Introduction Traditional law enforcement techniques historically have

Traditional law enforcement techniques historically have focused on the apprehension and prosecution of violent offenders after violent crimes are committed. When police are given information that someone may potentially commit a crime or become violent in the future, their responsibilities, authorities, and available investigative tools are suddenly less clear. This guide is about threat assessment and management, or stated another way, how law enforcement officers and others may identify, assess, and manage the risk of future, planned violence. This task is a complex and nuanced one. Published research about intended violence and its perpetrators, along with knowledge and experience derived from previous cases, are applied to the facts and circumstances of each case. In other words, there is a lot to think about.
The FBI Behavioral Analysis Unit (BAU) held a symposium in mid-2015, bringing together academic researchers, mental health experts, and law enforcement practitioners of threat assessment to discuss the active shooter phenomenon. Specifically, symposium participants focused on prevention strategies with regard to this crime problem. By far the most valuable prevention strategy identified was the threat assessment and management team. The good news is that every organization and community has the potential to stand up or access such a team. The intent of this publication is, therefore, to provide desperately needed guidance on making this a reality for every community based upon a consensus of recommendations in an evolving field. Recommendations are offered about this process in very practical terms. It is not intended as an academic textbook but rather as a hands-on guide for novice and experienced threat assessment practitioners alike.
The first and most fundamental potential barrier to engagement is lack of knowledge- knowledge about threat assessment and management itself, about risk factors and warning signs, about what goes into managing potential threats. This knowledge is a key to implementing viable strategies to reduce targeted violence. Without it, prevention efforts are far less effective because they may then be guided by assumption and fear of the unknown, rather than knowledge and experience. This guide provides some of the information needed for creating teams and engaging in the business of threat assessment and management. It is derived from published research and the collective experience of the BAU and other experts.
This guide first addresses some important awareness aspects of the active shooter problem, not the least of which is the term “active shooter.” The content of this publication does not begin and end with active shooters, but instead applies to targeted violence generally. However, it does not specifically address potential acts of terrorism, or threat assessment for violence perpetrated primarily in furtherance of a political, religious, or other extremist cause or ideology. Planned violence, threat assessments, violence and mental health, and barriers to successful prevention efforts are also
discussed. The guide then offers specific and actionable information on identifying, assessing, and managing persons who pose a true concern for planned, targeted violence. Guidance about setting up and running a threat management team is offered. Sample tools are provided in the appendices.
Additionally, this guide is context-neutral, and can be applied to educational, workplace, and other situations.
Prevention is not and cannot be a passive process. It requires a strong and overt commitment by organizations and communities to prioritizing public safety and caretaking for those in need. This is manifested by adoption of policies and programs to support targeted violence prevention efforts, establishment of threat assessment and management teams, and education to underscore the importance of these processes and to promote acceptance and engagement by all.
Chapter 1 Awareness: Initial Step Toward Change
Violence is gender neutral
Those responsible for threat assessment and management should recognize that both male and female persons of concern for targeted violence will come to their attention. There may be a tendency for stakeholders to view the potential threat posed by females as less worrisome, e.g. dismissing threatening writings by females as mere fantasy or attention-seeking material. The BAU strongly cautions against this approach, and recommends safety stakeholders not dismiss female persons of concern as nonthreatening based upon statistics supporting the idea that males are more likely to offend in this way. Targeted violence is a highly individualized crime based upon highly individualized and unique motivators.
For ease of reading, however, only male gender pronouns are used in this publication in reference to single individuals.
Diminishing the violent offender
While it can be difficult or even impossible to truly understand, for some people there is an aura of power or cultural fascination surrounding shooting attacks. It attracts and encourages certain troubled individuals, helping to propel them along their paths toward intended violence. This aura can be projected by an offender in a pre-recorded video manifesto or during an attack, or it may be an interpretation by the reader of an online statement posted immediately after an incident. The dominance of 24/7 media coverage, networks and internet sites competing with each other for viewers, and even our own fascination as a society perpetuates this and allows it to grow and evolve.
Before case-specific prevention efforts even begin, the problem of glorification of these events should be addressed. First and foremost, the words society as a whole uses to describe both the phenomenon and the attackers are fostering this mystique. Terms like “active shooter,” “lone wolf,” or any others that romanticize and idealize these offenders, should be deemphasized. Such words and phrases project power and sensationalize predatory violence. Instead, describing an attack as an incident or shooting incident, and the attacker as an assailant or offender, is strongly recommended as a means of denying legacy establishment to these violent criminals. Extensive media coverage featuring the offenders’ names, photos and life stories only cements the legacies they seek to achieve. It may never be possible to pinpoint primary influences on individual decisions to attack, particularly in cases where an offender does not survive the incident. Highly personal factors are dominant motivators; however, some inspiration may also derive from intensive and available coverage of past acts and actors.
A shooting incident, once sensationalized in the media, can live on for years in full color and sound, at a keystroke. A change in the way these events are reported and talked about may diminish this phenomenon. The term active shootera should be dropped from our cultural narrative. News media should refrain from naming the assailants, from posting their photographs, videos and communications, and from publishing detailed investigations into their lives and motives.
This guide will adopt that posture and refrain from using sensationalizing descriptors.
These offenders don’t “snap”—they decide
Violence can be categorized in one of two ways: predatory/planned or impulsive/reactive. Predatory/planned violence is premeditated and serves some purpose for those who plan and conduct violent attacks. Impulsive/reactive violence, on the other hand, is emotional and impromptu; it is frequently a defensive behavior in response to a perceived imminent threat. These two types of violence are distinctly different. Clinical and forensic data on adult and adolescent mass murder, the type of violence this guide is concerned with, will reveal that virtually all of these acts are premeditated, rather than impulsive, violence. Two obvious signs indicate this is so: the planning and preparation for days, weeks, or months, sometimes recorded by these offenders and often observed by others, and the utter lack of emotion witnessed by survivors while the perpetrators committed their crimes.1
Targeted mass attacks are just that—“targeted." Forethought and planning go into the attack. These are not spontaneous, emotion-driven, impulsive crimes emanating from a person's immediate anger or fear. In fact there is no evidence in the research to date that “snap” mass murders occur at all. The perpetrators often have a grievance and they take time to consider, plan, and prepare their attack. This is one advantage that threat assessment teams have—preparing to engage in violence almost always requires time and action, which in turn allows for opportunities for bystander observation and reporting. This will be discussed further below.
Threat assessment
Threat assessment is a systematic, fact-based method of investigation and examination that blends the collection and analysis of multiple sources of information with published research and practitioner experience, focusing on an individual’s patterns of thinking and behavior to determine whether, and to what extent, a person of concern is moving toward an attack. A threat assessment is not a final product, but the beginning of the management process. It guides a course of action to mitigate a threat of potential violence; merely identifying that someone is of moderate or higher concern, without developing a management strategy, does not complete this process and is not recommended.
When a person of concern has been brought to the attention of safety stakeholders, it is essential to engage as early as possible in the assessment and management process. By the time crisis- stage management is reached, likely solutions run the risk of being “knee jerk” rather than measured
and thoughtful, with past, present and future in mind. By engaging in the assessment and management process as soon as a person of concern is identified, threat managers are more likely to succeed in preventing a violent outcome. Steering a person in a different direction early on may mean offering assistance to someone who needs it before that person concludes violence is necessary.
Scientific research and lessons learned from completed acts of targeted violence have added significantly to the body of knowledge about who commits it and why, what warning signs may be evident, and more. This increase in knowledge suggests that law enforcement agencies and other entities may consider developing methods to address threats of violence by persons of concern from a prevention standpoint, where feasible. Guidance is available from various sources to institutions and organizations that need to develop policies and procedures aimed at violence prevention. Research- based data are becoming increasingly available to assist in assessing violence risk within the context of mental health assessment. Foundational studies such as the Exceptional Case Study Project3 and the Safe School Initiative4 addressed targeted violence. Though they have been advanced by a significant body of additional research and thought, their key findings remain core to this discipline. Both studies focused on the thinking and behavior of planned violence offenders leading up to their crimes. They found most offenders did not threaten their targets directly, but prior to the incidents they displayed identifiable behaviors reflecting potentially violent intent. These conclusions support using an evidence- based approach to assess persons of concern by evaluating behaviors in order to determine the appropriate level of concern.
Invaluable resource materials derived from research and experience are publicly available, such as those identified in Appendix F. These resources, largely used to create this guide, lay the framework and build a convincing case for public and private entities to incorporate the threat assessment and management process for gathering, assessing and managing concerning persons and situations via strategies for preventing targeted violence.
In addition to qualitative and quantitative research, targeted violence incidents themselves represent an additional and invaluable source of knowledge and experience for threat assessment practitioners and policymakers alike. For example, as a result of the 2007 tragedy at Virginia Polytechnic University, the Virginia legislature passed measures resulting in an improved emergency evaluation process in that state, modified criteria for involuntary commitment, tightened procedures for mandatory outpatient treatment, increased state funding for community mental health services, requirements for better collaboration between the courts and the services system, and the establishment of data systems for monitoring and oversight of the commitment process. This tragic incident also provided learning material for threat assessment professionals regarding risk factors and missed warning signs, losses of opportunity to intervene, the violent behaviors themselves, and more.
With every incident, lessons are learned.
The symposium participants’ intentions and hopes for this guide are to summarize much of this knowledge for organizations and communities, in furtherance of a goal of standing up teams and processes to manage threats of planned violence.
Barriers to successful engagement
Entities identified below all potentially play a role in threat assessment and management. They may encounter or inadvertently cause barriers to successful engagement. Threat management is about diverting dangerous and concerning behaviors away from a course that would ultimately lead to an act of targeted violence, and any person or organization interacting with a person of concern can impact the course of events. As a proactive measure when faced with a person of concern, referral of the matter to a local threat management team is always a good choice, and is at minimum preferable to doing nothing.
 Law enforcement: Most uniformed law enforcement organizations are stretched thin as it is. It can be difficult to devote resources to preventing something that may or may not happen. Law enforcement agencies, their officers and agents, and leaders may consider becoming versed in preemptive measures to prevent violence to the extent practicable for each agency and community. Awareness can be developed about threat assessment and how it fits into daily operations.
 Prosecution: Prosecutorial discretion and ingenuity are highly effective tools in threat management, and their use is encouraged. Even low-level cases may be worthy of pursuit in order to hold a person of concern accountable; another goal may be to deter violent behavior. Prosecutorial agencies should view themselves as part of the solution.
 Schools: Schools are responsible for maintaining a safe and positive learning environment for all students. The desire to avoid conflict or trouble can unnecessarily create obstacles and ultimately do disservice to persons of concern and to the general population at a school. Information should be shared with threat managers where permissible, and schools should be part of threat management solutions.
 Social services: These agencies address needs and facilitate access to services for at-risk individuals and families; they also engage at the community level to improve lives. The social services system may be more overburdened than any other in the overall threat management process, which creates serious challenges for it in performing its functions in a safe and effective manner. Social services can offer invaluable resources in the quest for successful threat management; the impact of these resources can be enhanced via co-deployments with other components of the team and by referring problematic issues for collaborative engagement.
 Health care systems and providers: The health care system is similarly overburdened, which creates challenges related to evaluation, diagnosis, and treatment of at-risk individuals. Ideally, health care workers at all levels might develop awareness about threat assessment and how violence and mental illness intersect. They should be open to sharing information with threat managers when privacy laws permit sharing, and in all cases be receptive to receiving information from law enforcement and others to help inform their own clinical judgments.
 Lawmakers: Members of legislative bodies have the responsibility for solving problems left by gaps in the law; unfortunately, these gaps are many and varied. These are not simple issues with obvious, single solutions. It is recommended that lawmakers remain mindful that statistics rarely provide proof of successful prevention; only tragedies make the headlines, whereas successful prevention efforts are difficult to measure. Regardless, prevention programs require resources. Legislators are positioned to assist with providing needed resources to threat management programs.
 Courts: Among many other responsibilities, the courts have power to issue orders for incarceration and other restrictions on freedom, mental health evaluations and treatment, and more. The influence and power of the court extends from the infancy of a case until well beyond its conclusion. It is recommended that courts achieve fluency with mental health issues, particularly where violence is concerned. Courts are encouraged to think of judicial discretion as an effective threat management tool;
using every available tool could be a step toward preventing tragedy.
 Probation and Parole: Probation and parole agencies can directly impact threat management cases in their unique positions of observation and control over a person of concern. Violations of conditions may be indicative of a greater problem. Probation and parole departments may consider obtaining training on risk factors, warning behaviors, and mitigators so they can recognize these signs and understand what bigger picture may be forming when violations occur. These agencies should be part of the threat management team on any case where they oversee a person of concern.
 Employers: Persons of concern spend perhaps as much time at work as they do anywhere else; colleagues and leadership are uniquely positioned to observe and be impacted by a person of concern. Discipline and dismissals, violence prevention policies, encouraging bystander reporting and more, all affect how an employer manages threats of violence; none of these issues are simple or easy to navigate. One issue of particular significance is that former employees can still pose a threat to the workplace or community at large after they no longer work or live in a particular location. In order to plan forward-thinking management strategies when needed, employers are encouraged to either create or participate in threat management teams, or fully cooperate with inquiries by threat managers.
 Parents and immediate family: In many circumstances, parents may have the best optic on a person of concern’s struggles and vulnerabilities, especially if the person lives at home with them. In some cases, parents or other family members may tend to “circle the wagons” around a minor child and avoid cooperation with mental health recommendations, school concerns, social services assistance, and law enforcement inquiry. Although often difficult, it is important for parents to remain open to assistance and guidance when it is needed to address concerning behavior or mental health issues.
Addressing these issues early can have a profound impact on improving quality of life and reducing later violence concerns.
 Bystanders (friends, neighbors, loved ones): Anyone with an opportunity to observe or interact with a person of concern may see or hear something that generates apprehension. When this happens, bystanders are urged to communicate that information on to an appropriate person, as referenced below in “Bystanders.”
Early recognition of barriers
As soon as a team receives a new report and an assessment and strategy are being considered, it must also begin thinking about what obstructions may surface. The earlier a threat management team recognizes particular hindrances, the more effectively it can address them. Barriers at multiple stages can inhibit effective management. Some barriers may be intentional (e.g., a resistant parent) and some may not be (e.g., confusion about privacy laws and information sharing), but all can complicate the process.
Barriers to successful engagement vary in degrees of difficulty, and can be encountered throughout the process. For example, erroneous information may surface during any stage of assessment. This common occurrence can cause threat managers to treat unsubstantiated rumor as fact and exhaust resources prematurely, or lead to a stalemate wait-and-see circumstance wherein they lack sufficient, corroborated information upon which to base case decisions. Avoiding these barriers requires threat managers to carefully validate information when it is received. As threat management teams mature, they will become increasingly adept at identifying and navigating challenges. Members should always take the time to consider all obstacles during every assessment.
Stakeholders and threat management teams should be on guard against becoming barriers themselves. They may inadvertently minimize concern for a variety of reasons. Members may find themselves desensitized to a person of concern who has been an annoyance for a long period of time, or they may be uncertain about what particular behaviors truly mean. They may have difficulty in accepting that a true violence concern could exist in a given community. There may be uncertainty about which stakeholder is responsible for a case.
Additionally, stakeholders or teams may erroneously believe that responsibility for a case or particular issue falls to another organization, or they may simply not know their own organizations’ policies and authorities. They may fear being sued or fear inadequate liability protection in the event of litigation; while this is a natural and likely inevitable concern, the obstacle arises when this fear becomes crippling to the point where no action is taken. These potential barriers may be alleviated by establishment of sound policies and procedures grounded in law and established responsibilities. Tools like non-disclosure agreements, memorandums of understanding, and/or standard operating procedures can help.
Information sharing
Another potential barrier to effective engagement is open information sharing amongst entities and threat management teams. It is critically important that stakeholders and team members alike completely and accurately share information to the extent possible. For example, school administrators can share staff observations and social services can share information about family dynamics. There are times, however, when information sharing is subject to limitations by law. For example, only law enforcement agencies are generally entitled to view criminal history information, and certain limitations on disclosure apply to health information and educational records. These limitations do not translate to absolute prohibitions, and one must understand what federal and state laws allow before proceeding.
Violence and mental illness
Researchers have been exploring the relationship between mental illness and violence for the better part of four decades. On balance, studies show a small but significant relationship between serious mental disorder, particularly psychotic disorders, and general violence risk.6 Although most people with a major mental illness do not commit violent acts, the likelihood of it is slightly greater for someone with a serious mental illness than for someone who is not so afflicted. Co-occurring variables can either enhance or decrease risk. Risk factors include past violence, childhood exposure to violence, substance abuse or dependence, and numerous environmental stressors.7 When considering targeted violence, substantially higher rates of severe mental illness have been observed among adult mass murderers, public figure attackers, and lone actor terrorists than in the general population.8
Behavior, not diagnosis
It can be tempting to get caught up in questions about a person of concern’s mental health diagnosis, particularly when vague statements are made to suggest he may be unstable, hear voices, or “may” have been diagnosed with a disorder. Understanding that a specific behavior can be connected to a specific diagnosis may help validate observations and reports of others. For example, knowing someone has been diagnosed on the autism spectrum can help explain and validate observations about strained social interactions, lack of visible emotions, and inflexibility with routines. However, it can also foster unsupported assumptions about other behaviors which may not be occurring. Initial diagnoses are sometimes incorrect due to any number of factors, or they are later amended or clarified. After all, a person being evaluated may very well demonstrate different symptoms or behaviors at different times, leading to diagnostic uncertainty and flux. It is best to avoid becoming focused on diagnosis when a person is being assessed for violence potential.
Ultimately, behaviors are the foundation of any mental health diagnosis, but they do much more than simply inform diagnosis and treatment. Behaviors can be clues to a person’s intentions. For example, if threat managers learn that a person of concern was discovered in a potential target’s neighborhood and he does not normally belong there, that could be evidence of pre-operational surveillance. Whether the person who is conducting the approach behavior is diagnosed with schizophrenia, antisocial personality disorder, or nothing at all is much less relevant at this juncture.
That a person of concern may be actively involved with surveillance of a target, rather than what diagnosis might be affecting this behavior, is what will drive the threat assessment.
However, information about a specific diagnosis may be quite helpful during threat management. Different internal states implicate different techniques to reduce violence concern. For example, a recent case involved a highly paranoid individual with whom law enforcement had to successfully interact in order to manage violence concerns. During what was to be a lengthy encounter, detectives brought prepackaged and sealed food and drink to counteract any paranoia he may have felt about being poisoned by others—one of his ongoing perceptions.
Threat assessment and management is an intertwined, dynamic process with mental disorder symptoms and diagnoses being several pieces in a larger puzzle.
Chapter 2 Identification: An Essential Step for Threat Management
Low probability/high impact events
Targeted violence attacks generate fear and anxiety. The seeming randomness of these crimes leaves members of the public wondering if they are safe at any given time. In reality, targeted violence attacks represent a low base rate, albeit high impact, crime. Base rate refers to the frequency of these events in a certain population over a certain period of time. The base rate for school attacks will differ from the base rate for public figure assassinations, though both are examples of targeted violence.
Even one homicide is too many. However, the generally low incidence of this kind of offense is worth noting. As of 2006, the average American K-12 school could expect one of its current or former students to be involved in a homicide on its grounds about once every 13,870 years.9 Even with frequency of targeted violence shooting events on the rise at this moment,10 student-associated intentional gun deaths at school have risen and fallen multiple times since 1992.11 Workplace homicide has declined significantly since 1993, and continues to do so, although it remains a significant problem. The sort of violence this guide concerns itself with, however, is less apparent in typical statistical reports.
It is difficult to find consensus on the number of targeted violence attacks regardless of venue, because the exact criteria for counting an incident often varies among academic researchers, media, and the government.
That said, this guide was not written to highlight statistics and probabilities. It was written because these incidents are horrific, wrenching, and, symposium participants believe, may be preventable. As for randomness, they are rarely, if ever, truly random. The term targeted violence refers to an incident of violence where a known or knowable assailant chooses a particular target prior to a violent attack. The chosen target may be one or more individuals, a class or category of individuals, or an institution. The offender may not actually reach or ultimately harm the chosen target for any number of reasons, but pre-event target selection of some kind has been made. This targeting is, in a sense, one of the keys to prevention. It likely means the would-be offender has a personal grievance toward someone, a group of persons, or perhaps an organization. It may be openly expressed, along with the idea that violence is the only valid solution to the problem perceived by the grievant. Research, planning, and preparation are likely needed in order to ensure success. Other
behaviors, as well as expressions and communications, may hint at or outright announce an intention to become violent. All of these mental and behavioral “waypoints” along a pathway to violence may be observed by someone, who can in turn report to authorities.
Bystanders become upstanders
Bystanders are the force multiplier of threat management. They are the extra eyes and ears for threat management teams, school administrators, human resource managers, police officers, and others responsible for the safety of others. The value of bystanders in prevention efforts cannot be overstated.
Bystanders are a key component for prevention of targeted violence events. A bystander is anyone positioned to have awareness of risk factors or to observe warning behaviors related to a person
who may be considering acting violently. A bystander can be a friend on social media, a classmate, a co- worker, a neighbor, a family member, or a casual observer. The term upstander has been previously used to describe individuals who spoke out against genocide,14 and more recently in the context of countering bullying. It may more accurately describe the desired response in bystanders—that they will report what they know or see to law enforcement, human resources, school staffers, or a caring adult. An upstander can potentially intervene by various means, but most importantly by simply conveying what he knows, observes, or fears may happen.
Transforming bystanders into upstanders is a must. However, bystanders may feel overwhelmed by or fearful of informing on a friend or associate, because of any of the following concerns:
 Potential for ridicule
 Potential for reprisal either from the person of concern or from the organization
 Appearance of being a “snitch”
 Potential of not being taken seriously
 Uncertainty about the seriousness of the information or situation
 Mistrust of confidentiality or mistrust of the system to handle the situation appropriately
 Desire to remain uninvolved in the affairs of others
 Other concerns which may be unique to each person
Creating Opportunities
There are programs scattered throughout the country aimed at achieving knowledge and familiarity with students, especially at-risk ones. One model for ensuring that caring adults have “eyes on” every student follows this general format: imagine a large chart with all school staff names listed across the top for each column, and each student name listed down the side for each row. Staffers mark the box for each student they know by name and with whom they can comfortably have a conversation. A box left completely empty represents a student with no relationship with a caring adult at the school—no eyes are on that student. Special attention is then paid to establishing some kind of relationship between at least one staffer and that student. If successful, no student completely slips through the cracks at that school. This system may not be a full-proof measure against violence, but it may dramatically reduce the chances that an at-risk student will spiral downward outside the awareness of those empowered to help.
The upstander asks not what should have been done, but what can I do? A culture of shared responsibility helps the upstander feel comfortable doing this. Upstanders also do not assume others will carry the burden of reporting. Steps must be taken to ensure that, in policy and in practice, upstander reporting is valued and treated with discretion
and respect. The occasional problematic reporter, or someone who may tend to over-report behavior that may not actually pose a concern, may happen. However, working from an assumption that most people have both a genuine interest in doing the right thing and are not hypervigilant to benign behaviors, will serve this purpose well.
Among key research findings is the certainty that upstanders are an absolutely critical component of prevention. In one study,15 researchers found that in 81% of school shooting cases they reviewed, the offender told at least one person about the attack beforehand. In 59% of cases at least two other individuals had some information about the event before it was carried out. This alone suggests that upstanders are invaluable resources who create opportunities for intervention and ultimately prevention.
Research of both successful attacks and potentially prevented cases reveals several observations about bystanders:
 Bystanders may take steps to convey information, or they may do nothing
 The school/workplace/environmental climate directly affects whether bystanders come forward
 Bystanders sometimes do not believe violence will actually occur, or they misjudge the likelihood and immediacy of the threat
 For student bystanders, parents or parental figures influence whether they will report16
 Bystanders are more likely to report if there is an anonymous way to do so, if the means of reporting is clear and easy, and if they believe the authority receiving the report to be trustworthy
In view of the impact these events have on communities and the nation, virtually everyone in society can be an upstander. They should be viewed as such and, more importantly, encouraged to view themselves as such.
Ideally all community members will be upstanders. When someone hears or sees something concerning from children, family, friends, neighbors, or co-workers, they might ideally ask questions or at least think about whether there is a concern that should be brought to the attention of authorities.
For example, one recent case involved a juvenile who received hundreds of ball bearings by mail order, a fact known by his parents. When his parents asked, their son provided an explanation that did not necessarily make sense and yet went unchallenged. Subsequently, the juvenile used the ball bearings to construct several improvised explosive devices with an intention to engage in violence while his parents remained unaware of his true intent.
Opportunities for identification
Each bystander in a person of concern’s sphere represents an opportunity to identify potential warning behaviors. Behavior supports assessments as to the appropriate level of concern and guides management strategies. One concern is that bystanders may be unaware of the importance of the information they possess. This may be because any one person could possess a relatively small amount of information: perhaps a comment overheard in the hallway or a sudden flurry of odd social media posts. A bystander could dismiss or downplay the importance of the information because he is unaware the person is exhibiting many other warning behaviors outside of his field of view. It could take reporting from many upstanders to form an accurate picture of a case. Without the support of upstanders in many segments of society, threat assessment and management would be much more challenging.
Threatening behavior can include communication or physical actions intended to intimidate others. When ignored, these behaviors can escalate to more serious problems. Someone who engages in harassment, intimidation, bullying or making threats must be assumed to be doing so with intention,
and the behavior may be repeated as long as it is [a] effective in supplying the person with something he wants, or [b] not stopped by an authority with the power to do so. Although not a complete list, some examples of reportable behavior could include:
 Any physical violence toward a person or property
 Direct or indirect threats of violence
 Any act, gesture or statement that would be interpreted by a reasonable person as threatening or intimidating, such as overt physical or verbal intimidation, throwing objects or other gestures intended to cause fear, or making contextually inappropriate statements about harming others
 Unusual or bizarre behavior that would cause a reasonable person to fear injury or harm due to its nature and severity, such as: stalking; erratic or bizarre behavior suggestive of mental disturbance or substance abuse; fixation with mass murder, weapons, or violence generally; or fixation with hate group, terrorist, or extremist material
 Any statements or behaviors indicating suicidality
A more complete summary of concerning behaviors which may be worthy of upstander reporting is found in Chapter 3, Assessment: Analysis for Guiding Management.
Reporting and reporting mechanisms
Reporting is an essential part of prevention. Reporting mechanisms should be easy to understand and effective at getting information to someone empowered to act on it. Transparency is advised, including clear notice regarding to whom a report should be made, how it may be reported, and preferably offer multiple options for each. An anonymous reporting system should be an option. While perhaps not ideal in all instances, it may be the only way some people feel comfortable reporting.
To maximize observation and reporting of warning signs, organizations and communities should foster an environment of shared responsibility by:
 Designing a strong violence prevention program
 Developing reporting mechanisms that are easy to understand and use
 Creating organizational policies to structure and implement these concepts to encourage reporting
 Providing training for upstanders, leaders and threat managers to ensure effectiveness
Creating a culture of shared responsibility
Ultimately, a culture of shared responsibility will further the goal of prevention. One thing that sets upstanders apart is that they often feel a positive emotional connection to their environment—to school and staff, to the workplace, or to a larger community. This connection seems to be fostered by a climate of safety and respect, wherein people feel joined with the community or organization and believe that others in that environment know and care for them. For example, in school settings this happens when social and emotional interactions occur daily between students, staff, and teachers. Upstanders are more likely to report their concerns when they believe all information is valued and that
coming forward will not cause harm. Targeted violence offenders sometimes convey vague information about the possibility of an attack, which very reasonably may cause a bystander to be concerned about overreacting. Uncomfortable gut feelings about inappropriate conduct are worth reporting, and someone trained to understand targeted violence can evaluate the information. An upstander may have one small piece of information which in turn is used to complete the larger picture; without it authorities may be unable to accurately assess a situation.
Making a threat versus posing a threat
A threat is an expression of intention to inflict injury or damage17 and is often one of the first ways a person of concern may be identified. Whether it is an actual expression of intent to do harm, a “leakage” of violent thought, or merely an inappropriate statement, it is something that needs further exploration. Threat assessment may begin when a threat is reported, but it does not end there. All threats are not created equal, although they must all be taken seriously and thoroughly evaluated. Content (i.e., the words or deeds used), context (i.e., what happens before, during and after a threat is made) and circumstances (i.e., surrounding facts, such as method of delivery, relationship between threatener and target, or type of target) must all be thoroughly assessed in order to determine what level of concern is appropriate when a threat is made.
A direct threat has been defined as an unambiguous statement to a target or to authorities of intent to do harm. In many circumstances there is little to no correlation between a directly threatening communication and a subsequent act of targeted violence.18 This is most likely to be true when no relationship exists between the threatener and target. Conversely, when a threatener and target do have a relationship, violence becomes more likely to occur. This concept is discussed in detail later in this section.
Whether an individual has actually conveyed a threat should not be a driving factor in the decision to follow through on a report. In fact, for a person who truly intends to do harm, making a direct threat would be quite counterproductive. Doing so naturally causes a logical and predictable chain of events to begin to unfold, including investigation, increased vigilance, and target hardening, each presenting challenges to the would-be offender.
While directly threatening communications should be thoroughly evaluated, a genuine forewarning of violence is often not intended by the threatener. Conversely, a person could pose a very real threat of violence without ever communicating that idea to anyone. Stakeholders should consider the communicated threat, but the focus should be on whether the person poses a threat through the consideration of all information. It is important to understand:
 Some persons who make threats ultimately pose a threat
 Some persons who pose a threat never make threats
 Many persons who make threats do not pose a threat
Postponing action until a person of concern has overtly threatened someone may be a grave mistake. However, if a decision is made to interview or confront a person of concern, he may deny any ill intent and even apologize for causing concern. Denial places threat assessors in a difficult position, particularly where there may be fear of litigation or complaint by the person under scrutiny. Even so, a denial of intent to do harm should not be taken at face value, as it is not proof of benign purpose. Someone truly intending to hurt others will rarely admit it when confronted with his threatening statements or actions. Outright denial, rationalization, or minimization can be tactics to avoid immediate repercussions, to allow him to continue on unfettered, and/or to allow him to enjoy manipulating the situation. Not everyone who engages in menacing and threatening behavior intends harm. However, simply taking a person’s word for it when he has already demonstrated an inability or unwillingness to behave appropriately is unwise. Rather, the denial should be considered a piece of information in the evaluation of the whole case.
Intimacy effect
When both threatener and target are known, particular attention should be paid to their relationship in attempting to assess the appropriate level of concern for violence. Threats become more valuable as pre-incident indicators of violence when the degree of intimacy between a threatener and target increases.20 This is referred to as the intimacy effect. Actual intimates are very close, of course, and therefore it is appropriate to assign a high level of concern to cases of threats, harassment and stalking directed toward an intimate or former intimate. These cases can also have a “spillover” effect at work, school or public places, wherein opportunistically chosen victims are targeted in addition to the desired one. One study found that over 70% of men who murdered their intimate partners explicitly threatened to do so beforehand.21 Other degrees of intimacy exist and should be considered. Work colleagues, students at the same school, and members of the same congregation or community all have degrees of closeness. This relationship allows a threatener to know where a target spends time, what a target’s vulnerabilities might be, and could also provide sufficient emotional investment for a threatener to feel angry or humiliated if his threats fail to provoke the desired behavior. Should a target decide to refuse demands or fail to demonstrate the desired reaction, the threatener may then be faced with a choice: admit his impotence or take action to show the target and possibly the world that he should have been taken seriously. Strangers, particularly those separated by significant distances, have the lowest degree of intimacy and therefore threats made in that context do not automatically generate the same level of concern.
Not all stalking cases will include an act of targeted violence. However, in the broadest definition of the word stalking—hunting for prey—it can be argued that every act of targeted violence involves some aspect of stalking. All stalking behaviors, historical and current, should be considered as part of any threat assessment, regardless of whether the stalking has anything to do with the person of concern’s identified grievance.
A person of concern who has engaged in previous stalking incidents may demonstrate ability to engage in research, planning, and preparation towards a target. The use of those terms—the middle steps on the “pathway to violence”—demonstrate even further the association of stalking with targeted violence. (See pages 24-25, 32-33) Stalkers may also be described as “fixed” and “focused” which are dimensions to be considered when assessing the potential targeted violence offender. The person of concern’s stalking behaviors should be evaluated for recency, frequency, and severity as they may be illustrative of the problematic way he engages with others and/or the unhealthy way he interacts with the world. This information will allow threat management teams to evaluate the individual’s ability to engage in pathway behaviors and how quickly he may navigate the stages. It may be that a person of concern’s previous incidents of stalking were unintentionally a training mechanism for future targeted violence.
A stalking case may be the reason a person of concern is brought to the threat management team. All stalkers should be considered “persons of concern” within the context of this guide. The assessment for violence should be explored in any stalking investigation; utilizing a threat assessment team is an ideal way to accomplish this task. While there is research on the link between stalking and targeted acts of violence, it has yet to be fully understood and all too often incidents of stalking are minimized.
Currently, there is no consistent mechanism amongst jurisdictions to record whether stalking behaviors preceded a homicide. The true association between stalking and other targeted violence warrants further study. It is not a mere coincidence that stalking behaviors have been identified in the timelines of previous targeted attack cases.
The team should be mindful that many stalking cases are unreported, as such the absence of a stalking charge in an individual’s record is not reflective of his potential engagement in this crime. Often in stalking cases, other charges such as trespass or criminal mischief may be used to criminalize the actions of the offender. Obtaining the actual police reports in such cases may reveal the underlying stalking behaviors. Further, the fact that a stalking case may not have risen to a criminal level does not diminish the concern of the stalking behaviors. Such information may be garnered through the interviews of the family, friends and associates of the person of concern. It is of utmost importance to be cognizant of and not dismiss any signs of current and historical stalking conducted by the individual.
Anonymous communicated threats
Many threatening communications are sent anonymously. They may come in the form of notes, emails, bathroom wall scrawls, or other methods. In addition to attempting to assess an appropriate level of concern (See Appendix A) provoked by the communication itself, logical investigation should be conducted when these are received in an effort to identify authorship. When a threat is made, the threat itself should be assessed by considering several variables, including the manner and context in which the threat was conveyed and the apparent relationship between the threatener and the target.
Electronic threats can be a particular concern—the internet age has made it entirely too easy to threaten and harass just about anyone anonymously. Anonymity, whether real or perceived, increases disinhibition and lowers behavioral constraints normally felt during more personal interactions. The perceived absence of monitoring or controls, as well as the ease of finding like-minded virtual friends, can also reinforce bad online behavior (see page 50: Pronoid pseudo-communities).22 Does this necessarily correlate with increased violence risk? Much work remains to be done in the area of electronic threats research. Although data are preliminary, threatening Tweets are not thought to be predictive of a physical approach absent other simultaneous activity or contact toward a target.
However, as with any case, each circumstance warrants individual scrutiny, paying particular attention
 Any noted patterns of escalation
 Intensity of effort and focus observed in a pattern of communications
 Potential leakage of harmful intent (See pages 34-35: Leakage)
 Evidence of a personalized motive by the threatener
 Expressed intention to approach
 Justifications for violence24
Analysis of threatening communications
Several questions may help assess level of concern for violence when a threatening communication is received. These are a few generalities for consideration and not an all-inclusive list of communication assessment questions. Each case is unique and contains numerous variables, all of which cannot be accounted for here.
 What is the relationship or prior contact between threatener and target(s)?
o The degree to which the intimacy effect is applicable should always be considered
 Does the method of delivery indicate physical proximity by the threatener?
o Signs of a possible approach may be more concerning than a long-distance mailing
 How many communications were received, by whom, and over what time frame?
o Increasing intensity of effort (measured by frequency, duration, and different means of communication) may be a sign of escalation
 According to the threatener, when will the threatened action or consequence happen?
o Generally, alerting the target and authorities to a violent plan is counterproductive to success; however, anniversaries and dates which are significant to the author may be reason for concern
o An expression of time running out or a looming deadline may justify increasing concern
 What is the significance of any identified dates or places?
o Certain dates or places may be symbolic of past attacks or upcoming events which have meaning to the threatener
 Is the threatened plan of harm feasible, given what is known about the threatener?
o Highly unrealistic plans may be indicative of an insincere threatener
 What details are known about any grievance or issue identified in the threat?
o Threats involving a personal motivation or justification for violence are generally cause for greater concern than those which merely threaten
First Amendment protected speech
First Amendment protected speech principles are implicated where public communications are concerned; privacy rights, on the other hand, govern the gathering or viewing of private communications or other personal items of relevance in a case. As a threat assessment strategy, monitoring a person of concern’s communications is sometimes recommended; these may include publicly accessible social media or weblog (“blog”) posts, school essays, articles, books, or communications authored by the person. These options, like any other threat assessment option, must be considered in view of legal authorities and protections, including the fundamental right of free expression guaranteed by the First Amendment to the United States Constitution.
The First Amendment protects this right. However, not all forms of expression are protected “speech.” It is important to understand the line between Constitutionally-protected speech, and advocacy of violence or conduct that may lead to violence or other unlawful activity. The First Amendment does not protect, among other things, “true threats,” fighting words, incitement of imminent lawless action, or material support to terror groups. Context, target, and intention are all important to figuring out whether something is an unprotected “true threat” as defined by the US Supreme Court. In a “true threat,” the threatener intends to communicate a serious expression of intent to commit unlawful violence against an individual or group; he need not actually intend to carry out the threat.25 Since the lower courts do not entirely agree on how to apply this definition, in those cases where a threat has been made and a threat assessment team may be recommending prosecution, consultation with the prosecutors is necessary to determine whether the statement in question is protected speech.
In addition to purely First Amendment considerations, governmental agencies must have an authorized purpose for monitoring someone’s speech. One such authorized purpose is trying to determine whether a person is exhibiting behaviors that pose a concern for significant and imminent violence. In cases involving protected speech, for example, where someone has not articulated a threat, the government cannot take an action that destroys, or even significantly diminishes, his ability to communicate a public message or idea through his words or deeds.
In a school setting, conduct on school campuses that either 1) materially disrupts class work, or 2) involves substantial disorder or invasion of the rights of others, does not carry First Amendment protection.26 In a workplace setting, employees are not entitled to unrestricted speech on any topic; they must be speaking about a matter of “public concern” in order to have First Amendment protection. Simply stated, context matters. The First Amendment has limitations, and courts “will consider time, place, manner of expression, and organizational and individual impact” when deciding whether an expression is protected by the First Amendment
Elonis v. United States – Online Threats
In Elonis v. United States, commonly referred to as “the Facebook threats case,” the United States Supreme Court examined the “guilty mind” necessary for a conviction under federal law for communicating threats in interstate commerce. Mr. Elonis posted a number of disturbing statements on his Facebook account, stating a desire to kill his estranged wife, a kindergarten class, and law enforcement officials who investigated his threatening behaviors. His statements were often specific and brutally violent. Mr. Elonis maintained that he did not mean to threaten anyone; rather, he meant to engage in artistic expression as a rapper. The case was originally expected to be decided on First Amendment grounds. However, rather than focusing on free speech the Supreme Court reversed his conviction on a technicality. News of the reversal nevertheless created a degree of false fear that internet threat cases would be difficult to successfully prosecute.
When considering prosecution of online threats in light of Elonis, law enforcement is encouraged to collect and memorialize, during data collection and interviews, any evidence that tends to prove a person of concern who transmitted a threatening message did so for the purpose of issuing a threat or with knowledge that the communication will be viewed as a threat. If a threatener alleges he intended only sarcasm or humor, investigators should be on the lookout for evidence
that contradicts this allegation. Any circumstantial evidence that counters a threatener’s position that his threats were just “artistic expression” may also be helpful. As a final note, in those cases where law enforcement officials admonish a person of concern who makes an online threat, they should carefully document the admonishment and the threatener’s responses, demeanor, and behavior.
Chapter 3 Assessment: Analysis for Guiding Management
Targeted violence threat assessment is complex. High level of violence concern almost invariably results from many factors, only some of which may be plainly visible to a threat assessment team. There will be unknown details in every case. This is a primary reason why threat assessment is a nuanced and complex discipline. A great deal of time and study is required to develop proficiency in threat assessment. As human behavior is variable in nature, thoughtful consideration of many facts and circumstances is required to conduct a thorough assessment.
There are no “usual suspects”
There is no demographic profile of a targeted violence offender. Objective assessment of threat enhancing and mitigating circumstances is the key to evaluating concern for violence. Any individual, no matter what age, sex, race, religion, education or income level, marital status, or occupation, has the potential to engage in targeted violence. The first step in preventing future violence is identifying and evaluating a person’s behaviors. No single behavior is predictive of targeted violence; rather, a “perfect storm” sometimes develops based on a multitude of factors and conditions. When conducting an assessment, the facts and circumstances identified in this chapter must each be examined while focusing on the person of concern, the potential target(s), the situation, and the setting. Threat assessment is a multifaceted process, stemming from a holistic analysis of the pattern of behaviors displayed by a person of concern.
Data interpretation and weighting
A checklist approach to assessment can work to ensure relevant topics are considered, but not for deciding how much weight to place upon each fact and circumstance. Assessment of each fact and circumstance must be uniquely weighted based upon:
 What makes up the whole person, including his behaviors and characteristics
 Any direction of interest in persons, places, or issues demonstrated by the person of concern
 The situation including a grievance, environmental and contextual factors, or recent or anticipated losses
 The setting including organizational culture and the physical setting29
Totality of circumstances versus singular points of assessment will drive the ultimate level of concern held by a threat management team. Human judgment applied to each factor on a case-by-case basis is the only endorsed method of violence threat assessment.
"Analysis at a glance" is a threat assessment hazard. Unintended bias by assessors must be understood and avoided. There are several types, each posing its own unique challenge. The BAU suggests that threat management teams adopt an evidence-based, structured approach to its work, rather than a biased approach.
The tendency to look for evidence or interpret information in a way that confirms a preconceived opinion is confirmation bias. Human nature is often such that it is easier to notice facts that support already held beliefs and overlook facts that do not. Further, this bias can also cause one to give greater weight to such information because of the tendency to accept it at face value without scrutiny. Even worse, people are usually better able to remember such information. For example, a preconceived belief is "I know John is going to end up shooting up this place because he has been angry for a long time." To support this opinion, one might then only collect examples of when John’s anger has attracted attention—while ignoring examples of his positive behaviors.
Availability bias is a tendency to assign the most importance to behavior which comes immediately to mind—if it can be recalled quickly then it must be important, or at least more important than other information which is not as readily recalled. This presents a risk that the most recent information will outweigh older information simply based upon its recency rather than on its importance. The takeaway for threat managers? Take care to evaluate behavior over time when possible; then it will likely become clearer if the person of concern is escalating, de-escalating, or holding steady.
"Hindsight is 20/20." This statement is never truer than when discussing the predictability of violent attacks. Hindsight bias is the inclination, after an event, to see it as having been more predictable than it was. A tendency to blame based upon an erroneous belief that something was predictable can potentially affect threat managers, such as when a particular threat management technique is not successful. For example, if mental health counseling is recommended but fails to deescalate a person of concern’s behavior, those critical of the threat management process may blame the team for making an incorrect recommendation because the person of concern reacted negatively to a suggestion he attend counseling. Hindsight bias facilitates a potentially erroneous argument that the team should have predicted that counseling would fail, when in reality there would have been no way to know that before implementation.
Hindsight bias can affect threat assessment and management by inducing foresight bias, which emphasizes an unrealistic ability to predict future events. This kind of bias could cause stakeholders or threat managers to erroneously apply outcomes in previous cases to the current one, even when the fact patterns are dissimilar. For example, one assailant posted what he called a “manifesto” online before offending against a camp of juveniles. Foresight bias might cause observers to conclude that
every troubled person who posts a manifesto is about to engage in violence. Psychologists, in particular, have faced the challenge of being asked to predict who will become a violent offender from among the overwhelming majority of non-violent mentally ill; even with the best available instruments general violence prediction is only moderately accurate.
Biases can occur or become more pronounced when fatigue or complacency become an issue. These problems can affect threat managers and stakeholders during a long term, repetitive, or unusually intense case. In those situations, threat management teams should remember that facts and circumstances can quickly change a case and the level of concern for violence it generates. Thus, teams should consider how best to mitigate fatigue or inadvertent complacency. Team structure itself may assist in reducing fatigue because the weight of a case, or all cases, does not rest on one person alone. Teams must also be on guard against complacency by remaining focused on the task at hand and maintaining a positive mental outlook.
Triage versus 360° assessment
A primary purpose of an assessment is to inform decision-making regarding how, and how quickly, to best manage a person of concern away from violence. An assessment is only as good as the information upon which it is formulated. The quantity and quality of information collected will likely dictate the assessment's degree of accuracy and utility. In addition to addressing concerns about public safety, stakeholders should also strive to promote a person of concern’s well-being. Optimally, threat managers would like to obtain as much relevant information as possible about the person of concern and the events occurring in his life, in order to devise the most appropriate management strategy. This is referred to as a whole person or 360° assessment. It typically requires an abundance of investigative effort and time. However, in instances where the information on the person of concern is unknown or unavailable and time is of the essence, the threat assessment can and should function more like a triage process. Relying on limited information which likely reveals behaviors over a short time, a triage assessment is used to determine case prioritization and resource allocation, and can include a preliminary level of concern and any immediately necessary management strategies. The use of triage assessments is vital, especially when multiple cases arise simultaneously, similar to emergency medical professionals assessing patients based on their urgency of need for care. Whole person assessment and triage share the same goal: to maximize threat mitigation and ultimately prevent violence.
Having a sense of urgency and knowing when to apply it are important skills for threat managers. Distinction must be made between cases requiring an emergent response, and those which do not. This will involve being able to determine whether a particular case justifies a low level of concern for targeted violence risk, a high level of concern, or somewhere in between. A system in use at the BAU, and elsewhere, for delineating between levels of concern (See Appendix A) was inspired by the National Weather Service (NWS) system of [1] no message, [2] watch, or [3] warn.30 Example: the NWS remains silent on the topic of tornadoes on any given day for which the chance of one is not measurably above the base rate. The NWS issues a tornado watch when the conditions are right for the formation of such an event, making it possible. It does not mean one will occur. It issues a warning when a tornado has been sighted or is imminent. For assessing violence concern, the BAU adopts a similar posture, one which takes into account the appropriate level of concern for [a] violence potential, and [b] how imminent that violence may be, based upon an application of published research and the unit’s experience with case facts and circumstances. A concern level does not predict violence likelihood but rather expresses the extent to which conditions may facilitate violence potential.
Standardization of processes from intake through assessment is strongly recommended; case management will be unique in each instance. This chapter identifies those elements which should be considered in assessing a case for violence concern and imminence. These include enhancers (risk factors, warning behaviors, stressors and precipitating events, and indicators of potential imminence) and mitigators. Every case is unique and will feature varying numbers of these elements; a checklist- based or quantitative formulaic method for assessing a case is not endorsed. A case may have an overwhelming number of threat mitigators, for example, and only three enhancing factors. However, if those enhancers are firearms access, substance abuse, and a persecutory delusional belief system, those three may very well overwhelm any number of mitigators. Conversely, a single mitigator (e.g., convalescing due to a serious physical illness) could dramatically reduce violence concern even in the face of a slew of enhancers. This is where a trained and experienced team, following a standardized assessment protocol, becomes an effective tool for managing persons of concern away from targeted violence.
Pathway to violence
It is generally believed that persons intending to engage in targeted violent acts move along an identifiable pathway on their journey to attack.31 The progression may be rapid or slow, and will not follow the same course from person to person. Some scholars have proposed pathway-like maps, while others have identified key indicators of high or imminent risk. Recently, the pathway concept was proposed as merely one of eight warning behaviors. Pathways can exist in multiple and complex forms, or may not exist at all in some cases.32 Regardless of which model is adopted for use, threat managers will find that both state of mind and outward behaviors of the person of concern are inextricably intertwined—behavior is a manifestation of thought. For the purposes of this practical guide, the well- known pathway to violence model which crystallized over the past twenty years and is relatively easy to understand, is presented. Further discussion later in this chapter will place this pathway within a larger constellation of warning behaviors.
The traditionally known pathway to violence model is an excellent place to begin the discussion because it addresses the question of “why?” It describes a first step on the journey toward intended violence as the formation of a deeply held personal grievance or humiliation based upon real or imagined injustices inflicted upon the grievant. This grievance could be against an individual, an institution, or other entity the person of concern feels slighted or wronged him. It may be nurtured and cultivated over time, even years. Depending upon the particular individual, it may be plainly evident to all around him or kept hidden and private. Although there are cases of targeted violence in which a grievance or motivation was never identified, this appears to be rare with regard to the kind of mass targeted violence attacks this guide addresses. Regardless of whether a specific grievance exists or can be pinpointed, only a few general motives for mass targeted violence offending appear to be prevalent in the experience of the BAU. They include:
 Revenge for a perceived injury or grievance
 Quest for justice (as defined by the offender)
 Desire for notoriety or recognition
 Desire to solve a problem perceived to be unbearable
 Desire to kill or be killed
When a person of concern for targeted violence is unable to resolve the negative emotional burden of unachieved justice, he could then progress to a violent ideation: the idea that violence is an acceptable, or even the only, means of achieving redress.33 Unable to shake off a grievance and its accompanying anger, despair, humiliation, or other negative emotional responses, the person of concern may eventually conclude that violence is justified, necessary, and his only choice. The adoption of this idea can be profoundly relieving, almost like a salve on a wound. It is for this reason that a sudden turnaround by a formerly angry, depressed, or menacing person of concern should not be presumed as good news. More assessment is often prudent.
Additional steps along the pathway are discussed in greater detail on pages 32-33. They involve both emotional and logistical considerations important for planning and carrying out an act of planned violence. They include research and planning, preparation, probing and/or breach of security measures, and the attack itself. A key factor to remember when recognizing that someone is on an apparent pathway to violence, is that time is on his side. Completing the steps from grievance to attack may take weeks, months, or even years. Someone may appear stalled along the way; he may even retreat a step or two. Conversely, the entire route may be covered relatively quickly or steps may not be observable to a threat assessment team. The following graphic illustrates, in very simplistic terms, one of several pathways to planned violence models; it may be useful in visualizing the concepts discussed in this
The role played by mental illness
A general stereotype exists that people who suffer from a mental illness may be dangerous. There is a small but significant relationship between serious mental illness, such as psychosis, and risk of violence toward others. However, misinformation and/or lack of knowledge or exposure to the mentally ill may grossly exaggerate this fact. Certainly, the unpredictable behaviors associated with some forms of mental illness can provoke concern. However, many times it is just the fear of the unknown associated with mental illness that makes people uncomfortable.
In the immediate aftermath of a targeted violence event, an inference may be made that the reason an incident occurred is the offender was mentally ill. While serious mental illness is substantially present in targeted violence offenders,35 it does not necessarily follow that such illness is the driving force behind the decision to offend. Assessing violence potential is more complex and dynamic than simply determining whether or not someone has a mental disorder. Many factors, including some which may be interrelated, play a role in an offender’s decision to plan and take violent action; these are discussed in this chapter. People with serious mental illness may have particular vulnerability to other variables which increase risk, such as past violence/childhood exposure to violence, personality disorders, substance abuse or dependence, and numerous environmental stressors.36 When considering serious mental illness, threat managers should assign a logical level of significance to it, based upon the nature of observed symptoms and behaviors.
From a threat assessment perspective, different types of mental illness-driven behaviors may inhibit or enhance violence concern and/or implicate different management strategies. There is a difference between someone who is so mentally disturbed that he cannot organize himself enough to plan and carry out a violent attack, and a functional person with a mental disorder that permits predatory thinking and violent planning, as well as an ability and commitment to follow through.
Threat managers should direct their attention to psychiatric symptoms and associated behaviors, rather than formal diagnoses, for purposes of assessing violence concern. Symptoms of mental disorder can be debilitating for the individual in question and alter his perception of others’ interactions and activities. For example, if he is struggling with paranoid beliefs that others are out to get him and he feels threatened or endangered by contact with others, he could potentially feel justified in using violent means to defend himself.
A personality disorder, on the other hand, is not the same sort of disorder as a serious mental illness. It is an enduring, pervasive, and inflexible pattern of internal experience and behavior which is not in harmony with cultural expectations. Personality disorders typically onset in adolescence or early adulthood, and are stable over time. They feature certain attitudes, behaviors and thought patterns that are maladaptive. As a result, a personality-disordered individual may be able to conclude that violence is an acceptable or even necessary response to a problem.38 Because he is not, however, disengaged from reality, he is capable of engaging in logistical and rational processes necessary to violently offend. Any observed behavior that demonstrates the person of concern’s thoughts, thinking, planning, and organization is important to consider for understanding his trajectory towards violence, if any. Once these are understood, work can begin on managing behaviors and ultimately lowering violence concern.
Forensic Mental Health Assessment/Violence Risk Assessment
A foundation of mental health treatment is the relationship that develops between the patient and his therapist. This therapeutic alliance is essential for the treatment process to work. The theory behind the trust-based therapeutic alliance is that a client seeks treatment from a mental health professional because he genuinely wants to be helped. What this fails to take into account is that someone truly considering engaging in an act of targeted violence must conceal that intention in order to ensure success. This can be difficult for providers inexperienced in such cases to accept. The violence risk assessment process assists in removing subjectivity from the equation.
When mental health professionals attempt to assess an individual’s potential danger to himself or others, they may use unstructured, clinical judgment as they interview the person about his history and current mental state. This falls short of a “violence risk assessment,” (VRA) ideally performed by forensically trained mental health professionals and which entails a much more systematic, structured, and thorough evaluation of the individual. For example, most clinicians base their suicide risk/homicide risk assessments on a patient’s self-report rather than conducting a multi-faceted VRA. An objective VRA involves asking additional questions of the patient which are predetermined and required by the tool being used, as well as gathering collateral information by interviewing family members, reviewing police reports, and conducting psychological testing. This evaluation process may interfere with trust and rapport-building and thus is not emphasized in general mental health provider training. However, unstructured clinical assessments are susceptible to the deceptions and poor insight of the patient. Mental health providers have not been very successful at violence prediction, which explains why forensic psychologists moved away from unstructured clinical assessments to more actuarial or structured assessment approaches to assess risk for violence. Forensic mental health professionals receive much more training on violence risk assessment than other providers.
Although pursuing a formal mental health diagnosis can be a distraction during the assessment process, diagnostic certainty is more useful during the management phase. Diagnosis by a qualified, licensed mental health professional can be a bridge to strategies for interacting with the individual, treatment if feasible, and an effective threat management plan overall. Mental health intervention should not be considered a standalone solution. Rather, it can and should be part of a comprehensive strategy when mental illness is an aspect of the case. Some persons of concern will be resistant or unreceptive to mental health treatment for various reasons. Even though they may not always be able to communicate back to a threat management team, mental health partners are good resources when psychiatric symptoms and behaviors are present. Evaluation and diagnosis can create additional opportunities for intervention and mitigation of any threat generated by the person of concern.
In this guide only a few of the many issues threat managers and stakeholders may encounter with regard to mental illness have been identified. It is important to think about what approach and interaction methods will be used during encounters with persons of concern who suffer from mental disorders or disturbances. The BAU recommends consultation with qualified, licensed mental health professionals for advice during such instances. Additionally, written resources about interacting with the mentally ill are available which may also provide assistance (see Appendix F, References).
The “person of concern”
As previously noted, a holistic view of a person of concern is needed in order to conduct a viable threat assessment and create a management plan. However, some individual qualities below may be of particular interest in conducting a threat assessment. They include but are not limited to:
 Strength of coping mechanisms (i.e., healthy conflict resolution, processing emotional stress, or tolerance for change)
 Negative traits (i.e., desperation, maladjustment, low trust, impulsivity, inattention, irrational
thinking, low empathy)
 Attitude about self (i.e., narcissistic/entitled, injustice collector, positive self-esteem, future- oriented)
 Need for attention, recognition, or notoriety
 Response to rules and authority
 Preoccupation with violence
 Deceptiveness and manipulation
 Motivation
Brittle people
The pathway to violence discussed above identifies a potentially observable path along which a person of concern may travel on the way to engaging in a violent attack. Although not every targeted violence event has its origins in a personal grievance, it is a common starting point. Clearly, however, most aggrieved persons do not go on to research, plan, prepare for and execute a targeted violence event. So who are those individuals most at risk for targeted violence? They are exceptionally brittle,40 unable to withstand slights, rejections, or offenses both minor and otherwise. Time and again, targeted violence offenders have claimed to be persecuted and alienated from their peers, family, and the world at large, viewing themselves as outsiders and not part of a larger social network. They seem unable to process the slights, rejections, teasing, and bullying that everyone experiences at some point in their lives. Most people learn to deal with these experiences as a normal, if unfortunate, part of life. Well- adjusted people develop emotional armor and learn to stand up to, ignore, or just ride out such behavior. To a brittle person lacking adequate resources to help him appropriately process and cope, even a minor loss can be absolutely devastating. Brittle targeted violence offenders, moreover, cannot seem to muster a healthy response. They continue to brood and obsess over every injustice, whether real or imagined, that has ever been inflicted upon them. Suicidal feelings are not uncommon. However, it is important to recognize that brittle people who are suicidal can also become homicidal toward others.
Conducting the assessment
In the next few subsections, threat enhancing and threat mitigating factors will be identified and explained, although the individuality of each human being, and therefore each case, prevents this from being considered an exhaustive list. In fact, there may be no such thing. Rather, this information (like the rest of this guide) should be considered as a general reference to get a threat assessment team started in conducting an assessment. With experience will come the expertise to identify additional enhancers and mitigators and evaluate how they fit into an overall case assessment. It is impossible to absolutely quantify the weight of each individual factor. Each case is a unique combination of personal and environmental factors which preclude assigning all relevant factors equal weight. The urge to quantify and calculate an assessment like a math problem must be resisted. Threat assessment envisions a holistic assessment of the person of concern, the potential target, the situation, and the potential setting for an incident.
Threat enhancers
Risk factors
Risk factors are existing realities about the person of concern that may increase the risk of violence he poses in a given situation. They are already in place at the time of assessment. Risk factors, as opposed to the behaviors a person may demonstrate (discussed later), can either be static or dynamic. Static risk factors are historical or dispositional, will not change over time or will change very slowly, and are not amenable to intervention (e.g., gender, history of prior violent acts). Dynamic risk factors are situational or clinical, and can and do change, often rapidly (e.g., weapons possession, illegal drug abuse). Some risk factors are highly interrelated with behaviors (e.g., current access to a gun (risk factor) and actively attempting to acquire more guns (behavior)).
Violence History
 History of violence: The best predictor of future violence in many cases is past violence. Past violence might not be indicated in a criminal history report, so it is important to cover this in interviews, social media reviews, personnel file reviews, or other available sources.
 Childhood exposure to violence: Violence in a person of concern’s family of origin or adolescent peer group has also been identified as a risk factor for adult violence.
Health/Mental Health
 Substance abuse or dependence: Psychostimulants are a concern, and are encountered as both illicit and prescription drugs; they can increase the fight or flight response, and more importantly for targeted violence assessment, they can cause grandiosity and/or paranoia in some.41 Generally, prescription medication side effects are variable and can sometimes include violent ideation and altered thought processing. Alcohol lowers serotonin levels in the brain, potentially leading to irritability and aggression.42 The use of non-prescription substances could be evidence of self-medication for a diagnosed or undiagnosed issue. However, there is evidence that drug and alcohol abuse is significantly lower among those engaged in targeted violence than those engaged in impulsive/reactive violence.
 Personality disturbance or disorder: Paranoia, narcissism, borderline personality, psychopathic or significant antisocial tendencies, or significant and sustained anger manifestations, can all increase risk of targeted violence and should be taken seriously. They can cause a person of concern to believe violence is justified and acceptable. Facets may include but are not limited to low empathy for others, abdication of personal responsibility, habitual projection of blame onto others, persistent belief that others are malevolent, or chronic belief in one’s own superiority over others. If personality disturbance or disorder appears to be a factor in a threat assessment case, a qualified mental health professional should be consulted to help a team understand how it may impact violence concern and potential management strategies.
 Severe mental illness: As previously noted, severe mental illness slightly increases the risk of general violence toward others. Psychosis, in particular, can raise concerns depending upon the nature of the symptoms; however, psychosis alone is neither necessary nor sufficient to assign a high level of concern. Its importance as a risk factor should be connected to how logically linked the symptoms are to future violence. Major depression, bipolar disorder, schizophrenia or other psychotic disorders can all feature psychotic symptoms which may elevate risk. Symptoms of special concern include command hallucinations, delusional beliefs of persecution or control, hostility, and grandiosity.44 When these symptoms co-occur with additional risk factors, particularly substance abuse or dependence, or a confirmed history of violent acts and/or childhood exposure to violence, the concern may increase.
 History of suicidality: If a person of concern has threatened or attempted suicide in the past, this should trouble threat managers. Suicidal and homicidal violence are more closely linked than many realize. Evidence of suicidal thoughts is reflective of lost hope, and it may be accompanied by acceptance of the consequences for behaving violently toward others. Suicide is often contemplated by targeted violence offenders before they decide to attack; instead, they choose to punish those they feel drove them to their plight.45 In a study of 160 active shooter incidents in the United States between 2000 and 2013, in 64 incidents (40%), the offender committed suicide.
 Organized: If a person of concern has a demonstrated ability to organize behavior, regardless of any superficial appearance of illogical or incoherent speech or personal presentation, then he is potentially able to plan and carry out an act of violence.
 Firearms and edged weapons: It is easier and more lethal to engage in targeted violence, particularly toward multiple targets, with a firearm. Possession of, access to, experience or familiarity with weapons are all risk factors because they improve one’s ability to carry out the act. Unfortunately, this can be difficult to determine in many cases. Edged weapons and stabbing instruments have been successfully used in attacks as well; they are often more accessible than firearms.
 Explosives: Fascination or experimentation with improvised explosive devices (IEDs) is a risk factor. They, too, increase ability to do harm and may also indicate study of past targeted violence incidents where IEDs were used or their use was attempted.
Problematic Behavioral History
 History of stalking, harassing, threatening, or menacing behavior: This spectrum of behavior may indicate low empathy, general disregard for rules and limits, or defiance of authority. These behaviors could also represent attempts to or actual breaches of security. If demonstrated as a pattern, it may also indicate the person has become habituated to engaging the world in an aggressive manner, potentially lowering inhibitions about escalating to violence. This is particularly relevant in the majority of mass murders which began with a spousal or family homicide. Several known targeted violence offenders engaged in stalking behavior before they engaged in mass violence.
 History of non-compliance with limits and boundaries: Violations of protective orders or terms of probation, flouting of private property lines (in furtherance of harassing activities, for example), and disregard for rules at school or work, all fall within this category of behavior. Such a history may bode poorly for a threat management strategy that is based on limit-setting, because the person of concern may not be willing to comply with limits.
 Negative family dynamics and support system: An unhealthy family or social peer environment can enhance risk. If there is tacit or active endorsement of violence within the home or family sphere, this can affect how the person of concern views violence. Similarly, if law-breaking or other negative tendencies are the norm in a person’s family sphere or social environment, it can influence behavior in negative ways. A toxic family or social peer dynamic could even fuel a person of concern to act. Irresponsible and chaotic families can also contribute to casual access to firearms in the home.
 Isolation: Living in physical or emotional isolation from others, particularly from family and friends, deprives the person of concern of emotional support often needed to work through life’s difficulties and challenges. The person has no one to rely upon. This can occur even when the person of concern shares a home with family members.
 Instability: Financial, residential, professional, familial and/or social instability all potentially interfere with the person of concern’s ability to become and remain grounded and to feel emotionally safe and secure. Instability in these spheres of life can lead to grievance formation, serve as stressors, and erode coping mechanisms.
 Others are concerned: When behaviors exhibited by the person of concern cause fear in others, stakeholders should take notice. After all, individuals close to the person of concern are often best positioned to observe alarming behaviors. They may not be able to precisely articulate all of the behaviors which concern them; they just know they are troubled.
Warning behaviors
Unlike risk factors, warning behaviors are dynamic and represent changes in patterns of behavior that may be evidence of increasing or accelerating risk.47 When warning behaviors are evident, they require a threat management strategy and operational response. They are, for the most part, proximal behaviors, occurring more closely in time to a potential act of targeted violence.
The body of knowledge about warning behaviors is based upon research of and experience with attackers and assassins of celebrities, politicians, and other public figures; psychiatric patients who have engaged in violence; adolescent mass murderers and school shooters; adult mass murderers; spousal homicide perpetrators; workplace violence offenders; and federal judicial threateners and attackers. For each “successful” targeted violence offender with any given behavioral past, there are likely many more who exhibited similar behaviors, but never attacked. Warning behaviors cannot predict targeted violence, but are useful in identifying accelerating risk which should elevate another or how many mitigators will outweigh a particularly troubling enhancer. This is why threat managers work best in teams. The consultative process allows for discussion and consensus.
Ultimately, a team will arrive at a conclusion on a level of concern and will recommend management strategies based upon the particulars of the case.