Utah Valley University’s after-action report on the September 10, 2025 assassination of Charlie Kirk points to a larger failure than any single missed rooftop or security gap. UVU had police officers, private security, surveillance cameras, emergency plans, outside law-enforcement partners and established event procedures. What it did not have was one coordinated protective-security plan built around the speaker, the venue and the threat environment.
The clearest example is the concern over elevated positions. Before the event, security personnel identified the walkway directly above Kirk’s speaking position as a vulnerability. Police cleared roughly 80 to 100 protesters from that area, restricted access and posted officers there. That solved the problem they could see. What did not happen was the next step: a full line-of-sight assessment of the surrounding rooftops, windows, walkways and structures with a view of the stage. The shooter ultimately accessed the roof of the Losee Center, moved across it and fired from an elevated position overlooking the event.
The report also found that UVU police and Turning Point USA security never completed the planned joint walkthrough and face-to-face operational briefing before the event. There was no comprehensive written security assessment or Event Action Plan tying together access control, staffing, communications, crowd management, protectee movement, elevated positions, emergency response and outside agency support. Additional officers and other resources were available, including tactical and drone capabilities, but much of that support was never built into the event plan. Cameras were also available, but the relevant feeds were not being actively monitored as part of the protective operation.
The failures did not end when the shot was fired. The first campus-wide emergency alert went out roughly 19 minutes later and incorrectly stated that a suspect was in custody while the actual shooter remained at large. The report identified confusion over command, emergency messaging, protective actions and the flow of information between officers in the field and the Emergency Operations Center. Some of those same command-and-control problems had surfaced during an earlier active-assailant exercise. That matters because an exercise only has value if the problems it identifies are actually fixed and tested again.
The biggest lesson from this report is the difference between reacting to individual security concerns and running a protective-security operation. A camera is not protection if no one is watching it. Mutual aid is not protection if it is not incorporated into the plan. Clearing one elevated position is not the same as assessing every line of sight to the speaker. Security cannot be a collection of individual precautions. It has to be a system built around one question: if someone wanted to attack this event, how would they do it, and have we accounted for those options before the crowd arrives?