Run, Hide, Tell: What to Do in a Weapons or Terror Attack

If someone attacks people with a gun, a knife or a vehicle in a public place, the advice from Counter Terrorism Policing is three words: Run, Hide, Tell. Run if there is a safe route. If there is not, hide, lock and barricade yourself in, silence your phone and turn off vibrate. When it is safe to do so, tell the police by calling 999¹.

These steps can help save lives and prevent casualties in the event of an attack². They matter most in the first few minutes, because most deaths in a marauding terrorist attack occur before the police are able to respond³. You do not need to memorise anything complicated: the whole message is designed to be remembered under stress, in the same way you remember what to do when a fire alarm sounds.

Attacks of this nature are still very rare in the UK⁴, and the official advice is that the chance of being caught up in a terrorist incident remains low⁵. Knowing what to do is like knowing a fire drill: you will almost certainly never need it, and if you do, it is the difference between freezing and acting.

Run: escape if you can, and leave your belongings

Running is always the best option if there is a safe route to do so⁷. Before you move, consider the safest options: is there a safe route, and can you get there without exposing yourself to greater danger? If the answer is yes, run. If it is no, hide instead¹. Running to a place of safety is described by the government's preparedness campaign as a far better option than to surrender or negotiate⁵.

Two instructions in the Run step surprise people, and both are deliberate. First, leave belongings behind¹. Whatever is in your bag is not worth the seconds it costs, and a bag can catch on doorways, handrails and turnstiles. Second, insist that others go with you, but do not let their indecision slow you down⁷. If someone freezes or refuses to move, keep going. You help them more by getting out and bringing the police than by standing next to them.

Do not attempt to film the incident while escaping⁸. A camera keeps your eyes on a screen instead of on exits and danger, and keeps you standing still. The police do not need live footage from inside an attack; they need people out and they need information, which comes later, on the phone, from a place of safety.

This is the everyday habit that makes the Run step possible: when you enter a shopping centre, station, stadium or cinema, notice where the ways out are. In an attack you may not be able to leave the way you came in, and the nearest exit may be behind you rather than ahead.

Hide: lock and barricade, silence your phone

If there is no safe route out, hide. Find cover that can withstand the threat, whether that is a knife attack or gunfire¹. Substantial brickwork or heavy reinforced walls are the examples given in the official guidance⁹. Be aware of your exits even while hiding, and try not to get trapped: a room with one door and no window is shelter, but it is also a dead end if the attacker finds it¹⁰.

The hiding step, in full, from the police guidance:

1. Find cover from gunfire, for example substantial brickwork or heavy reinforced walls⁹
2. Be aware of your exits⁹
3. Try not to get trapped⁹
4. Be quiet, silence your phone and turn off vibrate⁹
5. Lock or barricade yourself in⁹
6. Move away from the door⁹

Lock the door if you can, and barricade it with whatever is in the room: furniture, equipment, stock. Then move away from the door itself⁹. If an attacker forces the door, distance and cover inside the room buy you time and protection.

Silencing the phone is not just turning the ringtone down. Turn off the vibrate function too¹. A phone buzzing against a table in a silent room is clearly audible, and it tells anyone outside the door that the room is occupied. You will still be able to use the phone: the Tell step, calling 999, happens while you are hidden, and if you cannot speak or make a noise, listen to the instructions given to you by the call taker⁹.

For more on choosing a place to hide, see Where to Hide During a Gun or Knife Attack.

Bullets go through glass, brick, wood and metal

This is the single most important safety warning in the Hide step, and it is worth reading twice. Bullets can go through glass, brick, wood and metal. Find cover from gunfire behind solid or heavy reinforced walls¹.

Cover from view does not mean you are safe. If you can see the attacker, they may be able to see you, and a locked door, a wooden partition or a shop window will stop a person but will not stop a round¹. Hiding behind a locked door is still the right thing to do, and the guidance is explicit that you must still hide even behind a locked door¹¹, but understand what it does and does not protect you from. It conceals you and delays an attacker. It does not make you bulletproof.

So the hiding place you want combines two things: concealment, so the attacker does not know you are there, and substance, so that if they fire at where you might be, the material between you and the shot is heavy enough to matter. Substantial brickwork and heavy reinforced walls are the examples the police give⁹.

Tell: call 999 when it is safe, and what to say

When it is safe to do so, tell the police by calling 999¹. "When it is safe" usually means while you are still hidden, with the phone silenced and the door barricaded, speaking quietly to the call taker. If you cannot speak or make a noise, do not hang up: listen to the instructions given to you by the call taker⁹.

The police need specific information, and the more of it you can give, the better their response. The list from the official guidance¹:

• Location: where the incident is happening
• Direction: where did you last see the suspects?
• Descriptions: numbers of attackers, features, clothing, what they are carrying
• Further information: casualties, type of injury, building information, entrances, exits, hostages¹

If it is safe to do so, stop other people entering the building¹. People walking in from outside have no idea what is happening inside, and a word at a door or a corridor can send them back the way they came.

For anything that is not an emergency, the police non-urgent number is 101⁶. That is the number for reporting suspicious activity that does not need an immediate response, not for an attack in progress. In an emergency, always dial 999¹².

When armed police arrive

Armed police responding to a marauding attack do not know who the attackers are, and in the first moments everyone they see is unknown. When they arrive, follow their instructions immediately. The guidance for people found hiding is to put your hands on your head and avoid sudden movements until you are evacuated to safety⁷. Keep your hands visible and empty, do not run towards the officers, and expect to be directed firmly. This is normal procedure, not an accusation. See What to Do When Armed Police Arrive for the full sequence.

Why the first few minutes matter most

Marauding terrorist attacks are fast-moving, violent incidents where attackers aim to kill or injure as many people as possible¹³. Because of that speed, most deaths occur within the first few minutes of the attack, before police are able to respond³.

That fact is the reason the advice is Run, Hide, Tell rather than "wait for the police". In the minutes before armed officers arrive, the only actions that change outcomes are your own: getting away from the attacker, getting behind substance, and getting information to the 999 call taker so that the response is aimed at the right place. Everything in this page is built around those first minutes.

It is also why the police put the message in the same category as a fire drill. The lesson material for schools notes that while such attacks are rare, it is still important to know and understand the safety procedures that would best protect you⁷. You do not rehearse a fire drill because your building will burn down; you rehearse it so that on the one day it matters, nobody stands still wondering.

What a marauding attack looks like

A marauding terrorist attack, or MTA, is defined by the police as a fast-moving, violent incident where assailants move through a location aiming to find and kill or injure as many people as possible³. The National Risk Register's reasonable worst-case scenarios for marauding attacks include low-sophistication methods, such as blades, with incidents taking place in a venue or public space¹⁴.

The police guidance sets out how varied these attacks can be, which is why the public advice stays simple rather than trying to cover every case³:

A marauding attack carried out with blades or blunt force instruments is generally the most likely attack methodology¹⁵. Other methodologies the police plan for include a vehicle used to cause harm, improvised explosive devices, fire used deliberately, and chemical, biological or radiological attacks¹⁵. If you are caught up in an incident, whatever its shape, the advice is Run, Hide, Tell¹⁶.

Fire used deliberately deserves a note. A fire during an attack, whether started on purpose or as a side effect, does not change the steps: escape if you can, hide if you cannot, and tell the police on 999, mentioning the fire so the fire and rescue service is sent too. Do not treat a fire alarm as a signal that the incident is over; follow police instructions when they arrive.

Organisations such as venues and employers are advised to assess the risk and have a plan for immediate action, covering evacuation, invacuation or lockdown, public warnings and staff training¹³. You may notice the results of this at places you visit: staff briefings, lockdown procedures, or public address systems. Martyn's Law is tightening these duties further at venues; see Martyn's Law: What It Changes at Venues You Visit.

How likely is an attack, and what the threat level means

The official position has two parts, and both are true at once. The chance of being caught up in a terrorist incident remains low⁵, and attacks of this nature are still very rare in the UK⁴. Local resilience bodies put it the same way: the chances of being caught in a terrorist incident are very low, but you and your family should be as prepared as possible¹⁷.

At the same time, the UK terrorism threat level is currently SEVERE, which means an attack is highly likely¹⁸. That is a national judgement about the overall risk to the country, not a statement that any particular place or person is in danger. The levels run from Low, meaning an attack is highly unlikely, up to Critical, meaning an attack is highly likely in the near future¹⁹. You can check the current level and what each one means on our page on UK Terrorism Threat Levels and What They Mean for You.

The National Risk Register scores terrorist attacks in publicly accessible locations with an average likelihood score of 5, meaning greater than 25% over the assessment period, and terrorist attacks on transport with a score of 4, meaning 5 to 25%²⁰. Those are planning figures for government, used to decide where protective effort goes. For a household, the practical reading is the one the police give: rare, but worth knowing the drill⁴.

Reporting suspicious behaviour before anything happens

The most useful thing most people will ever do about terrorism is report something that looks wrong before an attack happens. If anyone is acting suspiciously it is essential to report them⁹. In an emergency, always dial 999; for non-emergencies, call the police on 101 or use their online form⁹.

What counts as suspicious? The examples given in the official guidance include taking photos of things you would not normally photograph, such as exits, crowds and security cameras, trying to hide a face or identity, or avoiding security staff or police⁷. The ACT campaign also asks whether you have noticed anyone observing CCTV, security arrangements, or taking photos of entrances and exits of specific buildings, which can be hostile reconnaissance, the preparation stage of an attack²¹.

Trust your instincts: if anyone is acting suspiciously it is essential to report them²¹. Our page on How to Report Suspicious Activity or Terrorism Concerns walks through the process, and Unattended or Suspicious Items covers what to do about a bag or package left where it should not be.

Teaching children Run, Hide, Tell

The police teaching material for Run, Hide, Tell is aimed at 11 to 16 year olds, at key stages 3 and 4, and the film used in schools is not designed for use with younger children⁷. It was produced for NaCTSO by the PSHE Association as part of the ACT for YOUTH campaign, published in November 2017, and ProtectUK published a school teaching guide in October 2021⁷.

The lesson plans are built around a 45 to 60 minute lesson, with options for reducing a 60 minute lesson to 45 minutes⁷. The film at the centre of it, "the story of Nur, Edih and Llet", shows three friends caught up in a gun and knife attack in a shopping centre who escaped unharmed; the characters are called Nur, Edih and Llet, which are Run, Hide and Tell backwards, and the film is available with subtitles and in a British Sign Language version⁷.

The guidance for anyone teaching this is to avoid being alarmist and to draw parallels with fire drills or other safety procedures children already know⁷. That is good advice for parents too. A child who has practised what to do when a fire alarm sounds is not frightened by fire; the same framing works here. Research with online participants aged 11 to 16 found many young people instinctively mention running and calling the police, but a widespread belief that filming could be useful for evidence needs countering⁷. If your teenager's instinct is to film, that is the habit to talk through.

For younger children, and for families who might be together when something happens, see What Young People Should Do in a Terror Attack and Caught Up in an Attack With Your Family: What to Do.

Helping others, and what to do afterwards

The Run step asks you to insist others go with you, but not to let their indecision slow you down⁷. That balance is deliberate: encourage, urge, even pull people along, but keep moving. If it is safe to do so, stop other people entering the building¹. Both actions help more people than staying in danger to help one.

Once you are out and safe, hand over anything useful. If you have a CCTV system or other footage, the police ask you to hand any footage obtained over to them, as it may assist with identification and provide evidence where offences have been committed¹¹. This is where filming belongs: afterwards, not during.

Support is available for anyone who has been affected by a terrorist incident⁹. Being caught up in an attack, or witnessing one from nearby, affects people long after the day itself, and seeking help is part of handling the aftermath, not a sign of weakness. See Support for Victims and Families After a Terror Attack.

If you want to be better prepared in advance, the free ACT Awareness e-learning covers these steps and more in about an hour: see ACT Awareness e-Learning. For the wider picture of attack types and how the UK plans for them, see The Terrorism Threat in the UK and our Major Incidents guide.