Journal of Human Security | 2016 | Volume 12 | Issue 1 | Pages 91–111
DOI: 10.12924/johs2016.12010091
ISSN: 1835–3800
Journal of
Human Security
Review of On-Scene Management of Mass-Casualty Attacks
Annelie Holgersson
Department of Surgical and Perioperative Sciences, Division of Surgery, Center for Disaster Medicine, Ume
a University,
a, Sweden. E-Mail:; Tel.: +46 702171695
Submitted: 27 January 2016 | In revised form: 8 June 2016 | Accepted: 8 July 2016 |
Published: 29 August 2016
Abstract: Background
: The scene of a mass-casualty attack (MCA) entails a crime scene, a hazardous
space and a great number of people needing medical assistance. Public transportation has been the
target of such attacks and involves a high probability of generating mass casualties. The aim of the
review was to investigate challenges for on-scene responses to MCAs and suggestions made to counter
these challenges, with special attention given to attacks on public transportation and associated terminals.
: Articles were found through PubMed and Scopus, “relevant articles” as defined by the databases,
and a manual search of references. Inclusion criteria were that the article referred to attack(s) and/or a public
transportation-related incident and issues concerning formal on-scene response. An appraisal of the articles’
scientific quality was conducted based on an evidence hierarchy model developed for the study.
One hundred and five articles were reviewed. Challenges for command and coordination on scene included
establishing leadership, inter-agency collaboration, multiple incident sites, and logistics. Safety issues
entailed knowledge and use of personal protective equipment, risk awareness and expectations, dynamic
risk assessment, cordons, defensive versus offensive approaches, and joining forces. Communication
concerns were equipment shortfalls, dialoguing and providing information. Assessment problems were
scene layout and interpreting environmental indicators as well as understanding setting-driven needs for
specialist skills and resources. Triage and treatment difficulties included differing triage systems, directing
casualties, uncommon injuries, field hospitals, level of care and providing psychological and pediatric
care. Transportation hardships included scene access, distance to hospitals, and distribution of casualties.
: Commonly encountered challenges during unintentional incidents were augmented during
MCAs, implying specific issues for safety, assessment, triage, and treatment, which require training.
Effectively increasing readiness for MCAs will likely entail struggles to overcome fragmentation between
the emergency services and the broader crisis management system as well as enabling critical and
prestige-less, context-based assessments, of needed preparatory efforts.
antagonism; disaster response; emergency medical services; fire fighter; law enforcement;
mass transportation; mass-casualty incident; rescue work; terrorism
1. Introduction
The scene of an antagonistically induced mass-casualty
incident, also called mass-casualty attack (MCA) [
], entails
a crime scene, a hazardous space, and medical challenge,
demanding a complex response by the police, rescue ser-
vices and emergency medical services (EMS). Countering
the aspects, with overlaying short- and long-term priorities
and differing organizational roles, is key to optimal function-
ing in the response stage of an event. This includes early
2016 by the authors; licensee Librello, Switzerland. This open access article was published
under a Creative Commons Attribution License (
planning for transfer of response organizations to the scene
of the attack, prevention of disturbances and additional at-
tacks, and prompt and efficient care of the victims [
]. It
also implies a need to take care so that the initial rescue
priorities do not unnecessarily impact long-term priorities,
such as careless handling of bodies which could reduce the
possibility of identification [
]. Response to an MCA thus
creates high demands for all the emergency organizations
to work together, to carry out their own responsibilities, and
achieve the collective goal of limiting the consequences of
the attack. Maximizing effectiveness of event management
constitutes a defensive counter-terrorism measure—which
Perliger and colleagues [
] hold are warranted—instead
of focusing only on active offensive methods, as terrorism
cannot be entirely prevented.
Active shooter or bombing response scenes present
risks of undetonated devices, secondary bombings and
shootings against rescue workers [
]. Natural or built
hazards may also be an issue, e.g., if the attack target
is public transportation. This has been the case in some
of the more publicized MCAs during the 21
century, like
the attacks against the railway sector in Madrid in 2004
(191 fatalities/more than 1500 non-fatally injured people)
] and on the subway system and a bus in London in
2005 (56 fatalities/775 non-fatally injured people) [
]. Hol-
gersson and Bj
ornstig showed that there was a large
increase in non-fatally injured people resulting from the
mass-casualty attacks (
10 fatally injured and/or
non-fatally injured) on public transportation during the
years 2000–2009 compared to the previous three decades
of the study period. Simultaneously, attacks against termi-
nal buildings, multiple targets, and using complex tactical
approaches increased during that decade [
]. This may
imply that preparedness among contemporary emergency
organizations needs to include the ability to manage large
numbers of injured people, possibly at multiple locations,
including confined or collapsed spaces, in a hostile and
hazardous environment.
Few health care providers have any experience in true
mass-casualty incidents with the imbalance between the
immediate medical need of a large number of victims and
local medical resources [
]. Furthermore, civilian terror-
ist bombings represent unique challenges to the trauma
system, e.g., they often include an urban setting, security
and field triage challenges, distinctive injury patterns, and a
rapid transfer and distribution of casualties to appropriate
hospitals [
]. Victims of terrorist attacks may also present
a combination of blast, blunt, penetrating and burn injuries.
Blast injuries may be particularly challenging to diagnose
and manage, as they may initially may be occult, with no
visible signs of injury [
]. The setting of modern urban
terrorist bombings also means that civilian medical systems
are confronted with patients arriving at the hospital alive
who would likely have died of their injuries in previous con-
ventional war settings [
]. Moreover, there is a difference
in those at risk of injury in a military setting versus those in
a civilian setting, where the civilian environment includes
children and the elderly [
]. Antagonistic acts thus
result in injuries that are not commonly encountered in the
civilian environment and also augment the challenges of
an unintentional mass-casualty incident by adding the fac-
tor of a hostile environment which together, demand other
approaches by the responders on scene. In-depth studies
of previous responses are one way to enable preparation
of a more effective emergency response in the immediate
aftermath of an attack [9,20].
The aim of the review was to analyze research on
challenges for on-scene responses to mass-casualty at-
tacks and suggestions made to counter these challenges,
with special attention given to attacks on public trans-
portation and associated terminals. The discussion con-
siders how overarching findings can be used in efforts to
increase preparedness.
2. Methods and Materials
This integrative literature review set out to generate new
knowledge about responses to attacks through review, cri-
tique and synthesis of representative literature in an inte-
grated manner [
]. Searches of the databases PubMed
and Scopus, as well as references from extracted articles,
were conducted in order to limit the risk of systematic er-
rors. Previous studies have indicated that one database
search is not enough to find all the studies that have the
potential to answer a research question [
]. Searches
were conducted in MEDLINE (PubMed) and Scopus in July
2014, and again in May 2015, for articles about on-scene
response to terrorist attacks (all published between 1970
and 2015 in the English language). In PubMed, several test
searches—with different MeSH-terms, free text words, and
filters—were conducted in order to find a balance between a
too-narrow and a too-broad search [
]. Components iden-
tified as search clusters in order to find articles of interest
were: intentionality (weapons, explosions and terrorism),
target (transportation), and consequence and management
(wounds and injuries, disasters, emergency responders
and emergency medical services). All words were used
as MeSH-terms except for “terrorism” and “transportation”,
which were also used as “free text keywords”: these terms
led to the identification of relevant articles while simply hav-
ing them as MeSH terms meant erroneous exclusion of
relevant articles. One word from each cluster needed to
be present for the article to be found in the search. A simi-
lar search was conducted in Scopus thereafter in order to
find more articles related to the police and rescue services,
complementing the medical perspective more prominent in
PubMed. Slightly different keywords and clusters were used
as MeSH terms could not be used in Scopus and the aim
was to identify more articles regarding the police and rescue
service (Table 1). For each title selected, additional titles of
interest were also found through the box “related citations
in PubMed” or the box “related documents” in Scopus.
Table 1. Database searches.
Database Search strings
PubMed ((“Explosions”[mesh] OR “Terrorism”[mesh] OR “Terrorism”[All Fields] OR “Weapons”[mesh]) AND (“Transportation”[mesh] OR
“Transportation”[All Fields]) AND (“Disasters”[mesh] OR “Wounds and Injuries”[mesh] OR “Emergency Responders”[mesh] OR
“Emergency Medical Services”[mesh])) AND “English”[Filter]
Scopus TITLE-ABS-KEY(“mass casualty event*” OR “mass casualty incident*” OR “mass violence” OR terrorism OR bomb*) AND
(“rescue work” OR “emergency responder*” OR “first responder*” OR “law enforcement” OR police OR “fire fighter*”) AND
(emergency* AND (response OR care OR management)) AND ( LIMIT-TO(LANGUAGE, “English” ) ) AND ( EXCLUDE (
DOCTYPE , “bk” ) OR EXCLUDE ( DOCTYPE , “ch” ) )
Articles of interest were reviewed in a staged manner:
firstly, through readings of their titles; secondly, the chosen
abstracts and then the full texts were examined to confirm
that they did not meet the exclusion criteria, but met the
inclusion criteria:
Inclusion criteria
(1a) attack(s);
Specified attack or compounded analysis from
several attacks
Actual attacks/incidents as opposed to simula-
tions or theoretical models
Irrespective of number of casualties, as long
as they were enough to trigger a formal civilian
mass-casualty response in the society in which
they occurred
(1b) public-transportation-related incident;
Attacks in connection to public transportation
and unintentional incidents with similar injury
mechanisms, i.e., explosions and fires
which raised issues of concern for formal on-scene
As stated in the MIMMS framework (Hodgetts &
Mackway-Jones 1995; 2004; see below)
Exclusion criteria
Chemical, biological, radiological, and nuclear
(CBRN) attacks
(2) Exposure to “World Trade Center air pollutants”
Long-term psychological and physical sequelae for
victims or responders
(4) Management and identification of human remains
Ethical considerations during and after incident man-
To determine inclusion or exclusion of articles, relevance
to the aim was deemed to weigh more than strict scientific
standards and methodology. The reference lists of the se-
lected abstracts were searched for further relevant articles
based on titles, and those articles were read in full. Lastly,
the final selection of articles was made, further excluding
those texts that after scrutiny failed to meet inclusion criteria
2, i.e. did not contain detailed descriptions of challenges
during civilian incident management. This inclusion criteria
also meant that reports of incident management without
formal prehospital response were excluded, which implies
inclusion of articles mainly from OECD countries. The find-
ings are therefore applicable primarily in such contexts.
To assess the scientific quality of each included arti-
cle, an adapted model of evidence hierarchy was created
(including study designs; Figure 1), based on evidence
ratings and descriptions of study design from the medi-
cal field [
]. However, research regarding disasters,
crises, or mass-casualty incidents is not limited to health
and medical science fields. The subject also presents
intrinsic research challenges and is not an area that can
be approached through experimental studies such as
randomized-controlled trials (RCT). This does not imply
that it cannot be the subject of rigorous research, but
rather necessitates an adapted evidence hierarchy model
that includes the types of studies involved in this multi-
disciplinary research field. The study design and method
by which the research is carried out and presented, con-
stitute integral parts to the assessment of a study’s quality.
Different study designs are suitable depending on the re-
search question, but certain study designs are generally
allotted higher evidence value, illustrated by schematic
pyramids of evidence hierarchy where the studies higher
up the pyramid are assigned higher evidence value, given
that they are properly conducted and described [
Meta-analyses and RCTs were excluded in the adapted
model, as there were no such studies included in the re-
view, while systematic reviews and cross-sectional studies
were considered a basis for high-quality evidence. The
articles constituting medium evidence-based studies were
the “retrospective case series” (a research design nor-
mally seen in the medical field), the “comparative case
studies” (a research design used within the political sci-
ence field), and “case studies”. Lastly, non-systematic re-
views, guidelines, special reports, consensus statements,
and perspective articles were considered to have lower
evidence value, mainly due to lacking or no presentation
of aim, methods or references in these articles.
Figure 1.
Evidence hierarchy, for scientific quality assessment, including study design description. (E.g. This review
would fit with the description of a “systematic review”, due to its systematic and appraising nature and the ambition to
synthesize existing research on MCA management).
The internationally used Major Incident Medical Manage-
ment and Support (MIMMS) framework, a systematic, peda-
gogic model of command and management at the scene of
an incident [
], constituted the baseline for extraction and
sorting the results. This was chosen as it includes details that
concern the study’s target population of the police, rescue
service, and ambulance staff, and it has a medical focus that
corresponded well with the findings of the literature search.
The defined management priorities Command, Safety, Com-
munication, Assessment, Triage, Treatment, and Transport,
used in MIMMS, constituted the basis for extraction of infor-
mation, word-for-word, from the articles. Command entailed
issues concerning vertical and horizontal leadership of the
overall rescue effort on scene and re-occurring management
challenges. Safety included issues regarding the safety of
personnel, the scene, and the survivors, with hazards de-
noting an unintentional safety risk and threat denoting an
intentional one. Communication involved issues with trans-
mission of information within and between personnel in the
emergency organizations on scene, and along the chain of
command, as well as to supporting organizations and facil-
ities and other persons requiring information. Assessment
included issues of interest for the ambulance service in or-
der to make estimates of the number of injured, severity of
injuries, and needs for extra resources and expertise; in this
case involving incident scene overview, the influence of the
surrounding public transportation environment on injuries,
and the work environment. Triage and Treatment comprised
issues regarding the prioritization of injured people for medi-
cal care and evacuation; as well as the type of injuries after
attacks, level of care, and treatment on scene, and the people
who provide care. Transport included issues of accessing,
evacuating, and distributing injured people to appropriate
medical facilities. After the relevant information was catego-
rized, the information was compounded into its core elements
and synthesized in subcategories.
3. Results
The primary and related article searches yielded 300 titles
of interest out of the 1,638 unique articles found in the
database searches, as well as 65 “related article” titles
and “reference article” titles. Further review of abstracts
found that 116 articles appeared relevant to the study,
and 105 articles were included in the review after full-text
readings (Figure 2).
Figure 2. Study flow from identification through screening of relevance and quality.
Of the studies included, three constituted systematic re-
views about blast injuries and safety issues, and three articles
were cross-sectional studies (i.e., six high-quality studies).
Fourteen of the reviewed articles were retrospective case
series/comparative case studies and 46 were case studies
(i.e., 60 medium-quality studies). Fifteen non-systematic re-
views and guidelines, ten special reports, two consensus
statements, and 12 perspective articles were identified in the
lower part of the evidence hierarchy model (i.e., 39 low-quality
studies). Table 2 summarizes the findings of the review re-
garding the management issues described in the articles,
sorted according to MIMMS main management tasks.
3.1. Command and Coordination
Traditionally, the first management task is often labeled
“command and control”, but the articles included in the re-
view clearly portray the essential aspects of coordination,
which is why the labeling of this section also reflects this.
3.1.1. Establishing a Clear, Unified Scene Leadership
Lack of command, coordination, and integration between
the emergency organizations have been commonly reported
problems during responses to MCAs [
]. The pres-
ence of several representatives of similar emergency organi-
zations and several responders in a leadership position have
also amounted to confusion, contradictory orders, and compli-
cations for scene management [
]. Early establishment
of a common operating picture with all involved agencies gath-
ered in a multidisciplinary, unified command at an Incident
Command Post (ICP), has been critical for the synchroniza-
tion and effectiveness of rescue operations [
According to Perliger et al. [
], a clear picture of the situa-
tion and proper coordination during the first minutes after an
attack had a greater effect on the duration of the on-scene
management process than the number of medical staff or the
number of wounded people. Increased standardization of the
command structures, language to manage events, and clear
jurisdictions and distribution of duties between the involved
emergency organizations, could increase survival [
3.1.2. Collaborating across Responder Professions in
Planning & Practice
Inter-agency planning and coordination is regarded
as imperative between police, rescue service, emer-
gency medical services, and mental health profession-
Pre-event collaboration plans may
also need to include policies for cross-border medical
responses [37] and use of military units [
] or specific
sea rescue organizations [
]. Priorities on the incident
site should not be viewed as sequential. Instead, sev-
eral actions need to occur simultaneously, carried out by
different rescue organizations [
]. This necessi-
tates functional inter-agency collaboration with clearly pre-
determined, common principles for incident management
and defined tasks and responsibilities of each organization,
which in turn need to be drilled [
]. If responders
are not aware of the others’ identities, roles, or tasks, prob-
lems in the inter-agency cooperation will likely arise [
Intra- and inter-agency cooperation and coordination is
required for efficient management, but such cooperation is
complicated as a large number of teams assemble, each
with its own goals, its own organizational terminology, and
its own supervision [2,7,39,40].
Table 2. Summary of defined challenges and corresponding scientific quality of articles.
Prioritized task Management challenges Quality appraisal of articles referenced
Low Medium High
Command & Coordination Establishing a clear, unified scene leadership 7 5
Collaborating across responder professions in planning & practice 6 7
Coordinating multi-site incidents & multi-exit scenes 2 5
Balancing needs for staff & resources 2 5
Safety Knowing of & using personal protective equipment 6 3
Being aware of risks & having realistic expectations of safety 7 4 1
Conducting dynamic risk assessments & cordoning off the scene 7 7
Approaching safety defensively or offensively 5 1
Joining forces 3
Communication Functioning equipment - overload, destruction, & incompatibility 10 12
Dialoguing - content, language & relay 5 10
Informing - survivors, relatives & the public 4 8
Assessment Viewing scene layout &interpreting environmental indicators 9 11 2
Understanding setting-driven needs for specialist skills & resources
9 8
Triage & Treatment Differing triage systems & labelling 3 12
Directing & gathering casualties 6 7
Encountering uncommon injuries 15 26 5
Setting up field hospitals & personnel matters 17 14
Determining ambition for level of care & treatment 10 6 1
Providing psychological support 7 3
Caring for the pediatric casualty 1 2
Transport Accessing & leaving the scene 8 10
Evacuating from urban or rural scenes 5 11
Distributing patients 14 18
3.1.3. Coordinating Multi-Site Incidents & Multi-Exit
Challenges with coordination have been most commonly
seen at events where there has been several incident sites or
more than one evacuation point [
]. When several attacks
have occurred simultaneously and in geographically proximal
areas, there has been confusion regarding the number of
incidents [
]. This confusion leads to misunderstandings
at EMS dispatch about the location of the scenes, resulting
in severe maldistribution of medical assets and personnel,
and greatly varying levels of treatment [
]. In order to avoid
such issues, a functional central command level is essential,
as multiple incidents often aggravate communication and
coordination problems [
]. Multi-site incidents may also
increase coordination demands due to occurrence within a
catchment area of several EMS systems or jurisdiction of sev-
eral involved agencies [
]. Another problem for incident
command may occur if there are multiple exits available from
the site, e.g. incidents in tunnels, on ferries or islands, as
casualties can escape in several directions. This can result
in dispersal of responders and can complicate organization
of clearing stations and evacuation, but management may be
alleviated by setting up several command posts [41,43,44].
3.1.4. Balancing Needs for Staff & Resources
A study by Juffermans and Bierens [
] indicated that lo-
gistics was an issue at all five incident sites researched,
often connected to communication deficiencies. Timely and
adequate supply of clothing, tools, and equipment is im-
portant, e.g., for identification, safety, debris removal, and
void searches [
]. While the definition of mass-casualty
incident commonly implies dealing with resource shortage
supplying an excess of resources and personnel may lead
to difficulties in tracking and locating supplies, problems
with coordinating the rescue effort and may delay casualty
evacuation [2,33,39,46].
3.2. Safety
The principle priority at the scene of an attack is safety of
self, scene and survivors [
]. Rescue personnel
have to face a reality where there is a need to worry about
their own and the victims’ safety, as well as demands to
manage life-threatening injuries [
]. According to Kashuk et
al. [
], balancing such safety concerns with expeditious ca-
sualty care requires training, in addition to a well-developed
work ethics base and, optimally, actual experience.
3.2.1. Knowing of & Using Personal Protective Equipment
To be able to work on site, all rescue personnel need to be
familiar with personal protective equipment (PPE; e.g., hel-
met and respiratory protection), and the equipment needs
to be immediately available in the response vehicles [
Respiratory protection, for example, is not just applicable
to minimize inhalation of intentional chemical or biological
agents, but also airborne particles present after bombings
or after a building collapse [
]. Lack of PPE use by re-
sponders has been seen during previous responses, with
several accounts of on- and off-duty staff working on scenes
wearing scrubs, surgical masks, and clogs [
Responders from involved emergency organizations may
not be equally aware of the risks to themselves during shoot-
ing incidents or of the limitations of their protective gear.
Military rounds, e.g., those used in high-velocity weapons,
can easily penetrate the sides of a vehicle as well as some
bullet-resistant vests [
]. Thus, while they may stop bul-
lets from some guns, it is important not to assume that
“bullet-resistant vests” are “bulletproof vests” [4,51].
3.2.2. Being Aware of Risks & Having Realistic
Expectations of Safety
Caution is warranted during scene approach, as initial re-
ports may have given the wrong location, and thus rescue
personnel may place themselves and their vehicles at risk
of unintentional hazard or an intentional threat [
]. Fol-
lowing an attack, responders need to consider the risk of
secondary explosions or coordinated attacks [
], as at-
tacks are sometimes arranged to create a need for a rescue
effort through an action, to then target rescue personnel
on arrival [
]. Several case studies however, tell of
lapses in determining presence or absence of secondary
explosives [
], and undetonated devices have been
present at several attack sites [
], implying that per-
sonnel have provided treatment and placed casualty tents
within the risk zone of undetonated devices [
]. In one
case, the police collecting belongings unknowingly brought
an undetonated device to the police station [
]. As op-
posed to responses revealing a lack of risk awareness,
exercises have also revealed unrealistic expectations of
safety at hostile event scenes by EMS and fire services.
The difficult and time-consuming practice of waiting for a
full risk assessment could delay provision of life-saving care
]. Thus, it is not always possible to secure the entire site
quickly enough to refrain from continuing the rescue effort.
Responses to MCAs may require a transition into thinking
of “relative safety” and “plus one” threat (e.g., looking for
secondary devices or a perpetrator among the victims)—a
frame of thought implying wariness of safety threats without
expecting the entire scene to be secured before acting [
In a systematic review, Thompson et al. further showed that
while the scene of a terrorist attack includes direct threats,
the published literature suggests that dominant causes of
mortality and morbidity in responders after such incidents
have been due to indirect environmental hazards [54].
3.2.3. Conducting Dynamic Risk Assessments &
Cordoning off the Scene
Scene safety includes assessing and ensuring the immedi-
ate safety of the incident scene from both present threats
and potential hazards, which need to be continuously re-
evaluated by way of a dynamic risk assessment as the
rescue and tactical situation may change [
]. If
there are no set policy decisions regarding whether to go
in or wait, i.e. “rules of engagement”, the decision ought
to be made by someone with management responsibility
and not left to individual responders [
]. During MCA
responses, there is a need to move people away from the
scene [
], i.e., evacuate casualties, distance civilians,
perform crowd control [34], and control access by checking
personnel identification [
]. A suitable division of a scene
may be one with three cordons, similar to those used in
the UK [
]. In a schematic representation (Figure 3), the
“middle cordon” could be an established safe area, func-
tioning as a buffer area, allowing for triage and life-saving
treatment of casualties outside of the immediate danger
area found in the “inner circle”. The “outer circle” would
then contain the designated evacuation roads, identifica-
tion control, and searched buildings. The police’s ability
to create and regulate the cordons is an essential task for
alleviating management and provision of important medi-
cal procedures and hindering follow-up attacks [
Cordons also constitute an important measure to protect
forensic evidence and control the flow of personnel and
traffic [
], but they need to operate while minimizing bar-
riers for essential equipment, staff, and patients [
through pre-determined plans and functional inter-agency
cooperation [2].
3.2.4. Approaching Safety Defensively or Offensively
Approaches to scene safety and management on scene
differ throughout the world, depending on the local con-
text, governance, and experiences of attacks. Based on
conflict experiences in Colombia, responders do not en-
ter a scene without governmental provision of troops in
order to assure security [
]. Experience with follow-up
attacks in Israel has led to the enactment of different regu-
lations at different times [
]. At one point, regulations
forbade medical forces from entering the scene until the
police had given the all-clear, but these were not strictly ad-
hered to, and opposite policies have also been described
where EMS do not wait for security clearance [
]. Instead,
wearing their mandatory protective gear, they attempt to
remove casualties from the immediate vicinity of the initial
event, only providing external hemorrhage control before
doing so [
]. The first example describes a more de-
fensive approach to safety while the latter tells of a more
offensive approach. The offensive approach implies an
aggressive entry into an unsecured scene containing casu-