He thought it was fireworks.
"Be advised we have possible, could be firecrackers. I think we have shots fired, possible shots fired 1200 building, Peterson radioed at 2:23 p.m.
I would like to see the timestamp on the Uber driver's drop off, which should be pretty accurate. With that data it should be possible to see how much time Cruz had to put on the vest and mask witnesses saw, and unpack his firearm before he started shooting.
I, as a small female civilian, know that when you hear “fireworks,” you’re to assume you’re hearing gun shots.
"Cruz was dropped off at the school by an Uber at 2:19 p.m. Two minutes later, he entered Building 12. He began firing within 15 seconds. Peterson, at the time, was near the administration building."
So when did he put the vest and mask on?