No specific demographic profile of an attacker exists
NTAC research found there is no specific demographic profile of an attacker.
There is no specific demographic profile of an attacker.
NCIER®
Attackers
65 claims on pp. 9–95 (fact 38, statement 4, evidence 18, conclusion 3, definition 2).
Claims about Attackers
Attackers often elicit concern through their behaviors or communications
NTAC research has continuously found that attackers often elicit concern from others because of their behaviors or communications.
Attackers often elicit concern from those around them because of their behaviors or communications.
Part 1 examines attackers' background and behavioral history
Part 1 presents NTAC research findings on mass attacks in workplace settings, including attackers' background characteristics and behavioral history.
mass attacks perpetrated in workplace settings, including the background characteristics and behavioral history of the attackers
Study uses open sources to examine 50 on-premises mass violence incidents
The study uses open sources to examine 50 mass violence incidents on the premises of a business or other work location, covering attacks and attackers' backgrounds and behavioral histories.
describes key findings of research using open sources examining 50 incidents of mass violence which occurred on the premises of a business or other work location
Attackers were known or knowable to the workplace before every attack
In each of the 50 incidents, the attackers were known or knowable to the workplace before their attacks.
In each incident, the attackers were known or knowable to the workplace prior to their attacks.
Overview presents findings on attack characteristics and attackers' backgrounds and behavior
The section presents findings on the characteristics of the attacks and on the backgrounds and behavioral histories of the attackers.
We present findings on the characteristics of the attacks and the backgrounds and behavioral histories of the attackers.
16 attackers were actively employed at the location they targeted
Sixteen attackers were actively employed by the location they targeted at the time of their attack.
Sixteen attackers were actively employed by the location they targeted at the time of their attack
One attacker was an on-duty military member armed with service weapons
One attacker was a U.S. military service member on watch duty and was armed with service weapons during his attack.
One attacker was a U.S. military service member on watch duty and was armed with service weapons
All but one of the 50 incidents had a single attacker
All but one of the 50 incidents examined were perpetrated by a single attacker.
All but one of the 50 incidents examined were perpetrated by a single attacker.
The one multi-attacker incident was a pair firing at a bar
The one incident with more than one attacker involved a pair who opened fire at a bar after one attacker had been thrown out hours earlier.
The one incident perpetrated by more than one attacker involved a pair of assailants that opened fire at a bar
Nearly all attackers were male (96%, n = 49)
Nearly all attackers were male (n = 49, 96%).
Sample (n = 49 of 51) · attackers, all affiliation types
Nearly all attackers were male (n = 49, 96%)
Attacker ages ranged from 22 to 66
Attacker ages ranged from 22 to 66 years old.
ages ranged from 22 to 66 years old
Average workplace attacker age was 41
The average age of workplace attackers was 41 years.
The average age of workplace attackers was 41 years.
Key findings box summarizes attacker stressors, concern, charges, and DV
The attacker key findings box lists stressors, elicited concern, prior criminal charges, and domestic violence history as key findings.
KEY FINDINGS FOR ATTACKERS
Why inferred Key findings box is a summary judgement; its statistics are restated from the body text.
Service member's on-base shooting after cumulative stressors
A 22-year-old U.S. military service member facing health, family, peer, and performance stressors, and seeking mental health care for sleep, coping, and belonging problems, fatally shot two civilian workers and injured a third on base before dying by suicide.
A 22-year-old service member in the U.S. military, armed with his service rifle and handgun, fatally shot two civilian workers and injured a third on base
A military service member faced personal and professional stressors in the year before his attack
As an example of multiple stressors, a U.S. military service member experienced a number of personal and professional stressors in the year leading up to his attack.
For instance, a U.S. military service member experienced a number of personal and professional stressors in the year leading up to his attack.
Service member repeatedly sought care for sleep, stress, and alienation problems
At multiple points the service member sought medical attention for mental health problems, including difficulty sleeping and concentrating, coping with stress, and feelings of alienation and not belonging among peers.
At multiple points in time, the attacker sought medical attention for mental health problems, including visits for difficulty sleeping and concentrating, issues coping with stress, and feelings of alienation and lacking a sense of belonging among his peers.
Key finding: 65% of attackers had prior criminal charges
The Key Findings for Attackers box states that 65% of attackers had prior criminal charges.
Sample (n = 33 of 51) · attackers, all affiliation types
65% of attackers had prior criminal charges.
Key finding: 53% of attackers had at least one instance of domestic violence
The Key Findings for Attackers box states that 53% of attackers had at least one instance of domestic violence in their past.
Sample (n = 27 of 51) · attackers, all affiliation types
53% of attackers had at least one instance of domestic violence in their past.
22 attacks were by current or former employees, all by lone attackers
There were 22 attacks perpetrated by current or former employees of the targeted workplace, each by a lone attacker.
There were 22 attacks perpetrated by current or former employees of the targeted workplace, each perpetrated by a lone attacker.
Grocery night-shift attacker held delusional belief of a cartoon ghost afterlife
The attacker held delusional beliefs that after death he would become a cartoon female ghost and join violent cartoon characters in an afterlife.
The attacker harbored delusional beliefs that when he died after his attack, he would become a cartoon female ghost character and join other violent cartoon characters in an afterlife.
Employee shot coworkers during a meeting to fire him, then wounded five officers
An employee with numerous rule violations drew a concealed handgun during a disciplinary meeting, killing four coworkers and injuring one. He then killed another coworker who had reported his safety violation, and the attacker injured five officers in a shootout before dying of his wounds.
the individual drew a concealed handgun and opened fire, killing four coworkers and injuring another
Attacker with two handguns killed five coworkers at an organization with racial harassment history
A man with two handguns killed five coworkers and then himself at an organization with a history of racial discrimination and harassment. According to a coworker, he had reported at least one exchange to HR, but the case was closed when the complaint could not be corroborated.
the case was closed when the complaint could not be corroborated
Terminated employee killed one and injured three at a manufacturing facility
A man with a semiautomatic handgun killed one and injured three others at a manufacturing facility before dying by suicide. He had been fired after missing three days of work and had complained of coworker harassment that continued after his transfer.
The gunman had previously been terminated by the facility after missing three days of work
19 attacks were perpetrated by 20 customers, clients, patients, or visitors
There were 19 attacks perpetrated by 20 individuals known or knowable to the targeted location as customers, clients, patients, or visitors.
There were 19 attacks perpetrated by 20 individuals who were known or knowable to the targeted location as customers, clients, patients, and visitors
Former treatment patient held three employees hostage for eight hours
A gunman previously treated for PTSD at a residential treatment center took five hostages, released two, and fatally shot the remaining three employees after an eight-hour standoff. One victim had expelled him from the program two weeks earlier because he had knives and threatened to kill staff.
locked himself in a room with the remaining three victims for eight hours
Newsroom attacker killed five after grievance over an unflattering article
A man killed five people with a shotgun at a newsroom after an unflattering article about him. He had sued the paper years earlier, stalked and threatened employees, and mailed a dossier on the intended victims and their families before the attack.
The attacker had a personal grievance with the newsroom after an unflattering article was written about him
Newsroom attacker surveilled the building and studied police response times
Before the attack, the attacker downloaded blueprints, recorded video of the building and access points, read textbooks on mass shootings, and studied police reaction times.
downloaded blueprints and recorded video of the newsroom building and its access points, read textbooks on mass shootings, studied police reaction times to previous attacks
Newsroom attacker mailed a dossier on intended victims and their families
Before the attack, the attacker created and mailed a dossier containing information about the intended victims and their families.
created and mailed a dossier with information about the intended victims and their families
Newsroom attacker sold his car and bought a chess membership before prison
In preparation for incarceration after the attack, the attacker sold his car and spent a significant portion of his income on a lifetime chess organization membership.
In preparation for his incarceration after the attack, the attacker also sold his car and spent a significant portion of his income on the purchase of a lifetime membership for a chess organization.
Nine attacks were perpetrated by current or former romantic partners or relatives
There were nine attacks perpetrated by current or former romantic partners or relatives of individuals connected to the targeted site.
There were nine attacks perpetrated by attackers who were current or former romantic partners or relatives of individuals connected to the targeted site
Gunman killed ex-girlfriend and coworker at her healthcare workplace despite protection order
A gunman took hostages outside a healthcare center where his ex-girlfriend worked, shot and killed a police chief, then fatally shot his ex-girlfriend and her coworker before dying by suicide. He had assaulted and threatened her multiple times, and one protection order was still in place at the time of the attack.
In the months prior to the incident, he had assaulted and threatened to kill his ex-girlfriend multiple times
Over half of workplace attackers (59%) had mental health symptoms before attacking
Over half of all workplace attackers (n = 30, 59%) were found to have experienced mental health symptoms prior to their attack.
Sample (n = 30 of 51) · attackers, all affiliation types
Over half of all workplace attackers (n = 30, 59%) were found to have experienced mental health symptoms prior to their attack
Nearly two-fifths (39%) had a prior mental health diagnosis or treatment
Nearly two-fifths of attackers (n = 20, 39%) received a prior diagnosis or treatment for a mental health issue before the attack.
Sample (n = 20 of 51) · attackers, all affiliation types
Nearly two-fifths of attackers (n = 20, 39%) received a prior diagnosis or treatment for a mental health issue before the attack.
Warehouse employee blocked exit with forklift, shot coworkers, then died by suicide
A warehouse employee used a forklift to block an exit before shooting coworkers with a revolver. On a call to police he described hearing voices since his teens, past treatment for psychosis, and a belief that a manager was attacking his mind.
used a forklift to block an exit before shooting coworkers with a revolver
Attacker cited a manager's psychic attack on his mind as a motive
The attacker claimed a manager was a powerful psychic attacking his mind and cited this as a contributing factor to his motive.
which he cited as a contributing factor to his motive
Warehouse gunman left the scene and contacted police after shooting coworkers
After the shooting, the gunman left the scene and contacted police.
The gunman then departed the scene and contacted police.
Figure 3, any symptom: employees 64%, customers etc. 55%, partners and relatives 56%
Figure 3 shows any mental health symptom in 64% of current or former employee attackers, 55% of customer, client, patient, and visitor attackers, and 56% of romantic partner and relative attackers.
Sample (N = 22 | 20 | 9 by column) · Figure 3 columns: employees 22 | customers, clients, patients, visitors 20 | partners and relatives 9
| Any | 64% | 55% | 56% |
Figure 3, paranoia: employees 41%, customers etc. 5%, partners and relatives 11%
Figure 3 shows paranoia in 41% of current or former employee attackers, 5% of customer, client, patient, and visitor attackers, and 11% of romantic partner and relative attackers.
Sample (N = 22 | 20 | 9 by column) · Figure 3 columns: employees 22 | customers, clients, patients, visitors 20 | partners and relatives 9
| Paranoia | 41% | 5% | 11% |
Figure 3, psychosis: employees 41%, customers etc. 20%, partners and relatives 22%
Figure 3 shows psychosis in 41% of current or former employee attackers, 20% of customer, client, patient, and visitor attackers, and 22% of romantic partner and relative attackers.
Sample (N = 22 | 20 | 9 by column) · Figure 3 columns: employees 22 | customers, clients, patients, visitors 20 | partners and relatives 9
| Psychosis | 41% | 20% | 22% |
Figure 3, depression: employees 32%, customers etc. 20%, partners and relatives 44%
Figure 3 shows depression in 32% of current or former employee attackers, 20% of customer, client, patient, and visitor attackers, and 44% of romantic partner and relative attackers.
Sample (N = 22 | 20 | 9 by column) · Figure 3 columns: employees 22 | customers, clients, patients, visitors 20 | partners and relatives 9
| Depression | 32% | 20% | 44% |
Figure 3, suicidal ideation: employees 14%, customers etc. 15%, partners and relatives 33%
Figure 3 shows suicidal ideation in 14% of current or former employee attackers, 15% of customer, client, patient, and visitor attackers, and 33% of romantic partner and relative attackers.
Sample (N = 22 | 20 | 9 by column) · Figure 3 columns: employees 22 | customers, clients, patients, visitors 20 | partners and relatives 9
| Suicidal Ideation | 14% | 15% | 33% |
Most attackers showed behaviors that elicited concern before attacks
NTAC research has shown that most attackers exhibited behaviors that elicited concern in others prior to their attacks, across a variety of systems.
most attackers exhibited behaviors that elicited concern in others prior to their attacks
Attackers showed concerning behavior at work, home and online beforehand
In many cases, attackers had demonstrated concerning behavior at work, at home, and online before their attack, but no program existed to examine these behaviors collectively.
In many cases, attackers had demonstrated concerning behavior at work, at home, and online before their attack
Assessment Themes characterize common thinking and behavior patterns of past attackers
Assessment Themes characterize common patterns of thinking and behavior found in the background and behavioral history of individuals who have engaged in past acts of targeted violence.
Assessment Themes characterize common patterns of thinking and behavior found in the background and behavioral history of individuals who have engaged in past acts of targeted violence.
Many past attackers had substantial negative contextual experiences
Prior NTAC research has found that many past attackers had substantial negative experiences related to the contextual themes.
prior NTAC research has found that many past attackers had substantial negative experiences related to these contextual themes
Interest in violent topics includes weapons, gore and prior attacks
Interest in violent topics is an unusual or excessive interest in weapons, violence, gore, prior attacks, notorious killers, or other concerning topics.
An unusual or excessive interest in weapons, violence, gore, prior attacks, notorious killers, or other concerning topics
Idolizing or emulating past attackers is of particular concern
Particular concern should arise if the individual idolizes or wants to emulate past attackers.
Particular concern should arise if the individual demonstrates an idolization of or desire to emulate past attackers
Oct 2017 manufacturing-facility attack: five coworkers shot, three killed
A 37-year-old man called an impromptu meeting at his manufacturing workplace, shot five coworkers (three killed), then drove to two more locations and shot a business owner he knew.
On October 18, 2017, a 37-year-old man gathered coworkers around him by calling an impromptu meeting at the manufacturing facility where he worked
Oct 2017 manufacturing-facility attack: grievance over coworkers' workplace pranks
The attacker was motivated by a grievance against coworkers who frequently played pranks on others at work, of which he felt he was the victim.
The attacker was motivated by a grievance against his coworkers who frequently played pranks on others at work, of which he felt he was the victim.
Data Table 2: attacker data for all attackers and three subgroups
Data Table 2 (Attacker Data) reports gender, age range, race/ethnicity, arrests/charges, history of domestic violence, mental health symptoms, stressors, concerning communications, elicited concern, bullying/harassment, inappropriate interest in violence or weapons, and behavior change for all attackers (n = 51) and for current or former employees (n = 22), customers, clients, patients, and visitors (n = 20), and romantic partners and relatives (n = 9). The column ns printed are 51 | 22 | 20 | 9.
ATTACKER DATA
Data Table 2 columns: all n = 51 (28%), employees 22 (12%), customers 20 (11%), partners 9 (5%)
Data Table 2 column headers give all attackers as n = 51 / 28%, current or former employees as n = 22 / 12%, customers, clients, patients, and visitors as n = 20 / 11%, and romantic partners and relatives as n = 9 / 5%.
Sample (n = 51 of undeterminable) · attackers in the NTAC 2023 population of 173 mass attacks
| ATTACKER DATA | All Attackers<br>n = 51 / 28% | Current or Former Employees<br>n = 22 / 12% | Customers, Clients, Patients, and Visitors<br>n = 20 / 11% | Romantic Partners and Relatives<br>n = 9 / 5% |
Why inferred table header: the column headers are printed in the table; the <br> marks the line break inside each printed header cell and is not printed text
Male attackers: all 96%, employees 95%, customers 95%, partners/relatives 100%
Data Table 2 reports that 96% of all attackers (n = 51) were male, as were 95% of current or former employees (n = 22), 95% of customers, clients, patients, and visitors (n = 20), and 100% of romantic partners and relatives (n = 9).
Sample (N = 51 | 22 | 20 | 9 by column) · Data Table 2 columns: all attackers 51 | employees 22 | customers, clients, patients, visitors 20 | partners and relatives 9
Male | 96% | 95% | 95% | 100%
Female attackers: all 2%, employees 0%, customers 5%, partners/relatives 0%
Data Table 2 reports that 2% of all attackers (n = 51) were female, as were 0% of current or former employees (n = 22), 5% of customers, clients, patients, and visitors (n = 20), and 0% of romantic partners and relatives (n = 9).
Sample (N = 51 | 22 | 20 | 9 by column) · Data Table 2 columns: all attackers 51 | employees 22 | customers, clients, patients, visitors 20 | partners and relatives 9
Female | 2% | 0% | 5% | 0%
Other gender: all 2%, employees 5%, customers 0%, partners/relatives 0%
Data Table 2 reports an other gender for 2% of all attackers (n = 51), 5% of current or former employees (n = 22), 0% of customers, clients, patients, and visitors (n = 20), and 0% of romantic partners and relatives (n = 9).
Sample (N = 51 | 22 | 20 | 9 by column) · Data Table 2 columns: all attackers 51 | employees 22 | customers, clients, patients, visitors 20 | partners and relatives 9
Other | 2% | 5% | 0% | 0%
Ages: all 22-66 (41.0 avg), employees 22-64 (40.1), customers 23-66 (41.1), partners 27-58 (42.9)
Data Table 2 gives an age range of 22-66 (41.0 average) for all attackers (n = 51), 22-64 (40.1 average) for current or former employees (n = 22), 23-66 (41.1 average) for customers, clients, patients, and visitors (n = 20), and 27-58 (42.9 average) for romantic partners and relatives (n = 9).
**Age Range (average)** | 22-66 (41.0 avg) | 22-64 (40.1 avg) | 23-66 (41.1 avg) | 27-58 (42.9 avg)
White (non-Hispanic/unknown): all 41%, employees 32%, customers 55%, partners/relatives 33%
Data Table 2 reports that 41% of all attackers (n = 51) were White (non-Hispanic/ethnicity unknown), as were 32% of current or former employees (n = 22), 55% of customers, clients, patients, and visitors (n = 20), and 33% of romantic partners and relatives (n = 9).
Sample (N = 51 | 22 | 20 | 9 by column) · Data Table 2 columns: all attackers 51 | employees 22 | customers, clients, patients, visitors 20 | partners and relatives 9
White (non-Hispanic/ethnicity unknown) | 41% | 32% | 55% | 33%
Black/African American: all 29%, employees 50%, customers 10%, partners/relatives 22%
Data Table 2 reports that 29% of all attackers (n = 51) were Black/African American, as were 50% of current or former employees (n = 22), 10% of customers, clients, patients, and visitors (n = 20), and 22% of romantic partners and relatives (n = 9).
Sample (N = 51 | 22 | 20 | 9 by column) · Data Table 2 columns: all attackers 51 | employees 22 | customers, clients, patients, visitors 20 | partners and relatives 9
Black/African American | 29% | 50% | 10% | 22%
Hispanic/Latino: all 14%, employees 9%, customers 20%, partners/relatives 11%
Data Table 2 reports that 14% of all attackers (n = 51) were Hispanic/Latino, as were 9% of current or former employees (n = 22), 20% of customers, clients, patients, and visitors (n = 20), and 11% of romantic partners and relatives (n = 9).
Sample (N = 51 | 22 | 20 | 9 by column) · Data Table 2 columns: all attackers 51 | employees 22 | customers, clients, patients, visitors 20 | partners and relatives 9
Hispanic/Latino | 14% | 9% | 20% | 11%
Asian: all 12%, employees 9%, customers 5%, partners/relatives 33%
Data Table 2 reports that 12% of all attackers (n = 51) were Asian, as were 9% of current or former employees (n = 22), 5% of customers, clients, patients, and visitors (n = 20), and 33% of romantic partners and relatives (n = 9).
Sample (N = 51 | 22 | 20 | 9 by column) · Data Table 2 columns: all attackers 51 | employees 22 | customers, clients, patients, visitors 20 | partners and relatives 9
Asian | 12% | 9% | 5% | 33%
Race/ethnicity undetermined: all 4%, employees 0%, customers 10%, partners/relatives 0%
Data Table 2 reports race/ethnicity as undetermined for 4% of all attackers (n = 51), 0% of current or former employees (n = 22), 10% of customers, clients, patients, and visitors (n = 20), and 0% of romantic partners and relatives (n = 9).
Sample (N = 51 | 22 | 20 | 9 by column) · Data Table 2 columns: all attackers 51 | employees 22 | customers, clients, patients, visitors 20 | partners and relatives 9
Undetermined | 4% | 0% | 10% | 0%
Arrests/charges: all 65%, employees 64%, customers 70%, partners/relatives 56%
Data Table 2 reports a history of arrests/charges for 65% of all attackers (n = 51), 64% of current or former employees (n = 22), 70% of customers, clients, patients, and visitors (n = 20), and 56% of romantic partners and relatives (n = 9).
Sample (N = 51 | 22 | 20 | 9 by column) · Data Table 2 columns: all attackers 51 | employees 22 | customers, clients, patients, visitors 20 | partners and relatives 9
**Arrests/Charges** | 65% | 64% | 70% | 56%
History of domestic violence: all 53%, employees 41%, customers 55%, partners/relatives 78%
Data Table 2 reports a history of domestic violence for 53% of all attackers (n = 51), 41% of current or former employees (n = 22), 55% of customers, clients, patients, and visitors (n = 20), and 78% of romantic partners and relatives (n = 9).
Sample (N = 51 | 22 | 20 | 9 by column) · Data Table 2 columns: all attackers 51 | employees 22 | customers, clients, patients, visitors 20 | partners and relatives 9
**History of Domestic Violence*** | 53% | 41% | 55% | 78%
Mental health symptoms: all 59%, employees 64%, customers 55%, partners/relatives 56%
Data Table 2 reports mental health symptoms for 59% of all attackers (n = 51), 64% of current or former employees (n = 22), 55% of customers, clients, patients, and visitors (n = 20), and 56% of romantic partners and relatives (n = 9).
Sample (N = 51 | 22 | 20 | 9 by column) · Data Table 2 columns: all attackers 51 | employees 22 | customers, clients, patients, visitors 20 | partners and relatives 9
**Mental Health Symptoms** | 59% | 64% | 55% | 56%
Stressors within 5 years: all 92%, employees 91%, customers 95%, partners/relatives 89%
Data Table 2 reports stressors within 5 years of the attack for 92% of all attackers (n = 51), 91% of current or former employees (n = 22), 95% of customers, clients, patients, and visitors (n = 20), and 89% of romantic partners and relatives (n = 9).
Sample (N = 51 | 22 | 20 | 9 by column) · Data Table 2 columns: all attackers 51 | employees 22 | customers, clients, patients, visitors 20 | partners and relatives 9
**Stressors (within 5 years of attack)** | 92% | 91% | 95% | 89%
Top
Find the Perfect Training Class For You