A student opened fire on a chartered bus returning from a field trip, killing three football players. The shooter fled, triggering a 12-hour manhunt that produced one of the longest documented campus alert sequences, with 36 messages across SMS, email, Twitter, and the UVA Emergency website. The two-stage escalation from 'SHOTS FIRED' to 'ACTIVE ATTACKER' reflected a deliberate verification protocol. This case file documents 13 of the 36 alerts recovered from public sources; approximately 20 were repetitive shelter-in-place reminders sent roughly every 15 minutes overnight.
UVA Alert: Shots fired reported at Culbreth Garage. Follow fire/police direction. If possible, avoid the area.
Standard 'UVA Alert:' prefix in mixed case (sentence case), not all caps
Terse initial report: 'Shots fired reported' rather than confirming active shooter
Includes a protective directive ('avoid the area') but does not invoke Run-Hide-Fight
Sent at approximately 10:32 PM EST — 16 minutes after the first 911 call at 10:16 PM, a delay later criticized in the independent review for an overly cumbersome multi-level approval process
UVA Alert: UPDATE TO THE SHOOTING ON CULBRETH ROAD. 1 SUSPECT IS AT LARGE, IS CONSIDERED TO BE ARMED AND DANGEROUS. PLEASE CONTINUE TO SHELTER IN PLACE.
Escalation: suspect now 'ARMED AND DANGEROUS'
All-caps format for severity emphasis
Recovered from UVA Emergency Management archive node/8701
Update: UPD reported shooting resulted in 3 fatalities. 2 add'l victims are injured. Refer to UVA email and social media for more information. Shelter in place.
First SMS confirmation of fatalities, approximately 5.5 hours after the shooting
Abbreviation 'add'l' reflects SMS character optimization
Directs to email/social for fuller information, a recurring pattern in this sequence
Recovered from UVA Emergency Management archive node/8786
UVA Alert: The University of Virginia has cancelled all classes for today, Monday, Nov. 14. All University activities are also cancelled. Employees who do not provide essential services should not report to work. The shelter-in-place order remains in effect. The suspect is still at large.
Morning administrative update: cancels classes, activities, non-essential work
Shelter-in-place maintained overnight into the next day
'Suspect is still at large' signals unresolved threat 8+ hours after incident
UVA Alert: A suspect is in custody. The UVA shelter-in-place has been lifted. Thank you for your patience and cooperation during this time. Further information will follow.
12 hours from first alert to all-clear
'Thank you for your patience and cooperation' provides emotional acknowledgment
This case file documents 13 of the 36 total alerts; approximately 20 were repetitive shelter-in-place reminders sent roughly every 15 minutes overnight
Context
Background
The UVA shooting produced one of the most extensive documented campus alert sequences in history. The 36 messages across 12 hours (roughly one every 15 minutes) illustrate the communication challenge of an extended manhunt across SMS, email, Twitter, and the UVA Emergency website. This case file documents 13 of the 36 alerts recovered from public sources; approximately 20 were repetitive shelter-in-place reminders sent at regular intervals overnight. The two-stage escalation from 'SHOTS FIRED' to 'ACTIVE ATTACKER' (with a 4-minute gap) reflects the tension between speed and accuracy. Subsequent alerts show progressive information escalation: suspect description (with the preserved 'BURGANDY' typo), suspect name, vehicle description with license plate, fatality count, and finally the all-clear. The independent review later concluded that even the initial alert was delayed; the 16-minute gap between the first 911 call and the first alert was attributed to the time needed to confirm the threat. Three football players, Devin Chandler, Lavel Davis Jr., and D'Sean Perry, were killed. The shooter, a former football player, was found the following morning in Henrico County.
Analysis
Key Findings
0136 alerts over 12 hours represents one of the longest documented campus alert sequences
02Two-stage escalation (SHOTS FIRED to ACTIVE ATTACKER) reflects deliberate verification protocol
0316-minute gap between 911 call and first alert was later criticized despite being faster than many peer institutions
04'BURGANDY' typo in suspect description carried forward across multiple alerts, an authenticity marker of urgent composition
05Progressive information escalation: shots fired, active attacker, suspect description, suspect name, vehicle/plate, fatalities, all-clear
06'REACH OUT TO FRIENDS & FAMILY TO ADVISE OF YOUR STATUS' is an unusually empathetic directive in a tactical alert
07Approximately 20 overnight alerts were repetitive shelter-in-place reminders sent roughly every 15 minutes
Outcome
Suspect apprehended the following morning in Henrico County. An independent review found the initial alert should have been sent sooner — it went out 16 minutes after the first 911 call.