DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | i

COVER
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | i

U.S. Department of Homeland Security

U.S. Secret Service

National Threat Assessment Center (NTAC)

December 2015

This publication is in the public domain. Authorization to reproduce this publication in whole or in part is 

granted. While permission to reprint is not necessary, when quoting, paraphrasing, or otherwise referring 

to this report, the citation should be: National Threat Assessment Center. (2015). Attacks on federal 

government 2001-2013: Threat assessment considerations. Washington, DC: U.S. Secret Service, 

Department of Homeland Security.

Cover photo of the White House is courtesy of the U.S. Secret Service Forensic Services Division; the photo of the U.S. Capitol is 

courtesy of the Architect of the Capitol; and the photo of the U.S. Supreme Court is by Alex Demas, U.S. Geological Survey.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | ii

EXECUTIVE SUMMARY

nsuring the continuous operation of government and the safety of the personnel and citizens who enter 

government facilities on a daily basis is an essential part of securing our homeland. To enhance 

prevention efforts in this area, the U.S. Secret Service National Threat Assessment Center studied 43 

attacks targeting federal government facilities and officials that occurred between 2001 and 2013 in the United 

States. These attacks bear an unfortunate resemblance to incidents of violence we see occurring in schools, 

colleges and universities, workplaces, and other public venues across the country. For example, most of the 

attacks were committed by lone actors, involved the use of firearms, and ended without law enforcement 

intervention. Further, although the offenders directed their attacks toward federal sites and officials, at times, the 

indiscriminant nature of their violence affected individuals who happened to be conducting business at

government sites, attending government functions, or working in buildings shared with government personnel. 

This report builds on existing best practices that the U.S. Secret Service has established in the field of threat 

assessment by offering considerations for investigations, security practices, and other types of mitigation 

strategies to reduce the risk of incidents of targeted violence. Based on open source research, the findings of the

study encourage investigators and others with a role in public safety to:

 Identify concerning behaviors, encourage reporting, and identify appropriate interventions. All but 

one of the offenders exhibited concerning behavior, while almost two-thirds elicited concern from others 

about their own safety or the safety of others. The behaviors varied and included making disturbing 

communications, exhibiting sudden or dramatic changes in behavior, and experiencing interpersonal 

difficulties. The behaviors did not necessarily indicate that the offender was planning an attack, but they 

did demonstrate that the person was struggling in some way. Investigators are encouraged to look for a 

broad range of concerning behaviors, bring together information from multiple sources, and work with 

others to identify various intervention points.

 Ask detailed questions to explore the link between mental health symptoms and an individual’s 

motive and behavior. Over half of the offenders experienced one or more mental health symptoms, to 

include paranoia, depressive symptoms, delusions, suicidal thoughts, disorganized or odd thinking and/or 

behavior, and hallucinations. For just under one-quarter of the offenders, these symptoms influenced 

their motives in some way. A comprehensive investigation includes gathering detailed information about 

an individual’s mental health symptoms, how they affect his or her behavior, whether the person views 

violence as an option to solving his or her problems, and whether their symptoms may influence their 

motive to carry out an attack. Investigators can approach gathering information about mental health 

symptoms with the same probing and critical mindset that they use in other areas of their investigations.

 Recognize stressors, assess their impact, and examine options for managing them. Over threequarters of the offenders experienced stressful events in the year prior to their attacks. These stressors 

were most frequently related to the offenders’ immediate family or romantic partners, criminal charges, 

their work or professional life, and actions in civil court. Investigators are encouraged to identify stressful 

E
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | iii

events in all areas of the person’s life – both past and present, how he or she has coped with these 

events in the past, how the person is handling any current stressors, and what options are available to 

provide assistance to the person to mitigate the stress. 

 Identify diverse sources of information, including records, interviews, and online searches. Many

of the offenders had previous contact with the judicial system, an educational system (high school or 

beyond), one or more employers, or law enforcement. All of these systems can provide vital information 

to a threat assessment investigation. However, formal records from these systems may either be 

unavailable or incomplete, thus requiring investigators to be creative in identifying information sources 

and following investigative leads. Interviews and online searches can supplement the information found 

in formal records.

 Develop physical security plans that extend beyond the building perimeter. Almost three-quarters 

of the offenders initiated their attacks outside of a facility, while three incidents occurred at security 

checkpoints inside the targeted building. Only one offender breached a security protocol before initiating 

his attack. These findings highlight the importance of exploring ways to harden security checkpoints, 

extend the security perimeter around the site or facility, and identify ways to enhance the safety of 

security personnel. Further, consideration should be given to establishing protocols to identify and 

address suspicious behavior. This may include communicating risks to personnel in order to encourage

them to be aware of their surroundings and to safeguard their personal information.

In addition to outlining several important operational considerations, this report describes the incidents and the 

offenders who executed the attacks. A few highlights of these findings include: 

 Targeting. All three branches of government were targeted, with the executive branch attacked most 

frequently. The incidents occurred in 15 states and the District of Columbia. In nearly three-quarters of 

the incidents, the offenders carried out the attacks either against or at federal facilities, with only onequarter targeting specific public officials.

 Planning and Pre-Attack Behaviors. The offenders engaged in various planning behaviors, including 

attempted or successful weapons acquisition and manufacturing; practicing with a weapon; researching 

targets; conducting surveillance on or approaching targets; and using deceptive practices to hide their 

activities and avoid detection.

 Execution of Attacks. Firearms were used most often, followed by the mailing of incendiary devices or 

items contaminated with chemical or biological materials. Even though over half of the firearm attacks

resolved in less than one minute, three incidents lasted over an hour. In only one incident was there 

evidence that a security protocol was breached. In nearly half of the incidents, the offenders

indiscriminately targeted persons present at the site. These included five mass casualty attacks in which 

both lone and group actors employed various weapons to carry out their attacks.

 The Offenders. The offenders ranged in age from 20 to 81. The offenders chose their targets for a 

variety of reasons, to include retaliation, the furtherance of ideological beliefs, personal gain, and seeking 
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | iv

fame or attention. Almost half of the offenders exhibited evidence of having a fixation, defined as, an 

intense or obsessive preoccupation with an individual, activity, or idea. Over half of the offenders had 

previously been arrested or faced criminal charges and over half had acted violently toward others. 

Further, nearly half of the offenders communicated to others about the target or communicated directly 

with their targets. One-third of the offenders made threats or veiled references of harming their targets, 

via online postings, verbal comments, personal manifestos, letters, and other means. Only three 

offenders communicated threats directly to their targets. In all three of these cases, the offenders 

communicated the threats verbally and in-person to the targets.

The operational considerations and findings of this report have broad utility for law enforcement and others 

engaged in preventing these kinds of attacks in our communities. In particular, they highlight the importance of 

engaging in early intervention with individuals who elicit concern before they begin to view violence as an option 

to solve their problems. Early intervention allows for more entities to have a role in providing support to the 

person of concern and managing the situation, affords more time to intervene, and provides greater flexibility with 

what intervention options are available.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | v

TABLE OF CONTENTS

INTRODUCTION...............................................................................................................................................................1

PART ONE: OPERATIONAL CONSIDERATIONS FOR THREAT ASSESSMENT...................................................4

IDENTIFY CONCERNING BEHAVIORS, ENCOURAGE REPORTING, AND IDENTIFY APPROPRIATE INTERVENTIONS...................5

ASK DETAILED QUESTIONS TO EXPLORE THE LINK BETWEEN MENTAL HEALTH SYMPTOMS AND AN INDIVIDUAL’S MOTIVE 

AND BEHAVIOR ........................................................................................................................................................................8

RECOGNIZE STRESSORS, ASSESS THEIR IMPACT, AND EXAMINE OPTIONS FOR MANAGING THEM .....................................10

IDENTIFY DIVERSE SOURCES OF INFORMATION, INCLUDING RECORDS, INTERVIEWS, AND ONLINE SEARCHES..................12

DEVELOP PHYSICAL SECURITY PLANS THAT EXTEND BEYOND THE BUILDING PERIMETER .................................................14

PART TWO: OVERVIEW OF THE ATTACKS.............................................................................................................16

TARGETS...............................................................................................................................................................................17

Attacks on Federal Buildings, Facilities, and Offices.........................................................................................18

Attacks on Public Officials ........................................................................................................................................20

LOCATIONS............................................................................................................................................................................21

MOTIVES................................................................................................................................................................................23

PLANNING AND PRE-ATTACK BEHAVIORS...........................................................................................................................25

Evidence of Planning Behaviors Among Lone Actors.......................................................................................25

Evidence of Planning Behaviors Among Groups ................................................................................................26

EXECUTION OF THE ATTACKS...............................................................................................................................................28

Firearms..........................................................................................................................................................................28

Mailings...........................................................................................................................................................................30

Explosives......................................................................................................................................................................33

Arsons and Incendiary Devices ...............................................................................................................................34

Airplanes ........................................................................................................................................................................35

PART THREE: BACKGROUNDS OF THE OFFENDERS..........................................................................................36

CONCERNING BEHAVIORS ....................................................................................................................................................40

FIXATIONS .............................................................................................................................................................................42

MENTAL HEALTH HISTORIES................................................................................................................................................43

Symptoms and Diagnoses.........................................................................................................................................43

Influence of Mental Health Symptoms on Motive ................................................................................................44

CONTACTS WITH SYSTEMS...................................................................................................................................................48

PRIOR COMMUNICATIONS RELATED TO THE TARGET .........................................................................................................50

PART FOUR: APPENDICES.........................................................................................................................................53

APPENDIX A: LIST OF INCIDENTS .........................................................................................................................................54

APPENDIX B: LIST OF TARGETS...........................................................................................................................................59

Federal Facilities, Buildings, and Offices ..............................................................................................................59

Federal Officials............................................................................................................................................................60

APPENDIX C: TIMING OF 35 FEDERAL ATTACKS (EXCLUDES MAILINGS) ..........................................................................61

APPENDIX D: STATISTICAL TABLES FOR ANALYSIS OF SERIOUS ATTACKS......................................................................62

APPENDIX E: COMPARISON WITH PREVIOUS U.S. SECRET SERVICE RESEARCH .............................................................63
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 1

INTRODUCTION

ederal facilities, officials, and personnel are not immune from the types of violence we see affecting 

communities throughout the United States, with recent incidents highlighting this danger. For example, on 

July 16, 2015, a lone gunman attacked two military installations in Chattanooga, TN, killing four Marines 

and a Navy sailor, and injuring a Marine recruiter and police officer. Just a few weeks later, on August 21, 2015, 

an individual shot and killed a guard at the security checkpoint of a federal building in New York, NY. Preventing 

similar incidents is critical to ensuring the continuous operation of government and the safety of the personnel and 

citizens who enter government facilities on a daily basis. Further, protecting the government, as well as schools, 

workplaces, and other public venues, is a shared responsibility and is an essential part of securing our homeland.

In the 1990s, the U.S. Secret Service pioneered the field of threat assessment. After conducting research on the 

targeting of public officials and public figures, we established a model for investigating threat cases.1 This model 

offered law enforcement and others with public safety concerns a systematic investigative approach to identify 

individuals who exhibit threatening, inappropriate, or concerning behavior, gather information to assess whether 

they pose a risk of harm, and identify the appropriate private and community resources to manage that risk. In 

January 2000, the U.S. Secret Service published a 

guide for law enforcement that outlined the basic 

elements of a threat assessment program and a threat 

assessment investigation, as well as considerations for 

assessing and managing persons of concern. The 

guide, titled Protective Intelligence and Threat 

Assessment Investigations: A Guide for State and Local 

Law Enforcement Officials,

2 was derived from the U.S. 

Secret Service’s research on the targeting of public 

officials and public figures. The guide outlines 10

general questions or themes included in a threat 

assessment investigation (see Key Themes to Guide 

Threat Assessment Investigations inset). These 

themes provide a framework for investigators to follow 

when gathering information about an individual or group 

that may be at risk of engaging in harmful behavior

directed toward a variety of targets and venues.

Since then, our agency has continued to evolve our 

operational practices and adapt our investigative 

approach to the changing dynamics of our society and 

 

1 Fein, R. A., & Vossekuil, B. (1999). Assassination in the United States: An operational study of recent assassins, attackers, and near-lethal approachers. 

Journal of Forensic Sciences, 44(2), 321–333.

2 Fein, R. A., & Vossekuil, B. (2000). Protective intelligence and threat assessment investigations: A guide for state and local law enforcement officials. 

(NCJ 179981). Washington, DC: National Institute of Justice.

Key Themes to Guide Threat 

Assessment Investigations

In January 2000, the U.S. Secret Service published a 

guide for law enforcement that identified the following 

themes to consider when conducting a threat 

assessment investigation:

 the individual’s motivation and goals;

 what, if anything, the individual communicated to 

others about his or her intentions;

 his or her interest in assassins, weapons, militant 

groups, or mass murderers;

 history of stalking or harassing behavior or evidence 

of planning behavior;

 ability to organize an attack;

 whether others are concerned that the individual 

might take action;

 history of mental illness, particularly involving 

command hallucinations, delusional ideas, and 

feelings of persecution;

 evidence of desperation or despair, suicidality, or 

recent losses;

 factors that decrease or increase the likelihood that 

the individual will carry out an attack; and

 consistency of the individual’s “story” with his or her 

actions.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 2

our understanding of those individuals and groups who might target a person, site, or event under our protection. 

As an illustration, we investigate a continuum of concerning behaviors, not just those indicative of planning 

activities in preparation for carrying out an attack. We deliberately set a low threshold for concerning behaviors 

so that we can identify early intervention points to prevent a situation from escalating, such as referring individuals 

to mental health care, connecting them to social services, involving their families in their care, or checking in with 

them during critical times to offer support. Similarly, we are not solely concerned with identifying individuals who 

exhibit threatening behavior, but also those who, among other things, demonstrate an inappropriate or unusual 

interest in a protected person or are at risk of engaging in self-harm at a protected site. Finally, we have 

broadened our investigations to adapt to the changing dynamics of those who come to our attention and the 

various risks they may pose to the larger community. Specifically, there is now heightened concern in some 

cases that while the individual or group may be interested in harming the President, there is also concern they 

may target a local school, their employers, a public venue, or others for harm. To address these emerging trends, 

we adapted our operational protocols to ensure that we partner with local law enforcement and others to share 

information regarding these threats that we uncover during our investigations.

Over the last 15 years, just as we have adapted operationally, the U.S. Secret Service National Threat 

Assessment Center has continued to research, train, and consult on the prevention of targeted violence in various 

contexts. As a result of this work, our investigative model has been adapted to prevent targeted violence in 

various settings, including workplaces, K-12 schools, colleges and universities, and government agencies. 

Although the basic tenets of threat assessment apply across these different settings, within each context the 

motives, triggers, and behaviors of individuals may differ based on the setting and the target they intend to 

harm. These contextual factors impact how individuals come to the attention of law enforcement, the information 

accessible during the investigation, and the options available to reduce the risk that an individual poses.

Understanding the nuances of threat assessment in different contexts is one of our main goals as it informs 

operations and decision-making in different settings. One context of particular concern to our agency is the 

safeguarding of government sites, facilities, events, and personnel. The National Threat Assessment Center 

initiated a large scale research project to examine attacks targeting federal, state, and local government facilities 

and officials, as well as nationally prominent events and attractions, to better inform our efforts and those of our 

partners in this area. The project seeks to enhance the field of threat assessment generally and provide a more 

refined understanding of the incidents that impact various levels of government and the offenders who target 

those government facilities and officials. 

This project expands upon previous Secret Service research on the targeting of public officials in four main ways. 

First, rather than solely focus on the targeting of prominent public officials, we included incidents in which a 

government building or site was targeted. By doing so, we sought to inform a more comprehensive approach to 

threat assessment and security planning by looking at the targeting of not only specific individuals, but also the 

indiscriminate targeting of persons located at federal sites as well as the targeting of federal buildings. Second, 

we included incidents in which there was no risk of harm to persons, such as explosives detonated overnight 

outside unoccupied buildings, as well as those that caused significant harm to people and facilities. We included 

the incidents in which there was little to no risk of harm to persons to examine whether we could identify 
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 3

differences between those who seek to harm or kill others from those engaging in behaviors that, although 

concerning and harmful, do not place persons at risk. Third, we sought to gather information about the offenders 

in areas we had not studied earlier, for example, capturing more detailed information about what concerning 

behaviors the offenders exhibited in advance as well as what systems the offenders had contact with prior to their 

attacks. We collected data on different aspects of the offenders’ backgrounds and situational factors in order to 

provide a more detailed understanding of those who target the government and how we might be able to identify 

them and intervene. Fourth, we broadened our efforts to identify incidents in which state and local government 

facilities and officials have been attacked, to include when law enforcement personnel have been targeted for 

assassination. We expanded the population of cases to include state and local government targets to help us 

learn more about whether there are unique operational considerations depending on the level of government that 

is targeted, especially considering the perceived easier access individuals and groups may have to facilities and 

officials at the local and state level.

With this overall project design in mind, we chose to partition the study into four parts, each focused on the 

targeting of a different level of government or nationally prominent venues. Thus, this particular report – the first 

in a series – focuses on 43 incidents in which attacks were directed toward federal government facilities, 

buildings, offices, and officials in the United States between 2001 and 2013. The report provides information 

about the incidents, as well as the backgrounds and behaviors of the individuals and groups who targeted federal 

sites and officials for harm. Future reports will focus on the targeting of state and local government facilities and 

officials, as well as nationally prominent events and attractions.

Extensive searches were performed to identify information available in open source that provided details on the 

incidents and those who executed them. The open source materials for this information included court 

documents, investigative reports and interviews, government reports, public records, personal communications of 

the individuals or others who knew them, and news media. Thus, the limitations of open source information 

should be considered when reviewing the findings contained herein. Further, this report was prepared for 

educational and research purposes. Several of the individuals identified in this report have been charged 

because of their alleged involvement, however, their cases are pending adjudication. For these cases, it is 

important to consider that assertions included in court documents are merely allegations, and the defendants in 

these cases are presumed innocent unless and until proven guilty. 

The report is presented in four sections. Part One: Operational Considerations for Threat Assessment discusses 

five operational considerations based on the findings of the study. Part Two: Overview of the Attacks offers a 

summary of the incidents, to include the targets and locations of the attacks, the offenders’ motives and planning 

behavior, and how the attacks were executed. Part Three: Backgrounds of the Offenders describes, among other 

things, the perpetrators’ histories of criminal activity, concerning behaviors, mental health symptoms, stressors, 

contact with various systems, and prior communications they made to or about their targets. Part Four: 

Appendices includes five appendices that provide a list of the incidents, a list of targets, information on the timing 

of the attacks, and statistical tables comparing offenders whose actions caused or could have caused harm to 

others with those offenders whose actions were unlikely to cause such harm, and tables comparing the offenders 

described in this report with previous U.S. Secret Service research in which government officials were targeted.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 4

PART ONE: OPERATIONAL CONSIDERATIONS FOR THREAT ASSESSMENT
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 5

OPERATIONAL CONSIDERATIONS FOR THREAT ASSESSMENT

he field of threat assessment benefits from ongoing research and the translation of that research into 

operational practice. After studying the 43 incidents in which the federal government was targeted for 

attack from 2001 to 2013, and the offenders who executed those attacks, we identified several 

operational considerations that build upon our threat assessment model. In addition, based on our review of the 

execution of the incidents, we also identified some considerations for physical security related to protecting 

federal sites and personnel. Although these considerations are most relevant for law enforcement and others 

tasked with identifying, assessing, and managing those who may pose a risk to federal sites and officials, they 

have broader applicability to the enhancement of threat assessment and physical security measures in other 

areas of our community as well.

Given the wide-ranging utility of the findings, the operational considerations are framed more generally for use by 

law enforcement and others working in a variety of settings. Specifically, they offer information on identifying a 

continuum of concerning behaviors, understanding the impact of mental health symptoms on an individual’s 

behavior and motive, assessing the effect of current and past stressors on a person’s life and decision-making, 

identifying diverse sources of information as part of an investigation, and enhancing facility and personnel 

security. A common thread underlying the considerations is the importance of engaging in early intervention with 

individuals who elicit concern before they begin to view violence as an option to solve their problems. Early 

intervention allows for more entities to have a role in providing support to the person of concern and managing the 

situation, affords more time to intervene, and provides greater flexibility with what intervention options are 

available.

Identify concerning behaviors, encourage reporting, and identify appropriate interventions

All but one of the offenders in this study exhibited concerning behavior prior to their attacks and almost 

two-thirds elicited concern about the risk they posed to their own safety or the safety of others.

As law enforcement professionals, we rely on others to share information with us about a person or situation of 

concern and to work with us to develop intervention strategies to mitigate the risks. One way we can enhance our 

efforts in this area is by encouraging the development of effective threat and/or behavioral assessment programs 

in our local communities. These programs identify what behaviors are, or should be, concerning in various 

settings; encourage the reporting of certain behaviors to law enforcement and others who have the authority or 

capacity to intervene; gather information about the behaviors and the factors influencing them; and identify 

appropriate interventions. Although law enforcement plays a critical role in these programs, their ability to prevent 

acts of targeted violence requires the collaboration and efforts of the entire community.

Identifying behaviors of concern is a challenge, particularly since they occur along a continuum, across time, and

in different settings. They can range from actions and statements that cause low levels of worry in someone who 

knows the individual to behaviors and comments that elicit alarm and fear. The concerning behaviors exhibited 

by the offenders in this study illustrate this range of actions and statements. For example, we saw evidence of 

the following:
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 6

 Disturbing communications that referenced grievances, threats or veiled references of harming self or 

others, sociopolitical or ideological issues, bizarre or delusional beliefs, and themes of depression or 

hopelessness.

 Subtle, as well as more dramatic and sudden, changes in behavior related to physical, social, 

occupational, and interpersonal functioning, to include declines in job performance, dropping out of 

school, and changes in mood, physical appearance, daily routine, and living status.

 Interpersonal difficulties, such as withdrawing from family or friends, disappearing for days or weeks at a 

time, and increased conflict with others.

 Stalking or harassing behaviors, including conducting online research about one or more persons, making 

unwelcomed visits, following others, making intrusive or threatening communications, engaging in acts of 

sabotage or blackmail, invading privacy, vandalizing property, and engaging in violent acts. 

 Final acts, such as leaving goodbye messages, giving away belongings, breaking a lease on a residence, 

and emptying bank accounts.

As is evident from these examples, the behaviors differed in terms of severity and were not always suggestive of 

someone being at risk of engaging in violence. Even so, they were indicative that the individual was experiencing 

some level of distress (see Concerning Behaviors May Not Always Indicate Risk of Harm to Others inset). 

Further, the behaviors occurred in a variety of contexts to include schools, places of employment, mental health 

settings, public venues, and in the offenders’ 

own homes. The offenders also exhibited the 

behaviors over the course of time, ranging from 

actions and statements that occurred decades 

earlier to those that occurred in the hours before 

the offenders executed their attacks. Thus, 

outlining broadly what behaviors elicit concern in 

various settings is an important first step in 

encouraging others to recognize what activities 

warrant attention. 

Setting a low threshold for the reporting of 

concerning behaviors to those with the authority 

and capacity to intervene is an essential next 

step. Often, this reporting will not be directed 

toward law enforcement, particularly for those 

behaviors that are less concerning. For those 

situations, there may be more appropriate 

channels to which the information could be 

directed such as mental health professionals, 

Concerning Behaviors May Not Always Indicate Risk 

of Harm to Others

On November 1, 2013, Paul Ciancia allegedly entered the Los 

Angeles International Airport (LAX) and fired several shots, 

killing a Transportation Security Administration (TSA) officer 

and wounding three others, including two TSA officers and a 

traveler. Ciancia reportedly had “a hand-written letter 

addressed to TSA employees stating that he wanted to ‘instill 

fear in [their] traitorous minds’ and [that he] had made a 

‘conscious decision to kill’ TSA employees.”1 A New Jersey 

native, Ciancia had difficulty transitioning to life in Los Angeles. 

In the days leading up to the incident, he spoke with his father 

about the weak economy and told him he was struggling to find 

work. On the day of the incident, his brother received a text 

message from Ciancia in which he alluded to taking his own life. 

Ciancia’s father, upon learning about the message, contacted 

local authorities in Pennsville, NJ, who then phoned the Los 

Angeles Police Department (LAPD). When LAPD officers 

arrived at Ciancia’s apartment, he had already left. 

1 Transportation Security Administration. (2014, March 26). Enhancing TSA Officer Safety and 

Security: Agency Actions and Path Forward.

.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 7

human resources representatives, school administrators, and others. Even so, as law enforcement agencies we 

can be proactive in this area by working with others to understand more about the behaviors they see in various 

settings and to identify those behaviors that should be reported to law enforcement for appropriate investigation 

and action. For example, in dealing with truancy issues, the local school will likely be the first line of intervention, 

however, if through the course of addressing a truancy issue it seems there are concerns about the student’s 

safety and the safety of others, the school may need to share that information with local law enforcement for 

appropriate follow-up. Similarly, observations of an employee’s declining work performance may be referred to a 

company’s human resources department. If, however, the employee makes references to harming his or her 

coworkers, then law enforcement should be contacted for appropriate follow-up. Less formally, a family member 

may be concerned about a relative’s increasing despondency and work to get the person into mental health care. 

If, however, the family member becomes concerned about the person’s safety, then they may need to contact law 

enforcement for appropriate assistance. As law enforcement, we can work within our communities to offer 

guidance on what behaviors should be reported to us, as well as educate the community about what steps we will 

take.

When setting a low threshold for reporting, it is important to consider the impediments that exist to thorough and 

timely reporting of such behaviors. For example, people may be hesitant to share information about individuals 

exhibiting concerning behaviors. First, they may not recognize that a behavior warrants an intervention. For 

example, someone who has become increasingly isolated and changed his or her normal routine may not elicit 

enough concern that others feel they should bring the information to someone’s attention. Second, if others who 

observe these behaviors are concerned, they may not know with whom to share the information in order to obtain 

help. Third, they may also be concerned about potential negative consequences the person may experience as a 

result of them sharing the information, such as disciplinary action at work, arrest or detention, or hospitalization for 

a psychiatric evaluation. Working to understand these barriers and developing community-level strategies to 

mitigate them will support our ability to identify concerns at an earlier stage.

If the person is brought to your attention and you initiate a threat assessment investigation, gather information 

from multiple sources about any concerning behaviors that the individual has exhibited.

3 You can gather this 

information by interviewing the individual of concern, friends and family, and those who come into contact with the 

individual in the community. In addition, you can explore other investigative avenues focused broadly on 

identifying the individual’s actions or statements that may have elicited concern in others across time and across 

settings. In particular, look for evidence of changes in the person’s behavior. At times these behaviors may be 

more subtle, for example, the individual may have generally been considered a loner, but in the last few months 

they may have become even more isolated. Another illustration is an individual who may have held antigovernment views for many decades, but recently those close to the person began to notice that his or her 

rhetoric had become increasingly angry. Also, gather information on whether the individual’s concerning 

behaviors are related to a preoccupation the individual may have on a specific person or cause, whether the 

 

3 For more information on how to identify sources and gather information, see Using a Systems Approach for Threat Assessment Investigations: A Case 

Study on Jared Lee Loughner, published by the U.S. Secret Service National Threat Assessment Center in December 2015.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 8

preoccupation has significantly impacted his or her life, or if the person has depicted the object of his or her

fixation in increasingly positive or negative ways over time. 

Finally, once you have evaluated the information gathered, the next step involves identifying appropriate 

interventions to mitigate the risk. Interventions can be quite varied and should be tailored to address each 

behavior or situation of concern. This may include helping the individual connect with appropriate support 

systems, access needed services, receive mental health treatment, and apply for benefits to reduce financial 

stress. At times, the intervention may also require arrest or detention if there are imminent concerns about safety 

and/or there is evidence of a criminal violation. The primary goal of all of these efforts is to ensure the safety of 

the individual and the community, and each community’s approach will vary based on the available resources in 

the surrounding area. Regardless of whether the individual’s behaviors generate obvious concern (e.g., threats of 

violence) or are more subtle in nature, they warrant some type of intervention to mitigate negative consequences 

for that individual and others.

Ask detailed questions to explore the link between mental health symptoms and an individual’s 

motive and behavior

Over half of the offenders experienced one or more mental health symptoms, to include paranoia, 

depressive symptoms, delusions, suicidal thoughts, and disorganized or odd thinking and/or behavior. 

For just under one-quarter of the offenders, these symptoms influenced their motives in some way.

Exploring the presence of symptoms of mental illness and their impact on someone’s behavior is an important 

element of any threat assessment investigation. Although most law enforcement professionals are not trained 

mental health providers, there are steps we can take to gather detailed information about an individual’s 

symptoms and the impact these symptoms have on the individual’s thinking and behavior. Our aim in these 

situations is not to perform a mental health evaluation or determine whether an individual meets the criteria for a 

psychiatric diagnosis; rather, the goal is to conduct a thorough investigation to understand what symptoms the 

person is experiencing, how these symptoms may influence his or her behavior, and whether they may impact the 

person’s decision to carry out an attack. In these situations, we encourage our agents and officers to focus on 

asking detailed questions just as they would in any investigation. 

In understanding symptoms of mental illness, first focus on learning more about those symptoms that occur most 

frequently in the population with which you come into contact and who may pose the greatest risk for engaging in 

targeted violence in that setting. This will allow you to identify tailored trainings geared towards those specific

symptoms as opposed to the broad field of mental health and all there is to learn about the various symptoms and 

diagnoses. For example, for the offenders studied in this report, the most prevalent mental health symptom was 

paranoia. Examples of paranoia include believing that the government tapped your phone, thinking your neighbor 

is poisoning the plants in your garden, and that others are conspiring against you to harm you in some way. 

Often we learn about an individual’s paranoia by observing their behavior, such as keeping the blinds shut to 

obstruct the view of government agents, or scanning the rearview mirror to look for people following them. We 

also learn about an individual’s paranoia by noting the content of their speech or writings (e.g., making unsolicited 

statements about being followed and/or persecuted by others or that the government or another entity is 
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 9

conspiring against them). As an investigator, you can ask specific questions to understand in greater detail the 

impact the individual’s paranoia has on his or her 

life (see If Expressing Paranoia, Ask What Steps 

Someone Feels Are Necessary to Protect 

Themselves inset). For example, explore:

 The nature of the individual’s beliefs 

(e.g., who is following them, how long has 

this been occurring); 

 Whether he or she has changed their 

behavior based on these beliefs (e.g., 

have they purchased a weapon, changed 

their daily routine, isolated themselves 

from family); and 

 Whether he or she considers violence as 

an option to solve the problem (e.g., are 

they in fear of their life, will killing a 

federal agent bring attention to the 

government conspiracy).

Delusional beliefs were another prevalent symptom among those who targeted federal officials and federal 

facilities in this study. Delusions are fixed, false beliefs, and may be either bizarre (e.g., the CIA is communicating 

with me via a device implanted in my tooth) or non-bizarre (e.g., my wife was terminated from her job because of 

a larger agency conspiracy to hide corruption). Similar to the line of questioning for those evidencing paranoia, 

explore a person’s delusional beliefs, the impact these beliefs have had on their behavior, and what options they 

see for themselves, as this will provide you with a greater understanding of their potential motive for carrying out 

an attack. When interviewing a person about their delusions, it is important not to minimize their beliefs, agree 

with them, or, alternatively, argue with them. Rather, in order for you to gather information, encourage dialogue, 

acknowledge if the person is upset or afraid, and ask what steps they see available to reduce their distress or 

solve the situation. The goal of your investigation is to thoroughly understand their belief system and the 

perspective this gives them on the world.

Depressive symptoms were also prevalent among the offenders studied. Depressive symptoms include sad or 

depressed mood, irritability, changes in sleep and appetite, suicidal thoughts, loss of interest in activities, feelings 

of guilt and worthlessness, and feelings of hopelessness. As part of your investigation, you will want to ask 

questions about these symptoms with a particular focus on such things as:

 The individual’s emotional state, specifically feelings of hopelessness, despair, and anger;

 Recent or recurrent losses, particularly those that leave the individual feeling alone and isolated;

If Expressing Paranoia, Ask What Steps Someone 

Feels Are Necessary to Protect Themselves

On September 16, 2013, Aaron Alexis fatally shot 12 Navy 

civilian and contractor employees and wounded several others 

at the Washington Navy Yard in Washington, DC. A month 

prior, law enforcement officers responded to Alexis’s hotel 

room in Newport, RI. Alexis told the officers that he believed 

he was being followed. He further reported that he had 

changed hotels twice to escape the voices he was hearing, had 

placed a microphone on the ceiling of his hotel room to record 

the voices, and that someone was hiding under his bed sending 

vibrations into his body from a microwave machine. The 

officers observed that Alexis had disassembled the bed. After

the incident at the Washington Navy Yard, authorities 

concluded that Alexis believed that he was being barraged with 

extremely low frequency (ELF) waves, which he referenced in 

words etched on the shotgun he used in the incident, “My ELF 

weapon!”

1

1 Federal Bureau of Investigation, Washington Field Office, Public Information Office. (2013, 

September 25). Law enforcement shares findings of the investigation into the Washington 

Navy Yard shooting.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 10

 Suicidal thoughts and suicide attempts;

 Whether the individual has realistic plans for the future and appears to be taking steps to make the plans 

come to fruition;

 What aspects of the individual’s life, if any, appear to be on-track (e.g., maintaining good job 

performance, stable social support); and

 Whether the individual blames others for their situation.

Although these examples are not comprehensive, they highlight a few lines of inquiry that can help you develop a 

greater understanding of how mental health symptoms affect the view people have of their current situation and 

what options, if any, they see available to them. Understanding their current status will also inform decisions you 

make in either transporting the person for immediate evaluation at a hospital or other facility or, if not urgent, 

connecting them to mental health and social services in your community for appropriate follow-up. In certain 

situations, you may want to check back with the individual, their family, or others to determine whether the 

situation requires additional intervention to mitigate any risk that may be posed.

Recognize stressors, assess their impact, and examine options for managing them

Over three-quarters of the offenders experienced stressful events in the year prior to their attacks, with 

over two-thirds experiencing a stressor in the six months prior. They experienced stressors most often 

related to family or romantic situations, criminal arrests and charges, employment, and civil court actions.

A thorough threat assessment investigation includes identifying past and current stressors affecting an individual, 

as well as determining what stressors could potentially affect the person in the future. Stress can affect an 

individual’s beliefs and attitudes, which then influence how he or she evaluates and reacts to current and past 

events. It can also adversely affect an individual’s behaviors, which in turn can impact his or her social 

interactions, decision making, and physical and mental health.4 Understanding these changes is an important 

aspect of your investigation as they can increase the risk that an individual may resort to maladaptive behaviors to 

cope, including violence.5 

When conducting an investigation, it is important to remember that events or situations that may not seem 

particularly stressful to you may have a significant impact on the individual who has come to your attention. This 

in turn could lead the individual to engage in maladaptive or concerning behaviors. Therefore, it is important to 

gather information about the stressors in an individual’s life, the individual’s perception of those stressors, and the 

impact they have on his or her behavior.

 

4 Smythe, J., Zawadzki, M., & Gerin W. (2013). Stress and disease: A structural and functional analysis. Social and Personality Psychology Compass, 7(4), 

217-227.

5 For more information on how to assess the role of stressors in investigations, see Exploring the Effect of Stressors in Threat Assessment Investigations: A 

Case Study on Bart Allen Ross, published by the U.S. Secret Service National Threat Assessment Center in December 2015.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 11

In addition, examine all areas of the individual’s life when 

identifying stressful events (see Explore Stressors in All Life 

Domains inset). This is important because at times, as law 

enforcement, we become aware of a person of concern 

because of behavior they may have exhibited in a specific 

setting. For example, a local college or university may 

reach out because of concerns they have regarding a 

student or faculty member. To assist with your assessment 

of the individual, it will be important to look beyond the 

stressors they may be experiencing related to the school, 

such as failing grades or a denial of tenure, to identify stressors in other areas of their lives (e.g., family or 

relationship problems). Similarly, a business may contact you because of concerns about an employee who was 

recently terminated. While investigating the person’s work history with the company is a crucial element to your 

investigation, it is also important to look for stressors outside of the work environment that might place the

individual at risk. For example, the person might be experiencing a foreclosure on his or her home, a pending 

divorce, or child custody litigation. We found that offenders who experienced stressors in more areas of their lives 

were more likely to engage in attacks that caused or could have caused harm to others. Thus, it is critical to 

investigate recent and past stressors in all aspects of an individual’s life to include:

 Family or relationship problems, including the death of a loved one, divorce, contentious child custody 

disputes, and the inability to develop one or more close relationships with others.

 Criminal actions, including arrests and charges, court filings, and appearances regarding criminal 

pleadings, convictions, and sentencing. 

 Occupational and educational difficulties, such as disciplinary actions, suspensions, disputes over 

performance, and terminations or expulsions.

 Civil actions, such as bankruptcy filings, eviction proceedings, failed lawsuits filed by the individual, and 

court actions instituted by others against the individual.

 Personal issues, including health problems, financial difficulties, and changes in living situation.

Once you have identified potential stressors, consider how the individual coped with similar events in the past and 

how he or she is handling their current situation. Knowing how the person dealt with stressful events in the past 

can help you better understand his or her state of mind and ability to cope with such situations now and in the 

future. Further, you may be able to identify options and resources that the person can use to positively cope with 

and manage stressors to reduce the risk they may pose. For example, you may check in with the person to offer 

support during critical times, ask their family to contact you if the person experiences a stressful situation in the 

future that might elevate their risk, and work with community organizations that may be able to provide various 

services to reduce certain stressors, such as financial worries or legal problems. As a final note, pay attention to 

any future events or changes that could increase (e.g., a pending divorce) or decrease (e.g., gaining meaningful 

Explore Stressors in All Life Domains

On October 9, 2013, former police officer Thomas 

Piccard fired shots at the exterior of the Wheeling 

U.S. Courthouse and Federal Building in Wheeling, 

WV, causing minor injuries to three security officers 

who were struck by debris. Piccard was killed by 

responding officers. According to the U.S. Attorney, 

Piccard’s hatred of the federal government, a recent 

failed relationship, and serious health problems may 

have led him to carry out the shooting. 
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 12

employment) the person’s stress, as well as strategies to cope with those changes. As with all threat assessment 

investigations, the goal is to assess the individual’s situation and work to manage and reduce any risk that may be 

posed currently or in the future.

Identify diverse sources of information, including records, interviews, and online searches 

About three-quarters of the offenders had contact with at least one of the following, the judicial 

system, educational institutions, employers, or law enforcement. Meanwhile, less than one-third of the 

offenders had contact with at least one of the following, mental health professionals, social services, or

houses of worship. Additionally, based on criminal charges alone, only one-third of the offenders had a 

history of violent behavior, however, based on reporting from others familiar with the offenders, nearly

one-half had a history of violence. Further, a few offenders without criminal records appeared to have 

committed criminal acts for which they were never charged.

When initiating a threat assessment investigation, one of your first steps is to identify the community systems that 

may have knowledge about the individual’s history, to include any concerning behaviors, mental health

symptoms, stressors, and other relevant background information. At times, these systems maintain information in 

more formal records, such as information on civil and criminal court activity, criminal history, education, 

employment, and mental health evaluations and treatment. As an illustration, most of the offenders had contact 

with the judicial system. These records are generally available to the public, either online or through the court. 

They offer valuable information about the person’ life, to include information on criminal activity; divorce 

proceedings; child support filings; bankruptcies, liens, and evictions; small claims and other civil actions filed by 

and against the person; and restraining orders. This example highlights the diversity of information that is 

contained in formal records. 

Other records may contain pertinent information for your investigation; however, they may not be as easily 

accessed due to privacy laws. For example, offenders in this study often had contact with educational institutions 

and employers, with a smaller number having contact with mental health professionals. Access to these records, 

however, is restricted by federal and state law (e.g. Family Educational Rights and Privacy Act (FERPA), the 

Health Insurance Portability and Accountability Act (HIPAA)). Thus, unlike judicial or law enforcement records, 

the disclosure of educational, employment, and mental health records generally requires either the consent of the 

individual under investigation or an express statutory or regulatory exception. Conducting liaison with area 

schools, colleges and universities, businesses, and large mental health providers will assist you in understanding 

when they may be able to disclose information to you and also offers you an opportunity to share with them how 

you would use the information and maintain the records should you need to initiate a threat assessment 

investigation. You may also consider developing forms that comply with federal and state law that authorize the 

disclosure of records to your agency as part of a threat assessment investigation. If an individual under 

investigation offers voluntary consent and signs the form, the institution or hospital may release the records to 

you. These are all activities that should be undertaken proactively outside of the context of a specific threat 

assessment investigation to ensure that when information is brought to your attention, you are able to work 

closely with relevant entities to share information where possible.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 13

Even where access to formal records is possible, the 

information is often incomplete and you may need to 

supplement it with information gathered from less formal 

avenues, such as searching online and conducting 

interviews. For example, criminal records maintained in 

standard databases, such as the National Crime 

Information Center (NCIC), generally contain information 

on an individual’s arrest history, but they do not reflect 

details regarding the circumstances of the arrest (see 

Formal Records May Not Tell the Whole Story inset). In 

addition, individuals may be released without being 

charged, and charges can be reduced, dropped, or 

expunged. Thus, if an individual you are investigating 

has a criminal history, contact the arresting agency to 

gather additional information regarding the individual’s 

behavior that led to the arrest, as well as his or her 

mental state at the time. 6 In addition, local law 

enforcement may be familiar with the individual apart from any criminal charges and may be able to offer a more 

complete picture of his or her past and current behavior. Similar to criminal records, mental health records do not 

always contain a complete description of the individual’s behavior, psychiatric history, or cognitive functioning. 

When authorized to obtain information on an individual’s mental health treatment, you can benefit by not only 

reviewing the medical record, but also contacting hospital staff and other mental health professionals. These 

professionals can provide information on an individual’s compliance with treatment and medication, as well as 

specific observations and concerns they may have about an individual’s behaviors, statements, or beliefs, which 

may not be contained in the medical record. This information may provide additional insights into an individual’s 

behavior and potential risk for engaging in targeted violence.

Finally, the people who know the individual well, such as family, friends, neighbors, and coworkers can provide 

information about the individual’s past and present behavior beyond what is contained in various records. Other 

people who encounter the individual regularly in the community, but do not have intimate knowledge of him or her, 

also may be valuable sources of information. To identify others who may have information, outline the locations 

that the individual frequents during a typical day, such as a coffee shop, gym, store, or library, and gather 

information from people at those locations who may interact with the individual. They may have knowledge about 

the individual’s concerning behavior, recent behavior changes, unusual or concerning statements, and stressors.

 

6 For more information on the importance of going beyond record checks in an investigation see Investigating Ideologically Inspired Violent Extremists -

Local Partners Are an Asset: A Case Study on Abdulhakim Mujahid Muhammad, published by the U.S. Secret Service National Threat Assessment Center in 

December 2015.

Formal Records May Not Tell the Whole Story

On December 18, 2013, Ricardo Martinez Diaz

allegedly ignited a glass bottle filled with gasoline and 

threw it toward a primary vehicle inspection booth and 

four U.S. Customs and Border Protection (CBP) officers 

at the San Ysidro – Class A Port of Entry. During the 

attack, Diaz reportedly yelled for officers to shoot him 

in a possible attempt to commit “suicide by cop.” 

Beginning in 1995, Diaz had numerous charges, 

arrests, and convictions for violent behavior, to include 

misdemeanor battery, inflicting corporal injury on a 

spouse or cohabitant, assaulting a first responder with

a deadly weapon, robbery, and threatening to commit 

a crime that would inflict injury or death on another 

person. Although certain records checks provided 

information on the dates and charges related to Diaz’s

criminal activity, the records did not offer details about 

the behaviors that led to his arrests.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 14

Develop physical security plans that extend beyond the building perimeter

Offenders most often used firearms, followed by the mailing of incendiary, chemical, and biological 

materials. Almost two-thirds of the incidents involving firearms were initiated outside of targeted 

facilities, while four occurred at the residences of targeted public officials, and one occurred at an 

outdoor event. In three incidents, the attacks were initiated at internal security checkpoints, and all 

three resulted in the deaths of one or more security officers.

In conjunction with a proactive threat assessment program, physical security measures are an important 

component of safeguarding facilities, buildings, and personnel. They not only serve as a deterrent, but also 

mitigate the impact of an attack. We saw this evidenced by the manner in which the attacks were executed, with 

many initiating outside of facilities, at security checkpoints, or at unsecured locations. These findings offer 

considerations for enhancing security, to include hardening security checkpoints and extending the security 

perimeter; implementing secure mail screening; and establishing protocols to identify and address suspicious 

behavior and increasing the security awareness of personnel both at work and at home.

Where possible, work to harden security checkpoints and extend the security perimeter around facilities and 

buildings. Since security officers work to safeguard facilities and personnel, they are often the first line of 

defense. As such, they are most vulnerable to being harmed when perpetrators employ firearms, explosives, or 

other weapons. When creating safety plans, consider establishing protocols to enhance the safety of the officers 

and their efforts to address potentially threatening situations. For example, include training for officers on 

recognizing the characteristics of an armed gunman or a person transporting an explosive on his or her 

person. Further, most officers at a security checkpoint are focused on verifying credentials and checking for 

prohibited items entering a site; it may be beneficial to designate one officer to observe persons approaching the 

post and be aware of anyone engaging in threatening or concerning behavior outside the immediate area of the 

checkpoint. This task can be facilitated if part of a security plan involves using plainclothes officers to roam 

outside the security perimeter or checkpoint to watch for individuals engaging in suspicious, unusual, concerning, 

or threatening behavior. You can also explore other methods, such as controlling the flow of pedestrians, 

establishing appropriate vehicle standoff distances, and video monitoring, as all can extend the security perimeter 

of a facility while also ensuring a safer working environment for security officers. 

Implementing secure mail screening protocols is another way to enhance facility and building safety. In this 

study, not every attack was conducted in person with a gun or explosive. Rather, several offenders sent anthrax, 

ricin, poisoned food and drinks, or incendiary devices through the mail. While the U.S. Postal Service provides a 

number of security measures to reduce the risk of mail attacks, it is important for government agencies to follow 

best practices for processing and screening mail to ensure the safety of their employees. Provide employees with 

instructions not to accept hand-delivered mail themselves, and develop training on how to visually identify 

suspicious packages or letters they might receive at home. Further, all employees should be aware of the 

procedures for responding to any real or perceived contamination from packages, whether at work or at home. 

You can review the U.S. Postal Inspection Service’s Guide to Mail Center Security7 and the interagency report 

 

7United States Postal Inspection Service. (2013, January). Guide to Mail Center Security (Publication 166) (PSN 7690-05-000-4890).
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 15

titled Best Practices for Mail Screening and Handling Processes: A Guide for the Public and Private Sectors8for 

more detailed guidance on developing and using an effective mail screening process, including the use of off-site 

screening facilities. Some of these procedures may be adapted to the private sector as well.

Finally, encourage the reporting of suspicious behavior and the maintenance of security awareness by personnel, 

both at work and at home. Several of the incidents occurred outside of facilities during overnight hours. These 

involved shots fired at buildings, explosives placed outside of the facilities, and acts of arson. Consider 

establishing protocols for identifying and responding to suspicious activity that specifically address security 

procedures during overnight hours, when the need for 

vigilance may not seem as important. In addition, some of 

the incidents occurred at the homes of targeted officials (see 

Identify Ways Federal Officials Can Enhance Their Security 

at Home inset). In today’s heightened security environment, 

many employees, especially government employees, enjoy a 

greater level of physical security at their place of work than 

they do at home. If possible, encourage public officials and 

government employees to maintain awareness of their 

surroundings at all times, protect personal information and 

identifiers, and implement security measures to improve the 

safety of their homes. Also, provide employees with 

information on who to contact if they observe suspicious 

activity near their residences.

 

8U.S. Department of Homeland Security. Interagency Security Committee. (2012, September 27). Best practices for mail screening and handling 

processes: A guide for the public and private sectors. (1st Edition).

Identify Ways Federal Officials Can 

Enhance Their Security at Home

On June 23, 2013, Aaron Richardson allegedly fired 

a shot into the home of U.S. District Judge Timothy 

Corrigan in Jacksonville, FL. Judge Corrigan 

suffered minor injuries from the debris. Richardson 

had been sentenced by Judge Corrigan in 2011 after 

accepting a plea agreement in a burglary and arson 

case. In 2012, Richardson wrote a letter to Judge 

Corrigan requesting an early end to his supervised 

release, which the judge denied. At the time of the 

incident, Richardson faced the possibility of being 

returned to jail by Judge Corrigan for multiple 

probation violations.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 16

PART TWO: OVERVIEW OF THE ATTACKS
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 17

OVERVIEW OF THE ATTACKS

etween 2001 and 2013, 43 attacks9 were conducted against federal facilities, buildings, offices, and 

officials based on their position or status as 

government entities (see Figure 1). 10 These 

attacks included incidents in which a weapon or harmful 

agent was employed, regardless of whether harm 

resulted. Thirty-five of the attacks (81%) were committed

by lone actors, while three were conducted by two or 

more individuals (7%). In the remaining five cases (12%), 

the individuals responsible for their execution either have 

not been identified or insufficient evidence exists to 

connect the offender(s) to the crime.11 In this section, we 

describe the targets, the locations of the attacks, the 

perceived motives underlying the incidents, planning 

behaviors, and how the attacks were executed.

Targets

The attacks were directed against federal facilities, buildings, and offices, 

as well as specific public officials. The incidents affected all three 

branches of government, with the executive branch attacked most 

frequently, followed by the judicial, and then the legislative (see Table 1).13 

The military was targeted in nearly a third of the attacks directed toward 

the executive branch (n = 13), including five incidents in 2010, in which

Yonathan Melaku fired shots at the Pentagon, the National Museum of the 

Marine Corps (twice), and recruiting offices for the U.S. Coast Guard and 

U.S. Marine Corps. No one was injured in any of his attacks.

 

9 See Appendix A for brief descriptions of the 43 incidents included in this report.

10 Incidents of workplace violence in which the offender took action in response to an employment issue (e.g., disciplinary action, demotion, conflict with a 

supervisor) were not included in this report. In addition, incidents in which law enforcement became aware of a potential attack during the planning 

stages and intervened in some manner (e.g., providing inert bomb materials) were not included.

11 Although a cell affiliated with the Earth Liberation Front (ELF), an eco-terrorist group, claimed responsibility for the August 2002 arson attack that 

destroyed the U.S. Forest Service’s Forestry Sciences Laboratory located in Irvine, PA, evidence did not clearly link one or more individuals to the incident. 

For this reason, this attack is considered an unknown subject case for purposes of this report. 

12 In four of the incidents, the offenders targeted two different branches of the federal government. These cases include: (1) the 9/11 terrorist attacks in 

which the legislative and executive branches were targeted; (2) the April 2005 mailing of cookies and candy laced with rat poison to 14 public officials 

associated with the executive and judicial branches; (3) the April 2013 mailing of letters containing ricin to public officials associated with the executive 

and legislative branches; and (4) the May 2013 mailing of letters containing ricin to public officials associated with the executive and judicial branches.

13 In four cases, the offenders also targeted state and/or local government officials and/or facilities as part of their attacks. For purposes of this report, 

only their federal targets are included in the analyses. These cases include: (1) in January 2011, unknown person(s) mailed incendiary packages to the 

Secretary of Homeland Security, the Governor of Maryland, and the Secretary of the Maryland Department of Transportation; (2) in December 2011, Justin 

Bennett fired shots at a police station in Sparks, NV before targeting a U.S. Post Office in Verdi, NV several hours later; (3) in April 2013, James Dutschke 

mailed letters containing ricin to President Barack Obama, U.S. Senator Roger Wicker, and a county judge; and (4) in May 2013, Shannon Richardson 

mailed letters containing ricin to President Obama, the Mayor of New York City, and the executive director of a private organization.

Table 1: Government Branches 

of Intended Federal Targets*

Branch n

Executive 31

Judicial 10

Legislative 5

General federal building 1

* Two branches of government were 

targeted in four incidents.12

* One individual, Yonathan Melaku, was responsible for five of 

the nine attacks that occurred in 2010. No one was injured in 

any of those incidents. 

0

2

4

6

8

10

Distribution of Attacks

2001 through 2013*

Figure 1.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 18

Across the branches of government, the attacks targeted various federal buildings and facilities, the offices of 

specific departments and/or agencies, specific public officials, and/or random individuals present at either federal 

sites or an event sponsored by a public official. In almost half of the incidents (n = 21, 49%), the offenders 

indiscriminately targeted persons for harm. For example, in November 2009, U.S. Army Major Nidal Hasan shot 

soldiers at random at the Fort Hood Soldier Readiness Processing Center in Fort Hood, TX. Similarly, in January 

2011, Jared Loughner shot and injured U.S. Representative Gabrielle Giffords at a “Congress on Your Corner” 

event in Tucson, AZ. He then opened fire on the crowd who had gathered to meet her, killing six individuals and 

wounding 12 others.

The following sections describe the attacks against federal buildings, facilities, and offices separately from the 

attacks that targeted specific public officials. Characteristics inherent to each type of target influenced how the 

offenders executed their attacks in terms of timing, method, location, and potential harm caused.

Attacks on Federal Buildings, Facilities, and Offices

In nearly three-quarters of the incidents (n = 31, 72%), the offenders targeted federal buildings and facilities in 

general, as well as the offices of specific government departments, agencies, and boards. In all but one of these 

incidents, the offenders traveled to the site to execute their attacks. The one exception occurred in October 2003, 

when an unknown person(s) mailed two separate envelopes containing ricin to the U.S. Department of 

Transportation and the White House. Given the unique nature of this incident, it is not included in the analyses 

below that describe the timing of the attacks, whether security was breached, and from where the attacks were 

launched.

The sites of the attacks included high-profile targets such as the White House and the Pentagon, as well as 

lesser-known facilities, including various federal office buildings, courthouses, and post offices (see Appendix B 

for a list of targeted buildings, facilities, and offices). Four locations were targeted in more than one incident, 

including the Patrick V. McNamara Federal Building in Detroit, MI; the National Museum of the Marine Corps in 

Triangle, VA; the Pentagon in Arlington, VA; and the White House in Washington, DC. 

Half of the attacks at federal sites (n = 15, 50%) occurred overnight or outside of the normal business hours of the 

targeted facilities. These incidents involved shots fired at buildings, explosive devices placed outside buildings, 

and arsons (see Appendix C for a graphic depicting the timing of the attacks). Of the attacks that took place 

during the normal business hours of the targeted facilities (n = 15, 50%), 10 involved shots fired at buildings or 

personnel and 2 involved the crashing of airplanes into buildings. The remaining three incidents involved arsons, 

the use of explosives, and a hostage situation during which no shots were fired.

14

 In only one incident in which a 

federal facility or office was targeted was there evidence that a security protocol was breached.

15

 In this case, in 

 

14 One of the incidents in which shots were fired also involved a hostage situation. In December 2009, Warren Taylor held several individuals hostage for 

eight-and-a-half hours at the U.S. Post Office in Wytheville, VA.

15 For one case, we were unable to locate information in open source about whether the individual breached a security measure. In February 2006, 

George Curran allegedly entered a hearing room of the National Labor Relations Board (NLRB) in Phoenix, AZ, taking nine hostages at gunpoint. The NLRB 

office was housed in a private office building that had one security guard at the main entrance, but no metal detectors. The NLRB office itself had no 

security personnel, but visitors had to be buzzed into the office. It is unclear how Curran reportedly entered the office, that is, whether he was buzzed in 

or gained access in another manner.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 19

September 2013, Aaron Alexis brought an unauthorized firearm to 

the Washington Navy Yard, where he had just begun an 

assignment as a civilian contractor. 

In nearly three-quarters of the incidents targeting federal sites

(n = 22, 73%), the offenders launched their attacks from outside 

the facilities.

16

 Of those where the attacks were launched from 

within (n = 7, 23%), three offenders initiated their assaults at 

security checkpoints, two had authorized access to enter a 

secured facility, one entered a U.S. Post Office before taking 

hostages, and another entered a National Labor Relations Board 

(NLRB) office before taking hostages.

The harm caused by the attacks on federal sites varied greatly. 

While six incidents caused no harm to persons or facilities, 10 

resulted in injuries and/or deaths. Although the highest number of 

losses was sustained in the 9/11 terrorist attacks, a significant 

number of casualties, 14, 16, and 45 respectively, occurred in 

three separate incidents. In the remaining six cases, one to four

persons were injured and/or killed. In addition, in two of these

incidents extensive property damage also occurred. First, the 

9/11 terrorist attacks damaged the Pentagon and destroyed the 

World Trade Center towers. In the second incident, Andrew 

Stack killed 1 person, injured 13 others, and caused major 

structural damage when he flew his private airplane into a building 

that housed an IRS office in Austin, TX. This latter incident 

occurred in February 2010.

The remaining 15 incidents resulted in property damage only. For 

the most part, the damage was minor and included bullet holes in 

windows or damage to the front or rear entrances of buildings. In 

four of the incidents, however, more extensive damage occurred

(see the Extensive Damage Caused in Four Attacks on Facilities

inset).17 In the first case, an August 2002 arson committed by 

members of ELF destroyed the U.S. Forest Service’s Forestry 

Sciences Laboratory in Irvine, PA. In the second incident, three 

pipe bombs detonated near the front doors of the Edward J. 

 

16 For one of the incidents, it was unknown whether the attack was launched from outside the facility. Specifically, in the August 2002 arson targeting the 

U.S. Forest Service’s Forestry Sciences Laboratory in Irvine, PA, information was not discovered in open source as to how or where the fire was initiated.

17 The photos shown are from the following sources: a) U.S. Forestry Laboratory, from the USDA Forest Service, photo by Dr. Pat Brose, b) Edward J. 

Schwartz U.S. Courthouse, photo credited to the FBI, c) inset photo of fire, still image from security footage, courtesy of the U.S. Marshals Service, d) U.S. 

Probation Office, photo by Stephanie Spyropoulos, and e) U.S. Post Office, photo courtesy of Mickey Grizzle.

U.S. Courthouse in San Diego, CA

U.S. Forest Service’s Laboratory in Irvine, PA

U.S. Probation Office in Plymouth, MA

U.S. Post Office in Verdi, NV
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 20

Schwartz U.S. Courthouse in San Diego, CA in May 2008. The explosion shattered the glass doors of the 

courthouse, damaging a metal detector and an X-ray machine that were located in the lobby. The courthouse 

was closed for one day to allow for repairs. In the third attack, which occurred in October 2010, James Dix set fire 

to the U.S. Probation Office in Plymouth, MA. The fire caused significant damage to the office’s furnishings and 

computer equipment, the building, and other offices leased to commercial tenants. The damage was estimated at 

nearly $2,000,000. Finally, in December 2011, Justin Bennett shot at and set fire to a U.S. Post Office in Verdi, 

NV. As a result, the facility was closed for 13 months while undergoing repairs.

Attacks on Public Officials

In the remaining incidents, just over one-quarter (n = 12, 28%), offenders directed their attacks against a variety of 

public officials. In all, 30 individuals were specifically targeted, to include judges, members of Congress, military 

Chiefs of Staff, department and agency heads, the President, and others (see Appendix B for a list of targeted 

public officials). In only one of these cases was a former public official, Douglas Bennett, attacked. Bennett had 

served as the personnel director for President Gerald Ford in the 1970s. In November 2003, Robert Spadaro 

approached Bennett outside his home in Washington, DC and fired shots at him as he drove away. Spadaro 

blamed Bennett for his failure to obtain a political appointment in President Ford’s Administration 28 years earlier.

In just over half of the attacks directed toward specific public officials (n = 7, 58%), offenders sent packages 

containing incendiary devices or items contaminated with chemical or biological materials through the mail.18 

None of these packages or letters reached their intended targets. The remaining five attacks (42%) all involved 

the use of firearms. Four of these took place at the private residences of the targets and one occurred at an 

outdoor public event (see Appendix C for a graphic depicting the timing of these attacks).

Similar to the harm caused by the attacks at federal facilities, the harm caused by the assaults targeting specific 

public officials ranged from no injuries in seven incidents to mass casualty attacks with more than three fatalities 

in two incidents (see the Mass Casualty Incidents inset). These latter two incidents included the January 2011 

shooting of Representative Giffords and others attending her constituent event and the October 2001 mailing of 

anthrax-laced letters to two U.S. senators. 

Three of the 30 public officials who were specifically targeted were harmed. These officials included 

Representative Giffords; Assistant U.S. Attorney Thomas Wales, who was fatally shot in his Seattle, WA home by 

an unknown assailant(s) in October 2001; and U.S. District Court Judge Timothy Corrigan, who suffered minor 

injuries from debris in June 2013 when Aaron Richardson allegedly fired a shot into his home.

Further, three of the attacks directed toward public officials resulted in indiscriminate harm to others:

 The shooting of Representative Giffords in which she and 12 others were injured and 6 were killed;

 

18 One of these attacks occurred in May 2013 when Matthew Buquet allegedly mailed letters containing ricin to two federal officials and three federal 

facilities. For purposes of this report, this incident is included in the analyses of cases in which specific public officials were targeted.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 21

 The October 2001 mailing of anthrax-laced letters to Senators Thomas Daschle and Patrick Leahy, which

resulted in four deaths and the sickening of seven people;19 and

 The February 2005 murders of U.S. District Judge Joan Lefkow’s husband and mother in her Chicago, IL 

residence. 

The indiscriminate nature of these latter incidents parallels the indiscriminate targeting found in some of the 

incidents in which offenders chose to direct their attacks toward specific government buildings, facilities, and sites.

 

19 In addition to the letters sent to Senators Daschle and Leahy, five anthrax-laced letters were sent in September 2001 to news anchors and media outlets 

in New York, NY and Boca Raton, FL. These letters killed 1 person and sickened 10 others who were exposed to the anthrax. Since the earlier letters were 

not directed toward a federal government official/entity, they were not included as part of this report.

Mass Casualty Incidents

Significant attention has been drawn to incidents with mass casualties, defined here as attacks that cause three or more 

fatalities (see Investigative Assistance for Violent Crimes Act of 2012). Five such attacks are described in this report, and 

represent incidents motivated by a broad range of issues, employing various methods of attack, and executed by both 

group and lone actors. These incidents include a large-scale coordinated attack using airplanes by a terrorist 

organization, three active shooters, and another lone actor who mailed a biological weapon to two U.S. Senators. In two 

of the incidents, although specific public officials were targeted, the offenders indiscriminately harmed others. In the 

other three attacks, the offenders caused large-scale indiscriminate harm by virtue of the sites/targets they selected.

 On September 11, 2001, 19 al-Qa‛ida operatives hijacked four commercial airliners and crashed them into the 

World Trade Center towers, the Pentagon, and a field in Shanksville, PA. The attack resulted in the death of 2,973 

persons.

 In October 2001, two anthrax-laced letters were mailed to the offices of Senators Thomas Daschle and Patrick Leahy 

in Washington, DC. While the letters were in transit, exposure to them killed four people and sickened seven others. 

The FBI identified Dr. Bruce Ivins, a senior microbiologist at the United States Army Medical Research Institute of 

Infectious Diseases (USAMRIID), as the lone suspect.

 On November 5, 2009, while in the waiting area at the Soldier Readiness Processing Center at Fort Hood, TX, U.S. 

Army Major Nidal Hasan shot into a crowd of soldiers who were waiting for medical appointments. Hasan fired 

over 200 rounds of ammunition that left 13 individuals dead and 32 others injured.

 On January 8, 2011, Jared Loughner shot and injured U.S. Representative Gabrielle Giffords at a “Congress on Your 

Corner” event in a shopping center parking lot in Tucson, AZ. Loughner then fired into the crowd, killing 6 people, 

and, in addition to Representative Giffords, injuring 12 others.

 On September 16, 2013, Aaron Alexis fatally shot 12 people and injured 4 others at the Washington Navy Yard in 

Washington, DC, where he was working as a civilian contractor.

Prior to their attacks, Ivins, Hasan, Loughner, and Alexis all had, among others things, elicited concerns in others about 

their own safety or the risk they posed to others; engaged in concerning communications; exhibited changes in their 

behavior; experienced stressors related to their employment or attempts to gain employment as well as their immediate 

family or romantic partners (to include loss of relationships or inability to establish them); and had come to the attention 

of law enforcement for various reasons.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 22

Locations

The incidents occurred in 15 states and the District of Columbia, with just under half of the targets (n = 18, 42%) 

located in the Washington, DC metropolitan area (see Figure 2 for the locations of the in-person attacks, that is, 

those in which the offenders traveled to the sites to execute their attacks). Multiple attacks occurred in the states 

of Arizona, California, Michigan, Nevada, Texas, and Virginia. 

Offenders who committed the attacks resided in 21 states and the District of Columbia. Three offenders traveled 

more than 1,000 miles to commit their attacks, all of which occurred in Washington, DC. The offender who 

traveled the farthest was Robert Spadaro, who covered over 4,800 miles after leaving his home in Honolulu, HI to 

target a former personnel director for the Ford administration at his home in Washington, DC.

Figure 2.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 23

Motives

The offenders had a variety of motives for selecting federal targets, and for some, more than one factor influenced 

their actions. The following examples highlight the most prevalent motives, in descending order:

Retaliation for a perceived personal slight or wrong. These offenders carried out their incidents in response 

to perceived slights, injuries, or wrongs that they suffered as a result of the actions or inactions of a public official 

or government entity.

 In January 2010, Johnny Wicks entered the Lloyd D. George Federal Building and U.S. Courthouse in 

Las Vegas, NV, and opened fire, killing a court officer and wounding a deputy U.S. Marshal as well as a 

law clerk. Four months earlier, in the same courthouse, Wicks’s lawsuit against the Social Security 

Administration alleging racial discrimination in the agency’s decision to reduce his benefits was 

dismissed.

 In October 2009, while riding in the back of a vehicle, Eduardo Mendoza fired four shots at the Wayne 

Lyman Morse U.S. Courthouse in Eugene, OR. Mendoza told others in the car that he was firing at the 

U.S. Probation Office, which was located in the building. No one was injured in the attack. The day prior 

to the incident, Mendoza’s probation officer had recommended revoking his probation. 

To further ideological beliefs. These offenders sought to influence the attitudes and behaviors of a broader 

audience, to protest against a specific sociopolitical issue, or to advance a particular belief system in the larger 

society.

 In November 2001, Stanislas Meyerhoff and Ian Wallace placed two incendiary devices on the campus of 

Michigan Technological University in Houghton, MI. One device was placed near the U.S. Forest Service 

Engineering Laboratory, which was owned by the U.S. Department of Agriculture, and the other was 

placed near a building that housed other federally-funded research. Both devices failed to detonate. 

Meyerhoff and Wallace intended to destroy the buildings and the research they contained to protest 

genetic engineering of plants. The attack was directed by William Rodgers and Kevin Tubbs, leaders of 

the Family, an eco-terrorist cell affiliated with the Earth Liberation Front (ELF). 

 In June 2009, Abdulhakim Muhammad opened fire on the Army-Navy Career Center in Little Rock, AR, 

killing one soldier and wounding another. He stated that his actions were to protest the killing and

mistreatment of Muslims by the U.S. military.

Personal gain. These offenders carried out their incidents to gain some personal benefit, such as professional 

recognition, acceptance from peers/romantic partners, illegal gain, or to cause negative consequences to another 

person.

 In May 2008, Rachelle Carlock detonated three pipe bombs near the front doors of the Edward J. 

Schwartz U.S. Courthouse in San Diego, CA. Three others were involved in the planning and execution 

of the attack, including Eric Robinson, Donny Love, and Ella Sanders. Love wanted the others to carry 

out the bombing so he could volunteer information to authorities in exchange for reward money and to 

garner leniency on felony charges he was facing. 
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 24

 In October 2010, James Dix set fire to the U.S. Probation Office in Plymouth, MA. Earlier that afternoon, 

Dix had visited the office to meet with his probation officer. He confessed to violating his probation in the 

hopes of being returned to federal prison. He believed that he was out of options and was going to be 

evicted from his apartment. Instead of revoking his probation, the officer sent Dix for a mental health 

evaluation. Within hours of his release from the hospital, Dix returned to the probation office, set the fire, 

and waited for police to arrive so he could surrender to authorities.

Seeking fame or attention. These offenders sought to gain notoriety, public acclaim, or personal attention.

 In October 2001, two anthrax-laced letters were mailed to Senators Thomas Daschle and Patrick Leahy. 

Following a lengthy investigation, the Department of Justice and the FBI named Dr. Bruce Ivins as the 

lone suspect, alleging that he sent the letters, in part, to increase the importance of his anthrax vaccine 

research, which was at risk of being defunded.

 From December 24, 2011 through December 26, 2011, Justin Bennett engaged in a crime spree targeting 

a police department, U.S. Post Office, strip clubs, and motels in three different cities in Nevada. 

Following his arrest, Bennett gave an interview to a reporter in which he admitted to committing the 

crimes and stated that he hoped he would be referred to as a “gangster,” a “shadow,” and an “assassin,”

but that “vigilante” and “martyr”20 would be good too.

Other motives. Although retaliation, ideological beliefs, personal gain, and seeking notoriety or fame were the 

most prevalent motives, others were also identified. For example, in two of the incidents, at least part of the 

offenders’ motives may have been influenced by a desire to be killed by law enforcement. In the first, in February 

2001, Robert Pickett fired two shots at the White House. Although he was wounded by responding officers, he 

survived the incident. Pickett, who had been involved in a 14-year legal battle with the IRS over his employment 

termination, left a suicide note in his car and had a letter on his person that indicated he did not expect to survive 

the shooting. In the second case, in December 2013, Ricardo Martinez Diaz allegedly ignited a bottle filled with 

gasoline and threw it in the direction of four U.S. Customs and Border Protection officers at a port of entry in San 

Ysidro, CA. As officers responded, Diaz reportedly yelled for them to shoot him.

Other motives that were identified for the incidents were either too infrequent to classify or were more difficult to 

categorize due to their idiosyncratic nature. These included such things as wanting to instill fear in others, a 

general dislike of the government, and taking action based on unusual or unique beliefs. For about one-fourth of 

the incidents (n = 11, 26%), a definitive motive was not identified in open source reporting.

 

20 O’Malley, J. (2011, December 28). Crime spree suspect says, ‘Jesus made me do it.’ Reno Gazette-Journal.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 25

Planning and Pre-Attack Behaviors

Behaviors related to the planning of an attack are often observable and may indicate that an individual or group 

has made a decision to carry out an attack. Planning behaviors include such things as acquiring or manufacturing 

weapons, using deceptive practices to hide activities and/or intentions, researching weapons and targets, 

practicing with a weapon, and conducting surveillance of potential targets. We saw evidence of these various 

behaviors across incidents executed by both lone offenders and groups.

Evidence of Planning Behaviors Among Lone Actors

Of the 43 incidents, 35 are known to have been committed by lone actors. These 35 attacks were executed by 31

individuals, including Yonathan Melaku, who carried out 5 attacks on military targets. Efforts were made to gather 

information on the planning behaviors of the 31 lone actors. Due to the nature of open source reporting, it is likely 

that a larger number of lone actors engaged in planning and other pre-attack behaviors than the number reported 

below.

 Acquiring and/or Manufacturing Weapons (attempted or successful) was reported for just over onehalf of the lone actors (n = 17, 55%). This included purchasing firearms, ordering or manufacturing 

chemicals, and assembling bombs. In their quest to obtain weapons, three of these individuals were 

thwarted from doing so at least once for various reasons. For example, in August 2002, Tashala Hayman 

sent a package containing two cyanide-laced bottles of soda to the office of U.S. Senator Edward

Kennedy. During one of her prior attempts to purchase cyanide, a chemical company denied her request 

after one or more of the company’s employees became suspicious that the business Hayman claimed to 

work for was fictitious. In another case, John Bedell, who opened fire at a Pentagon security checkpoint 

in March 2010, was denied a gun purchase when the federal background check revealed that his mental 

health history precluded him from purchasing a firearm. The third offender, Jared Loughner attempted to

purchase ammunition from a store on the morning of his attack; however, due to his erratic behavior, the 

store clerk told him that they were out of stock. 

 Using Deceptive Practices, that is, hiding activities and/or intentions to avoid detection, was reported for 

over one-quarter of the lone actors (n = 9, 29%). For example, Tashala Hayman used a false identity to 

order cyanide from another company. In addition, in the weeks prior to firing shots at the White House in 

November 2011, Oscar Ortega-Hernandez told his family and friends he was going on vacation, when 

instead he was traveling to Washington, DC. As a final example, prior to mailing ricin-laced letters to 

President Barack Obama and others in May 2013, Shannon Richardson created a PayPal account in her 

husband’s name. She used the account to place orders for castor beans and other supplies to 

manufacture ricin, and then had these purchases forwarded to a post office box that she had opened in 

her name only.

 Researching weapons was reported for about one-fifth of the lone actors (n = 6, 19%). This included 

such activities as researching ammunition, explosives, or biological weapons. For example, Abdulhakim 

Muhammad, who opened fire at a recruiting center in Little Rock, AR in June 2009, acquired manuals on 
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 26

explosives; Nidal Hasan inquired at a gun store about high-tech firearms and ammunition before his 

attack at Fort Hood, TX; and, Abdullatif Aldosary, who attacked a Social Security Administration building 

in Casa Grande, AZ in November 2012, printed instructions from the Internet on military-grade explosive 

material and how to mix chemicals for use in explosives. Further, both James Dutschke and Shannon 

Richardson accessed information on the Internet on how to extract ricin from castor beans before mailing 

ricin-laced letters to President Obama and others in spring 2013.

 Researching Targets was reported for about one-fifth of the lone actors (n = 6, 19%). These behaviors 

included developing lists of potential targets and using the Internet to acquire addresses for specific 

targets. For example, both Tashala Hayman and Abdulhakim Muhammad researched potential targets 

and their locations. In addition, Robert Spadaro, who fired shots at Douglas Bennett, the former 

personnel director for President Ford, sought assistance from acquaintances at the IRS and the Social 

Security Administration to gather information about Bennett.

 Practicing with a Weapon was also reported for less than one-fifth of the lone actors (n = 4, 13%). For 

example, Abdulhakim Muhammad trained by shooting at empty construction sites; Nidal Hasan went to a 

shooting range in preparation for his attack; Jared Loughner practiced shooting in the year prior to his 

attack; and, Aaron Alexis conducted target practice with a rented rifle at a gun range in Virginia two days 

before his attack at the Washington Navy Yard.

 Conducting Surveillance or Approaching Targets was reported for two offenders, representing less 

than one-tenth of the lone actors (n = 2, 7%). In the first case, Robert Spadaro went to Douglas Bennett’s 

residence in a costume on Halloween night and asked Bennett if a party was being held at that address. 

Earlier in the day, Spadaro had also approached Bennett in Washington, DC, pretending to be a real 

estate investor. Spadaro called Bennett by name and asked him if he was affiliated with the private 

investment firm that Bennett owned. In the other case, Bart Ross took photographs from various angles 

of U.S. District Judge Joan Lefkow’s residence prior to breaking into her home in February 2005. 

Although Judge Lefkow was not at home, her husband and mother were in the residence. Ross fatally 

shot both of them before departing the scene.

Evidence of Planning Behaviors Among Groups

Three incidents were executed by two or more offenders. The planning behavior of these incidents included the 

totality of actions taken by all members of the group. In the first incident, the 9/11 terrorist attacks, al-Qa‘ida 

operatives crashed commercial airliners into the Pentagon, the World Trade Center towers, and a field in 

Shanksville, PA. Similar to lone actors, the offenders involved in the planning and execution of this group attack 

engaged in various behaviors before the incident, such as researching targets, researching and acquiring 

weapons, practicing for the attack, conducting surveillance, and engaging in deceptive practices. The nature of 

this attack, however, also necessitated unique types of planning behaviors, such as training on western culture, 

learning English words and phrases, relocating to areas within the U.S., receiving flight training, testing airline 
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 27

security, obtaining financing from overseas, engaging in complex operational security tactics, and undergoing 

psychological and physical fitness testing.

In the second incident, in November 2001, two members of an active ELF cell, known as the Family, placed two 

incendiary devices on the campus of Michigan Technological University in Houghton, MI. One of the devices was 

placed near the U.S. Forest Service Engineering Laboratory, owned by the U.S. Department of Agriculture, and 

the other near a building that housed other federally-funded research. The perpetrators, Stanislas Meyerhoff and 

Ian Wallace, targeted the building to protest genetic engineering of plants. Two Family leaders, William Rodgers 

and Kevin Tubbs, directed Meyerhoff to go to the Midwest, teach others how to build incendiary devices, and 

carry out an arson attack. This incident was the final of 20 arson attacks various members of the Family carried 

out from 1995 to 2001. To execute this specific arson, the group acquired materials, manufactured the incendiary 

devices, used a stolen Michigan license plate to avoid detection, and conducted surveillance on the targeted 

facilities. 

The third incident executed by a group occurred in May 2008 when three pipe bombs were detonated near the 

front doors of the Edward J. Schwartz U.S. Courthouse in San Diego, CA. Four individuals were involved to 

varying degrees in the planning and execution of this attack. The group engaged in planning behaviors that 

included researching potential targets by assessing their vulnerabilities, researching weapons, acquiring materials 

to manufacture bombs, testing explosive devices at other facilities, and using deceptive practices to hide their 

identities.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 28

Execution of the Attacks

The offenders used a variety of weapons and methods of 

attack in executing the incidents. The most prevalent 

weapon was a firearm (n = 25, 58%)21 followed by 

incendiary devices or items contaminated with chemical or 

biological materials sent through the mail (n = 8, 19%). 

These two weapon types were used in almost threequarters of the incidents (n = 32, 74%). Four cases 

involved explosives (9%), five involved arsons or 

incendiary devices (12%), and two involved airplanes 

(5%). For each type of weapon category, information on 

the distances the offenders traveled from their homes to 

execute the attacks, how and when the attacks resolved, 

the casualties and damages caused, and other details is

provided.

Firearms22

The firearm incidents varied greatly, ranging from shots fired overnight at buildings to active shooter situations 

lasting over an hour. The individuals responsible for 24 of the 25 incidents involving firearms have been 

identified.

23 All of the shootings for which the offenders were 

identified were committed by lone actors.24 The offenders resided at 

varying distances from their targets, ranging from approximately 1

mile to over 4,800 miles (see Table 2).25

Almost three-quarters of the offenders brought one firearm with them

(n = 18, 72%), while the remaining offenders were armed with 

between two and four firearms (n = 6, 24%). As to the type of 

firearm, over two-thirds of the offenders brought handguns (n = 17, 

68%) and approximately one-quarter of the offenders brought long 

guns (n = 6, 24%). In two incidents, the offenders brought both types 

of guns. Only one of the offenders acquired an additional weapon 

 

21 One incident involved a firearm and arson. This occurred in December 2011, when Justin Bennett fired shots at, and set fire to, a U.S. Post Office in 

Verdi, NV. This incident is included in the analyses in both the Firearms and Arsons and Incendiary Devices sections. 

22 Five of the firearm attacks were part of Yonathan Melaku’s 2010 17-day shooting spree against military targets.

23 The individual(s) responsible for the October 2001 shooting of Assistant U.S. Attorney Thomas Wales has not been identified.

24 In October 2009, Eduardo Mendoza, Jr., fired four shots from the passenger seat of a moving vehicle at the Wayne Lyman Morse U.S. Courthouse in

Eugene, OR. Mendoza reportedly told others in the vehicle that he was firing at the U.S. Probation Office that was located in the building. It did not 

appear as though the other passengers in the car were directly involved in the planning or execution of the attack, and no one else was charged in the 

incident. For these reasons, this case is considered a lone actor incident for purposes of this report.

25 Information on the distance from the lone actors’ residences to the targets of the attacks was not found in open sources for two of the firearm incidents, 

including one case in which the subject is unknown and another in which a lone actor’s address could not be determined nor approximated within a 

designated range.

Table 2: Distance from Offenders’ 

Residences to Locations of Federal 

Targets (Firearm Attacks)

*Distance in miles n %

0-10 8 32

11-25 8 32

26-100 3 12

101-1000 1 4

1001-5000 3 12

Unknown 2 8

* All distances are approximate.

Comparison to Previous

Secret Service Research

In the late 1990s, the U.S. Secret Service studied 83 

persons known to have assassinated, attacked, or 

approached with lethal intention, a person of 

prominent public status in the United States between 

1949 and 1996. A subset of cases from the earlier 

study, comprised of 19 attacks committed by 23 

offenders directed toward federal targets, was 

compared, where possible, with results from the 

current study. In both studies, lone offenders 

committed most of the attacks and firearms were the 

most common weapon. See Appendix E for statistical 

tables comparing the two sets of incidents and the 

offenders who executed them. 
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 29

from site security and used it during the incident. In this case, after fatally wounding a security officer, Aaron 

Alexis took the officer’s handgun and used it as he continued his attack at the Washington Navy Yard.

The offenders left the sites unimpeded in over half of these incidents (n = 13, 52%). It is important to note, 

however, that eight (62%) of these cases involved shootings at federal sites outside of normal business hours. 

Meanwhile, the offenders disengaged as a result of law enforcement intervention in almost half of the cases

(n = 11, 44%). These incidents included law enforcement personnel shooting or subduing the gunmen, or, in the 

case of the hostage situations, negotiating the offenders’ surrender. In the remaining attack, bystanders subdued 

Jared Loughner after he opened fire at Representative Giffords’s constituent event. They were able to restrain 

him until law enforcement arrived on the scene.

The firearm attacks ranged in length from less than a minute, to active shooter events lasting over an hour. Over 

three-quarters of these incidents ended in less than 16 minutes (n = 20, 80%). Specifically, one-half of the

attacks resolved in one minute or less (n = 13, 52%),

26 about one-tenth resolved in 1-3 minutes (n = 3, 12%), and 

just under one-fifth lasted 5-16 minutes (n = 4, 16%). Three of the incidents lasted over an hour. These included 

Aaron Alexis’s attack at the Washington Navy Yard, which lasted just over an hour; and two incidents involving

hostage situations that each lasted several hours. In the first, in February 2006, George Curran allegedly held

hostages for about seven hours at the National Labor Relations Board (NLRB) office in Phoenix, AZ. In the 

second, in December 2009, Warren Taylor held hostages for approximately eight-and-a-half hours at the U.S. 

Post Office in Wytheville, VA. Finally, for two incidents, it is unclear how long the offenders were on site. One 

incident involved Bart Ross, who broke into Judge Lefkow’s home reportedly around 4:30 a.m., then hid in the 

basement intending to wait for her return. Around 9:00 a.m., he shot Judge Lefkow’s husband, and sometime 

later, shot her mother. Per Ross’ report, he remained in the home until 1:15 p.m. The other incident involved 

Justin Bennett, who on December 24, 2011 at approximately 11:55 p.m., fired shots at the local police station in 

Sparks, NV. Several hours later, at approximately 4:30 a.m. on Christmas Day, he fired shots at the U.S. Post 

Office in Verdi, NV and set the building on fire. It is unknown how long Bennett remained at the post office during 

the incident.

Less than half of the firearm incidents resulted in casualties (n = 12, 48%), with a total of 61 injuries and 38

deaths occurring across the incidents. Three of the shootings accounted for 81% of the casualties caused by 

perpetrators using firearms. These three incidents included the November 2009 attack by Nidal Hasan at Fort 

Hood (responsible for 45 casualties), the January 2011 attack by Jared Loughner (responsible for 19 casualties), 

and the September 2013 attack by Aaron Alexis (responsible for 16 casualties). In the other nine shootings that 

resulted in casualties, between one and four persons were injured or killed in each incident. 

 

26 For purposes of this report, incidents involving sniper-style and drive-by shootings were categorized as lasting one minute or less.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 30

Mailings27

Mailings containing incendiary devices or items contaminated with chemical or biological materials were the 

second most prevalent method of attack (n = 8). The individuals responsible for the mailings were identified in 

only six of the cases (75%). 

The offenders generally sent two or more letters 

or packages (n = 7, 88%), and in most of the 

mailings, the letters and packages were 

addressed to specifically named public officials

(n = 7, 88%). In two of the incidents, however, 

letters were addressed more generally to 

federal facilities, departments, and offices. 

Meanwhile, almost two-thirds of the mailings 

were addressed solely to federal targets in the 

Washington, DC region (n = 5, 63%), while the 

remainder also included targets in other states

(n = 3, 38%). 

In three (38%) of the mailings, the offenders 

sent items to targets at multiple levels of 

government and others outside of the 

government. The first occurred in January 

2011, when an unknown individual(s) sent 

incendiary packages to Department of 

Homeland Security Secretary Janet Napolitano, 

Maryland Governor Martin O’Malley, and 

Maryland Transportation Secretary Beverley 

Swaim-Staley. The second occurred in April 

2013, when James Dutschke mailed letters 

containing ricin to President Barack Obama and 

U.S. Senator Roger Wicker, as well as Lee 

County Justice Court Judge Sadie Holland in 

Tupelo, MS. In the remaining case, in May 

2013, Shannon Richardson mailed letters 

containing ricin to President Obama, New York 

City Mayor Michael Bloomberg, and the Executive Director of Mayors Against Illegal Guns.

 

27 Seven of the mailings involved the sending of more than one package and/or letter to more than one public official or government entity. For the 

purposes of this report, a group of letters or packages sent by the same individual were considered one incident.

2013 Ricin Mailings

In the spring of 2013, in three separate incidents, offenders mailed

ricin-laced letters to federal targets. All three incidents involved 

more than one target, included threatening language, were 

intended to frame others, and did not cause injuries or deaths.

In April 2013, James Dutschke sent three ricin-laced letters with 

similar text to President Barack Obama, U.S. Senator Roger Wicker, 

and Lee County Justice Court Judge Sadie Holland. Judge Holland 

opened the letter addressed to her; however, the other two letters 

were intercepted at mail facilities. Dutschke, who had previous 

contact with Judge Holland and Senator Wicker, wrote the letters 

to make them appear as though they were written by another man 

who Dutschke disliked.

In May 2013, Shannon Richardson mailed three ricin-laced 

letters to President Barack Obama, New York Mayor Michael 

Bloomberg, and Mark Glaze, the head of Mayors Against Illegal 

Guns, a national gun-control advocacy group. Glaze opened the 

letter addressed to him; however, the other two letters were 

intercepted at mail facilities. Though the text of the letters varied 

slightly, they all referenced gun-control issues and contained 

threats. Richardson wrote the letters to make them appear as if 

they were written by her husband, and when initially interviewed 

by the FBI, she told them that her husband had sent them. 

In May 2013, Matthew Buquet allegedly mailed five ricin-laced 

letters to President Obama, U.S. District Judge Frederick Van Sickle, 

a U.S. Post Office in Spokane, WA, the Fairchild Air Force Base, and 

the CIA. Although the letters directly threatened the targets and 

were signed from the Lebanese terrorist group Hezbollah, Buquet 

apparently had no connection to the group. In addition, at least 

one of the mailings used an envelope with the name of a law firm 

where Buquet previously was assigned to work as a janitor. 

Following harassment allegations, his employer had transferred 

him from the firm and he was fired a month prior to the mailing of 

the letters. 
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 31

None of the mailings reached the public officials or facilities that were targeted at the federal level (see 2013 Ricin 

Mailings inset for recent examples). In all but one of the attacks (n = 7, 88%), the letters or packages were 

intercepted at on-site or off-site mail-sorting facilities. In the remaining incident, two anthrax-laced letters were 

sent to Senators Thomas Daschle and Patrick Leahy. One letter arrived at the office of Senator Daschle in 

Washington, DC, but did not actually reach the senator, while the other letter was misrouted to the U.S. 

Department of State.

Although the items enclosed in the letters or packages included ricin, anthrax, food or drink tainted with rat poison 

or cyanide, and an incendiary device, only one mailing resulted in casualties. This was the mailing of the anthraxlaced letters to Senators Daschle and Leahy, which killed four and sickened seven in four states and the District 

of Columbia. Those who died included two postal workers and two private citizens; and those sickened included 

five postal workers, a U.S. Department of State employee, and a private citizen.

Four offenders mailed the packages from their hometowns, while two others traveled to neighboring states to mail 

their letters. For two of the offenders who mailed the packages from their hometowns, the envelopes were 

postmarked by a facility in a neighboring city, which is not uncommon. As for those offenders who traveled out of 

state, the FBI and the Department of Justice allege that Dr. Bruce Ivins drove from Maryland to New Jersey, 

where he placed the anthrax-laced letters into post boxes near Princeton University. Similarly, Barbara March, 

who sent 14 packages containing cookies or candy laced with rat poison to various public officials in April 2005, 

lived in Connecticut and traveled to New York to mail her packages. The individuals responsible for the other two 

mailings have not been identified, thus, it is unknown whether they traveled from their hometowns to mail the 

letters and packages.

Although the language of the letters in the mailings ranged from direct threats to non-threatening content, most of 

them contained threatening language and/or referenced a political issue. Examples of the language include:

 Direct threat as part of a poison-pen scenario: When Barbara March mailed her packages, she 

included typewritten letters that stated “We are (or I am) going to kill you. This is poisoned.”28 She 

signed each letter using the names of former acquaintances and family members she thought had 

wronged her in the past.

 Threat falsely connected to terrorism: The handwritten text of the anthrax-laced letters sent to 

Senators Leahy and Daschle contained threats designed to cause intimidation and mislead investigators 

by making the reader think the letters were written by al-Qa‘ida operatives. The letters referenced the 

9/11 terrorist attacks, which had just occurred, and read: “WE HAVE THIS ANTHRAX. YOU DIE NOW. 

ARE YOU AFRAID? DEATH TO AMERICA. DEATH TO ISRAEL. ALLAH IS GREAT.”29

 Conditional threat with reference to a specific policy issue: In the fall of 2003, two typewritten letters, 

one containing a vial of ricin and one sprinkled with ricin, were mailed to the U.S. Department of 

 

28 Search Warrant, United States v. March, No. 1:05-cr-00254 (D. Conn. June 24, 2005).

29 Application and Affidavit for Search Warrant, In the Matter of the Search of Property of Bruce Edwards Ivins, No. 08-431 (D.D.C. July 11, 2008).
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 32

Transportation and the White House (see photo inset). Both letters were signed "Fallen Angel." The 

outside of the envelope addressed to the Department of Transportation bore the text: “caution RICIN 

POISON Enclosed in sealed container Do not open without proper protection.”30 Demanding the repeal 

of new trucking regulations, a letter contained in the envelope stated, “I’m a fleet owner of a tanker 

company. I have easy access to castor pulp. If my demand is dismissed I'm capable of making Ricin. 

My demand is simple, January 4 2004 starts the new hours of service for trucks which include a ridiculous 

ten hours in the sleeper berth. Keep at eight or I will 

start dumping. You have been warned this is the only 

letter that will be sent by me.”31 Weeks later, the 

envelope addressed to the White House was 

discovered. It contained a letter also addressed to the 

Department of Transportation that made a similar 

demand, this time threatening “If you change the hours 

of service...I will turn D.C. into a ghost town. The 

powder on the letter is RICIN have a nice day.”32 No 

suspect(s) has been identified.

 Aggressive language with a veiled reference to a specific policy issue: In January 2011, three 

incendiary packages were mailed to the Secretary of Homeland Security Janet Napolitano and two 

Maryland state officials (see photo inset). Investigators reported that all three packages contained the 

same handwritten note, which read: “Report suspicious activity! . . .You have created a self fulfilling

prophecy.”33 Investigators believed the language was 

referencing Maryland’s toll-free terrorism tip line, 

displayed on the electronic highway signs that urge 

motorists to report suspicious activity. They further 

speculated that Secretary Napolitano was targeted 

because of the “See Something, Say Something” 

campaign in which she urged people to report 

suspicious activity. No suspect(s) has been identified.

 Non-threatening language: There was no information 

found in open sources on whether a letter was included in the package Tashala Hayman sent to Senator 

Kennedy in August 2002. The text of a note found in another package she had prepared for a member of 

the British Royal Family, however, was described. That note read: “Have a Coke and a smile.”34

 

30 Lengel, A. (2004, April 6). Probe of ricin on Hill still wide open, FBI says; Toxin found in February provides few clues. The Washington Post, p. B4.

31 Ricin letter text. (2004, February 4). The Associated Press. 

32 Eggen, D. (2004, February 24). FBI releases details of letter with ricin sent to White House; Postmark was weeks before discovery. The Washington 

Post, p. A3. 

33 Paige, J. (2011, January 7). Package that ignited in Washington DC postal room ‘similar to Maryland ones;’ Authorities said item addressed to US head 

of homeland security shared likeness with others found day before. The Guardian.

34 Johannes, K. N. (2002, August 17). Vaughn woman charged in poison threat to Sen. Kennedy. Great Falls Tribune, p. 1A.

Package sent to Governor O’Malley (Photo courtesy 

of the U.S. Department of Homeland Security)

Vial of ricin sent to the U.S. Department 

of Transportation (Photo credited to the FBI)
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 33

Explosives

Four incidents (9%) involved explosives that were placed outside federal facilities either overnight or in the early 

morning hours. The explosives detonated in three of the incidents, resulting in no injuries and only minimal to 

moderate property damage, such as broken windows, shattered doors, and damaged entryways and security 

equipment. Those responsible for, or suspected of, carrying out three of the attacks have been identified. The 

four incidents involving explosives included:

 Armed Forces Recruiting Station: In March 2008, an unknown assailant(s) placed a device in front of 

the U.S. Armed Forces Recruiting Station in New York, NY. The device, which detonated, had been 

placed in an ammunition box similar to those that can be purchased at military supply stores.

 Courthouse: In May 2008, Donny Love and his three associates built three pipe bombs using two 

pounds of gunpowder and three 10-inch pipes, ranging in thickness from 1.5 to 2 inches. The pipes were 

taped together and placed inside a backpack with a jar of nails. Video footage showed Rachelle Carlock 

placing the backpack next to the doors of the Edward J. Schwartz United States Courthouse in San 

Diego, CA just after 1:40 a.m. She then lit the device and departed. Moments later the device detonated. 

Prior to the attack, the group had tested similar devices at a hardware store and a Federal Express 

distribution center. The four offenders lived together and resided approximately 65 miles from the 

courthouse.

 Federal Building: In February 2011, Gary Mikulich allegedly left an explosive device outside the Patrick 

V. McNamara Federal Building in Detroit, MI. The building housed several government agencies, 

including the Detroit Field Office of the FBI, which Mikulich was 

reportedly targeting. The device was described as a metal 

rectangular cash safe that contained wires, electrical components, 

dense material, PVC pipe, a spring-wound timer, and black electrical 

tape. It is unclear whether the timer was set since the device failed 

to detonate. He lived approximately 350 miles from the site of the 

attack.

 Federal Office: In November 2012, Abdullatif Aldosary detonated a 

homemade explosive device outside the Social Security 

Administration (SSA) building in Casa Grande, AZ (see photo inset). 

Although the attack occurred prior to business hours, 14 employees 

were inside the building. The explosion and ensuing fire caused 

minimal damage to the walls, door, and window, but no injuries to 

persons. Aldosary lived approximately 10 miles from the target. 

Damage to SSA building in

Casa Grande, AZ 

(Photo courtesy of Casa Grande Dispatch)
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 34

Arsons and Incendiary Devices

Four of the incidents involved fires that were set overnight at federal facilities, while a fifth involved an incendiary 

device thrown at a port of entry during daylight hours (n = 5, 12%). Although no one was injured, several of the 

arsons resulted in extensive property damage, causing the targeted facilities to remain closed while undergoing

substantial repairs. Descriptions of these incidents are provided below.

 Federally-Funded Research Facilities: Two of the arsons were committed in the name of ELF and 

targeted facilities that housed federally-funded research. The first incident occurred in November 2001, 

when Stanislas Meyerhoff and Ian Wallace placed two incendiary devices outside research buildings on 

the campus of Michigan Technological University in Houghton, MI. Prior to the incident, Meyerhoff had 

moved into Wallace’s residence, which was located approximately 370 miles from the university. 

Although the devices were constructed using five-gallon containers filled with gasoline and had ignition 

switches and timers attached, they failed to ignite. This design was similar to one described in ELF 

brochures and on ELF websites. In the second incident, in August 2002, members of ELF targeted the 

U.S. Forest Service’s Forestry Sciences Laboratory located in Irvine, PA. Information describing how the 

fire was set was not found in open source. Days after the attack, a communiqué signed by the Pacific 

ELF claimed responsibility for the attack, which caused approximately $700,000 in damages. 

 U.S. Probation Office: In October 2010, James Dix broke the first floor window of the U.S. Probation 

Office in Plymouth, MA, poured gasoline through the window, and tossed a lit napkin inside to ignite the 

gasoline. The fire caused significant damage to the building, furnishings, and computer equipment 

owned by the U.S. Probation Office, as well as damage to other offices leased by commercial tenants. 

The damage was estimated at approximately $2 million. Dix lived approximately 20 miles from the office.

 U.S. Post Office: In December 2011, Justin Bennett set fire to, and fired shots at, a U.S. Post Office in 

Verdi, NV. It is unclear exactly how he started the fire. Some reports state that Bennett ignited fireworks 

inside the building, while others state that he tossed an accelerant into the building. The fire caused 

severe damage and the post office was closed for 13 months while repairs were completed. Bennett

lived approximately 13 miles from the post office.

 U.S. Customs and Border Protection Port of Entry: In December 2013, Ricardo Martinez Diaz 

allegedly ignited a glass bottle filled with gasoline and threw it toward a vehicle inspection booth and four 

U.S. Customs and Border Protection officers at the San Ysidro Port of Entry in San Ysidro, CA. Officers 

used fire extinguishers to douse the flames, and no structural damage was noted. Diaz lived 

approximately 115 miles from the port.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 35

Airplanes 

Two incidents involved the crashing of airplanes into occupied buildings. One of these incidents was the 9/11 

terrorist attacks, which involved nearly 30 individuals in the planning and execution of the attack. These 

individuals had various roles, for example, some were leaders of the group, making decisions and providing 

direction and oversight; some offered support by providing funding and/or logistics; and others executed the 

attack using four commercial airplanes.

The second incident occurred in February 2010 when Andrew Stack intentionally flew his plane into an Austin, TX 

building that housed an IRS office (see photo inset). Stack had a 30-year history of opposing and protesting the 

U.S. tax system and had been dealing with a tax audit prior to the attack. He had a pilot’s license and used his 

own single-engine plane to fly out of a 

municipal airport located approximately 

20-25 miles from his home. He had been 

renting a hangar at the municipal airport 

for four-and-a-half years. On the day of 

the attack, Stack did not file a flight plan 

before his takeoff. Under Federal 

Aviation Administration (FAA) rules, such 

flight plans are not required as most 

small airplanes can fly under visual flight 

rules (VFRs) in good weather.35 

 

35 Under visual flight rules (VFRs), the pilot is not required to file a flight plan or rely on air traffic control to navigate the plane. See Federal Aviation 

Administration. (2014). Aeronautical information manual. Washington, DC: Federal Aviation Administration.

Damage caused when Andrew Stack flew his single-engine plane into a building 

housing an IRS office in Austin, TX. 

(Photo retrieved from http://en.wikipedia.org/wiki/2010_Austin_suicide_attack)
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 36

PART THREE: BACKGROUNDS OF THE OFFENDERS
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 37

BACKGROUNDS OF THE OFFENDERS

xamining the lives of offenders prior to 

their attacks offers insights into potential 

intervention points as well as factors 

that may have influenced their decisions. 

Information related to the offenders’ histories 

and prior behaviors was collected on 39 of the 

perpetrators.36 These offenders included the 31

lone actors, 4 individuals who collaborated on 

the attack at the U.S. courthouse in San Diego, 

CA, and the 4 members of the Family, an ELF 

cell, who collaborated on the attack on two 

buildings that housed government research on 

the campus of Michigan Technological 

University. The offenders who planned and/or 

executed the 9/11 terrorist attacks were not 

included in these analyses for several reasons. 

First, the report gathered information on those 

individuals who were residing in the U.S. before 

they developed an interest in targeting a federal 

government facility or public official in order to 

provide information that would assist domestic 

law enforcement with the identification of these 

individuals before they commit an attack. In addition, since the systems (e.g., judicial, educational, mental 

health) available in the U.S. differ from those available in other countries, we focused on offenders who may have 

had contact with these domestic systems prior to carrying out their attacks. For these reasons, the individuals 

involved in the 9/11 terrorist attacks, who initiated their planning activities overseas and moved to the U.S. after 

their decision to target U.S. interests in the homeland, were excluded from these analyses.

Given open source reporting on a few of the offenders was limited, it is likely that a larger number than reported 

here may have engaged in, or experienced, the behaviors, symptoms, and other background events explored in 

this section. Information on such things as the offenders’ ages, drug and alcohol use, criminal history, history of 

violence toward others, concerning behaviors, fixations, history of mental health symptoms, stressors, contact 

with various systems, and prior communications is provided.

 

36 The background information for Yonathan Melaku, who was responsible for five separate attacks on military targets in Virginia in 2010, was only 

counted once in the offender-level analyses. 

Comparison to Previous U.S. Secret Service 

Research

As noted earlier, in the late 1990s, the U.S. Secret Service 

studied 83 persons known to have attacked or 

approached with lethal intention, a person of prominent 

public status in the United States between 1949 and 

1996. A subset of cases from the earlier study, comprised 

of 19 attacks committed by 23 offenders directed toward 

federal targets, was compared, where possible, with 

results from the current study. Males accounted for over 

85% of the offenders in both studies. The offenders in 

the current study were on average older than those in the 

earlier study, with the mean age being 41 and 35 

respectively. Almost three-quarters of the offenders in 

the earlier study had been arrested, compared with 

almost two-thirds of the offenders in the current study. 

Although both groups had similar levels of arrests for 

violent crimes, offenders in the earlier study had slightly 

higher rates of arrest for non-violent crimes. Similar 

levels of depressive symptoms and delusions were found 

among offenders in both groups; however, a greater 

percentage of offenders in the current study exhibited 

hallucinations. None of the offenders in the earlier study 

who attacked a federal public official made a threat 

directly to the target, whereas in the current study, three 

attackers directly threatened the targets. See Appendix E 

for statistical tables comparing the two sets of incidents 

and the offenders who executed them.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 38

General Histories

Most of the offenders were male, over the age of 30, 

with varied educational backgrounds. Most of the 

offenders were male (n = 34, 87%), with only five females 

involved in the attacks. While they ranged in age from 20 to 

81 years old (M = 41), almost three-quarters were over 30 

(n = 28, 72%) (see Figure 3). Their educational 

backgrounds ranged from those who attended high school 

without receiving a diploma to those who received doctoral 

or medical degrees.

37

A history of drug use was reported for over a third of 

the offenders. Over one-third of the offenders had a known history of drug use (n = 15, 39%), with marijuana 

and cocaine being the most commonly used substances. In addition, over one-third of the offenders had a history 

of drug and/or alcohol abuse (n = 14, 36%). Substance abuse was evidenced by such behaviors as habitual use, 

receiving substance abuse treatment, suffering disciplinary or legal consequences because of their substance 

use, and engaging in illegal behavior to obtain drugs or alcohol. The offenders abused, among others, alcohol, 

prescription drugs, marijuana, methamphetamines, hallucinogens, and cocaine.

A history of criminal charges or arrests was reported for more than half of the offenders. Over half of the 

offenders had reported histories of criminal charges or arrests outside of minor traffic violations (n = 24, 62%). All 

but two of these individuals had at least one charge for a non-violent crime (n = 22), while one-third of the overall 

offenders had charges or arrests for aggressive or violent crimes (n = 13, 33%) and just over one-tenth had 

arrests related to sex crimes (n = 5, 13%) (see Figure 4).

Six offenders (15%), with no histories of criminal 

charges or arrests, appeared to have committed 

criminal acts for which they were never charged. 

For example, Andrew Stack had a history of tax 

evasion before flying his single-engine plane into 

an Austin, TX building that housed an IRS office. 

Additionally, Bruce Ivins burglarized sorority 

houses and committed acts of vandalism. He also 

reportedly mailed five anthrax-laced letters to 

media outlets prior to sending anthrax-laced letters 

to Senators Daschle and Leahy in October 2001.

 

37 Educational background was not found in open source for just under one-quarter of the offenders (n = 9, 23%).

Figure 3: Age Distribution

0

2

4

6

8

10

12

20-29 30-39 40-49 50-59 60-69 70-79 80-89

Age of Offenders (n = 39)

Figure 4: Criminal Charges and Arrests
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 39

A history of violence against others was reported for over half of the offenders. Half of the perpetrators 

engaged in violent acts against other persons (n = 20, 51%). These acts ranged from physical altercations to 

murder. For example, Abdulhakim Muhammad, who killed one soldier and injured another in Little Rock, AR, had 

a history of getting into fights dating back to middle school, some involving weapons. Meanwhile, Donny Love, 

who masterminded the attack on the U.S. courthouse in San Diego, CA in May 2008, physically abused his 

girlfriend, Rachelle Carlock, who helped carry out the attack. A final example is Johnny Wicks, who opened fire in 

the Lloyd D. George Federal Building and U.S. Courthouse in Las Vegas, NV, killing a court security officer and 

wounding a Deputy U.S. Marshal and a law clerk. In 1974, Wicks fatally shot his brother during an argument 

about whose vehicle was faster. Additionally, four offenders, who did not have a history of violence against 

others, did engage in aggressive or intimidating behaviors that caused others to call law enforcement, to include

campus police, court security, or local authorities. These behaviors included making threatening statements or 

gestures, throwing objects, and punching walls.

One-fifth of the offenders were reported to have stalked or harassed other persons. One-fifth of the 

perpetrators had a history of stalking or harassing others (n = 8, 21%), including strangers, coworkers, former 

friends, acquaintances, and family. These behaviors included writing letters, causing problems for others in their 

personal and professional lives, and damaging victims’ personal property. For example, Bruce Ivins engaged in 

numerous actions over a 30-year timeframe in which he stalked one woman who he met while working at the 

University of North Carolina. The woman was a member of Kappa Kappa Gamma (KKG), a sorority with which 

Ivins was obsessed. Ivins repeatedly drove by her house and at one point stole notebooks from her that were 

crucial to her dissertation, only to return them anonymously a few days later. Years later, when both Ivins and the 

target of his harassment were living in Maryland, Ivins spray-painted “KKG” on a sidewalk and fence at the home 

she shared with her fiancé and on her fiancé’s car window. He also sent a letter in her name that defended the 

practice of hazing to a newspaper editor, and then once published, sent a clipping of the article to an anti-hazing 

activist whose son had died in a hazing incident.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 40

Concerning Behaviors

All but one offender engaged in concerning behaviors before their attacks (n = 38, 97%). These actions were 

diverse, and included such things as making disturbing statements, having unexplained changes in behavior, and 

experiencing conflict in relationships. In addition, the offenders also engaged in final act behaviors, which include 

actions indicative of someone placing 

their affairs in order (e.g., writing a will or 

saying goodbye). For half of the 

offenders (n = 20, 51%), some of these 

concerning behaviors caused worry in 

others to the point that they took some 

action or voiced apprehension about the 

offenders in the five-year timeframe 

leading up to their attacks. The following 

examples highlight the types of 

concerning behaviors exhibited by the 

offenders: 

 Almost two-thirds of the offenders engaged in concerning communications unrelated to their targets (n 

= 25, 64%), during which they aired grievances, referenced ideological or sociopolitical issues, or made 

threats or veiled references of harm. For example, years prior to his alleged placement of an explosive 

device outside the Patrick V. McNamara Federal Building in Detroit, Gary Mikulich reportedly told a 

psychiatrist that he often ruminated about buying bullets, and that if he were to kill someone, he would not 

tell anyone about his intentions. The offenders’ communications also included themes of depression or 

suicidal ideation, and bizarre or delusional ideas. For example, Jared Loughner made numerous online 

communications accusing the U.S. government of using grammar and currency to control its citizens.

 One-half of the offenders exhibited changes in behavior related to occupational, physical, social, or 

interpersonal functioning (n = 21, 54%). Those who exhibited such changes were more likely to commit 

serious attacks, that is, incidents in which the attack caused or could have caused harm to others, as 

compared to offenders who did not exhibit such changes.38 The behavioral changes identified in the 

study included declines in work performance as evidenced by a decrease in the quality of work products 

or increased absenteeism; a decline in grades or dropping out of school; or changes in physical 

appearance, daily routine, or living situation. For example, several months before firing shots at the 

White House, Oscar Ortega-Hernandez’s appearance began to change. He grew out his hair and beard 

and began referring to himself as a modern-day Jesus Christ, prompting concern among those who knew 

 

38 The incidents ranged in severity from those in which there was no risk of harm to persons (e.g., explosives detonated outside a building overnight), to 

other incidents in which the attack caused or potentially could have caused harm to others (e.g., shots fired into a crowd of people). Logistic regressions 

were performed to examine factors that differentiated between those offenders who executed attacks that caused or could have caused physical harm to 

one or more persons (n = 20, 51%) and those offenders who executed attacks that posed a low risk of such harm (n = 19, 49%). Statistical tables showing 

the results of the logistic regression analyses for which significant differences were found are included in Appendix D.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 41

him. Meanwhile, some offenders exhibited a marked change in mood or engaged in uncharacteristic 

behavior, such as unpredictable anger, outbursts, or becoming paranoid that others were conspiring 

against them. 

 Just under one-half of the offenders displayed interpersonal difficulties (n = 18, 46%). These 

individuals withdrew or distanced themselves from friends or family, disappeared for days or weeks, or 

stopped communicating with those close to them. In addition, most of these offenders experienced 

strained relationships with family because their behavior led to conflicts or elicited concern from family 

members. In the weeks before flying his plane into an IRS office, Andrew Stack’s wife told her parents 

that his increasing anger about their taxes was causing a strain on their marriage. 

 One-fifth of the offenders engaged in final act behaviors (n = 8, 21%). These behaviors were conducted 

by the offenders prior to their attacks. They included leaving goodbye messages on the voice mails of 

friends or posting goodbyes on social networking sites, giving away belongings, setting fire to their own 

residences, and leaving a will. Bart Allen Ross gave away his pet dog and cat, whom he considered to 

be his only family, several days before he broke into the home of Judge Joan Lefkow. Some offenders’ 

final acts were more destructive. Two offenders, Johnny Lee Wicks and Andrew Stack, set fires in their 

residences in the hours prior their attacks. Specifically, before opening fire in the Lloyd D. George 

Federal Building and United States Court House in Las Vegas, NV, Wicks set a small fire in the closet of 

his apartment; while Stack set his family’s home on fire before leaving for the airport.

In addition to eliciting concern about their behaviors, at some point in their lives, almost two-thirds of the offenders 

elicited concerns in others about their own safety or the risk they posed to others (n = 25, 64%). Those 

concerned about the offenders’ safety included family, friends, coworkers, teachers, law enforcement personnel, 

and mental health professionals. For example, Bart Ross was the subject of three investigations over a five-year 

period. These investigations were launched after court personnel reported Ross’ threatening and bizarre 

behaviors. In late 1995, 10 years prior to Ross’ attack at Judge Lefkow’s home, a judge ordered an investigation 

after Ross filed documents that referenced blowing up the U.S. Supreme Court in the same manner as the 

Oklahoma City bombing that had taken place that April. In 1999, the Illinois Office of the Attorney General 

opened an investigation after receiving bizarre and threatening letters and repeated calls from Ross. Then in 

2000, the Illinois Secretary of State Police investigated Ross after he called the Illinois Court of Claims and 

threatened to kill himself and take others with him.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 42

Fixations

Almost half of the offenders exhibited evidence of having a fixation, defined as, an intense or obsessive 

preoccupation with an individual, activity, or idea (n = 19, 49%). Those individuals demonstrating a fixation 

showed an intense preoccupation with a specific person or cause, held progressively stronger opinions or beliefs 

to the point that it significantly impacted their lives, and depicted the objects of their fixations in increasingly

positive or negative ways over time. The fixations often carried an angry or emotional undertone and revolved 

around several themes, to include personal vendettas, perceived injustices, political ideologies, or idiosyncratic 

beliefs. For example, in April 2013, James Dutschke included information in the anthrax-laced letters that he sent 

to several public officials that implied they were sent by another man. Dutschke had become obsessed with this 

other man during the six years leading up to the attack and he viewed him as a personal and professional rival. 

Dutschke taunted him about his music career in emails, stalked him online, and engaged in a running feud with 

him via social media. Dutschke also allegedly tried to sabotage this man’s career as a performer by contacting 

various sponsors to inform them about the man’s past legal problems, which reportedly caused him to lose 

numerous bookings. In another case, prior to his alleged hostage taking incident at a National Labor Relations 

Board (NLRB) hearing in February 2006, George Curran reportedly became obsessed with the perceived injustice 

of his wife’s employment termination from the Transportation Security Administration (TSA). In the two years 

leading up to the hostage incident, Curran filed numerous complaints with regulatory and law enforcement 

agencies, filed a lawsuit against numerous government agencies, quit his job so he could devote all of his time to 

the case, and experienced paranoid beliefs that others were conspiring against him and his wife.

Concerning Behavior May Not Be Evident in All Areas of Life

A comprehensive threat assessment includes gathering information on inconsistencies in a person’s words and actions 

across all areas of the individual’s life. Since those who plan attacks may be able to hide aspects of their behaviors, stress, 

and other information from some people in their lives, it is important to create a complete picture of the person by gathering 

information from a variety of sources, including interviews, reviews of records, and searches. The importance of gathering 

information across sources is highlighted with the case of Bruce Ivins. Prior to mailing several anthrax-laced letters in 

October 2001, he had become adept at compartmentalizing his life and activities. Thus, while some people who knew him 

were concerned, others were not worried. 

In his public life, Ivins was a married father of adopted twins who played the keyboard at church every Sunday. He founded 

a community group for jugglers that provided entertainment to children, and was known to be a dedicated scientist and 

expert in his field. Coworkers characterized him as a jokester who often penned humorous poems and gave candy to visitors

in the workplace. Ivins’s private life, however, which was hidden from even close family members, demonstrated a much 

darker existence. He harbored secret obsessions and fetishes and engaged in harassing and stalking behaviors, both at work 

and outside. Further, over the years, he committed several burglaries and acts of vandalism. He also had a mental health 

history of depression, paranoia, and homicidal ideation; and unbeknownst to his family, attended Alcoholics Anonymous.

Though these behaviors caused concern in others, including law enforcement, coworkers, and his therapist, no one had the 

full picture of who he was in all areas of his life. This compartmentalization was deliberate and allowed Ivins to hide his 

obsessions, depression and paranoia, and criminal behaviors.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 43

Mental Health Histories

In studying whether the offenders experienced mental health symptoms, and in turn, whether these symptoms 

influenced their decisions to execute their attacks, we focused on identifying information that law enforcement 

personnel and others could gather as part of an investigation. The most common symptoms are described as 

well as whether these symptoms influenced the offenders’ decisions to engage in their attacks.

Symptoms and Diagnoses

Over half of the offenders experienced symptoms of mental illness (n = 20, 51%), with most of these individuals 

having more than one symptom (n = 15) (see Table 3). The three most common symptoms included:

 Paranoia refers to feelings of pervasive 

distrust and suspiciousness that one is being 

harmed, deceived, persecuted, or exploited by 

others. For example, Bart Ross, who 

murdered the husband and mother of Judge 

Joan Lefkow, became increasingly paranoid 

and felt others were conspiring against him. 

He believed he was being targeted by medical 

and judicial professionals and that hospital 

staff had placed a transmitter in his mouth during his treatment for cancer. In addition, he monitored his 

home with security cameras and concealed his backyard with a high fence and trees.

 Depression/despondency symptoms include sad or depressed mood, irritability, changes in sleep and 

appetite, suicidal thoughts, loss of interest in activities, feelings of guilt and worthlessness, and feelings of 

hopelessness. For example, Bruce Ivins sent email messages to at least one person describing his 

feelings of depression. One message stated in part, “Even with the Celexa [an anti-depressant] and the 

counseling, the depression episodes still come and go . . . Ominously, a lot of the feelings of isolation –

and desolation – that I went through before college are returning. I don’t want to relive those years 

again.”39

 Delusions are false or idiosyncratic beliefs that are firmly maintained despite evidence to the contrary. 

For example, Yonathan Melaku carried out a series of attacks directed toward military targets in Northern 

Virginia. Although he carried out the shootings in protest of U.S. involvement in the Iraq and Afghanistan 

wars, he also was influenced by his delusional beliefs. For example, Melaku reported that he conducted 

the attacks as a warning to God because God was threatening him, and Melaku “had to engage in certain 

behaviors or acts to ‘force God to stop the visions.’”40

 

39 Affidavit in Support of Search Warrant, No. 07-524-M-01 (D.D.C. Oct. 31, 2007).

40 Motion for Court to Conduct a Further Review of its Prior Rule 11 Colloquy of Defendant Yonathan Melaku, United States v. Melaku, No. 1:12-cr-27 (E.D. 

Va. Jan. 9, 2013).

Table 3: Symptoms Exhibited by the Offenders

Symptom n

Paranoia 12

Depression/despondency 12

Delusions 9

Suicidal thoughts 6

Disorganized or odd thinking/ behavior 6

Hallucinations 5

Mania 3

Suicidal attempts 2

Other symptoms 10
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 44

Other symptoms exhibited by the offenders included mood swings, insomnia, muscle tension, anxiety, feelings of 

isolation, difficulty taking care of daily living, and thoughts of harming others. Just over one-quarter of the 

individuals had received or claimed to have received a formal diagnosis of mental illness prior to their attacks (n = 

11, 28%), including schizophrenia, major depressive disorder, and bipolar disorder. 

Influence of Mental Health Symptoms on Motive

For just under one-quarter of the offenders, their mental health symptoms appeared to have influenced their 

motive to carry out their attacks in some way (n = 8, 21%). All of these offenders experienced paranoia and most 

of them also experienced delusions (n = 6). Other symptoms played a role as well, including depression and 

despondency. Examples are provided to demonstrate the link between some of the offenders’ symptoms of 

mental illness and their decisions to take action against federal targets. 

 Paranoid delusions. In February 2006, George Curran allegedly took nine people hostage at the 

National Labor Relations Board (NLRB) in Phoenix, AZ. After a seven-hour standoff, all the hostages 

were released unharmed. Curran reportedly had paranoid beliefs regarding his wife’s termination from 

her employment with the federal government and had filed numerous complaints, including two with the 

NLRB. He believed that an unknown group was blocking his efforts to get his wife’s case investigated; 

and that the authorities with whom he spoke regarding his complaints, including the police and the FBI, 

were “imposters.”41 Additionally, at some point he grew to believe that members of his own family were 

involved in the conspiracy as several of them worked for the government, and two others owned an 

agency that was responsible for collecting some of his wife’s debts. Curran supposedly thought that 

members of the conspiracy had tapped his phone and been following him. He also believed that the 

group involved had influence over police and government organizations, and he described it as a “blue 

shield conspiracy.”42 

 Paranoid delusions. In February 2011, Gary Mikulich allegedly placed an explosive device outside the 

Patrick V. McNamara Federal Building in Detroit, MI. He reportedly held the delusional belief that the FBI, 

particularly its Detroit Field Office, was responsible for the murder of thousands of people, including his 

father, who had died of a heart attack six years earlier. In the weeks prior to the attack, he sent a series 

of faxes to a local police department in which he described his beliefs. The federal building he targeted

housed the offices of the FBI Detroit Field Office and other federal agencies.

 Depression/despondency. In February 2001, Robert Pickett fired shots from the south fence toward the 

White House. Pickett had a long history of depression, including several suicide attempts, and engaged 

in his attack so he would be killed by responding law enforcement officers. Pickett left a suicide note in 

his car and had a letter on his person that indicated he did not expect to live through the incident. 

Although shot in the knee, he survived.

 

41 Forensic Report – U.S. Medical Center, Springfield, MO, United States v. Curran, No. 2:06cr227 (D. Ariz. Apr. 14, 2006).

42 Forensic Report – U.S. Medical Center, Springfield, MO, United States v. Curran, No. 2:06cr227 (D. Ariz. Apr. 14, 2006).
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 45

Stressors

Most of the offenders experienced stressors or events in various areas of their 

lives that appeared to place negative pressure on them (n = 36, 92%). The 

stressors occurred throughout their lives and in the timeframe leading up to 

the incidents. Just over three-quarters of the offenders experienced at least 

one stressor in the year prior (n = 30, 77%), while over two-thirds experienced 

at least one stressor within the six months before (n = 27, 69%). Only three 

offenders had no evidence of stressors; however, there was very little 

information found in open source regarding the personal lives of these three 

individuals.

The offenders experienced stressors across different areas of their lives. The 

most prevalent categories of stressors include:

 Over two-thirds of the offenders experienced stressors related to their immediate family or romantic 

partners (n = 27, 69%). These included the death of a loved one, the ending of a romantic relationship, 

civil disputes related to a family debt or inheritance, divorce, contentious child custody issues, or 

occurrences of domestic abuse. For example, within the year prior to his shooting at the White House in 

November 2011, Oscar Ortega-Hernandez experienced problems in his relationship with the mother of 

his son, causing him to move back in with his own mother. During that time, he was also ordered to pay 

child support.

 Over half of the offenders experienced stressors related to arrests or charges for criminal activity, or 

court filings and appearances regarding criminal pleadings, convictions, or sentencing (n = 23, 59%). For 

example, within the three-month period prior to the pipe bomb attack that he directed against the U.S. 

courthouse in San Diego, CA, Donny Love pled guilty to drug charges and faced separate charges for 

forgery, fraud, counterfeiting, and firearms offenses. Two weeks prior to the attack, he pled guilty to two 

counts of forgery and was awaiting sentencing on both sets of charges. 

 Over half of the offenders also experienced work-related stressors, such as disciplinary actions, being 

fired or laid off, not receiving a promotion, a loss of status (e.g., being demoted), or the inability to obtain 

employment(n = 22, 56%). For some of the individuals, the work-related stressors occurred several years 

prior to their attacks and continued to influence their lives, while for others the stressors occurred in the 

days, weeks, and months leading up to their attacks. In the case of Robert Spadaro, his application for a 

political appointment was rejected by President Ford’s administration 28 years earlier. Spadaro blamed 

the personnel director for this failure and remained obsessed with him for three decades before 

approaching him at his home and firing shots at him as he drove away. On the other end of the

spectrum, approximately one month prior to carrying out his first of five shootings against military targets, 

Yonathan Melaku, a lance corporal in the U.S. Marine Corps Reserves, failed his combat and fitness 

tests. As a result, he was deemed non-deployable and not recommended for a promotion.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 46

 About one-half of the offenders experienced stressors connected to civil court actions outside of family 

or work issues, filed by or against them (n = 20, 51%). These included such things as malpractice suits, 

bankruptcy filings, eviction proceedings, formal foreclosure actions, personal injury suits, and small claims 

actions. Bart Ross, who murdered the husband and mother of Judge Joan Lefkow, suffered from cancer, 

the treatment of which caused severe physical consequences, including chronic pain. Believing he had 

been a victim of medical malpractice, Ross embarked on numerous legal battles that evolved into him 

suing his treating physicians; the State of Illinois; the attorneys who had represented him; an attorney

who refused to represent him; the attorneys who had represented the defendants in his previous 

malpractice claims; and eventually the United States of America. In pursuing his lawsuits, Ross 

reportedly traveled 5,000 miles to meet with hundreds of lawyers and doctors who he thought could help 

his case. The financial strain of this pursuit caused him to lose his home and, over the two-year period 

prior to his attack, he battled and lost civil suits filed by various creditors. 

 About one-quarter of the offenders experienced stressors that occurred within the context of educational

settings, such as not being accepted into a school or program, or receiving disciplinary actions (n = 10, 

26%). Prior to his attack on Representative Giffords, Jared Loughner was notified that he would be 

suspended from the community college he had been attending. He subsequently was advised that in 

order for him to re-enroll, he would need to obtain clearance from a mental health professional indicating 

that he was not a danger to himself or others. 

 About one-quarter of the offenders also experienced stressors related to their physical health, such as 

chronic or acute illnesses, hospitalizations, and major surgeries (n = 9, 23%). A few days prior to firing 

shots at the Wheeling U.S. Courthouse and Federal Building in Wheeling, WV, Thomas Piccard 

reportedly told several neighbors that he had stomach cancer and was dying. He also supposedly told 

neighbors that he planned to move to Florida for his remaining days. Around this time, neighbors had 

noticed that Piccard had lost a lot of weight and was vomiting blood. 

 Less than one-quarter of the offenders experienced stressors related to social interactions, including 

friendships, social clubs, community groups, or religious organizations (n = 8, 21%). Barbara March, who 

mailed threatening letters containing poisoned food to 14 public officials, signed each letter using the 

names of former acquaintances. The names March signed on the letters belonged to individuals who 

previously had relationships with March, but who discontinued their friendships with her due to her 

troubling and, at times, threatening behavior. These individuals included former elementary and high 

school classmates, as well as several former sorority sisters.

 Finally, over half of the offenders experienced stressors in other areas of their personal lives (n = 23, 

59%). These included financial difficulties and other stressful living situations, like being forced to live out 

of a vehicle or residing in a shelter. For instance, several years before holding individuals hostage at a 

U.S. Post Office, Warren Taylor’s leg was amputated following a diving accident and he was diagnosed 

with diabetes. At some point, as a result of his diabetes and leg injury, he left his job and was receiving
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 47

Social Security disability. The resulting financial problems caused him to lose his house and move in with 

family members.

We also looked at the number of different life domains in which offenders experienced stressors. We found that 

offenders who experienced stressors in more areas of their lives were more likely to commit serious attacks, 

meaning those in which one or more persons were or could have been harmed.

43

 For example, Washington Navy 

Yard shooter Aaron Alexis experienced stressors in all of the areas identified above. He had trouble connecting 

with family members, particularly his father, and experienced conflicts with roommates and neighbors. He was 

arrested on several occasions for charges related to disorderly conduct and discharge of a firearm. Further, while 

in the U.S. Navy, he was disciplined for actions of misconduct and was issued a non-judicial punishment. He also 

experienced periods of financial hardship, had a tax lien placed against him, and was evicted from his home. 

Regarding his education, Alexis attended several schools, but dropped out of most of them. Finally, he also 

experienced several physical problems, including a sprain of his rotator cuff, lumbar degenerative disc disease, 

and knee problems.

 

43 The incidents ranged in severity from those in which there was no risk of harm to persons (e.g., explosives detonated outside a building overnight), to 

other incidents in which the attack caused or potentially could have caused harm to others (e.g., shots fired into a crowd of people). Logistic regressions 

were performed to examine factors that differentiated between those offenders who executed attacks that caused or could have caused physical harm to 

one or more persons (n = 20, 51%) and those offenders who executed attacks that posed a low risk of such harm (n = 19, 49%). Statistical tables showing 

the results of the logistic regression analyses for which significant differences were found are included in Appendix D. 
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 48

Contacts with Systems

In the days, weeks, months, and years prior to their attacks, all 

of the offenders interacted with, or came to the attention of, one 

or more community systems (or community-level resources), 

such as the courts, educational institutions, employers, law 

enforcement, mental health professionals, social services, or 

spiritual centers (see Table 4). These systems may hold key 

information for investigators in identifying and assessing those 

who may engage in targeted violence.

Most of the offenders had previous contact with the judicial 

system (n = 34, 87%). Generally, these contacts were related 

to the adjudication of criminal charges the offenders faced and/or civil actions filed by or against them. For 

example, in 2001, Robert Pickett fired two shots from the south fence line toward the White House in an effort to 

be killed by responding law enforcement officers. At the time of his attack, Pickett was involved in an ongoing 

legal battle with the IRS over what he saw as his unfair employment termination from the agency 14 years earlier. 

Over the years, Pickett appealed his termination during an administrative hearing, complained to the Equal 

Employment Opportunity Commission, and filed several lawsuits against the IRS and other parties he believed 

had wronged him.

Furthermore, over three-quarters of the offenders had contact with an educational institution, specifically 

secondary schools and/or colleges and universities (n = 31, 80%). Some offenders were only reported to have 

contact with a secondary school. For example, Ricardo Martinez Diaz, who allegedly ignited a bottle filled with 

gasoline and threw it in the direction of U.S. Customs and Border Protection officers, had dropped out of high 

school when he was in the ninth grade. Other offenders, however, had prior contact with both secondary schools 

and colleges or universities. For example, Andrew Stack, who crashed his private airplane into a building that 

housed an IRS office, had graduated from high school, attended community college for several semesters, and 

then transferred to a university in Colorado where he graduated with a degree in electronic engineering 

technology. While the remaining one-quarter of offenders (n = 8, 21%) may have had contact with an educational 

institution, it was not directly referenced in open source documents.

Over three-quarters of the offenders were employed at the time of their attacks or had been employed at some 

point in the past (n = 30, 77%). Although Jared Loughner had a number of low-wage, entry-level positions in the 

retail and fast food industry, at the time of his attack on Representative Giffords, he was unemployed and had 

struggled to find employment over the course of the previous year. Meanwhile, Nidal Hasan was a psychiatrist 

with the U.S. Army, and had achieved the rank of major, before his attack at Fort Hood. Previously, he had been 

selected for a two-year fellowship program in disaster and preventive psychiatry at the Uniformed Services 

University of the Health Sciences in Bethesda, MD.

Table 4: Percentage of Offenders Who 

Had System Contacts

System n %

Judicial 34 87

Education 31 80

Employment 30 77

Law Enforcement 29 74

Mental Health 12 31

Social Services 8 21

Houses of Worship 8 21
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 49

In addition, almost three-quarters of the offenders had previously come to the attention of law enforcement

(n = 29, 74%). The reasons for these contacts ranged from rather minor infractions (e.g., traffic or fishing 

citations) to arrests for violent crimes. For example, in June 2004, Walter Kloesel fired shots at the Corpus 

Christi, TX Federal Courthouse. One month earlier, he had been arrested for vandalizing a city newspaper 

delivery truck. In October 2009, Eduardo 

Mendoza, Jr., fired shots at the U.S. 

Probation Office housed in the Wayne 

Lyman Morse U.S. Courthouse in Eugene, 

OR. In the years before the incident, 

Mendoza had numerous charges and 

arrests for assault and harassment. 

A third of the offenders had previous contact 

with the mental health system for 

evaluations or treatment (n = 12, 31%). In 

addition, a fifth of the individuals had contact 

with a broad array of social services (n = 8, 

21%) by way of growing up in an orphanage, 

residing in a homeless shelter, meeting with 

a social worker, or discussing disability 

benefits with the Social Security 

Administration. For example, prior to his 

2007 enlistment into the U.S. Navy, Aaron 

Alexis received unemployment benefits 

through the Washington State Employment 

Security Department. Finally, a fifth of the 

offenders had contact or had been involved 

with a house of worship (n = 8, 21%), 

which was evidenced through attending 

religious services or classes. For example, 

prior to his attack at the Army-Navy Career 

Center in Little Rock, AR, Abdulhakim 

Muhammad had begun to re-examine his 

Baptist faith. After attending numerous 

prayer services at his local mosque, 

Muhammad began working to convert to 

Islam, and finally converted in December 

2004, about four-and-a-half years prior to his 

attack.

Law Enforcement Contact the Day of or While En Route 

to the Site of the Attack

Four offenders either had contact with law enforcement the day of 

their attacks and/or were stopped by law enforcement for minor 

driving infractions while traveling across the country on their way 

to their targets.

On March 4, 2010, John Bedell, of Hollister, CA, approached a 

Pentagon security checkpoint near a Metrorail station entrance and 

opened fire on Pentagon Force Protection Agency (PFPA) police 

officers. One month prior, on February 1, 2010, Bedell was stopped 

at the beginning of his cross-country trip for failing to signal at a light 

in Reno, NV. Bedell was charged with possession of marijuana, 

unlawful possession of drug paraphernalia, and driving under the 

influence of marijuana. On February 5, 2010, he posted bail and 

continued his trip to the Washington, DC metro area. He was 

scheduled to be arraigned in Reno Justice Court on March 2, 2010, 

but did not appear.

On January 8, 2011, hours before opening fire at the “Congress on 

Your Corner” event in Tucson, AZ, Jared Loughner was pulled over

for failing to stop at a light. A check by the officer did not reveal any 

outstanding warrants. When the officer informed Loughner that he 

would only be issuing him a citation, Loughner began to cry, and 

stated that he was having a rough time and was going back home. He 

then shook the officer’s hand and departed. 

On November 11, 2011, Oscar Ortega-Hernandez, of Idaho Falls, 

ID, fired shots at the White House. Approximately three weeks 

earlier, he was stopped by a state trooper in Montana and issued a 

warning for driving on an expired license. At the time of the stop, 

Ortega-Hernandez had a semiautomatic assault rifle and 

ammunition in the car, of which the state trooper was unaware. His 

next contact with law enforcement occurred on the morning of the 

incident. Police officers responded to a call of a suspicious person 

after Ortega-Hernandez was observed looking into houses in 

Arlington, VA, a suburb of Washington, DC. He identified himself to 

the officers, but refused their request to search his vehicle. After 

answering questions, he was sent on his way.

On October 4, 2010, just hours before James Dix set fire to the U.S. 

Probation Office in Plymouth, MA, his probation officer contacted 

local law enforcement, and responding officers arranged to have Dix 

taken to a local hospital for a mental health evaluation. 
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 50

Prior Communications Related to the Target

Just under one-half of the offenders (n = 18, 46%) engaged in communications related to their targets prior to the 

attacks. These offenders both communicated to others about the targeted public official or entity and/or they 

communicated directly with the targets themselves. No information was found in open source on whether any of 

the remaining 21 offenders (54%) engaged in communications related to their targets prior to the attacks. 

Most of the offenders who communicated to or about their targets did so verbally (n = 12) to family, friends, 

acquaintances, and even their eventual targets. They also communicated in writing (n = 10) by sending letters or 

faxes, and posting manifestos and other content online. The content of the offenders’ prior communications 

varied, to include:

 One-third of the offenders made threats or veiled references of harming their targets (n = 13, 33%). 

For example, Robert Spadaro wrote about killing Douglas Bennett, the former Ford Administration 

personnel director, in an unpublished memoir. In addition, prior to his alleged attack at the Los Angeles 

International Airport in November 2013, Paul Ciancia reportedly wrote a letter expressing his desire to kill 

multiple TSA employees and cause them fear.

 Over one-quarter of the offenders communicated their grievances or made accusations of injustice 

due to personal issues (n = 11, 28%). For example, Andrew Stack spent thousands of dollars and at 

least a thousand hours writing letters to various governors and members of Congress. He also posted a 

manifesto online complaining about the actions of the IRS. In addition, Gary Mikulich, who allegedly

placed an explosive device in front of the federal building in Detroit, MI, sent faxes to a local police 

department complaining about the FBI’s Detroit Field Office and expressed an interest in pressing 

charges against the office for harassment.

 Just under one-fifth of the offenders referenced sociopolitical or ideological themes in their 

communications related to their targets in Internet postings or through verbal statements to others (n = 7,

18%). Topics of these communications included anger over government corruption or violations of the 

people’s rights, opposition to foreign policy decisions, or conspiracy theories regarding the U.S. 

government. For example, Kevin Tubbs, who directed the arson attack at Michigan Technological 

University, had left a message espousing ELF’s ideologies and justifying an attack on government targets 

at the site of another arson he had committed four years prior. The communication described ELF’s 

belief that they were justified in attacking government targets that killed or destroyed wildlife.

 Just under one-fifth of the offenders made disparaging comments about their targets by calling them 

names or referring to them in a derogatory manner to friends, acquaintances, or the targets themselves

(n = 7, 18%).

The offenders included such content in both the communications they directed to the targets as well as those 

communications they made about the target to others.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 51

Prior communications with the targets. About one-quarter of the offenders communicated directly with their 

targets to voice grievances against the target’s actions or the actions of others, request help from the target, or 

blame the target for certain policies or a perceived problem (n = 9, 23%). The targets in these instances included 

specific public officials, such as judges or members of Congress, and federal departments and agencies more 

generally, such as the military or the FBI. For example:

 Jared Loughner attended a “Congress on Your Corner Event” sponsored by Representative Giffords in 

August 2007, several years prior to his attack on her in January 2011. During the earlier event, Loughner 

submitted a question to Representative Giffords and later was reportedly unhappy with her response.

 Less than a year before allegedly firing a shot into the home of Judge Timothy Corrigan in June 2013, 

Aaron Richardson wrote a letter to the judge requesting that he end his federal probation early. 

Richardson wrote that he no longer needed supervision since he had complied with all the terms of his 

probation, had re-enrolled in school, and was living on his own. 

 Five days before firing shots at the White House, Robert Pickett wrote a letter to the IRS, copying 

President George W. Bush, complaining about his 14-year legal battle with the IRS over his employment 

termination and indicating that he did not expect to live long.

Only three offenders communicated threats directly to their targets. In one incident, years prior to allegedly

placing an explosive device outside the federal building in Detroit, MI, Gary Mikulich told FBI investigators that he 

felt like shooting FBI agents. The federal building he targeted housed the FBI Detroit Field Office. In another 

case, George Curran reportedly threatened an agent of the National Labor Relations Board (NLRB) a few months 

prior to his alleged hostage taking incident at the board’s Phoenix office, saying something to the effect of “You 

folks will get yours.”44 In the remaining case, hours before setting fire to a U.S. Probation Office in Plymouth, MA, 

James Dix had appeared at the office and told his probation officer that he wanted to return to federal prison. He 

said that if his request was not met, he would set a fire and wait for authorities to arrive. In all three of these 

cases, the offenders targeted a federal building or office, rather than a specific public official.

Prior communications about the targets. Over a third of the offenders communicated about their targets to 

others including friends, family, neighbors, law enforcement, government officials, or others (n = 14, 36%). 

Four of the offenders who communicated about their targets did so in a general sense. These offenders all

communicated broadly about the military and then subsequently attacked a specific military target. For example:

 Abdulhakim Muhammad posted a video online in which he discussed his anger over American actions in 

Guantanamo Bay, Abu Ghraib, and Bagram Air Base before he attacked a military recruiting center in 

Little Rock, AR.

 

44 DeFalco, B. (2006, February 24). Phoenix hostage standoff ends peacefully. Associated Press Online.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 52

 Nidal Hasan conducted several presentations during his psychiatry residency and fellowship programs in 

which he discussed his disapproval of the military’s role in killing Muslims before shooting soldiers at the 

military base in Fort Hood, TX.

 John Bedell discussed his opposition to the U.S. government’s military actions in the Persian Gulf War 

with family members prior to firing shots at Pentagon Force Protection Agency (PFPA) police officers at a 

Pentagon security checkpoint.

 Prior to targeting the Naval Sea Systems Command (NAVSEA) Headquarters, Aaron Alexis believed he 

was being attacked by unknown forces using military technology, including extremely low frequency (ELF) 

and microwave technologies. Two weeks prior, and just days before starting his assignment at NAVSEA, 

Alexis indicated in an email that he had identified the specific group in the military responsible for these 

attacks. Although he did not name the specific group, NAVSEA oversees the development of various 

weapons, including those that utilize radio frequencies to disable electronic targets. 
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 53

PART FOUR: APPENDICES
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 54

Appendix A: List of Incidents

1. On February 7, 2001, Robert William Pickett, 47, fired two shots at the White House in an attempt to commit 

"suicide by cop." Following a brief standoff, Pickett was shot and wounded after he aimed his gun at nearby 

officers. He left a suicide note in his car and had a letter on his person that indicated that he did not expect to 

survive the shooting. Pickett had been engaged in a 14-year legal battle with the IRS over his employment 

termination.

2. On September 11, 2001, 19 al-Qa‛ida operatives hijacked four U.S. commercial airliners and crashed them into 

several targets, including the World Trade Center towers and the Pentagon. The fourth plane crashed in a field in 

Shanksville, PA. Although reports identify both the White House and the U.S. Capitol as the potential targets of the 

fourth plane, evidence suggests the flight was most likely targeting the U.S. Capitol. The attack was ordered and 

orchestrated by Osama bin Ladin, Muhammed Atef, and Khalid Sheikh Mohammed in protest of what they 

characterized as the occupation of Muslim lands in the Middle East and U.S. aggression against Islam. The attacks 

resulted in the deaths of 2,973 individuals.

3. On September 21, 2001, David Daniel Serra, 28, tried to enter the Patrick V. McNamara Federal Building in Detroit, 

MI with a firearm. When he was denied entry, Serra fired two shots, killing a Federal Protective Service (FPS) Law 

Enforcement Security Officer. Serra’s motive was unclear; however, he had a history of mental health issues, 

including paranoia that the government was targeting him.

4. Between October 6 and 9, 2001, anthrax-laced letters were mailed to the Washington, DC offices of Senators 

Thomas Daschle and Patrick Leahy. Exposure to the anthrax killed four people, including two U.S. Postal Service 

workers, and sickened seven, including five U.S. Postal Service workers and an employee of the U.S. Department 

of State. An earlier mailing targeted news anchors and media outlets in New York, NY and Boca Raton, FL. The 

Department of Justice and the FBI named Dr. Bruce Edwards Ivins, 55, a senior microbiologist at the U.S. Army 

Medical Research Institute of Infectious Diseases (USAMRIID), as the lone suspect in the case. In 2008, Ivins 

committed suicide before charges were formally brought against him. The FBI alleged that one aspect of his 

motivation may have been to increase the importance of his research on the anthrax vaccine.

5. On October 11, 2001, while working at his home in Seattle, WA, Assistant U.S. Attorney (AUSA) Thomas Wales 

was fatally shot by an unknown perpetrator. No suspect(s) has been identified.

6. On November 5, 2001, Stanislas Gregory Meyerhoff, 23, and Ian Jacob Wallace, 20, placed two incendiary devices 

on the campus of Michigan Technological University in Houghton, MI. One device was placed near the U.S. Forest 

Service Engineering Laboratory, which was owned by the U.S. Department of Agriculture, and the other was placed 

near a building that housed other federally-funded research. Meyerhoff and Wallace intended to destroy the 

buildings and the research they contained in protest of genetic engineering of plants; however, the devices failed to 

detonate. Meyerhoff had been directed to carry out an arson attack by William Christopher Rodgers, 36, and Kevin 

M. Tubbs, 32, leaders of the Family, a cell affiliated with the Earth Liberation Front (ELF).

7. On August 1, 2002, Tashala Lynett Hayman, 22, sent a package containing two cyanide-laced bottles of soda to the 

Washington, DC office of Senator Edward Kennedy. Although information regarding her motive was unavailable, 

prior to the incident, while watching a television program profiling the Kennedy family, Hayman allegedly made a 

reference that the family should be dead.

8. On August 11, 2002, the U.S. Forest Service’s Forestry Sciences Laboratory located in Irvine, PA, was destroyed in 

an arson attack. The blaze damaged the facility’s roof and interior, causing roughly $700,000 in damages. Weeks 

after the incident, the Pacific ELF, a cell affiliated with the Earth Liberation Front (ELF), took credit for the attack, 

claiming the station was targeted because of its research, potential timber sales, and oil drilling. Although a suspect 

was later identified, no charges were filed.

9. In October 2003, two envelopes containing ricin were mailed to the U.S. Department of Transportation and the 

White House. The envelopes contained letters that were signed by an unknown perpetrator, identified only as 

"Fallen Angel." The letters contained threats of more widespread harm if a new trucking regulation that restricted 

driving time for long-haul truckers was not repealed. No suspect(s) has been identified.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 55

10. On November 2, 2003, Robert Nicholas Spadaro, 68, fired two shots at Douglas Bennett, former Personnel Director 

for President Gerald Ford, as Bennett drove away from his home in Washington, DC. Both shots missed. Spadaro 

blamed Bennett for his failure to obtain a political appointment in the Ford Administration 28 years earlier, and he 

had tracked Bennett and his family for decades.

11. On June 21, 2004, Walter Edwin Kloesel, 81, fired shots outside the Corpus Christi, TX Federal Courthouse. A 

Court Security Officer tackled Kloesel as he tried to reload his gun. No one was injured. Information regarding 

Kloesel’s motive was not available.

12. On February 28, 2005, Bart Allen Ross, 57, broke into the Chicago, IL home of U.S. District Court Judge Joan 

Lefkow with the intent to kill her. A few months earlier, Judge Lefkow had dismissed Ross’ long-running medical 

malpractice case. Judge Lefkow was not at home; however, Ross fatally shot her husband and mother. Nine days 

after the shooting, Ross fatally shot himself during a routine traffic stop.

13. On or about April 22, 2005, Barbara Joan March, 59, mailed letters that were threatening in nature and contained 

cookies or candy laced with rat poison to the Director and Deputy Director of the FBI, three military Chiefs of Staff, 

and all nine of the U.S. Supreme Court Justices. Wanting to frame others for high-profile crimes, March signed 

each letter using the names of former acquaintances and family members. No one was injured.

14. On February 23, 2006, George Leo Curran, IV, 42, allegedly entered a hearing room of the National Labor 

Relations Board (NLRB) in Phoenix, AZ, and held nine hostages at gunpoint. Curran had reportedly become 

obsessed with fighting for his wife’s civil rights after she was fired from two jobs. The couple unsuccessfully filed 

numerous complaints with regulatory and law enforcement entities, including the NLRB. Curran was purportedly

convinced the government would not investigate the claims because it was conspiring against him. He allegedly 

held the hostages for seven hours and released them unharmed.

15. On March 6, 2008, an explosive device detonated outside an unoccupied U.S. Armed Forces Recruiting Station in 

New York, NY. Although no injuries were reported, the blast led to the closing of Times Square for two hours and 

caused temporary disruption to the subway service. No suspect(s) has been identified.

16. On May 4, 2008, Rachelle Lynette Carlock, 31, detonated three pipe bombs at the front doors of the Edward J. 

Schwartz U.S. Courthouse in San Diego, CA. The bombs caused structural damage to the doors and lobby area of 

the courthouse, but no injuries. Three others were involved, including Donny S. Love, Sr., 41, who directed the 

attack; Eric Reginald Robinson, 42, who drove Carlock to the courthouse; and Ella Louise Sanders, 56, who helped 

create the bombs. Love wanted the others to carry out the bombing so he could volunteer information to authorities 

in exchange for reward money and leniency on felony charges he faced.

17. On June 1, 2009, Abdulhakim Mujahid Muhammad, 23, fatally shot Private William Long and seriously wounded 

Private Quinton Ezeagwula outside the Army-Navy Career Center in Little Rock, AR. The attack was part of 

Muhammad’s personal campaign of violence, during which he planned to attack Jewish and military targets. 

Muhammad stated the attacks were in retaliation for U.S. military actions against Muslims.

18. Sometime overnight between October 28 and 29, 2009, while riding in the back of a vehicle, Eduardo Mendoza, Jr., 

28, fired four shots at the Wayne Lyman Morse U.S. Courthouse in Eugene, OR. Mendoza told others in the car 

that he was firing at the U.S. Probation Office, which was located in the building. Three bullets hit a second-floor 

window of the unoccupied offices of U.S. Congressman Peter DeFazio, and the fourth bullet hit a wall above the 

offices. No injuries were reported. The day prior to the incident, Mendoza’s probation officer had recommended 

revoking his probation.

19. On November 5, 2009, while in the Fort Hood Soldier Readiness Processing Center in Fort Hood, TX, Army 

Psychiatrist Major Nidal Malik Hasan, 39, shot into a crowd of soldiers, killing 13 and injuring 32. According to 

Hasan, during his psychiatry residency at the Walter Reed Army Medical Center, he began to struggle with his 

identity as a Muslim and a soldier in the U.S. military. He became convinced that engaging in violence against the 

U.S. military was a way he could help Muslims overseas.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 56

20. On December 23, 2009, Warren Aubra Taylor, 53, entered the Wytheville, VA U.S. Post Office with a fake bomb 

and four guns with the intent to hold employees and customers hostage. Taylor shot at and missed the Postmaster, 

who safely escaped the building along with two postal workers. Taylor took a postal supervisor and two customers 

hostage and released them unharmed after an eight-and-a-half hour standoff. Taylor held anti-government views

and claimed that he selected the post office as a symbol of "federal inefficiency."

21. On January 4, 2010, Johnny Lee Wicks, 66, entered the Lloyd D. George Federal Building and U.S. Courthouse in 

Las Vegas, NV and fired three shots, killing a court security officer and wounding two others, including a Deputy 

U.S. Marshal and a law clerk. Four months prior to the incident, Wicks’s lawsuit against the Social Security 

Administration (SSA), in which he alleged racial discrimination in its decision to reduce his benefits, had been 

dismissed. Sources stated that he may have been seeking revenge.

22. On February 18, 2010, Andrew Joseph Stack, III, 53, crashed his personal single-engine plane into Echelon 

Building One, home of an IRS office, in Austin, TX. One IRS employee was killed and 13 other individuals in the 

building were injured. Prior to the crash, Stack posted a 3,200-word suicide manifesto on a website for his software 

company and set fire to his home. Stack had a 30-year history of opposing and protesting the U.S. tax system and 

had been dealing with a tax audit.

23. On March 4, 2010, John Patrick Bedell, 36, approached a Pentagon security checkpoint and opened fire on 

Pentagon Force Protection Agency (PFPA) police officers. Two of the officers suffered minor injuries when they 

were grazed by bullets. The officers returned fire, fatally shooting Bedell. Though the motive for the attack is 

unclear, Bedell had a long history of mental illness, believed the government was spying on him, and believed in 

several anti-government and anti-military conspiracy theories.

24. On October 4, 2010, James Andrew Dix, 63, set fire to the U.S. Probation Office in Plymouth, MA, which had closed 

for the day. Earlier that afternoon, Dix had appeared at the same office asking his probation officer to arrest him. 

Dix thought that he was about to be evicted from his apartment and was going to lose his driver’s license. Believing 

he was out of options and wanting to return to federal prison, he warned his probation officer that if he did not get 

what he wanted, he would set a fire and wait for police to arrive so he could confess. Dix was sent to a hospital for 

a mental health evaluation. Within hours, he was evaluated and released from the hospital and returned to the 

probation office where he set the fire.

25. On October 17, 2010, Yonathan Melaku, 22, a U.S. Marine Corps Reservist, fired at least 10 shots at the National 

Museum of the Marine Corps in Triangle, VA. This was the first in a series of five incidents occurring from October 

17, 2010 to November 1, 2010, during which Melaku fired shots at military targets throughout Northern Virginia. 

The shootings took place late at night or in the early morning hours. No injuries were sustained in conjunction with 

any of the incidents. Melaku stated that he committed the incidents to protest U.S. involvement in the Iraq and 

Afghanistan wars. He was also experiencing delusional beliefs that God was threatening him and later stated that 

he engaged in the attacks as a warning to God.

26. On October 19, 2010, Yonathan Melaku, 22, a U.S. Marine Corps Reservist, fired six shots at the Pentagon in 

Arlington, VA. This was the second in a series of five incidents occurring from October 17, 2010 to November 1, 

2010, during which Melaku fired shots at military targets throughout Northern Virginia. The shootings took place 

late at night or in the early morning hours. No injuries were sustained in conjunction with any of the incidents. 

Melaku stated that he committed the incidents to protest U.S. involvement in the Iraq and Afghanistan wars. He 

was also experiencing delusional beliefs that God was threatening him and later stated that he engaged in the 

attacks as a warning to God.

27. Sometime overnight between October 25 and 26, 2010, Yonathan Melaku, 22, a U.S. Marine Corps Reservist, fired 

shots at a U.S. Marine Corps Recruiting Center in Chantilly, VA. This was the third in a series of five incidents 

occurring from October 17, 2010 to November 1, 2010, during which Melaku fired shots at military targets 

throughout Northern Virginia. The shootings took place late at night or in the early morning hours. No injuries were 

sustained in conjunction with any of the incidents. Melaku stated that he committed the incidents to protest U.S. 

involvement in the Iraq and Afghanistan wars. He was also experiencing delusional beliefs that God was 

threatening him and later stated that he engaged in the attacks as a warning to God.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 57

28. Sometime overnight between October 28 and 29, 2010, Yonathan Melaku, 22, a U.S. Marine Corps Reservist, fired

shots at the National Museum of the Marine Corps, in Triangle, VA, for the second time that month. This was the 

fourth in a series of five incidents occurring from October 17, 2010 to November 1, 2010, during which Melaku fired 

shots at military targets throughout Northern Virginia. The shootings took place late at night or in the early morning 

hours. No injuries were sustained in conjunction with any of the incidents. Melaku stated that he committed the 

incidents to protest U.S. involvement in the Iraq and Afghanistan wars. He was also experiencing delusional beliefs 

that God was threatening him and later stated that he engaged in the attacks as a warning to God.

29. Sometime overnight between November 1 and 2, 2010, Yonathan Melaku, 22, a U.S. Marine Corps Reservist, fired 

into a window of the U.S. Coast Guard Recruiting Station in Woodbridge, VA. This was the fifth in a series of five 

incidents occurring from October 17, 2010 to November 1, 2010, during which Melaku fired shots at five separate 

military targets throughout Northern Virginia. The shootings took place late at night or in the early morning hours. 

No injuries were sustained in conjunction with any of the incidents. Melaku stated that he committed the incidents 

to protest U.S. involvement in the Iraq and Afghanistan wars. He was also experiencing delusional beliefs that God 

was threatening him and later stated that he engaged in the attacks as a warning to God.

30. On January 7, 2011, an incendiary package addressed to Department of Homeland Security (DHS) Secretary Janet 

Napolitano was discovered at a federal mail processing facility in Washington, DC. Two similar devices, one 

addressed to Maryland Governor Martin O’Malley and the second addressed to Maryland Transportation Secretary 

Beverley Swaim-Staley, were discovered the day before. All three packages were similar in size and construction. 

The package sent to Secretary Napolitano was not opened, but ignited briefly after a U.S. Postal Service employee 

tossed it into a processing bin. No serious injuries were reported. Authorities investigating the incidents speculated 

that the packages were sent by someone who was frustrated with the government’s counter-terrorism efforts. No 

suspect(s) has been identified.

31. On January 8, 2011, Jared Lee Loughner, 22, shot and injured U.S. Representative Gabrielle Giffords at a 

“Congress on Your Corner” event in a shopping center parking lot in Tucson, AZ. Loughner killed six people in the 

attack, including a Congressional Aide to Rep. Giffords and a U.S. District Court judge. In addition to Rep. Giffords, 

Loughner injured 12 others, including her District Director and Community Outreach Representative. Loughner had 

made numerous delusional and anti-government statements online, and reportedly disliked Rep. Giffords because 

he felt she snubbed him at a prior event. Communications discovered after the attack indicated that Loughner may 

also have been seeking fame as an assassin.

32. On or about February 26, 2011, Gary John Mikulich, 42, allegedly placed a bag containing an explosive in front of 

the Patrick V. McNamara Federal Building in Detroit, MI. The building housed offices for the FBI and other federal 

agencies. Mikulich, who had been diagnosed with paranoid schizophrenia, had a long history of threatening the 

FBI, particularly the Detroit FBI Field Office. He reportedly believed that the FBI was responsible for the murder of 

thousands of people, including his father who had died of a heart attack six years earlier. 

33. On November 11, 2011, Oscar Ramiro Ortega-Hernandez, 21, fired shots at the White House. Several bullets 

struck the exterior of the building, but no one was injured. Ortega had become obsessed with the belief that the 

world would end in 2012 and he was desperate to protect himself and his family from the coming Armageddon. 

After failing to garner enough attention to warn others on his own, he carried out the attack against the White House 

to attract media attention that would allow him to broadcast his beliefs.

34. On December 25, 2011, Justin Michael Bennett, 36, fired shots at the U.S. Post Office in Verdi, NV, vandalized the 

building with racist and anti-government graffiti, and set fire to the building. The attack severely damaged the 

building, causing the post office to close for 13 months while repairs were completed. This attack was part of a 

multi-day spree of violent attacks, during which Bennett also fired shots at a police station in Sparks, NV, and 

attacked several businesses in Reno, NV. Bennett stated that he targeted the post office to misdirect officials 

investigating his other attacks.

35. On November 30, 2012, Abdullatif Ali Aldosary, 47, detonated a homemade explosive device outside of the Social 

Security Administration (SSA) building in Casa Grande, AZ. Although the attack occurred prior to business hours, 

14 employees were inside the building. The explosion and ensuing fire caused minimal damage to the walls, door, 

and window, but no injuries to persons. A few days prior to the attack, Aldosary fatally shot a former coworker at a 

grain facility in Maricopa, AZ. Information regarding his motive in targeting the SSA building was not available. 
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 58

36. On April 8, 2013, James Everett Dutschke, 41, mailed letters containing ricin to President Barack Obama and U.S. 

Senator Roger Wicker, both in Washington, DC, as well as Lee County Justice Court Judge Sadie Holland in 

Tupelo, MS. Judge Holland received and opened her letter, but she was not injured. The remaining letters were 

intercepted before reaching their targets. Dutschke sent the letters using an adversary’s name in order to retaliate 

against him.

37. On or about May 13, 2013, Matthew Ryan Buquet, 38, allegedly mailed letters containing ricin to President Barack 

Obama, and the Central Intelligence Agency (CIA), both in the Washington Metropolitan Area; and U.S. District 

Court Judge Frederick Van Sickle, a U.S. Post Office, and the Fairchild Air Force Base, all located in Spokane, WA. 

No one was sickened through contact with the letters, which were all intercepted before reaching their destinations.

Information regarding Buquet’s supposed motive was not available and he was awaiting trial at the time of this 

report.

38. On May 20, 2013, Shannon Dawn Guess Richardson, 35, mailed threatening letters and ricin to President Barack 

Obama and Mayors Against Illegal Guns Executive Director Mark Glaze, both in Washington, DC, as well as Mayor 

Michael Bloomberg in New York, NY. No one was injured. Richardson sent the letters to frame her husband so 

she could end their marriage and may have also been seeking fame.

39. On June 23, 2013, Aaron Markus Richardson, 24, allegedly shot through a window into the home of U.S. District 

Court Judge Timothy Corrigan in Jacksonville, FL, while the judge was at home. The judge suffered minor injuries 

from debris. Just over two years prior to the incident, Richardson pled guilty to an unrelated charge and Judge 

Corrigan sentenced him to supervised release. Ten months before the incident, Richardson asked Judge Corrigan 

to terminate his supervised release early, but the judge denied his request.

40. On September 16, 2013, Aaron Alexis, 34, entered the Naval Sea Systems Command (NAVSEA) Headquarters 

located at the Washington Navy Yard in Washington, DC and opened fire on civilian and contract employees. 

Alexis killed 12 people and injured 3 others prior to being shot and killed by responding officers. Alexis also 

seriously wounded one of the first responders. In the weeks leading up to his attack, Alexis suffered from paranoia, 

auditory hallucinations, and delusions. He believed he was being attacked by unknown forces using military 

technology.

41. On October 9, 2013, Thomas Jude Piccard, 55, fired shots at the Wheeling U.S. Courthouse and Federal Building in 

Wheeling, WV. Three court security officers suffered minor cuts from the shattered glass and debris. Piccard was 

shot and killed by responding officers. Although information regarding Piccard’s motive was unavailable, he had 

expressed negative feelings towards the federal government and may have experienced a series of stressors 

leading up to the attack.

42. On November 1, 2013, Paul Anthony Ciancia, 23, allegedly shot and killed a Los Angeles International Airport 

Transportation Security Officer (TSO) and injured two other TSOs and an airport traveler. He was shot and 

apprehended by responding officers. In a note left at the scene, Ciancia reportedly expressed his belief that the 

Transportation Security Administration’s (TSA) security practices were an abuse of power and violated his 

constitutional rights.

43. On December 18, 2013, Ricardo Martinez Diaz, 39, allegedly ignited a glass bottle filled with gasoline and threw it 

toward a primary vehicle inspection booth and four U.S. Customs and Border Protection (CBP) officers standing in 

the vehicle inspection lane at the San Ysidro – Class A Port of Entry in San Ysidro, CA. The bottle landed a few

feet from the officers. As they advanced on Diaz, he reportedly yelled for them to shoot him in a possible attempt to 

commit “suicide by cop.” The officers extinguished the flames and Diaz was taken into custody. No one was 

injured and the flames did not damage the port of entry.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 59

Appendix B: LIST OF TARGETS

Federal Facilities, Buildings, and Offices

Army-Navy Career Center, Little Rock, AR

Central Intelligence Agency (CIA), McLean, VAa

Corpus Christi Federal Courthouse, Corpus Christi, TX

Edward J. Schwartz U.S. Courthouse, San Diego, CA

Fairchild Air Force Base, Spokane County, WAa

Federal Bureau of Investigation (FBI) Field Office in the Patrick V. McNamara Federal Building, Detroit, MI 

Fort Hood Soldier Readiness Processing Center, Fort Hood, TX

Internal Revenue Service, Austin, TX 

Lloyd D. George Federal Building and U.S. Courthouse, Las Vegas, NV 

National Labor Relations Board (NLRB), Phoenix, AZ

National Museum of the Marine Corps, Triangle, VA [targeted in two separate incidents]

Naval Sea Systems Command (NAVSEA) Headquarters, Washington Navy Yard, Washington, DC

Patrick V. McNamara Federal Building, Detroit, MI

The Pentagon, Arlington, VA [targeted in three separate incidents]

San Ysidro – Class A Port of Entry, San Ysidro, CA

Social Security Administration, Casa Grande, AZ

Transportation Security Administration (TSA) at the Los Angeles International Airport, Los Angeles, CA

U.S. Armed Forces Recruiting Station, Times Square, New York, NY 

U.S. Capitol, Washington, DC 

U.S. Coast Guard Recruiting Station, Woodbridge, VA

U.S. Department of Transportation, Washington, DC

U.S. Forest Service Engineering Laboratory, Houghton, MI

U.S. Forest Service Forestry Sciences Laboratory, Irvine, PA 

U.S. Marine Corps Recruiting Substation, Chantilly, VA

U.S. Post Office, Verdi, NV 

U.S. Post Office, Wytheville, VA

U.S. Post Office, Spokane, WAa

U.S. Probation Office for the District of Massachusetts, Plymouth, MA

U.S. Probation Office for the District of Oregon at the Wayne Lyman Morse U.S. Courthouse, Eugene, OR

Wheeling U.S. Courthouse and Federal Building, Wheeling, WV

The White House, Washington, DC [targeted in three separate incidents]

a Targeted as part of one incident involving mailings to federal sites and officials in May 2013.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 60

Federal Officials

Bader Ginsburg, Rutha U.S. Supreme Court Justice

Bennett, Douglas Former Personnel Director, Ford Administration

Breyer, Stephena U.S. Supreme Court Justice

Clark, Vernona Chief of Naval Operations, U.S. Navy

Corrigan, Timothy U.S. District Judge

Daschle, Thomasb U.S. Senator

Giffords, Gabrielle U.S. Representative

Jumper, Johna Chief of Staff, U.S. Air Force 

Kennedy, Anthonya U.S. Supreme Court Justice

Kennedy, Edward U.S. Senator

Leahy, Patrickb U.S. Senator

Lefkow, Joan U.S. District Judge

Mueller, Robert, IIIa Director, Federal Bureau of Investigation (FBI) 

Napolitano, Janet Secretary, Department of Homeland Security (DHS)

Obama, Barack c d President of the United States [targeted in three separate incidents]

O'Conner, Sandra Daya U.S. Supreme Court Justice

Pistole, Johna Deputy Director, Federal Bureau of Investigation (FBI) 

Rehnquist, Williama U.S. Supreme Court Justice

Scalia, Antonin a U.S. Supreme Court Justice

Schoomaker, Peter a Chief of Staff, U.S. Army 

Souter, Davida U.S. Supreme Court Justice

Stevens, John Paula U.S. Supreme Court Justice

Thomas, Clarencea U.S. Supreme Court Justice

Van Sickle, Frederickc U.S. District Judge

Wales, Thomas Assistant U.S. Attorney

Wicker, Rogerd U.S. Senator

a Targeted as part of one incident involving mailings in April 2005.

b Targeted as part of one incident involving mailings in October 2001.

c Targeted as part of one incident involving mailings to federal sites and officials in May 2013.

d Targeted as part of one incident involving mailings in April 2013.
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 61

APPENDIX C: TIMING OF 35 FEDERAL ATTACKS (EXCLUDES MAILINGS)

 *The attack occurred overnight or prior to normal business hours. The timeframe reflects when the incident was discovered.

 

Legend

Aircraft Arson Bombing Shooting Shooting/Arson

TIME SUNDAY MONDAY TUESDAY WEDNESDAY THURSDAY FRIDAY SATURDAY

0000-0200

 

 Courthouse

 Target’s

 Residence

 

 Research

 Center

 

0200-0400 Recruiting

 Office

0400-0600 *Research

 Center

 Post

 Office

 Pentagon *Military

 Museum

0600-0800 

 *Military

 Museum

 *Recruiting 

 Office

 *Recruiting 

 Office

 *Courthouse

 

0800-1000 Navy Yard

 Target’s

 Residence

 

 

 Courthouse

 Pentagon Office

 Building 

 Federal 

 Office

 Airport

1000-1200 Recruiting

 Office

 White

 House

 Public

 Event

1200-1400 Courthouse Port of 

 Entry

 Military 

 Base

 Federal

 Building

1400-1600 Post 

 Office 

 

 Federal 

 Building

 Office

 Building 

1600-1800

1800-2000 Pentagon

2000-2200 Office 

 Building

 White 

 House 

2200-2400 Target’s

 Residence

UNKNOWN Target’s

 Residence

 Federal

 Building 
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 62

APPENDIX D: STATISTICAL TABLES FOR ANALYSIS OF SERIOUS ATTACKS

The incidents ranged in severity from those in which there was no risk of harm to persons (e.g., explosives 

detonated outside a building overnight) to other incidents in which the attack caused, or potentially could have 

caused, harm to persons (e.g., shots fired into a crowd of people). Logistic regressions were performed to 

examine factors that differentiated between 39 total offenders, those offenders who executed attacks that caused 

or could have caused physical harm to one or more persons (n = 20, 51%) and those offenders who executed 

attacks that posed a low risk of such harm (n = 19, 49%). These factors included the offenders’ motives;

stressors; community systems with which they had contact; whether they exhibited behavior changes or elicited 

concern from others; and their histories of drug use, mental illness, and criminal behavior. These analyses did 

not include the individuals involved in the 9/11 terrorist attacks. The two groups of offenders differed significantly 

on two factors. The statistical results for these two factors are presented in Tables 1 and 2. 

Stressors in more areas of life: Offenders who experienced stressors in more areas of their lives were more 

likely to commit serious attacks than those offenders who experienced stressors in fewer areas of their lives 

(B = 0.48, p = 0.026, Odds Ratio = 1.61).

Behavior changes: Offenders who displayed a change in their behavior were more likely to commit serious 

attacks than those offenders who did not display a change in their behavior (B = 1.87, p = 0.009, Odds 

Ratio = 6.50).

Table 2: Evidence of Behavior Change and Percentage of 

Offenders Who Committed Serious Attacks

Behavior Change % Serious Attack

Behavior Change (n = 21) 71

No Behavior Change (n = 18) 28

Table 1: Offenders Who Committed Serious Attacks and 

Average Number of Life Domains in Which a Stressor 

Occurred

Incident Type Average (M) SD

Serious (n = 20) 4.4 1.7

Non-Serious (n = 19) 2.9 1.9
DEPARTMENT OF HOMELAND SECURITY 

UNITED STATES SECRET SERVICE 

NATIONAL THREAT ASSESSMENT CENTER

Attacks on Federal Government: 2001-2013 | 63

APPENDIX E: COMPARISON WITH PREVIOUS U.S. SECRET SERVICE RESEARCH

Several findings were compared across this study and earlier U.S. Secret Service research that analyzed 83 

persons known to have assassinated, attacked, or approached with lethal intention, a person of prominent public 

status in the United States between 1949 and 1996. A subset of cases from that earlier study included 23 

offenders who committed 19 attacks on federal targets.

45

 The tables below provide frequency data on variables 

of interest that could be compared between this subset of cases from the earlier study and the incidents and 

offenders included in the current study.

Table 1. Group and Lone Actor Attacks

1949-1996

(Previous study, n = 19)

2001-2013

(Current study, n = 43)

Lone actors 84% (16) 81% (35)

Groups 16% (3) 7% (3)

Unknown 0% (0) 12% (5)

Total 100% (19) 100% (43)

Table 2. Methods of Attack

1949-1996

(Previous study, n = 19)

2001-2013

(Current study, n = 43)

Firearm 63% (12) 58% (25)

Mailing 5% (1) 19% (8)

Explosives 11% (2) 9% (4)

Arson 0% (0) 12% (5)

Airplane 5% (1) 5% (2)

Other 16% (3) 0% (0)

Total 100% (19) 103% (44)

46

Table 3. Offender Characteristics

1949-1996

(Previous study, n = 23)

2001-2013

(Current study, n = 39)

Sex

 Male 87% (20) 87% (34)

 Female 13% (3) 13% (5)

Age

 Mean 35 41

Arrest History

 Any Arrest 74% (17) 62% (24)

 Violent 30% (7) 33% (13)

 Non-Violent 70% (16) 62% (24)

47

Mental Health Symptoms

 Depression 26% (6) 31% (12)

 Delusions 17% (4) 23% (9)

 Hallucinations 4% (1) 13% (5)

Communications

 Directly Threatened Target 0% (0) 8% (3)

 

45 This subset consists only of the subjects in the original study’s sample who initiated attacks against their targets.

46 One incident in the current study was an arson in which the perpetrator also used a firearm.

47 In order to provide an accurate comparison of the non-violent arrest variable, this number includes offenders who committed a sex crime.