
pedestrian walkway located above the speaker’s canopy, no actual face-to-face contact or pre-event
debriefing activities occurred between the UVUPD Police Chief or TPUSA security representatives. This
represents a lost opportunity to identify and mitigate any real-time security concerns prior to the
beginning of an event. UVUPD did not establish fixed or mobile security posts, which limited its visible
law enforcement presence during the event.
Recommendations related to the issues addressed in this section are included in Section 9.
After-Action Report for Utah Valley University
58
The outdoor venue presented significant operational challenges. The event area included multiple
access points, adjacent buildings, elevated walkways, open pedestrian areas, and numerous locations
from which attendees, protesters, and bystanders could observe the event. These features increased
the complexity of crowd management, situational awareness, perimeter security, and response
operations.
Staffing decisions appear to have been made based on information available at the time. However,
the absence of a formal Security Assessment, reliable attendance estimate, and written Event Action
Plan limited the ability to systematically evaluate staffing needs and resource requirements. Historical
incidents involving similar events may also have supported consideration of additional security
measures.
The Project Team also identified the importance of clearly defining operational responsibilities and
command relationships during major events. Leadership and decision-making roles, such as Incident
Commander and EOC Manager need to include both primary and backup personnel. Security operations
are most effective when assignments, reporting relationships, emergency procedures, communications
protocols, and contingency plans are documented and briefed before the event. This provides a
common operating picture and supports effective decision-making if conditions change rapidly.
Officers responded quickly following the shooting and initiated emergency response actions. The
incident nevertheless demonstrated the challenges associated with managing a high-profile event in
a complex, open-access environment. Future planning efforts would benefit from a more formalized
process that links Security Assessments, staffing decisions, command structures, security technologies,
and emergency response procedures into a unified operational framework.
For the September 10 TPUSA event, the Director of Emergency Management and Safety assigned two
UVU Emergency Medical Services (EMS) personnel. Both were Emergency Medical Technicians (EMTs)
trained to provide prehospital emergency medical care before patients reach a hospital. EMTs may
deliver non-invasive, lifesaving interventions and help stabilize patients during emergencies. Both EMTs
were equipped with trauma packs and rendered aid after the shooting, including assisting individuals
who experienced trips and falls, breathing difficulty, and panic attacks during the ensuing chaos
following the shooting. It is important to note that the EMTs could not transport patients, including
Charlie Kirk, to the hospital. No ambulance was staged on site for the September 10 TPUSA event.
3.3 Access Control, Screening, and Credentialing
Recognized Practices
Access control, screening, and credentialing are core components of event security planning. Together,
they help define who may enter an event space, what items may be brought into the venue, which areas
are restricted, how attendance is monitored, and how security personnel identify authorized individuals.
Effective access-control planning integrates personnel, technology, physical barriers, written
procedures, emergency management, event organizers, and coordination with law enforcement, fire,
EMS, and other critical partners.
Recommendations related to the issues addressed in this section are included in Section 9.
After-Action Report for Utah Valley University
61
No formal attendee screening operation was established at entry points. Attendees generally accessed
the event area without passing through a controlled security perimeter. No formal credentialing process
was used to differentiate event participants, TPUSA personnel, University staff, vendors, media
representatives, VIPs, emergency responders, or other authorized personnel. While legal and
operational constraints may affect the feasibility of screening and weapons-related restrictions on public
University property, the absence of controlled access points, credentialing procedures, and attendee
screening reduced UVU’s ability to manage entry, monitor attendance, identify unauthorized access, and
enforce event-specific security protocols.
The event also presented access-control concerns beyond the immediate audience area. Before the
shooting, individuals entered the Fugal Gateway Building and attempted to access an upper balcony
area outside the University President’s Office to observe the event. Chief Long addressed this issue and
had a staff member from the Director of Emergency Management and Safety’s staff posted on the
second level to help prevent people from entering the stairwell and accessing the third-floor balcony
area. This incident illustrated the difficulty of managing access to surrounding buildings and elevated
viewing areas during an open-air campus event.
The elevated Hall of Flags outdoor pedestrian walkway above the speaker location presented another
access-control issue. TPUSA Security Supervisor Dan Flood raised concerns through text messaging with
Chief Long before the event about individuals being able to access the area above the canopy where
Charlie Kirk would speak. On the morning of September 10 and prior to Charlie Kirk’s arrival on campus,
Chief Long and UVUPD personnel cleared people from the Hall of Flags outdoor pedestrian walkway,
placed security tape in two locations, and assigned two sworn personnel to the area to maintain
compliance. This action addressed a visible and immediate access concern, but it also demonstrated
the need for more formal pre-event identification of restricted areas, post assignments, and access-
control responsibilities.
The absence of a written access-control, screening, credentialing, and post-coverage plan limited the
ability to document how public areas, restricted areas, elevated positions, building access points,
command-post access, media areas, staff areas, VIP areas, and emergency response routes would be
managed. It also limited the ability to define responsibilities for entry management, exception handling,
late entry, re-entry, restricted-area enforcement, suspicious activity reporting, and escalation to law
enforcement.
The September 10 TPUSA event presented access-control challenges that were foreseeable given the
outdoor location, open campus environment, political nature of the event, protest concerns, external
organizer involvement, and presence of a private security team. UVU personnel took practical steps to
address access concerns as they emerged, including clearing the elevated Hall of Flags outdoor
pedestrian walkway and limiting access to the third-floor balcony area. However, those actions occurred
without the benefit of a comprehensive written access-control and credentialing plan developed before
the event.
Recommendations related to the issues addressed in this section are included in Section 9.
After-Action Report for Utah Valley University
63
For high-profile events involving a private security or executive protection detail, coordination should
occur early enough to influence site selection, staging, crowd configuration, staffing, communications,
emergency response procedures, and the Event Action Plan. Protective details can provide important
information regarding the speaker’s threat environment, movement preferences, arrival and departure
needs, known concerns from prior events, and protective expectations. Event security planning should
integrate, as appropriate, the resources and information available from the event organizer, the
protective detail, UVUPD, emergency management, and external public safety partners.
UVU Application and Assessment
The September 10 TPUSA event was held in an outdoor, open-access campus location near the large,
tiered Fountain Courtyard. The venue was surrounded by adjacent buildings, elevated areas, and the
Hall of Flags outdoor pedestrian walkway above the canopy where Charlie Kirk was scheduled to speak.
These conditions created line-of-sight and elevated-position concerns that were directly relevant to
protective operations planning.
As discussed in Section 2, UVU participants raised concerns during the MEAC process regarding the
controllability of the requested outdoor location and suggested an alternative location where access
could be more effectively managed. The event ultimately proceeded in the Fountain Courtyard, as
requested by TPUSA. In our assessment, that decision increased the importance of conducting a
documented line-of-sight assessment, identifying elevated positions, assigning fixed posts, documenting
mitigation measures, and coordinating protective operations before the event.
The elevated Hall of Flags outdoor pedestrian walkway above the speaking area became a specific
security concern before the event. TPUSA Security Supervisor Dan Flood raised this concern with Chief
Long on September 8, and UVUPD personnel promptly cleared, taped off, and assigned two UVUPD
officers to the walkway shortly before the event began. This action addressed an immediate and visible
vulnerability, but it occurred without the benefit of a documented Security Assessment or Event Action
Plan developed before the event.
The selected location also presented broader environmental concerns beyond the elevated Hall of Flags
outdoor pedestrian walkway. The surrounding buildings, elevated vantage points, open pedestrian
areas, and multiple access routes made it difficult to fully control or monitor the event environment.
These conditions affected line-of-sight planning, crowd placement, protest management, emergency
access, and the ability to identify and control restricted or sensitive areas before the event began.
Coordination with TPUSA’s security team was also limited. UVUPD, TPUSA’s security team, emergency
management, and event organizers did not conduct a formal pre-event briefing and walk-through
focused on line-of-sight concerns, elevated positions, arrival and departure routes, building access,
communications, emergency response, staffing, emergency egress, medical contingencies, post
assignments, and responsibility for specific security functions. If local law enforcement or other external
public safety agencies are asked to support future events, those agencies should also participate in pre-
event briefings and walk-throughs.
Event-related protective intelligence was another relevant planning consideration. Prior incidents
involving similar speakers or organizations did not predict violence at UVU, but they provided relevant
information regarding protest activity, crowd-control issues, disruption, and security measures used at
other institutions. That information could have supported a more structured discussion of venue
After-Action Report for Utah Valley University
64
suitability, staffing, access control, protest management, screening, mutual aid, and other protective
measures.
In our assessment, UVU personnel recognized and responded to some protective operations concerns,
particularly the elevated Hall of Flags outdoor pedestrian walkway. However, the planning process did
not produce a Security Assessment documenting line-of-sight concerns, a formal Event Action Plan
providing specific protective operations measures, or a structured coordination process among the
speaker’s security team, UVUPD, emergency management, event organizers, and external law
enforcement partners before the event. For future high-profile outdoor events, UVU would benefit from
a more formal process for identifying line-of-sight concerns, advising University leadership and event
organizers of protective operations issues, documenting mitigation options, and determining whether
an outdoor venue remains appropriate. See Appendix D.5: Protective Operations Considerations for
Outdoor Events for more information.
3.5 Traffic, Parking, and Perimeter Management
Recognized Practices
Traffic, parking, and perimeter management are important components of event security planning,
particularly for outdoor events, large gatherings, and events involving high-profile speakers or elevated
security concerns. These functions support attendee safety, emergency response access, crowd
movement, and overall site control.
For major events, planning typically addresses how attendees, participants, vendors, emergency
responders, and event staff will arrive, move through the area, park, access the venue, and depart.
Traffic and parking plans also help identify where pedestrians and vehicles may intersect, how
emergency vehicles will reach the event site, and what conditions may require law enforcement,
parking, transportation, or mutual aid support.
Parking areas are part of the event security environment. They are often the first and last points of
interaction attendees have with an event and may present opportunities for criminal activity, suspicious
behavior, unattended property, traffic congestion, or emergency incidents. Parking operations should
therefore be considered as part of the event’s broader security and Event Action Plan.
Perimeter management helps define the event boundary, direct pedestrian movement, support access-
control operations, and protect emergency access routes. Depending on the venue, risk environment,
and event layout, perimeter measures may include physical barriers, staffed posts, signage, vehicle-
control points, or other controls designed to manage movement and reduce unauthorized access.
Emergency departure planning is also important. During a fast-moving incident, attendees, students,
faculty, staff, and visitors may need clear instructions regarding which areas to avoid, which routes are
available, and how to leave campus safely. These decisions are most effective when identified before
the event and coordinated with Dispatch, the EOC, Communications, UVUPD, parking personnel, and
public safety partners.
Recommendations related to the issues addressed in this section are included in Section 9.
After-Action Report for Utah Valley University
66
3.6 Fixed and Temporary Site Security Measures
Recognized Practices
Fixed and temporary site security measures help control movement, define event boundaries, protect
pedestrian areas, support screening operations, reduce unauthorized access, and preserve emergency
access and egress. These measures are selected based on the event’s risk profile, venue characteristics,
crowd size, traffic patterns, pedestrian flow, and emergency response needs.
For outdoor events, common measures include temporary fencing, gates, barricades, stanchions,
signage, concrete barriers, water-filled barriers, vehicles, planters, bollards, and other physical controls.
These measures can help establish event perimeters, guide pedestrian movement, limit vehicle access,
protect screening areas, create buffer zones, and distinguish public spaces from restricted or controlled
areas.
When roads, vehicle routes, parking lots, or public access points remain open near an event site,
physical controls are typically evaluated in connection with staffing, traffic management, emergency
vehicle access, and law enforcement support. Temporary barriers are most effective when they are
incorporated into a broader security plan that identifies who will staff, monitor, inspect, and adjust
them as conditions change.
Site security measures also support screening and access-control operations. When screening is used,
planning accounts for queueing areas, screening tables, lighting, signage, secondary screening locations,
express lanes, ADA or medical-device lanes, staff or participant lanes, vendor and delivery access, and
backup procedures if equipment fails or crowd conditions change. Detailed screening considerations are
addressed in Section 3.3. And additional information is provided in Appendix D.7: Fixed and Temporary
Site Security Measures.
UVU Application and Assessment
The September 10 TPUSA event occurred in a largely open-access outdoor environment. The Project
Team learned that UVUPD did not establish a comprehensive physical perimeter around the event area,
use temporary fencing or barricades to define controlled entry points, or create a screening area
through fixed or temporary site security measures. Bicycle racks placed to help secure the area near the
speaker’s canopy were the only barriers used on September 10, but they were not intended to be used
as entry- and exit-point controls. Immediately after the shooting, the crowd knocked down the racks by
running towards the canopy area and away from where the assailant was located.
The most notable temporary control measure used before the event was security tape placed on the
elevated Hall of Flags outdoor pedestrian walkway along with two UVUPD officers posted above the
canopy where Charlie Kirk would speak. This measure helped restrict access to the area directly above
the speaker location after TPUSA raised concerns about that location. While this was a practical
response to an immediate access concern, it also reflected a reactive measure rather than a
documented site-security plan developed before the event.
The open nature of the event site also affected nearby buildings. Individuals entered the Fugal Gateway
Building and attempted to access an upper balcony area overlooking the event. UVU personnel took
steps to limit access to that area, but the issue illustrates the importance of incorporating adjacent
After-Action Report for Utah Valley University
67
buildings, stairwells, balconies, rooftops, and other elevated viewing areas into site-security planning for
outdoor events.
No attendee screening operation was conducted at entry points, and non-ticketed attendees generally
accessed the event area without passing through a controlled security perimeter. No formal
credentialing process was used to distinguish staff, vendors, media, VIPs, private security personnel,
emergency responders, or other controlled-access groups. While legal and operational factors may
affect what measures are feasible on public University property, the absence of defined site-security
controls reduced UVU’s ability to manage movement, control restricted areas, support screening, and
maintain a clear event boundary.
In the Project Team’s assessment, UVUPD personnel addressed specific access concerns as they
emerged, including the elevated Hall of Flags outdoor pedestrian walkway and access to an upper
balcony area. However, the event was not supported by a documented site-security plan that identified
physical controls, staffing responsibilities, perimeter boundaries, screening-support measures, adjacent
building controls, emergency routes, or backup measures before the event began.
Recommendations related to the issues addressed in this section are included in Section 9.
After-Action Report for Utah Valley University
68
4. Incident Command, Emergency Management, and
Emergency Response Implementation
Section 1 describes the policies, plans, and preparedness framework that existed before September 10.
Section 2 summarizes planning, security, response, and coordination related to the September 10 TPUSA
event. Section 3 addresses event security planning and operations. This section focuses on how specific
emergency management systems were applied in practice on September 10 and where implementation
could be strengthened for future major events and critical incidents.
Emergency management systems are most effective when written plans, command structures,
communications procedures, resource coordination, and decision-making processes are understood
before an incident and applied consistently during an incident. In a university environment, these
systems must account for students, employees, visitors, academic operations, public events, media
attention, outside public safety agencies, legal considerations, and senior leadership decision-making.
4.1 Application of ICS and Event Action Planning
Recognized Practices
Incident Command System (ICS) principles provide a scalable structure for managing both planned
events and emergency incidents. In a university setting, ICS helps clarify event objectives, command
roles, operational assignments, communications procedures, resource needs, contingency plans, and
coordination responsibilities among campus police, emergency management, University leadership, fire
and EMS, communications personnel, facilities, student affairs, partner law enforcement agencies, and
external event organizers.
For major or elevated-risk events, an Event Action Plan or similar operational document is a practical
way to apply ICS principles before the event occurs. An Event Action Plan may document event
objectives, staffing assignments, command structure, communications procedures, access-control
measures, contingency plans, mutual aid resources, and post-event review expectations. The purpose is
not to create unnecessary administrative burden, but to ensure that key assumptions, decisions, roles,
and resource needs are identified and documented before the event.
Event Action Plans are particularly useful when an event involves one or more of the following
conditions:
▪ A high-profile or controversial speaker
▪ Anticipated protest or counter-protest activity
▪ A large or uncertain crowd size
▪ An outdoor venue with open access or elevated-position concerns
▪ An external organizer or private security team
▪ Multiple university departments with operational responsibilities
▪ A need for law enforcement, fire, EMS, or emergency management coordination
▪ Potential need for mutual aid or specialized resources
▪ Significant media, public, or government attention
▪ An elevated risk environment based on a credible threat(s)
After-Action Report for Utah Valley University
69
The following is an example of a standard Incident Command System (ICS) organizational chart based on
models FEMA provides to agencies across the nation. Additional information regarding commonly used
ICS command and general staff positions is provided in Appendix B: Incident Command System Roles
and Responsibilities.
Illustration: FEMA ICS Organizational Chart26
UVU Application and Assessment
UVUPD Policy 429, First Amendment Assemblies, is particularly relevant to the assessment because it
addresses the use of ICS principles for both planned and unplanned UVU events. The policy states that
ICS should be established when resources are deployed for unplanned events and that ICS should be
considered for planned events, including the development of incident-specific operational plans when
appropriate.
Basic planning and coordination occurred before the September 10 TPUSA event. The Major Events
Assessment Committee (MEAC) convened on August 25 via Microsoft Teams, during which University
and UVUPD stakeholders discussed the event and engaged with TPUSA representative Maycee Crofts.
On September 3, Chief Long received a call from Dan Flood, TPUSA Security Supervisor. Chief Long asked
Flood what was needed by TPUSA from the UVU police. Later on September 3, Chief Long called Flood
again to ask whether the event was ticketed. Flood confirmed that TPUSA’s national office in Phoenix
was handling ticketing so TPUSA could gauge how many people planned to attend. Chief Long did not
ask Flood about updated ticketing numbers, nor did Flood offer any information about crowd estimates
from TPUSA’s ticketing process at that time. On September 8 and 10, Chief Long coordinated directly
with TPUSA Security Supervisor Dan Flood by text.
26 Retrieved from https://emilms.fema.gov/is_0552/groups/51.html.
After-Action Report for Utah Valley University
70
Unlike other major events, such as previous commencement activities or concerts, no formal written
Event Action Plan or incident-specific ICS planning document was developed for the September 10
TPUSA event. This was significant because the event involved political activity, a high-profile speaker,
expected protest activity, an outdoor open-access venue, uncertain attendance, a private security team,
and multiple operational concerns involving access control, line-of-sight exposure, staffing,
communications, and emergency response.
The absence of a written operational plan limited the opportunity to formally document planning
assumptions, resource requirements, assignments, communications procedures, contingency plans,
mutual aid thresholds, and real-time monitoring responsibilities. It also limited UVU’s ability to create a
shared written record of decisions regarding the selected outdoor venue, attendance uncertainty,
protest activity, line-of-sight concerns, high-ground vulnerability, TPUSA security coordination, security-
post assignments, and the role of external public safety partners.
The lack of a written Event Action Plan did not mean that planning was absent. Chief Long and other
UVU personnel took practical steps to prepare for the event, including attempting to identify TPUSA
security contacts; contacting SIAC; arranging available UVUPD staffing; responding to TPUSA concerns
regarding the Hall of Flags outdoor pedestrian walkway; clearing, taping off, and posting two UVUPD
officers at the Hall of Flags outdoor pedestrian walkway above the speaker location; and establishing a
Command Post in Room 204 of the Fugal Gateway Building. However, these efforts were not captured in
a formal Event Action Plan that assigned responsibilities, identified resource gaps, clarified command
relationships, or established escalation thresholds before the event began.
In our assessment, the September 10 TPUSA event illustrates the operational value of using ICS and an
Event Action Plan for major events before conditions deteriorate. A scalable Event Action Plan could
have helped UVU document who was responsible for specific functions, how security personnel would
be deployed, how information would move, when additional resources would be requested, how
TPUSA’s security team would be integrated, and how the University would transition from event
monitoring to emergency response if conditions changed. It also might well have highlighted the need
to insist that UVU determine the venue location due to security concerns, as well as insist that the
UVU ticketing system be used instead of TPUSA’s as part of the agreement requirements for using
UVU facilities.
4.2 Implementation of the Emergency Operations Plan
and Active Assailant Protocols
Recognized Practices
An Emergency Operations Plan provides the framework for managing significant incidents. In practice,
an EOP connects field response, emergency communications, EOC operations, executive decision-
making, public information, resource coordination, and recovery efforts. The plan is most useful when
personnel understand their roles, know when and how the plan is activated, and have practiced the
procedures on a regular basis, either in training, such as a practical exercise, or under realistic
conditions.
Recommendations related to the issues addressed in this section are included in Section 9.
After-Action Report for Utah Valley University
71
Active assailant protocols are a critical component of campus emergency preparedness. Effective
protocols emphasize protection of life, rapid law enforcement response, emergency notification,
lockdown or evacuation decision-making, coordination with fire and EMS, public information,
reunification considerations, crime-scene preservation, and transition from immediate response to
investigation and recovery.
Emergency preparedness also depends on whether students, employees, visitors, and event participants
and attendees understand what actions to take during an active threat. Public education and emergency
messaging should reinforce plain-language protective actions, including active assailant response;
lockdown; evacuation; and shelter-in-place.
UVU Application and Assessment
UVU’s Emergency Operations Plan (EOP) is comprehensive and generally aligned with recognized
emergency management practices. The plan incorporates NIMS principles and establishes a framework
for emergency response, resource coordination, emergency communications, executive decision-
making, and recovery activities. The EOP also identifies key leadership positions, outlines Emergency
Operations Center functions, and provides guidance regarding incident management, communications,
resource coordination, and executive decision-making.
The University’s primary guidance for managing active shooter and active-assailant incidents is
contained within the EOP which establishes roles, responsibilities, response procedures,
communications protocols, and coordination mechanisms for managing such incidents. The procedures
were updated in October 2024 and appropriately emphasize rapid law enforcement response,
emergency communications, incident command, resource coordination, and protection of life during a
rapidly evolving crisis.
The September 10 incident placed significant pressure on UVU’s emergency management framework.
The incident involved a high-profile outdoor event, an open campus environment, uncertainty regarding
suspect status, multiple responding agencies, emergency notifications, campus searches, crime-scene
protection, traffic concerns, media attention, and public anxiety. These conditions required rapid
coordination among Chief Long and UVUPD personnel, command post, Dispatch, the Emergency
Operations Center, University leadership, communications personnel, and external public safety
partners.
The incident demonstrated that even well-developed plans can be difficult to execute when personnel
are managing competing operational demands, incomplete information, and rapid escalation. UVU’s
plan had an appropriate written foundation, but implementation depended on how quickly personnel
could activate the relevant structures, understand their roles, obtain accurate information, coordinate
with outside agencies, and communicate protective actions to the campus community.
The September 10 response also underscored the importance of aligning active-assailant protocols
with emergency messaging. Emergency terms and instructions must be understandable to students,
employees, visitors, and event participants and attendees in real time. When emergency messages use
similar-sounding terms or do not provide clear protective actions to take using commonly understood
language, recipients may be uncertain about whether to leave, hide, lock down, shelter, avoid an area,
or wait for further instructions.
After-Action Report for Utah Valley University
72
In our assessment, UVU’s EOP and active-assailant protocols provide an appropriate planning
foundation. The greater opportunity lies in translating those plans into practical tools, training,
exercises, and plain-language emergency instructions that can be used quickly during rapidly
evolving incidents.
4.3 EOC Activation, Situational Awareness, and Decision Support
Recognized Practices
An Emergency Operations Center supports incident management by bringing together personnel,
information, resources, and decision-makers in a coordinated environment. The EOC does not replace
a Command Post or field command. Instead, it supports field operations by maintaining situational
awareness, coordinating resources, supporting emergency communications, documenting decisions,
briefing senior leadership, coordinating with external partners, and helping manage broader
institutional consequences.
Effective EOC operations require clear activation criteria, defined roles, trained personnel, reliable
information flow, shared situational awareness, and a common understanding of decision-making
authority. During a fast-moving incident, EOC personnel need timely and verified information regarding
the nature of the threat, suspect status, victim information, campus conditions, law enforcement
activity, emergency notifications, building status, traffic conditions, media attention, and public safety
partner activity.
For high-profile or elevated-risk events, some institutions use an EOC monitoring posture even when
full activation is not required. This approach allows emergency management, communications, the
Command Post, Dispatch, public safety personnel, senior administration, and Policy Group
representatives to maintain awareness and transition quickly if conditions change. The Policy Group also
plays an important role in communicating with governing bodies and other stakeholders as needed and
supporting the emergency management and business continuity roles and responsibilities identified in
the Emergency Operations Plan.
UVU Application and Assessment
UVU’s Emergency Operations Plan establishes an Emergency Operations Center framework and
identifies key leadership positions, EOC functions, Incident Command System principles, incident
management responsibilities, communications processes, resource coordination mechanisms, and
executive decision-making roles. This framework provided an important foundation for the September
10 response.
Following the shooting, UVU activated its EOC in the Fugal Gateway Trustees Conference Room and
assembled EOC personnel and the University’s Policy Group. EOC members responded quickly and made
substantial efforts to coordinate the University’s response under rapidly evolving circumstances. The
activation itself reflected a prompt good-faith response to a complex emergency.
Recommendations related to the issues addressed in this section are included in Section 9.
After-Action Report for Utah Valley University
73
The incident also exposed several implementation challenges involving EOC leadership, succession,
delegation of authority, communications coordination, law enforcement representation, and situational
awareness. These challenges were not primarily the result of individual performance. Rather, they
reflected the difficulty of applying written EOC procedures during a fast-moving incident when several
key leaders were away from campus, participating remotely, or managing competing responsibilities.
The University’s Emergency Operations Plan designates Val Peterson, Vice President of Administration
and Strategic Relations, as the Emergency Operations Center Manager. At the time of the shooting,
Peterson was approximately 45 minutes from campus. He joined response discussions by speakerphone
while traveling to UVU and remained actively engaged. However, his delayed arrival created a period
during which EOC participants expressed uncertainty regarding leadership responsibilities, decision-
making authority, and message approval processes. Interviews reflected broad confidence in Peterson’s
abilities and qualifications but also indicated that clearer succession and delegation procedures would
have supported EOC operations more effectively during the initial phase of the response.
Peterson also had competing responsibilities during the response, including communications with the
Governor’s Office, preparation for a joint press conference, and assistance with public statements.
These responsibilities required him to divide his attention between EOC management and external
communications activities at critical moments, which led him to move in and out of the EOC during
the incident.
The response was also affected by the physical absence of Robin Ebmeyer, UVU’s Director of Emergency
Management and Safety, who was out of state at the time of the incident. Ebmeyer engaged remotely
by telephone and by the Microsoft Teams online meeting platform, and she worked diligently to support
EOC operations. Her remote participation was valuable, but it also created coordination challenges
because she had significant familiarity with the University’s Rave emergency notification system and
assumed a leading role in preparing and distributing emergency messages.
During the period when both the Vice President of Administration and Strategic Relations and the
Director of Emergency Management and Safety were not physically present in the EOC, some Cabinet
members believed that Jim Mortensen, Vice President of Finance and Auxiliary Services, was in charge.
On September 5, the UVU President issued an email and memorandum designating Mortensen as the
acting administrator and authorized signatory while she was traveling on September 10. That
designation had not been communicated to all Cabinet members, which contributed to uncertainty
regarding Mortensen’s role.
The review also identified a potential inconsistency among the Emergency Operations Plan, the Campus-
Wide Emergency Communication Plan, and UVU’s Green Card succession process. The Project Team
learned that UVU maintains a Green Card which documents EOC members’ roles, contact information,
and succession process on a wallet-sized green card. The succession process identifies the order of
decision-making authority if the University President is unavailable. That succession order appeared to
differ from the September 5 designation of Mortensen as acting administrator and authorized signatory.
At least one version of the Green Card also reportedly listed personnel who were no longer with UVU
(i.e., Police Chief Matthew Pedersen). These inconsistencies can create confusion during a fast-moving
incident when personnel must quickly determine who has authority to approve emergency messages,
direct EOC activity, coordinate with the Policy Group, and make operational decisions.
After-Action Report for Utah Valley University
74
Law enforcement command presence in the EOC was also difficult to maintain. Chief Long and the
limited UVUPD personnel assigned to the event were required to manage competing operational
priorities in the field and in the Command Post. As the incident unfolded, Chief Long moved among
operational responsibilities, which was understandable given the circumstances. However, this limited
his ability to serve as a consistent law enforcement representative within the EOC and contributed to
information-sharing challenges between field operations and University leadership. Several interviewees
noted that there were periods during which no UVUPD command representative was physically present
in the EOC.
UVU had previously identified related issues during its January 2023 active assailant tabletop exercise.
The After-Action Report identified challenges involving communication and situational awareness
between the EOC and Policy Group and recommended additional and ongoing EOC and Policy Group
exercises. Several similar issues resurfaced on September 10, including challenges involving situational
awareness, information sharing, communications coordination, and uncertainty regarding decision-
making authority. The recurrence of similar issues suggests that corrective actions from the 2023
exercise had not been fully implemented or validated before September 2025.
In our assessment, UVU’s written EOC framework was an important strength, and EOC activation
occurred quickly. The primary opportunities for improvement involve succession planning, delegation of
authority, role clarity, communications leadership, remote-participation protocols, information-sharing
procedures, corrective-action tracking, and maintaining a consistent law enforcement command
representative or liaison in the EOC during major incidents.
4.4 Interagency Coordination and Mutual Aid Implementation
Recognized Practices
Major campus incidents often exceed the capacity of a university police department or require
specialized resources not maintained by the institution. Interagency coordination and mutual aid
provide access to additional personnel, equipment, specialized capabilities, investigative support, fire
and EMS resources, emergency management support, traffic-control resources, tactical resources, and
public information coordination.
Effective interagency coordination is built before an incident by establishing formal written agreements,
working relationships, joint planning, shared training, practice exercises, and clear procedures for
requesting and integrating outside resources. For planned events, external resources may be needed
before an emergency occurs. For critical incidents, early integration of outside agencies can support field
operations, campus searches, medical response, investigation, traffic control, emergency
communications, EOC operations, and public information.
During major incidents, outside agencies may arrive quickly and assume or support different operational
roles. Field command, investigative command, EOC coordination, public information, and executive
decision-making may evolve as the incident expands. For that reason, effective interagency coordination
depends on clear liaison roles, current contact information, resource-request procedures, command-
Recommendations related to the issues addressed in this section are included in Section 9.
After-Action Report for Utah Valley University
76
The interview with Keith Stevenson, Emergency Management Director for the City of Orem, further
illustrated the availability of external emergency management support. Stevenson offered assistance
shortly after the shooting and remained at the Orem Emergency Operations Center when he was not
asked to respond to UVU. Orem City officials coordinated fire operations from the Orem Emergency
Operations Center and remained prepared to assist if requested.
Although these relationships were valuable during the response, the Project Team identified that they
were largely informal before the incident. Formal written mutual aid agreements were not in place with
key public safety partners, including OPD, Utah County Sheriff’s Office, and Utah DPS. Written mutual
aid agreements can help define how assistance will be requested, what resources may be available, how
command coordination will occur, how communications will be managed, and how specialized
capabilities may be integrated into major events and emergency incidents.
This is particularly important for major-event planning. External partners may be able to provide
additional sworn personnel, tactical resources, traffic-control support, fire and EMS resources,
emergency management personnel, investigative support, drones, and other specialized capabilities.
For example, the Orem Police Department maintains drone capability that could support situational
awareness during large outdoor events when legally permissible and operationally appropriate. Greater
awareness and pre-event coordination regarding this capability would allow UVU to determine whether
aerial observation should be requested or included in an Event Action Plan.
The incident showed that available external resources were not fully leveraged before the event or
immediately as conditions changed. UVUPD did not initiate outreach to the Orem Police Department or
other local public safety partners before the event to request potential additional security resources or
specialized capabilities. Similar requests were not initiated after UVUPD and other UVU officials
recognized the large crowd size gathering for the event. Given the nature of the event, the open
outdoor venue, uncertainty regarding attendance, line-of-sight concerns, and expected protest activity,
earlier coordination with external partners could have supported a more robust security posture.
The response also demonstrated the need for defined procedures for integrating outside agencies into
Command Posts, EOC operations, field command, investigative command, emergency communications,
and public information functions. As local, state, and federal agencies arrived, command and
investigative responsibilities evolved quickly. The rapid arrival of outside agencies created significant
operational benefits, but it also underscored the importance of defined liaison roles, clear information-
sharing procedures, documented command transitions, and a common understanding of how the EOC
will coordinate with field command and investigative command during a major criminal incident.
In the Project Team’s assessment, UVU’s relationships with external public safety partners were a
significant strength during the September 10 response. Those partners responded quickly and
demonstrated capability and professionalism. The primary opportunities for improvement involve
formalizing mutual aid agreements, establishing clearer thresholds for requesting external support
before major events, defining liaison and integration procedures, maintaining resource inventories,
and conducting joint exercises so external partners can be incorporated effectively into UVU’s
command, EOC, Command Post, communications, investigative, and public information structures.
Recommendations related to the issues addressed in this section are included in Section 9.
After-Action Report for Utah Valley University
77
5. Communications, Security Technology,
and Protective Intelligence
5.1 Communications and Mass Notification
Recognized Practices
Clear, timely, and accurate communications are essential during emergency incidents, particularly
during active-threat, large-crowd, or fast-moving events. Effective emergency communications require
reliable internal coordination, interoperable communications with external responders, pre-approved
message templates, clearly defined authority, and the ability to rapidly disseminate appropriate and
accurate information to multiple audiences through multiple channels.
In a university environment, emergency communications involve several overlapping audiences and
functions. Campus police, Dispatch, emergency management, University leadership, event personnel,
local law enforcement, fire, EMS, students, employees, visitors, and the broader campus community
may all need information at the same time, but not always the same information. Internal responders
often need operational detail, while students, employees, and visitors need clear protective-action
instructions that can be understood quickly under stress.
Illustration: Communications and Mass Notification Example
Recognized practices include maintaining a 24/7 dispatch or communications capability; establishing
internal communications protocols among police, Dispatch, emergency management, leadership, event
personnel, and operational stakeholders; ensuring interoperability with external public safety partners;
using plain-language emergency terminology; developing pre-approved message templates; identifying
message authority and backup authority; using multiple notification channels; regularly testing
After-Action Report for Utah Valley University
78
emergency notification systems; and incorporating communications planning into major-event planning,
tabletop exercises, drills, after-action reviews, and emergency management training.
Emergency messages are most effective when they are concise, action-oriented, and consistent. Public
protective-action messages generally need to explain what is happening, what action to take, what
areas to avoid, and when additional information will be provided. Messages issued during a fast-moving
incident also need to account for uncertainty. When information changes, follow-up messages should
make clear whether protective actions have changed and why.
UVU Application and Assessment
UVU has several important communications and mass notification capabilities in place. The UVUPD
Dispatch Center operates 24 hours a day and serves as a central communications point for campus
safety operations. UVU also uses multiple mass notification tools, providing the ability to communicate
with students and employees through more than one channel during emergencies.
Dispatch staffing is a significant operational consideration. UVUPD Dispatch generally operates with one
dispatcher per shift. During a major incident, one dispatcher may be required to manage simultaneous
responsibilities, including incoming calls for service, radio traffic, officer assignments, external
communications, emergency notifications, system monitoring, and incident documentation. On
September 10, a senior administrative support person in the UVUPD office assisted as a second
dispatcher. That support was valuable, but it was informal and did not reflect a planned event security
or emergency staffing model.
Emergency communications were among the most significant challenges identified during the
September 10 response. Interviews and document review indicate that multiple individuals participated
in drafting, reviewing, approving, and disseminating emergency messages. However, no single individual
was clearly functioning as the designated communications lead responsible for coordinating messaging
strategy, managing approvals, and ensuring timely dissemination of accurate information.
This challenge was compounded by the fact that Robin Ebmeyer, UVU’s Director of Emergency
Management and Safety, was out of state at the time of the incident. Although she engaged
immediately and supported EOC operations remotely, her physical absence created additional
coordination challenges. Because she had significant familiarity with the University’s Rave emergency
notification system and assumed a leading role in preparing and distributing emergency messages,
communications frequently required coordination among individuals operating in different locations
under significant time pressure.
EOC personnel began communicating by telephone, text message, and Microsoft Teams to coordinate
response activities. The first emergency notification to the broader campus community was distributed
at approximately 12:42 p.m., approximately 19 minutes after the shooting. That message advised
recipients that a single shot had been fired and that a suspect was in custody. Subsequent investigation
revealed that the individual initially detained was not the shooter and that the actual assailant remained
unidentified and at large.
After-Action Report for Utah Valley University
80
UVU has begun incorporating the Standard Response Protocol (SRP)27 into its emergency management
program, consistent with its recent adoption within the Utah System of Higher Education. The SRP
establishes five standardized protective actions — HOLD, SECURE, LOCKDOWN, EVACUATE, and
SHELTER — with defined purposes and corresponding instructions. Under the SRP, SECURE generally
directs people to get inside and restrict access because of a threat or hazard outside, an action similar to
a reverse evacuation. LOCKDOWN, by contrast, is used when there is an active or imminent violent
threat requiring occupants to lock or barricade rooms, get out of sight, and take other protective
measures. SHELTER is reserved for hazard-specific protective actions, such as those associated with
severe weather or hazardous materials.
HOLD
Stay in your room
or area.
This may be used if
emergency
personnel are
responding to a
situation that
doesn’t pose a
threat to others in
the building.
SECURE
Get or stay inside.
Lock outside doors.
Used when the
threat is outside the
building or in
another area of
campus. Lock
outside doors and
stay inside until the
“all clear” is
announced.
LOCKDOWN
Locks, lights,
out of sight.
Used for immediate
threats -
typically inside the
building. Lock or
barricade individual
rooms, turn off
lights, and stay out
of sight.
EVACUATE
Get to a safer
location.
An evacuation
order will direct you
to a safer location.
That could be
outside or to
another area in the
building.
SHELTER
Pay attention to the
announced hazard
and instructions.
Instructions will be
based on the
situation – such as
an earthquake or
severe weather.
The Project Team noted that UVU used the emergency terminology “secure-in-place.” However, this
term is not located in UVU’s EOP to describe locking or barricading classrooms and offices in response to
an armed or hostile intruder — actions associated with LOCKDOWN under the SRP. The use of the
term “secure-in-place” created confusion for numerous recipients interviewed. In the context of the
1:36 p.m. message, the direction functioned essentially as an instruction for individuals to remain inside
and limit movement until police could safely escort them from campus. The same phrase therefore had
the potential to convey different protective actions depending on context.
Feedback from student leadership reinforced this concern. The UVU Student Body President, who was
present in the Command Post on September 10 just before the shooting, reported frustration with what
he perceived as delayed and inconsistent emergency alerts, including changes in messaging about
suspect status and protective actions. When asked to review several messages sent during the incident,
he indicated that students may not have understood what action was expected from certain messages,
particularly the direction to “secure-in-place.” His feedback suggested that some messages may have
been understandable in isolation but confusing in context, especially as students were hiding,
27 https://iloveuguys.org/The-Standard-Response-Protocol.html
After-Action Report for Utah Valley University
81
attempting to leave campus, sitting in traffic, or receiving changing information about campus closure
and suspect status.
UVU’s transition to the SRP provides an opportunity to establish a common emergency vocabulary
across emergency plans, alert templates, training, exercises, classroom materials, and public-facing
guidance. Consistent use of the five SRP actions, accompanied by clear hazard-specific instructions,
should reduce ambiguity and help recipients more quickly understand what they are being asked to do
during an emergency.
UVU’s use of multiple emergency notification
tools presents both benefits and challenges.
Redundancy can strengthen emergency
communications when each system has a
defined role, activation protocol, failover
procedure, and testing process. At the same
time, overlapping systems can create
operational complexity, cost, administrative
burden, and uncertainty if personnel are not
clear on which system to use, who activates it, how messages are coordinated across platforms, or how
system performance is measured. This is particularly relevant given UVU’s use of Rave, Alertus, and the
fire suppression system. The red, yellow, and green emergency button system is used to activate an
instantaneous campus-wide emergency alert via email, text and on-campus digital signage. In addition,
separate emergency buttons are located in the fire suppression system panel that personnel use to
activate the audible emergency alert through the speakers located throughout the campus. UVU should
also determine whether any of the other public address systems that exist on campus facilities could be
included in the automated emergency notification system.
While UVU had a system in place on September 10, 2025, to issue immediate campus-wide safety alerts
to students, faculty, and administrators, nineteen minutes elapsed between the shooting and the first
notification issued through UVU’s Rave system. The delay was attributable in part to confusion in the
EOC regarding whether the incident met the criteria for the type of text notification under
consideration, as well as an initial report that a suspect was in custody. The individual who had
identified himself as the shooter, however, was quickly determined not to be the assailant.
This uncertainty underscores the importance of disseminating available information and protective
direction as quickly as possible to those who may be in harm’s way. In the immediate aftermath of an
on-campus shooting, critical facts are often unknown, including whether there are additional shooters,
whether the assailant has moved to another location, or whether other potential victims remain at risk.
Under these circumstances, it would have been appropriate for the UVU Incident Commander to ensure
immediate activation of the red Alertus Active Shooter button in the UVU Dispatch Center, which would
have initiated a Rave emergency alert stating: “UVU Alert: Shooter/Violent Aggressor on Campus. If
Shooter/Violent Aggressor is near Run-Hide-Fight! For more info @ www.uvu.info. Additional messages
to come.” At the same time, activation of the fire suppression system panel switch would have
broadcast the pre-recorded active shooter message over the campus fire alarm speaker system:
“Attention, attention, attention: There is an active shooter on the main campus. Run if it is safe, Hide and
secure your location, Fight to survive.” The Project Team understands that UVU is taking steps to
establish this as the protocol going forward.
After-Action Report for Utah Valley University
82
Mass notification systems also depend on accurate contact data, user participation, system reliability,
and clear activation protocols. UVU should regularly encourage students and employees to update
contact information and evaluate whether message delivery rates meet institutional expectations.
UVU documents indicate that on September 10, 2025, the campus had a population of approximately
35,176 students and employees, excluding enrolled high school students not present on campus. System
records show 31,567 users were targeted to receive RAVE text and/or email notifications representing
approximately 90% of the campus population targeted by email and 67% by text.
Post September 10, UVU has significantly strengthened its RAVE alert system coverage through a
targeted campaign to increase mobile phone numbers on file. Subsequent testing on November 10,
2025, showed 98% of students and 98.6% of employees were receiving text alerts.
Communications planning was also an important event-security consideration. For higher-risk or large-
scale events, communications roles, radio channels, contact numbers, message authority, notification
pathways, public information coordination, and backup procedures are most effective when identified
before the event. For September 10, the Project Team learned that UVU had communications tools
available, but communications planning was not fully integrated into a written Event Action Plan, event-
specific communications plan, or pre-event briefing process.
In the Project Team’s assessment, UVU had important communications capabilities in place on
September 10, including 24/7 Dispatch and multiple mass-notification platforms. The primary
opportunities for improvement involve planned Dispatch surge capacity, clearer communications
leadership, defined message issuance authority, plain-language emergency terminology, pre-approved
templates, backup approval procedures, system coordination, responder interoperability, contact-data
accuracy, and integration of communications planning into major-event preparedness. See Appendix
D.8: Announcements and Scripted Response Protocol Messages for more information.
5.2 Physical Security Technology
Physical security technology can strengthen campus safety when systems are properly selected,
maintained, integrated, monitored, and incorporated into operational planning. The value of these
systems depends not only on the equipment itself, but also on how information is routed to Dispatch,
field personnel, command staff, emergency management, and the Emergency Operations Center during
routine operations, major events, and critical incidents. Additional technical considerations regarding
access control, video surveillance, analytics, dispatch monitoring, panic and duress alarms, emergency
call points, storage, and aerial observation are included in Appendix D.9: Physical Security Technology
Technical Considerations.
Recognized Practices
Integrated Security Systems and Common Operating Picture
Physical security systems are most effective when access control, video surveillance, intrusion detection,
duress alarms, panic alarms, public address systems, lockdown capabilities, and mass notification tools
are connected through defined workflows. Integration allows an alarm, forced door, panic activation, or
Recommendations related to the issues addressed in this section are included in Section 9.
After-Action Report for Utah Valley University
83
other security events to trigger associated video, location information, mapping, and notification to the
monitoring personnel responsible for incident response.
For campus environments, an integrated or unified security platform can help Dispatch and command
personnel maintain a common operating picture. A single interface or coordinated set of interfaces can
reduce the need to monitor multiple disconnected systems, improve response time, support incident
documentation, and allow personnel to understand where an alarm occurred, what cameras are nearby,
what access points are affected, and what resources should be dispatched.
These integrations can improve situational awareness, reduce the time needed to interpret alarms, and
support a more coordinated response by Dispatch, field officers, the Command Post, and the Emergency
Operations Center.
Access Control and Credential Management
Access-control systems support building security by limiting access to authorized individuals based on
role, location, time, and operational need. Effective access-control programs include current credential
records, defined approval authority, role-based access levels, timely deactivation of expired or
unauthorized credentials, oversight of card issuance, and periodic audits of badge-holder information.
For universities, access-control systems are most effective when they are connected to reliable Human
Resources databases, student records, contractor, and visitor-management processes. These
connections help ensure that access privileges change when a person’s role, enrollment, employment,
contractor status, or authorization changes.
Video Surveillance, Analytics, and Real-Time Monitoring
Video surveillance provides deterrence, situational awareness, investigative support, and
documentation. Its operational value is strongest when camera placement is aligned with identified
security concerns, event locations, access points, building entrances, parking areas, elevated positions,
emergency routes, and areas where crowd activity may occur.
Video analytics can add value by identifying defined events or behaviors, such as weapons detection,
perimeter crossing, unauthorized access, loitering, crowd-density changes, wrong-way movement,
objects left behind, tailgating, falls, or movement in restricted areas. Virtual perimeter or video-
geofencing tools may also be used to create a defined electronic boundary around a specific area and
generate an alert when people or vehicles cross into or out of that area. These tools can reduce the
burden on personnel when properly configured, tested, and monitored, but they require clear alert
thresholds, trained users, privacy review, system maintenance, and integration with response
procedures.
Dispatch Monitoring and Event Support
Dispatch is often the point where calls, alarms, radio traffic, video, access control, emergency
communications, and response coordination converge. During major events or critical incidents,
Dispatch may need to manage incoming calls, officer assignments, radio traffic, alarm monitoring, video
review, notification systems, and documentation at the same time. Technology is most effective when
Dispatch has sufficient staffing, programmed views, priority camera feeds, alarm workflows, and
escalation procedures before an incident occurs.
After-Action Report for Utah Valley University
84
Duress, Panic Alarm, and Emergency Call Capabilities
Duress and panic alarm systems can provide rapid notification when employees, students, visitors, or
event personnel need immediate assistance. These systems may include fixed panic buttons, wireless or
body-worn duress devices, emergency call boxes, or other assistance points. Their value depends on
placement, reliability, monitoring, response protocols, location accuracy, training, testing, and
integration with video or access-control systems where appropriate.
Aerial Observation and External Technology Support
Large outdoor events, demonstrations, and high-profile gatherings may benefit from aerial observation
or other external technology support when legally permissible and operationally appropriate. Drone or
aerial observation capabilities can provide situational awareness regarding crowd movement,
pedestrian flow, perimeter concerns, elevated positions, and emergency response routes. If a university
does not maintain this capability internally, mutual aid or interagency support may provide access to
these resources.
UVU Application and Assessment
Integrated Security Systems and Common Operating Picture
UVU has multiple physical security and communications technologies in place, including access control,
video surveillance, Rave, Alertus, public address capabilities, remote lockdown capabilities, radio
communications, license plate readers, and other systems monitored or supported through UVUPD
Dispatch. These systems provide important operational capabilities.
The Project Team identified opportunities to improve how systems work together. Some security-
related technologies operate as separate systems rather than as part of a fully integrated common
operating picture. When systems are not integrated, Dispatch or command personnel may need to
move between platforms to understand what occurred, where it occurred, what video is associated with
the event, and what response is needed. This can slow response, increase the burden on Dispatch
personnel, and reduce situational awareness during fast-moving incidents.
A more integrated environment could allow alarms, forced doors, panic activations, or other defined
events to call up associated video, display location information, support mapping, and assist Dispatch or
command personnel in coordinating a response. This type of integration is particularly important during
major events and active incidents, when multiple systems may be generating information at the same
time.
Access Control and Credential Management
UVU uses an industry-recognized access-control system. Facilities or Physical Plant personnel assign
access to employees, students, and contractors for specific buildings, rooms, days, and times, as well as
manage activation and deactivation of access-control cards.
The access-control system provides an important foundation for managing access to campus buildings
and restricted areas. The Project Team identified opportunities to strengthen governance of the access-
control program, including credential audits, timely deactivation of expired or unauthorized badges,
role-based access controls, oversight of card issuance, and integration with student or employee records
where feasible.
After-Action Report for Utah Valley University
85
Operational considerations related to when access-control systems are active were identified.
Information provided during the review indicates that select access-control points may be turned off
during business hours. While this may support ease of movement during normal operations, continuous
access-control monitoring can strengthen awareness of doors that are forced open, held open, or
accessed outside expected patterns. Decisions regarding 24-hour access-control operation should be
based on building function, occupancy, security profile, operational needs, and emergency access
requirements.
Video Surveillance, Analytics, and Real-Time Monitoring
UVU maintains an extensive network of security cameras throughout campus. During the September 10
TPUSA event, however, no individual had been specifically assigned to monitor camera feeds in real time
for security purposes. UVUPD personnel were able to review recorded footage rapidly after the shooting
to identify the suspect’s apparent route of travel and obtain images of the suspect entering campus
before the attack. This use of video was valuable to the post-incident investigation.
Cameras were used primarily as a post-incident investigative resource rather than as a real-time
situational awareness tool. For high-profile outdoor events, active monitoring of camera feeds can
support crowd management, identify suspicious activity, improve coordination of security resources,
and provide earlier awareness of emerging concerns. Given the camera coverage already in place
throughout campus, this represents an opportunity to leverage existing resources more effectively.
Information provided during the review indicated that video coverage does not extend to all interior
and exterior areas of campus. Gaps in camera coverage can limit deterrence, delay detection, reduce
available evidence, and impair response capabilities. Future camera planning should be guided by
security considerations, event locations, access points, parking areas, building entrances, pedestrian
pathways, elevated positions, and other priority areas.
Video analytics may also provide value for selected locations and events. For example, analytics could
be configured to detect human activity on rooftops or in restricted areas, alert Dispatch when defined
thresholds are met, support crowd monitoring, identify perimeter crossing in specific camera views, or
create virtual boundaries around sensitive areas. These capabilities should be carefully configured and
tested so alerts are meaningful, reliable, and actionable.
Dispatch Monitoring and Event Support
The UVUPD Dispatch Center operates 24 hours a day and serves as a central point for campus safety
communications and system monitoring. Dispatch monitors or supports numerous campus safety and
security systems, including access control, radio communications, video surveillance, emergency
notification tools, public address capabilities, lockdown systems, panic alarms, and other technologies.
During major events, the volume of information available to Dispatch may exceed what a single
dispatcher can reasonably monitor while also managing calls, radio traffic, officer assignments,
emergency notifications, and documentation. This issue is addressed in Section 5.1, but it also has direct
implications for physical security technology. Technology-enabled situational awareness depends on
having trained personnel available to actively monitor relevant systems and communicate useful
information to field personnel, command staff, the Command Post, and the EOC.
After-Action Report for Utah Valley University
86
For the September 10 TPUSA event, UVUPD established a Command Post in a second-floor conference
room within the Fugal Gateway Building. This location provided a strong vantage point over the event
venue and allowed University personnel to observe much of the crowd, monitor protest activity, and
maintain visual awareness of the event area before and during the incident. The selection of this
location was a strength and reflected thoughtful use of an available observation point. Future major-
event planning would benefit from pairing these types of physical observation points with assigned
technology monitoring roles, priority camera views, and defined reporting procedures.
Duress, Panic Alarm, and Emergency Call Capabilities
UVU does not have a comprehensive interior or exterior panic alarm system. Panic alarms, duress
devices, and emergency call points can provide another method for summoning assistance when a
person is unable to call Dispatch directly or when a situation is escalating quickly.
These systems may be particularly useful in higher-risk public-facing offices, student service areas, event
venues, parking areas, isolated exterior locations, or locations where employees regularly manage
conflict, emotional distress, or volatile interactions. Their value depends on reliable location
information, clear response protocols, regular testing, user training, and integration with Dispatch and
video surveillance where feasible.
Aerial Observation and External Technology Support
The September 10 incident highlighted the potential value of aerial observation for large outdoor
events. UVUPD did not possess unmanned aircraft systems capable of providing aerial surveillance
during the event. Neighboring agencies, including the Orem Police Department, maintain drone
capabilities that are available through mutual aid or interagency support arrangements.
Given UVU’s campus layout, including multiple elevated vantage points overlooking major gathering
areas, aerial observation may provide useful situational awareness during large outdoor events,
demonstrations, and other high-profile activities when legally permissible and operationally appropriate.
This capability could be incorporated into mutual aid planning, Security Assessments, and Event Action
Plans for major outdoor events.
5.3 OSINT, Web, and Social Media Monitoring
Recognized Practices
Effective campus safety, event security, and behavioral threat assessment programs increasingly rely
on open-source intelligence (OSINT), web-based research, social media monitoring, and protective
intelligence capabilities. These capabilities complement internal reporting, law enforcement records,
behavioral threat assessment processes, event planning, and external intelligence resources.
For institutions of higher education, the purpose of these capabilities is not limited to monitoring
general public sentiment or media coverage. Mature programs also include the ability to identify, assess,
and monitor potential persons or groups of concern when there is a nexus to the institution, its people,
Recommendations related to the issues addressed in this section are included in Section 9.
After-Action Report for Utah Valley University
88
The University also utilizes Sprout Social to support social media management and monitor engagement,
reach, and traction associated with topics of interest to the institution. While Sprout Social contains
certain social listening capabilities, Campus Sonar remains the University’s primary platform for
monitoring online conversations and sentiment related to emerging issues and events.
University Communications personnel also utilize Meltwater to monitor traditional and online media
coverage, track news reporting, and identify developing issues receiving public or media attention.
Collectively, Campus Sonar, Sprout Social, and Meltwater provide UVU with meaningful visibility into
media coverage, social media activity, public sentiment, and event-related discussion. 30
These tools are valuable, but they are not designed to serve as dedicated protective intelligence or
subject-focused investigative platforms. They are better suited to understanding broader conversation,
public sentiment, media activity, and institutional reputation than conducting comprehensive
investigations of specific persons or groups of concern.
UVUPD personnel maintain access to criminal justice databases, law enforcement records systems, and
calls-for-service information through the Utah County Spillman Flex system. These resources provide
valuable investigative information regarding criminal history, prior law enforcement contacts, protective
orders, and other indicators relevant to threat assessment and investigative activities.
A significant strength of UVU’s current intelligence capability is its relationship with the Utah SIAC. SIAC
provides threat assessments, suspicious activity reporting intake, criminal intelligence support, targeted
violence prevention resources, and information sharing with federal, state, and local public safety
partners. The SIAC Threat Management Unit also provides training, investigative consultation, and
support to multidisciplinary threat assessment and management teams. 31 Interviews indicated that SIAC
serves as the University’s primary source of threat-related intelligence and protective intelligence
support, with Chief Long and UVUPD acting as the primary conduit for intelligence sharing and
coordination.
Intelligence-related activities currently occur across several functions, including UVUPD, Marketing and
Communications, the Free Speech Committee, and members of the Behavior Assessment Team (BAT).
Behavioral concerns may originate from multiple sources, including faculty and staff referrals, SafeUT
submissions, Title IX reports, student concerns, law enforcement contacts, and BAT referrals.
Information gathered through social media monitoring, media monitoring, open-source research, law
enforcement records, and SIAC coordination may be shared with stakeholders involved in threat
assessment, event planning, and campus safety decision-making.
While UVU possesses several valuable intelligence-related resources, current capabilities are primarily
focused on social listening, media monitoring, law enforcement intelligence, and communications
awareness rather than subject-focused protective intelligence investigations. When an individual
becomes the subject of a BAT assessment or threat management inquiry, there does not appear to be a
formalized process, dedicated capability, or specialized platform for conducting comprehensive open-
source research regarding that individual.
30 Meltwater. https://www.meltwater.com/en/our-story. Accessed June 13, 2026.
31 The Utah Statewide Information and Analysis Center. https://siac.utah.gov/threat-management/. Accessed June 1, 2026.
After-Action Report for Utah Valley University
89
Open-source information is gathered on an informal and case-by-case basis, often relying upon the
initiative of individual BAT members, UVUPD personnel, or other stakeholders. Responsibility for
collecting, analyzing, documenting, retaining, and integrating open-source information is distributed
among multiple stakeholders without a clearly defined protective intelligence function responsible for
supporting elevated-risk cases, event-security planning, or targeted violence prevention efforts.
The Project Team also identified instances where social media reviews of persons of concern were
conducted using personal social media accounts. Although well-intentioned, this practice introduces
unnecessary operational security, privacy, documentation, and investigative integrity concerns. Threat
assessment-related inquiries should be conducted using authorized, agency-managed investigative
accounts or approved investigative methods, with appropriate legal, privacy, documentation, and
supervisory controls.
UVU has several meaningful intelligence and monitoring resources, including Campus Sonar, Sprout
Social, Meltwater, Spillman Flex, and SIAC access. These capabilities provide important awareness of
public discourse, media coverage, social media activity, criminal justice information, and threat-related
intelligence. However, subject-focused protective intelligence requires different procedures, training,
tools, and governance than general social listening or media monitoring. The primary opportunity is to
create a more structured protective intelligence capability that defines when subject-focused OSINT is
needed, who is authorized to conduct it, how legal and privacy issues are reviewed, how information is
documented, how findings are shared with the BAT, UVUPD, Emergency Management, Event Services,
Communications, legal counsel, SIAC, or other appropriate stakeholders, and how the information
informs threat assessment, event planning, and protective decision-making.
Additional technical considerations regarding OSINT governance, investigative accounts, operational
security, specialized platforms, analyst qualifications, documentation, retention, and dissemination are
provided in Appendix C: OSINT and Protective Intelligence Technical Considerations.
5.4 Information Sharing and Protective Intelligence
Recognized Practices
Effective prevention and response to targeted violence on a higher education campus depend on timely,
accurate, and actionable information sharing across institutional and external partners. Institutions are
increasingly expected to integrate campus-based intelligence efforts with broader local, state, and
federal information-sharing ecosystems to identify emerging threats, assess risk, and coordinate
protective actions.
This section examines the institution’s use of national platforms such as the Homeland Security
Information Network (HSIN) and engagement with regional fusion centers and other intelligence-sharing
mechanisms. It also evaluates the extent and effectiveness of collaboration with peer institutions, law
enforcement agencies, and public-private partners to support threat awareness and mitigation.
Recommendations related to the issues addressed in this section are included in Section 9.
After-Action Report for Utah Valley University
90
Particular attention is given to how information is shared and operationalized before, during, and after
critical incidents, including the clarity of roles, timeliness of communication, and integration of
intelligence into decision-making processes. The review assesses both formal protocols and informal
practices that support situational awareness and coordinated response.
Digital security considerations are also relevant to protective intelligence and event security when
online activity creates risk to people, facilities, or events. For UVU, this may include monitoring for
threatening online communications, doxxing or exposure of personal information, fixation on university
leaders or high-profile guests, hostile event-related discourse, and online activity involving persons of
concern. These issues should be distinguished from broader cybersecurity functions, such as network
protection, wireless security, and system intrusion prevention, which are more appropriately addressed
through UVU’s information security program or a separate cybersecurity assessment.
A prime example of information sharing and protective intelligence
dissemination with federal partners is the FBI InfraGard Program.32 The Salt
Lake City InfraGard Members Alliance33 is a non-profit organization dedicated
to the protection of our nation’s critical infrastructure. Through a trusted
partnership with the FBI, the InfraGard Program facilitates the sharing of
intelligence, education, and security practices among the private and public
sectors across Utah and Wyoming. Their mission is to enhance the collective
security of the region and state through proactive communication and unified
outreach.
Illustration: Protective Intelligence and Information Sharing Ecosystem
32 InfraGard. Welcome to InfraGard. https://infragard.fbi.gov/
33 Salt Lake City InfraGard Members Alliance. https://www.slcinfragard.org/
After-Action Report for Utah Valley University
91
UVU Application and Assessment
The September 10 planning process illustrates the importance of documenting how threat-related
information from SIAC, law enforcement partners, open-source research, event organizers, and
University personnel is received, evaluated, assigned for follow-up, and incorporated into event-security
decisions. When threat-related information is received before a major event, the planning record should
identify what was received, who reviewed it, what follow-up occurred, whether the information was
connected to the event, and whether it affected staffing, venue, access control, communications, or
mutual aid decisions.
SIAC’s existing intelligence and information-sharing capabilities also present an opportunity for UVU.
Information provided to the Project Team indicates that SIAC uses Kaseware as part of its investigations,
intelligence, and information-sharing environment. Rather than developing a wholly separate capability,
UVU should explore whether and how SIAC’s existing platform, analytical resources, and information-
sharing workflows could support UVU’s protective intelligence, suspicious activity reporting, major-
event planning, and threat assessment needs.
This exploration should not be limited to technology acquisition. Any future capability should be
evaluated as part of a broader governance model that addresses legal authority, privacy, data
ownership, user access, auditability, information retention, investigative standards, and coordination
among UVU, SIAC, UVUPD, the BAT, Emergency Management, and other appropriate stakeholders.
Additional technical considerations regarding intelligence platforms, OSINT tools, and potential SIAC
collaboration are included in Appendix C: OSINT and Protective Intelligence Technical Considerations.
Recommendations related to the issues addressed in this section are included in Section 9.
After-Action Report for Utah Valley University
92
6. Behavioral Threat Assessment and Threat Management
This section addresses UVU’s Behavior Assessment Team (BAT) structure, reporting and case
management processes, information-sharing practices, use of open-source and protective intelligence,
integration with security planning, training, intervention resources, and related institutional policies.
The Project Team notes that the BAT was not involved in the planning for, response to, or events
surrounding September 10, 2025 because no internal credible threat had been identified. Accordingly,
the observations and recommendations in this section are forward-looking and are intended to identify
opportunities to strengthen UVU’s behavioral threat assessment and management capabilities as part of
its broader efforts to enhance campus safety and security.
Institutions of higher education play a critical role in identifying, assessing, and managing behaviors that
may indicate an elevated risk of targeted violence or other harmful outcomes. Nationally recognized
guidance from the U.S. Secret Service National Threat Assessment Center (NTAC), Federal Bureau of
Investigation (FBI), National Association for Behavioral Intervention and Threat Assessment (NABITA),
Association of Threat Assessment Professionals (ATAP), International Association of Campus Law
Enforcement Administrators (IACLEA), and other professional organizations consistently emphasizes the
importance of a formal multidisciplinary threat assessment and management capability.
Effective programs typically include:
▪ Clearly defined governance, authority, and operating procedures
▪ Multidisciplinary participation representing key institutional stakeholders
▪ Multiple reporting pathways and a strong reporting culture
▪ Structured assessment methodologies
▪ Centralized case management and documentation systems
▪ Appropriate information sharing practices
▪ Integration of behavioral assessment, intelligence gathering, and protective measures
▪ Access to mental health resources and intervention services
▪ Access to licensed clinical or forensic psychology expertise trained in violence risk assessment
▪ Ongoing training and professional development
Today’s threat assessment programs focus not only on direct threats but also on patterns of concerning
behavior, grievances, fixation, leakage, stalking, deterioration in functioning, and other pathway warning
behaviors34 that may precede violence.
6.1 Team Structure, Governance, and Case Management
UVU has maintained a multidisciplinary Behavior Assessment Team (BAT) for approximately 14 years
and has established a mature behavioral intervention capability that aligns with many accepted higher
education best practices.
34 Reid Meloy, J. R., Hoffmann, J., Guldimann, A., & James, D. (2012). The Role of Warning Behaviors in Threat Assessment:
An Exploration and Suggested Typology. Behavioral Sciences & the Law, 30(3), 256–279. https://doi.org/10.1002/bsl.999.
After-Action Report for Utah Valley University
94
Governance Documentation
The Project Team reviewed the document entitled Behavior Assessment Team (BAT): Behavior
Intervention and Threat Assessment Utah Valley University, which serves as the primary operating
framework for the BAT. The document is comprehensive and reflects many best-practice principles
related to team composition, referral processes, information sharing, assessment methodologies,
intervention planning, and case management.
BAT leadership advised that the document remains in draft status because it is continually reviewed and
updated to reflect evolving practices and institutional needs. While periodic review and revision are
hallmarks of effective threat assessment and management programs, maintaining foundational
governance documents in perpetual draft status may create ambiguity regarding institutional approval,
authority, accountability, and operational