​It has happened at an outdoor concert in Las Vegas. A work meeting in San Bernardino, California. A nightclub in Orlando. A high school in Parkland, Florida. A church in Sutherland Springs, Texas. An elementary school in Newtown, Connecticut. A movie theater in Aurora, Colorado. An Army base in Fort Hood, Texas. A college campus in Blacksburg, Virginia. And a newsroom in Annapolis, Maryland.

We can't forget Umpqua Community College in Roseburg, Oregon; the Emanuel African Baptist Church in Charleston, South Carolina; the U.S. Navy Yard in Washington, D.C.; an adult school classroom in Binghamton, New York; a restaurant in Killeen, Texas; a McDonald's in San Ysidro, California; post offices in Dana Point, California; Edmond, Oklahoma; Escondido, California; and Royal Oak, Michigan; a law office in San Francisco; and a beauty salon in Seal Beach, California.

The first modern-day mass shooting in the United States occurred in 1966 when Charles Whitman killed 16 people and wounded 30 with a rifle from the clock tower on the University of Texas (UT) Austin campus. His murder spree remains one of the top 10 deadliest active shooter attacks in the United States. And active shooter incidents are on the rise—a new FBI report found that 2017 saw the most incidents and most people killed in any one year since 2000.

Active assailant events have killed too many people to still refer to such workplace violence, school campus violence, or mass shootings in public places as rare. But while horrific incidents in the last several years make the news and keep police, politicians, parents, business owners, and employees awake at night, recall that this has been going on since Whitman fired that first shot from the UT clock tower so long ago. What has happened then will certainly happen again, despite the best efforts of law enforcement responders and security professionals around the country and internationally. These cases deeply scar the cities, schools, campuses, and communities where they happened, forever. The anniversary dates get further and further out as the years and even the decades pass, but no one associated with these events ever forgets.

How safety and security officials plan for and respond to these incidents, though, has continuously evolved over the decades, and will continue to do so as new research, best practices, and lessons learned are adopted.

Ticking Bombs

Defusing Violence in the Workplace—which the author co-wrote in 1994 with then-San Diego Police psychologist Dr. Michael Mantell—was one of the first business books on active shooters. The book set out a 21-step profile of a potential workplace shooter based on many of the cases that happened up to 1994—usually at U.S. Post Office facilities. The postmaster general at that time even wrote the foreword for our book, showing how attached experts were to the idea that workplace violence was mostly committed by white males in their 30s to 50s, with a military history and access to guns.

However, it soon became clear how wrong these profiles were. The April 1999 Columbine High School shooting changed collective thinking away from the focus on profiles toward the current emphasis on preattack behaviors and information leakage to third parties about the attackers' preferred targets and plans. 

Evolving Perceptions

For threat assessment experts and security management professionals, the shootings that took 13 lives at Columbine High School were the equivalent to the 9/11 attacks—they completely changed the thinking about how to respond to these types of events. Much like the United States' post-9/11 terrorism fight around the world, engaging an active shooter on sight became the new normal post-Columbine.

Law enforcement had to change its tactical response to what were now being called active shooters, because at Columbine there were multiple perpetrators who were not there to take hostages and make demands, but to kill others and then themselves. Security experts will never forget hearing recordings of shots fired and the anguished cries inside those buildings as the officers on scene followed their usual protocol: set up a perimeter and wait for the SWAT team to arrive.

Columbine taught security practitioners about preattack behaviors, the leakage of information by the perpetrators, and the need for arriving police officers to respond quickly, form into tactical teams, and use whatever firearms they had to enter the building and stop the attackers. This model has become standard police procedure for active shooters and mass attackers at schools and businesses in the United States.

Research and Models

Two U.S. Secret Service (USSS) reports—Protective Intelligence and Threat Assessment Investigations from 2000 and the 2004 Safe School Initiative, authored by USSS Supervisory Special Agent Bryan Vossekuil and psychologists Dr. Robert Fein and Dr. Marisa Reddy—have contributed immensely to the understanding of planned attacks against protected targets, workplace violence, and school violence prevention. These two comprehensive reports should be studied by every security practitioner who faces the potential for violence at their facilities.

Protective Intelligence and Threat Assessment Investigations was also known as the Exceptional Case Study Project (ECSP) because it focused on data from assassinations of political figures as far back as Abraham Lincoln in 1865, as well as research into school and workplace violence attacks and interviews of surviving political assassins and school and workplace attackers in prison.

The ECSP laid out the concept that some people make threats and some people pose threats. There should be more focus on people who pose threats and less on those who just make verbal or written threats, because the presence of such threats is not the best indicator of a pending attack. The ECSP also discussed the idea that people who engage in lethal violence often engage in third-party leakage—they warn other people such as coworkers, family members, or students of their plans, but not the targets they intend to harm. The student that wants to shoot his teacher rarely directly threatens that teacher, because it would lead to consequences such as being arrested or suspended, thereby interrupting the opportunity to attack. 

In the early years of threat assessment and management, there was a tendency to overreact to direct verbal or posted threats and underreact to third-party threats. While all threats need to be investigated, the new emphasis is on listening more closely for these leakage events, and training employees and students to have the courage to report them to the safety and security stakeholders for the business or school.

The Safe School Initiative, also coauthored by Dr. Randy Borum from the University of South Florida and Bill Modzeleski from the U.S. Department of Education, offered the conclusion that there is no known or useful profile of a school shooter. This research also showed that most perpetrators are on a path from ideas to actions, meaning they follow a distinct process that starts with a grievance, followed by a violent ideation that may last for weeks, months, or even years. They begin to make a plan, acquire or practice with a weapon, stalk their targets, make a series of dry runs, and then attack.

Two recent reports by the FBI's Behavioral Analysis Unit expand on this concept, detailing preattack behaviors of active shooters based on a study of incidents from 2000 to 2013. The active shooters examined in the study could not be identified prior to attacking based on demographics alone, but concrete patterns emerged in their preattack behaviors. A majority of attackers acquired their firearms legally, and more than three-quarters of attackers spent a week or more preparing. The average attacker had experienced multiple stressors in the year before they lashed out, but only 25 percent had ever been diagnosed with a mental illness. And in the majority of attacks, at least one of the victims was specifically targeted—the most common grievance reported was adverse interpersonal or employment action taken against the shooter.

A key to identification and resolution of threat cases is early identification of such attack-related behaviors. Perpetrators of targeted acts of violence engage in covert and overt behaviors prior to their attacks: they consider, plan, prepare, and share—and not with their target, but usually with third parties. One challenge security faces is educating scared, concerned, or anxious employees or students on how to disclose what they have heard and to whom, so security stakeholders can assess the information in context, formulate a deterrence plan, and take proactive steps.​

Defining Threat Assessments

In the post-Columbine world, we began to define a series of investigative processes as a threat assessment—a way to interpret data gathered from a wide variety of sources such as direct observation, records reviews, witness reports, past behaviors, and potential current targets, to form an opinion about the seriousness of a situation.

Conducting threat assessments became both a science and an intuitive art, and moved away from the limits of profiles, demographic characteristics, or historical statistics. Threat assessment activities underwent a shift from predicting violence—which is not possible—to identifying the behaviors of potential attackers, their targets, and the means and methods for harming those targets as a "window in time." The concept of threat assessments began to take on a new professionalism, moving beyond the realm of just mental health clinicians or law enforcement and into areas crossing over into the fields of security, human resources, prosecution, corrections, educational facilities, and research.  

Efforts in preventing mass shootings, stopping active shooters, and workplace and school violence prevention continue today, especially in light of recent attacks. We stand on the shoulders of researchers and threat assessment practitioners who were doing this work long before Columbine. Their work supports today's active assailant best practices and is based on extensive research.

Early researchers—including Dr. Fred Calhoun's work on threats against federal judges and Steve Weston's research on threat assessment—teach the theory that Howlers howl and Hunters hunt, meaning that there is more to worry about from the potential perpetrator who works in stealth than the person who "howls" and wants to be seen as intentionally provocative, disruptive, or sinister. The Hunter wants to be successful and not be stopped by security or the police, so this attacker does not warn. In the past, a lot of investigative energy, security assets, and resources were put towards threats made by Howlers who would say, "I've put a bomb near the loading dock!" or "I'm gonna come there and shoot up the whole school!"

Security and human resource-related associations are taking the lead in providing research, analysis of incidents, training, and the creation of national standards related to workplace violence and school violence prevention. Such organizations include ASIS International, the Association of Threat Assessment Professionals, and the Society for Human Resource Management. Other groups with input into the prevention of workplace and school violence include the International Association of Chiefs of Police, the National Sheriffs Association, and the National Association of School Resource Officers.​

Threat Assessment Teams

The biggest shift in the movement towards making the threat assessment process more professional and structured was the emergence of Threat Assessment Teams (TATs). These groups are also called threat management teams, crisis response teams, or critical incident response teams, and they now populate private-sector businesses, school districts, college and university campuses, and public-sector entities ranging from utilities to cities and counties.

TATs don't need to be formally appointed, but they must be staffed by the organization's safety and security stakeholders. This often includes representatives from executive management, human resources, security, legal counsel, facilities, IT, communications, safety, and risk management. The team can also benefit from support by local law enforcement commanders, mental health clinicians or Employee Assistance Program (EAP) providers, or labor relations or union representatives.

The function of the TAT is to discuss its coordinated, measured—but urgent— responses to potential crisis situations, including threats or violence towards the organization or its employees, employee-to-employee bullying, high-risk employee discipline or terminations, domestic violence crossovers with employees, threats to the organization's facilities, cyberthreats, and vexatious litigants.

The value of TATs—which are often run by human resources or security representatives, because of their familiarity with employee-related issues—is to take the best advice from the group and not get manipulated into "seeing the ocean through one drinking straw." In other words, the police may have strong feelings about making an arrest; the threatening employee's manager may want to terminate; and the facilities representative may want to lock the building down. These are all potential solutions and should be put up for group discussion before a final decision is made.

Run. Hide. Fight. 

The Run. Hide. Fight. video created in 2012 by the U.S. Department of Homeland Security (DHS) and the City of Houston is short and to the point. If you are ever confronted by an active shooter, run out of the building, taking as many people as safely as you can with you; hide out in the best room you can barricade; and be ready to fight back if the shooter breaches your room. This active shooter protocol is designed to get employees out of the way of the attacker and the responding police by leaving the facility or locking the room down. In most cases, attackers have a short window of time to carry out their plan—usually five to 10 minutes—before police arrive.

All of the videos and training programs that have emerged as a response to workplace or campus shooters have the same goals: don't wait for the police to rescue you, get out of their way while they confront the attacker, and be prepared to fight back or provide first aid to save your life and help save the lives of your coworkers, customers, or students.​

Domestic Violence in the Workplace 

One exception to Calhoun and Weston's Howlers vs. Hunters model is called the Intimacy Effect. In cases where there has been previous sexual intimacy between the suspect and the victim, the chances for fatal violence go up dramatically. These perpetrators are Howlers who become Hunters because they are obsessed with hurting or killing their former partner. 

Murder is still the leading cause of death for women in the workplace, and has been for decades, according to the U.S. Occupational Safety and Health Administration. Most women who are killed on the job are shot during robberies at retail facilities or attacked by their former partners while working. As a workplace issue—one that many managers, supervisors, and human resources professionals are still reluctant to address—domestic violence crossover from home to work continues to take the lives of many female employees, especially in states where there are no laws preventing employees from being fired for revealing their victim status to their employer.

In California, legislation was passed in 2013 that gives domestic violence victim-employees protected class status—like age, race, or gender—and dictates that employers not only cannot fire an employee who brings a domestic violence issue to their attention but must also help create a workplace safety plan to provide protection and support. Fewer than 10 states in the United States offer similar supportive legislation, which is something domestic violence advocacy groups are trying to change.

Continued Evolution 

Progress is being made to thwart potential workplace, school, and mass attackers, but there is still a long way to go to stop future perpetrators. These attackers learn from the methods and mistakes of their predecessors—but so do threat assessment experts and security practitioners. Threat assessment experts need to continue to develop new strategies for schools and businesses.

Scheduling yearly Run. Hide. Fight. drills that focus on the value of the first two steps is becoming more common, as is training employees and students to listen for—and properly report—preattack leakage threats from potential perpetrators. More organizations and school districts are establishing TATs to address crises, and there has been a bigger emphasis on getting funding for more well-trained school resource officers.

When it comes to addressing a potential active shooter who is moving on the path from ideas to action, proactive interventional responses by mental health clinicians and law enforcement officers alike is becoming an established best practice. Open dialogue about teaching all parents who own guns to practice safe storage in their homes is more common as well. And if a mass shooting is successfully carried out, there has been a greater emphasis on encouraging national media to not cover the attackers by name and face.

While facility security has evolved from the model of relying on gates, guards, and guns, it is still important to install appropriate security devices and update procedures periodically.

How security practitioners handle the threat of mass attackers on campuses and active shooters in workplaces, churches, and malls has changed over the past 25 years. There are many committed people who have made it their life's work to help stop these attacks, and the fight for peace at businesses and schools will continue.  ​

​

Dr. Steve Albrecht, CPP, is a 22-year member of ASIS. As a keynote speaker, author, and trainer, he specializes in violence prevention. He has written 18 books on business, security, and criminal justice subjects. he can be reached at [email protected].

Resources Mentioned in this Article

Dr. John Monahan, from the University of Virginia Law School is regarded as the "the leading thinker on the issue of violence risk assessment."

Hollywood security expert and threat assessment pioneer Gavin de Becker is best known for his groundbreaking work in protective intelligence gathering and his best-selling 1997 book, The Gift of Fear.

Dr. Reid Meloy and Dr. Kris Mohandie are known for their research and speaking work on stalking perpetrators, "predatory versus affective violence," and their widely-used violence risk assessment models, methods, and practices.

The FBI's Behavioral Analysis Unit has often provided critical research, including two highly-detailed recent reports edited by Supervisory Special Agent Andre Simons: "A Study of Active Shooter Incidents in the US Between 2000 and 2013" and "A Study of the Pre-Attack Behaviors of Active Shooter Incidents in the US Between 2000 and 2013." Supervisory Special Agent Eugene Rugala edited the FBI's 2004 report, "Workplace Violence: Issues in Response."

Dr. Ted Calhoun and Steve Weston's threat assessment books, presentations, and research and development of the concept known as "Hunters versus Howlers." Calhoun's seminal 1998 book, written for the US Marshals, Hunters and Howlers: Threats and Violence Against Federal Judicial Officials in the United States, 1789 to 1993, taught us to pay more attention to people who don't just draw attention to themselves by making verba​l or written threats.