Threat Assessment: Finding and Putting Together the Puzzle Pieces
The initial warning is one piece of the puzzle. By conducting a threat assessment, organizations try to find the other pieces of the puzzle to determine the level of concern, what additional information is needed, and what to do next. In this toolkit, follow-up actions (mitigations) and reassessments are addressed in the Follow-Up section. In this section, we cover initial warning follow-up and both general and formal threat assessment processes to determine what to do as a result of that warning.
- Behavior Threat Assessment Model and Team: The collaborative prevention teams need to adopt a threat assessment model that works with a team of government and community partners to look at the entirety of information about a person's life and make a judgment of the level of concern, what additional information is needed, and what to do next.
- Information Collection: Fill in the Gaps: Prevention teams should look for the gaps in information to complete the full picture for an accurate assessment.
- Information Collection: Do Not Leave Information in the Field: Check with team members to ensure that all key pieces of information known by someone involved in a case are provided to the assessment team.
Each jurisdiction, school system, and major community and private organization needs a standing team to establish relationships and conduct training in addressing cases. This team may be shared across organizations and can meet on varying timelines depending on size and demand. The figure below shows the key elements of a threat assessment model and team, including:
- team members representing different communities and types of expertise within the organization, and, ideally, representatives from other agencies who directly support the organization regularly
- There are many different services involved in a threat assessment team and follow-up support. Although each partner will play a critical role in the team's success, one agency needs to be appointed as the lead to maintain responsibility. The responsible agency ensures that all aspects of the mitigation and information collection plans are executed. A support agency may fulfill this role if there is not an immediate criminal concern, or law enforcement may take the lead if there is a criminal or high-threat element.
- an assessment model that includes a set of core indicators and risk factors, information collection forms, and documented next steps in a mitigation plan. The plan needs to identify one overall responsible partner and POC for monitoring the subject and ensuring that actions are carried out. We describe major exacerbating and mitigating factors for threat assessment below. The resources section includes example threat assessment models and guidance.
- The Virginia Department of Criminal Justice Services' Portal on Threat Assessment, although it is focused on school threat assessment, includes model data collection, assessment, and follow-up planning and review forms that could be adapted outside education (Virginia Department of Criminal Justice Services, undated).
- a threat assessment process, which includes a specific schedule for when evaluations and reevaluations will occur and what major events or discoveries will trigger reevaluations or emergency interdictions (for extreme-threat discoveries). The process also needs to include procedures for changing the responsible partner as circumstances dictate (e.g., a need to move from law enforcement investigations to providing health services, or vice versa). Assessment processes will include both field contacts with subjects and their associates to gather information and multidisciplinary teams making decisions about what to do next. The nature of the field contacts will depend on the type of threat: whether this is a potential school shooting (which will involve a school assessment team), a potential workplace shooting (which will involve the relevant workplace security team), or a plot reported from the general public to the police (which will involve service providers)
- relationships with a higher-level multiagency threat assessment team at the metropolitan, regional, and/or state level, which includes the relevant local law enforcement, schools, mental health providers, social services, and community organizations. This higher-level team will also include links to federal partners and resources.
- Most local organizations will not have the capacity or resources to support a threat assessment team that has substantial expertise in assessing and addressing potential violence, much less in navigating all local, state, and federal agency partners that may be needed, especially for more-serious situations. This is why having relationships with higher-level teams that can provide guidance and support as needed is important.
Threat Assessment Model
Essential knowledge required to execute a prevention plan
- Indicators
- Information collection plan (fill in the gaps)
- Mitigation plan
- Assign a responsible partner
Always ready to interdict if imminent threat
Threat assessment team
A team comprising members of your local internal prevention team and agency partnerships
- Local and federal law enforcement
- Fusion centers
- Schools
- Mental health organizations
- Social services
- Community organizations
Threat assessment process
A guide to help the threat assessment team implement the prevention model
- Recurring schedule
- Emergency
- Status change or trigger event to change the responsible partner
Information Collection: Fill in the Gaps. Look for the gaps in information to complete the full picture for an accurate behavior threat assessment. The following figure shows example components needed to fully assess risk and determine next steps. These components are interviewing the subject and their close connections, querying relevant databases, and working with government and community partners both to see whether they have relevant information about the subject and to determine what steps to take next.
Databases
- Federal
- Statye
- Local
- Regional
- In-agency
- Partner
- Private
Partners
- Law enforcement
- Public safety
- Judicial and drug courts
- Schools
- Social services
- Private sector and private security
- Social media and communications companies
- Religious institutions
Close Connections and Interviews
- Family
- Friends
- Former relations
- Co-workers and supervisors
- Teachers
- Fellow students
- Caregivers
- Neighbors
Information Collection: Do Not Leave Information in the Field. Information is considered "left in the field" when it is known by someone but does not make its way into an assessment team's consideration. An assessment team member might see only a small part of a picture, without knowing that there could be a larger issue or that someone has the piece of information that makes a difference in prevention. Multiple-agency and organization-specific threat assessment teams are so valuable because they can facilitate information requests and coordination on specific cases, which reduces the likelihood of information being left in the field.
Critically, threat assessment is not just about assessing the likelihood that a subject will carry out an attack; it is about determining the right next steps to take with the subject. In our expert interviews, it was clear that the majority of reports were handled outside the criminal justice system. Typical responses were either watchful waiting or referring the subjects to specific services (and ensuring that those services were used). These steps are discussed in the Follow Up section.
Major Threat-Increasing and -Mitigating Factors. The following table captures top findings on both threat-increasing and -mitigating factors from our literature review, case review, and interviews with subject-matter experts. High-threat factors are those that, when discovered, indicate that an attack might be imminent. These warrant an immediate review and possible criminal interdiction, depending on the extent of the evidence. High-threat factors are mostly finding more evidence along the lines of the Warning Signs: clear intentions or actions toward an attack. Greater-threat factors are those that indicate that a subject is more likely to engage in violence according to their history, which requires more-intense follow-up efforts. Threat reducers are factors that, if found, imply that the subject is less likely to engage in violence and may be a good candidate for lesser follow-up actions, such as watchful waiting. Lining up support services to mitigate the potential threat likely is most suitable for cases in which high-threat factors (i.e., warning signs) are not present.
| High Threat (i.e., attack may be imminent) | Greater Threat | Threat Reducers | |
|---|---|---|---|
| Motive-related | Discovery of motivation warning signs during assessment or investigation |
|
|
| Prep-related | Discovery of preparation warning signs during assessment or investigation |
|
|
a Suicidality, domestic violence, other threats and violence, and seeking weapons illegally need to be addressed independently.
Literature Used to Identify These Risk Factors, in Addition to Case Analysis
| Factor | Source |
|---|---|
| Suicidality indicators | Duwe, 2020 |
| Domestic violence | Geller, Booty, and Crifasi, 2021 |
| Joined an extremist group, desires to hurt others, and prior acts of violence | Clemmow et al., 2020 |
| Recent humiliating event and concerns about violent or radicalizing media usage | Gibson et al., 2020 |
| Seeking weapons stockpile or access to a weapons stockpile | Blair, Sandel, and Martaindale, 2020 |
| Current student, no criminal history, or no familiarity with guns | Silva, 2021 |
The greater-threat factors are meant to be just that—their presence is associated with a higher likelihood of a plot. They are not meant to be directly indicative of a plot themselves.
A special note on suicidality. Caution should be taken with indicators of suicidality and serious mental health indicators. The majority of those who are suicidal are not would-be mass attackers. That said, suicidality is a significant risk factor (e.g., Duwe, 2020) and warrants special attention, because preventing suicide is critical in its own right.
Reports of domestic violence, reports of actual violence, or credible threats of violence are also significant risk factors for mass violence, although, like suicidality, they are not indicative in the same way that the Warning Signs are. Like suicidality, they are critical to address in their own right. When investigating these reports, law enforcement should not presume that suspects will commit mass violence, but they should be vigilant for evidence of mass attack plots. More than two dozen plots have been foiled as part of investigating crimes and criminally suspicious activity. These are also important cases for identifying whether there are weapons present that have the potential to increase the seriousness of the harm.