AbstractAcross a range of recent terrorist attacks in the United Kingdom, the question of how crowds behave in confined public space is an important concern. Classical theoretical assumptions are that human behaviour in such contexts is relatively uniform, self‐interested and pathological. We contest these assumptions by reporting on a study of public response to a marauding knife attack that occurred on London's underground rail network in 2015. The analysis draws primarily upon footage from 27 CCTV cameras positioned across the station footprint supplemented by social media, news footage, radio logs and incident reports. Using an innovative methodology, we topographically and chronologically mapped behaviours during the incident. The analysis demonstrates that while rapid egressions occurred as the threat escalated, at every phase of the incident members of the public intervened spontaneously with coordinated, purposeful, socially oriented actions. This behavioural pattern contrasts with classical assumptions of a chaotic and apathetic crowd in emergencies. We highlight eight complementary categories of actions in the public response that appeared functional for the collective safety of the crowd during the short period before the police arrived. The policy implications for emergency planning, and the methodological innovations involving the use of video data are discussed.