Threat Assessment: An Approach To Prevent Targeted Violence.

Series: NIJ Research in Action
Published: September 1995
14 pages
29,637 bytes
NCJ 155000

Threat Assessment: An Approach To Prevent Targeted Violence

by Robert A. Fein, Ph.D., Bryan Vossekuil, and Gwen
A. Holden
----------------------------------------------
Highlights

In the past 5 years, violent crimes involving
stalking, workplace violence, and attacks or
threatened attacks on public figures and officials
have been prominent in the news.  Law enforcement
and security professionals are turning to
prevention as an important component of control
strategy. This Research in Action discusses
operational and investigative tools and approaches
that can be effectively used to recognize,
evaluate, and manage the risks of targeted violence
before crimes occur. 

Of special interest:

o Threats of violence arise from feelings or ideas
that range from the mean-spirited to the messianic.
Sometimes a threat is backed by the will and
capacity to do harm; at other times, a voiced
threat may amount to nothing but emotional
"venting." However, violent acts can be committed
when no prior threat has been uttered. For law
enforcement and security officers, recognizing the
difference between "making" and "posing" a threat
is crucially important.

o Perpetrators of violence often have a traceable
history of problems, conflicts, disputes, and
failures. Violent behavior may be triggered by
these individuals' perception that it provides a
means to rectify or avenge an injustice or
wrongdoing. Targeted violence can be premeditated
or opportunistic when a situation arises that
facilitates or permits the violence or does not
prevent it from occurring.

o The first component of threat assessment case
management involves developing a plan that moves
the subject away from regarding violence as a
viable option. 

o Information about a subject's coping ability
during periods of great stress, including any
contemplated or attempted violence against others
or self, is of special interest in a threat
assessment investigation. Other behavioral data--
such as obsessive or undue interest in a potential
target, or efforts made to secure or practice with
weapons--also is helpful.

o Interviews of subjects should be considered as
part of the investi-gation's overall strategy. 
However, sometimes an interview may stimulate the
interest, and may even increase the desperation or
anxiety level, of a subject and thus could
precipitate violence when it may not have occurred
otherwise. 

o The target in a threat assessment case needs to
be evaluated in terms of vulnerability to attack,
job and personal lifestyle, fear of the subject,
and degree of sophistication with regard to the
need for caution.

o Documentation of data and consultation with
experts are key aspects in implementing a case
management strategy.

o A case can be considered for closing when the
subject is deemed to no longer be a threat. 
Questions should be asked regarding what changed
circumstances could trigger the subject to move
toward violent behavior.
------------------------------------------
About the authors

Robert A. Fein, Ph.D., a Visiting Fellow at the
National Institute of Justice, is a Consultant
Psychologist for the U.S. Secret Service; Bryan
Vossekuil is Assistant Special Agent in Charge,
Intelligence Division, U.S. Secret Service; and
Gwen A. Holden serves as Executive Vice President
of the National Criminal Justice Association.
On April 25, 1993, 25 abortion protesters gathered
at the Brookline home of a doctor who performed
abortions at the Preterm Health Services clinic on
nearby Beacon Street.
-----------------------------------------------
It was a Sunday afternoon, just a few weeks after
antiabortion activist Michael Griffin had gunned
down Dr. David Gunn at a Pensacola, Florida
abortion clinic. The protesters sensed that Gunn's
murder, the first in the abortion war, had somehow
changed the movement--a clear escalation of the
violence.

As Mary Schumacher, then the executive director of 
Operation Rescue in Massachusetts, led the group in
prayer, she described how Griffin could not be
"prolife" if he killed someone. She called Gunn's
death a "tragedy" and asked the protesters to pray
for him.

Just then one of the protesters--a young man with a
face twisted in anger--interrupted the prayer. "You
need a talking to," he said to Schumacher.

After the prayer, the man confronted Schumacher and
spoke about the failure of the Catholic Church to
fight hard enough against abortion. "How can you
say that Gunn's death was a tragedy? He was killing
the innocent. Griffin was a hero as far as I'm
concerned," Schumacher remembers the man saying,
his voice filled with rage.

"I remember it well, especially the part when he
said Griffin was a hero," said Schumacher,
referring to her 1993 encounter..."It was not the
kind of conversation you forget. I even alerted a
police officer that day about it. You could tell
the guy was not stable."
Boston Globe, 1/8/95 (emphasis added)

The man described in the Boston Globe article who
was reported to the police that day in 1993 was
John C. Salvi III. Less than a year later, on
December 30, 1994, Salvi allegedly opened fire on
the Preterm and Planned Parenthood clinics in
Brookline, Massachusetts, killing two and wounding
five persons. Salvi has been charged with
committing an act of "targeted violence," a term
that refers to situations in which an identifiable
(or potentially identifiable) perpetrator poses (or
may pose) a threat of violence to a particular
individual or group.

Increasingly, Americans have been confronted with
such incidents of targeted violence, both actual or
threatened. Behaviors characterized as "stalking,"
workplace violence, and attacks on public figures
and officials are frequently reported in the media.
Recently, those reports have concerned violent
attacks occurring in settings (such as health
clinics, schools, the workplace, or a Long Island
commuter train) where unsuspecting victims believed
themselves to be safe. Often the perpetrators of
these attacks are subsequently found to have given
advance notice of their violent inclinations. 

Investigative and operational techniques

Traditional law enforcement activities aim at
apprehending and prosecuting perpetrators of
violence after the commission of their crimes. In
most circumstances, the primary responsibility of
law enforcement professionals is to determine
whether a crime has been committed, conduct an
investigation to identify and apprehend the
perpetrator, and gather evidence to assist
prosecutors in a criminal trial. However, when
police officers are presented with information and
concern about a possible future violent crime,
their responsibilities, authority, and
investigative tools and approaches are less clear.
"Threat assessment" is the term used to describe
the set of investigative and operational techniques
that can be used by law enforcement professionals
to identify, assess, and manage the risks of
targeted violence and its potential perpetrators.  

"Making" versus "posing" a threat. Individuals
utter threats for many reasons, only some of which
involve intention or capacity to commit a violent
act. However, a person can present a grave threat
without articulating it. The distinction between
making and posing a threat is important:

o Some persons who make threats ultimately pose
threats.
o Many persons who make threats do  not pose
threats. 
o Some persons who pose threats never make threats.

Targeting the victim. Postponing action until a
threat has been made can detract attention from
investigation of factors more relevant to the risk
of violence, e.g, a potential perpetrator's
selection of possible targets. Data from two recent
studies suggest that at least some approachers--and
attackers--of public officials/figures show an
interest in more than one target. U.S. Secret
Service experience indicates that a number of
would-be Presidential assassins, such as Arthur
Bremer and John Hinckley, considered several
targets, and changed targets, before finally making
an attack. Data on relationship stalking murders
and workplace violence murders point to suicide, as
well as homicide, as a possible outcome. These
examples suggest that, in some cases, the
perpetrator may ultimately become his or her own
final target.

Legal sanctions  

The threat of sanctions, such as a long prison
sentence, may not deter a person who desperately
desires revenge or is prepared to die to achieve
his objective. Passage of enforceable laws that
define and prohibit behaviors that could presage
violent attacks is one important step in preventing
such attacks. Forty-nine States have passed
antistalking laws in the past 4 years, and the
National Institute of Justice, together with the
National Criminal Justice Association, published a
model antistalking law. Additionally, authorities
in some jurisdictions are reviewing various threat
and harassment laws to determine whether they might
apply to threat-of-violence situations. However,
laws by themselves are unlikely to prevent
stalking, workplace, or public figure-centered
violence, unless law enforcement and security
professionals know how to identify, evaluate, and
manage persons at risk of committing these violent
acts.

Fundamental principles of threat assessment

Notwithstanding the growing importance of threat
assessment for law enforcement and security
professionals, systematic thinking and guidance in
this area have been lacking. The law enforcement
and security communities currently do not have
clearly articulated processes or procedures to
steer their actions when they are made aware of
threat-of-violence subjects and situations. Without
guidelines for making threat assessments, otherwise
competent law enforcement professionals may be less
thoughtful and thorough than they might be in
handling such incidents. To fill the void, this
report presents four fundamental principles that
underlie threat assessment investigation and
management. They are followed by a model and
process for conducting comprehensive threat
assessment investigations.

o Violence is a process, as well as an act. Violent
behavior does not occur in a vacuum. Careful
analysis of violent incidents shows that violent
acts often are the culmination of long-developing,
identifiable trails of problems, conflicts,
disputes, and failures.

o Violence is the product of an inter-action among
three factors:

a) The individual who takes violent action. 
b) Stimulus or triggering conditions that lead the
subject to see violence as an option, "way       
out," or solution to problems or life situation. 
c) A setting that facilitates or permits the
violence, or at least does not stop it from
occurring.

o A key to investigation and resolution of threat
assessment cases is identification of the subject's
"attack-related" behaviors. Perpetrators of
targeted acts of violence engage in discrete
behaviors that precede and are linked to their
attacks; they consider, plan, and prepare before
engaging in violent actions.

o Threatening situations are more likely to be
successfully investigated and managed if other
agencies and systems--both within and outside law
enforcement or security organizations--are
recognized and used to help solve problems
presented by a given case. Examples of such systems
are those employed by prosecutors; courts;
probation, corrections, social service, and mental
health agencies; employee assistance programs;
victim's assistance programs; and community groups.

Functions of a threat assessment program

The three major functions of a threat assessment
program are: identification of a potential
perpetrator, assessment of the risks of violence
posed by a given perpetrator at a given time, and
management of both the subject and the risks that
he or she presents to a given target.

Identifying the perpetrator

The process of identifying a potential perpetrator
involves: (1) defining criteria that could lead to
a person becoming a subject of a threat assessment
investigation; (2) determining the areas within the
law enforcement or security organization that will
be responsible for receiving information about
possible subjects and conducting threat assessment
investigations; (3) notifying those individuals and
organizations that might come in contact with--or
know of--potential subjects about the existence of
a threat assessment program; and (4) educating
notified individuals and organizations about the
criteria for bringing a concern about potential
violence to the attention of investigators.

Assessing the risks

The second goal of a threat assessment program is
to evaluate the risks persons under suspicion may
pose to particular targets. Risk assessment
involves two primary functions: investigation and
evaluation.

Investigation. The primary objective of a risk
assessment investigation is to gather information
on a subject and on potential targets. Multiple
sources of information should be consulted to learn
about a subject's behavior, interests, and state of
mind at various points in time:

o Personal interviews with the subject.

o Material created or possessed by the subject,
including journals and letters, and materials
collected by the subject, such as books and
magazines, that may relate to the investigation.

o Persons who know or have known the subject,
including family members, friends, coworkers,
supervisors, neighbors, landlords, law enforcement
officers, social service or mental health staff,
and previous victims of unacceptable behavior
(including violence) committed by the subject.

o Record or archival information, including police,
court, probation, and correctional records; mental
health and social service records; and notes made
by those aware of the subject's interest in a
particular target, such as security personnel,
managers, victims, or colleagues.

Information about the subject. At the beginning of
a threat assessment investigation, it is important
to secure detailed descriptions of the subject's
behaviors and actions that prompted other persons
to notice the subject. The kinds of information
useful for threat assessment include data about
overwhelmingly or unbearably stressful experiences
and the subject's ability to cope at such times.
Behavioral data about the subject's motives,
intentions, and capacities is critical; of
particular importance is information about
attack-related behaviors: 

o The subject has expressed interest in possible
targets, including particular, identifiable
targets.

o The subject has communicated with or about
potential targets.

o The subject has considered and/or attempted to
harm self or others.

o The subject has secured or practiced with
weapons. 

o The subject has followed or approached potential
targets, either with or without weapons, at events
or occasions. 

Interviewing the subject. Whether to interview the
subject of a threat assessment investigation can be
a key question; the decision depends on several
factors:

o The investigator's need for information.
o The facts leading to initiation of investigation.
o The investigator's legal standing in relation to
the subject.
o The resources available to the investigator.
o The investigator's training and experience in
interviewing.
o The stage of the investigation.
o The investigator's strategy for resolving the
case.

A decision to interview a subject should be made on
the basis of case facts.  Generally, when there has
been face-to-face contact between subject and
target or the subject has communicated a threat to
the target, an interview is a good idea. An
interview under such circumstances may have several
goals. It may signal that the subject's behavior
has been noticed, permit the subject's story to be
related to a third party, gather information that
is the basis for corroboration, and provide an
opportunity for communicating that the subject's
behavior is unwelcome, unacceptable, and must
cease.

Any interview is a vehicle for gathering
information about the subject that can be used to
assess the threat that a subject poses and to
manage that threat. Therefore, threat assessment
interviews are most productive if they are
conducted respectfully and professionally. The task
of the investigator is twofold: to gather
information about the subject's thinking, behavior
patterns, and activities regarding the target(s)
and to encourage change in the subject's behavior.
By showing an interest in the subject's life that
is neither unduly friendly nor harsh, an
investigator can increase the likelihood of the
interview's success.

In some cases, however, an interview may intensify
the subject's interest in the target or increase
the risk of lethal behavior. For example, a subject
who has written a letter to a celebrity professing
undying love and formally proposing marriage, but
who has engaged in no other known behavior in
relation to the celebrity, may have his or her
interest stimulated by an interview. Without an
interview, the subject's interest may dissipate.
Similarly, a desperate and suicidal subject,
self-perceived as having been abandoned, who has
been stalking a former partner, may sense that time
is running out and be prompted by an interview to
engage in more extreme behavior before "they put me
away." In such a circumstance, the investigator may
need to  expend additional resources, perhaps
increasing security for the target, arranging
hospitalization or arrest of the subject, or
monitoring or surveilling the subject.  Subject
interviews, therefore, should be considered and
conducted within the context of overall
investigative strategy. 

Information about the target. A man who, over days
and weeks, has been following a secretary whom he
met once, but with whom he has no relationship,
appears to have picked out a potential target. An
employee, fired by a manager whom he blames for
discriminating against him and causing the breakup
of his family, has told former coworkers that he
will "get even"; once again, a potential target
appears to have been selected. To prevent violence,
the threat assessment investigator requires
information on the targeted individual. Relevant
questions about the target might include:

o Are potential targets identifiable, or does it
appear that the subject, if considering violence,
has not yet selected targets for possible attack? 

o Is the potential target well known to the
subject? Is the subject acquainted with a targeted
individual's work and personal lifestyle, patterns
of living, daily comings and goings? 

o Is the potential target vulnerable to an attack?
Does the targeted individual have the resources to
arrange for physical security? What might change in
the target's lifestyle or living arrangements that
could make attack by the subject more difficult or
less likely, e.g., is the targeted individual
planning to move, spend more time at home, or take
a new job?

o Is the target afraid of the subject? Is the
targeted individual's degree of fear shared by
family, friends, and/or colleagues? 

o How sophisticated or naive is the targeted
individual about the need for caution?   How able
is the individual to communicate a clear and
consistent "I want no contact with you" message to
the subject?

Evaluation

A 2-stage process is suggested to evaluate
information gathered about the subject and the
potential target(s). In the first stage,
information is evaluated for evidence of conditions
and behaviors that would be consistent with an
attack. The second stage of evaluation seeks to
determine whether the subject appears to be moving
toward or away from an attack. After analyzing the
available data, the threat assessor is left with
these questions:

o Does it appear more or less likely that violent
action will be directed by the subject against the
target(s)? What specific information and reasoning
lead to this conclusion? 

o How close is the subject to attempting an attack?
What thresholds, if any, have been crossed 
(e.g., has the subject violated court orders, made
a will, given away personal items, expressed
willingness to die or to be incarcerated)?

o What might change in the subject's life to
increase or decrease the risk of violence?  What
might change in the target's situation to increase
or decrease the risk of violence?

Case management

The first component of threat assessment case
management involves developing a plan that moves
the subject away from regarding violence against
the target as a viable option. Such a plan is
likely to draw on resources from systems within the
threat assessment unit's parent organization, as
well as those outside it. The second component is
plan implementation. The best developed and
supported case management plan will be of little
use in preventing violence if the plan is not
implemented and monitored. The plan must remain
flexible to accommodate changes in the subject's
life and circumstances. The final management
component is formal closing of the case.

Case plan development. Once an evaluator determines
that a given subject presents a risk of violence to
a targeted individual, the next task is to develop
a plan to manage the subject and the risk. The
evaluator then proceeds to identify those internal
and external systems that may be helpful in
managing the problems presented by the subject. In
certain situations, such as those in which the
subject has been stalking an identifiable target in
a jurisdiction that has an enforceable and
effective anti-stalking law, the best way to
prevent violence and minimize harm to the targeted
individual may be to prosecute the case vigorously.
A good relationship between threat assessment
investigators and prosecutors can influence the
priority assigned to the case and the extent to
which prosecutorial and judicial processes
facilitate its resolution. Such relationships also
may affect the court's disposition of the case,
including sentencing of a convicted offender.

Even conviction and imprisonment, however, do not
guarantee that the target will be safe from the
subject. If the subject has been unable or
unwilling to let go of the idea of a relationship
with the target, or if the subject attributes the
pains and misfortunes of his or her life to the
targeted individual, it may make sense to consider
strategies by which the subject is encouraged to
change the direction, or intensity, of his
interest. A subject engaged in activities that
bring success and satisfaction is less likely to
remain preoccupied with a failed relationship.
Family, friends, neighbors, or associates may play
a role in suggesting and supporting changes in the
subject's thinking and behavior. In addition,
mental health and social service staff may be of
great assistance in aiding the subject to formulate
more appropriate goals and develop skills and
strengths that are likely to result in life
successes. 

At least one aspect of a case management plan
concerns the target. If the subject is to be
prohibited from contact with the target, the target
needs to understand what to do (i.e., whom to call
and how to contact the official handling the case)
if the subject initiates direct or indirect
contact. 

Case management implementation. The most carefully
crafted plan will have little effect if it remains
in the investigator's files and is not translated
into action.

Although no procedures or techniques can guarantee
that a subject of comprehensive threat assessment
will not attempt violent action toward a target,
two activities are known to help reduce the risk of
violence, and, in the instance of a bad outcome,
assist the threat assessment team in any
post-incident review. 

First, documentation of data and reasoning at every
stage of a threat assessment investigation is
essential. Undocumented or poorly documented
information-gathering and analysis are suspect in
and of themselves, and they provide little
foundation for review or for efforts to learn from-
-and improve on--experience. Without clear
documentation, investigators are left with only
their recollections, which can be both partial and
faulty and are subject to criticism as
retrospective reconstruction. A carefully and
comprehensively documented record may be criticized
for imperfect data-gathering or flawed analysis,
but such a record also demonstrates both
thoughtfulness and good faith--critical questions
in any postincident review. 

Second, consultation at every major stage of the
threat assessment process can be a significant case
management tool. Consultants may be members of the
threat assessment unit or external experts. To be
effective, a consultant should be knowledgeable in
areas relevant to the case and be known and trusted
by the investigators. For example, in a case where
a subject has a history of diagnosed mental
disorders and the primary investigator is
unfamiliar with mental health language and concepts
used in the records, an expert in psychology or
psychiatry can provide invaluable insight and
advice.

In addition to providing special expertise,
consultants may notice and ask about questions in a
case that remain to be explored or answered. Even
proficient investigators are occasionally
vulnerable to "missing the forest for the trees." 
A consultant, such as a fellow threat assessment
specialist who has not been involved with the case,
may offer a comment that can redirect or sharpen an
ongoing investigation. In the event of a bad
outcome, use and documentation of consultant
expertise may demonstrate that the threat
assessment team sought additional perspectives and
ideas and did not get stuck with "tunnel vision."

Closing the case. The final task of threat
assessment case management is closing the case.
When a threat assessor determines that the subject
has moved far enough away from possible violent
action toward the target to no longer cause
appreciable concern, the case can be considered for
closing. At this time, it may be important to ask:

o What has changed in the subject's life that
appears to lessen the likelihood that the subject
is interested in or will attempt violent action
toward the target?

o Which components of the case management plan
seemed to affect the subject's thinking or capacity
to initiate violent action, and to what extent?

o What life circumstances might occur that would
again put the subject at increased risk of
contemplating, planning, or attempting violent
action toward the original target or other
potential targets?  

o Are there supports in place (or that can be
developed) that will be known and available to the
subject at a future time when the subject is again
at risk of moving toward violent behavior?

While social commentators and analysts may debate
the myriad reasons that lead to growing national
concern about targeted violence, law enforcement
and security organizations are increasingly being
called on to examine individual situations and make
judgments and determinations about the risks of
violence that one person might present to an
identifiable target. In cases related to stalking
behaviors, workplace violence, attacks on public
officials and figures, and other situations where
targeted violence is a possibility, comprehensive
and carefully conducted threat assessment
investigations can safeguard potential targets,
deter potential attackers, and serve the public.

Notes

1. Dietz, P.E. and D.A. Martell, "Mentally
Disordered Offenders in Pursuit of Celebrities and
Politicians," National Institute of Justice,
Washington, D.C., 1989, 83-NI-AX-0005; Dietz, P.E.,
D.B. Matthews, D.A. Martell, T.M. Stewart, D.R.
Hrouda and J. Warren, "Threatening and Otherwise
Inappropriate Letters to Members of the United
States Congress," Journal of Forensic Sciences, 36
(September 5, 1991):1445-1468; Dietz, P.E., D.B.
Matthews, C. Van Duyne, D.A. Martell, C.D.H. Parry,
T.M. Stewart, J. Warren and J.D. Crowder,
"Threatening and Otherwise Inappropriate Letters to
Hollywood Celebrities," Journal of Forensic
Sciences, 36 (January 1, 1991):185-209; and Fein,
R.A. and B. Vossekuil, "The Secret Service
Exceptional Case Study Project: An Examination of
Violence Against Public Officials and Public
Figures," National Institute of Justice, study in
progress, 92-CX-0013.

2. For example, both Thomas McIlvane, in the Royal
Oak, Michigan post office attack, and Alan
Winterbourne, in the Oxnard, California
unemployment office attack, killed themselves.

3. National Criminal Justice Association, Project
to Develop a Model Anti-Stalking Code for States,
National Institute of Justice, Washington, D.C.,
1993.

The National Institute of Justice is a component of
the Office of Justice Programs, which also includes
the Bureau of Justice Assistance, Bureau of Justice
Statistics, Office of Juvenile Justice and
Delinquency Prevention, and the Office for Victims
of Crime.

Points of view in this document are those of the
authors and do not necessarily reflect the official
position of the U.S. Department of Justice.