What Changed at Utah Valley?

Charlie Kirk Utah Valley security

Charlie Kirk’s Protection Failures; Utah Valley Exposed.

By Matthew C. Parker | CEO & Director of Training, Independent Security Advisors LLC | EPTraining.us | Defending Democracy Initiative

Posted: Sept 24th, 2026

 

From the author:

Minutes after the fatal bullet was fired, the assassination of Charlie Kirk was already being debated, analyzed, and had touched more than a few nerves. Some in the industry immediately jumped to the defence of the protective detail, while others shared their “expert” opinions on how and why it happened. Well, if we are being honest, we knew the how and why before he was officially announced dead. This was not a complex attack, and it was during a live broadcast.

What really bothered me was the “they shoulda” and I woulda” crowd who dazzled us with their in-depth analysis.  Bulletproof glass, check. Drones, check. Counter-sniper, SMH, check. But nobody thought to ask why? Look beyond the obvious, the media attention, and the CYA interviews, and determine how and why this happened. 

This was not a one-off; this was a systemic failure that started months earlier. So we will reverse-engineer not the security in Utah, but we will look at the pre-Utah protective operations and how they led to the failures on September 10th, 2025.  

 

Abstract

Charlie Kirk had appeared on college campuses across the country before he arrived at Utah Valley University on September 10, 2025. Many of those appearances involved protests, large crowds, open public interaction, and difficult security problems. His private security team traveled with him from event to event, but much of the larger security system did not. At several earlier campuses, experienced police leaders and well-prepared departments checked buildings and rooftops, monitored cameras, controlled access, brought in other police agencies, and, in at least one case, used a drone to monitor the area surrounding Kirk.

Utah Valley was different. Six UVU police officers were assigned to an outdoor event attended by approximately 3,000 people, while Kirk’s private security team concentrated on the crowd and the area immediately around him. Brian Harpole, who led Kirk’s security detail, later said his team recognized that the courtyard was exposed to elevated positions and had raised a concern about rooftop access before the event.

According to Harpole, UVU Police Chief Jeffrey Long told him the problem was covered, and the private team then stopped treating that outer area as its responsibility. The attacker eventually fired from the roof of the Losee Center into the courtyard below.

The larger question is therefore not simply why one roof was unguarded. Kirk’s traveling team had become accustomed to working with strong host agencies that often completed the outer security layer around it. When Utah Valley did not provide the same level of protection, the traveling team appears not to have adjusted enough to make up the difference. The drone issue, previous problems with police support and escape routes, and Harpole’s own description of how the rooftop area was handed over to UVU all point toward the same problem: operational complacency, normalized dependency, and failure of initiative.

 

The Security Around Kirk Changed Every Time He Changed Campuses

The easiest way to misunderstand Charlie Kirk’s security is to focus only on the private agents standing close to him. Those were the people who traveled with him, so they were the most visible part of the security operation. They knew Kirk, understood how he liked to interact with crowds, knew his staff, and carried the lessons from earlier events. What they did not carry from campus to campus were the local police officers, building keys, cameras, drone programs, police authority, and relationships with nearby agencies that made up much of the rest of the security measures.

This meant that Kirk could arrive at two campuses with much the same private team and still have very different levels of protection. At one university, a police chief might personally walk the site, assign officers to watch nearby buildings, and bring in another police agency. At another, the campus might have its own executive-protection unit or drone capability. At a weaker location, many of those functions might not exist unless someone specifically asked for them and made sure they were provided.

That is the part of this case that became clearer as I compared Kirk’s earlier appearances with Utah Valley. Several of the previous police agencies were not simply supplying extra officers. Their leaders were making independent security decisions that protected Kirk beyond the immediate circle around him. Those departments were helping complete his protective measures and build the protective cordons around him. And their competence may have hidden how dependent his traveling team had become on the quality of the local agency waiting at the next stop.

 

What Earlier Campuses Did Differently

Illinois State University provides a good example. Police Chief Aaron Woodruff reviewed the security plan, walked the site, and had personnel monitoring nearby buildings and rooftop areas through cameras during Kirk’s outdoor appearance. Woodruff had more than twenty-five years of municipal and campus policing experience, had attended the FBI National Academy, and had training and instructional experience related to violence prevention and threat reporting.

The important point is not the résumé by itself. His experience showed up in the operation because the department was looking beyond Kirk and the immediate crowd toward the surrounding environment.

Michigan State University had an even more direct connection to executive protection. Deputy Chief Akin Bryant had spent twenty-one years with the University of Michigan public-safety organization and, during his final five years there, led a Protective Security Section that included executive protection, special events, strategic intelligence, and drone operations.

Michigan State itself maintains executive/dignitary protection, special-events security, emergency preparedness, and other related functions within its Field Services Bureau. The public record does not establish that Bryant personally designed Kirk’s security plan, but it does show that Kirk was entering a police organization where executive protection was already an established function rather than something officers had to figure out for the first time.

The University of Wyoming approached Kirk’s April 2025 appearance differently but showed the same kind of initiative. Police Chief Josh Holland contacted universities that had previously hosted Kirk to ask how they handled his security. About fifteen officers, including personnel from another agency, worked the event, bags were restricted, and Holland said his officers checked the buildings to make sure people were not on the roofs.

Holland did not have the same executive-protection background documented at Michigan State, but he had years of university policing and training in active-shooter response, tactical medicine, use of force, and special-response operations. More important, he did not assume his department already knew everything it needed to know; he called people who had done the mission before and used what they learned to prepare his own campus.

UC Davis faced a different problem when Kirk appeared there in 2023. About one hundred protesters gathered outside the venue, glass was broken, objects were thrown, and confrontations occurred, yet the event continued inside because the university had spent weeks planning and had established a controlled entrance. Tickets and matching identification were required, attendees passed through metal detectors, and bags and backpacks were prohibited.

UC Davis Police Chief Joe Farrow had more than thirty-seven years in public safety and had previously served as commissioner of the California Highway Patrol, where he led more than 11,000 employees. Again, the important issue was not simply the chief’s title; it was that planning, access control, and police resources kept a serious disturbance outside the protected event instead of allowing it to become an immediate threat to Kirk.

Less than two weeks before the Utah Valley shooting, Kirk appeared in Visalia, California, where local law enforcement conducted advance work and used a drone to observe surrounding rooftops. The event was indoors, but police still looked outside the building because an indoor stage did not eliminate the possibility of a threat from the surrounding environment. That point matters because it shows that drone observation and attention to rooftops were not ideas invented after Utah Valley. They were measures already being used around the same principal shortly before he was killed.

None of these examples proves that Kirk could not have been attacked at another campus. Security cannot eliminate every possibility, and it would be irresponsible to claim otherwise. What the comparison does show is that several earlier host agencies were actively addressing the type of problem that later became critical at Utah Valley. They were looking at roofs, controlling buildings, screening entrances, calling other agencies, or using technology to watch areas Kirk’s private agents could not continuously observe.

 

Utah Valley Did Not Bring the Same Protective Experience

UVU Police Chief Jeffrey Long was not an inexperienced police officer. Utah Valley’s own biography describes more than thirty years of law-enforcement and public-safety experience, including more than twenty years with Orem Police, service with BYU Police, supervisory and training responsibilities, and a long military-reserve career that included deployments to Afghanistan. The comparison with the earlier campuses is therefore not about calling Long inexperienced. It is about asking whether the experience and resources available at Utah Valley matched the specific mission of protecting a nationally prominent public figure in an open courtyard surrounded by buildings.

The public record does not show UVU having the same established executive-protection, strategic-intelligence, special-event, or drone structure documented at Michigan State. Nor does the event itself show the same level of preparation seen at Wyoming, Illinois State, UC Davis, or Visalia. Utah public-safety officials reported that six UVU officers worked an outdoor event attended by approximately 3,000 people, in addition to Kirk’s private security team. The private team was larger, but Harpole later explained that his people were focused on the close area around Kirk and the crowd rather than the buildings farther out.

That difference should have mattered during the advance. A traveling team should not assume that because the police department at the last university handled rooftops, cameras, or outside support, the next department will automatically do the same. The weaker the local capability, the more important it becomes for the traveling team to identify the gaps and either help close them or make sure the principal understands that they remain open.

Harpole says his team did recognize the problem at Utah. He described the location as one they were not comfortable with and said his people immediately began looking at the risks. He also said the team increased its own manpower to twelve because it expected a large crowd and did not like the environment. Those decisions show that the traveling team understood Utah Valley required more attention than an ordinary stop.

 

Harpole’s Experience and the Warning His Team Already Had

Harpole was not an amateur. His published biography describes fourteen years as a Texas police officer, followed by private-security work beginning in 2008 that included executive and personal protection. The same biography says he completed more than 4,400 hours of advanced instruction in law enforcement and executive-protection practices. That is substantial experience, although the number combines law-enforcement and executive-protection training and does not identify how much of it was specifically devoted to executive protection.

The more important evidence is Harpole’s own description of what his team had already experienced while protecting Kirk. He discussed a previous San Francisco event where both the primary and backup escape routes became compromised as the situation deteriorated. He also described a separate New Mexico event where he said effective law-enforcement assistance was not available and his team had to physically fight its way out. Harpole did not identify those incidents with enough detail to connect them confidently to specific Kirk appearances, so they should not be assigned to particular campuses without more evidence. What matters is that, according to Harpole, his team had already learned firsthand that escape routes can fail and that outside police support may not be there when the detail expects it.

Those earlier incidents should have changed how the team approached later events. If both the primary and backup escape routes had already failed during one operation, future routes should have been checked more carefully and monitored as conditions changed. If the team had previously experienced a situation where expected police support was not available when it was needed, then police support at future events should have been confirmed rather than assumed.

Harpole also says the team had already warned Kirk that the open nature of his events was becoming increasingly dangerous. Put those experiences together and Utah Valley should have received greater scrutiny, not less. The team was preparing to place Kirk in an open courtyard surrounded by buildings, and Harpole says his own people recognized that problem before the event. Under those circumstances, being told by UVU Police that the area was covered should not have ended the security review. Kirk’s private team did not need to take over the police department’s responsibilities, but it did need to confirm that the protection on which Kirk would depend was actually in place.

 

The Rooftop Problem Was Known Before Kirk Took the Stage

Harpole says his team had concerns about the rooftops and the elevated positions around the courtyard before the event began. He later produced messages concerning reported student access to an elevated area associated with the Sorensen Center and said he asked Chief Long either to control that access or allow his people to address it. According to Harpole’s account, Long responded that he had the issue covered.

There is an important distinction that should not be lost. The concern raised before the event involved the Sorensen Center, while the fatal shot was fired from the Losee Center. Harpole’s team therefore did not identify the exact firing position in advance. That does not make the warning irrelevant, because the larger issue was already known: Kirk was sitting in an open area with several buildings and elevated positions around him, and at least one concern about rooftop access had already reached the security team.

Once that kind of problem is identified, the question should widen beyond the first roof that drew attention. Someone needs to determine which surrounding buildings have a clear view of the principal, how those roofs can be reached, whether access is controlled, whether cameras cover them, and whether officers or other observers are watching them. Harpole’s team did not have to personally occupy every roof, but it needed to understand how the larger risk was being managed before Kirk entered the courtyard.

Harpole’s own interview shows where that process broke down. He explained that his people were assigned specific areas close to Kirk so they could focus on the crowd without trying to watch an entire campus at once. When the discussion turned to the rooftops, he said that police were supposed to cover that area and that Chief Long had told him it was handled. The rooftop area was then dropped from the private team’s responsibilities while Harpole’s people concentrated on the immediate crowd.

There is nothing wrong with dividing responsibilities between a private security team and police. In fact, it is necessary. The problem is treating the assignment of a responsibility as proof that the protection actually exists. At Illinois State, surrounding buildings were being watched. At Wyoming, roof access was physically checked. At Visalia, a drone was in the air. Those measures could be seen and confirmed. At Utah Valley, the available record suggests that an assurance from the police chief became a substitute for confirming what was actually being done.

 

The Drone Issue Makes the Problem Harder to Explain

Harpole later said his company had invested in drones and had trained personnel but could not fly at Utah Valley because the campus was inside controlled airspace near Provo. He was correct that his company could not simply launch a drone wherever it wanted and ignore federal rules. The problem is that the rules did not create the absolute prohibition his explanation can sound like. FAA regulations allow qualified Part 107 operators to request permission to fly in controlled airspace, including through the LAANC system or the FAA’s DroneZone process. Approval depends on the location, altitude, timing, and other conditions, but controlled airspace does not automatically mean that a lawful flight is impossible.

Utah Valley University’s own written policy makes the issue even clearer. Policy 705 specifically defines “authorized visitors and contractors” as people who are not UVU employees or students but have received permission to operate a drone on university property. The policy states that visitors and contractors may seek written authorization through the Office of Risk Management and must provide proof of insurance. It also directs people seeking authorization to work with the university’s aviation-safety personnel on FAA requirements, and UVU continues to maintain a public process for requesting permission to operate a drone.

That does not mean Harpole’s company was guaranteed approval, and there may have been other legal or safety problems with flying over a large crowd. It does mean the answer was more complicated than simply saying that the company could not fly because the campus was in controlled airspace. The relevant question is whether the team explored the university approval process and the required FAA authorization early enough to determine whether a legal operation was possible. The public record and Harpole’s detailed interview do not establish that his company completed that process before the event.

There was also another option that did not require Kirk’s private company to operate the aircraft. Orem Police already had a formal drone program. Its written policy allowed the department to use drones when they could improve the protection of life and property and required procedures for normal and urgent deployment requests. Harpole himself later described Orem’s drone unit as active and professional and questioned why UVU Police did not request its help.

That is a legitimate question for UVU, but it also leads directly back to the traveling detail. Harpole says his team knew the site was exposed, believed a drone would be useful, and knew or later confirmed that a neighboring police agency had exactly that capability. His argument is that he did not have authority to order Orem Police onto a university campus, which is true. He did, however, have the ability to tell UVU that aerial observation remained an unresolved security problem and ask the department to obtain the resource through its local relationships.

If a private flight could not be approved, the next question should have been whether a police drone could be obtained. If the police drone was unavailable, then another way of watching or controlling the roofs was needed. If none of those options could be provided, the remaining risk should have been made clear before Kirk entered the courtyard. The drone issue is therefore not mainly about technology; it is another example of whether the traveling team kept pushing a known security problem until someone actually solved it.

 

Did Strong Host Agencies Make the Traveling Team Too Comfortable?

We cannot know exactly what Harpole was thinking, and calling him personally responsible would go beyond the evidence. The stronger argument is that the pattern shows operational complacency, normalized dependency, and failure of initiative. Those terms describe what happened to the security measures planning without pretending we can read anyone’s mind.

Normalized dependency develops when one organization repeatedly relies on another organization to provide an important part of the job. That is not automatically bad. Kirk’s private team needed campus police because police controlled the property and possessed authority the private agents did not have. The problem appears when that outside support becomes so routine that the traveling team begins to assume it will be present rather than rebuilding and checking it at every new location.

Several of Kirk’s earlier campuses could easily have reinforced that habit. At Illinois State, the chief personally walked the site and officers watched the surrounding buildings. At Michigan State, executive protection and drone operations were already part of the police organization. At Wyoming, the chief called previous campuses and checked roof access. In Visalia, police used a drone. Kirk’s private agents could remain close to him while experienced local organizations handled much of what happened farther out.

When those events ended safely, the entire operation appeared successful, but some of that success belonged to the host agency rather than the traveling team. If that distinction is not recognized, repeated success can create complacency. A team can work hard, remain professional, and still stop questioning an assumption that has worked many times before. In this case, the assumption appears to have been that campus police would handle the outer layer.

Utah Valley should have caused that assumption to be reconsidered. The police department had fewer officers assigned to the event than some previous sites, no police drone was operating above the courtyard, outside agencies were not integrated into the pre-event operation at the same level, and the site itself had broad elevated exposure. Harpole’s team recognized at least part of that problem. The failure of initiative came when the team accepted the handoff without doing enough to determine whether the promised outer security had actually been built.

 

This Was Not Only a UVU Failure or Only a Private-Security Failure

Utah Valley University had responsibilities that cannot be shifted onto Kirk’s contractors. UVU controlled the campus, its buildings, and its police resources. The university police department possessed the legal authority to control areas that private agents could not, and it had the ability to request help from surrounding agencies. The fact that six officers were assigned to an event of roughly 3,000 people, that no police drone was used, and that neighboring agencies were not part of the advance operation at the level seen elsewhere are legitimate parts of the security review.

Kirk’s traveling team had a different responsibility because it possessed information UVU did not. Harpole’s people knew Kirk’s habits, his preference for open public interaction, and the problems that had developed at earlier events. According to Harpole, they had already warned Kirk that the risks were increasing. They also recognized the elevated problem at Utah before the event began.

That is why this case does not need to be reduced to a choice between blaming UVU and blaming the private security company. A layered security system can fail in more than one place at the same time. UVU could fail to provide an adequate outer layer while Kirk’s traveling team also failed to recognize how much weaker that layer was than what it had received elsewhere and failed to push hard enough for the missing resources.

The leadership comparison helps explain why. Earlier agencies were often solving problems on their own before Kirk’s team needed to ask. Their chiefs and directors brought experience, judgment, and resources that quietly made the entire system stronger. At Utah, the traveling detail needed to compensate for the difference, and the available record suggests that it did not do enough.

 

What Experience Should Have Changed

Years of experience are useful only if they change what someone does. Woodruff’s experience showed up in a site walk and observation of surrounding buildings. Holland’s experience showed up in calls to previous campuses, another police agency, and checks of rooftop access. UC Davis turned weeks of planning into a controlled entrance that kept serious protest activity outside. Michigan State had executive protection, special events, intelligence, and drone operations built into the larger public-safety organization.

Harpole’s experience also produced some good decisions at Utah. His team saw the elevated problem, increased its own staffing, and raised a concern with the police chief. Those actions show that the team understood the event deserved more attention. The problem is that recognizing a risk is only the first part of solving it.

The earlier San Francisco and New Mexico incidents Harpole described should have made his team more careful about relying on support that had not been confirmed. The same is true of the drone issue. Once the team knew its preferred tool could not simply be launched without authorization, the next step should have been to work through the approval process, seek police assistance, or identify another way to cover the same problem. Experience should have made the team more persistent because it already knew what happened when outside support failed.

That is what makes Utah Valley more than an unfortunate gap nobody could have anticipated. The team had warning from its own past operations, warning from the site itself, and warning from the rooftop concern raised before the event. The problem was not a complete failure to recognize risk. It was a failure to carry the recognition far enough.

 

The Lesson From Utah Valley

The central lesson from Charlie Kirk’s assassination is not that every public speaker needs officers on every roof or that every campus needs a large federal-style protection team. Most universities and private security companies do not have those resources, and executive protection has always depended on different organizations working together. The lesson is that the traveling team has to understand which parts of its security actually travel and which parts have to be rebuilt at every new location.

Kirk’s private agents traveled with him, along with their knowledge of his habits and previous incidents. The police chief from Illinois did not travel with him. Michigan State’s executive-protection structure did not travel with him. Wyoming’s officers did not travel with him, and the Visalia drone did not travel with him. When Kirk arrived at Utah Valley, those capabilities either had to be replaced or the security plan had to change to reflect their absence.

The available evidence suggests that did not happen well enough. Harpole’s team recognized the elevated exposure but accepted the host agency’s assurance that the issue was covered. The team knew aerial observation could be useful but does not appear to have driven either the university authorization process or a request for local police drone support to a clear answer. These decisions make more sense when viewed against a history in which stronger local agencies had repeatedly completed the outer security layer around the same traveling team.

That is why operational complacency, normalized dependency, and failure of initiative are useful descriptions of what went wrong. They do not mean that Harpole or his people stopped caring about Kirk or stopped working. They describe a system that had become accustomed to competent host agencies filling the gaps, and a failure to adjust when the next host agency did not provide the same level of protection.

Charlie Kirk’s team did not need to perform every police function itself, and it could not. What it needed to do was know exactly what Kirk’s safety depended on and confirm that those protections actually existed before he entered the courtyard. Utah Valley is a reminder that an agreement, a plan, or an assurance is not the same thing as a protective measure that is actually in place. In executive protection, the difference can remain invisible through dozens of successful events and become obvious only once, when it is already too late.

 

About the Author

Matthew C. Parker is CEO of Independent Security Advisors LLC and Director of Training for EPTraining.us. Retired U.S. Army and combat veteran, Master Instructor and protective-services practitioner, Parker has more than three decades of military, security, training and advisory experience in the United States and internationally.

His protective-services background includes formal federal protective-services training, executive and dignitary protection, advance work, physical security, threat assessment, protective planning and the development and training of personnel responsible for protecting government officials. In Iraq, his work included protective-service operations and the assessment and training of government protective personnel. His later work in Ukraine included training police and judicial-security personnel responsible for protecting judges, government officials and public institutions during wartime.

Parker’s approach to executive protection treats the agent standing next to the principal as only one part of a much larger system. His writing and training examine what was known before an incident, how the security plan addressed the threat, whether the different protective layers actually worked, and what should change after a failure. That same approach is used in this case study of the Charlie Kirk assassination at Utah Valley University.

 

About Independent Security Advisors and EPTraining.us

Independent Security Advisors LLC operates EPTraining.us, a U.S.-based executive-protection training program serving law enforcement, the military, government, corporate security and qualified private-sector protection professionals. ISA’s executive-protection training history reaches back to 2011 and grew from the need to prepare law-enforcement personnel and other professionals for real dignitary and executive-protection assignments.

ISA teaches executive protection as a complete system rather than simply the close-protection formation surrounding the principal. Training addresses threat assessment, protective intelligence, advance work, site security, transportation and movement, communications, emergency planning, medical response, coordination with law enforcement and other functions that have to work together before, during and after a protective operation.

The program is built around measurable performance and practical application. ISA regularly reviews its curriculum as threats, technology, regulations and operational lessons change. Its executive-protection programs have received regulatory approvals, law-enforcement recognition and professional endorsement, and the organization continues to work with law-enforcement, military, government and private-security professionals in the United States and internationally.

This Charlie Kirk case study is part of ISA’s continuing examination of real protective incidents. The purpose is not to assign blame from hindsight or suggest that every attack can be prevented. It is to identify what was known, what security measures were available, where the protective system appears to have broken down, and what future protection teams can learn from it.