Sutherland Springs (2017): What Changed Church Security Forever

November 5, 2017.

It was a Sunday morning in a small town about thirty miles southeast of San Antonio. First Baptist Church of Sutherland Springs was a congregation of fewer than a hundred people meeting in a modest sanctuary. The service was already underway when a man in tactical gear walked up to the building and opened fire.

In the time it took for what would become a national news event to unfold, twenty-six people were killed. Many more were wounded. A neighbor with a legal firearm engaged the attacker, who fled and died by his own hand shortly after. The parishioners who survived that morning included children who had been shielded by adults, and adults who had been shielded by nothing but the architecture of a building that was never designed for what was happening inside it.

This is what changed.

What the reports revealed.

Multiple investigations followed the attack. The Department of Defense Inspector General reviewed the Air Force’s handling of the attacker’s domestic violence conviction. Federal and state agencies reviewed the timeline of the response. Journalists documented, often painfully, the gap between what the community had hoped their Sunday morning was and what it turned out to be.

A few findings stood out for those of us who audit and train churches:

• The attacker had a prior conviction that should have prohibited his firearm purchase, but the Air Force failed to report it to the FBI's background check system
• The congregation had no formal security team, no trained response, and no rehearsed protocol
• The building had limited camera coverage and no access control beyond the front door
• Local law enforcement response time to a rural sanctuary was, as expected, longer than the duration of the attack
• The neighbor who engaged the attacker was a trained civilian who acted on initiative, not a designated security response

Every one of those findings became, in the months that followed, a conversation that congregations across the country started having for the first time.

The Fix NICS Act.

One of the most concrete federal outcomes was the Fix NICS Act of 2018, signed into law as part of the Consolidated Appropriations Act. The law addressed the specific gap that allowed the attacker to pass background checks he should have failed: federal agencies had been inconsistently reporting disqualifying records to the National Instant Criminal Background Check System.

Between November 2017 and the signing of the act, the Department of Defense alone submitted over 4,000 records that should have been in the system but were not.

That is a federal story. It is also a story about how large a gap can sit in plain sight for years until a tragedy forces it closed.

What changed in churches.

The more important change for our work happened not in Washington but in thousands of churches across the United States.

In the months after Sutherland Springs, we saw what many pastors and denominational leaders later described as an inflection. The conversation that had been running in the background of American church life since Charleston in 2015 and Colorado Springs in 2007 finally became urgent.

Across congregations of every size and denomination, the following became common:

• Formal safety teams. Where there had been “a few guys who carry,” there began to be organized teams with defined roles, training expectations, and reporting structures.
• Written protocols. Evacuation, lockdown, medical response, and lockdown-with-injured protocols began to exist in writing.
• Local law enforcement liaison. Pastors made calls to sheriffs and police chiefs. Many had never done so before. Most found LE eager to help.
• Training investment. Active shooter response, stop-the-bleed, and tabletop exercises became regular line items in budgets that had not included them before.
• Threat assessment. Many churches began, for the first time, to think about threat assessment as a ministry function. Not a paranoia, a practice.

None of this was universal. Many congregations remained unprepared. But the trajectory of the American church’s posture toward its own security shifted after that Sunday, and the shift has not reversed.

Two years later: West Freeway.

On December 29, 2019, a gunman entered a Sunday service at West Freeway Church of Christ in White Settlement, Texas, and opened fire during the communion portion of the service. Within approximately six seconds, a trained member of the church’s security team stopped the attack. The attacker was killed. Two members of the congregation were fatally wounded before the response.

West Freeway became, for many church security professionals, a post-Sutherland-Springs demonstration. The team that responded had been built deliberately. They had trained. They had doctrine. When the hardest moment of their lives arrived, they did what they had prepared to do.

The video of the incident, released by the church with purpose, has become required viewing for serious church security practitioners. It is difficult to watch. It is also, arguably, the clearest available illustration of what a trained volunteer team can do in a compressed window.

Three lessons that apply to every congregation.

The specific tactics, teams, and technologies that emerged from the post-Sutherland-Springs years can be endlessly debated. The underlying lessons are simpler, and they apply whether a congregation has six people or six thousand.

Lesson 1: Time is the only weapon you always have.

Every layer of a security program is, fundamentally, a time-buying mechanism. A locked door does not stop anyone. It slows them down. A trained greeter does not prevent all threats. They extend the window before a threat reaches people. Response time from LE is not a fixed number. It is the time between detection and arrival, and detection is something you control.

Every minute you add between a threat and your people is a minute inside which decisions can be made and lives can be saved.

Lesson 2: People are the layer that thinks.

Technology does what it was programmed to do. A person who has been trained, who knows the protocol, and who has rehearsed under pressure can adapt. They can de-escalate. They can reroute. They can communicate. They can spot the situation that does not quite fit any trained category and make a judgment call.

The investment in people is the investment with the longest tail. A trained team member stays trained. A trained team member trains the next team member. Culture compounds.

Lesson 3: Hospitality and hardening are not opposites.

This is the theological and practical point. A church with a trained safety team is not a less welcoming church. A daycare with a tight drop-off protocol is not a colder daycare. A nonprofit with disciplined cash handling is not a less trusting nonprofit.

The organizations that do this best are often the warmest in the room. They have the quiet confidence of people who have thought about hard things and are not, in the daily moment, preoccupied with them.

The rebuilders of Jerusalem prayed and posted a guard. Not one or the other. The phrase has become a kind of watchword in contemporary church security. The reason it resonates is that it refuses the false choice between faith and preparation.

What this means for Southwest Florida congregations.

Churches across Fort Myers, Cape Coral, Naples, and Port Charlotte face a different threat geography than rural Texas. We live in denser communities. We have stronger LE response times in most areas. We have hurricane exposure that Texas does not. Our attendance patterns swing with seasonal residents in ways that stress volunteer teams.

What Sutherland Springs taught applies directly, regardless:

• Build a safety team that has trained together, with defined roles and regular practice.
• Establish a relationship with your local sheriff or police department before you need it.
• Run tabletop exercises. At least quarterly. The act of rehearsing is half the value.
• Invest in your greeters and ushers as your primary detection layer.
• Review your physical space with someone whose eyes are fresh.

Most of this is not expensive. All of it requires attention from leadership. The churches that treat security as a pastoral responsibility, not a facilities line item, build programs that last.

The church did not close its doors.

One of the quieter legacies of Sutherland Springs is what did not happen. The American church did not retreat behind armed fortifications. Most congregations did not install metal detectors or hire full-time security staff. The doors are still open. Hospitality is still the posture.

What changed is the layer of trained, prepared, attentive people between the open door and the people inside. That is the perimeter doctrine in practice. It is the work we do every day with churches across Southwest Florida.

If you are a pastor or elder asking where your congregation stands, we would be glad to walk your facility, meet your team, and tell you plainly what we see. The work is patient. The work is possible. The work is worth doing now, not after.