What Warning Signs Look Like and Where They Have Come From

The following figure summarizes top warning signs to report. In our analysis, we found that warning signs tend to exist in combination, meaning that there are signs that a person wants to attack (i.e., signs of motivation) and is taking actions to carry out an attack (i.e., signs of preparation).

Motivation (serious intent to attack) plus Preparation (concrete actions for attack) equals Warning (intent and actions).

Examples of motivation are	Examples of preparation are
claims that they are inspired by past attacks claims that they will fulfill an extremist cause (especially if they were kicked out of a group for being too violent) claims that *someone is (or others are) so harmful or threatening that they have no choice* but to attack**	written plans for an attack attempts to recruit others attempts to learn how to kill many people (in person or online) coordination with known violent extremists seeking arsenals of weapons & ammunition (without a benign reason, such as hunting) travel for training or to the target site probing or breaching

Discussion: Where the Warning Signs and Sources Come From

The following figure summarizes how the foiled plots in our data set were initially brought to the attention of authorities.

This figure includes cases in which a report was brought to authorities, but the attack was executed anyway.

Literature Used to Help Identify the Warning Signs Above, Along with Case Analysis

Indicator	Source
Seeking arsenals under threatening circumstances	Blair, Sandel, and Martaindale, 2020
Inspired by prior mass attacks to be famous Planning related to mass killing Leakage of interest or plans for mass killing	Lankford and Silver, 2020
Inspired to fulfill extremist cause, especially if they were kicked out of a group for being too violent Attempting to recruit others to the plot Coordinating with violent extremists	Clemmow et al., 2020
Belief that someone is so harmful that they have no choice but to attack	Knoll and Meloy, 2014
Travel to, or engagement in, paramilitary training for an extremist cause Site probing or breaching	Strom et al., 2011

More Examples and Discussion of Warning Signs, Including Information on What Does Not Constitute a Warning Sign

A typical example of an individual exhibiting warning signs is when they make a threat to kill many people and display the gun they plan to use, although details may vary, as follows:

The threat might be made in person or online.
The threat might be a direct threat or, more frequently, might be leaked to others (family, friends, fellow students, coworkers, online communities, etc.).
The display might be planning to get firearms, showing off firearms training, or displaying a gun.

Strong signs of motivation or action can be worth reporting by themselves. For example, amassing an arsenal under suspicious conditions is worth reporting, even without being told of a specific motive to kill. When in doubt, call it out.

Actions related to gaining capabilities to kill—such as trying to learn to kill more effectively or amassing the arsenal to do so—are of special concern because bringing more-lethal skills and weapons to attacks is unsurprisingly related to significantly higher casualties.

Account for the local context in determining what could "reasonably" reflect intent or actions toward a mass attack. For example, an arsenal is not inherently suspicious if it is used for hunting, sporting, or collecting; in those circumstances, it is typical to have a variety of weapons, similar to how golf is played with more than one club.

Our warning signs do not include mental health symptoms or other general behavioral or demographic profile information. The key warning signs are about desiring to kill or harm or conducting activities along that path. General profile indicators have a role in subsequent threat assessment, but they are too generic—applying to many millions of Americans—to be highly indicative themselves.

Next Page in the Prevent Phase

Initial Detection - Findings on Reporting