52 SHERIFF & DEPUTY | JULY/AUGUST 2016

On July 16, 2015, a gunman opened fire on two military 

installations in Chattanooga, Tennessee, killing four 

Marines and a sailor. The offender first targeted a recruiting center in a strip mall, where he fired shots from 

his vehicle before fleeing. He then drove to a naval reserve center, 

where he crashed through the security gate, exited his vehicle, and 

continued his assault until he was shot and killed by officers from the 

Chattanooga Police Department. Beyond the families and friends of 

those immediately affected and the first responders, this incident also 

affected the surrounding community and the nation as a whole.

Federal facilities, such as those in Chattanooga, are located 

throughout the United States. Although the targeting of these 

facilities is rare in comparison to other types of violence, safeguarding 

government personnel and individuals conducting business at these 

sites is a priority. Often, the public turns to law enforcement for inLocal law enforcement plays a 

vital role in threat assessments, 

early intervention 

By Michelle Keeney, J.D., Ph.D., 

and Lina Alathari, Ph.D. 

PREVENTING VIOLENT ATTACKS ON

GOVERNMENT FACILITIES 

AND PERSONNEL

0716_NSA.indd 52 6/24/16 3:06 PM
SHERIFF & DEPUTY | JULY/AUGUST 2016 53

formation about what steps are being taken to prevent these tragedies.

The U.S. Secret Service has a particular stake in preventing incidents of targeted violence toward government officials, facilities, and 

sites. In December 2015, the agency’s National Threat Assessment 

Center published Attacks on Federal Government 2001–2013: Threat 

Assessment Considerations, a report that studied 43 attacks targeting 

federal government facilities and officials that occurred between 

2001 and 2013. More than half of the attacks occurred outside of the 

Washington, D.C., metro area, affecting communities in 15 states. 

In these incidents, almost two-thirds of the attackers selected 

targets within 25 miles of their homes. Further, the offenders targeted 

not only federal buildings, but also federal officials at their private residences, federally funded university research labs, and federal agencies 

with offices in commercial buildings and shopping centers. 

THE IMPORTANCE OF COLLABORATION 

The majority of the attackers had previously come to the attention 

of law enforcement for a variety of criminal activities, ranging from 

minor infractions to arrests for violent crimes. These findings highlight the importance of involving local law enforcement and local 

communities in prevention efforts, even when the federal government is the target.

Prevention efforts are more effective when community partners 

collaborate to include law enforcement, behavioral and mental health 

services, social services, local citizens, and others. Although local 

law enforcement plays a critical part in averting violent activity, we 

understand that each partner has a different role in identifying individuals who are exhibiting behaviors of concern and intervening early 

to address these concerns. This is particularly true in preventing acts 

of targeted violence in which a public official, government facility, or 

public venue is selected in advance. 

COMMUNITY-BASED THREAT ASSESSMENT AND 

ITS ROLE IN PREVENTION

Often, we are asked whether there is a checklist of warning behaviors to identify those at risk of engaging in targeted violence. More 

specifically, are there warning behaviors separate from activities 

related to planning—acquiring or manufacturing weapons, conducting surveillance, or using deceptive practices to avoid detection? With 

this in mind, our study sought to identify any additional concerning 

behaviors offenders exhibited prior to their attacks. 

Although we found that all but one of the offenders engaged in some 

sort of concerning behavior, these behaviors were not always suggestive 

of someone being at risk of engaging in violence. They did, however, 

indicate that the individuals were experiencing some level of distress, and 

for half of them, their behavior elicited concern in others. These findings 

highlight the importance of more broadly identifying individuals who 

exhibit concerning behavior and developing intervention strategies that 

may divert them from considering violence as an option. 

As law enforcement professionals, we rely on others to share information with us about a person or situation of concern, and to work 

with us to develop intervention strategies. One way we can enhance 

our efforts in this area is by encouraging the development of effective, 

local behavioral and/or assessment programs. 

Although law enforcement plays a critical role in these programs, 

preventing acts of targeted violence requires the collaboration and 

efforts of the entire community. These partnerships may include 

working with representatives from federal offices in your districts, so 

they know with whom to share information and what community 

resources are available to them.

Partnering with others and sharing information helps us do the 

following: 

1) Identify concerning behaviors and the settings in which they occur.

The concerning behaviors exhibited by the offenders in the study 

ranged from actions and statements that caused low levels of worry in 

someone who knew the individual, to behaviors and comments that 

elicited alarm and fear. For example, the offenders made disturbing 

comments and posted bizarre content online, exhibited subtle or 

dramatic changes in behavior, experienced interpersonal difficulties 

and conflicts, stalked or harassed others, and engaged in final-act 

behaviors, such as leaving goodbye messages, giving away belongings, 

and emptying bank accounts. 

These behaviors occurred in a variety of contexts to include schools, 

places of employment, mental health settings, and public venues. 

The offenders also exhibited the behaviors over the course of time, 

ranging from actions and statements that occurred decades earlier to 

those that occurred in the hours before they executed their attacks. 

These findings emphasize the importance of broadly outlining what 

behaviors should elicit concern in various settings to encourage others 

to recognize activities that warrant attention.

 2) Set a low threshold for the reporting of concerning behaviors to those 

with the authority and capacity to intervene. Often, the reporting of information on an individual who elicits concern will not be directed toward 

law enforcement, particularly for those behaviors that are less concerning. 

For those situations, there may be more appropriate channels where 

information could be directed, such as mental health professionals, 

human resources representatives, school administrators, and others. 

Even so, as law enforcement agencies, we can work with others 

in the community to understand more about the behaviors they see 

An improvised device blasted the entrance to the U.S. Armed Forces Career Center, a joint-service recruiting 

station located in Times Square. The blast caused no injuries; however, glass in the office’s front door and 

window was shattered by the explosion, and the door’s metal frame was bent. The busy recruiting office is 

singularly located on a triangular island in the center of the iconic Manhattan intersection and has been the 

site of periodic anti-war protests.

Photo courtesy of the U.S. Secret Service National Threat Assessment Center

0716_NSA.indd 53 6/24/16 3:06 PM
54 SHERIFF & DEPUTY | JULY/AUGUST 2016

in various settings, and to identify those behaviors that should be 

reported to us for appropriate investigation and action. For example, 

observations of an employee’s declining work performance may be 

referred to a company’s human resources department. If, however, the 

employee makes references to harming coworkers, law enforcement 

should be contacted for appropriate follow-up. 

 3) Gather information from multiple sources about any concerning behaviors the individual has exhibited. If the person is brought to your attention and you initiate an investigation, you can gather information 

by interviewing the individual of concern, friends, and family, and 

those who come into contact with the individual in the community. 

In particular, look for evidence of changes in the person’s behavior. 

At times, these changes may be subtle. For example, the individual may have generally been considered a loner, but in the last 

few months, the person may have become even more isolated. 

Another illustration is when those close to an individual who has 

held anti-government views for many decades notice that his or her 

rhetoric is becoming increasingly violent. 

Also, gather information on whether the individual’s concerning behaviors are related to a preoccupation the individual may 

have on a specific person or cause, whether the preoccupation has 

significantly impacted his or her life, or if the person has depicted 

the object of his or her fixation in increasingly positive or negative 

ways over time. 

 4) Evaluate the information gathered and identify appropriate interventions to mitigate the risk. Interventions can be quite varied and 

should be tailored to address each behavior or situation of concern. 

This may include helping the individual connect with appropriate 

support systems, access needed services, receive mental health treatment, and apply for benefits to reduce financial stress. 

At times, the intervention may also require arrest or detention if imminent concerns about safety exist, and/or there is evidence of a criminal violation. The primary goal of all of these efforts is to ensure the 

safety of the individual and the community, and each community’s approach will vary based on the available resources. Regardless of whether 

the individual’s behaviors generate obvious concern (e.g., threats of 

violence) or are more subtle, they warrant some type of intervention to 

mitigate negative consequences for that individual and others.

UNDERSTANDING MENTAL HEALTH SYMPTOMS 

AND STRESSORS

As part of the study, we examined additional aspects of the offenders’ 

backgrounds to include any histories of mental health symptoms and 

exposure to stressors. We found symptoms of paranoia, delusional 

beliefs, and depressive symptoms were most common. 

Increasingly, law enforcement professionals are tasked with 

interviewing and managing individuals experiencing mental health 

symptoms. These individuals have either engaged in a criminal act, or 

someone is concerned that they may be at risk of doing so. Although 

most law enforcement officers are not trained mental health providers, we can take steps to gather detailed information about an 

individual’s symptoms and the impact these symptoms have on his or 

her thinking and behavior. 

In a threat assessment context, our goal is not to perform a mental 

health evaluation or determine whether an individual meets the 

The majority of the attackers had 

previously come to the attention 

of law enforcement for a variety of 

criminal activities, ranging from 

minor infractions to arrests for violent 

crimes. These findings highlight the 

importance of involving local law 

enforcement and local communities 

in prevention efforts, even when the 

federal government is the target.

TAKEAWAYS

Local law enforcement plays a vital role in partnering with 

federal departments and agencies, as well as others in 

their jurisdictions, to prevent violence directed toward the 

federal government. This includes working within their 

communities to:

• Identify persons exhibiting concerning behaviors;

• Report concerns to a person with the authority to intervene; 

• Gather information; 

• Investigate whether the person is experiencing symptoms of mental illness or stressors, and if so, their 

impact on the person’s thinking and behaviors; and

• Identify appropriate interventions. 

ADDITIONAL RESOURCES

Over the last 15 years, the U.S. Secret Service National 

Threat Assessment Center has researched, trained, and 

provided consultation on the prevention of targeted 

violence in various contexts, including workplaces, K-12 

schools, colleges and universities, and government 

agencies. For the complete report referenced in this 

article, Attacks on Federal Government 2001-2013: Threat 

Assessment Considerations, and other publications 

and resources, visit our website at secretservice.gov/

protection/ntac. 

0716_NSA.indd 54 6/24/16 3:06 PM
SHERIFF & DEPUTY | JULY/AUGUST 2016 55

criteria for a psychiatric diagnosis. Rather, our aim is to understand 

what symptoms the person is experiencing, how these symptoms 

may influence his or her behavior, and whether they may impact the 

person’s decision to carry out an attack.

We also found that offenders who experienced stressors in more 

areas of their lives were more likely to carry out attacks that caused 

or could have caused serious harm to others. These included family or 

relationship problems, interactions with the criminal justice system, 

occupational or educational difficulties, civil actions, and other issues 

such as health problems, financial difficulties, and changes in living 

situation. This highlights the importance of identifying past and current stressors across various parts of the person’s life and their impact 

on the individual. 

Michelle Keeney, J.D., Ph.D., is the chief of the National Threat Assessment 

Center (NTAC). She directs the center’s current activities, develops plans for 

its future work, and consults with other offices in the agency on mental health 

topics and behavioral and social science research. Lina Alathari, Ph.D., is a 

supervisory research psychologist with NTAC, where she conducts research 

on threat assessment and cases of targeted violence. Alathari also oversees 

NTAC’s training and consultation program, which has provided guidance to U.S. 

government agencies, international security agencies, schools, and businesses. 

0716_NSA.indd 55 6/24/16 3:06 PM