Master JKO Force Protection Module 5: Comprehensive 2026 Guide To Active Shooter And Threat Response

This guide addresses Module 5 (Active Threat and Response Protocols) of the Joint Knowledge Online (JKO) JS-US007 Joint Anti-Terrorism Level I training. It is designed for military personnel, defense contractors, and DoD civilians seeking compliance with 2026 security directives.

Understanding the Role of Module 5 in JS-US007 Antiterrorism Training

The Joint Anti-Terrorism Level I Awareness Training (JS-US007) is a mandatory annual requirement for all Department of Defense (DoD) personnel, including active-duty service members, reserves, civilian employees, and contracted personnel. Within this curriculum, Module 5 focuses on the high-consequence scenario of an active threat or active shooter event. As asymmetric threats continue to evolve, the 2026 standards updated by the Joint Staff J7 emphasize immediate, decentralized decision-making rather than passive reliance on first responders.

The primary objective of Module 5 is to equip personnel with the cognitive framework necessary to survive a hostile intrusion. This module moves beyond theoretical security postures to provide concrete, actionable steps for individuals caught in a crisis. It aligns directly with Department of Defense Instruction (DoDI) 2000.12 (DoD Antiterrorism Program) and DoDI 2000.16 (DoD Antiterrorism Standards), ensuring that all cleared personnel maintain a uniform understanding of emergency protocols on and off federal installations.

Security environments demand that individuals recognize pre-incident indicators and understand the mechanisms of an active attack. By mastering the concepts in Module 5, personnel ensure they do not become soft targets. The training stresses that in the initial minutes of an attack, individual actions dictate survival rates far more than the speed of responding tactical units.

Core Threat Response Strategies: Run, Hide, Fight

The cornerstone of the Module 5 curriculum is the "Run, Hide, Fight" framework, adapted specifically for military and federal environments. While civilian training emphasizes these options as a strict linear progression, the DoD 2026 tactical doctrine teaches them as dynamic, situation-dependent options that can be initiated in any order based on the immediate proximity of the threat.

The Evacuation Protocol (Run)

If there is an accessible escape path, the primary directive is to attempt to evacuate the premises. Individuals must make a rapid assessment of their surroundings and exit the building immediately.

• Evacuation Planning: Personnel must constantly maintain situational awareness of primary and secondary emergency exits in their workspaces. Do not stop to gather personal belongings or government equipment.
• Preventing Others from Entering: Warn individuals met during the escape, but do not allow indecision or panic from others to delay your departure.
• Interacting with Law Enforcement: When escaping, keep hands visible, fingers spread wide, and raised above head height. Do not carry any items that could be mistaken for a weapon. Avoid making sudden movements toward responding military police (MP) or civilian law enforcement officers.

The Barricade Protocol (Hide)

When evacuation is impossible or too dangerous due to the proximity of the shooter, finding a secure hiding place is the secondary survival action. The goal is to create a physical barrier and visual screen between yourself and the threat.

• Securing the Space: Lock all doors and reinforce them with heavy office furniture, filing cabinets, or desks. Turn off all lights, close window blinds, and silence all electronic devices, including the vibrate mode on cellular phones.
• Positioning for Safety: Remain quiet and stay out of the direct line of sight from door windows. Situate yourself along walls perpendicular to the entry door, as shots fired through the door or drywall are less likely to strike individuals positioned out of the direct trajectory.
• Silent Communication: If safe to do so, use silent communication channels (such as text messages or enterprise chat systems) to alert security forces of your exact location, the number of individuals with you, and any known details about the shooter.

The Active Defense Protocol (Fight)

As an absolute last resort, and only when life is in imminent danger, individuals must commit to neutralizing the threat through physical force. This is a critical point of emphasis in the 2026 JKO updates: defense is not passive when facing lethal violence.

• Total Commitment to Action: If forced to fight, individuals must act with maximum aggression. Hesitation increases lethality. Use improvised weapons such as fire extinguishers, heavy tools, tactical pens, or metal chairs to incapacitate the shooter.
• Coordinated Defense: If multiple personnel are trapped in a room, coordinate an ambush plan. Assign specific roles, such as grabbing the weapon, striking the head, or tackling the suspect's legs, to overwhelm the intruder upon entry.
• Securing the Weapon: Once the shooter is incapacitated, secure any weapon away from the suspect. Do not hold the weapon in your hands when security forces enter; place it inside a trash can or under a heavy object where it cannot be reached by the attacker.

Tactical Comparison: FPCON Levels vs. Threat Actions

Maintaining readiness requires understanding how localized threat responses interact with broader base security measures. Force Protection Conditions (FPCON) are systemic, command-driven postures, whereas active shooter responses are localized, immediate actions. The table below delineates these systems to clarify how individual responses shift during escalations.

Step-by-Step Response Protocol During an Active Threat Event

When an active shooter or threat event initiates, the window for decision-making is measured in seconds. This step-by-step operational protocol outlines the critical actions required from the initial blast or gunshot to the arrival of first responders.

Phase 1: Immediate Assessment and Classification

Upon hearing sounds resembling gunfire, explosions, or unusual shouting, do not dismiss them as construction noise or backfires. Immediately classify the event as a potential threat.

1. Determine Proximity: Assess the distance and direction of the threat based on acoustics and visual cues.
2. Evaluate Escape Routes: Identify if a clear path to an exit exists without crossing the suspected path of the shooter.
3. Choose the Survival Path: Commit instantly to either Evacuation (Run) or Barricading (Hide).

Phase 2: Execution of the Selected Action

Depending on the assessment made in Phase 1, execute your survival plan with speed and precision.

1. If Evacuating: Run in a zig-zag pattern if moving through open areas. Leave all gear, except for life-saving medical supplies if easily accessible. Keep your hands empty and visible.
2. If Barricading: Close, lock, and block the door with the heaviest objects available. Silence all phones. Turn off lights and computer monitors to make the room appear unoccupied.
3. If Confronted directly: Move quickly to catch the attacker off-guard. Use body weight to disrupt their balance and strike vulnerable areas such as the eyes, throat, and groin.

Phase 3: Reporting and Communicating

Once you are either safe outside the building or securely barricaded, transmit critical intelligence to emergency dispatchers.

1. Initiate Contact: Call 911 or the installation's military police desk.
2. Provide a SALUTE Report: Supply clear, concise details using the military SALUTE framework where possible:
   
   
   • Size: Number of shooters or attackers.
   • Activity: Direction of travel, active firing, or taking hostages.
   • Location: Building number, floor, room number, or grid coordinate.
   • Unit/Appearance: Physical description, clothing color, tactical gear, or masks.
   • Time: Time the attack started and current status.
   • Equipment: Types of weapons (rifles, handguns, explosives) observed.

Phase 4: Integration with Emergency Responders

The arrival of security forces is a highly volatile phase of the incident. Law enforcement's primary mission is to neutralize the threat, not to treat the injured.

1. Do Not Obstuct: Allow responding officers to pass. Do not cling to them or scream for medical assistance while they are clearing the area.
2. Show Empty Hands: Keep your hands completely visible, fingers spread, and do not make any sudden gestures.
3. Follow Directives: Obey all commands instantly. Expect to be detained, searched, or handcuffed temporarily until the scene is fully secured and identities are verified.

Insider Threats and Identifying Pre-Attack Indicators

A critical component of the 2026 update to Module 5 is the recognition of insider threats. Many active threat events on military installations do not originate from external actors, but from radicalized, disgruntled, or compromised personnel holding active security clearances. Recognizing the behavioral indicators of an insider threat is vital for prevention.

DoD Directive 2000.16 Prevention Standard Active threat mitigation begins long before a weapon is drawn. Command readiness relies on the proactive reporting of anomalous behaviors. Personnel must utilize established reporting channels, such as the Army's iWATCH program, Air Force Eagle Eyes, or Navy NCIS tips, to report observable pre-attack behaviors.

The JKO Module 5 curriculum highlights several key behavioral indicators that, when observed in combination, warrant immediate reporting to security managers or law enforcement:

• Expression of Extremist Ideologies: Sudden advocacy for violent extremist groups, expressing a desire to harm military personnel, or demonstrating intense fascination with past mass casualty events.
• Erratic or Severe Behavioral Changes: Unexplained bursts of anger, paranoia, drug or alcohol abuse, or rapid social withdrawal from coworkers and family.
• Disregard for Security Protocols: Repeated, intentional violations of information security or physical security guidelines, such as attempting to access restricted areas or downloading unauthorized classified material.
• Pre-Incident Planning Actions: Inquiry about active shooter response times, studying building floor plans outside of operational requirements, or acquiring large quantities of weapons and tactical gear without reasonable explanation.

Pros and Cons of Active Defense Strategies in Military Installations

While the "Run, Hide, Fight" protocol is globally recognized, its implementation in a highly secured military environment presents unique operational dynamics. Balancing rapid defensive actions with controlled tactical responses requires an analytical look at the strategies taught in JKO Module 5.

Pros of the Active Threat Response Framework

• Empowers Low-Level Decision Making: By authorizing individuals to act instantly without waiting for command approval, the protocol saves lives during the critical first three minutes of an attack.
• Adapts to Non-Permissive Environments: Unlike civilian-only models, the JKO framework prepares personnel for attacks inside secure compartmented information facilities (SCIFs) where cell phone communication is restricted and emergency exits are highly controlled.
• Standardizes Interoperability: Because all military branches and DoD contractors utilize the same JKO module, personnel from different commands can coordinate instinctively during a crisis.

Cons and Risks of Immediate Defensive Action

• Risk of Blue-on-Blue Incidents: Armed personnel or contractors attempting to engage the shooter themselves may be misidentified as active threats by arriving military police or tactical teams.
• Exits and Entry Barriers: Secured military buildings often feature single-point entry turnstiles and reinforced blast doors, which can bottleneck evacuation paths and trap fleeing personnel.
• Over-Reliance on the "Fight" Option: Without adequate physical training, personnel may overestimate their ability to disarm an attacker, leading to close-quarters casualties that might have been avoided through effective barricading.

Force Protection Module 5 FAQ

What is the primary purpose of JKO Force Protection Module 5?

The primary purpose of Module 5 is to train DoD personnel in survival strategies during active threat and active shooter scenarios. It outlines response actions such as Run, Hide, Fight, and explains how to safely interact with arriving emergency responders.

This module ensures that all personnel can make split-second decisions to protect themselves and others under high-stress conditions. By standardizing these actions across the DoD, the training helps reduce confusion and casualty rates during real-world security breaches.

What should I do with my hands when escaping an active shooter scene?

When escaping an active shooter scene, you must keep your hands completely empty, visible, and raised above your head with fingers spread wide. This allows responding law enforcement to quickly verify that you are unarmed and do not pose a threat.

Avoid carrying any objects, such as bags, jackets, or tools, which could be misidentified as weapons in a high-stress environment. Do not make sudden movements toward officers or attempt to grab them for assistance.

How does FPCON Delta affect active shooter response protocols?

FPCON Delta signals that an attack has occurred or is imminent, initiating a complete installation lockdown. During FPCON Delta, your immediate response should be to shelter in place or execute the barricade (Hide) protocol unless directed otherwise by official emergency broadcasts.

While FPCON Delta increases base-wide security to its highest state, an active shooter inside your specific facility requires immediate personal defense measures that override static security postures. Always prioritize local survival actions over general base movement.

How do I report a suspected insider threat within my unit?

A suspected insider threat should be reported immediately to your security manager, chain of command, or via dedicated reporting programs like iWATCH or Eagle Eyes. For urgent situations involving immediate danger, contact local military police or civilian law enforcement.

Provide detailed, factual observations of the behavior rather than personal speculation. Use objective terms to describe changes in work habits, security violations, or hostile statements to ensure security officials can conduct a proper risk assessment.

Is the "Fight" option in JKO Module 5 mandatory if I cannot escape?

No, the "Fight" option is not a mandatory sequence, but a last resort when your life is in imminent danger and escape or barricading is no longer possible. It is a personal decision based on the immediate tactical reality of the situation.

If you are cornered and have no other viable options, the JKO curriculum stresses that committing to aggressive physical action with improvised weapons offers the highest chance of survival compared to remaining passive.

Elevating Command Readiness and Individual Survival

Command readiness is the sum of individual vigilance and systemic preparation. As threat profiles evolve, maintaining a passive security posture is no longer an option for defense personnel. Understanding JKO Force Protection Module 5 is more than a check-in-the-box training requirement; it is a critical survival skill that directly impacts the operational security of your unit and installation.

Take the time to review your immediate workspace today. Identify your primary and secondary evacuation routes, locate rooms that can be secured effectively as barricades, and ensure you have local emergency dispatch numbers programmed into your communication devices. By turning the theoretical lessons of JKO Module 5 into proactive, daily habits, you ensure that you are prepared to respond effectively, protect your team, and preserve operational capability under any circumstances.