STEP 4: Gather Information to Assess for Risk

BTAUs should establish clearly defined protocols to guide their assessment process.

Assessment is the process of collecting and analyzing information to understand threatening and concerning behavior in context.

During this process, information will be gathered from a variety of community systems and should address the Assessment Themes identified by decades of NTAC research on targeted violence.

Doing so ensures all relevant information is gathered and considered when assessing if an individual of concern poses a risk of violence while also identifying possible prevention strategies.

Once a case has been initiated, the BTAU will begin gathering information to assess if the individual poses a risk of engaging in targeted violence.

The information gathering process is intended to provide the BTAU with a comprehensive fact-based picture of the individual’s behavioral history and current life circumstances and to enable the unit to make an objectively reasonable and articulable assessment of the potential for violence.

This approach is based on foundational principles identified by NTAC research and the Secret Service’s pioneering efforts in the field, which have established that behavioral threat assessment: • utilizes a low threshold of concern, • requires corroboration from diverse sources, • emphasizes rapport building, • is not profiling, and • is not prediction.

Following the BTAU’s initial processing (see STEP 3: Identify and Process Reports of Concerning Behavior), the unit will need to determine the scope of the behavioral threat assessment based on the information available.

At this stage, some cases will receive a preliminary inquiry to determine whether a full assessment is warranted, while other cases may move immediately into a full assessment.

Gather as much information as necessary to establish context for reported concerns • Determine whether the case should be closed or if the case warrants a full assessment

Gather all relevant information from all relevant sources • Comprehensively assess the risk posed by an individual • Identify strategies to mitigate risk

For any actionable report of concerning behavior that meets the BTAU’s criteria for opening a case, the minimum level of response would be an inquiry.

An inquiry is itself a form of assessment, though limited in scope.

The purpose of an inquiry is to gather as much information as necessary to establish context for the reported concerns, allowing the BTAU to determine the credibility of the report and whether the case should be closed or elevated for a full assessment.

An inquiry may involve steps such as • interviewing the reporting party, • interviewing the individual of concern, • conducting a corroborative interview with someone who knows the individual well, • conducting a criminal records check, and • conducting a preliminary review of publicly available online activity (e.g., social media).

At the conclusion of an inquiry, the BTAU may decide to either close the case or elevate it to a full assessment.

The rationale for the decision to close a case or elevate it for further assessment should be documented.

Like other decision points in a behavioral threat assessment, this determination should be objectively reasonable and articulable, taking into account the totality of all relevant information along with the training and experience of the BTAU members.

Full assessments are initiated when safety concerns are elevated by the result of an inquiry or when the content of the initial report on its own justifies a full assessment.

The goal of a full assessment is to gather all relevant information from a range of sources in order to comprehensively assess the risk posed by an individual while also identifying potential strategies to mitigate that risk.

A full assessment should involve an extensive interview with the individual of concern, multiple corroborative interviews (e.g., family, friends, neighbors, employers, and classmates), records checks (e.g., criminal, employment, educational, and mental health), reviews of online activity (e.g., social media and personal websites), and physical searches.

Physical searches should be conducted in accordance with existing protocols and may involve plain-view searches, searches conducted with consent of the individual, or searches conducted with a warrant, depending on the circumstances.

Report is received Does this report involve an imminent threat to life?

Document, close, and retain the report. Share information as

Respond as necessary. Is a behavioral threat assessment still

Is the report actionable? appropriate. | necessary? | appropriate. YES Initiate a preliminary inquiry.

Document, close, and retain the | NO | Is more report. Share information as | information needed? appropriate. YES Perform a full | YES assessment

Secret Service research pioneered the Systems Approach to behavioral threat assessment when it published Protective Intelligence and Threat Assessment Investigations: A Guide for State and Local Law Enforcement Officials in 1998.

The guide describes how examining the “systems (family, work, community, criminal justice, mental health, and social services) that the individual is involved with are key to assessing and managing a potential threat.”

Gathering information from a variety of community systems will provide BTAUs with an organized and comprehensive way to assess an individual’s thinking and behavior.

The Systems Approach operationalizes how people tend to exhibit different behaviors in different environments. An individual’s communications and behaviors will often adapt to the context of their current situation.

For example, individuals may act differently when visiting family compared to how they act in a meeting with coworkers.

Therefore, gathering information from various community systems provides a more comprehensive and reliable assessment of an individual’s behavior than would be possible by only focusing on a single area of their life.

Utilizing the Systems Approach also allows BTAUs to corroborate information as it is gathered and make note of any inconsistencies or anomalies they identify.

Another benefit of the Systems Approach is that it allows BTAUs to connect pieces of information that are traditionally siloed.

Often, communities in the United States identify warning signs for acts of targeted violence after violence has already taken place.

In some cases, attackers had demonstrated concerning behavior at home, at work, in school, and online, but no program existed to examine all those behaviors together.

Additionally, information gathered from community systems can help to show changes in behavior over time.

For example, if a supervisor from an individual’s current workplace provides a starkly different description of the individual compared to a supervisor from a prior workplace, the BTAU may seek to identify any traumatic events or other situational factors that occurred during the timeframe of the individual’s current employment that could explain the dramatic change in behavior.

Community systems fall into two general categories: formal and informal.

Formal systems are structured organizations or groups that tend to maintain a physical location and records. Examples include judicial, law enforcement, employment, mental health, and education systems.

In these types of systems, there are often formal records that document an individual’s history of interaction with the systems (e.g., judicial records or education records). While such records can provide vital information for a behavioral threat assessment, it must also be noted that formal records sometimes lack context for explaining an individual’s behavior and rarely tell the whole story.

For example, a student may have a long history of eliciting safety concerns among teachers and classmates at a university, but there may be little documentation in their university education record regarding the concerning behavior or any interventions applied.

As another example, a man with a long history of stalking and harassing women may have a law enforcement record reflecting only a single charge of trespassing without any additional details about the months of behavior that led to the charge.

BTAUs should seek access to records from formal systems when authorized and in accordance with all relevant privacy protections. BTAUs may be able to access records from other law enforcement agencies, courts, and community organizations.

However, any information gathered should be further supplemented through appropriate interviews.

For example, if a BTAU obtains information through a police record provided by another agency, the BTAU may want to establish further context around the information by contacting the police department and officers who have previously interacted with the individual or by requesting more detailed police reports about those interactions.

Informal systems represent the less structured environments with which an individual routinely interacts, including family, friends, neighbors, and other community groups.

Unlike formal systems, informal systems rarely maintain records about an individual and instead provide information most often through interviews.

Interviews with informal systems provide BTAUs with the perspective of those who have maintained close or frequent relationships with the individual, sometimes over many years.

Online activity represents another informal system from which to obtain information to guide a behavioral threat assessment.

BTAUs should have protocols in place for evaluating open-source online information, including publicly available social media and other publicly available information (e.g., posted pictures, videos, communications, or shared files).

If visible, social media content may provide insight into an individual’s behavior, mindset, interests, and activities, all of which are useful when assessing an individual’s risk of engaging in violence.

BTAUs should also establish protocols for information gathering using popular search engines, which can reveal things such as personal websites and instances when an individual appeared in media coverage.

Partner agencies and fusion centers may employ specialized analysts who can assist BTAUs in open-source information gathering.

When the Secret Service conducts a behavioral threat assessment, one of the earliest steps will involve an initial interview with the individual of concern.

For BTAUs, the initial interview provides an opportunity to engage with the individual, directly observe their behavior, and gain insight into their mindset while also beginning to identify factors that indicate whether the individual does or does not pose a risk of violence.

In addition to observing the individual’s general thinking and state of mind, the BTAU should prioritize open-ended questions regarding each of the Assessment Themes identified later in this section.

The initial interview is also an early opportunity to begin establishing rapport with the individual.

Because behavioral threat assessments are not the same as criminal investigations, the initial interview will often take place outside of police custody and only with the consent of the participating individual.

Rapport building is a key element in establishing a positive relationship that can help the individual being interviewed to feel at ease while sharing information.

In many cases, an individual of concern may be experiencing a personal crisis or other stressful event.

Being receptive to the individual’s needs will help establish a foundation of trust, which can then be used to help motivate changes in behavior.

Explain your role, the purpose of the interview, and next steps using plain language.

Be clear, direct, and truthful, and clarify any misconceptions.

Maintain a calm, respectful demeanor for the entire interaction, not just while asking questions.

Prepare strategies for responding to extreme or emotional responses (e.g., aggression, sadness, or silence).

Invite the individual to provide their perspective. Be respectful and patient if they are not interested in speaking at first.

Offer realistic choices during the interview, when possible. The more the individual feels in control of how the interview time is spent, the more they may want to talk.

Use the time to explore the individual’s interests, relationships, past experiences, future plans, concerns, and coping skills.

Provide an opportunity for the individual to suggest ways they can be supported in order to prevent the situation from escalating further.

BTAUs can maintain a positive rapport with individuals of concern while also establishing firm and professional boundaries around public safety.

For example, a statement such as, “We are concerned that you might hurt someone, and we want to work with you to figure out a better way forward,” communicates an expectation for safe and nonviolent behavior and demonstrates a willingness to provide support. Approaches like this can help to dissuade someone from considering violence and create further opportunity for rapport building.

If officer safety allows, interviews with individuals of concern should be conducted face-to-face in order to observe nonverbal cues and physical reactions to questions.

If conducted at the individual’s residence, officers will have an opportunity to observe the individual’s living conditions and home environment.

At the conclusion of the interview, the individual may be advised of next steps and any lawful requirements they must adhere to (e.g., if they are the subject of a restraining order).

BTAUs should consult with their legal counsel to determine if an interview will take place in police custody and if the individual needs to be informed of their constitutional (“Miranda”) rights against self-incrimination.

The initial interview with the individual of concern should be followed by corroborative interviews with other people across the individual’s formal and informal systems.

These interactions provide opportunities for the BTAU to gather new information about the individual’s behaviors from people who know them and to corroborate information already identified in the assessment.

For example, when conducting a behavioral threat assessment involving the potential for workplace violence, the BTAU may conduct corroborative interviews with the individual’s coworkers and supervisor, in addition to the individual’s close family members.

For an assessment involving a student who threatened a school attack, the BTAU would likely interview the student’s parents, the student’s teachers, other school staff, and possibly classmates.

Establishing rapport continues to be important when engaging with the individual’s family, friends, and other support networks. The people in these systems should be made aware that the BTAU’s primary goal is to prevent negative outcomes, in part by getting help for their loved one, friend, or colleague.

While gathering information from the subject’s formal and informal systems, BTAUs should focus on exploring each of NTAC’s 20 Assessment Themes.

Assessment Themes are not intended to be used as a checklist. The purpose of Assessment Themes is to provide a broad scope through which to understand an individual’s behavior and the context in which they are operating.

These themes have been identified by decades of Secret Service research examining targeted violence in a variety of forms, including acts of mass violence targeting public spaces in the United States. Assessment Themes are based on frequently observed or particularly noteworthy factors in the backgrounds of those who have engaged in previous acts of targeted violence.

Gathering this information will allow the BTAU to assess if the individual poses a risk of violence and plan the interventions needed to mitigate that risk.

Information about Assessment Themes should be gathered using the Systems Approach described previously, namely through records checks, an interview with the individual of concern, corroborative interviews with others, and a review of open-source social media.

For example, BTAUs could identify a history of stalking and harassment both through an examination of criminal records and interviews with people who know the individual of concern. Similarly, BTAUs could identify concerning communications both through interviews and through an examination of the individual’s open-source social media posts.

Examining each of these Assessment Themes will provide the BTAU with comprehensive information to assess if the individual poses a risk of violence by identifying the contextual themes that may impact the individual’s thinking and behavior, the behavioral themes they have exhibited, and the summative themes that must be considered as part of an overall assessment.

Exploring each theme is necessary for a thorough assessment and may uncover other avenues of inquiry.

Keep in mind that there is no need to wait until the BTAU has completed all interviews or addressed every theme before taking action.

As soon as an area for intervention is identified, suitable management strategies should be enacted.

The Assessment Themes identified here are not individually predictors of violence but are factors that should be evaluated in context when conducting a behavioral threat assessment.

Further, some of the identified themes involve activities that are protected by the Constitution and should be viewed with those protections in mind.

Significant setbacks, losses, and other life challenges that may be acute (e.g., romantic breakups) or chronic (e.g., ongoing medical conditions).

Stressors can be experienced across several life domains, including family/romantic relationships, social interactions, work or school environments, personal health, legal actions, and other identified areas.

Specific examples include being bullied or harassed by others, financial instability, job loss, divorce or child custody issues, and failed life aspirations.

Family dynamics or home environments that negatively impact an individual, including family discord, abuse, drug use, criminality, domestic violence, mental/physical health concerns, death, and dissolution of relationships.

Conversely, positive home life factors may include supportive families, healthy relationships, and other dynamics that could support intervention strategies to mitigate risk.

Current or previous history of mental health symptoms that negatively impact the individual, particularly when left untreated, including paranoia, delusions, hallucinations, depression, and suicidality.

Mental health history may or may not include prior formal diagnoses, hospitalizations, and treatment (e.g., prescription medication).

A history of criminal behaviors identified in formal records, including arrests, convictions, and other legal actions. Criminal history may also include other criminal behavior and contacts with law enforcement and the courts that have not resulted in official legal actions.

Criminal behavior outside of formal records may be identified during the assessment through interviews with family, friends, coworkers, classmates, and others familiar with the individual.

A pattern of strained or conflicted relationships with family members, romantic partners, friends, coworkers, classmates, neighbors, or other members of the community. Interpersonal difficulties may include an inability to form or sustain positive relationships with others due to the individual’s inappropriate or concerning behaviors.

A pattern of engaging in criminal or inappropriate behavior for which the consequences were either absent or not commensurate with the behavior.

Examples of past behaviors that may not have received appropriate consequences could include threatening communications, domestic violence, physical/sexual assaults, inappropriate touching of others, stalking, and harassment.

Any violent, threatening, or disturbing communications which may be conveyed verbally (e.g., in-person or via phone), in writing (e.g., journals or drawings), electronically (e.g., text messages or emails), online (e.g., websites, blogs, or social media), or by other means.

The content of the concerning communications may reveal information on threats, grievances, violent intention, feelings of hopelessness/suicidality, obsessions, paranoid thinking, or a fascination with violence or weapons.

An unusual or excessive interest in weapons, violence, gore, prior attacks, notorious killers, or other concerning topics.

Fascination with weapons and violence can be demonstrated in a variety of ways, including stockpiling or manufacturing weapons, being described as obsessed with weapons, consuming or producing violent or graphic media, and writing stories or lyrics indicating a desire to harm others.

Particular concern should arise if the individual demonstrates an idolization of or desire to emulate past attackers.

Prior acts of physical violence against people, animals, or property that may appear in criminal records or may be observed or experienced by others, including physical and sexual assaults, domestic/family violence, animal cruelty, aggressively menacing behaviors, or arsons.

A history of violence may reveal signs of an escalation in aggressive behavior, for example, moving from property crimes to crimes against persons.

A pattern of conduct that willfully and maliciously causes another to feel bullied, stalked, persecuted, threatened, injured, or attacked.

The victim of this behavior may or may not have a pre-existing relationship with the individual of concern. Examples of victims with a pre-existing relationship to the individual include romantic partners, family members, coworkers, classmates, or neighbors, while those without a prior relationship may include elected officials, government employees, or celebrities.

Extreme ideological, political, or conspiratorial beliefs that advocate hate or violence, form the basis of an individual’s worldview or significantly influence an individual’s daily life.

Extreme beliefs may be based on distortion of facts (e.g., conspiracy theories) or may advocate distrust, hatred, or the use of violence targeting others based on biases against a particular race, religion, national origin, sexual orientation, gender, or gender identity.

An intense or obsessive preoccupation with a person, event, activity, or belief to the point where it negatively impacts aspects of an individual’s life.

Fixations often carry an angry or emotional undertone and may be evidenced through an individual’s extreme beliefs, grievances, interest in violence or weapons, and stalking or harassing behaviors.

Changes in behavior observable to others, including notable shifts in mental, social, occupational, physical, or interpersonal functioning.

This may be evidenced through changes in mood, appearance, or hygiene; withdrawing or isolating from others; new or increased substance use; sudden aggressive, violent, or threatening behavior; changes in work or school attendance or performance; signs of depression or paranoia; or other uncharacteristic actions that demonstrate a distinct change from an individual’s baseline behavior.

Feeling hopeless, despondent, desperate, or out of options.

An individual’s inability to perceive an improvement in their situation may lead to feelings of extreme distress, depression, frustration, and the perception that violence is the only option to cope with their circumstances.

A pattern of intense or escalating anger or aggression that is observed through the individual’s behavior, communication, or reported feelings.

This may be marked by impulsive angry outbursts, significant overreaction to circumstances or events, or frequent episodes of verbal or physical aggression directed at others.

Evidence of unusual inconsistencies in an individual’s communications and behaviors that may occur across the various community systems in their lives, including how they behave at work, home, school, or in social or romantic contexts.

When inconsistencies are found, these may be indicative of efforts to conceal violent intentions or behavior.

Specific steps taken to prepare to carry out an act of violence, including researching, visiting, or following potential targets; researching, manufacturing, acquiring, or practicing with weapons; documenting preparations for an attack through hit lists, to-do lists, maps, or manifestos; researching prior attacks and tactics; developing attack plans; researching logistical concerns; or using deceptive practices to hide activities.

Individuals may also engage in final acts intended to make a statement or to prepare for their inevitable arrest or death. These acts may include drafting a last will and testament, making financial arrangements for family members, leaving farewell messages or notes, posting goodbye messages online, and selling or giving away personal possessions.

The reason(s) why the individual engaged in the behavior that elicited concern or brought them to the attention of law enforcement.

Motive also includes assessing the reasons that may drive an individual to carry out an act of violence.

Motives may be multifaceted and include retaliating for grievances or perceived wrongs (e.g., bullying, failed romantic relationships, or workplace issues); furthering ideological, bias-related, or political beliefs; acting in response to psychotic symptoms; having a desire to kill; achieving fame or notoriety; or committing suicide-by-cop.

The individual’s behaviors or communications have caused fear, alarm, worry, or distress in those who observed them.

Particular attention should be paid to whether others are in fear for their safety as a result of the individual’s behavior.

Family members, friends, coworkers, neighbors, law enforcement, mental health professionals, and others may have been concerned about an individual’s demeanor, mental wellbeing, threatening or disturbing communications, harassing or other violent behavior, obsession with weapons or violent topics, isolating or withdrawing from others, substance use or abuse, or other concerning behaviors.

Current or future ability to access weapons that could be used to cause harm, including firearms, bladed weapons, explosives, chemicals, or poisons.

Access to weapons may include those that are readily available to the individual in their home, whether secured or unsecured, as well as those accessible in the homes of relatives or friends.

Contextual themes represent significant elements of an individual’s personal circumstances and surroundings which may negatively impact their thinking and behavior.

Some of these Assessment Themes have their own body of existing research examining their impact on an individual, and prior NTAC research has found that many past attackers had experienced substantial negative experiences related to these contextual themes as well.

Gathering both positive details (e.g., caring and supportive family) and negative details (e.g., familial discord and violence) about these factors will establish the context of past, present, and impending circumstances within which the individual of concern is operating and will inform the BTAU’s intervention strategies.

Stressors • Home life • Mental health • Criminal history • Interpersonal difficulties • Lack of consequences

Central to assessing whether an individual poses a risk of targeted violence is understanding the nature of concerning behaviors commonly observed in previous attackers.

While the presence of these behaviors alone cannot predict if an individual will become violent, it will inform the final assessment and management strategies employed by BTAUs.

For example, if an assessment reveals an individual is fixated on past attackers, has grown increasingly isolated, has posted concerning violent content on social media, and has been researching upcoming public gatherings, the BTAU will need to develop the appropriate strategies to manage the risk the individual may pose toward public spaces or other potential targets.

Concerning or threatening communications • Interest in violent topics • History of violence • Stalking, harassing, or bullying • Extreme beliefs • Fixations • Behavior changes • Desperation or despair • Intense anger or aggression • Inconsistency • Planning and final acts

Summative themes represent key questions that must be answered as part of an overall assessment.

BTAUs will be better equipped to make an informed assessment of risk if they have identified what is, or could be, motivating someone to become violent.

They will also need to understand if the people who know or have had contact with the individual have been concerned, especially if their concern is related to safety.

Lastly, BTAUs will need to assess if the individual has the means and capability to cause harm by gathering information about the weapons the individual has access to or could potentially obtain.

Motive • Elicited concern in others • Access to weapons

As information is gathered from interviews, records, and other sources, the BTAU must assess whether an individual does or does not pose a risk of violence, while also thinking about what intervention is required to move the individual toward a more positive outcome.

The BTAU should make this assessment by considering all the information gathered about the Assessment Themes using the Systems Approach, while also considering any other situational factors.

When assessing for risk, the BTAU should not focus solely on whether a person made a threat, but whether a person poses a threat. In other words, while explicit threats are relevant to assessing risk, they are not the sole indicator for whether a person may become violent and, as such, should not be treated as a threshold for concern by public safety officials.

This distinction is based on decades of NTAC research that demonstrates that many attackers do not make explicit threats of violence prior to an attack.

Therefore, the central question in behavioral threat assessment is—Does the individual of concern pose a risk of violence at this time?

Even if the individual does not appear to pose a risk of violence at this time, the BTAU may decide to implement some management strategies to support the individual’s wellbeing and prevent the situation from escalating.

Throughout an assessment, it is essential that units continuously assess any potential changes in the threat posed by the individual of concern.

While not Secret Service practice, BTAUs may explore classifying their assessments into levels of risk (e.g., low risk, medium risk, and high risk) if needed for case prioritization and management.

In doing so, BTAUs should ensure that each classification level is clearly defined and articulable (e.g., clarifying the distinction between low and medium risk) in order to avoid confusion and inconsistencies across assessments.

The BTAU’s protocols should allow for the unit to deviate from the prescribed levels of risk, if needed, based on any unique circumstances identified during the assessment.

Protocols should also allow for implementing risk management resources to all cases, including those deemed low risk.

Assessments should be based on an objectively reasonable and articulable assessment of the potential for violence, taking into account all available information identified by the BTAU.

The unit should document the decision and its justification with facts and details identified during the assessment.

Based on the results of the assessment, the BTAU will then determine how to manage the risk of violence through interventions and supports, as described in STEP 5.

While not Secret Service practice, BTAUs may explore the use of structured professional judgment (SPJ) tools to support their process of assessing risk and developing a management plan.

SPJs are instruments that can be used by trained personnel to measure the level of risk posed by an individual and may offer management considerations to reduce risk.

BTAUs should ensure that any tools incorporated into their behavioral threat assessment process have established evidence of reliability and validity for assessing the risk of targeted violence, specifically, and that the BTAU’s protocols allow for the unit members to deviate from the structured tool, if needed, based on their operational law enforcement training and experience.