October 23, 2017

The Threat Assessment Model

Typically, prevention issues capture attention following a spectacular, high-casualty event such as the fatal rampages by deeply disturbed students at Columbine High or Virginia Tech. Obviously, the occurrence of such events means that prevention has failed. Examining those failures can lead to useful changes (the revised FERPA guidelines issued after the Virginia Tech shootings are one example). But concentrating too narrowly on what went wrong in a particular high-profile incident can also be a trap, for a number of reasons.

Mass shootings on campus are extremely rare — which means that looking too hard for similar warning flags may not be of significant help in preventing another incident because similar signals will in fact not reflect the same danger: the “false positive” problem. The writings and videos that reflected Seung Hui Cho’s and the Columbine killers’ violent fantasies were obvious warning signs, in retrospect. But the same kind of fantasies will be expressed by an overwhelmingly larger number of adolescents who will not become mass murderers. That does not mean that troubling works of imagination should be ignored. But it does mean that a student’s story or essay or film with disturbing visions of violence is not very useful, by itself, as a forecaster of a violent act. Nor are other apparent alarm signals taken by themselves, such as suicidal thoughts. Survey data consistently indicate that among students who report having seriously considered suicide, only one in every thousand will actually take his or her own life.

From the standpoint of prevention, the most important thing to do about such specific indicators (in the absence of an emergency situation requiring immediate response) is not to leap to intervene against the apparent — though frequently minimal –risk. More important is to find out whether they are associated with other indicators and circumstances. Has there been a broken romance or a family conflict? A history of threatening or violent acts in the past? Drug or alcohol abuse or other self-destructive behavior? A diagnosis of depression or other mental health disorder? A noticeable drop in grades or work performance?  Financial pressure or the threat of job loss or some other acute stress in the person’s life? Does the person have a weapon, or access to one? Is he or she familiar with firearms?

Such questions are at the core of the process called threat assessment, which has, in many institutions, become the centerpiece of violence prevention efforts. Gene Deisinger, deputy chief of the Virginia Tech Police and keynote speaker at the opening session of the Columbia conference, described threat assessment as a systematic, evidence-based process that moves through four stages: first, identifying “persons of concern”; second,  ”collecting information from multiple sources and constructing a much fuller picture of a person’s emotional condition and personal circumstances”; third, assessing that information and the situation; and fourth, managing the situation. Once the first two steps have been taken, Deisinger said, the next two — assessing and managing the threat — involve another four-part concept: that violence “is the product of an interaction among four factors” that he listed under the acronym STEP. S represents the Subject who may take violent action; T refers to the vulnerabilities of the Target of such actions; E stands for the Environment that may facilitate or permit or fail to discourage violence; and P indicates Precipitating events that may trigger an act by the subject.

Threat management, accordingly, deals with all four factors. It seeks, in Deisinger’s formulation, to “de-escalate, contain, or control the Subject who may take violent action”; to “decrease vulnerabilities of the Target”; to modify the physical and cultural Environment in ways that will discourage violence; and to prepare for and find ways to mitigate possible Precipitating events that may be the spark for a violent event. (Another function is recovery following a violent event, including assistance and support for those directly affected and rebuilding trust and a sense of security in the wider community. Recovery may not be strictly speaking a part of threat management, since it comes after the danger has passed. But it will typically involve the same campus institutions — principally public safety, student affairs, and medical/mental health counseling services — and it is connected to managing threats at least in the sense that measures to improve safety and prevent future incidents have an obvious role in the recovery process.)

An effective threat assessment program, as Deisinger and other speakers noted, requires not just the efforts of an assessment team but awareness, acceptance, communication and cooperation from the rest of the university community. A threat can’t be investigated, evaluated and managed until the team knows about it. That means that faculty (including adjunct faculty, who may be harder to reach and enlist), students, residential staff, public safety officers and other campus staff need to know how and where to inform the right people about a troubling or potentially troubling situation. It also means that administrators who make university policy and the staff that carries it out have to earn and keep the community’s trust. “The people who really know who’s dangerous are peers,” Richard J. Eichler, executive director of health services at Columbia, pointed out. “They won’t come forward if they don’t think the school will act humanely and rationally and  with judiciousness, wisdom and compassion.”

Beyond understanding their responsibility to report and how to do it, Deisinger commented, people also need to believe that their reports are wanted and that something will be done about them. They also need to know what to report. Deisinger offered this list:

  • Persons at risk of causing harm to others or harm to self
  • Persons who demonstrate inability to take care of themselves
  • Serious mental health concerns
  • Substance abuse
  • Behavior that is significantly disruptive to the learning, living, or working environment

Roger Depue, former chief of the FBI’s Behavioral Science Unit and the closing speaker at the Columbia meeting, told the group that relevant information can come from many directions — school records, teacher observations, student or peer information, police reports, counselor concerns, commitment evaluations, and parents’ observations. Depue was a member of the Virginia Tech Review Panel and author of an appendix to the panel’s report, titled “Red Flags, Warning Signs and Indicators,” which said, in part:

A single warning sign by itself usually does not warrant overt action by a threat assessment specialist. It should, however, attract the attention of an assessor who has been sensitized to look for other possible warning signs. If additional warning signs are present then more fact-finding is warranted to determine if there is a likelihood of danger. Some warning signs carry more weight than others. For instance, a fascination with, and possession of, firearms are more significant than being a loner, because possession of firearms gives one the capacity to carry out an attack. But if a person simply possesses firearms and has no other warning signs, it is unlikely that he represents a significant risk of danger. When a cluster of indicators is present then the risk becomes more serious. Thus, a person who possesses firearms, is a loner, shows an interest in past shooting situations, writes stories about homicide and suicide, exhibits aberrant behavior, has talked about retribution against others, and has a history of mental illness and refuses counseling would obviously be considered a significant risk of becoming dangerous to himself or others.

When a threat assessment team becomes aware of someone showing that or a similar list of warning signs, Depue wrote, it could respond by meeting with the student and developing a treatment plan with conditions for remaining in school (or, alternatively, suspending the student until he or she has been treated and doctors indicate the student is not a safety risk). Other possible actions could include contacting parents or guardians; talking with roommates and instructors; requesting permission to receive medical and educational records; and checking to find out about any past restraining orders or encounters with police, especially if they involved anger, stalking, making threats, or using or threatening with a weapon.[1]

Violence prevention and threat management cannot be reduced to simple formulas or knee-jerk responses. Profiling someone as dangerous from a checklist of factors, or automatic suspension or expulsion under mindless “zero tolerance” policies, are not the way to safer campuses.

“All threats and all threateners are not equal,” the FBI’s National Center for the Analysis of Violent Crime declared in a 2000 report that also warned: “It is especially important that a school not deal with threats by simply kicking the problem out the door. Expelling or suspending a student for making a threat must not be a substitute for careful threat assessment and a considered, consistent policy of intervention. Disciplinary action alone, unaccompanied by any effort to evaluate the threat or the student’s intent, may actually exacerbate the danger– for example, if a student feels unfairly or arbitrarily treated and becomes even angrier and more bent on carrying out a violent act.”[2] Virginia Tech’s Gene Deisinger echoed that warning, cautioning against over-reliance on “fear-driven responses” and disciplinary procedures such as suspension, expulsion or termination.  ”Never equate separation with safety,” he concluded.

Different campuses may have different views on how to structure a violence prevention system, what to call it, and what its scope should be. Some schools will avoid the term “threat assessment” because that might suggest that the campus is a dangerous place, and because they define safety and wellbeing more broadly than just protecting their community against possible violent acts. Terms such as “At-Risk Student Support” put a different lens on troubled students or employees, too: not just as threats to others, but as people in need of help.

A system aimed at detecting and dealing with a wider range of emotional problems may have a somewhat different makeup than one that focuses narrowly on potential violence. But in general, both will involve representatives of the university administration, campus police, counseling service and student or faculty/staff assistance programs, the dean of students, the residence office, and the legal department. As well as having different perspectives, those offices may not always completely share the same goals, either. “Administrators want to get rid of the problem, health professionals want to solve the problem, public safety wants to safeguard the campus,” one participant said wryly. Better and more systematic communication will not guarantee unanimity on all policies or procedures or decisions, but as most who attended the Columbia conference appeared to agree, it can make threat assessment (under whatever name) and threat management an effective method for making a campus a safer place for all members of the community.


[1] Report of the Virginia Tech Review Panel, Appendix M, p. M2-M4

[2] The School Shooter: A Threat Assessment Perspective. The Critical Incident Response Group (CIRG), National Center for the Analysis of Violent Crime (NCAVC), FBI Academy, Quantico, Virginia, 2000; p. 5, 26