VT Panel Recommendations

Recommendations from the "Mass Shootings at Virginia Tech: Report of the Review Panel"

On August 29, 2007, the Virginia Tech Review Panel released a large report investigating the massacre at the university that claimed 33 lives, including the shooter. Throughout, the panel made recommendations on how Virginia Tech and other universities could rectify security gaps to minimize the likelihood something like this could happen again.

Below, you will find the list of the panel's recommendations, divided by chapter, in one easy-to-find location. (Note: The panel's specific recommendations to Virginia's mental health system have been excluded due to their specificity.)

-- Matthew Harwood

Chapter II: University Setting and Security


II-1 Universities should do a risk analysis (threat assessment) and then choose a level of security appropriate for their campus. How far to go in safeguarding campuses, and from which threats, needs to be considered by each institution. Security requirements vary across universities, and each must do its own threat assessment to determine what security measures are appropriate.

II-2 Virginia Tech should update and enhance its Emergency Response Plan and bring it into compliance with federal and state guidelines.

II-3 Virginia Tech and other institutions of higher learning should have a threat assessment team that includes representatives from law enforcement, human resources, student and academic affairs, legal counsel, and mental health functions. The team should be empowered to take actions such as additional investigation, gathering background information, identification of additional dangerous warning signs, establishing a threat potential risk level (1 to 10) for a case, preparing a case for hearings (for instance, commitment hearings), and disseminating warning information.

II-4 Students, faculty, and staff should be trained annually about responding to various emergencies and about the  notification systems that will be used. An annual reminder provided as part of registration should be considered.

II-5 Universities and colleges must comply with the Clery Act, which requires timely public warnings of imminent danger.
“Timely” should be defined clearly in the federal law.


II-6 Campus emergency communications systems must have multiple means of sharing information.

II-7 In an emergency, immediate messages must be sent to the campus community that provide clear information on the nature of the emergency and actions to be taken. The initial messages should be followed by update messages as more information becomes known.

II-8 Campus police as well as administration officials should have the authority and capability to send an emergency message. Schools without a police department or senior security official must designate someone able to make a quick decision without convening a committee.


II-9 The head of campus police should be a member of a threat assessment team as well as the emergency response team for the university. In some cases where there is a security department but not a police department, the security head may be appropriate.

II-10 Campus police must report directly to the senior operations officer responsible for emergency decision making. They should be part of the policy team deciding on emergency planning.

II-11 Campus police must train for active shooters (as did the Virginia Tech Police Department). Experience has shown that waiting for a SWAT team often takes too long. The best chance to save lives is often an immediate assault by first responders.

II-12 The mission statement of campus police should give primacy to their law enforcement and crime prevention role. They also must to be designated as having a function in education so as to be able to review records of students brought to the attention of the university as potential threats. The lack of emphasis on safety as the first responsibility of the police department may create the wrong mindset, with the police yielding to academic considerations when it comes time to make decisions on, say, whether to send out an alert to the students that may disrupt classes. On the other hand, it is useful to identify the police as being involved in the education role in order for them to gain access to records under educational privacy act provisions.

Chapter IV: Mental Health History of Seung Hui Cho

 IV-1 Universities should recognize their responsibility to a young, vulnerable population and promote the sharing of information internally, and with parents, when significant circumstances pertaining to health and safety arise.

IV-2 Institutions of higher learning should review and revise their current policies related to—

a) recognizing and assisting students in distress

b) the student code of conduct, including enforcement

c) judiciary proceedings for students, including enforcement

d) university authority to appropriately intervene when it is believed a distressed student poses a danger to himself or others

IV-3 Universities must have a system that links troubled students to appropriate medical and counseling services either on or off campus, and to balance the individual’s rights with the rights of all others for safety.

IV-4 Incidents of aberrant, dangerous, or threatening behavior must be documented and reported immediately to a college’s threat assessment group, and must be acted upon in a prompt and effective manner to protect the safety of the campus community.

IV-5 Culturally competent mental health services were provided to Cho at his school and in his community. Adequate resources must be allocated for systems of care in schools and communities that provide culturally competent services for children and adolescents to reduce mental-illness-related risk as occurred within this community.

IV-6 Policies and procedures should be implemented to require professors encoutering aberrant, dangerous, or threatening behavior from a student to report them to the dean. Guidelines should be established to address when such reports should be communicated by the dean to a threat assessment group, and to the school’s counseling center.

IV-7 Reporting requirements for aberrant, dangerous, or threatening behavior and incidents for resident hall staff must be clearly established and reviewed during annual training.

IV-8 Repeated incidents of aberrant, dangerous, or threatening behavior must be reported by Judicial Affairs to the threat assessment group. The group must formulate a plan to address the behavior that will both protect other students and provide the needed support for the troubled student.

IV-9 Repeated incidents of aberrant, dangerous, or threatening behavior should be reported to the counseling center and
reported to parents. The troubled student should be required to participate in counseling as a condition of continued residence in campus housing and enrollment in classes.

IV-10 The law enforcement agency at colleges should report all incidents of an issuance of temporary detention orders for
students (and staff) to Judicial Affairs, the threat assessment team, the counseling center, and parents. All parties should be educated about the public safety exceptions to the privacy laws which permit such reporting.

IV-11 The college counseling center should report all students who are in treatment pursuant to a court order to the threat assessment team. A policy should be implemented to address what information can be shared with family and roommates pursuant to the public safety exceptions to the privacy laws.

IV-12 The state should study what level of community outpatient service capacity will be required to meet the needs of the commonwealth and the related costs in order to adequately and appropriately respond to both involuntary court-ordered and voluntary referrals for those services. Once this information is available it is recommended that outpatient treatments services be expanded statewide.

Chapter V: Information Privacy Laws

V-1 Accurate guidance should be developed by the attorney general of Virginia regarding 3 1 V a . C o d e § 2 . 2 - 3 8 0 6      ( A ) ( 2 ) the application of information privacy laws to the behavior of troubled students. The lack of understanding of the laws is probably the most significant problem about information privacy. Accurate guidance from the state attorney general’s office can alleviate this problem. It may also help clarify which differences in practices among schools are based on a lack of understanding and which are based on institutional policy. For example, a representative of Virginia Tech told the panel that FERPA prohibits the university’s administrators from sharing disciplinary records with the campus police department. The panel also learned that the University of Virginia has a policy of sharing such records because it classifies its chief of police as an official with an educational interest in such records.

The development of accurate guidance that signifies that law enforcement officials may have an educational interest in disciplinary records could help eliminate discrepancies in the application of the law between two state institutions. The guidance should clearly explain what information can be shared by concerned organizations and individuals about troubled students. The guidance should be prepared and widely distributed as quickly as possible and written in plain English. Appendix G provides a copy of guidance issued by the Department of Education in June 2007, which can serve as a model or starting point for the development of clear, accurate guidance.

V-2 Privacy laws should be revised to include “safe harbor” provisions. The provisions should insulate a person or organization from liability (or loss of funding) for making a disclosure with a good faith belief that the disclosure was necessary to protect the health, safety, or welfare of the person involved or members of the general public. Laws protecting good-faith disclosure for health, safety, and welfare can help combat any bias toward nondisclosure.

V-3 The following amendments to FERPA should be considered:

FERPA should explicitly explain how it applies to medical records held for treatment purposes. Although the Department of
Education interprets FERPA as applying to all such records, that interpretation has not been universally accepted. Also, FERPA does not address the differences between medical records and ordinary educational records such as grade transcripts. It is not clear whether FERPA preempts state law regarding medical records and confidentiality of medical information or merely adds another requirement on top of these records.

FERPA should make explicit an exception regarding treatment records. Disclosure of treatment records from university clinics should be available to any health care provider without the student’s consent when the records are needed for medical treatment, as they would be if covered under HIPAA. As currently drafted, it is not clear whether off-campus providers may access the records or whether students must consent. Without clarification, medical providers treating the same student may not have access to health information. For example, Cho had been triaged twice by Cook Counseling Center before being seen by a provider at Carilion St. Albans in connection with his commitment hearing. Later that day, he was again triaged by Cook. Carilion St. Albans’s records were governed by HIPAA. Under HIPAA's treatment exception, Carilion St. Albans was authorized to share records with Cook. Cook’s records were governed by FERPA. Because FERPA’s rules regarding sharing records for treatment are unclear about outside entities or whether consent is necessary, Carilion St. Albans could not be assured that Cook would share its records. This situation makes little sense.

V-4 The Department of Education should allow more flexibility in FERPA’s “emergency” exception. As currently drafted, FERPA contains an exception that allows for release of records in an emergency, when disclosure is necessary to protect the health or safety of either the student or other people. At first, this appears to be an exception well-suited to sharing information about seriously troubled students. However, FERPA regulations also state that this exception is to be strictly construed. The “strict construction” requirement is unnecessary and unhelpful. The existing limitations require that an emergency exists and that disclosure is necessary for health or safety. Further narrowing of the definition does not help clarify when an emergency exists. It merely feeds the perception that nondisclosure is always a safer choice.

V-5 Schools should ensure that law enforcement and medical staff (and others as necessary) are designated as school officials with an educational interest in school records. This FERPA-related change does not require amendment to law or regulation. Education requires effective intervention in the lives of troubled students. Intervention ensures that schools remain safe and students healthy. University policy should recognize that law enforcement, medical providers, and others who assist troubled students have an educational interest in sharing records. When confirmed by policy, FERPA should not present a barrier to these entities sharing information with each other.

V-6 The Commonwealth of Virginia Commission on Mental Health Reform should study whether the result of a commitment hearing (whether the subject was voluntarily committed, involuntarily committed, committed to outpatient therapy, or released) should also be publicly available despite an individual’s request for confidentiality. Although this information would be helpful in tracking people going though the system, it may infringe too much on their privacy.

As discussed in Chapter IV, and its recommendations to revise Virginia law regarding the commitment process, the law governing hearings should explicitly state that basic information regarding a commitment hearing (the time, date, and location of the hearing and the name of the subject) is publicly available even when a person requests that records remain confidential. This information is necessary to protect the public’s ability to attend commitment hearings.

V-7 The national higher education associations should develop best practice protocols and associated training for information sharing. Among the associations that should provide guidance to the member institutions are:

• American Council on Education (ACE)
• American Association of State Colleges and Universities (AASCU)
• American Association of Community Colleges (AACE)
• National Association of State and Land Grant Universities and Colleges (NASLGUC)
• National Association of Independent Colleges and Universities (NAICU)
• Association of American Universities (AAU)
• Association of Jesuit Colleges and Universities

If the changes recommended above are implemented, it is possible that no further changes to privacy laws would be necessary, but guidance on their interpretation will be needed. The unknown variable is how entities will choose to exercise their discretion when the law gives them a choice on whether to share or withhold information. How an institution uses its discretion can be critically important to whether it is effectively able to intervene in the life of a troubled student. For example, FERPA currently allows schools to release information in their records to parents who claim students as dependents. Schools are not, however, required to release that information. Yet, if a university adopts a policy against release to parents, it cuts off a vital source of information.

The history of Seung Hui Cho shows the potential danger of such an approach. During his formative years, Cho's parents worked with Fairfax County school officials, counselors, and outside mental health professionals to respond to episodes of unusual behavior. Cho’s parents told the panel that had they been aware of his behavioral problems and the concerns of Virginia Tech police and educators about these problems, they would again have become involved in seeking treatment. The people treating and evaluating Cho would likely have learned something (but not all) of his prior mental health history and would have obtained a great deal of information germane to their evaluation and treatment of him. There is no evidence that officials at Virginia Tech consciously decided not to inform Cho's parents of his behavior; regardless of intent, however, they did not do so. The example demonstrates why it may be unwise for an institution to adopt a policy barring release of information to parents.

The shootings of April 16, 2007, have forced all concerned organizations and individuals to reevaluate the best approach for handling troubled students. Some educational institutions in Virginia have taken the opportunity to examine the difficult choices involved in attempts to share necessary information while still protecting privacy. Effort should be made to identify the best practices used by these schools and to ensure that these best practices are widely taught. All organizations and individuals should be urged to employ their discretion in appropriate ways, consistent with the best practices. Armed with accurate guidance, amended laws, and a new sense of direction, it is an ideal time to establish best practices for intervening in the life of troubled students.

Chapter VI: Gun Purchase and Campus Policies

VI-1 All states should report information necessary to conduct federal background checks on gun purchases. There should be federal incentives to ensure compliance. This should apply to states whose requirements are different from federal law. States should become fully compliant with federal law that disqualifies persons from purchasing or possessing firearms
who have been found by a court or other lawful authority to be a danger to themselves or others as a result of mental illness. Reporting of such information should include not just those who are disqualified because they have been found to
be dangerous, but all other categories of disqualification as well. In a society divided on many gun control issues, laws that specify who is prohibited from owning a firearm stand as examples of broad agreement and should be enforced.

VI-2 Virginia should require background checks for all firearms sales, including those at gun shows. In an age of widespread information technology, it should not be too difficult for anyone, including private sellers, to contact the Virginia Firearms Transaction Program for a background check that usually only takes minutes before transferring a firearm. The program already processes transactions made by registered dealers at gun shows. The practice should be expanded to all sales. Virginia should also provide an enhanced penalty for guns sold without a background check and later used in a crime.

VI-3 Anyone found to be a danger to themselves or others by a court-ordered review should be entered in the Central Criminal Records Exchange database regardless of whether they voluntarily agreed to treatment. Some people examined for a mental illness and found to be a potential threat to themselves or others are given the choice of agreeing to mental
treatment voluntarily to avoid being ordered by the courts to be treated involuntarily. That does not appear on their records, and they are free to purchase guns. Some highly respected people knowledgeable about the interaction of mentally ill people with the mental health system are strongly opposed to requiring voluntary treatment to be entered on the record and be sent to a state database. Their concern is that it might reduce the incentive to seek treatment voluntarily, which has many advantages to the individuals (e.g., less time in hospital, less stigma, less cost) and to the legal and medical personnel involved (e.g., less time, less paperwork, less cost). However, there still are powerful incentives to take the voluntary path, such as a shorter stay in a hospital and not having a record of mandatory treatment. It does not seem logical to the panel to allow someone found to bedangerous to be able to purchase a firearm.

VI-4 The existing attorney general’s opinion regarding the authority of universities and colleges to ban guns on campus should be clarified immediately. The universities in Virginia have received or developed various interpretations of the law. The Commonwealth’s attorney general has provided some guidance to universities, but additional clarity is needed from the attorney general or from state legislation regarding guns at universities and colleges.

VI-5 The Virginia General Assembly should adopt legislation in the 2008 session clearly establishing the right of every institution of higher education in the Commonwealth to regulate the possession of firearms on campus if it so desires. The panel recommends that guns be banned on campus grounds and in buildings unless mandated by law.

VI-6 Universities and colleges should make clear in their literature what their policy is regarding weapons on campus. Prospective students and their parents, as well as university staff, should know the policy related to concealed weapons so they can decide whether they prefer an armed or arms-free learning environment.

Chapter VII: Double Murder at West Ambler Johnston

VII-1 In the preliminary stages of an investigation, the police should resist focusing on a single theory and communicating that to decision makers.

VII-2 All key facts should be included in an alerting message, and it should be disseminated as quickly as possible, with explicit information.

VII-3 Recipients of emergency messages should be urged to inform others.

VII-4 Universities should have multiple communication systems, including some not dependent on high technology. Do not assume that 21st century communications may survive an attack or natural disaster or power failure.

VII-5 Plans for canceling classes or closing the campus should be included in the university’s emergency operations plan. It is not certain that canceling classes and stopping work would have decreased the number of casualties at Virginia Tech on April 16, but those actions may have done so. Lockdowns or cancellation of classes should be considered on campuses where it is feasible to do so rapidly.

Chapter VIII: Mass Murder at Norris Hall

VIII-1 Campus police everywhere should train with local police departments on response to active shooters and other emergencies.

VIII-2 Dispatchers should be cautious when giving advice or instructions by phone to people in a shooting or facing other threats without knowing the situation. This is a broad recommendation that stems from reviewing other U.S. shooting incidents as well, such as the Columbine High School shootings. For instance, telling someone to stay still when they should flee or flee when they should stay still can result in unnecessary deaths. When in doubt, dispatchers should just be reassuring. They should be careful when asking people to talk into the phone when they may be overheard by a gunman. Also, local law enforcement dispatchers should become familiar with the major campus buildings of colleges and universities in their area.

VIII-3 Police should escort survivors out of buildings, where circumstances and manpower permit.

VIII-4 Schools should check the hardware on exterior doors to ensure that they are not subject to being chained shut.

VIII-5 Take bomb threats seriously. Students and staff should report them immediately, even if most do turn out to be false

Chapter IX: EMS Response

IX-1 Montgomery County, VA should develop a countywide emergency medical services, fire, and law enforcement communications center to address the issues of interoperability and economies of scale.

IX-2 A unified command post should be established and operated based on the National Incident Management System Incident Command System model. For this incident, law enforcement would have been the lead agency.

IX-3 Emergency personnel should use the National Incident Management System procedures for nomenclature, resource typing and utilization, communications, interoperability, and unified command.

IX-4 An emergency operations center must be activated early during a mass casualty incident.

IX-5 Regional disaster drills should be held on an annual basis. The drills should include hospitals, the Regional Hospital Coordinating Center, all appropriate public safety and state agencies, and the medical examiner’s office. They should be followed by a formal postincident evaluation.

IX-6 To improve multi-casualty incident management, the Western Virginia Emergency Medical Services Council should review/revise the Multi-Casualty Incident Medical Control and the Regional Hospital Coordinating Center functions.

IX-7 Triage tags, patient care reports, or standardized Incident Command System forms must be completed accurately and retained after a multi-casualty incident. They are instrumental in evaluating each component of a multi-casualty incident.

IX-8 Hospitalists, when available, should assist with emergency department patient dispositions in preparing for a multicasualty incident patient surge.

IX-9 Under no circumstances should the deceased be transported under emergency conditions. It benefits no one and increases the likelihood of hurting others.

IX-10 Critical incident stress management and psychological services should continue to be available to EMS providers as needed.

Chapter X: Office of the Chief Medical Examiner

The following recommendations reflect the research conducted by the panel, after-action reports from Commonwealth agencies, and other studies regarding fatality management issues.

X-1 The chief medical examiner should not be one of the staff performing the postmortem exams in mass casualty events; the chief medical examiner should be managing the overall response.

X-2 The Office of the Chief Medical Examminer (OCME) should work along with law enforcement, Virginia Department of
Criminal Justice Services( DCJS), chaplains, Department of Homeland Security, and other authorized entities in developing protocols and training to create a more responsive family assistance center (FAC).

X-3 The OCME and Virginia State Police in concert with FAC personnel should ensure that family members of the deceased are afforded prompt and sensitive notification of the death of a family member when possible and provide briefings regarding any delays.

X-4 Training should be developed for FAC, law enforcement, OCME, medical and mental health professionals, and others regarding the impact of crime and appropriate intervention for victim survivors.

X-5 OCME and FAC personnel should ensure that a media expert is available to manage media requests effectively and that victims are not inundated with intrusions that may increase their stress.

X-6 The Virginia Department of Criminal Justice Services should mandate training for law enforcement officers on death notifications.

X-7 The OCME should participate in disaster or national security drills and exercises to plan and train for effects of a mass fatality situation on ME operations.

X-8 The Virginia Department of Health should continuously recruit board-certified forensic pathologists and other specialty
positions to fill vacancies within the OCME. Being understaffed is a liability for any agency and reduces its surge capability.

X-9 The Virginia Department of Health should have several public information officers trained and well versed in OCME
operations and in victims services. When needed, they should be made available to the OCME for the duration of the event.

X-10 Funding to train and credential volunteer staff, such as the group from the Virginia Funeral Director’s Association, should be made available in order to utilize their talents. Had this team been available, the family assistance center could have been more effectively organized.

X-11 The Commonwealth should amend its Emergency Operations Plan to include an emergency support function for mass fatality operations and family assistance. The new ESF should address roles and responsibilities of the state agencies. The topics of family assistance and notification are not adequately addressed in the National Response Plan (NRP) for the federal government and the state plan that mirrors the NRP also mirrors this weakness. Virginia has an opportunity to be a national leader by reforming their EOP to this effect.

Chapter XI: Immediate Aftermath and the Long Road to Healing

The director of Criminal Injuries Compensation Fund and the chief of the Victim Services Section (Department of Criminal Justice) conducted internal after-action reviews and prepared recommendations for the future based on the lessons that were learned. The recommendations with which the panel concurred are incorporated into the following recommendations.

XI-1 Emergency management plans should include a section on victim services that addresses the significant impact of homicide and other disaster-caused deaths on survivors and the role of victim service providers in the overall plan. Victim service professionals should be included in the planning, training, and execution of crisis response plans. Better guidelines need to be developed for federal and state response and support to local governments during mass fatality events.

XI-2 Universities and colleges should ensure that they have adequate plans to stand up a joint information center with a
public information officer and adequate staff during major incidents on campus. The outside resources that are available (including those from the state) and the means for obtaining their assistance quickly should be listed in the plan. Management of the media and of self directed volunteers should be included.

XI-3 When a family assistance center is created after a criminal mass casualty event, victim advocates should be called immediately to assist the victims and their families. Ideally, a trained victim service provider should be assigned to serve as a liaison to each victim or victim’s family as soon as practical. The victim service should help victims navigate the agencies at the FAC.

XI-4 Regularly scheduled briefings should be provided to victims’ families as to the status of the investigation, the identification process, and the procedures for retrieving the deceased. Local or state victim advocates should be present with the families or on behalf of out-of-state families who are not present so that those families are provided the same up-to-date information.

XI-5 Because of the extensive physical and emotional impact of this incident, both short- and long-term counseling should be made available to first responders, students, staff, faculty members, university leaders, and the staff of The Inn at Virginia Tech. Federal funding is available from the Office for Victims of Crime for this purpose.

XI-6 Training in crisis management is needed at universities and colleges. Such training should involve university and area-wide disaster response agencies training together under a unified command structure.

XI-7 Law enforcement agencies should ensure that they have a victim services section or identified individual trained and
skilled to respond directly and immediately to the needs of victims of crime from within the department. Victims of crime are best served when they receive immediate support for their needs. Law enforcement and victim services form a strong support system for provision of direct and early support.

XI-8 It is important that the state’s Victims Services Section work to ensure that the injured victims are linked with local victim assistance professionals for ongoing help related to their possible needs.

XI-9 Since all crime is local, the response to emergencies caused by crime should start with a local plan that is linked to the wider community. Universities and colleges should work with their local government partners to improve plans for mutual aid in all areas of crisis response, including that of victim services.

XI-10 Universities and colleges should create a victim assistance capability either inhouse or through linkages to county-based professional victim assistance providers for victims of all crime categories. A victim assistance office or designated campus victim advocate will ensure that victims of crime are made aware of their rights as victims and have access to services.

XI-11 In order to advance public safety and meet public needs, Virginia’s colleges and universities need to work together as a coordinated system of state-supported institutions.


    Beyond Print

    SM Online

    See all the latest links and resources that supplement the current issue of Security Management magazine.