55 claims on pp. 8–94 (fact 9, statement 24, evidence 22).
The publication is also intended for people with broader public safety responsibility, including state and local law enforcement, mental health professionals, and other community partners.
It is also intended for individuals with broader public safety responsibility, including state and local law enforcement, mental health professionals, and other community partners.
The attacker was ultimately shot by law enforcement and later died of his injuries.
The attacker was ultimately shot by law enforcement and later died of his injuries.
Less frequently, attackers were stopped by law enforcement intervention (n = 9).
Less frequently, attackers were stopped by law enforcement intervention (n = 9)
Table 3 reports that 15 attackers (30%) stopped on their own and were then arrested at or away from the scene.
Sample (n = 15 of 50) · incidents (attacks) in the study
— Arrested at/away from scene | 15 | 30%
Table 3 reports that law enforcement intervened to end 9 of the attacks (18%).
Sample (n = 9 of 50) · incidents (attacks) in the study
Law enforcement intervened, then... | 9 | 18%
Table 3 reports that in 2 attacks (4%) law enforcement intervened and the attacker was then arrested at or away from the scene.
Sample (n = 2 of 50) · incidents (attacks) in the study
— Arrested at/away from scene | 2 | 4%
Table 3 reports that in 7 attacks (14%) law enforcement intervened and the attacker was killed by law enforcement.
Sample (n = 7 of 50) · incidents (attacks) in the study
— Killed by law enforcement | 7 | 14%
The gunman whose spree ended at his workplace was shot and killed by responding law enforcement officers.
The attacker was ultimately shot and killed by responding law enforcement officers.
The gunman had numerous law enforcement encounters for domestic violence against his ex-girlfriend, which prompted her to file for the protection order served on the day of his attack.
The attacker had numerous other encounters with law enforcement for domestic violence he perpetrated against his ex-girlfriend, prompting her to file for the protection order he was served on the day of his attack.
While employed, the cemetery attacker made threatening statements that concerned coworkers, leading to calls to law enforcement and eventually his termination.
As an employee, the attacker had made threatening statements that concerned coworkers, prompting calls to law enforcement and his eventual termination.
When police arrived, the attacker engaged in a shootout, injuring five officers before dying from gunshot wounds sustained in the exchange.
When police arrived, the attacker engaged in a shootout with them, injuring five officers before dying from gunshot wounds sustained during the exchange.
After law enforcement responded, the gunman shot and killed a police chief as the chief exited his vehicle.
After law enforcement responded to the scene, the gunman shot and killed a police chief as the chief exited his vehicle.
The laid-off employee who had threatened to return to the workplace with a gun was ultimately arrested for trespassing on the premises.
The employee was ultimately arrested for trespassing on the premises.
Establishing partnerships with community agencies, such as law enforcement, social services, or mental health professionals, is crucial to the success of organizational BTAM efforts.
Establishing partnerships with community agencies, such as local law enforcement, social services, or mental health professionals, is crucial to the success of organizational BTAM efforts.
A workplace safety manager offered police coffee and parking, then shared building plans and a campus map at a meeting. The report says these resources let law enforcement navigate the campus safely during an incident.
He introduced himself to the local police department and made coffee and parking spaces available for officers and their patrol cars
Over time, the organization established a strong relationship with law enforcement.
Over time, the organization established a strong relationship with law enforcement.
A newly hired workplace safety manager at a major corporation recognized the value of partnerships with local law enforcement.
A newly hired workplace safety manager at a major corporation recognized the value of partnerships with local law enforcement.
The workplace safety manager convened a meeting with officers, described the organization's mission and needs, and shared the building plans and a campus map with police.
The workplace safety manager convened a meeting with the officers, during which he described the organization’s mission and needs and shared the building plans and a campus map with police.
The shared building plans and campus map ensure law enforcement can safely and efficiently navigate the campus if an incident requiring law enforcement response occurs.
These resources ensure law enforcement will be able to safely and efficiently navigate the organization’s campus if an incident occurs that requires law enforcement response.
Making coffee and parking spaces available to officers encouraged police to visit the organization's campus more frequently.
which encouraged police to visit the organization’s campus more frequently
The policy should establish what behaviors and reports should necessitate notification to law enforcement for assistance with a safety concern or a criminal matter.
Establish what behaviors and reports should necessitate notification to law enforcement for assistance with a safety concern or a criminal matter.
cite page 42 Step 2: Establish BTAM Program Policy and Procedures
A BTAM policy should establish the threshold for law enforcement intervention.
Threshold for law enforcement intervention.
cite page 42 Step 2: Establish BTAM Program Policy and Procedures
Security personnel can support communication with local law enforcement, information gathering, physical security responses, and safety plans.
Security personnel can provide support in communicating with local law enforcement
State and local law enforcement can assist with information gathering, responding to safety concerns, and supporting management strategies.
Law enforcement can assist with information gathering, responding to safety concerns, and supporting management strategies.
Training should describe when it is appropriate to contact law enforcement and the procedures to follow once they are contacted.
Training for BTAM members should describe when it is appropriate to contact law enforcement
Objectively concerning behaviors such as unauthorized weapons, threats, and assaults should warrant immediate action, often including local law enforcement.
Some behaviors are objectively concerning (e.g., unauthorized weapons, threats, assaults) and should warrant immediate action, oftentimes including local law enforcement intervention.
cite page 50 Step 4: Identify and Process Reports of Concerning Behavior
Some organizations partner with law enforcement or a third-party dispatch center with 24/7 availability to receive reports outside work hours.
partnerships with law enforcement agencies or a third-party dispatch center that has 24/7 availability
Why inferred Describes a practice some organizations use; typed as statement rather than fact.
cite page 55 Step 4: Identify and Process Reports of Concerning Behavior
Reports describing emergencies, such as a terminated employee brandishing a weapon on site, are not appropriate for a BTAM and should prompt an immediate call to security, emergency dispatchers, or local law enforcement.
Reports that describe emergency situations, such as a terminated employee brandishing a weapon on site, are not appropriate for a BTAM
cite page 57 Step 4: Identify and Process Reports of Concerning Behavior
Figure 10 shows Law Enforcement as an external system (blue circle) surrounding the individual of concern.
Law Enforcement (blue)
Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text
In this fictional example, a retail customer's social media posts prompted employee interviews, an IT review and a consensual law enforcement interview, leading to a no-trespass order from physical stores.
The BTAM team determines that the individual presents a low risk for physical harm but a high risk for causing disruption at the store
In the fictional retail example, the BTAM team gathered information by interviewing store employees, directing company IT to review the customer's publicly available social media posts, and coordinating with law enforcement on a consensual interview about the posts.
The BTAM team uses the Systems Approach to gather information through interviews with employees from the store, direct the company IT department to further review the individual's publicly available social media posts, and coordinate with law enforcement to conduct a consensual interview with the individual regarding the social media posts.
In the fictional retail example, the BTAM team worked with local law enforcement to issue the customer a no trespass order for all physical store locations while offering him discount codes for online shopping on the store's website.
The BTAM team works with local law enforcement to issue the customer a no trespass order from all physical store locations, while offering him discount codes for online shopping through the store's website.
Coordination with law enforcement can be critical, especially in highly concerning cases involving possible violence or criminal behavior or individuals not associated with the organization.
Coordination with law enforcement partners can be critical for organizations
Law enforcement agencies possess the legal authority, training, and operational protocols needed to safely engage with individuals outside the organization, ensuring that privacy rights are protected and that investigative activity does not escalate the situation or expose the workplace to liability.
Law enforcement agencies possess the legal authority, training, and operational protocols needed to safely engage with individuals outside the organization
Organizations may coordinate with law enforcement to serve or enforce a protective order or to request a welfare check at an individual's home.
Organizations may coordinate with law enforcement to serve or enforce a protective order or to request a welfare check
Seeking to interview community members will typically occur by requesting law enforcement support, and only in serious or high-risk situations.
Seeking to interview members of the community will typically occur by requesting the support of law enforcement and only in serious or high-risk situations
The Assessment Themes are presented in NTAC's 2024 guide for state and local law enforcement, Behavioral Threat Assessment Units.
Behavioral Threat Assessment Units: A Guide for State and Local Law Enforcement to Prevent Targeted Violence (2024)
For external individuals such as customers or clients, BTAM teams can offer community service connections, liaise with law enforcement for wellness checks, and seek court orders when appropriate.
BTAM teams can offer connections to community and social service providers, liaise with law enforcement to conduct wellness checks, and partner with the judicial system to obtain court orders
Examples include changing an employee's schedule when staff conflict, restricting an individual's facility access, engaging local law enforcement for support, and limiting access to firearms when permitted by law and consistent with constitutional protections.
Some strategies for creating a situation less prone to violence include changing an employee's schedule when there are conflicts among staff
Eligible petitioners for an ERPO may include law enforcement, family members, romantic partners, and clinicians, depending on state law.
Eligible petitioners for an ERPO may include law enforcement, family members, romantic partners, and clinicians.
In some cases it may be appropriate to use added safety precautions, such as an offsite or video meeting or a security or law enforcement presence.
In some cases, it may be appropriate to utilize additional safety precautions.
Why inferred Conditional recommendation hedged with 'may be appropriate'; classified as a statement.
Post-separation strategies can include following up with an employee or their friends, family, or mental health provider; monitoring online behavior and communications (e.g., social media posts); and re-evaluating potential resources or support mechanisms to assist the employee in coping with stressors.
These strategies can include following up with an employee or their friends, family, or mental health provider; monitoring online behavior and communications (e.g., social media posts); and re-evaluating potential resources or support mechanisms to assist the employee in coping with stressors.
Additional safety precautions can include holding the separation meeting offsite or by phone or video, or having security or law enforcement present before, during, and after the termination.
These can include conducting a separation meeting at an offsite location or via a phone or video conference, or establishing a security or law enforcement presence before, during, and following the termination procedures.
For high-risk cases, other strategies might include working with law enforcement to issue a stay-away order and telling reception or front-desk staff to contact security or law enforcement if the individual is seen on premises after separation.
Other strategies, particularly for high-risk cases, might include coordinating with law enforcement to issue a “stay away” order from the premises and notifying reception, front desk, or other personnel to contact security or law enforcement if the individual of concern is observed on premises following the separation.
Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.
Organizations should contact law enforcement for immediate safety concerns.
Contact law enforcement for immediate safety concerns.
Community partners with whom the organization has established a relationship can be an asset during the BTAM process.
Community partners with whom the organization has established a relationship (see Step 1) can be an asset during the BTAM process.
In non-imminent situations, organizations should determine whether notifying law enforcement is appropriate.
In non-imminent situations, determine if law enforcement notification is appropriate.
A multinational technology company queries prior contacts after customer-service threats, warns or restricts the customer, notifies the closest facility, and contacts law enforcement if the situation escalates.
When a threat is received, the BTAM team runs queries to identify previous contacts with the customer
At a nationwide healthcare network, when patients engage in problematic or concerning behaviors, a flag placed in the patient's digital record notifies staff.
When patients engage in problematic or concerning behaviors, a flag placed in the patient’s digital record notifies staff.
If the situation escalates, the tech company's team contacts law enforcement.
If the situation escalates, the team contacts law enforcement.
The healthcare network has its own law enforcement personnel ready to respond to imminent risk or crisis, or when criminal activity is suspected or identified.
The organization has its own law enforcement personnel ready to respond to situations of imminent risk or crisis or when criminal activity is suspected or identified.
Data Table 1 reports that the attacker stopped on their own and was then arrested at or away from the scene in 30% of all attacks (n = 50), 22% for current or former employees (n = 22), 37% for customers, clients, patients, and visitors (n = 19), and 35% for romantic partners and relatives (n = 9).
Sample (N = 50 | 22 | 19 | 9 by column) · Data Table 1 columns: all attacks 50 | employees 22 | customers, clients, patients, visitors 19 | partners and relatives 9
Arrested at/away from scene | 30% | 22% | 37% | 35%
Data Table 1 reports that law enforcement intervened in 18% of all attacks (n = 50), 23% of attacks by current or former employees (n = 22), 15% by customers, clients, patients, and visitors (n = 19), and 12% by romantic partners and relatives (n = 9).
Sample (N = 50 | 22 | 19 | 9 by column) · Data Table 1 columns: all attacks 50 | employees 22 | customers, clients, patients, visitors 19 | partners and relatives 9
Law enforcement intervened, then... | 18% | 23% | 15% | 12%
Data Table 1 reports that law enforcement intervened and the attacker was then arrested at or away from the scene in 4% of all attacks (n = 50), 0% for current or former employees (n = 22), 10% for customers, clients, patients, and visitors (n = 19), and 0% for romantic partners and relatives (n = 9).
Sample (N = 50 | 22 | 19 | 9 by column) · Data Table 1 columns: all attacks 50 | employees 22 | customers, clients, patients, visitors 19 | partners and relatives 9
Arrested at/away from scene | 4% | 0% | 10% | 0%
Data Table 1 reports that law enforcement intervened and killed the attacker in 14% of all attacks (n = 50), 23% for current or former employees (n = 22), 5% for customers, clients, patients, and visitors (n = 19), and 12% for romantic partners and relatives (n = 9).
Sample (N = 50 | 22 | 19 | 9 by column) · Data Table 1 columns: all attacks 50 | employees 22 | customers, clients, patients, visitors 19 | partners and relatives 9
Killed by law enforcement | 14% | 23% | 5% | 12%
Find the Perfect Training Class For You
