The Practitioner Playbook

Practice 1 of 9

Template the six elements before you ever need them

First alerts reliably include the easy elements (where) and omit the hard ones (what it could do, until when, what to do) — a gradient consistent with messages composed ad hoc under stress. A pre-approved fill-in-the-blank template that prompts for source, hazard, location, guidance, time, and impact turns a judgment call under pressure into a form-filling exercise.

Grounding: Five of the six elements come from Mileti & Sorensen's 1990 FEMA synthesis, reflected in CDC CERC and FEMA's WEA guidance; the sixth, impact, follows Dr. Jeannette Sutton's research. Sources are listed on the Message Anatomy page.

Practice 2 of 9

Never send a threat alert without a protective action

One in four coded first alerts gives no guidance at all — including dozens of alerts about shootings, stabbings, and armed persons. An alert that names a danger but no action outsources the protective decision to thousands of people individually, at the worst possible moment. Even a generic action (“avoid the area”, “secure-in-place”) measurably outperforms silence in the warning literature.

Practice 3 of 9

Write the first hundred characters for the lock screen

Concatenated SMS and push notifications have removed the hard 160-character ceiling, and a third of recent SMS first alerts run past it. Length is now a choice — but the lock-screen preview is not. Whatever the total length, the lock-screen preview — roughly the first sentence — is all many recipients see before deciding what to do.

Practice 4 of 9

Tell people when the next update will come — then keep the promise

The median documented gap between the first alert and the first update is about an hour, and a quarter of the documented cases left people waiting three hours or more. People who receive a warning immediately begin confirming it; a silent hour hands that process to group chats and rumor. A cadence promise (“next update by 2:30 PM even if nothing has changed”) is free, and 'no change' is itself information.

Grounding: CDC's Crisis and Emergency Risk Communication guidance treats committed update cadence as a core practice for maintaining credibility during uncertainty.

Practice 5 of 9

Close every incident with an explicit all-clear

In nearly half of archived cases, the record ends without any message lifting the protective action. Either the loop was never closed, or the closing message was never preserved — and both are failures: one leaves thousands of people deciding individually when ‘shelter in place’ stopped applying, the other erases the institution's final, credible word from the public record.

Practice 6 of 9

Pre-script the hoax: verification updates and honest uncertainty

One in eight recent cases in the archive ended as a confirmed hoax or swatting, and clearing one still takes police roughly two hours. The first alert can't wait for verification — so the hoax playbook lives in messages two through five: language that reports without confirming (“police are investigating a report of…”), visible verification progress, and a firm all-clear that names the thing a hoax.

Practice 7 of 9

When the system errs, correct it by name — fast

Accidental activations, wrong-campus sends, and template test messages that escape are rare in the record but devastating to trust when mishandled. The documented corrections that worked share one trait: they explicitly named the error (“that alert was sent in error”) rather than silently issuing new instructions, and they came quickly — typically within a quarter hour.

Practice 8 of 9

Know your own latency number before an incident assigns you one

Where the interval is documented, the median campus took about a quarter hour from incident start to first alert — but the well-prepared end of the distribution operates in single digits, and UNC Chapel Hill alerted within one minute in 2023. After-action reviews of the slow cases — Virginia Tech's 131 minutes above all — point again and again at approval chains rather than technology, so the lever most within your control is pre-authorization: who may send without further approval, from what device, with which template.

Practice 9 of 9

Put WEA in the toolkit for the people your database misses

Campus systems reach enrolled devices; they structurally miss visitors, contractors, prospective students on tour, and everyone whose contact record is stale. Wireless Emergency Alerts reach every WEA-capable phone in the target area with no sign-up (opt-out rather than opt-in: users can disable every alert class except National Alerts) — and they appear in only a handful of cases in this archive; the computed count is below. For a true life-safety event, the gap between those two reach models is the whole ballgame.

Grounding: FEMA's IPAWS program documents alerting-authority requirements and best practices for WEA content; see the sources on the Message Anatomy page.