At 2:49 p.m. on the Patriots Day holiday, April 15, 2013, in Boston, Mass., hundreds of runners were about to finish the Boston Marathon in roughly a four-hour time. Many thousands remained on the course behind them, expecting to finish over the next two hours or more.
Elite runners — who both started earlier and ran faster — were nearly three hours gone from the finish area. Winners had already been wreathed with laurels, and many public officials and VIP spectators had since drifted away from the finish line.
The marathon is a massive community celebration, with more than 20,000 runners and tens of thousands of spectators lining the 26-mile (42.2-kilometre) route from Hopkinton — a rural town beyond the suburbs of Boston — to the finish line near Boston's downtown. Although many spectators awaited the runners still on the course, the crowds had begun to thin, and the stands that line one side of the street just before the finish were sparsely populated.
Many of the most senior people in organizations associated with running or securing the event had moved on to other locations and activities. Those actually in charge of supporting the event, however, were still on the scene or in command centers from which they were monitoring the still in-progress event.
During the next minute, 12 seconds and 183 yards apart, two low-power improvised explosive devices contained in pressure cookers packed with nails and BBs detonated just short of the finish line. Three people died almost instantly; more than 260 others, some of them grievously wounded (including many who lost limbs), would require hospital care.
The 100 hours following the detonation saw a diverse series of law enforcement challenges confronted by a wide array of agencies that would pool, co-ordinate and deploy both their disparate jurisdictional powers and their diverse capabilities. Although further improvements could have been made in certain aspects of the response, most observers agree that, overall, law enforcement performance was highly effective. Why, in the frequently repeated phrase, was "Boston Strong?" What lessons does the Boston experience hold for other law enforcement organizations?
Co-ordinated response
Complex crisis events like the Boston Marathon bombing draw upon capabilities that generally don't reside in a single agency and therefore demand effective co-ordination across many organizational boundaries.
The answer to the question of how law enforcement agencies in Boston mustered an effective response has two parts: First, how did the involved agencies organize and co-ordinate in the moment, as the event evolved? Second, what prior preparations in the days, weeks, months and years before the event enabled these agencies to engage in this co-ordination when it was required?
The bombing resulted in at least five separate law enforcement challenges and responses over the ensuing four days:
- Managing the immediate aftermath of the bombing itself: assisting survivors, helping to secure the area of the bombing and clear it of those not rendering medical assistance.
- Securing area hospitals to which survivors were taken and other key infrastructure and installations that might be subject to secondary attacks.
- Securing the crime scene, collecting evidence and conducting the investigation.
- Planning and executing support for a visit by the President and First Lady to Boston for a memorial service and visits to area hospitals to speak with and comfort survivors and families.
- Pursuing and taking into custody the two suspects after they hijacked a car and were found through the vehicle's locator.
The first three of these responses flowed naturally and immediately from the bombing itself. They emerged from the capabilities (the structures, relationships and personnel) that various agencies had stood-up in preparation for the marathon — a "fixed event" with long lead time.
Operationally, the event was organized in an incident management structure (IMS), including the formation of a unified command and co-ordination in planning and deployment between different agencies with jurisdiction for different locations.
The "peacetime" operational structure that had been overseeing the security efforts of crowd control and traffic management quickly transitioned to a "wartime" footing. The same managerial structure, quickly augmented by additional leadership as senior officials arrived at the scene, was now overseeing rapidly surged efforts: the post-bombing cleanup of the site, the securing of other facilities, and the collection of evidence and launching of the investigation.
The transition to a wartime posture was rapid and — adjusting for the intrinsically chaotic nature of a sudden attack — fairly efficient. Senior on-site commanders of different law enforcement and emergency management organizations immediately felt the need to join forces, and rapidly began searching for one another, forming increasingly large groups of co-located leadership.
They searched for a location for a command center, and chose a nearby hotel. They called their superiors, disseminated information about their location, and requested subordinates and superiors to gather in the command center. They sought key resources, including meeting space, food, telephones, laptops and tables.
And they began organizing, carrying out and delegating work — from designing and fielding the first press conference (two hours and one minute after the first bomb went off) to ordering a massive deployment of National Guard troops to secure the 13-block crime scene they had just defined.
In addition to dealing with the most immediate issues, they began working on plans for the next day: security in the public transit system, traffic routing around the restricted-area crime scene, and a myriad of other suddenly implied operational decisions and actions.
The fourth event — the massive security effort required for a presidential visit on Thursday, April 18 — placed a considerable additional burden on already-stretched law enforcement resources. Planning had to be carried out on short notice. As one senior law enforcement official observed, "The city may have needed this event, but law enforcement didn't."
Nonetheless — and, again, drawing on the existing incident management structure that had sprung from the underlying operational management structure of the marathon — resources were located, co-ordinated and successfully deployed.
Starting in the evening that same day, following the release of photos of the suspects identified by the ongoing investigation, a rapidly evolving series of events unfolded over roughly the next 24 hours in nearby Cambridge, Allston and Watertown. This fifth set of law enforcement challenges included the assassination of an MIT police officer, a car hijacking and chase, a gunfight between officers and the suspects, the death of one and escape of the other, a day-long, house-to-house search in a 20-block area, and, ultimately, the capture of the last suspect after a massive salvo of law enforcement bullets.Footnote 1
Micro-command issues
During most of the final 24 hours, officers operated in highly disciplined, organized fashion, with superior officers from their own departments in command of deployed units and effectively co-ordinating with other units both in command posts and in the field. However, at several points — in particular, during the Thursday night gunfight with the suspects and on Friday afternoon when the final suspect was apprehended — law enforcement agencies faced severe challenges in effectively establishing "micro-command," specifically, the ability to exercise appropriate control and co-ordination over a group of officers in the field.
These micro-command issues arose when individual officers from the numerous police departments involved arrived on the scene independently in the midst of an ongoing, dangerous operation, and then acted on their own rather than looking for command and co-ordinating in a structured way.
In both instances, imperfectly controlled gunfire endangered officers and nearby civilians alike. In addition, a number of smaller episodes in this period illustrate the problems of loose or non-existent command when officers were operating outside of the command structure of their own departments.
These events point to an important issue of doctrine and training: the need to establish and practise better protocols for officers operating under circumstances when their own superior officers are not present to co-ordinate with individuals or units from other police organizations.
These failures of micro-command, however, were the exception during a week of mostly effective crisis performance. What facilitated the rapid formation of effective co-ordination in the aftermath of the marathon bombing was literally years of practice, relationship building, and joint planning and operation of major events in the Boston area.
While co-ordination was present earlier, the formal joint planning of fixed events was greatly spurred by planning efforts for the 2004 Democratic National Convention held in Boston. As the first national political convention after 9/11, this event received special national attention, resulting in a highly inclusive joint planning effort involving federal, state and local agencies.
In the aftermath, many of the participants concluded that it should become a regular protocol in advance of any major fixed event. Subsequently, events ranging from the Fourth of July fireworks, to the Boston Marathon, to victory parades for national champion sports teams were all jointly planned across multiple agencies and then operated through a unified command process. The repeated use of these structures resulted in the development of cross-agency understanding of one another's capabilities, interests, mandates and imperatives, and the development and maintenance of personal relationships that enabled interagency trust and willingness to co-operate.
This "infrastructure"— built with continuing effort long in advance — was the foundation on which stood the ability of agencies suddenly to work together effectively in the aftermath of the marathon bombing.
There are five key recommendations for law enforcement from the events of the Boston Marathon bombing:
- Use IMS to plan fixed events: Organize fixed events using incident management as the operational paradigm. This will help the events to run more smoothly and efficiently on good days — and will provide a ready framework within which a strong response can quickly be mounted on a bad day.
- If an incident occurs, activate an IMS-based response: When and if an untoward event takes place in the midst of a fixed event, engineer a quick transition to a wartime footing, activating the unified incident management structure to develop and oversee the response.
- There may be a "lead" agency, but the command structure needs to be very flat: The key concept is "unified" command, not "unitary" command. There may be a "first among equals," but the emphasis should be on the "equals." Under US doctrine (and law), the FBI is the lead agency for any terrorist attack. But the FBI has too little operational capacity to carry out the vast array of actions that need to be taken. And bossing other agencies (even if it might have the authority to do so, which in many cases it would not) isn't the best way to get the most effective work out of the whole team. In the marathon response, the FBI and other agencies formed a relatively flat and very effective team.
- Use the joint planning for fixed events to build, over time, the infrastructure of relationships and understanding that will produce greater co-operation in a moment of crisis: Using incident management as the structure for planning and operating fixed events will build the relationships and cross-agency understanding and knowledge of each other's strengths (and shortcomings) that will enable more effective co-ordination.
- Develop better protocols for micro-command in complex events: Address the issues of micro-command in advance by developing better protocols for how law enforcement officers from different agencies should co-ordinate their actions by establishing a cross-organizational command structure when they come together under crisis conditions. Build instruction in these protocols into every officer's basic training and refresh this training in exercises throughout their careers.
The response to the Boston Marathon bombing vividly demonstrates effective action to co-ordinate in crisis but that capability should not be regarded as either guaranteed or fortuitous.
"Boston Strong" resulted from years of hard work. Any community can develop the infrastructure and capacities to field such a response, but not every community has. Boston's response shows a good example of what to do in the moment — and of how to build that capacity in advance.
Herman B. Leonard is professor of Public Management and faculty co-director of the Program on Crisis Leadership.
Christine M. Cole is executive director of the Program on Criminal Justice Policy and Management.
Arnold M. Howitt is executive director of the Ash Center for Democratic Governance and faculty co-director of the Program on Crisis Leadership.
The authors gratefully acknowledge support for the research underlying this paper from the International Centre for Sport Security.