Skip to content
Campus Alert Archive
UVA

Student gunman killed three on a chartered bus; 12-hour manhunt produced 36 alerts

AI-generated · every claim is source-linked
VAactive shooteremergency notificationhigh confidence
Confirmed Threat

A student opened fire on a chartered bus returning from a field trip, killing three football players. The shooter fled, triggering a 12-hour manhunt that produced one of the longest documented campus alert sequences, with 36 messages across SMS, email, Twitter, and the UVA Emergency website. The two-stage escalation from 'SHOTS FIRED' to 'ACTIVE ATTACKER' reflected a deliberate verification protocol. This case file documents 13 of the 36 alerts recovered from public sources; approximately 20 were repetitive shelter-in-place reminders sent roughly every 15 minutes overnight.

Alerts
12
Response
16 min
Killed
3
Injured
2
Institution
University of Virginia
Public R1 · VA
All UVA cases →
~26,000 studentsUVA Alerts
Official alert policy
Read when and how UVA says it will use UVA Alerts: summarized, quoted, and analyzed.
Documented Timeline

Alert Sequence

12 messages in sequence · 12 verified verbatim

INITIAL ALERTTwitter/X
Verified verbatim@UVAPolice on X (verbatim raw t.co)111 chars
UVA Alert: Shots fired reported at Culbreth Garage. Follow fire/police direction. If possible, avoid the area.
Standard 'UVA Alert:' prefix in mixed case (sentence case), not all caps
Terse initial report: 'Shots fired reported' rather than confirming active shooter
Includes a protective directive ('avoid the area') but does not invoke Run-Hide-Fight
Sent at approximately 10:32 PM EST, 16 minutes after the first 911 call at 10:16 PM EST, a delay later criticized in the independent review for an overly cumbersome multi-level approval process
Verbatim text recovered from the UVA Police Division's official X/Twitter post; Charlottesville Tomorrow's reporting describes this alert as part of a rapid sequence of tweets, text messages, and emails pushed out simultaneously, corroborating the SMS channel label alongside the cited Twitter source
UPDATESMS+10 min
UVA Alert: ACTIVE ATTACKER firearm reported in area of Culbreth Road. RUN HIDE FIGHT
Escalation from 'Shots fired reported' to 'ACTIVE ATTACKER' in approximately 10 minutes
Uses 'ACTIVE ATTACKER' rather than 'ACTIVE SHOOTER', a terminology choice some institutions now prefer
Adds Run-Hide-Fight directive absent from the initial alert
Broadens location from specific garage to 'area of Culbreth Road'
Verbatim text recovered from the UVA Department of Safety and Security's official X/Twitter post; this message was also transmitted via SMS and email in the same simultaneous multi-channel push described by Charlottesville Tomorrow's reporting
UPDATETwitter/X
Verified verbatim@UVASafety on X (verbatim raw t.co)84 chars
UVA Alert: ACTIVE ATTACKER firearm reported in area of Culbreth Road. RUN HIDE FIGHT
First explicit shelter-in-place directive
Confirms single suspect at large
Recovered from UVA Emergency Management archive node/8686
UPDATESMS
Verified verbatimUVA Emergency Alert Archive152 chars
UVA Alert: UPDATE TO THE SHOOTING ON CULBRETH ROAD. 1 SUSPECT IS AT LARGE, IS CONSIDERED TO BE ARMED AND DANGEROUS. PLEASE CONTINUE TO SHELTER IN PLACE.
Escalation: suspect now 'ARMED AND DANGEROUS'
All-caps format for severity emphasis
Recovered from UVA Emergency Management archive node/8701
UPDATESMS
Verified verbatimUVA Emergency Alert Archive146 chars
UPDATE: 1 SUSPECT IS AT LARGE, CONSIDERED ARMED & DANGEROUS. CONTINUE TO SHELTER IN PLACE. REACH OUT TO FRIENDS & FAMILY TO ADVISE OF YOUR STATUS.
'REACH OUT TO FRIENDS & FAMILY TO ADVISE OF YOUR STATUS' is an unusual and empathetic directive
Acknowledges the human dimension of an unfolding crisis, not just the tactical situation
UPDATESMS
Verified verbatimUVA Emergency Alert Archive100 chars
UVA Alert: SUSPECT IS DESCRIBED AS A BLACK MALE, WEARING A BURGANDY JACKET BLUE JEANS AND RED SHOES.
Typo preserved: 'BURGANDY' (not 'BURGUNDY'), an authenticity marker of urgent composition
Provides physical description to enable community assistance in identifying suspect
Recovered from UVA Emergency Management archive node/8706
UPDATESMS
Verified verbatimUVA Emergency Alert Archive127 chars
SUSPECT IS CHRISTOPHER DARNELL JONES JR. DESCRIBED AS A BLACK MALE, WEARING A BURGANDY JACKET OR HOODIE, BLUE JEANS, RED SHOES.
First alert naming the suspect by full name
Same 'BURGANDY' typo carried forward from the previous alert
Recovered from UVA Emergency Management archive node/8746
UPDATESMS
Verified verbatimUVA Emergency Alert Archive98 chars
SUSPECT IS A B/M BURGANDY JACKET, BLUE JEANS, RED SHOES. MAY BE DRIVING A BLACK SUV VA TAG TWX3580
Adds vehicle description and license plate: critical escalation detail
Uses police abbreviation 'B/M' (Black/Male) rather than full description
Recovered from UVA Emergency Management archive node/8751
UPDATESMS
Verified verbatimUVA Emergency Alert Archive146 chars
UVA Alert: Shelter in place remains in effect. Suspect is at large. UPD is actively searching. Monitor email for updates. Call 911 to report info.
Transition to manhunt posture: 'suspect is at large'
Directs to email for detailed updates, acknowledging SMS length limits
One of approximately 20 periodic shelter-in-place reminders sent roughly every 15 minutes overnight
UPDATESMS
Verified verbatimUVA Emergency Alert Archive160 chars
Update: UPD reported shooting resulted in 3 fatalities. 2 add'l victims are injured. Refer to UVA email and social media for more information. Shelter in place.
First SMS confirmation of fatalities, approximately 5.5 hours after the shooting
Abbreviation 'add'l' reflects SMS character optimization
Directs to email/social for fuller information, a recurring pattern in this sequence
Recovered from UVA Emergency Management archive node/8786
UPDATEEmail+7h 28m
Verified verbatimUVA Emergency Alert Archive289 chars
UVA Alert: The University of Virginia has cancelled all classes for today, Monday, Nov. 14. All University activities are also cancelled. Employees who do not provide essential services should not report to work. The shelter-in-place order remains in effect. The suspect is still at large.
Morning administrative update: cancels classes, activities, non-essential work
Shelter-in-place maintained overnight into the next day
'Suspect is still at large' signals unresolved threat 8+ hours after incident
ALL CLEARSMS+12h 1m
Verified verbatimUVA Emergency Alert Archive172 chars
UVA Alert: A suspect is in custody. The UVA shelter-in-place has been lifted. Thank you for your patience and cooperation during this time. Further information will follow.
12 hours from first alert to all-clear
'Thank you for your patience and cooperation' provides emotional acknowledgment
This case file documents 13 of the 36 total alerts; approximately 20 were repetitive shelter-in-place reminders sent roughly every 15 minutes overnight
Message elements

How the first alert is built

To check this alert, Claude (an AI) read it in full 25 separate times, independently. Each read decided whether the message answers each of the six questions and gave a short reason. A final reviewer then weighed all 25 and wrote the plain-English verdict you see when you open a row. The score (for example 22/25) is how many reads agreed; the 25 individual reads are tucked underneath if you want to check them.

UVA Alert: Shots fired reported at Culbreth Garage. Follow fire/police direction. If possible, avoid the area.

  • Sourcepresent25/25

    Final assessment

    All 25 reads agree the source is present; it opens with the branded UVA Alert signature and references fire and police.

    Who is sending the alert and who is responding. People act faster on a message from a clearly identifiable, credible sender, such as a named department, the police, or a branded alert system, than on an anonymous notice. A branded signature counts.

    See all 25 individual reads
    1. present: It opens "UVA Alert", a branded signature identifying the sender.
    2. present: It opens with "UVA Alert", a branded sender signature.
    3. present: It opens with the branded signature "UVA Alert".
    4. present: It opens "UVA Alert" and references "fire/police".
    5. present: The "UVA Alert" signature identifies the sender.
    6. present: It opens with the branded signature "UVA Alert", identifying the sender.
    7. present: It opens with "UVA Alert", a branded sender tag.
    8. present: It opens with the branded tag "UVA Alert".
    9. present: The "UVA Alert" branded signature identifies the sender.
    10. present: It opens with "UVA Alert", a branded signature identifying the sender.
    11. present: It opens with the branded signature "UVA Alert".
    12. present: The branded "UVA Alert" and "fire/police" identify the sender.
    13. present: It opens with "UVA Alert", a branded signature.
    14. present: It opens "UVA Alert", a branded signature identifying the sender.
    15. present: It opens with the branded signature "UVA Alert".
    16. present: It opens "UVA Alert", a branded signature, and references fire/police direction.
    17. present: It opens "UVA Alert", a branded signature identifying the sender.
    18. present: It opens with the branded signature "UVA Alert".
    19. present: It opens with the branded signature "UVA Alert".
    20. present: It opens with the branded signature "UVA Alert".
    21. present: It opens "UVA Alert", a branded signature identifying the sender.
    22. present: Opens "UVA Alert" branded signature.
    23. present: Opens "UVA Alert" identifying the sender.
    24. present: "UVA Alert" is a branded alert signature identifying the sender.
    25. present: It opens with the branded signature "UVA Alert".
  • Hazardpresent25/25

    Final assessment

    Unanimous that a specific hazard is named, shots fired.

    What the threat actually is. A complete warning names the specific danger, such as a shooter, a fire, a tornado, or a gas leak, rather than a vague emergency, because people decide what to do based on what they are facing.

    See all 25 individual reads
    1. present: It names "Shots fired", a specific hazard.
    2. present: It names "Shots fired", a specific threat.
    3. present: It names "Shots fired", a specific threat.
    4. present: It names "Shots fired", a specific threat.
    5. present: It names "Shots fired", a specific hazard.
    6. present: It names "Shots fired", a specific threat.
    7. present: It names "Shots fired", a specific threat.
    8. present: It names "Shots fired", a specific threat.
    9. present: It names "Shots fired", a specific threat.
    10. present: It names "Shots fired", a specific threat.
    11. present: It names "Shots fired", a specific threat.
    12. present: It names "Shots fired", a specific hazard.
    13. present: It names "Shots fired", a specific threat.
    14. present: It names "Shots fired", a specific threat.
    15. present: It names "Shots fired", a specific threat.
    16. present: It names "Shots fired", a specific threat.
    17. present: It names "Shots fired reported", a specific threat.
    18. present: It names "Shots fired", a specific threat.
    19. present: It names "Shots fired", a specific threat.
    20. present: It names "Shots fired", a specific threat.
    21. present: It names "Shots fired", a specific threat.
    22. present: Names "Shots fired".
    23. present: Names "Shots fired", a specific threat.
    24. present: It names "Shots fired", a specific threat.
    25. present: It states "Shots fired reported", a specific threat.
  • Locationpresent25/25

    Final assessment

    Unanimous that a location is given, at Culbreth Garage.

    Where the threat is. Saying whether danger is in a specific building, a part of campus, or area-wide lets people judge their own proximity and choose a safe direction. Without a where, a warning is hard to act on precisely.

    See all 25 individual reads
    1. present: It locates it "at Culbreth Garage".
    2. present: It locates it "at Culbreth Garage".
    3. present: It locates it "at Culbreth Garage".
    4. present: It says "at Culbreth Garage".
    5. present: It locates it "at Culbreth Garage".
    6. present: It specifies "Culbreth Garage", a location.
    7. present: It locates it "at Culbreth Garage", a specific place.
    8. present: It names "Culbreth Garage".
    9. present: It locates it "at Culbreth Garage".
    10. present: It locates it "at Culbreth Garage".
    11. present: It specifies "Culbreth Garage".
    12. present: It names "Culbreth Garage".
    13. present: It locates it "at Culbreth Garage".
    14. present: It names "Culbreth Garage", a specific place.
    15. present: It locates it "at Culbreth Garage".
    16. present: It names "Culbreth Garage", a specific place.
    17. present: It names "Culbreth Garage", a specific place.
    18. present: It locates it "at Culbreth Garage".
    19. present: It locates it "at Culbreth Garage".
    20. present: It locates it "at Culbreth Garage".
    21. present: It locates it "at Culbreth Garage", a specific place.
    22. present: Names "Culbreth Garage".
    23. present: Locates it "at Culbreth Garage".
    24. present: It names "Culbreth Garage", a specific place.
    25. present: It locates it "at Culbreth Garage".
  • Guidancepresent25/25

    Final assessment

    Unanimous that protective action is given, to follow fire and police direction and avoid the area.

    The protective action to take. A clear, specific instruction, such as shelter in place, evacuate, avoid the area, or run-hide-fight, drives faster and more correct protective behavior than describing the threat alone.

    See all 25 individual reads
    1. present: It instructs "Follow fire/police direction. If possible, avoid the area".
    2. present: It instructs to "Follow fire/police direction" and "avoid the area".
    3. present: It instructs "Follow fire/police direction" and "avoid the area".
    4. present: It instructs "avoid the area".
    5. present: It instructs recipients to "avoid the area" and "Follow fire/police direction".
    6. present: It tells recipients to "Follow fire/police direction" and "avoid the area", protective actions.
    7. present: It instructs recipients to "Follow fire/police direction" and "avoid the area", protective actions.
    8. present: It instructs "If possible, avoid the area" and "Follow fire/police direction".
    9. present: It instructs recipients to "avoid the area" and "Follow fire/police direction".
    10. present: It instructs recipients to "Follow fire/police direction" and "avoid the area".
    11. present: It instructs recipients to "avoid the area" and "Follow fire/police direction".
    12. present: It instructs recipients to "avoid the area" and follow direction.
    13. present: It instructs recipients to "Follow fire/police direction" and "avoid the area".
    14. present: It instructs "Follow fire/police direction" and "avoid the area", protective actions.
    15. present: It instructs recipients to "Follow fire/police direction" and "avoid the area".
    16. present: It instructs to "Follow fire/police direction" and "avoid the area", protective actions.
    17. present: It instructs "Follow fire/police direction" and "avoid the area".
    18. present: It instructs to "Follow fire/police direction" and "avoid the area".
    19. present: It instructs recipients to "Follow fire/police direction" and "avoid the area".
    20. present: It instructs to "avoid the area" and "Follow fire/police direction".
    21. present: It instructs "Follow fire/police direction" and "avoid the area".
    22. present: Instructs "Follow fire/police direction" and "avoid the area".
    23. present: Instructs to "Follow fire/police direction" and "avoid the area".
    24. present: It instructs to "Follow fire/police direction" and "avoid the area", protective actions.
    25. present: It instructs to "Follow fire/police direction" and "avoid the area".
  • Timeabsent0/25

    Final assessment

    Unanimous that no clock time, date, or recency cue appears in the text.

    When the message applies. A timestamp, the word now or immediately, or a phrase like until further notice tells the reader whether the danger is current and how quickly to act.

    See all 25 individual reads
    1. absent: No clock time, date, or recency cue appears.
    2. absent: No clock time, date, or recency cue appears.
    3. absent: No clock time, date, or recency cue appears in the text.
    4. absent: No clock time, date, or recency cue appears.
    5. absent: No clock time, date, or recency cue appears in the text.
    6. absent: No clock time, date, or recency cue appears in the text.
    7. absent: No clock time, date, or recency cue appears.
    8. absent: No clock time, date, or recency cue appears in the text.
    9. absent: No clock time, date, or recency cue appears.
    10. absent: No clock time, date, or recency cue appears in the text.
    11. absent: No clock time, date, or recency cue appears.
    12. absent: No clock time, date, or recency cue appears.
    13. absent: No clock time, date, or recency cue appears in the text.
    14. absent: No clock time, date, or recency cue appears.
    15. absent: No clock time, date, or recency cue appears in the text.
    16. absent: No clock time, date, or recency cue appears in the text.
    17. absent: No clock time, date, or recency cue appears.
    18. absent: No clock time, date, or recency cue appears.
    19. absent: No clock time, date, or recency cue appears.
    20. absent: No clock time, date, or recency cue appears.
    21. absent: No clock time, date, or recency cue appears in the message.
    22. absent: No clock time, date, or recency cue appears.
    23. absent: No clock time, date, or recency cue appears in the text.
    24. absent: No clock time, date, or recency cue appears in the text.
    25. absent: No clock time, date, or recency cue appears.
  • Impactabsent11/25

    Final assessment

    Absent by majority (14 of 11): it reports shots fired and advises avoiding the area but states no injury, harm, or danger severity; the substantial dissent treated gunfire with avoidance instructions as implying a deadly threat.

    What the hazard could do to the people in its path. Beyond naming the threat, a complete warning conveys its potential consequences or severity, such as that a tornado can level buildings or that a leak could be explosive, so recipients grasp how much danger they are in. Research on warning message content finds that a concrete impact statement helps people personalize their risk and act sooner.

    See all 25 individual reads
    1. present: Reports shots fired and advises following police direction and avoiding the area, implying a gunfire threat to safety.
    2. absent: It reports shots fired and to avoid the area but states no harm, injury, or danger explicitly.
    3. present: Shots fired with instructions to follow police direction and avoid the area conveys a deadly threat to people.
    4. absent: It reports shots fired and tells people to avoid the area but states no harm, injury, or how dangerous it is.
    5. absent: It reports shots fired and tells people to avoid the area but states no harm, injury, or stated danger beyond the hazard name.
    6. absent: It reports shots fired and to avoid the area but states no explicit harm, injury, or severity.
    7. present: Reports shots fired and instructs to follow police direction and avoid the area, implying a clear threat of harm.
    8. absent: It reports shots fired and tells people to avoid the area but states no harm, injury, or how dangerous it is.
    9. absent: Reports shots fired and to avoid the area but states no explicit harm or danger.
    10. absent: It reports shots fired and to avoid the area and follow direction but states no consequence or stated harm.
    11. absent: This reports shots fired and advises avoiding the area but states no injury, harm, or stated danger.
    12. absent: Reports shots fired and to avoid the area but states no harm, injury, or stated danger.
    13. present: Reports shots fired and directs people to follow police direction and avoid the area, implying a threat to safety from gunfire.
    14. present: Reports shots fired and directs people to follow police and avoid the area, with the directive conveying danger to people.
    15. present: Reports shots fired and tells people to avoid the area, implying a threat to safety from gunfire.
    16. absent: It reports shots fired and tells people to avoid the area but states no explicit harm, injury, or severity.
    17. present: It reports shots fired and directs people to follow police and avoid the area, implying a threat of harm.
    18. present: Shots fired with instructions to follow fire/police direction and avoid the area conveys an active danger to safety.
    19. present: Reports shots fired and directs people to follow police direction and avoid the area, conveying a clear armed threat to safety.
    20. absent: It reports shots fired and directs avoiding the area but states no harm, injury, or explicit danger.
    21. present: Reports shots fired and directs people to avoid the area and follow police direction, implying danger to safety.
    22. absent: It reports shots fired and to avoid the area but states no harm, severity, or consequence beyond naming the hazard.
    23. present: Shots fired with instruction to follow police direction and avoid the area conveys danger to safety.
    24. absent: This names shots fired and gives avoidance guidance but states no harm or consequence.
    25. absent: Reports shots fired with avoidance guidance but states no explicit harm or severity.

Systematic AI judgments with visible reasoning, not human-validated codings.

About this analysis
Context

Background

The UVA shooting produced one of the most extensive documented campus alert sequences in history. The 36 messages across 12 hours (roughly one every 15 minutes) illustrate the communication challenge of an extended manhunt across SMS, email, Twitter, and the UVA Emergency website. This case file documents 13 of the 36 alerts recovered from public sources; approximately 20 were repetitive shelter-in-place reminders sent at regular intervals overnight. The two-stage escalation from 'SHOTS FIRED' to 'ACTIVE ATTACKER' (with a 4-minute gap) reflects the tension between speed and accuracy. Subsequent alerts show progressive information escalation: suspect description (with the preserved 'BURGANDY' typo), suspect name, vehicle description with license plate, fatality count, and finally the all-clear. The independent review later concluded that even the initial alert was delayed; the 16-minute gap between the first 911 call and the first alert was attributed to the time needed to confirm the threat. Three football players, Devin Chandler, Lavel Davis Jr., and D'Sean Perry, were killed. The shooter, a former football player, was found the following morning in Henrico County.
Analysis

Key Findings

36 alerts over 12 hours represents one of the longest documented campus alert sequences
Two-stage escalation (SHOTS FIRED to ACTIVE ATTACKER) reflects deliberate verification protocol
16-minute gap between 911 call and first alert was later criticized by an independent review as too long
'BURGANDY' typo in suspect description carried forward across multiple alerts, an authenticity marker of urgent composition
Progressive information escalation: shots fired, active attacker, suspect description, suspect name, vehicle/plate, fatalities, all-clear
'REACH OUT TO FRIENDS & FAMILY TO ADVISE OF YOUR STATUS' is an unusually empathetic directive in a tactical alert
Approximately 20 overnight alerts were repetitive shelter-in-place reminders sent roughly every 15 minutes
Outcome
Suspect apprehended the following morning in Henrico County. The gunman, Christopher Darnell Jones Jr., pleaded guilty to three counts of first-degree murder in November 2024 and was sentenced in November 2025 to five life terms plus 23 years. An independent review found the initial alert should have been sent sooner; it went out 16 minutes after the first 911 call.
Reception

Community Response

How the campus community received and interpreted the alert(s), in their own words.

Poorly received

Independent reviews concluded UVA "waited too long" (about 16 minutes after the first 911 call) to issue the first UVA Alert, with the external review saying the delay subjected the community to "preventable risk," and students describing being unaware a shooter was loose for hours.

That elapsed period of time is too long given the timeline of most active shooting incidents and could have resulted in University community members being subject to preventable risk by unknowingly continuing to move freely around Grounds despite the presence of an active shooter
Vinson & Elkins external review report· Charlottesville TomorrowView source
It's scary to think that a shooter was loose in my city for so long and I had no idea
Paige Robinson, UVA student· UVA MagazineView source

Reactions to the alert, drawn from press coverage; follow each link to verify. Quotes are reproduced from reporting and not independently re-confirmed against the original source.

Provenance

Sources

  1. Official
  2. Report
  3. Official
  4. Official
Cite this case

Campus Alert Archive. "University of Virginia: Student gunman killed three on a chartered bus; 12-hour manhunt produced 36 alerts." Incident of November 13, 2022. Added March 2026; last updated July 2026. https://campusalertarchive.com/case/uva-shooting-2022-11-13/

Download case JSON

Alert text quoted on this page remains the work of the issuing institution; the archive is a secondary source.

Tags
active-shootermanhuntovernightextended-sequencerun-hide-fighttwo-stage-escalationfootball-players2022
Added March 2026Updated July 2026Via manual