Yesterday, in Act #9, I outlined the Hillard Heintze team’s intimate familiarity with both threat assessment techniques and their integration with social media and open-source monitoring – and committed this program to serving as a leader in bringing the benefits of these capabilities to our schools.

Very few experts understand these analytical methods and intervention strategies.  In fact, to accomplish this, our five-step threat detection and analysis process is guided by three fundamental principles – principles that now stand as the leading edge of a 145-year investment on the part of the U.S. Secret Service to understand, anticipate and counter the threat of assassination to the U.S. President and other government leaders.  These strategic principles, which are based upon groundbreaking research conducted by the Secret Service in the area of targeted violence, include the following:

  • Targeted violence is the result of an understandable and often discernible process of thinking and behavior.
  • Violence stems from an interaction among the potential attacker, past stressful events, a current situation and the target.
  • A potential attacker’s behavior is vital to identifying his or her intentions.  The attacker’s thinking, planning and logistical preparations have to be detected and interrupted.

6 Threat Assessment Tenets

Just how are these core principles and other traditional threat assessment tenets best applied to social media and open-source threat monitoring for targeted violence prevention in schools?  Here are some examples:

  1. Traditional Threat Assessment Tenet:  People generally don’t just snap prior to committing targeted violence.  Targeted violence is often preceded by an attack pathway that involves planning.  Implications for Open-Source Threat Discovery:  Pre-attack planning is often observable and possibly detectable if you know what to look for and much of that planning likely takes place online.  Would-be attackers who use the Internet to research or plan an attack often unwittingly leave an electronic evidence trail that points directly to them.  Online search must target the deepest segments of the World Wide Web.  Driving this search isn’t just a matter of selecting the right key words and search terms.  It’s also a matter of understanding behaviors and how these typically manifest themselves in an online environment.
  2. Traditional Threat Assessment Tenet:  Most attackers do not make direct threats to the target.  Implications for Open-Source Threat Discovery:  Though the threats may not be received by the targets, the threats or other ominous warnings that reveal the subject’s intent may be posted to different websites.
  3. Traditional Threat Assessment Tenet:  Those who attack innocent victims in mass violence scenarios often communicate their intentions to others, including friends, family, co-workers and, increasingly, to a web audience via Internet postings.  Implications for Open-Source Threat Discovery:  Individuals with extremist and violent views often turn to the web to find the camaraderie and support only those peers with the same views can provide.  In the online environment, this communication of attack-related intent, in some cases, takes the form of a posting on a social media platform.
  4. Traditional Threat Assessment Tenet:  Pre-attack communications can be direct or indirect, and their meaning may only become apparent when tied in with other facts of the case.  Implications for Open-Source Threat Discovery:  The autonomy of the Internet allows individuals to assume different personas depending on the position or opinion they want to express.  Critical to the monitoring’s success is the ability to proactively search and retrieve this open-source data, connect the dots across the various web domains, information silos, presumed identities and aliases and understand the inferences.
  5. Traditional Threat Assessment Tenet:  There is a difference between someone making a threat and actually posing one.   Often individuals will make statements (e.g., “I could kill Jack Smith”) yet have no intention of ever carrying them out – and would never take any steps to advance such a plot.  Implications for Open-Source Threat Discovery:  We recognize this, and conduct searches that seek to identify such statements, without prematurely flagging that individual as a severe threat.  We do, however, flag for immediate and serious consideration those cases which, by statements and actions, individuals appear to be developing or taking steps to execute an attack plan.
  6. Traditional Threat Assessment Tenet:  Prior to an incident, many  subjects display attack-related behaviors, which may include exhibiting an interest in assassination; stalking or attempting to approach the target; making plans to conduct an attack; attempting to acquire a weapon; or practicing with a weapon.  Implications for Open-Source Threat Discovery:  Every single one of these attack-related behaviors can be carried out online – from researching various types of school-related attacks, using online information to facilitate stalking or online stalking itself to planning the attack and even facilitating the purchase of weapons through the Internet.

Monitoring Long-Term Behavior

Since attackers can plan for years before committing a violent act, or totally abandon the idea altogether, long-term monitoring of behavior must occur.  Such rigor requires sophisticated analytic applications that can take in information; monitor it for changes and alert analysts when patterns develop.  This is a function that government understands when it comes to potential terrorism, but has not made available to our schools to protect our children. Therefore, today – and building on our commitment yesterday – our Act #10 is to provide schools with

  • Social media discovery of individuals presenting pre-attack behaviors so we can implement actions and strategies to eliminate or mitigate attacks.
  • Monitoring of social media traffic after targeted violence events for supportive, sympathetic or threatening posts that could identify a potential attacker and support a successful intervention.
  • Development of a data collection system that bridges the gap between schools and law enforcement that places actionable information into the hands of decision makers.
  • Education on social media discovery in a way that is both effective in advancing targeted violence prevention and also respectful of privacy, individual liberties and rights.
  • Providing these services at little to no costs to schools.


9 critical questions to guide your approach to online harassment