The cases that reshaped campus emergency communication
If a single incident can be said to have created the modern campus alert, it is the Virginia Tech shooting of April 16, 2007. A 22-year-old student killed two people in West Ambler Johnston Hall at 7:15 AM. The first university-wide email went out at 9:26 AM, 131 minutes later. Its confirmed text reads, in part, "A shooting incident occurred at West Amber Johnston earlier this morning. Police are on the scene and are investigating." ("West Amber Johnston," for West Ambler Johnston Hall, is preserved as sent.) The email urged caution and asked anyone with information to call police; it named no protective action. Roughly fifteen minutes after it went out, the shooter opened fire in Norris Hall and killed thirty more people. The 131-minute gap is the single most-studied number in this archive: the state's official review panel report made the notification delay its central finding, and the Higher Education Opportunity Act of 2008 (HEOA) rewrote the Clery Act to require immediate emergency notification, the requirement every alert in this archive now operates under.
What this chapter documents is what immediate has come to mean in practice, and how unevenly it is practiced.
The arc from 131 minutes to 8
Compare the Virginia Tech delay to UNLV, December 6, 2023. A gunman opened fire on the fourth floor of Beam Hall at 11:45 AM PST. The first alert, sent at 11:53 AM, eight minutes after the first 911 call, read "University Police responding to report of shots fire in BEH evacuate to a safe area, RUN-HIDE-FIGHT"; three Las Vegas outlets quoted the same "shots fire" typo, and the archive preserves it as sent. At 11:59 AM the @UNLV account posted "University Police responding to confirmed active shooter in BEH. This is not a test. RUN-HIDE-FIGHT." At 12:20 PM a third alert reported additional shots at the Student Union and told people to evacuate the area; at 12:58 PM police asked the campus to keep sheltering while they cleared buildings one at a time. The shooter had died in a confrontation with police within minutes of the first shots, but the 7:38 PM message still read "The threat has been neutralized" while ordering "Shelter in place until further notice": the full shelter-in-place held for nearly eight hours. Eight minutes to a first alert, against Virginia Tech's 131, is the distance between 2007 and 2023. The hours that followed are part of the same record.
Between Virginia Tech and UNLV sit Northern Illinois (Cole Hall, February 14, 2008: "There has been a report of a possible gunman on campus. Get to a safe area and take precautions", sent at 3:20 PM, fifteen minutes after the shooting began), the University of Texas at Austin (September 28, 2010: an 8:17 AM shelter-in-place SMS, preserved in the archive as a reconstruction), Umpqua Community College (October 1, 2015: a lockdown declared four minutes after the shooting began), Ohio State (November 28, 2016: "Buckeye Alert: Active Shooter on campus. Run Hide Fight. Watts Hall. 19th and College.", 86 characters posted at 9:56 AM), the University of Virginia (November 13, 2022), Michigan State (February 13, 2023: "There have been shots fired near Berkey Hall on the East Lansing campus. Please secure-in-place immediately." at 8:31 PM, with "Run, Hide, Fight" following on the multi-channel alert a minute later), the University of North Carolina at Chapel Hill (August 28, 2023: "Emergency: Armed, dangerous person on or near campus. Go inside now; avoid windows.", sent at 1:03 PM, one minute after the first 911 call), and Florida State (April 17, 2025). Each of those is its own case file in the archive. The K-12 shootings of the same years (Sandy Hook, Parkland, Oxford, Uvalde) fall outside a higher-education archive and are not case files here.
What this chapter is actually about
The 337 cases in this chapter are not all mass casualty events. The majority are single-shooter, no-injury, or shooter-self-evacuated incidents that nonetheless triggered an emergency notification: armed-person sightings, off-campus shooting bleed-over, and swatting hoaxes mistaken for live shooters until proven otherwise. The verbatim alert texts in this chapter are therefore the genre's full vocabulary: the compressed first SMS, the formal email follow-up, the overnight timeline correction, the next-day apology explaining why a swatting call was treated as the real thing.
A few patterns repeat across the chapter and are worth flagging for emergency managers studying these cases as a benchmark:
In this chapter's fastest documented cases, the first message is one short sentence that leads with what to do. UNC's one-minute alert ("Go inside now; avoid windows."), UNLV's eight-minute alert, and NIU's fifteen-minute message each fit in a sentence or two and put a protective action in the first breath. The slowest first alert in the chapter, Virginia Tech's 131-minute email, named no protective action: it described an investigation and asked for information. The archive records what was sent and when, not what recipients did, so this is a documented co-occurrence of speed and brevity, not a measured effect of either.
"Run. Hide. Fight." is newer in this record than its fame suggests, and rarer. The Department of Homeland Security's active-shooter guidance, built on a 2012 City of Houston video DHS funded, made the phrase the national standard for individual response. In this archive, its first documented appearance inside an alert is Ohio State's, November 28, 2016, and it remains a small minority of the chapter's alert texts after that. The 2007-2012 cases predate it entirely; where their first alerts instruct at all, the instruction is "Get to a safe area" (NIU) or shelter-in-place (UT Austin).
Three protective-action vocabularies coexist in these alerts, sometimes within a single message. Each carries a different doctrine. "Lockdown" descends from active-threat protocol: lock the door, stay quiet, stay out of sight. "Shelter in place" descends from hazmat response: go indoors and seal the room against outside air. "Run. Hide. Fight." is addressed to the individual, and its first option is leaving. The chapter documents the terms in combination as well as in isolation: Emory's first confirmed alert during the 2025 CDC shooting carried all three in one message ("RUN, HIDE, FIGHT. Avoid the area. Shelter in place."), and a 2023 Delaware County Community College SMS read, in its entirety, "DCCC Emergency Alert: Shelter in Place or Run, Hide, Fight". Rendering varies as well: Ohio State sent "Run Hide Fight", UNLV "RUN-HIDE-FIGHT", Michigan State "Run, Hide, Fight". Which vocabulary an institution reached for, and how it paired stay-put language with leave-if-you-can language, is a dimension of these messages worth reading as closely as their timing.
The "all-clear" is a separate genre. A message that still tells people to shelter or avoid an area is not an all-clear, no matter what its subject line says. This archive is strict about that distinction; readers studying response timing should be too.
What you cannot read out of these cases, and what no archive can give you, is the part of every active-shooter incident that lives between the first 911 call and the first message sent: the moment a dispatcher decides the threat is credible, the moment a campus police chief authorizes the alert, the moment someone at a console types "Buckeye Alert: Active Shooter on campus. Run Hide Fight. Watts Hall. 19th and College." and presses Send. The verbatim text is the artifact. The decision behind it is the work.