Spontaneous public response to a marauding knife attack on the London underground: Sociality, coordination and a repertoire of actions evidenced by CCTV footage

Across a range of recent terrorist attacks in the United Kingdom, the question of how crowds behave in confined public space is an important concern. Classical theoretical assumptions are that human behaviour in such contexts is relatively uniform, self-interested and pathological. We contest these assumptions by reporting on a study of public response to a marauding knife attack that occurred on London's underground rail network in 2015. The analysis draws primarily upon footage from 27 CCTV cameras positioned across the station footprint supplemented by social media, news footage, radio logs and incident reports. Using an innovative methodology, we topographically and chronologically mapped behaviours during the incident. The analysis demonstrates that while rapid egressions oc-curred as the threat escalated, at every phase of the incident members of the public intervened spontaneously with coordinated, purposeful, socially


INTRODUCTION
Marauding Terrorist Attacks (MTAs) can strike at any time and are hard to detect beforehand.When they happen, they pose an immediate danger to the public and create strains on the emergency services and other authorities as they seek to suppress the threat, evacuate the unharmed and save the injured (Bates, 2021;Kenyon et al., 2021;Pajunen, 2015;Spaaij & Hamm, 2015;Teich, 2013).Although these incidents tend to conclude through emergency services' intervention, there is inevitably a protracted period when the public are the only responders.Knowing how members of the public behave during MTAs is therefore crucial for emergency preparedness and response.Despite its importance, we still know relatively little about public behaviour during MTAs.This is in part because these events are rare, unpredictable, and therefore, difficult to study.
Scientists have traditionally relied on post-hoc witness accounts and experimental simulations to study emergency behaviours.However, the proliferation of high-definition digital CCTV cameras now offers a novel and robust data source for researchers to assess public behaviours in mass emergencies in situ.Despite this development, the analysis of such data remains rare.Therefore, this paper reports upon a study that examines real time CCTV footage of a marauding knife attack at a London underground railway station, suspected at the time to be an MTA.It identifies evidence of collective coordination between passengers and derives a set of functional categories of actions that may be useful for understanding in what ways to harness the public's capacity for resilience.The paper concludes with discussion of how video analysis provides ecologically robust evidence for the modelling of public behaviours in this type of emergency.

Classical models of crowd behaviour
Early academic accounts of behavioural responses in emergencies tended to portray people in crowds as irrational and apathetic.This 'classical' perspective was originally popularized by Gustave Le Bon (1926 [1895]) Consequently, it is often assumed that people lose their identity in crowds which in turn produces a loss of behavioural control and the inevitable emergence of atavistic, anti-social and selfish behaviour (Stott & Drury, 2017; see also Drury, 2021, for a detailed review of Le Bon's crowd psychology).Crowd members facing threats are therefore expected to respond in an irrational manner by being prone to 'mass panic' (Timsit, 2022).Although the Le Bonian model has been heavily criticized by subsequent historical reviews and empirical research (Cole et al., 2011;Drury, 2018Drury, , 2021;;Drury et al., 2013aDrury et al., , 2013b)), the idea is still popularized in public discourse, illustrated in terms such as 'stampedes' (Associated Press, 2022) and 'panic buying' (Ntontis et al., 2022) in news reporting of public behaviour during emergencies.
This pathologizing picture of the effects of the crowd upon individual psychology and behaviour is reflected in another relevant area of social psychology referred to as the 'bystander effect'.This perspective was developed from Darley and Latané's (1968) analysis of the street-based murder of a young American woman, Kitty Genovese.Central to their analysis was the claim that her death was facilitated by the systematic absence of bystander intervention, despite the proximity of 38 witnesses.Darley and Latané explain the apparent witness apathy in terms of the debilitating effects of groups, one of which is a sense of diffused responsibility towards the victim.Therefore, it was subsequently assumed that the larger the group size co-present the more the diffusion and hence the decreasing likelihood that individuals would exercise their agency to intervene (Darley & Latané, 1968;Latané & Darley, 1968).The bystander effect remains highly influential as a psychological assumption and has been one of the most-cited effects in introductory psychology textbooks (Urschler, 2015).This is despite the fact that it has been discredited largely through research revisiting the murder itself which demonstrates that apathy was not the normative reaction (Manning et al., 2007).More recent studies drawing on CCTV data also highlight that far from being passive, bystanders do tend to intervene in conflicts in public space (Bloch et al., 2018;Levine & Manning, 2013;Liebst et al., 2019;Philpot et al., 2020).

The social identity model of collective resilience
In short, the narrative of apathetic crowds prone to debilitating fear and irrationality is inconsistent with the empirical evidence of public response to emergency situations.This is the case in several major events such as during the evaluation in 9/11 World Trade Centre terrorist attack in the United States (Fahy & Proulx, 2005;Tierney, 2003), the Costa Concordia disaster in Italy (Bartolucci et al., 2021;Kvamme, 2017 ) and the 7/7 London Underground bomb attack in the United Kingdom (Barr et al., 2023;Cocking, 2013;Drury et al., 2009a).
Considering these findings, new psychological theories have emerged attempting to provide more powerful explanations.Perhaps most significantly, researchers applying Self-Categorisation Theory (SCT; Turner, 2010;Turner et al., 1987) have proposed the Social Identity Model of Collective Resilience (SIMCR; Drury, 2012).The model is particularly applicable to threats to crowded spaces, where people are often among strangers (e.g., transport hubs) (Drury et al., 2009a(Drury et al., , 2009b)).SIMCR suggests that in the context of shared threat, cooperation among members of the public can emerge from the social-psychological process of self-categorization.More specifically, Drury and his colleagues (Drury, 2018;Drury et al., 2009b) found evidence that in mass emergencies the common experience of threat is the basis of an emergent shared identity among those co-present.This group level identity is functional in forming the psychological basis for a shared definition of the situation, cooperation, motivations to give help and expectations of collaborative support (Drury et al., 2019).
Given the ubiquity of mass media and social media coverage, there is now an accumulating evidence base of in-situ reactions to MTAs circulating online (e.g., Wikipedia entries around bystander interventions in the 2017 London Bridge attack and the 2022 Oslo mass shooting e.g., -see Philpot, Levine, & Drury, 2023).To date, however, these accounts remain largely anecdotal and have not been assessed in a systematic manner.Two notable exceptions are the interview study of the behaviour of survivors in the 2015 Bataclan attack by Dezecache et al. (2021) and Bernardini and Quagliarini's (2021) survey of observed behaviours at recent European terrorist incidents.SIMCR research has therefore yet to explore the potential complexity within behavioural reactions to a marauding attacker.As such 'collective resilience' 1 could be misunderstood as implying uniform crowd behaviour in an otherwise complex set of reactions to an MTA incident.

The state of play in practice: The importance of 'zero-responders'
Despite the development of the SIMCR, the representation of crowd behaviour in emergency planning and news reports is often dominated by the simplistic representation of crowds in line with the classical models (Kvamme, 2017;Templeton & Neville, 2020).In other words, policy approaches often assume members of the public facing threat will react dysfunctionally by taking flight in a uniform and self-interested manner.This in turn supposes that the public are psychologically vulnerable unless the authorities 1 Here we conceptualize collective resilience as a process whereby a shared identity allows survivors to express and expect solidarity and thereby coordinate to deal with adversity.
20448309, 0, Downloaded from https://bpspsychub.onlinelibrary.wiley.com/doi/10.1111/bjso.12703 by Test, Wiley Online Library on [07/12/2023].See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions)on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License restrict information about threat or step in to provide resolution (Cole et al., 2011), thus prioritizing system resilience at the institutional level above any spontaneous collective resilience offered by the public (Durodié & Wessely, 2002).Furthermore, those who model mass emergencies still tend to assume members of the public act as self-interested individual agents at the expense of collective resilience and socially oriented co-operation (Templeton et al., 2015;e.g., Balboa et al., 2020;Cao et al., 2018;Fridolf et al., 2016).Given this lack of appreciation, it is perhaps unsurprising that UK's emergency guidance to those exposed to any marauding attacks is, at time of writing, to 'Run, Hide, Tell' (National Counter Terrorism Security Office, 2021).Some argue that such guidance may inadvertently undermine the emergence of spontaneous, endogenous collective resilience (Cocking, 2013;Lindekilde et al., 2021;Wessely, 2005).
Instead, studies suggest that identity and pro-social norms operate, with survivors reporting collaboration among those involved in ways that save lives and protect other casualties (Cocking, 2013;Drury, Au-Yeung, et al., 2022;Drury, Stancombe, et al., 2022;Fahy & Proulx, 2005;He et al., 2003;Wessely, 2005).In parallel, researchers and policymakers have started to refer to members of public who perform these salutary actions in mass emergency as 'zero-responders' because of their presence in the situation before first-responder arrival (Briones et al., 2019;Cocking, 2013;Cutter, 2018).Templeton et al. (2015) also propose that emergency simulation should move beyond modelling 'mass' response towards postulating reaction from smaller 'groups'.This alternative 'sociality' vision of behaviour in emergencies is gaining momentum in the United Kingdom in the wake of the civilian resilience shown in response to recent incidents (Drury et al., 2023).Indeed, as the Kerslake report on the Manchester Arena bombing in 2017 concludes: […] the public will likely become a key source of direct assistance for both the injured (by providing first aid and assisting evacuation) and for the emergency services (by enabling them to initiate and manage scene safety and casualty management priorities for all those affected, without being drawn into caring for individuals).(Kerslake et al., 2018, p. 155).
This propensity of individuals to provide spontaneous help is supported by the recent and largest systematic review of behaviour in emergencies.Here, a synthesis of 483 studies of artificial and real-world mass emergencies found that while the behaviour of evacuees was highly varied, the most prevalent behaviours were attempts to help and assist others (Philpot, Levine, & Drury, 2023).Yet it is possible that behavioural responses to marauding knife attacks will be different from those to other forms of threats -for example, spontaneous explosions (Drury et al., 2009b;Philpot & Levine, 2022) and active shooter events (Dezecache et al., 2021).Consequently, resilient behaviours may not be the dominant response among the public.Nonetheless, following the learning from the Manchester Arena Bombing (Kerslake et al., 2018), we suggest it is important to better understand what the few may do to save the many and how they may achieve such resilience through socially coordinating with each other.

The current study
SIMCR would predict that public emergencies, which involve direct threat to multiple civilians and where there is a shared experience of this threat across the crowd, would lead to coordination and spontaneous support among individuals.However, as noted above, to date, the SIMCR and 'collective resilience' literature has yet to explore the potential complexities of 'zero-responding' behaviours that are acknowledged to emerge in response to a complex marauding attack.Given that CCTV footage allows systematic examination of behaviour over an entire captured event, the present study aims to advance the literature both empirically and theoretically by analysing the levels and nature of behavioural diversity in a real-life hostile threat incident.This study is therefore the first to systematically observe and report on the responses of citizens during a marauding knife attack in a confined public space.The attack in question occurred in Leytonstone station on London's Underground rail network, at approximately 7.05 pm on Saturday, 5 December 2015 -just 3 days after the UK parliament voted in favour of joining the international coalition engaging in airstrikes against the Islamic State militants in Syria.The incident was initially reported via mainstream and social media, highlighting the response of an onlooker who rebuked the attacker by shouting 'You ain't no Muslim, bruv'-a statement later cited by the then UK Prime Minister, David Cameron, when condemning the attack (Faulconbridge, 2015).While this knife attack was subsequently understood to have been the outcome of a mental health episode it was reacted to at the time by the Metropolitan Police Service as a 'terrorist incident'. 2Regardless of its underlying motivation, the knife attacker, a 29-year-old male from Somalia, attempted to murder a 59-year-old white male using a blunt 3-inch knife.The attack triggered a rapid egress of passengers out of the ticket hall area.After leaving the station temporarily, the attacker remained outside of the station before he re-entered, attacking more passengers and a police officer.The attack was concluded after additional police officers arrived and subdued him with Tasers.

The data corpus
Access to video data were provided by Transport for London (TfL) under a strict data sharing protocol.The footage comprises 2.5 h of soundless CCTV streams starting from around half an hour before the attack to around 15 min after its conclusion.In total, the footage was derived from 27 CCTV cameras, encompassing most of the station area, including the platforms, the ticket hall, the stairways and a pedestrian tunnel connecting the station to the ground level.Besides the video corpus, TfL also shared recordings of radio communications between TfL's central control and train drivers in the vicinity of the station during the incident, as well as their internal report of the attack.This additional data were triangulated with the CCTV footage to assist us in developing our chronology of the incident.In particular, it helped develop an understanding of the pattern of train arrivals and departures from the station during the incident.However, the focus in this analysis is on the nature of the overt spontaneous public behavioural response during the attack once passengers were already flowing through the station.Thus, the analysis we present below focuses on the data obtained from the CCTV footage.

The analytical procedure
This study applies a chronological and thematic analytic approach (Braun & Clarke, 2006, 2019;Stott et al., 2018) to create a detailed behavioural account of events (c.f., Ball et al., 2019;Reicher, 1984).We use this analytical method to identify, describe and categorize how members of the public responded in proximity to a marauding knife attack.Accordingly, the analysis process began by synchronizing the otherwise asynchronous camera feeds, which did not directly correspond despite each having purportedly matching time codes.To address this disparity, the lead author systematically compared the postures and positions of people appearing on different angles simultaneously or in immediate succession.Using this technique, we synchronized 23 angles out of 27 video streams. 3 The 23 angles were then arranged into a 6-columns-times-4-rows grid, allowing the investigators to 2 https:// www.bbc.co.uk/ news/ uk-35018789 Technically, since the assailant targeted people during the incident rather than attacking them indiscriminately, the incident does not meet the formal definition of an MTA.However, the incident was seen in this way at the time and has some of the hallmarks.See: https:// www.cpni.gov.uk/ marau ding-terro rist-attac ks-0. 3See Supporting Information for further details.
observe simultaneously the behaviours of everyone on the station footprint in differing levels of proximity to the attack (e.g., those in sight of it, those on the platforms, those just entering the station).
On this basis, the video data were used to identify the moment when the attacker and his first victim alighted from an eastbound train at what was timestamped as 19: 07. 4 The footage then continued until the police contained the attacker and set up a cordon at the station ticket hall entrance at the timestamp 19:19.Thus, the footage subjected to analysis amounts to approximately 15 min, covering 2 min of the 'normality' in the station prior to the eastbound train arriving.
We subjected the footage to three iterative analytical rounds.The first involved developing our chronological account with the first author exhaustively tracking individual movements of everyone appearing in the footage and mapping these on to a diagram of the station.At the end of the first round, the wider research team identified a series of three interactional broad sequences, which we describe as temporal phases: 1. Arrival and initial attack: Appearance, initial assault and egress of passengers and then the attacker from the station.2. Return to normality: A lull as the passengers began to reappear and establish a movement pattern akin to that observed prior to the attack.3. Secondary attacks: Reappearance, a series of further assaults concluding with the incapacitation and handcuffing of the attacker by the police.
In the second analytical round, the first and second authors conducted more detailed behavioural analysis of each phase by identifying key actors' actions and interactions over time.These individuals were those that remained on the station footprint and appeared to play some form of active or purposeful role.This process utilized the key strength of digital video data, which allows multiple observers to scrutinize behaviour as many times as necessary and at different speeds, triangulated across footage from different CCTV cameras (c.f., Ball et al., 2019;Stott et al., 2018Stott et al., , 2021)).This allowed a more granular and exhaustive examination of individual-level action sequences.Given the footage from the different cameras was synchronous, we were also able to cross-reference actions and interactions occurring simultaneously in multiple locations across the station footprint, to understand how they subsequently inter-related in both time and space.In the third and final round, we randomly assigned a letter code to each relevant actor and retracked their behaviours across phases to confirm temporal ordering.This completed the behavioural analysis and produced our triangulated account of participant actions over time and location.
Finally, all the authors conducted a team-based thematic analysis, again, with a series of iterative steps (Braun & Clarke, 2006, 2019;c.f., Radburn et al., 2022).Firstly, we undertook collective initial coding of a sample of extracts to identify functional action categories that described identified patterns of action.This process helped to develop a preliminary theoretical understanding of the various behavioural repertoires and social functions the relevant actors appeared to be displaying.Next, the first and second author systematically applied and developed the framework across all three phases to enable the categories to describe the actions of each active participant.Upon completion, the thematic analysis created a framework of eight categories that we judged exhaustively described all the behavioural repertoires and apparent social functions of all key individuals identified within the triangulated account of events.

ANALYSIS
We first present a general overview of the incident and introduce the ecology of Leytonstone station.Then, we report the outcome of the triangulated account of participant behaviours.We then discuss the category framework of resilience-in-action and the significance of the findings for facilitating civil 4 As the CCTV clip was not synchronized with the atomic clock, all stated times are empirically derived estimates.
20448309, 0, Downloaded from https://bpspsychub.onlinelibrary.wiley.com/doi/10.1111/bjso.12703 by Test, Wiley Online Library on [07/12/2023].See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions)on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License resilience in response to a marauding knife attack.Please note, the following contains vivid descriptions of distress and violence.

The ecology of Leytonstone station and initial attack
Leytonstone station is a three-platform 'above-ground' station that serves the Central line of the Transport for London (TfL) Underground rail network.Its basic layout is shown in Figure 1.Platform 1 serves the eastbound direction away from London's city centre and Platforms 2 and 3 serve the westbound direction.The platform(s) for each direction have one staircase descending to a shared ticket hall of the station which is at an underground level.The ticket hall is divided from the stairways by several automated ticket gates only accessible to passengers who have paid to access the network.There is one exit from the ticket hall, leading to a pedestrian tunnel which connects two above-ground exits of the station, one in Church Lane and the other in Grove Green Road, adjacent to the latter is a bus station.The tunnel is not formally a part of the TfL station infrastructure because it also serves as a footpath for the public to travel on foot between the eastern and the western area of Leytonstone underneath the railway line and the A12 road carriageway.Given the location of Leytonstone on the outskirts of London, patterns of passenger flow into and out of the station depends upon the time and day of the week.
On the early Saturday evening concerned, trains arriving onto the eastbound platform were relatively busy with passengers returning to Leytonstone from the direction of central London.The westbound platform was less busy with relatively few passengers travelling towards the city centre.Before the attack, the attacker and the first victim disembarked onto the tail end of a wave of passengers moving along the eastbound platform (at the top-right of Figure 1) and then descended the stairwell (at the top-middle of Figure 1) into the paid area of the ticket hall.As they both alighted the stairs the attacker, entirely unprovoked, lunged towards the victim and began his assault.The approximate location is marked by a red cross in Figure 1.

Triangulated account of events
In this section, we present the integrated chronological and behavioural account of the three phases, emphasizing the slight overlaps of the boundaries between them.Besides the attacker, there are a total 20448309, 0, Downloaded from https://bpspsychub.onlinelibrary.wiley.com/doi/10.1111/bjso.12703 by Test, Wiley Online Library on [07/12/2023].See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions)on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License of four victims identified as V1 to V4 as per their sequence of being attacked.TfL staff and individual members of public who were judged to have acted in a purposeful manner are referred to via their randomly allocated alphabetic identifier so that readers can follow their actions within and across phases.Pixilated screenshots from the CCTV are inserted into the description to help readers to visualize the situation.

Phase 1-The initial attack and the first egress
On the evening in question at approximately 7.05 pm, a train arrived at the eastbound platform.It released around 40 passengers who made their way along the platform, down the stairwell and began to leave the station as normal.Close to the tail end of the arrivals was a tall Black male of Somali heritage (the attacker).Walking a few feet in front of him was a white middle-aged musician, carrying two guitar bags (one on his right hand and one on his back) as well as a portable amplifier (the first victim; V1).The attacker followed V1 along the eastbound platform, walking approximately a metre behind him at the back of the wave of disembarking passengers.
They did not interact with each other initially, but as they descended the stairs the attacker reached into an inside pocket of his jacket with his right hand.As the pair reached the ticket hall, he brought his right arm around the front of V1's neck and began trying to cut V1's throat with the knife.V1, startled, struggled, and broke free.Stepping forward he turned his body 180 degrees to face his assailant.Figure 2 shows a series of screenshots of this sequence.During this struggle, the attacker dropped his knife, grabbed V1 again and pulled him to the ground kicking him five times to the torso and head.
As the assault progresses, it was witnessed by several egressing or ingressing passengers.Four passengers who had arrived via the same train, were descending the eastbound stairway behind the attacker and V1.These four were all white and comprised a male-female couple in their 30s [T & C], a middle-aged male [H] and a woman in her 70s [O].
As the attack progressed, rather than running away, the four entered the ticket hall and began to distract the attacker from V1. Passenger T stepped forward and pushed the attacker away from V1 (see Figure 3) to which he reacted by grabbing both arms of Passenger T and pushing him back towards On the other side of the ticket barrier in the unpaid area, several passengers continued to flow into the ticket hall from the tunnel and, rather than fleeing, stood witnessing the attack (see Figure 4).At around the same time, a member of staff (TfL α) came out of a room behind the kiosk, walked across the unpaid area and approached the barriers.After observing the attack, he turned and entered an adjacent customer assistance booth, picked up a phone and appears to make a call.As TfL α was doing so, the attacker reapproached V1 with the knife at hand.He bent over, pulled V1 onto his side, and began cutting his neck in a sawing motion for around 16 s.According to news report of the court case, as he was doing so, he allegedly shouted, 'This is for my Syrian brothers.I'm going to spill your blood'.As the shouting and prolonged sawing motion began, the dozens of otherwise passive observing passengers in the unpaid area turned and most egressed rapidly out of the entrance along the tunnel and left the station entirely via both the Church Lane and Grove Green Road exits (see Figure 5).Even at this point, not everyone departed.Among the rapidly egressing passengers, a young nonwhite male passenger (Z) stopped midway.Leaving an associate who continued departing through the tunnel, Z began to walk slowly back towards the incident (see below).At least seven other passengers remained in the unpaid area and observed the attacker from different distances.Four of these were women and five were Black.Among this group was a white female passenger, who appears to be middle-aged ( J). J approached the ticket barrier and appeared to talk to or shout towards the attacker while simultaneously holding a phone to her ear, seemingly making a call.As the sawing motion continued, this group of seven passengers also gradually moved out the ticket hall into the tunnel and stood close to a second member of staff (TfL β) who appeared to be communicating via a radio in his left hand.
As V1's neck was cut a large pool of blood formed on the floor, and he now lay motionless.The four passengers in the eastbound stairwell (C, H, O and T) then retreated up to the eastbound platform and were joined there by two other passengers who were already on the platform.The attacker was then distracted as a third member of staff (TfL γ) suddenly ran into the paid area from the westbound stairway.Apparently startled, the attacker stood up and watched as this staff member ran directly past him, went through the barriers, and exited the ticket hall.Both TfL β and γ then left the station footprint all together via the Church Lane exit, leading several remaining passengers to do the same.This left a shopkeeper in the station kiosk behind the counter, TfL α and passenger J (who both were on their phones) and two young Black males (Passengers K & G).These five were the only people in the vicinity of the unpaid area of the ticket hall who had witnessed the initial attack.
The attacker then turned his attention towards a white male passenger (N) who had descended the westbound staircase and who now stood observing him.The attacker approached N, standing approximately a metre away, and the two appeared to communicate (see Figure 6).N gestured towards the exit as if explaining he simply wanted to leave.Rather than assaulting him, the attacker, as if consenting, turned away and N passed underneath the ticket barrier and walked calmly out of the station through the tunnel.The attacker then walked back towards V1, who was now writhing prostrate on the floor.He briefly looked down at him but continued to walk to the bottom of the eastbound staircase and looked up the stairwell, presumably looking to see whether any passengers remained.The attacker then turned back and approached the barriers and began to gesticulate with his knife towards those remaining in the tunnel adjacent to the ticket hall exit.
The group in the tunnel adjacent to the exit now comprised eight people, at least three of whom had been direct witnesses to the attack (G, J and K), the others were new passengers ingressing into the station through the tunnel who had not.K and G began to interact and block some of these new arrivals, preventing them from entering the ticket hall.J, appearing to be continuing her phone call, soon broke away from the group and walked along the tunnel towards the Grove Green Road exit.On her way she walked past a newly arriving member of staff (TfL δ) who was descending the tunnel.As they passed, TfL δ stopped walking and turned to J, appearing to have overheard the phone conversation.J reacted, as if startled, and turned around towards δ.They both then descended the tunnel together and (re)entered the ticket hall.As this occurred, TfL α put down the phone and emerged from the customer assistance booth.Exiting the ticket hall, he was joined by TfL δ.At about the same time, Z (see above) had descended the tunnel and returned to stand near the ticket hall entrance.He was stopped by G from progressing into the ticket hall and they then both raised their phone, taking pictures or videoing the attacker.At this time, an ingressing new arrival, a non-white young male (R), descended the tunnel via the Grove Green exit and joined the group adjacent to the ticket hall entrance.As he did so the attacker reached into his pocket, and after 10 s of searching removed a payment card and used it to pass through the ticket barrier into the unpaid area.Except for R, this action prompted everyone remaining (including TfL α and δ, and passengers G, J, K and Z) to egress towards the two exits at various paces (shown in Figure 7).As the attacker entered the tunnel, he walked towards the Grove Green Road exit.R stood at a short distance from the attacker and observed him as he walked out of the tunnel and disappeared from the station footprint (and from the CCTV footage).

Phase 2-Victim care and a brief return to 'normality'
By the time the attacker left the station, it was largely empty apart from a few individuals and small groups positioned across its footprint (shown in Figure 8).Having observed the attacker leaving the station, R walked cautiously back into the ticket hall and conversed with the shop-worker behind his counter for approximately 10 s.Being present throughout, presumably the shop worker had witnessed the attack in its entirety.After that R moved away from the counter, used his payment card to pass through the ticket barrier and approached V1.The latter tried to sit up and appeared to converse with R. With the attacker now apparently departed, a small number of passengers waiting at the Church Lane entrance of the tunnel began descending the tunnel towards the ticket hall.
At much the same time, on the eastbound platform there were at least 13 people, most of whom appeared to be waiting for the next train to arrive.In contrast, five individuals including passengers C, H and T, who had intervened against the attacker in phase one, were still stood near the top of the eastbound stairwell.As a second eastbound train began to arrive, passenger T made his way back down to the ticket hall to reapproach V1.Before assisting V1, T conversed with R, who repeatedly pointed towards the exit area seemingly communicating that the attacker had left the station.T then bent down next to V1 helping him to sit upright and used his jumper to help stem the bleeding from his neck.At the same time, C and O also came back down from the eastbound platform and assisted V1, while H stayed and approached several passengers disembarking from the newly arrived train appearing to communicate with them.
As this flow of disembarking passengers began to egress onto the platform, a young non-white male passenger (D) entered the ticket hall from the tunnel.He walked across the unpaid area, began conversing with R and T, and then climbed over the ticket barrier to join the group that now surrounded V1 assisting him (see bottom row of Figure 9).Shortly afterward, H appeared at the front of the large wave of disembarking passengers descending the eastbound stairway.He was now accompanied by another passenger (M), a young white male who had arrived on the second train (see top-left frame of Figure 9).M then approached those assisting V1, bent down and appears to take control of providing first aid.We presume that H had been seeking medical expertise among those arriving on the train and had as a result identified and recruited M.
Behind M and H, the front edge of the large wave of disembarking passengers began to descend the stairways and enter the paid area of the ticket hall near where V1 was situated.Although the group assisting V1 had encircled him by forming a crescent shape formation, some of the descending passengers appeared to be able to see the large pool of blood adjacent to V1 from the stairwell, and hence slowed down to observe the situation.Nonetheless, several moved on through the barriers and departed into the tunnel as they would do normally.But two passengers (E and S), both non-white males, joined the crescent shape formation as other passengers passed by (see left frame of Figure 10).As this was occurring R interacted with several disembarking passengers, gesticulating in the same direction of the attacker's departure from the station as if communicating that the situation was now relatively safe.At much same time, more passengers were ingressing into the unpaid area from the tunnel.Among them were two young Black males (P and F).Rather than moving through the barriers, after observing the situation, they turned back into the tunnel.P ran straight to the street level of the Church Lane entrance, while F jogged behind.F encountered and interacted with several other ingressing passengers in the  tunnel, including another young Black male (Y) who subsequently went into the ticket hall and then also turned back.As P first reached the Church Lane entrance, he interacted with four passengers there who had cautiously remained, two young white males (B and W), who had participated in or witnessed the flight in phase 1 and one of whom (B) was holding a bike.P gesticulated in the direction of the ticket hall seemingly communicating to them about the status of the situation before he left the station entirely.
While B remained at the entrance, W and two other passengers cautiously descended the tunnel towards the ticket hall.Along the way, they encountered Y who was still returning to the street level.Y interacted with the descending trio and gesticulated towards the ticket hall as if communicating to them about what had happened.After that, the trio continued towards the ticket hall, where they were joined by other ingressing passengers who then paused in the unpaid area to observe the situation on the other side of the barrier.When the egressing passengers from the eastbound platform began to pass through the ticket barrier, some of these ingressing passengers then started to do the same, predominantly going towards the westbound platform (see right frame of Figure 10).As a result, a relatively normal two-way flow through the ticket barrier was slowly re-established.

Phase 3-The return of the attacker and public defence
Despite leaving the station footprint, the attacker stayed in the vicinity and was being filmed and challenged verbally by a young white male passenger (U).Shortly after flow through the ticket hall re-established, the attacker re-entered the tunnel via the Grove Green Road entrance.With knife still in hand, he walked towards the ticket hall closely followed by a passenger, who we presume was U who was clenching a plastic shopping bag in his left fist as if prepared to use it as a weapon.U was also holding a phone upright in his right hand, pointing its camera towards the attacker with its flashlight on as if recording the situation and using this as a deterrent.As they both descended the tunnel, the attacker walked past seven egressing passengers who were on the other side of the waist high railing dividing the tunnel in half (see Figure 11).While he could have easily done so, the attacker did not display any aggression towards them.These passengers were mostly female and non-white, one of whom was with two small children.
As the attacker reached the ticket hall entrance, the wave of the egressing passengers from the second eastbound train were now moving through the ticket barrier and exiting into the tunnel.At the same time a third train arrived onto the eastbound platform.As passengers from the second train went through the ticket hall entrance, they walked directly into the path of the attacker who began further assaults.Specifically, he swung the knife towards the neck of a young white female (V2).Fortunately, he missed and V2 immediately turned and ran back uninjured through the ticket hall and away, followed by several other passengers.After that, the attacker ignored a non-white female stood immediately in front of him instead stepping sideways to lunge towards a young white male (V3).V3 reacted by blocking the attack with his arms and retreating into the ticket hall (Figure 12).Throughout this second sequence of attacks, U stood in the tunnel and continued holding his phone, apparently videoing the attacker (see the left frame of Figure 13).Those in the unpaid area retreated behind ticket barrier while those in the tunnel rapidly egressed towards both entrances and out to the street level.This left only a handful of individuals.One of them was a middle-aged white male passenger (Q) from the second eastbound train, who was wearing a rucksack.Q stopped and stood at the demarcation line between the ticket hall and the tunnel facing the attacker.As V3 retreated into the ticket hall, the attacker attempted to follow but was stopped by Q deliberately standing in his way.Q then interacted with the attacker, gesturing with open hands, palms facing down seemingly to pacify him.On the other side of the ticket hall in the paid area, egressing passengers stopped proceeding through the barrier and the majority ran back up the stairwells onto both platforms.Those passengers directly assisting V1 (C, D, E, M, O, R, T and S) remained S and R moved to the side, making more space for fleeing passengers to ascend the stairs towards the eastbound platform.D and E approached the ticket barrier and looked it, observing the attacker.T and M continued to hold the garment against the victim's neck while also looking over the gate line.C and O also remained standing close to the victim.
New arrivals from the third eastbound train could see several of these fleeing passengers reach the platform level.Some simply ran away from the stairwell towards the far end of the platform while others reboarded the train they had just disembarked from.However, approximately 10 passengers continued descending the staircase.

FIGURE 11
The attacker returning to the station's tunnel, followed by U.
20448309, 0, Downloaded from https://bpspsychub.onlinelibrary.wiley.com/doi/10.1111/bjso.12703 by Test, Wiley Online Library on [07/12/2023].See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions)on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License At around the same time, in the paid area of the ticket hall, C, O and T, who had remained assisting V1 throughout, appeared to converse.A few moments later O began ascending the eastbound stairway apparently remove herself from danger.As she was doing so, C, M and T picked up V1's belongings, and C and T helped V1 to his feet (see Figure 14) and slowly walked him up the eastbound stairway.Several others of the group who had been assisting V1 remained in the paid area and actively prevented other egressing passengers from progressing through the ticket barriers to the unpaid area.
During this time K, who was present during phase 1, reappeared at the Grove Green Road entrance of the tunnel.He descended along the tunnel and interacted with other passengers, ushering them from the attacker with hand-waving gestures.Some individuals appeared to respond and turned back moving away quickly towards the street level.Yet, a few continued down the tunnel towards the attacker, including a young white male passenger (L) and his female partner (V).After observing the standoff between Q and the attacker, L and V moved back to the Grove Green Road entrance and joined K near the street level to actively discourage new passengers from ingressing into the tunnel.
Meanwhile, Q retreated backward into the ticket hall while he continued to interact with the attacker, keeping him occupied.Concurrently, U remained behind the attacker filming him from the tunnel.Both Q and U then moved backwards and forward in synchrony with the attacker keeping him at a short distance but contained.After Q's continuous engagement for approximately a minute, the attacker turned towards U and pursued him aggressively along the tunnel towards the Grove Green Road exit.On their way, around a dozen new arrivals walked into the tunnel and watched the situation from a distance, including L. As U and the attacker reached the exit, he lunged his knife towards L across the railing.20448309, 0, Downloaded from https://bpspsychub.onlinelibrary.wiley.com/doi/10.1111/bjso.12703 by Test, Wiley Online Library on [07/12/2023].See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions)on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License L then joined Q, U and two others to surround the attacker in a coordinated manner.Keeping just a few metres away from him, they all moved back towards the ticket hall.Doing so, removed his rucksack, holding it in front as a shield, L and U both held shopping bags spun tightly in fists, as if ready to strike the attacker, and U continued to hold his phone shining its flashlight.As they approached the ticket hall, the attacker lunged again at L with his knife just as a police officer (MPS 1) arrived via the Grove Green entrance.MPS 1 immediately confronted the attacker and stood between him and the three passengers who had been occupying him.The officer drew a Taser, while Q constrained L who appears to try to then begin a direct assault on the attacker as if emboldened by the police presence.During this time, 13, both ingressing and returning, passengers including J and K (from phase 1), advanced down the tunnel and stood behind or to the side of MPS 1, now observing the situation at close quarters.
MPS 1 then shouted towards the attacker as he, along with Q and L, stepped back behind the waisthigh railing.The attacker pointing his knife towards them and began bouncing, seemingly getting ready to mount a further attack.At this time, a second officer (MPS 2) descended from the Grove Green Road entrance and joined his colleague.At this point, MPS 1 stepped forward and fired his taser, but it had no effect.The attacker then immediately lunged towards MPS 1 with his knife.
During this assault Passenger Q again intervened, this time by placing his rucksack directly in front of the officer preventing him from being stabbed by blocking the knife thrusts (see Figure 15).MPS 2 and a group of passengers behind him, including J, K and U, also backed away towards the Grove Green Road entrance.As they were doing so, two new officers (MPS 3 and 4) entered the Grove Green entrance and with Tasers drawn descended the tunnel joined by MPS 2. In the melee MPS 1, the attacker and Passenger Q had moved back towards the ticket hall entrance as MP2, 3 & 4 arrived.MPS 3 discharged his Taser, which connected with the attacker this time, dropping him to the ground.MPS 1 and 3 then advanced immediately, stood over him, took his weapon and restrained him with handcuffs.As the officers restrained the attacker, Passenger L assertively approached the entrance, seemingly attempting to reach and assault the attacker.He was stopped again by Q, this time supported by MPS 2 and 4. At this point, the attacker was prevented from any further action and the incident from an analytical perspective was concluded.

Summary of key observations
The necessarily complex description set out above provides the basis of several insights.Across all three phases of the emergency, it is evident that the behaviour of passengers was not uniform but diverse and complex.In phase 1, when the initial knife assault occurred, rather than a rapid collective egress, large numbers of passengers simply stood watching the attack unfold just a short distance away.Some even 20448309, 0, Downloaded from https://bpspsychub.onlinelibrary.wiley.com/doi/10.1111/bjso.12703 by Test, Wiley Online Library on [07/12/2023].See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions)on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License moved towards the danger intervening to stop the attack.The first collective flight occurred sometime into the assault and then at the specific point that the attacker shouted jihadist slogans and began cutting the victim's neck.But at this point, not all passengers fled.The footage shows that a handful remained, with some appearing to try to de-escalate or coordinate with the emergency services.Others positioned themselves outside the ticket hall and appeared to try to stop otherwise naïve ingressing passengers from inadvertently placing themselves in danger.It is also important to note that throughout this initial attack TfL staff had followed guidance and left the vicinity encouraging others to do so.There was therefore limited staff intervention, although one staff member remained in the vicinity to alert the control room and/or the emergency services.Equally, the attacker also appeared to decide not to attack some passengers and even actively allowed them to depart.
At the end of phase 1, the attacker left the station and entered the street level.Consequently, at the beof phase 2, the ticket hall and tunnel areas were largely empty of passengers.This soon changed, however, as new trains arrived, and both returning, and newly arriving naïve passengers flowed into the station.During this phase, it is apparent that several people began to adopt sometimes coordinated roles which appear to have been important in providing potentially lifesaving care for the victim, transmitting information and facilitating movement flow.Passengers appeared to move around the station assessing the ongoing threat levels and disseminating information to other newly arriving passengers, suggesting a high level of spontaneous organization and division of labour.There was also a notable tendency to return to normality once the immediate danger had apparently subsided.As new trains arrived, passengers from phase 1 appeared to seek out -and apparently find -medical expertise and then worked collaboratively to create formations which allowed medical assistance to be delivered by creating makeshift corridors.This information flow and coordination coincided with a return to 'normality' with passengers resuming a normative pattern of movement through the ticket barriers and out of the station.
Phase 3 described the period in which the attacker returned onto the station footprint and once again began attacking passengers.Here it is evident that the attacker was not indiscriminate in his attack.He walked past several individuals without displays of aggression, the majority of whom were non-white, before turning to attack two white passengers at the entrance to the ticket hall.During these attacks, there was collective flight egress but once again passenger behaviour was complex and certainly not uniform.Some passengers actively approached the attacker and placed themselves in extreme danger to distract him from assaulting others.Others documented the incident through their mobile device while using them as a form of deterrence.These interventions appear to have allowed those providing medical care to defensively escort the initial victim out of the ticket hall to a place of relative safety.At around the same time, at the station entrances and ticket barriers, passengers appeared to inform one another about the shifting threats, with some even blocking naïve passengers from entering the high-risk area.As the incident progressed, the attacker began to slash out at the trio of apparent strangers working together in their attempt to restrain and corral him.These actions even extended to shielding a police officer from the knife in the wake of a failed attempt to disable the attacker with Taser.Taken together, phase 3 once again showed evidence of complex, spontaneous coordination between passengers, as well as pro-sociality and care to protect apparently unknown others.

Repertoires of action
What is apparent, from the case descriptions above, is the behavioural diversity of the passengers.Far from a uniform rapid mass egress driven by selfishness, irrationality and fear in the context of a marauding knife attack, the behaviour of those in the immediate vicinity shows considerable variety, sociality, and coordinated purpose that we suggest it is valuable to understand.As such, in this final stage of our analysis we explored the footage once again to identify what we suggest are behavioural patterns that can be meaningfully categorized thematically into repertoires that describe the underlying nature of an emergent functional collective adaptation to the rapidly evolving dangers such situations can create.
We present these in Table 1, which classifies eight distinct behavioural categories (each with a behavioural definition), that cover actions we judged related to defence and de-escalation (Defending, 20448309, 0, Downloaded from https://bpspsychub.onlinelibrary.wiley.com/doi/10.1111/bjso.12703 by Test, Wiley Online Library on [07/12/2023].See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions)on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License Negotiating), information sharing (Communicating, Risk-assessing, Recruiting, Evidence-gathering), health care provision (First aid) and movement flow co-ordination (Marshalling).For each behavioural category, a reference is given which illustrates the alphabetical identifier of the individuals identified the account above who carried out the action.Note, that these behavioural categories are not mutually exclusive, with some individuals (e.g., C, H, O and T) adopting and performing multiple repertoires across the span of the incident.

DISCUSSION
Public transport infrastructures around the world remain vulnerable to marauding attacks, in which passengers may be targeted within confined public spaces (Cabinet Office, 2020).Knowing how members of the public react in these types of incidents is important for mass emergency preparedness, response and recovery.The current paper therefore contributes to knowledge through providing a detailed account of behavioural responses to a marauding knife attack on the London Underground, using triangulated footage captured on CCTV cameras.It provides a sequential chronology of the behaviour people in the vicinity of the attack across three temporal phases of the incident -the initial attack and first egress, victim care and a return to normality, the return of the attacker and public self-defence.Finally, the behaviours of passengers in response to the attack are organized into a repertoire of eight categories.
There remains a concern, across both science and society, that when under significant threat, individuals will merely flee and not take responsibility for others.It is salient to note that in this study there were several instances of egress, in which individuals hurriedly left the scene.What is also important to note, however, is that such behaviours were (a) not always immediate, (b) took place in ways which suggest they were driven by meaningful interpretations of the situation and (c) even when occurring many others remained in the vicinity.Also, there were several examples in which those who entered the station after the attack, appeared to take up new positions of responsibility and support.In this sense, the findings are intrinsically interesting, but they also have theoretical implications.
As described in the introduction, classical models of crowd and bystander behaviour suggest that in public emergencies of this kind, people will be either uniformly apathetic and self-interested or behave irrationally when faced with threat (Darley & Latané, 1968;Latané & Darley, 1968;Le Bon, 1926[1895]).The research literature has challenged such assumptions in recent years, with many studies of mass emergency behaviour that 'bystanders' commonly behave co-operatively, pro-socially and even self-organize spontaneously (Barr et al., 2023;Drury, 2018;Philpot & Levine, 2022;Philpot, Levine, & Drury, 2023).Nonetheless, despite these important developments, the precise behaviours and unfolding interactions which make up these collective efforts are rarely explored.This study begins to address this gap in the literature by examining a new type of threat using an innovative methodology.This study is unique in that it draws upon a montage of video footage that was taken from within the relatively confined space of an underground railway station.This footage allowed detailed observational analysis which evidences the complexity and diversity of how people behaved when faced with the threat of a marauding knife attacker, presumed by many at the time to be a terrorist.Based on this data, our thematic analysis postulates at least eight behavioural repertoires that we suggest were functional in enacting resilience, through aiding the victim, de-escalating, and constraining the attacker, assessing risk or protecting others.Previous research has focussed primarily on whether a person in the context of an emergency takes 'fight or flight' (Pietrantoni & Prati, 2009), behaves re-actively or proactively (Fridolf et al., 2013), follows routine behaviour (Donald & Canter, 1992), imitates the actions of others (Shiwakoti et al., 2017 ) or shows spontaneous cooperation (Drury et al., 2009a).The analysis presented here suggests that such action categories are important but may be too restrictive to fit the diverse, context-dependent and socially coordinated actions of how people can and do purposefully react to a marauding knife attack.
The reliance on CCTV data mean that it is impossible to accurately infer the motivations of the people we observed or the underlying psychological mechanisms which guide behaviour -e.g., social identity processes.Nonetheless, the observed behaviours are consistent with predictions of the SIMCR: that a sense of shared fate engendered by an emergency can create a common social identity among those affected by the threat which in turn underpins the emergence of socially coordinated support behaviours amongst strangers in a crowd (Drury, 2018;Drury et al., 2009a).While support behaviours were only exhibited by a minority of those who remained present, this pattern of behaviour cannot be easily explained by other theoretical models, such as mass panic or social capital.
This relates to the discussion within the field of emergency preparedness around the extent to which members of the public in emergencies function as 'zero-responders' (Cocking, 2013).The study builds upon this by speaking to the complexity of the socially coordinated actions that appear to flow out of this kind of emergency.Specifically, people appeared not just to act as individual responders but to take on series of complimentary social roles, almost in the form of a division of labour.For example, when the victim is being cared for, it does not make sense for more individuals to gather round and offer medical support; in fact, it is functional to move on.At some point the role becomes saturated, and individuals take up other responsibilities, such as marshalling others (which improves movement flow), risk assessing, and communicating dangers (which improves shared situational risk assessment among otherwise naïve participants).This speaks not to 'bystander apathy', in which individuals are dissuaded to act because of the presence of others but is another example of context sensitive proactivity and socially co-ordinated 'zero-responding'.These behavioural repertoires are particularly important in the case of a busy, single passage transport station, in which newly arriving passengers could walk naively into threats that they have yet to be made aware of by the authorities.
These debates about zero-responding stem from the knowledge that in most public emergencies the first people present and attentive are ordinary citizens as opposed to professional first responders (i.e., the emergency services), the latter who unavoidably take time to mobilize (Cole et al., 2011).For example, after the Madrid bombings in 2004 it took around 40 min for emergency services to arrive and after the London 7/7 bombings in 2005, the emergency services did not arrive until 23 min after the first explosion.In the case of the current study, the response time of the police of just approximately 8 min was comparatively rapid and yet, this still left a significant void.The propensity of passengers to confront the offender, defend one another and self-organize demonstrates the capacity of 'zero-responders' to fill this unavoidable vacuum.The study therefore compliments previous research by again emphasizing how members of the public clearly have utility as a key resource for resilience and public safety (Cocking, 2013;Cole et al., Durodié & Wessely, 2002;Wessely, 2005).
Clearly, the safety of passengers is also influenced by the coordination and organization of authorities.The current incident occurred within the context of one of the largest public transport infrastructures in the world.While the station staff were limited in number, they responded in line with training and 'Run, Hide, Tell' guidance to keep themselves and others safe by evacuating the location, taking others with them and informing control so that interventions could take place.Central control for the rail network were made aware within the space of a few minutes, but TfL acknowledge how difficult it was for the controllers to understand what was taking place.In the absence of adequate situational awareness, trains were at first still bringing passengers into the station at the time of the attack.Contrastingly, they then took the decision to prevent trains from stopping but this was at a time when the attacker had returned, and these trains may have been the only way passengers could have escaped had the attack been more sustained.What this demonstrates is the need to revisit policy to try to understand more effective ways of linking situational awareness to command and control in the precious minutes where these highly unpredictable attacks begin to unfold.Put simply, what the study highlights once again is that rather than being merely a problem to be managed the public may be central to resolving such challenges.
The analysis has practical implications for emergency preparedness and modelling.The sheer range of activity carried out by zero-responders suggests that more provisions, at the design and planning levels, should be targeted at this group.Indeed, further demonstrating this spontaneous capacity, even when a police officer arrived at the scene during the third phase and sought to take control of the situation, he was unable to do so.He was then actively defended and protected from being stabbed by zero-responders until his colleagues arrived a few seconds later.Moreover, the study suggests guidance could be tailored towards some of the repertoire of actions identified in this study.For example, as individuals are likely to attend to the wounded (i.e., first aiders), it would be beneficial for the transinfrastructure to provide easily accessible medical kits for individuals to engage with.Further, as zero-responders are likely to disseminate information regarding threat to one-another and the authorities (i.e., risk-assessing, communicating and recruiting) infrastructures could invest in communication mediums which facilitate peer-to-peer and public-to-authority interactions.Insights from this work can also inform computational modelling efforts which seek to simulate likely behaviours in emergencies.Modellers in this area still tend to give evacuees uniform and individualistic behavioural rules (Templeton et al., 2015).The current work speaks to the complexity, complementary coordination and pro-social intent of many individuals.This also suggests that a social identity approach to spontaneous group formation in computational modelling may be beneficial for optimized realism and fidelity (Philpot, 2017;von Sivers et al., 2016).This is concordant with other research that has demonstrated how agent-based computational models can be improved by applying SIMCR principles (Bartolucci et al., 2022;Templeton & Neville, 2020), rather than merely assuming autonomous individual movements when modelling collective actions and contexts (Wijermans & Templeton, 2022).
The current study has some limitations.First, while video data provide unrivalled access into real-life behaviours as they unfold in their natural settings, sometimes with multiple angles, analysing this form of data is not without challenges.This data requires much processing before the video analysis can begin.This involves site visits to understand the topology of the covered area, which inform how different camera angles (in the current study 23 cameras) spatially align.There is also the consideration of synchronicity between the footages from different cameras, which despite being timestamped, tend to be uncoordinated.Second, the privileged data access we were provided from TfL serves to highlight the difficulty in conducting this form of research and means that our methodology, while innovative, will be inaccessible to many researchers.Our study therefore emphasizes the importance of embedded knowledge co-production partnerships between university-based researchers and practitioners to help navigate the difficulties of unlocking similar datasets.Moreover, data protection laws, as well as ethical principles, will inevitably continue to preclude open sharing of these data sets, because such data is highly sensitive.Third, our CCTV data did not provide sound, meaning that any spoken word or verbally expressed behaviour is absent from the analysis unless available through other mediums (e.g., footage posted on social media).Ideally, video data should be triangulated with verbal accounts, such as witness testimonies, to include fine grained experiential Even without sound, the behavioural coverage afforded by the cameras is incredibly rich and thus exceedingly time-consuming to analyse.For example, it took four researchers repeatedly observing dozens of individuals months to make sense of the data.

CONCLUSIONS
While appreciating the limitations above, the current study joins a growing body of CCTV based behavioural evidence (Levine et al., 2011;Philpot et al., Under Review;Philpot & Levine, 2022) and selfreport accounts (Cocking & Drury, 2007;Dezecache, 2022;Drury et al., 2009a) which show that panic and irrationality is not the default reaction of people in emergencies.Indeed, far from being a uniform rapid mass egress driven by selfishness or fear, the behaviour of those in the immediate vicinity of the Leytonstone attack showed considerable sociality, complementarity, and therefore, coordination.The study demonstrates that these behavioural patterns can be meaningfully categorized into eight different repertoires of actions.Accordingly, people did act collectively and often pro-socially to support one another in a time of hostile threat.This capacity for collective, purposeful and meaningful resilience should be seen as an asset to be harnessed by authorities in the drive to protect society from harm.However, further research is needed to understand how the behavioural patterns we identified might be evident in different emergency situations where people are more known to one another or where alternative weapons are used, such as a mass shooting in a school.

FIGURE 1
FIGURE 1 A layout diagram of Leytonstone station with a red cross marking the location of the initial attack.

FIGURE 2
FIGURE 2 A series of CCTV stills showing the first attack.

FIGURE 3
FIGURE 3 Four passengers [C, H, O & T] from the Eastbound platform intervene.

FIGURE 4
FIGURE 4 Ingressing passengers stopped in front of the ticket barrier observing the attack.

FIGURE 5
FIGURE 5 Passengers turned and ran as the attacker cut V1's neck in sawing motion.

FIGURE 6
FIGURE 6Passenger N appears to negotiate with the attacker for his way out.

FIGURE 7
FIGURE 7The remaining passengers egressing away from the ticket hall, except R.

FIGURE 8
FIGURE 8The ticket hall and Church Lane tunnel left empty except V1 and R.

FIGURE 9
FIGURE 9 The simultaneous frames showing D joining the group helping V1 and H and M descending the Eastbound stairway.

FIGURE 10
FIGURE 10The simultaneous frames of when the station's traffic began to resume.

FIGURE 13 Q
FIGURE 13 Q engaging the attacker while U continued videoing.

FIGURE 14 C
FIGURE 14 C, M and T helping V1 to his feet and picking up his belongings.

FIGURE 15
FIGURE 15The attacker launching an attack towards MPS1 in the direction of the Church Lane exit, blocked by Q.