The cases that reshaped campus emergency communication
If a single incident can be said to have created the modern campus alert, it is the Virginia Tech shooting of April 16, 2007. A 22-year-old student killed two people in West Ambler Johnston Hall at 7:15 AM. The first university-wide email went out at 9:26 AM, 131 minutes later. Its confirmed text reads, in part, "A shooting incident occurred at West Amber Johnston earlier this morning. Police are on the scene and are investigating." ("West Amber Johnston," for West Ambler Johnston Hall, is preserved as sent.) The email urged caution and asked anyone with information to call police; it named no protective action. Roughly fifteen minutes after it went out, the shooter opened fire in Norris Hall and killed thirty more people. The 131-minute gap is the single most-studied number in this archive: the state's official review panel report made the notification delay its central finding, and the Higher Education Opportunity Act of 2008 (HEOA) rewrote the Clery Act to require immediate emergency notification, the requirement every alert in this archive now operates under.
What this chapter documents is what immediate has come to mean in practice, and how unevenly it is practiced.
The arc from 131 minutes to 8
Compare the Virginia Tech delay to UNLV, December 6, 2023. A gunman opened fire on the fourth floor of Beam Hall at 11:45 AM PST. The first alert, sent at 11:53 AM, eight minutes after the first 911 call, read "University Police responding to report of shots fire in BEH evacuate to a safe area, RUN-HIDE-FIGHT"; three Las Vegas outlets quoted the same "shots fire" typo, and the archive preserves it as sent. At 11:59 AM the @UNLV account posted "University Police responding to confirmed active shooter in BEH. This is not a test. RUN-HIDE-FIGHT." At 12:20 PM a third alert reported additional shots at the Student Union and told people to evacuate the area; at 12:58 PM police asked the campus to keep sheltering while they cleared buildings one at a time. The shooter had died in a confrontation with police within minutes of the first shots, but the 7:38 PM message still read "The threat has been neutralized" while ordering "Shelter in place until further notice": the full shelter-in-place held for nearly eight hours. Eight minutes to a first alert, against Virginia Tech's 131, is the distance between 2007 and 2023. The hours that followed are part of the same record.
Between Virginia Tech and UNLV sit Northern Illinois (Cole Hall, February 14, 2008: "There has been a report of a possible gunman on campus. Get to a safe area and take precautions", sent at 3:20 PM, fifteen minutes after the shooting began), the University of Texas at Austin (September 28, 2010: an 8:17 AM shelter-in-place SMS, preserved in the archive as a reconstruction), Umpqua Community College (October 1, 2015: a lockdown declared four minutes after the shooting began), Ohio State (November 28, 2016: "Buckeye Alert: Active Shooter on campus. Run Hide Fight. Watts Hall. 19th and College.", 86 characters posted at 9:56 AM), the University of Virginia (November 13, 2022), Michigan State (February 13, 2023: "There have been shots fired near Berkey Hall on the East Lansing campus. Please secure-in-place immediately." at 8:31 PM, with "Run, Hide, Fight" following on the multi-channel alert a minute later), the University of North Carolina at Chapel Hill (August 28, 2023: "Emergency: Armed, dangerous person on or near campus. Go inside now; avoid windows.", sent at 1:03 PM, one minute after the first 911 call), and Florida State (April 17, 2025). Each of those is its own case file in the archive. The K-12 shootings of the same years (Sandy Hook, Parkland, Oxford, Uvalde) fall outside a higher-education archive and are not case files here.
What this chapter is actually about
The 659 cases in this chapter are not all mass casualty events. The majority are single-shooter, no-injury, or shooter-self-evacuated incidents that nonetheless triggered an emergency notification: armed-person sightings, off-campus shooting bleed-over, and swatting hoaxes mistaken for live shooters until proven otherwise. The verbatim alert texts in this chapter are therefore the genre's full vocabulary: the compressed first SMS, the formal email follow-up, the overnight timeline correction, the next-day apology explaining why a swatting call was treated as the real thing.
A few patterns repeat across the chapter and are worth flagging for emergency managers studying these cases as a benchmark:
In this chapter's fastest documented cases, the first message is one short sentence that leads with what to do. UNC's one-minute alert ("Go inside now; avoid windows."), UNLV's eight-minute alert, and NIU's fifteen-minute message each fit in a sentence or two and put a protective action in the first breath. The chapter's most-studied slow first alert, Virginia Tech's 131-minute email, named no protective action: it described an investigation and asked for information. The archive records what was sent and when, not what recipients did, so this is a documented co-occurrence of speed and brevity, not a measured effect of either.
"Run. Hide. Fight." is newer in this record than its fame suggests, and rarer. The Department of Homeland Security's active-shooter guidance, built on a 2012 City of Houston video DHS funded, made the phrase the national standard for individual response. In this archive, its first documented appearance inside an alert is Ohio State's, November 28, 2016, and it remains a small minority of the chapter's alert texts after that. The 2007-2012 cases predate it entirely; where their first alerts instruct at all, the instruction is "Get to a safe area" (NIU) or shelter-in-place (UT Austin).
Three protective-action vocabularies coexist in these alerts, sometimes within a single message. Each carries a different doctrine. "Lockdown" descends from active-threat protocol: lock the door, stay quiet, stay out of sight. "Shelter in place" descends from hazmat response: go indoors and seal the room against outside air. "Run. Hide. Fight." is addressed to the individual, and its first option is leaving. The chapter documents the terms in combination as well as in isolation, though no confirmed alert in this collection carries all three at once. Emory's first confirmed alert during the 2025 CDC shooting paired the second and third ("RUN, HIDE, FIGHT. Avoid the area. Shelter in place."); a 2022 Jamestown Community College SMS paired the first and third ("Lockdown on Jamestown Community College's Cattaraugus County Campus in all buildings due to man potentially with a weapon. Run, hide, fight."), then defined each verb inside the same message ("Run from the threat. Hide out of view. Fight to protect yourself if an intruder enters your area."); and a 2023 Delaware County Community College SMS read, in its entirety, "DCCC Emergency Alert: Shelter in Place or Run, Hide, Fight". Rendering varies as well: Ohio State sent "Run Hide Fight", UNLV "RUN-HIDE-FIGHT", Michigan State "Run, Hide, Fight". Which vocabulary an institution reached for, and how it paired stay-put language with leave-if-you-can language, is a dimension of these messages worth reading as closely as their timing.
The "all-clear" is a separate genre. A message that still tells people to shelter or avoid an area is not an all-clear, no matter what its subject line says. This archive is strict about that distinction; readers studying response timing should be too.
What the expanded record adds
The most recent cases carry the arc into 2025 and 2026. Florida State's shooting of April 17, 2025 produced a first alert six minutes in: "An active shooter has been reported in the area of Student Union. Police are on scene or on the way." The full SMS breaks off mid-word ("be prepared to take additional protective measur") just before its link; the archive preserves the truncation as sent. The same afternoon, Florida A&M, also in Tallahassee, sent its own campus a message about its neighbor's emergency: "Avoid the area or lockdown if nearby. No threat to FAMU Campus at this time." The adjacent-campus alert, sent for an incident on someone else's grounds, is its own genre in this collection. That November, the University of Virginia's alert for a reported active attacker at Shannon Library led with the location and closed with the protocol ("UVA Emergency Alert: ACTIVE ATTACKER with a gun reported in area of Shannon Library 160 McCormick Road. RUN HIDE FIGHT"); its follow-up ten minutes later read, in its entirety, "3:14 PM: UVA Emergency Alert: RUN-HIDE-FIGHT". In this record, by 2025 the three words could stand alone as a complete emergency message.
The expanded collection also documents the campuses the famous cases overshadow. Central Oregon Community College locked down its Bend campus on October 7, 2021 over a report of an armed person; the all-clear about a half hour later named what the object turned out to be: "A compass was mistaken for a firearm." Many of the chapter's armed-person cases at community colleges resolve on that pattern: a report taken seriously, a lockdown, an all-clear that explains. The chapter's HBCU coverage deepened the same way, and it consists mostly of shooting and shots-fired notices rather than mass-casualty attacks. North Carolina A&T sent three separate AggieAlerts for shots fired in the fall 2025 semester alone (August 20, September 13, and September 21), each naming its location in the same house format; the first read "EMERGENCY- AggieAlert! Shots fired between the area of the Deese Clocktower." Alcorn State's homecoming shooting of October 11, 2025 shows the other end of the sequence: the shelter order issued that evening held overnight, and the all-clear arrived the next morning: "Students, faculty, and staff may safely leave shelter in place locations."
What you cannot read out of these cases, and what no archive can give you, is the part of every active-shooter incident that lives between the first 911 call and the first message sent: the moment a dispatcher decides the threat is credible, the moment a campus police chief authorizes the alert, the moment someone at a console types "Buckeye Alert: Active Shooter on campus. Run Hide Fight. Watts Hall. 19th and College." and presses Send. The verbatim text is the artifact. The decision behind it is the work.