Volume 7 Number 1

Introduction

Incidents of intentional mass violence continue to threaten civilian populations and challenge response agencies worldwide. While law enforcement has shifted from containment to rapid engagement and neutralisation of threats, the optimal timing for deploying medical resources remains unclear. In many cases, delays in treating and evacuating casualties stem from perceived or unknown threats—often worsened by poor communication—rather than an actual ongoing danger.¹

Time to definitive care is the only independent variable consistently linked to improved survival in severe injury.² Severely bleeding patients cannot afford delays, making the reduction of the ‘therapeutic vacuum’—periods where critical medical care is unavailable—a key priority.

This descriptive analysis reviewed terrorist attacks over a 10-year period to examine the characteristics and duration of the active threat phase. The primary aim was to define the typical timeframe of armed assault attacks in developed countries. Secondary analysis assessed whether law enforcement responses influenced threat duration or casualty numbers, and whether weapon type correlated with attack length or lethality. The findings aim to inform medical response planning in high-threat environments.

Methods

This study used the Global Terrorism Database (GTD), an open-source dataset covering terrorist events worldwide from 1970 to 2020. The search focused on successful armed assault incidents in developed regions—Australasia and Oceania, North America, and Western Europe—to explore the typical duration of attacks where mature emergency response systems are in place. While acknowledging that mass violence extends beyond terrorism, only GTD-classified terrorist events were included for consistency.

Inclusion required corroborating data from independent media or official post-incident reports detailing clear start and end times or attack duration. One researcher cross-referenced open-source reports with GTD identifiers, while a second independently verified findings. Discrepancies were resolved through consensus, with additional sources were consulted if needed. Start time was defined as the onset of violence; end time marked resolution of the active threat. Where conflicting times were reported, the mean was used.

For complex, multi-location attacks, each site was treated as a separate event, in line with GTD protocol. The active threat phase for each location was recorded individually.

Descriptive statistics were used for analysis. Secondary variables—including incident resolution, weapon type, attacker ideology, and casualty count—were examined for potential correlations.

Inclusion criteria

The study examined attacks from 1 January 2010 to 31 December 2020. Only GTD-classified ‘Armed Assault’ events with at least one casualty (excluding the offender) were included. Vehicle ramming attacks were excluded unless part of a multi-modal assault. Eligible incidents targeted civilians or law enforcement/military personnel in public spaces outside conflict zones. Assassinations, isolated assaults, and prison-related incidents were excluded. Cross-referencing required a minimum of two independent sources. Where an event transitioned to a siege, only the active threat phase before the siege was analysed.

Results

Between 1 January 2010 and 31 December 2020, 58 incidents met the inclusion criteria. The median duration of the active threat phase across all events was six minutes. The median number of injured was five, with four fatalities, resulting in a median of 8.5 total casualties and a median fatality rate of 41%.

Analysis by weapon type showed that incidents involving both firearms and melee or edge weapons had the longest median duration at 10 minutes, with 11 injured and five deceased, yielding 16 total casualties. Despite the higher casualty count, the fatality rate (31%) was lower than in incidents involving firearms alone. Firearm-only attacks had a median duration of six minutes, with eight injured and five deceased, and a higher fatality rate of 45%.

When stratified by firearm velocity, high-velocity weapons were associated with greater lethality, with a median of 17 deceased and 24 total casualties, compared to five deceased and nine casualties for low-velocity firearms. Melee or edged weapon attacks were shorter in duration (median four minutes), with fewer injured (three), fewer deceased (two), and a lower fatality proportion of 22%.

Event resolution was also associated with differing casualty profiles. Incidents in which the attacker fled had the highest median number of fatalities (17) and total casualties (29). Events resolved by law enforcement killing the offender had a median duration of six minutes, with four injured and four deceased (7.5 total casualties). Arrest or surrender resulted in a slightly longer median duration (eight minutes) but fewer casualties overall (three deceased, five total). Attacks ending in suicide had a median duration of eight minutes, with 13 injured and four deceased, totalling 16 casualties.

Analysis by perpetrator motivation showed that religiously motivated attacks had slightly fewer injured (median 4.5) and deceased (3.5) than non-religiously motivated events (seven injured, four deceased), though the duration of the active threat phase remained consistent at minutes minutes for both. The fatality proportion was higher in religiously motivated incidents (41% vs 33%).

When analysed by duration, 29% of events lasted less than three minutes, with a median of three injured and two deceased. Attacks lasting three to six minutes accounted for 28% of cases, with 4.5 injured and 4.5 deceased. Events lasting seven to 10 minutes represented 21% of the total and had a higher casualty burden, with 12 injured and 4.5 deceased. The remaining 22% of attacks exceeded 10 minutes in duration, with a median of five injured and four deceased.

 

Table 1. Event characteristics split by weapon and resolution

 

Table 2. Event Characteristics Split by Event Duration

 

Figure 1. Median time until resolution

 

Figure 2. Median casualty counts

 

Discussion

The active threat phase of armed attacks is typically brief yet highly lethal. This study shows a sharp rise in casualties within the first 10 minutes, after which injury rates decline. However, the fatality rate remains relatively constant during this period. This trend likely reflects a decreasing pool of accessible victims as individuals flee or take cover, while those with survivable injuries may die due to delayed medical access. While considerable progress has been made to ‘stop the killing,’ efforts must now focus on ‘stopping the dying’.⁴

Although outside the scope of this study, a critical question remains: are fatality rates during these incidents primarily driven by ongoing threats, or by delayed casualty access and evacuation? The answer is unclear, but the need to improve early access to definitive care for salvageable patients is evident.

How the incident was resolved did not correlate with event duration. While specific factors influencing perpetrator flight (or suicide) were not captured, rapid and coordinated law enforcement action likely contributed to shorter duration events and fewer fatalities. These findings reinforce the principle that neutralising the threat is a prerequisite for delivering effective medical care.

The data support the evolving doctrine of rapid threat suppression by law enforcement.⁵ Incidents where the threat was clearly resolved—either by perpetrator suicide or law enforcement action—were associated with fewer fatalities. This may reflect greater confidence among responders to commit medical teams once the scene is confirmed safe, compared to situations with unresolved or ambiguous threats.

Most attacks involved ten or fewer casualties, a finding with important planning implications. While large-scale attacks remain possible, the data suggest that a small, well-trained cadre of forward medical responders is sufficient for the early phase of most incidents.

Attacker ideology—religious or otherwise—did not significantly influence event duration or casualty numbers, indicating that such motivations are more relevant to target selection than to acute tactical or clinical response.

As expected, firearms—especially in combination with other weapons—were associated with longer durations and higher casualty counts. Firearms allow attackers to engage from a distance, prolonging threat exposure and complicating response. In contrast, melee weapon attacks, which require close contact, tended to be shorter duration and less lethal.

These findings underscore the urgency of applying Tactical Emergency Casualty Care (TECC) principles in the early phase of response.⁶ Life-saving interventions such as haemorrhage control often need to occur before full scene clearance, posing a tension between responder safety and casualty survival. While tactical teams often include medics, their primary focus is team care. This study highlights the need to expand medical roles to include early care for civilian casualties in threat environments.⁷

No chemical, biological, radiological, or nuclear (CBRN) attacks were identified in the dataset. While CBRN preparedness remains essential, historical data suggest that managing injury (especially haemorrhage control) should remain the primary focus of counter-terrorism medical planning.

Limitations and future directions

This study analysed a relatively small dataset, focusing exclusively on events recorded in the Global Terrorism Database (GTD). While relevant incidents beyond formal terrorism definitions exist, using the GTD ensured a consistent and structured method of case identification and preserved data integrity. However, the limited sample size restricts the ability to draw statistically significant conclusions, and findings are instead descriptive.

Interpreting attacker intent is inherently complex. This study included incidents where perpetrators engaged or attempted to engage multiple victims, regardless of whether the attack was interrupted by law enforcement, suicide, or civilian action. All events involved access to public spaces with potential victim pools, even when actual casualties were low.

A minority of attacks transitioned into siege or barricade situations. In such cases, only the initial active assault phase was analysed to focus on the period most relevant to prehospital response planning, excluding subsequent injuries or deaths during standoffs.

While the study highlights the presence of a therapeutic vacuum in intentional mass violence, it did not capture real-time medical response data. Similarly, the psychological and tactical factors leading to attacker suicide or flight were not examined. Notably, the therapeutic vacuum is not unique to armed assaults—it has also been observed in bombings (such as the Manchester Arena attack⁸) and is likely in CBRN events.

Future research should incorporate prehospital timelines, tactical response sequencing, and behavioural analysis of perpetrators. These elements are critical to developing integrated, threat-informed trauma systems capable of delivering timely care in high-threat environments.

Conclusion

In developed nations, terrorist attacks typically involve conventional weapons, with catastrophic haemorrhage likely a leading cause of preventable death. A therapeutic vacuum inevitably exists due to the complexity of threat environments and the hesitation to deploy unarmed medical personnel during ongoing operations.

This study found that the active threat phase is usually brief, with most casualties occurring within the first 10 minutes. These findings support the early integration of medical teams—alongside law enforcement—to deliver point-of-injury care, including haemorrhage control and rapid extrication, even before scenes are fully secured.

Although outside the direct scope of this analysis, the data suggest that higher fatality rates may be linked to delays in care caused by uncertainty over the threat status. This hesitation highlights the need for jurisdictions to develop capabilities that support early medical intervention despite residual risk.

Adopting integrated warm zone models—such as the Rescue Task Force—is recommended. These teams should operate under unified, multi-agency command with robust information-sharing and joint risk assessment protocols to ensure the timely and safe deployment of medical responders in high-threat environments.

Conflict of interest

The authors declare no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.

Funding

No funding was received for the conduct of this research.

Disclosures

The views expressed in this manuscript are those of the authors and do not reflect official Australian Defence Force policy or endorsement. Nor do they represent the views of any other state or federal law enforcement or emergency response agency.

Author(s)

Sam Miletta^1,2*, Aldon Delport¹, Patrick Weinrauch^1,3, Simon Hendel^3,4,5, Liam Hemingway^6
1Counter-Terrorism and Operational Medicine Program, Central Queensland University, Australia
²Operational Firefighter, Melbourne, Australia
³Australian Defence Force
⁴National Trauma Research Institute, Monash University, Victoria, Australia
⁵Trauma Service, Alfred Health, Victoria, Australia
⁶Department of Paramedicine, Monash University, Victoria, Australia

*Corresponding author email s_miletta@outlook.com.au

References

1. Vize R. Fast response to terror attacks saves lives: UK medics should not be held back. The Guardian. 2020 Feb 7. https://www.theguardian.com/society/2020/feb/07/fast-response-to-terror-attacks-saves-lives-uk-medics-should-not-be-held-back
2. Shackelford SA, Del Junco DJ, Mazuchowski EL, Kotwal RS, Remley MA, Keenan S, et al. The Golden Hour of Casualty Care: Rapid handoff to surgical team is associated with improved survival in war-injured US Service members. Annals of Surgery. 2024;279(1):1–10. doi: 10.1097/SLA.0000000000005787
3. National Consortium for the Study of Terrorism and Responses to Terrorism START. Global Terrorism Database (GTD) 1970-2020 [data file]. START; 2022. https://www.start.umd.edu/data-tools/GTD
4. Park CL, Langlois M, Smith ER, Pepper M, Christian MD, Davies GE, et al. How to stop the dying, as well as the killing, in a terrorist attack. The BMJ. 2020;368:m298. doi: 10.1136/bmj.m298
5. Martaindale MH, Blair JP. The evolution of active shooter response training protocols since Columbine: lessons From the Advanced Law Enforcement Rapid Response Training Center. Journal of Contemporary Criminal Justice. 2019;35(3):342–356. doi: 10.1177/1043986219840237
6. Callaway DW, Smith ER, Shaprio G, Cain JS, McKay SD, Mabry RL. The Committee for Tactical Emergency Casualty Care (C-TECC): evolution and application of TCCC Guidelines to civilian high threat medicine. Journal of Special Operations Medicine. 2011;11(2):94–99. https://www.c-tecc.org/images/content/C-TECC-JSOM-Spring-11.pdf
7. Eastridge BJ, Mabry RL, Seguin P, Cantrell J, Tops T, Uribe P, et al. Death on the battlefield (2001-2011): Implications for the future of combat casualty care. Journal of Trauma and Acute Care Surgery. 2012;73(6,Sup5):431–437.
8. Parveen N. “Significant flaws” by police led to delays in treating Manchester Arena victims. The Guardian. 2020, Sep 9. https://www.theguardian.com/uk-news/2020/sep/08/greater-manchester-force-had-no-plan-to-police-arena-on-night-of-bombing
9. Mueck R. Active shooter incidents: the rescue task force concept. DomesticPreparedness.com; 2017, Sep 20. https://www.domesticpreparedness.com/healthcare/active-shooter-incidents-the-rescue-task-force-concept/