Incident Command and the Failure at Butler, Pennsylvania 

By Steve Hooper, Professor 

Event and Timeline 

The crowd was gathering as they weathered the high late afternoon temperatures, unusual for the Butler, Pennsylvania area. Security was typical, a combination of state, local, and federal resources scattered through the public park venue.

The United States Secret Service had completed its security advance a week earlier and had positioned personnel in the appropriate locations to provide a secure environment for the rally by former President and current presidential candidate Donald J. Trump. The security advance, the security procedures, and security team communications are all topics of this critical review of security processes and procedures. 

As the event commenced, the following timeline represents events as they occurred. At 5 p.m., a man described by witnesses as “suspicious” was seen walking around the event sight and near a structure on the property. At 5:20, Butler Police, who are part of the security operation, are made aware of the suspicious man. From 5:20 to 6:02, the man roams freely without being confronted by security elements.

He remains in the area and within view of attendees and police. At 6:02, former President Trump takes the stage to begin speaking to the crowd. At 6:09, rallygoers start pointing and advising police that the man is climbing up to the roof of the structure with what appears to be a rifle. A Butler Police Officer attempts to climb onto the roof and confront the suspect.

The man with the rifle points the weapon at the officer as he crests the edge of the roof causing the officer to retreat for cover. Secret Service and local police counter-sniper teams are in place and can see the rooftop and the shooter.

At 6:11, three shots ring out and former President Trump is struck. Secret Service detail agents rush the stage and surround the injured President. After forcing him to the ground more shots are fired from the rooftop. Secret Service agents move the former President from the stage and to a safe area. Eventually, President Trump is moved to an awaiting vehicle and rushed to the hospital. 

The shooter, firing the shots from the rooftop of the nearby structure, is shot, and killed by Secret Service counter snipers.  

Although many watching began wondering “why” someone would attempt to kill the former President, I joined many of those who understand executive protection and began asking “how”? 

Incident Command Failures 

The critical failures that lead to this catastrophic and historic event come down to the use, misuse, or lack of use of the basic Incident Command process as established by the Department of Homeland Security of which the Secret Service is a member agency. The Incident Command System (ICS) is a formal process established under the National Incident Management System (NIMS).  

For background, in the decades preceding the attack of 9/11/2001, the United States National Security footprint was a bifurcated process with each agency having to establish and play by its own processes and rules. This splintered approach lacked the foresight necessary to form a homeland security mechanism to prevent a large-scale terror attack.

In defense of the United States Intelligence Community (USIC) and its members, no single agency was built for this type of mission. The FBI, for example, was primarily a law enforcement agency. An agency that arrived after the crime had been committed investigated the crime and identified those who committed the crime. The 9/11 and Al Qaeda changed all that. 

In the decades after the attacks, the citizens of the United States heard a steady beat of “Never Again.” This caused the national security footprint to be morphed and enhanced to establish a prevention capability and response capability. The most meaningful change to the national security world was the creation of the Department of Homeland Security (DHS) and the movement and combination of several existing federal law enforcement agencies. The new DHS also established many new preparedness and response processes and capabilities in pursuit of the goal of “Never Again”. 

One of the agencies designated as part of the new Department was the Federal Emergency Management Agency (FEMA). FEMA’s role in the national security process includes dozens of certifications as part of the National Preparedness System.

DHS, through NIMS, mandated all federal agencies and recommended all state and local agencies be trained and certified in Incident Command (ICS). The U.S. Secret Service (USSS) was another agency that moved after 9/11. The USSS was part of the Department of the Treasury due to its criminal investigation responsibility into financial crimes. The USSS was reassigned to DHS due to its primary national security role as executive protection of the President and Vice-President. 

After all the re-organization and agency building since 2001, one must wonder how the incident that unfolded during former President Trump’s event could possibly occur. The procedures dictated by the ICS process should lead to the implementation of all systems and procedures necessary for a presidential event.

Preparedness and prevention are the trademark of DHS and its FEMA component through the National Preparedness System. All federal agencies should be operating in sync and seamlessly during high-profile events. Lastly, events involving National Security assets are assessed through the DHS Special Events Management process. If an event is identified as elevated risk, additional assets are deployed. Some good examples are the Republican and Democrat National Conventions and the Super Bowl. It would be interesting to see what the risk level was assessed for the Butler, PA rally. It remains one of the mysteries.  

That leads us to the question of the process used in the preparation of the security for the rally resulting in the tragic event. As a former Secret Service Special Agent and having done numerous security advances and protection details in my FBI career, I would like to break down the process and critique the decisions made on that fateful day. I will assess the advance, and the roles of all federal and local personnel involved starting with the security advance and going through the after-action. 

The Advance

During a security advance, the advance agent views all resources related to the event. In this case, an outdoor speaking event. Some things are consistent for all advances such as the motorcade, the closest hospital, the route to and from the event, if the dignitary is staying the night, the hotel, the communications, etc. One of the most important aspects of the security advance is the location of the Unified or Incident Command (IC). This is a critical failure in the preparedness process on the day of the shooting.  

The Incident Command Process 

The role of the IC is to identify the On-Scene-Commander (OSC) and centralize decision-making, overall management procedures, and communications. This process provides a specific location for all decision-makers involved in the security footprint.

The IC provides leadership from all participating agencies to be involved from the top down. The IC also provides a unified communication capability as each agency can have radio communications directly with all security elements. This became a critical failure during the assault.

According to media reports and interviews of police involved, radio communications transmitted by Butler PD in reference to the suspect/shooter around and ultimately on the structure went unheard by Secret Service personnel, including command elements.

The centralization of communications in the IC would have resolved that issue and the command elements, with immediate and accurate intelligence, could have provided instruction and deployed appropriate resources to address and potentially mitigate the threat.

Additionally, command elements could have provided instructions to immediately remove President Trump or delay his arrival on stage. Finally, as a sub-command of the IC, the Tactical Operations Command (TOC), which provides oversight and deployment of assets such as the sniper teams, could have established tactical assets more quickly upon receiving the intelligence through IC channels. 

Conclusion 

The issue with the structure used by the shooter for the attack involves the command structure in place and the lack of oversight by an established IC. Post-shooting reports indicate that Butler PD was put in charge of the building. However, if Butler PD had been designated to secure that building, the command structure would have run upwards through a Secret Service Supervisor. If it did not, that would be an IC failure. Utilizing the IC process would have provided the Secret Service Supervisor and Incident Commander oversight of that building’s security allowing for a more secure process and responsibility.   

This incident was a tragic process failure by several agencies whose members should have been better prepared. The Incident Command System provides a unified and consistent process that prevents errors in preparedness and response during crisis and high-risk situations. Lives were changed and a life was lost, and a country will never forget. 

Steve Hooper is a Professor of Global Security at Embry-Riddle Aeronautical Engineering University’s College of Business, Security, and Intelligence in Prescott, AZ. He is also the founder of Tripwire Security Solutions LLC, a training and consultancy on all facets of Crisis Management and Safety and Security.

Professor Hooper retired after a 30-year career with the Federal Bureau of Investigation. His career included executive management in Counterterrorism and Counterintelligence. Professor Hooper also has extensive experience in Crisis Management and Tactical Operations.

Prior to the FBI, Professor Hooper was a Special Agent with the United States Secret Service and a patrol officer in Dover, NH.

Professor Hooper received a bachelor’s degree in criminal justice from St. Anselm College, Manchester, NH and a Master’s Degree in Criminal Justice/Homeland Security from St. Joseph’s University, Philadelphia, PA. He also attended the Marshal School for European Security Studies in Garmisch Germany and The Kellogg School of Business at Northwestern University. Professor Hooper is a Certified Protection Professional (CPP) and Threat Manager.