How do you tell good guys from bad guys?

| October 7, 2015 | 23 Comments

“Luckily we made the choice not to get involved We were quite a distance away from the building where this was happening. And we could have opened ourselves up to be potential targets ourselves, and not knowing where SWAT was, their response time, they wouldn’t know who we were. And if we had our guns ready to shoot, they could think that we were bad guys.” — John Parker, armed student during recent Umpqua Community College Campus shooting

I have a pretty diverse group of friends. When there is a mass murder like the one in Umpqua Community College my Facebook feed has all sorts of pro- and anti-gun stuff.

Lately, some people that used to be anti-gun have started asking a few questions about armed citizen first responders. I think they’re getting the point that no matter how quickly law enforcement can react, there is a potential for an armed citizen to intervene.

The questions are starting to gravitate more to “how would this work?” instead of “how can we ban everything with a pointy end?”

This [is] one of my concerns with concealed and open carry by ordinary citizens. In the event of an emergency, how do you tell the good guys from the bad guys? — a non-shooting friend of mine

If you’ve read “Facing the Active Shooter” by CR Williams (my review) or “Killing the Active Shooter” by Gabe Suarez (my review) you may already know some the ways to tell.

Here some additional thoughts.

Participant Categories

I believe there are five categories of individuals in an active murderer situation:

The Attacker(s) — both “Facing the Active Shooter” and “Killing the Active Shooter” describe typical active shooter / murderer profiles, including the difference between a crazy person and a terrorist with a mission. They may not be acting alone.

The Victims — these are people who have no concept of fighting, are trying to escape, hide, or bargain.

The Fighters — they may or may not be carrying a weapon, may be using improvised weapons, may counter-attack in groups with or without weapons (e.g., three Americans who attacked the terrorist in France)

The Police — may be in uniform or plainsclothes (such as the off-duty officer who assisted uniformed police in the Salt Lake City Trolley Square assault)

You — you’re you! If you’re reading this blog, hopefully you’ve had a lot of fight-focused training, as well as training on how to de-escalate a confrontation, handle irate / scared bystanders, administer trauma care, and have the weapons and equipment to take a risk.

Identifying Participants


These are not hard and fast rules, and some of this is taken from the two books (credit to them, I’m just a messenger). You may have to rely on multiple observations in order to make a decision.

The attacker(s)

  • Point guns at people who look afraid or who are trying to get away. If someone points a gun at a little kid, they’re a bad guy.
  • They are more likely to have a long gun of some kind, but may be armed with just a handgun.
  • Be aware there are Attackers that are armed with edged weapons, but we don’t see that as often in the US.
  • May be displaying their weapons in a way to generate the maximum amount of fear. Don’t expect Attackers to move with weapons in a Low Ready, Ready, or Sul position.
  • May attempt to herd Victims where they can be controlled / executed. Another Victim or Fighter may attempt to lead others to safety. You may be able to differentiate between these two categories by position and reaction. If the person is in the back, yelling and people and threatening them with a weapon, they may be an Attacker. If the person with a weapon is in front and people are following them, they are probably a Fighter.
  • May be wearing tactical gear, such as a chest rig or plate carrier.

The victims

  • They’re running around, screaming, perhaps clinging onto you or others, or begging for help.
  • Expect them to run in packs / groups. For examples please watch the excellent documentary Terror at the Mall  (my review), on the Westgate Mall terrorist attack in Kenya.
  • Will be helping injured people.
  • May be carrying / leading people, usually children (e.g., a man holding a kid by the hand and running is probably a Victim, not an Attacker)

The fighters

  • According to Suarez, Williams, John Farnam, Erik Pakieser, and others, expect anyone running towards gunfire to be either a Fighter or another Attacker.
  • If they’re unarmed and running towards fighting, probably a good guy.
  • This may seem obvious, but Fighters won’t indiscriminately shoot people.
  • Fighters will probably not be carrying a PDW or SBR.
  • Fighters might be barricaded in a room, waiting for help. This was the case of John Parker in Oregon. Be careful entering a room with a weapon in your hand.
  • May (hopefully) use cover and concealment. Do not expect an Attacker to do this unless someone has started shooting back.
  • If several people are struggling with one person on the ground, that group is probably made up of Fighters and not Attackers. They may be trying to wrestle a weapon away from an Attacker or subdue them.

The police

  • Uniformed officers should be easy to identify. There has been some concern that attackers might dress up as police officers, but I am not sure if we’ve ever seen an incident where this has happened.
  • Identify plainsclothes officers by their dress and demeanor. Unless they’re an undercover narcotics officer (thinking of you, Craig “SouthNarc” Douglas), they will be clean-cut, well dressed, and wearing traditional Western attire. They may be moving towards the fight, interacting with Victims, checking on the wounded.
  • May (hopefully) use cover and concealment. Do not expect an Attacker to do this unless someone has started shooting back.

The First Step of the OODA Loop

The OODA Loop consists of four steps: Observe, Orient, Decide, and Act. In the process of identifying who’s who, the critical step is Observe.

I do not think it is wise to challenge an Attacker. However, you may want to issue a challenge if you aren’t sure who you’re dealing with.

Please watch Terror at the Mall, and read about other mass shootings. Particularly study the motivations of the Attacker(s), and how they interact with Victims.

Learning about Victim and Attacker behavior may help you distinguish an armed Fighter from and Attacker.

Observe comes before Act.

No guarantees

There is no guarantee that these attributes will result in a correct identification. However, it is important to think about this topic ahead of time. Please discuss this concept with qualified instructors and your fight-focused trained peers.

Engage in force on force or scenario-based training that makes you identify different categories of people. I misidentified an individual during active shooter Force on Force training. Understand that this training is not “real life,” and that actors will be mimicking what they know about the category they are portraying. This may or may not match the situation you’re in.

For most people reading this, you are not required to act during an active shooter situation. Every action carries risk, and it is up to you to determine what kind of risks you are willing to take.

I will write an additional article in the future about how to avoid being misidentified by law enforcement or other Fighters.

About the Author:

Short Barrel Shepherd Short Barrel Shepherd is a regular guy and works to make Web sites and mobile apps easier for people to use. He spends his free time attending fight-focused firearm, knife, and combatives training, motorcycling, writing, and playing games. His daily carry is a Glock 19 pistol and an AR15 .300 Blackout pistol in a backpack.

23 Comments on "How do you tell good guys from bad guys?"

Trackback | Comments RSS Feed

  1. Joe says:

    I STILL think it’s hugely problematic, and don’t see how this article helps much:
    For example, I have probably 5-10 times the amount of annual training that cops at my University have on an annual basis (depending on the officer).
    However, during an ACTIVE SHOOTER situation, if a campus police officer saw me running with my gun out, he’d be smart to shoot me (and assume I’m a shooter) because if he tried to yell at me, he would be increasing his odds of being killed IF I WERE (ONE OF) THE BAD GUY(S).
    SO now I have to run with my gun NOT OUT; in this case, if I run around a corner and into a/the shooter, I’m NOW behind the curve and decreasing MY odds of success.
    IF another good Samaritan shooter is running around, I might should shoot him–ANY DELAY only decreases my odds IF it turns out he is the/one ofthe bad guy(s).
    We MIGHT could arrange for armed-professors to carry a BRIGHT PINK VEST in a tiny concealed bag at all times when armed, and ONLY put it on when we’re going to address a shooter. Something like that MIGHT be a possible solution (unless it leaks to the shooter OR he/she gains control of one–then police would be put in a bad spot yet again).

    • Short Barrel Shepherd Short Barrel Shepherd says:

      All good points, but that’s not what this article is about.

      This specific article is how YOU can find ways to evaluate other actors in a situation.

      Thank you for reading.

      • Joe says:

        I’m just worried about how my chances of getting shot go up every milliseconds I spend trying to figure out who’s who (from the police or the bad guy).

        • thebronze says:

          You don’t have a choice. You HAVE TO figure out who’s who. You can’t just shoot everyone that “looks” like a threat.

    • CR Williams says:

      Re: Running around the corner.

      Don’t RUN around the corner. CLEAR the corner with your hand on the gun under your cover or with gun drawn but held in one of a number of covert-carry positions you can learn. If you see a cop you drop your hand away or step back out of sight and holster or if necessary let go of the gun and get your hands in sight.

      It’s a matter of thinking ahead for most of this which is what the article here is about. I don’t want to sprint all the way to the shooter even if I am sure I’m the only other guy with a gun for a hundreds of yards around. I want to slow down at any point where I can’t see or have to negotiate obstacles such as entrances and corners and a few yards prior to where I believe the shooter is at that time. I approach it then as a clearance problem and I solve it as best I can.

      Yes, it slows you down and yes, that gives them more time to shoot others. Running headlong and getting shot yourself gives them freedom to continue shooting, though. Find, fix, stop them from the most advantageous position you can. Don’t take all day but don’t think you have to act on the microsecond either.

  2. Clint says:

    Joe seems concerned less with effective IFF (Identify Friend or Foe), and more with ensuring they didn’t become targeted by the good guys.

    Even though it is off topic from the main point of the article, it’s always good to discuss what may happen and how to handle those situations.

    SBS nailed it on the head: knowing who is good/bad is a key part to not getting shot by an LEO. Another part is being aware of your actions. Would I have my firearm drawn in an active shooter situation? Most likely, yes. I will not emphatically say yes, because every situation is different.

    If I were to draw my sidearm, I would have it very close to my body as 1) it allows optimum control of my arms and firearm and 2) it allows me to partially conceal it while still having the ability to quickly deploy my firearm.

    After the bad guy is out:

    It’s important to remember to reload (which means having at least an one extra mag with my EDC) because there could be more problems. Contrary to that though, holstering after the threat(s) is neutralized is a smart idea to prevent a negative response from our LEOs.

    Speaking of their response, they will hem you up, possibly have you eat concrete (aka: face down on the ground), and confiscate your firearm. Let them do it, don’t resist them. They’ll find out soon enough that you’re a good guy.

  3. Slim says:

    What are your thoughts on carrying one of those “police” or “swat” hats in edc bag? The ones that can be found at corner store etc. If one finds himself in an active shooter situation and decides to act (or forced to defend himself/family,etc), he puts it on. Do you think it’ll work for or against him?

    • Short Barrel Shepherd Short Barrel Shepherd says:

      I haven’t really thought about that, or the CCW sash that is sold.

    • CR Williams says:

      If you are not police do not have or put on anything that might be taken as identifying you as such. That’s impersonating an officer on a platter if somebody doesn’t like you shooting a bad guy (maybe even if they do). Too risky.

      • thebronze says:

        1) If you’re involved in an Active-Killer situation, Impersonating a Police Officer will be the absolute LEAST of your worries.

        2) IMO, you should only identify yourself as LE in a situation where the police are involved and you have your gun out and they’re trying to identify good guys from bad. I’m former LE and I would absolutely tell LE that I’m a cop, in a heat of the moment situation. We can sort out that I’m not, afterwards.

        I can’t really think of any situation where I’d tell a civilian that I’m a cop, as the first question they ask would be show me your badge (or ID).

    • Cameron says:

      Maybe one that says security?

  4. Tobias P. says:

    “Uniformed officers should be easy to identify. There has been some concern that attackers might dress up as police officers, but I am not sure if we’ve ever seen an incident where this has happened.”

    Utoya. And it worked well.

  5. TatendaZim says:

    Thanks for writing this. Active shooters in a large environment like a shopping mall is a scary scenario. Here’s a very good article on the Kenya mall shooting

    • Short Barrel Shepherd Short Barrel Shepherd says:

      Thanks for the link, I will read it. You may have found our two prior posts about Westgate of interest :

      • TatendaZim says:

        Thanks, I haven’t seen those but will read them. I learned a lot about the attack from article I linked and have been looking for more information on it. One interesting thing I got from that article is that a woman who was pinned down with her children said she used her yoga breathing to calm herself down. Which reminded me to practice my tactical breathing so I can be more focused in case I’m involved in a similar scenario.

        I just found this video by a Kenya news service and don’t know if it is any good, but I plan on watching it as well.

      • TatendaZim says:

        I just read your previous articles and they are great. I agree with you about being able to take care of yourself if you are shot. When I first read the Foreign Policy article about the mall shooting, what hit me the most was that many people bled to death because of the lengthy response time. This promoted me to consider what I could carry on a daily basis to stop bleeding. I have a large trauma kit in my truck, but that will do me no good if I can’t access it. As part of my EDC, I now carry a triangular bandage, small zip tie secured to a safety pin (to secure an improvised windlass) and 8 feet of DIY flat-fold duct tape. Obviously not as good as having a real tourniquet and compression bandage, but it is compact and something I can access immediately.

        • Hunter says:

          May I suggest adding a few tampons to your go bag. They are sterile, compact, come in an applicator that can be placed in a bullet wound. Just a thought

          • Sian says:

            A bundle of hemostatic wound dressings takes up just as much space and works better. Tampons are better than nothing but they actually aren’t all that great. They expand and can worsen a wound, and are made of cotton so they tend to stick.

            you’re usually better off not stuffing anything in a hole that isn’t designed to be there.

  6. thebronze says:

    Terror At The Mall on youtube:

  7. Joseph Perez says:

    The guy in Norway, Anders Behring Breivik, he used a police uniform to lure the victims to get closer where he would kill them, then go and try to lure more to come. He managed to kill 68 people and injure more than 100 in this way.

    Just thought to mention it since here it says that you were not aware of somebody using a police uniform in a mass shooting.

  8. Ric says:

    We have a fairly common problem in South Africa with criminals posing as Police officers. From uniforms to full-on “cloned” police cars, mainly used in robberies and vehicle hijackings. Sadly there is a high percentage of corrupt officers who supply criminals with uniforms, radios and firearms including State issued fully automatic R5 rifles.

  9. Al marvelli says:

    Maybe it would be better for ccw civilians to establish a perimeter rather then run toward the threat.?

    Establish a secure area of some sort and pull victims to them instead ? Then use the weapon to defend and shelter in place while awaiting rescue?

    I’m thinking more inside a building than outside, although either works provided there is cover.

    Hopefully isolate and contain the threat .? While minimizing the weakness of the ccw civilian. ( no comms, no armor, no uniform or coordination) . Minimize the blue on blue by avoiding it altogether.

  10. JoeG says:

    This book should be a required read for everyone today, but most especially for CCW holders, and DEFINITELY for first responders: Left of Bang.

    The concepts in it are not only good for identifying pre attack indicators, but are also useful for sorting good guys, victims, and bad guys out during an incident.

    I’m of the opinion that as an armed citizen, my priorities run like this unless it’s an absolute clear massacre and the only sane option is to immediately engage the threat:

    1) If my wife or kids are with me, my only priority is getting them to safety.
    2) Escort any other victims in my vicinity, especially unattended or separated children to safety.
    3) Assist uniformed good guys if possible.
    4) Triage casualties if it is safe to do so.
    5) Engage shooter(s) if they are preventing any of the above, or it is opportune to do so (read that as I have a CLEAR tactical advantage, like I’m behind the guy when he opens fire).

Post a Comment