The cases that reshaped campus emergency communication
If a single incident can be said to have created the modern campus alert, it is the Virginia Tech shooting of April 16, 2007. A 22-year-old student killed two people in West Ambler Johnston Hall at 7:15 AM. The first university-wide email went out at 9:26 AM, 131 minutes later, stating that police were "investigating two shooting incidents." By the time that message landed, the shooter had already entered Norris Hall and killed thirty more. The 131-minute delay is the single most-studied number in this archive, and the state's official review panel report made the notification gap its central finding. It is the reason the Higher Education Opportunity Act of 2008 (HEOA) rewrote the Clery Act to require immediate emergency notification, and why every alert system on every campus today exists in the form it does.
What this chapter documents is what immediate has come to mean in practice, and how unevenly it has been adopted.
The arc from 131 minutes to 5
Compare the Virginia Tech delay to UNLV, December 6, 2023. A gunman opened fire on the fourth floor of Beam Hall at 11:45 AM PST. The first UNLV police alert, posted to X, "University Police responding to report of shots fire in BEH evacuate to a safe area, RUN-HIDE-FIGHT", was sent at 11:53 AM, eight minutes after the first 911 call. The typo (shots fire) was preserved verbatim across SMS, X, and the campus Rebel Alert push, indicating the police dispatcher composed it under pressure and did not pause to proofread. Six minutes later, a confirmed-active-shooter update went out. Three minutes after that, a secondary report at the Student Union expanded the alert. Within 35 minutes from the first 911 call, students across the campus had received four messages and a building-by-building all-clear was underway. The shooter was already dead by the second alert, but UNLV did not yet know that, and the system's job was to assume the worst. That assumption is what HEOA encoded.
Between Virginia Tech and UNLV sit Northern Illinois (Cole Hall, February 14, 2008, 14 minutes to first alert), University of Texas at Austin (September 28, 2010, 6 minutes via UT Police Twitter, the first alert in this archive sent via social media before SMS), Sandy Hook spillover at Western Connecticut (December 14, 2012, lockdown declared even though the campus was not the target), Umpqua Community College (October 1, 2015, 3 minutes to lockdown declaration but 41 minutes to evacuation order), Florida State at Strozier Library (November 20, 2014, 2 minutes to first FSU Alert), Ohio State (November 28, 2016, the famous "BUCKEYE ALERT: Active Shooter on campus. Run Hide Fight," 85 characters that locked down 50,000 people in 90 seconds), Marshall County HS (Kentucky, January 23, 2018), Parkland (February 14, 2018), Saugus High (November 14, 2019), Oxford High School (November 30, 2021), Robb Elementary in Uvalde (May 24, 2022), Michigan State (February 13, 2023, with "Run, Hide, Fight" sent eight times across MSU Alert, Twitter, and email over the course of three hours), University of Virginia (November 13, 2022), University of North Carolina at Chapel Hill (Caudill Labs, August 28, 2023, with "Alert Carolina: Shots reported in Caudill Labs" sent one minute after the first 911 call), Florida State (April 17, 2025), and Apalachee High School (Georgia, September 4, 2024). Each of those is its own case file in the archive; together they map a learning curve that is real, measurable, and incomplete.
What this chapter is actually about
The 261 cases in this chapter are not all mass casualty events. The majority are single-shooter, no-injury, or shooter-self-evacuated incidents that nonetheless triggered an emergency notification: armed-person sightings, off-campus shooting bleed-over, and swatting hoaxes mistaken for live shooters until proven otherwise. The verbatim alert texts in this chapter are therefore the genre's full vocabulary: the dispatcher's compressed SMS, the IT-formal email follow-up, the timeline correction issued at 3:00 AM after the all-clear has held overnight, the apology email sent the next afternoon explaining why a swatting call was treated as the real thing.
A few patterns repeat across the chapter and are worth flagging for emergency managers studying these cases as a benchmark:
The first 90 seconds matter more than the next 90 minutes. The cases that hold up well (UNC, UNLV, MSU, FSU 2014, OSU 2016) share a single structural feature: the first message is short, mono-channel, and tells people to do one thing. The cases that don't (Virginia Tech, Umpqua's evacuation lag) failed at exactly this step.
"Run-Hide-Fight" became the lingua franca after 2013. The Department of Homeland Security's "Run. Hide. Fight." guidance, built on a 2012 City of Houston video DHS funded, is the reason almost every alert in this chapter from 2014 onward contains the phrase. The earlier cases (Virginia Tech, NIU, Texas) do not; alerts in the 2007–2012 window typically said "remain in your classroom" or "shelter in place," language that became legally and rhetorically inadequate after Sandy Hook reframed the bystander as an actor.
Hyphenation matters more than you'd think. Compare Ohio State's "Run Hide Fight" (no hyphens, 85 characters) to UNLV's "RUN-HIDE-FIGHT" (hyphenated, capitalized). The hyphenation in UNLV's template was kept because it survives SMS character collapses without losing meaning when phones strip whitespace; OSU's spaces are a deliberate readability choice. Both are correct. The fact that universities have actually argued about this, in writing, in their alert-system style guides, is itself an artifact this chapter preserves.
The "all-clear" is a separate genre. A message that still tells people to shelter or avoid an area is not an all-clear, no matter what its subject line says. This archive is strict about that distinction; readers studying response timing should be too.
What you cannot read out of these cases, and what no archive can give you, is the part of every active-shooter incident that lives between the first 911 call and the first message sent: the moment a dispatcher decides the threat is credible, the moment a campus police chief authorizes the alert, the moment a duty IT staffer types "BUCKEYE ALERT: Active Shooter on campus. Run Hide Fight." into a console and presses Send. The verbatim text is the artifact. The decision behind it is the work.