In light of recent violent attacks, such as the December 5, 2019 NAS Pensacola fatal shooting, in which an attacker killed three people and injured eight others, and the Pearl Harbor Naval Shipyard fatal shooting, where a sailor killed two civilian workers, the U.S. the Navy and Marine Corps are conducting a broad review of security measures to review insider threat protocol and training.

These violent attacks have forced schools, enterprises, government agencies and other organizations to prepare for any violent threats that may occur. What do security professionals, in charge of protecting and responding to threats of violence in their workplace, need to know in order to conduct a thorough and accurate threat assessment and develop a workable response plan?

On December 17, 2019, Tom M. Conley, CPP, CISM, CMAS, President and CEO of The Conley Group, Inc. of Des Moines, Iowa, that provides security services, security patrol services and alarm response service to their clients, led a Security magazine webinar, Conducting a Workplace Violence Threat Analysis and Developing a Response Plan. The webinar examines how to best complete a thorough threat assessment, true foundation strategies to prevent an active killer event, and maintaining strong and vibrant public-private relationships to advance an organization’s workplace violence threat.

Here, we’ll explore lessons learned from the webinar and examine how to implement a threat assessment team that will help security professionals be ready when they are called upon to conduct a threat assessment of potential insider threats and provide the best recommendations possible to their organization’s leadership.


Lesson 1: Defining an Active Killer

Before defining an active killer, it’s important to note that during the past 25 years, there’s been an uptick in workplace violence attacks. Recent data compiled by The Associated Press, USA Today and Northeastern University shows that there were more mass killings in 2019 than any year dating back to at least the 1970s. In all, there were 41 mass killings, defined as when four or more people are killed excluding the perpetrator. Of those, 33 were mass shootings. More than 210 people were killed.

What is an active killer? Conley defines an active killer as a suspect or assailant whose activity is immediately causing death and serious bodily injury. It’s important to understand that death or serious bodily injury can come from anything that can be used as a weapon or no weapon at all, says Conley. “Think about anything that can be used to hurt others. Bodybuilders, for instance, can use their bodies to inflict pain on others due to their physical makeup,” he says.

According to Conley, the active killer is considered the greatest human threat in the security business, on school campuses and within our communities. However, it wasn’t until after the Columbine High School mass shooting, in which two teens went on a shooting spree on April 20, 1999, killing 13 people and wounding more than 20 others before committing suicide, that patrol deputies and officers had specialized training for patrol to respond to active threats, says Conley.

Before Columbine, police arrived, set up a perimeter and called S.W.A.T, patrol deputies and officers had very limited firepower and no specialized training on responding to insider threats, which was a major security problem, Conley notes.

What does this mean for security? After Columbine, agencies reevaluated response to “Active Shooter” situations, first unit(s) on scene engaged the suspect, and two, three and four-office teams were implemented throughout the U.S.

Law enforcement protocol has evolved as well, as departments instruct officers to secure the immediate area and assess the danger. The goal now is to locate, contain and stop the shooter. Once officers and deputies find the suspect, they either disarm him/her or terminate the threat.


Building a Threat Assessment Team


A threat assessment team is another risk-based approach to preventing and mitigating insider threats or workplace violence. There are many resources on how to build a TAT. The following guide, titled Enhancing School Safety Using a Threat Assessment Model: An Operational Guide for Preventing Targeted School Violence, from the U.S. Secret Service National Threat Assessment Center (NTAC), and is available on the NTAC website.

The goal of a threat assessment is to identify suspects of concern, assess their risk for engaging in violence or other harmful activities, and identify intervention strategies to manage that risk.

Step 1. Establish a multidisciplinary threat assessment team of personnel, administrators and officers who will direct, manage and document the threat assessment process.

Step 2. Define behaviors, including those that are prohibited and should trigger immediate intervention (e.g., threats, violent acts and weapons inside buildings) and other concerning behaviors that require a threat assessment.

Step 3. Establish and provide training on a central reporting system such as an online form on the organizations website, email address, phone number, smartphone application or other mechanisms. Ensure that it provides anonymity to those reporting concerns and is monitored by personnel who will follow-up on all reports.

Step 4. Determine the threshold for law enforcement intervention, especially if there is a safety risk.

Step 5. Establish threat assessment procedures that include practices for maintaining documentation, identifying sources of information, reviewing records and conducting interviews. Procedures should include the following investigative themes to guide the assessment process:

  • Motive: What motivated the student to engage in the behavior of concern? What is the student trying to solve?
  • Communications: Have there been concerning, unusual, threatening or violent communications? Are there communications about thoughts of suicide, hopelessness or information relevant to the other investigative themes?
  • Inappropriate Interests: Does the person of interest have inappropriate interest in weapons, school attacks or attackers, mass attacks or other violence? Is there a fixation on an issue or a person?
  • Weapons Access: Is there access to weapons? Is there evidence of manufactured explosives or incendiary devices?
  • Stressors: Have there been any recent setbacks, losses or challenges? How is the person of interest coping with stressors?
  • Emotional and Developmental Issues: Is the person dealing with mental health issues or developmental disabilities? Is the person’s behaviors a product of those issues? What resources does the person need?
  • Desperation or Despair: Has the person felt hopeless, desperate or like they are out of options?
  • Violence as an Option: Does the person think that violence is a way to solve a problem? Have they in the past?
  • Concerned others: Has the person’s behavior elicited concern? Was the concern related to safety?
  • Capacity: Is the person organized enough to plan and execute an attack? Does the person have the resources?
  • Planning: Has the person initiative an attack plan, researched tactics, selected targets, or practiced with a weapon?
  • Consistency: Are the person’s statements consistent with their actions or what others observe? If not, why?
  • Protective factors: Are there positive and prosocial influences in the person’s life? Does the person have positive and trusting relationships with others in their organization? Does the person feel emotionally connected to others in their organization?

Step 6. Develop risk management options to enact once an assessment is complete. Create individualized management plans to mitigate identified risks. Notify law enforcement immediately if the person is thinking about an attack, ensure the safety of potential targets, create a situation less prone to violence, redirect the person’s motive and reduce the effect of stressors.

Step 7. Create and promote a safe environment built on a culture of safety, respect, trust and emotional support. Encourage communication, intervene in conflicts and bullying and empower everyone in the organization to share their concerns.

Step 8. Provide training for all stakeholders, including employees, staff, personnel, students, parents, and law enforcement.

The U.S. Secret Service notes that despite having a comprehensive targeted violence prevention plan in place and a threat assessment team, incidents of targeted violence may still occurs. It is critical to develop and implement emergency response plans and procedures and provide training on them to all stakeholders.

In addition, the U.S. Department of Homeland Security recommends that emergency response plans be developed with input from local law enforcement and first responders. These include, but are not limited to: procedures when reporting emergencies, evacuation procedures and routes, use of emergency notification systems and information regarding local hospitals or trauma centers.


Lesson 2: The Mentality of an Active Killer

Knowing the mentality of an active assailant is key, and includes understanding that the active killer’s goal is not to escape, but rather to kill as many people as possible, says Conley. Other factors include:

  1. A desire to kill without concern for their safety or threat of capture.
  2. Normally has intended victims and will search them out.
  3. Accepts targets of opportunity while searching for or after finding intended targets.
  4. Has a victim mentality.
  5. Will continue to move throughout a building or are until stopped by law enforcement, suicide or other intervention. This has necessitated a change in tactics by law enforcement. Studies showed that the mere presence of armed security or law enforcement has prevented an active shooter incident, notes Conley.

To counterattack killers, intended to kill and injure, and losses, community preparedness training and response during an actual event is needed. Having some forethought can help prepare community members and security professionals if the need arises, as well, Conley says.

According to Conley, for a crime to occur, a crime trifecta is necessary: means, motive and opportunity. These refer to:

  1. The ability of the defendant to commit the crime (means)
  2. The reason the defendant committed the crime (motive)
  3. Whether the defendant had the chance to commit the crime (opportunity)

The prime conditions for crime to occur need, as well, a suitable target, a likely offender and a suitable environment. “If you remove any of these conditions, the likelihood of a crime significantly reduces,” says Conley.


Lesson 3: Truths About Security Protection

Finally, Conley contends that there are some absolute truths about security protection:

  1. Implementing adequate security measures before an incident occurs is the only chance for real success.
  2. Proper preparedness is crucial. People never “rise to the occasion” in a crisis. Rather, they dip to a basic level of preparedness.
  3. The only way to do risk management is to conduct a survey and then mitigate the risks identified in the survey in an adequate level, notes Conley.

In addition, knowing procedures for emergency response is critical. “First, understand that your actions will influence others,” he says. “Panic and calm are contagious, so stay calm. Lastly, assure others that you and the police are working closely to resolve the issue.”

Maintaining good safety and security is only achieved through the combination of acquiring a “warrior spirit,” proper planning, leveraging tools that are available and maintaining situational awareness at all times, Conley says. That being said, when reporting suspicious activity to law enforcement, Conley notes that security professionals should always maintain situational awareness and report:

  • Specific location
  • Number of victims
  • Number of suspects
  • Description of suspects
  • Clothing color and style
  • Physical features
  • Type of weapon(s)
  • Do you recognize the shooter(s)?
  • What are their name(s)?

It’s important to note that we can no longer predict the origin of the next threat. Assailants in some recent incidents across the country were not students or employees, and there were no obvious specific targets and the victims were unaware they were targets until attacked, Conley says.