When a major incident occurs at a live event, the actions taken in the first minutes to secure the scene can determine what is learned, who is held accountable, and whether justice is possible. Scene management—including cordon placement and evidence preservation—is a responsibility that falls first to law enforcement but requires advance coordination and cooperation from event organizers.

The Role of Cordons

Cordons are physical barriers or exclusion zones established around an incident scene to control access and protect evidence. NIMS ICS doctrine recognizes two standard cordon types (Federal Emergency Management Agency [FEMA], 2017):

• Inner cordon (hot zone): immediately surrounds the incident site. Access is restricted to emergency responders directly involved in the response and, subsequently, to authorized investigators.
• Outer cordon (warm/cold zone perimeter): creates a larger exclusion zone. Access is controlled by police and may include staging areas for emergency resources, media liaison areas, and witness assembly points.

Cordon placement must be coordinated with police, fire, and EMS during pre-event planning. NIMS requires that cordon establishment be directed through the Incident Commander to ensure that critical access routes for emergency vehicles, command posts, and triage areas remain unobstructed (FEMA, 2017). Cordon locations should be considered in the venue site plan and shared with all responding agencies on gridded site diagrams before the event opens (FEMA, 2010).

Who Is Responsible for Scene Preservation?

In a major incident, law enforcement is responsible for preserving the scene and the evidence. Saving lives takes absolute precedence—evidence preservation does not interfere with emergency medical response. Once the immediate life-safety phase is complete, scene preservation becomes the primary concern.

At that point, no one should enter the inner cordon without law enforcement authorization. Event staff, organizers, and venue personnel must comply with law enforcement direction on scene access—even if this means parts of the venue remain inaccessible for hours or days. OSHA’s post-incident investigation requirements under 29 CFR 1904.39 require that employers report work-related fatalities and certain hospitalizations to OSHA within specified timeframes, and that scenes be available to OSHA investigators upon request (Occupational Safety and Health Administration [OSHA], 2016).

Why Scene Preservation Matters

Major incidents at live events frequently lead to criminal investigations, regulatory enforcement actions, and civil litigation. The quality and completeness of evidence available depends on how well the scene was preserved in the immediate aftermath. Physical evidence, digital records, and documentation created before and during the event all become relevant to proceedings.

The Ghost Ship warehouse fire in Oakland, California (2016), which killed 36 people, resulted in criminal convictions that relied heavily on physical evidence about the structure’s condition and occupancy arrangements. The Astroworld Festival litigation (2022–present) involves extensive forensic review of site conditions, security camera footage, radio logs, and medical response records. In both cases, the integrity of the scene and records created before and during the events were central to establishing responsibility (Texas Task Force on Concert Safety, 2022).

What Event Organizers Must Preserve

Beyond the physical scene, event organizers have a duty to preserve records that may be relevant to any investigation. OSHA (2016) and NFPA 1600 (National Fire Protection Association [NFPA], 2022) both address post-incident record retention. Records that should be preserved immediately following any significant incident include:

• All communications records from the event period (radio logs, text messages, emails, command post logs)
• CCTV and camera footage from all sources
• Staff schedules, logs, and shift records
• Medical response records and triage documentation
• Crowd monitoring data and access control records
• Incident reports and near-miss records from the event
• Contracts with vendors, security firms, and medical providers
• Permits, approvals, and inspection records

Records should not be altered, deleted, or overwritten after an incident. Many digital systems—including CCTV recorders, access control systems, and radio logging equipment—automatically overwrite older recordings on a cycle. Immediate action is required to preserve recordings before they are lost (OSHA, 2016).

Cooperating with Investigators

FEMA (2010) recommends that event organizers designate in advance a liaison with law enforcement and regulatory investigators—a named individual who knows what records exist, where they are stored, and how to provide access. Event organizers should seek legal counsel before making formal statements to investigators where criminal liability may be in question. Cooperation with investigators and legal counsel are not mutually exclusive.

References

Federal Emergency Management Agency. (2010). Special events contingency planning job aids manual. U.S. Department of Homeland Security.

Federal Emergency Management Agency. (2017). National Incident Management System (3rd ed.). U.S. Department of Homeland Security.

National Fire Protection Association. (2022). NFPA 1600: Standard on continuity, emergency, and crisis management. NFPA.

Occupational Safety and Health Administration. (2016). 29 CFR 1904: Recording and reporting occupational injuries and illnesses. U.S. Department of Labor.

Texas Task Force on Concert Safety. (2022). Final report of the Texas Task Force on Concert Safety. Office of the Governor of Texas.