Report pages 59–74: 203 claims on pp. 59–74 (fact 5, statement 96, evidence 47, conclusion 3, conjecture 4, definition 48).
When actionable reports of concerning behavior are received, BTAM teams must conduct a comprehensive evaluation of the risk posed by the individual.
BTAM teams must conduct a comprehensive evaluation of the risk posed by the individual
BTAM teams should use a fact-based process to gather information from diverse sources, identify key details about the individual's thinking and behavior, and consider the context of the individual's situation.
BTAM teams should use a fact-based process to gather information from diverse sources
The purpose of the assessment phase in BTAM is to determine whether an individual poses a risk of harm to themselves or others.
The purpose of the assessment phase in BTAM is to determine whether an individual poses a risk of harm to themselves or others
In Mass Attacks in Public Spaces: 2016-2020 (2023), NTAC found that the workplace was the most common formal setting in which concerning behavior was observed.
NTAC found that the workplace was the most common formal setting in which concerning behavior was observed
NTAC research has shown that most attackers exhibited behaviors that elicited concern in others prior to their attacks, across a variety of systems.
most attackers exhibited behaviors that elicited concern in others prior to their attacks
Information gathering can be phased, beginning with a preliminary inquiry and, when appropriate, a full assessment.
Gathering information can be accomplished using a phased procedure beginning with a preliminary inquiry and, when appropriate, conducting a full assessment
BTAM teams should use the Systems Approach and explore relevant Assessment Themes when gathering information and determining risk.
BTAM teams should utilize the Systems Approach and explore relevant Assessment Themes
To evaluate risk, BTAM teams should conduct a preliminary inquiry and/or full assessment to systematically gather information and develop a comprehensive understanding of the individual of concern's thinking and behaviors.
To accomplish this, BTAM teams should conduct a preliminary inquiry and/or full assessment to systematically gather information to develop a comprehensive understanding of the thinking and behaviors of the individual of concern.
In workplace settings, the assessment process may involve gathering information from individuals and systems inside and outside the organization and piecing together a comprehensive picture of the individual's behavior and life circumstances so an informed, reliable risk assessment can be made.
In workplace settings, this process may entail gathering information from individuals and systems both inside and outside of the organization, then piecing together a comprehensive picture of the individual's behavior and life circumstances so an informed and reliable assessment of risk can be made.
Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.
Figure 9 illustrates a potential pathway for a report of concern from initial intake through to case closure.
Figure 9 on the following pages illustrates a potential pathway for a report of concern from initial intake to case closure.
NTAC's finding that the workplace was the most common formal setting for observed concerning behavior highlights the key role workplaces can play in early detection.
This finding highlights the key role workplaces can play in early detection.
Why inferred Typed conclusion: the sentence is the report's own judgement drawn from the finding just cited.
Figure 9 (the left half of a two-page flowchart) starts at a received report and asks whether it involves an imminent threat to life. If yes, it goes to Emergency Response and loops until the situation is stabilized, then to Move to Full Assessment. If no, it asks whether the report is actionable and credible: if yes, a Preliminary Inquiry (initial interviews and records review, analysis of available information) leads to the question of whether there is a safety concern; if no, Make Referral to Alternative Resources.
Move to Full Assessment
Figure 9 continues: Full Assessment (interviews and records review, Systems Approach, Assessment Themes, analysis) leads to a decision whether the IOC poses a risk of harm to self or others. If yes, Implement Risk Management Strategies, then Evaluate, repeating the decision; if no, a check whether the IOC could benefit from other resources. If no, Close BTAM Case (document all actions, findings, and determinations; follow record retention protocols; share information as appropriate), ending in case closure.
Full Assessment
In Figure 9, when no risk of harm is found, the team asks whether the IOC could benefit from other resources; if yes, the case is referred to alternative resources and then closed.
Could the IOC* benefit from other resources?
Following initial triage of any actionable report of concerning behavior, a preliminary inquiry serves as the minimum level of response.
a preliminary inquiry serves as the minimum level of response
The objective of the preliminary inquiry is to establish enough context to decide whether the case should be closed or elevated to a full assessment.
The objective of the preliminary inquiry is to establish enough context to assess whether the case should be closed or elevated to a full assessment
A preliminary inquiry may involve interviews with the reporting person(s), the individual of concern, and others familiar with the situation, such as supervisors or HR.
This process may involve conducting interviews with the reporting person(s), the individual of concern, and others who are directly familiar with the individual or situation
Why inferred 'may' describes an optional method; typed as process guidance rather than conjecture.
If the preliminary inquiry reveals a possible risk of harm or that more information is needed, the BTAM team should proceed with a full assessment.
If the preliminary inquiry reveals that the individual may pose a risk of harm or that more information is necessary to make that determination, the BTAM team should proceed with a full assessment
A full assessment is conducted when the reported concern is objectively concerning enough to bypass a preliminary inquiry and move immediately to full assessment.
the reported concern is objectively concerning enough to bypass a preliminary inquiry and move immediately to a full assessment
A full assessment is conducted when the preliminary inquiry reveals a substantial concern.
the preliminary inquiry reveals a substantial concern
A full assessment is conducted when the preliminary inquiry alone did not yield enough information to make an assessment of risk.
the preliminary inquiry alone did not yield enough information to make an assessment of risk
A full assessment involves gathering more detailed information from a broader group of people and systems the individual has interacted with.
A full assessment involves gathering more detailed information from more diverse sources
A full assessment typically involves multiple interviews, records checks, reviews of publicly available social media, and analysis of employer-issued electronic devices.
A full assessment typically involves multiple interviews, records checks, reviews of publicly available social media, and analysis of employer-issued electronic devices
Gathering this information enables the BTAM team to gain a reasonable and articulable understanding of the risk posed, identify factors specific to the individual that increase or decrease risk, and determine effective strategies to intervene and prevent a potential escalation to violence.
Gathering this information enables the BTAM team to gain a reasonable and articulable understanding of the risk posed
The Systems Approach is a process of gathering information from various community systems to provide a comprehensive and reliable assessment of an individual's thinking and behavior.
A process of gathering information from various community systems in order to provide a comprehensive and reliable assessment of an individual's thinking and behavior
The U.S. Secret Service pioneered the Systems Approach.
the U.S. Secret Service pioneered the Systems Approach
This tiered approach ensures that resources are allocated appropriately and that every report receives an appropriate individualized response.
This tiered approach ensures that resources are allocated appropriately and that every report receives an appropriate individualized response.
One early and necessary determination in the BTAM process is whether a report of workplace concerning behavior needs a preliminary inquiry or a full assessment.
One early and necessary determination in the BTAM process is distinguishing between the need for a preliminary inquiry or a full assessment when responding to reports of concerning behavior in the workplace.
Preliminary inquiries are limited in scope and designed to quickly gather enough information to understand the concern and the context needed to decide next steps.
Preliminary inquiries are limited in scope and designed to quickly gather enough information to establish an understanding of the concern and the context needed to determine next steps.
Information for a preliminary inquiry may also come from additional sources, such as a review of the individual's publicly available social media, as needed.
Information for a preliminary inquiry may also come from additional sources, for example, a review of the individual's publicly available social media, as needed.
Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.
The effectiveness of the BTAM team depends on its ability to gather substantive information from the people and systems with whom the individual of concern interacts.
The effectiveness of the BTAM team depends upon its ability to gather substantive information from the people and systems with whom the individual of concern interacts.
The Systems Approach allows BTAM teams to collect and synthesize pieces of information that may otherwise be siloed.
The Systems Approach allows BTAM teams to collect and synthesize pieces of information that may otherwise be siloed
In many cases, attackers had demonstrated concerning behavior at work, at home, and online before their attack, but no program existed to examine these behaviors collectively.
In many cases, attackers had demonstrated concerning behavior at work, at home, and online before their attack
By using the Systems Approach, BTAM teams can identify and synthesize information from numerous sources to make a holistic determination about risk.
By utilizing the Systems Approach, BTAM teams can identify and synthesize information from numerous sources to make a holistic determination about the risk
The Systems Approach can also be an effective tool for identifying potential risk management strategies.
This approach can also be an effective tool for identifying potential risk management strategies
Systems in a workplace can be internal components, such as security or human resources departments, or external community partners, such as law enforcement and mental health providers.
Systems in a workplace can be internal components, such as security or human resources departments, or external community partners, such as law enforcement and mental health providers.
In Figure 10, the center of the diagram represents the individual of concern who is the subject of the assessment.
The center of the diagram represents the individual of concern who is the subject of the assessment.
The circles around the individual of concern in Figure 10 represent some of the workplace and community systems that may provide important behavioral and contextual information about the individual to inform the BTAM process.
The circles surrounding the individual of concern represent some of the workplace and community systems that may provide important behavioral and contextual information about the individual to inform the BTAM process.
Figure 10 shows Supervisors & Coworkers as an internal system (orange circle) surrounding the individual of concern.
Supervisors & Coworkers (orange)
Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text
Figure 10 shows Human Resources as an internal system (orange circle) surrounding the individual of concern.
Human Resources (orange)
Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text
Figure 10 shows Physical Security as an internal system (orange circle) surrounding the individual of concern.
Physical Security (orange)
Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text
Figure 10 shows Legal as an internal system (orange circle) surrounding the individual of concern.
Legal (orange)
Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text
Figure 10 shows Information Technology as an internal system (orange circle) surrounding the individual of concern.
Information Technology (orange)
Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text
Figure 10 shows Cybersecurity & Insider Threat as an internal system (orange circle) surrounding the individual of concern.
Cybersecurity & Insider Threat (orange)
Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text
Figure 10 shows Law Enforcement as an external system (blue circle) surrounding the individual of concern.
Law Enforcement (blue)
Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text
Figure 10 shows Mental Health as an external system (blue circle) surrounding the individual of concern.
Mental Health (blue)
Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text
Figure 10 shows Judicial as an external system (blue circle) surrounding the individual of concern.
Judicial (blue)
Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text
Figure 10 shows Online & Social Media as an external system (blue circle) surrounding the individual of concern.
Online & Social Media (blue)
Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text
Figure 10 shows Family & Community as an external system (blue circle) surrounding the individual of concern.
Family & Community (blue)
Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text
A BTAM team should have immediate access to internal workplace systems (shown in orange in Figure 10); external systems (blue) lie outside the workplace.
orange circles represent internal systems to which a BTAM team should have immediate access, while blue circles represent external systems outside of the workplace
The general method for gathering information using the Systems Approach remains the same for all cases, though the specific systems used may differ from case to case.
the general method for gathering information using the Systems Approach remains the same for all cases
In this fictional example, a colleague's escalating statements led to interviews, a family check and coordinated outreach, after which the employee's workload was reduced and he was referred to counseling support.
employees at a software company submit a report of concern to the BTAM team about a colleague who is making increasingly agitated statements
In this fictional example, a retail customer's social media posts prompted employee interviews, an IT review and a consensual law enforcement interview, leading to a no-trespass order from physical stores.
The BTAM team determines that the individual presents a low risk for physical harm but a high risk for causing disruption at the store
Internal systems are almost always relevant when assessing an individual who is currently, or has previously been, employed by the organization.
these systems are almost always relevant when assessing and managing an individual of concern who is currently, or has previously been, employed by the organization
For employees, leveraging organizational systems will often be sufficient to assess and manage the risk posed.
leveraging organizational systems will often be sufficient to assess and manage the risk posed
Internal systems can also hold relevant information about other individuals of concern, including customers, clients, visitors, or members of the public.
Internal systems can also have relevant information about other individuals of concern, including customers, clients, visitors, or members of the broader public
A retail organization assessing a disruptive customer may get valuable insight into the individual's background by speaking with the physical security staff who dealt with them.
may get valuable insight into the individual's background and behaviors by speaking with their physical security professionals
The fictional examples described below highlight how different systems may be leveraged depending on the unique characteristics of a case.
how different systems may be leveraged depending on the unique characteristics of a case
Coworkers reported that the employee had claimed he might snap if things did not improve at work, and a supervisor reported a sharp decline in his performance and demeanor.
his coworkers report that he has claimed he might "snap" if things don't improve at work
The BTAM team's interview revealed that the employee was going through a difficult separation from his spouse, and his brother confirmed the struggle in a phone call.
discovers that he is going through a difficult separation from his spouse and has had trouble adjusting to this change, which the employee's brother confirmed during a phone call
An organization's assessment of a current employee may look different and may draw on different sources of information than the systems used when assessing a customer.
For instance, an organization's assessment of a current employee may look different and may leverage different sources of information compared to the systems used when assessing a customer.
Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.
In the fictional software-company example, the Systems Approach surfaced a supervisor's report of a sharp decline in performance and demeanor, coworkers' reports that he said he might snap if things did not improve, and HR's report of a coworker's complaints about his rude and combative nature.
During their assessment, the BTAM team uses the Systems Approach to identify several concerns about the employee
Through coordinated outreach by the BTAM team, the supervisor, and HR, the fictional employee's workload was temporarily reduced and he was referred to the company's EAP for counseling and support.
Through coordinated outreach between the BTAM team, his supervisor, and HR, the employee has his workload reduced temporarily and is referred to the company's EAP so that he may receive counseling and support.
In the fictional retail example, a frequent customer with a history of disruptive and concerning behaviors recently posted on social media alluding to something bad happening to the store.
A major retail outlet has a frequent customer with a history of disruptive and concerning behaviors who recently made posts on social media alluding to something bad happening to the store.
In the fictional retail example, the BTAM team gathered information by interviewing store employees, directing company IT to review the customer's publicly available social media posts, and coordinating with law enforcement on a consensual interview about the posts.
The BTAM team uses the Systems Approach to gather information through interviews with employees from the store, direct the company IT department to further review the individual's publicly available social media posts, and coordinate with law enforcement to conduct a consensual interview with the individual regarding the social media posts.
In the fictional retail example, the BTAM team worked with local law enforcement to issue the customer a no trespass order for all physical store locations while offering him discount codes for online shopping on the store's website.
The BTAM team works with local law enforcement to issue the customer a no trespass order from all physical store locations, while offering him discount codes for online shopping through the store's website.
The report defines internal systems as systems within the organization itself.
Internal systems are systems within the organization itself.
BTAM teams should gather and examine information from a variety of internal systems that bear on concerning or mitigating information.
BTAM teams should gather and examine information from a variety of internal systems
Employees who interact with the individual may offer observations about past interactions, perceived behavioral changes, and escalating stress or hostility.
Employees who interact with the individual of concern may offer observations and information about past interactions, perceived behavioral changes, and indicators of escalating stress or hostility
Why inferred Descriptive 'may' about information sources; typed as guidance.
HR professionals may offer information on employment history, work performance, conduct, grievances, conflicts, disciplinary actions, accolades, and attendance records.
professionals may offer information pertaining to the individual's employment history
Physical security personnel may offer behavioral observations, details of security incidents, witness statements, access logs, and security footage.
Physical security personnel may offer behavioral observations, details about security incidents, witness statements, building or facility access logs, and security footage
Why inferred Descriptive 'may' about information sources; typed as guidance.
Legal personnel may offer records of legal filings or complaints, such as harassment claims, restraining orders, and prior violent incidents, and legal rights or protections.
Legal personnel may offer records of legal filings or complaints—such as claims of harassment, restraining orders, and prior violent incidents
IT may assist with access to system records, including login history, email communications, and internet usage.
IT may assist with access to system records, including login history, email communications, and internet usage
Why inferred Descriptive 'may' about information sources; typed as guidance.
Cybersecurity and insider threat professionals may offer data from user activity monitoring, including anomalous digital behaviors such as unauthorized or failed access attempts to restricted systems or files.
Cybersecurity and insider threat professionals may offer data from user activity monitoring
Insider threat programs are designed to detect risks from trusted insiders, such as employees or contractors, who may intentionally or unintentionally cause harm.
Insider threat programs are designed to detect risks from trusted insiders, such as employees or contractors, who may intentionally or unintentionally cause harm
Insider threat programs typically focus on areas such as unauthorized access to sensitive data, sabotage, fraud, and misuse of systems, whereas BTAM programs focus on violence against individuals in the workplace.
BTAM programs focus on violence against individuals in the workplace
Collaboration between insider threat and BTAM programs can enable each to perform its functions more effectively.
Collaboration and partnership between these programs can enable each to perform their functions more effectively
Both insider threat and BTAM programs are specifically designed to detect early behavioral red flags, aggregate data from multiple sources, and facilitate cross-functional collaboration.
However, both insider threat and BTAM programs are specifically designed to detect early behavioral red flags, aggregate data from multiple sources, and facilitate cross-functional collaboration.
Because of these shared features, insider threat programs are well-positioned to support BTAM teams in identifying and mitigating risk before it escalates to violence.
These similarities make insider threat programs well-positioned to support BTAM teams in identifying and mitigating risk before it escalates to violence.
External systems are systems outside of the workplace that may be of particular importance when assessing individuals not directly affiliated with the organization, such as customers or visitors.
External systems are systems outside of the workplace
Organizations should preemptively establish collaborative relationships with those outside the organization, as highlighted in Step 1.
This highlights the importance of preemptively establishing collaborative relationships with those outside the organization
Coordination with law enforcement can be critical, especially in highly concerning cases involving possible violence or criminal behavior or individuals not associated with the organization.
Coordination with law enforcement partners can be critical for organizations
Law enforcement agencies possess the legal authority, training, and operational protocols needed to safely engage with individuals outside the organization, ensuring that privacy rights are protected and that investigative activity does not escalate the situation or expose the workplace to liability.
Law enforcement agencies possess the legal authority, training, and operational protocols needed to safely engage with individuals outside the organization
Organizations may coordinate with law enforcement to serve or enforce a protective order or to request a welfare check at an individual's home.
Organizations may coordinate with law enforcement to serve or enforce a protective order or to request a welfare check
While court records alone do not indicate a threat, when reviewed in context with other stressors or criminal behaviors they can help BTAM teams identify a history of aggression, violence, or signs of instability or distress.
when reviewed in context with other stressors or criminal behaviors present in the individual's background
Community mental health partners can be valuable assets at nearly any stage of a behavioral threat assessment.
Community mental health partners can be valuable assets at nearly any stage of a behavioral threat assessment
Publicly available posts on social media, forums, or content-sharing platforms can reveal grievances, intent, or interest in violence.
Publicly available posts on social media, forums, or content-sharing platforms can reveal grievances, intent, or interest in violence
Social media content can also contain indicators that an individual is in crisis (e.g., expressions of hopelessness, desperation, pleas for help), which could warrant further assessment.
Social media content can also contain indicators that an individual is in crisis
Including a team member with open-source investigations expertise can significantly enhance a BTAM team's ability to identify digital and online indicators of concern.
Including a team member with expertise in open-source investigations can significantly enhance a BTAM team's ability to identify digital and online indicators of concern
Team members with open-source expertise should be trained to ethically and efficiently find, gather, and analyze publicly available open-source information.
These team members should be trained to ethically and efficiently find, gather, and analyze publicly available open-source information
These partners can offer valuable insight into potential symptoms and diagnoses, help BTAM teams understand unusual patterns of behavior, and identify avenues for evaluation and treatment.
These partners can offer valuable insight into potential symptoms and diagnoses, help BTAM teams understand unusual patterns of behavior, and identify avenues for evaluation and treatment
Some employees of concern, particularly those engaging in highly concerning behaviors, may also warrant the use of external systems to gather information when assessing risk.
Some employees of concern, particularly those engaging in highly concerning behaviors, may also warrant the use of external systems to gather information when assessing risk.
Why inferred Typed statement: 'may also warrant the use of external systems' is guidance on when to use external systems, not a prediction.
BTAM teams may seek to gather and examine information from a variety of external systems, including law enforcement, judicial, mental health, and online and social media sources.
BTAM teams may seek to gather and examine information from a variety of external systems, including the following:
Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.
Publicly available court records such as criminal charges, convictions, protective orders, civil lawsuits, eviction filings, and bankruptcy declarations, found on many judicial and governmental websites, can provide relevant context about an individual's legal history or other stressors.
Publicly available court records (e.g., criminal charges, convictions, protective orders, civil lawsuits, eviction filings, bankruptcy declarations), which can be found on many judicial and governmental websites, can provide relevant context about an individual’s legal history or other stressors.
Community mental health professionals can assist in a consultative capacity, using their expertise to assess the risks posed by an individual or situation, particularly where individuals may be experiencing mental health crises.
These professionals can provide assistance in a consultative capacity, leveraging their professional expertise to assess the risks posed by an individual or situation, particularly in cases where individuals may be experiencing mental health crises.
Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.
Members of the community, such as family and friends, may offer critical insight into an individual's behavior and circumstances, especially during crises.
Members of the community (e.g., family, friends) may offer critical insight into an individual's behavior and current circumstances
Why inferred Descriptive 'may' about information sources; typed as guidance.
Seeking to interview community members will typically occur by requesting law enforcement support, and only in serious or high-risk situations.
Seeking to interview members of the community will typically occur by requesting the support of law enforcement and only in serious or high-risk situations
For current or former employees, emergency contacts in personnel files may help identify family and community members with personal information about the individual.
emergency contacts listed in their personnel file may help BTAM teams identify family and community members who have personal information about the individual
Why inferred Descriptive 'may' about a practical route; typed as guidance.
NTAC presented 20 Assessment Themes established by 25 years of NTAC research and the Secret Service's unique operational expertise in violence prevention.
NTAC presented the 20 Assessment Themes that have been established by 25 years of NTAC research
The Assessment Themes are presented in NTAC's 2024 guide for state and local law enforcement, Behavioral Threat Assessment Units.
Behavioral Threat Assessment Units: A Guide for State and Local Law Enforcement to Prevent Targeted Violence (2024)
Assessment Themes are areas of inquiry that, when explored, provide a contextual understanding of an individual's mindset, behavior, and circumstances that will allow a BTAM team to assess if the individual poses a risk of violence.
Areas of inquiry that, when explored, will provide a contextual understanding of an individual's mindset, behavior, and circumstances
Assessment Themes can also help identify relevant protective factors, which can reduce an individual's risk by bolstering their capacity to cope.
Assessment Themes can also help identify relevant protective factors for an individual of concern
Assessment Themes are not intended to be used as a checklist to predict who will engage in violence.
Importantly, Assessment Themes are not intended to be used as a checklist to predict who will engage in violence
The themes allow teams to distinguish situational behaviors, such as temporary frustrations or poor communication, from more persistent, escalating patterns of concern.
these themes allow BTAM teams to distinguish between situational behaviors, such as temporary frustrations or poor communication, and more persistent, escalating patterns of concern
There are three categories of Assessment Themes: contextual themes, behavioral themes, and summative themes.
There are three relevant categories of Assessment Themes: contextual themes, behavioral themes, and summative themes
Instead, these themes provide a structured framework to guide the gathering and integration of information about the individual of concern.
these themes provide a structured framework to guide the gathering and integration of information about the individual of concern
This framework helps BTAM professionals look beyond isolated incidents and evaluate behavior in a broader context.
This framework helps BTAM professionals look beyond isolated incidents and evaluate behavior in a broader context.
This approach ensures decisions are not made based on subjective judgments or initial impressions, but instead on a comprehensive and methodical review of relevant information.
This approach ensures decisions are not made based on subjective judgments or initial impressions, but instead on a comprehensive and methodical review of relevant information.
Assessment Themes characterize common patterns of thinking and behavior found in the background and behavioral history of individuals who have engaged in past acts of targeted violence.
Assessment Themes characterize common patterns of thinking and behavior found in the background and behavioral history of individuals who have engaged in past acts of targeted violence.
While BTAM teams gather information from internal and external systems, the Assessment Themes should guide evaluation of the individual's behaviors, personal circumstances, and relevant environmental factors that may increase, decrease, or contextualize concern.
While BTAM teams gather information from the internal and external systems relevant to the individual of concern, these Assessment Themes should guide the team’s evaluation of the individual’s behaviors, personal circumstances, and relevant environmental factors which may increase, decrease, or contextualize concern.
Gathering both positive details, such as a supportive family, and negative details, such as familial discord, establishes the context of an individual's circumstances.
Gathering both positive details (e.g., caring and supportive family) and negative details (e.g., familial discord and violence) about these factors will establish the context
Prior NTAC research has found that many past attackers had substantial negative experiences related to the contextual themes.
prior NTAC research has found that many past attackers had substantial negative experiences related to these contextual themes
Stressors are significant setbacks, losses, and other life challenges that may be acute or chronic, across family, social, work, health, and legal domains.
Significant setbacks, losses, and other life challenges that may be acute
Home life refers to family dynamics or home environments that negatively impact an individual, including discord, abuse, drug use, criminality, and domestic violence.
Family dynamics or home environments that negatively impact an individual, including family discord, abuse, drug use, criminality, domestic violence
Mental health history covers current or previous symptoms that negatively impact the individual, particularly when untreated, such as paranoia, delusions, depression, and suicidality.
Current or previous history of mental health symptoms that negatively impact the individual, particularly when left untreated
Criminal history is a history of criminal behavior identified in formal records, including arrests, convictions, and other legal actions.
A history of criminal behavior identified in formal records, including arrests, convictions, and other legal actions
Outside formal records, criminal behavior may be identified during the assessment through interviews with family, friends, coworkers, and others familiar with the individual.
Outside of formal records, criminal behavior may be identified during the assessment through interviews with family, friends, coworkers, classmates, and others familiar with the individual
Why inferred Hedged with 'may be identified'; typed as a process statement about sources.
Interpersonal difficulties are a pattern of strained or conflicted relationships with family, partners, friends, coworkers, neighbors, or community members.
A pattern of strained or conflicted relationships with family members, romantic partners, friends, coworkers, classmates, neighbors, or other members of the community
Lack of consequences is a pattern of criminal or inappropriate behavior for which consequences were absent or not commensurate with the behavior.
A pattern of engaging in criminal or inappropriate behavior for which the consequences were either absent or not commensurate with the behavior
Stressors can be experienced across several life domains, including family/romantic relationships, social interactions, work or school environments, personal health, legal actions, and other identified areas. Specific examples include being bullied or harassed by others, financial instability, job loss, divorce or child custody issues, and failed life aspirations.
Specific examples include being bullied or harassed by others, financial instability, job loss, divorce or child custody issues, and failed life aspirations.
Mental health history may or may not include prior formal diagnoses, hospitalizations, and treatment (e.g., prescription medication).
Mental health history may or may not include prior formal diagnoses, hospitalizations, and treatment (e.g., prescription medication).
Contextual themes represent significant elements of an individual's personal circumstances and surroundings that may impact their thinking and behavior.
Contextual themes represent significant elements of an individual’s personal circumstances and surroundings that may impact their thinking and behavior.
Positive home life factors may include supportive families, healthy relationships, and other dynamics that could support intervention strategies to mitigate risk.
positive home life factors may include supportive families, healthy relationships, and other dynamics that could support intervention strategies to mitigate risk
Criminal history may also include other criminal behavior and contacts with law enforcement and the courts that have not resulted in official legal actions.
Criminal history may also include other criminal behavior and contacts with law enforcement and the courts that have not resulted in official legal actions.
Interpersonal difficulties may include an inability to form or sustain positive relationships with others due to the individual's inappropriate or concerning behaviors.
Interpersonal difficulties may include an inability to form or sustain positive relationships with others due to the individual’s inappropriate or concerning behaviors.
The presence of behavioral themes alone cannot predict whether an individual will become violent, but it will inform the final assessment and management strategies.
the presence of these behavioral themes alone cannot predict if an individual will become violent
Concerning or threatening communications are violent, threatening, or disturbing communications conveyed verbally, in writing, electronically, online, or by other means.
Any violent, threatening, or disturbing communications which may be conveyed verbally
Interest in violent topics is an unusual or excessive interest in weapons, violence, gore, prior attacks, notorious killers, or other concerning topics.
An unusual or excessive interest in weapons, violence, gore, prior attacks, notorious killers, or other concerning topics
Particular concern should arise if the individual idolizes or wants to emulate past attackers.
Particular concern should arise if the individual demonstrates an idolization of or desire to emulate past attackers
History of violence is prior physical violence against people, animals, or property, including assaults, domestic violence, animal cruelty, and arson.
Prior acts of physical violence against people, animals, or property
A history of violence may reveal an escalation in aggression, such as moving from property crimes to crimes against persons.
A history of violence may reveal signs of an escalation in aggressive behavior, for example, moving from property crimes to crimes against persons
Why inferred Hedged with 'may reveal'; typed as conjecture.
Stalking, harassing, or bullying is a pattern of conduct that willfully and maliciously causes another to feel bullied, stalked, persecuted, threatened, or injured.
A pattern of conduct that willfully and maliciously causes another to feel bullied, stalked, persecuted, threatened, injured, or attacked
Extreme beliefs are ideological, political, or conspiratorial beliefs that advocate hate or violence, form the basis of a worldview, or significantly influence daily life.
Extreme ideological, political, or conspiratorial beliefs that advocate hate or violence
Fascination with weapons and violence can be demonstrated through stockpiling or manufacturing weapons, being described as obsessed with weapons, consuming or producing violent or graphic media, and writing stories or lyrics indicating a desire to harm others.
Fascination with weapons and violence can be demonstrated in a variety of ways, including stockpiling or manufacturing weapons
Extreme beliefs may be based on distortion of facts (e.g., conspiracy theories) or may advocate distrust, hatred, or the use of violence targeting others based on biases against a particular race, religion, national origin, sexual orientation, gender, or gender identity.
Extreme beliefs may be based on distortion of facts (e.g., conspiracy theories) or may advocate distrust, hatred, or the use of violence targeting others based on biases against a particular race, religion, national origin, sexual orientation, gender, or gender identity.
Central to assessing whether an individual poses a risk of targeted violence is understanding the nature of concerning behaviors commonly observed in previous attackers.
Central to assessing whether an individual poses a risk of targeted violence is understanding the nature of concerning behaviors commonly observed in previous attackers.
As an example, if an assessment reveals an individual is fixated on past attackers, has grown increasingly isolated, and has posted concerning violent content on social media, the BTAM team will need to develop appropriate strategies to manage the risk the individual may pose toward the workplace.
For example, if an assessment reveals an individual is fixated on past attackers, has grown increasingly isolated, and has posted concerning violent content on social media, the BTAM team will need to develop the appropriate strategies to manage the risk the individual may pose toward the workplace.
The content of concerning communications may reveal information on threats, grievances, violent intention, feelings of hopelessness/suicidality, obsessions, paranoid thinking, or a fascination with violence or weapons.
The content of the concerning communications may reveal information on threats, grievances, violent intention, feelings of hopelessness/suicidality, obsessions, paranoid thinking, or a fascination with violence or weapons.
The victim of stalking, harassing, or bullying may or may not have a pre-existing relationship with the individual of concern: victims with one include romantic partners, family members, coworkers, classmates, doctors, attorneys, or neighbors; those without may include elected officials, government employees, or celebrities.
The victim of this behavior may or may not have a pre-existing relationship with the individual of concern.
Fixations are intense or obsessive preoccupations with a person, event, activity, or belief, to the point where they negatively impact aspects of life.
Intense or obsessive preoccupations with a person, event, activity, or belief, to the point where they negatively impact aspects of an individual's life
Fixations often carry an angry or emotional undertone and may be evidenced through extreme beliefs, grievances, interest in violence or weapons, and stalking or harassing behaviors.
Fixations often carry an angry or emotional undertone
Behavior changes are notable shifts in mental, social, occupational, physical, or interpersonal functioning that others can observe.
Changes in behavior observable to others, including notable shifts in mental, social, occupational, physical, or interpersonal functioning
Desperation or despair is feeling hopeless, despondent, desperate, or out of options.
Feeling hopeless, despondent, desperate, or out of options
An inability to perceive improvement may lead to extreme distress and the perception that violence is the only option to cope.
may lead to feelings of extreme distress, depression, frustration, and the perception that violence is the only option to cope with their circumstances
Why inferred Hedged with 'may lead to'; typed as conjecture.
Intense anger or aggression is a pattern of intense or escalating anger or aggression observed through behavior, communication, or reported feelings.
A pattern of intense or escalating anger or aggression
Inconsistency is evidence of unusual differences in an individual's communications and behaviors across work, home, school, social, or romantic contexts.
Evidence of unusual inconsistencies in an individual's communications and behaviors
When inconsistencies are found, they may indicate efforts to conceal violent intentions or behavior.
these may be indicative of efforts to conceal violent intentions or behavior
Why inferred Hedged with 'may be indicative'; typed as conjecture.
Planning and final acts are specific steps taken to prepare to carry out an act of violence, such as researching, visiting, or following targets.
Specific steps taken to prepare to carry out an act of violence
Individuals may also engage in final acts intended to make a statement or to prepare for their inevitable arrest or death.
Individuals may also engage in final acts intended to make a statement or to prepare for their inevitable arrest or death
Why inferred Hedged with 'may also engage'; typed as conjecture about motive.
Behavior changes may be evidenced through changes in mood, appearance, or hygiene; withdrawing or isolating from others; new or increased substance use; sudden aggressive, violent, or threatening behavior; changes in work or school attendance or performance; signs of depression or paranoia; or other uncharacteristic actions.
changes in mood, appearance, or hygiene; withdrawing or isolating from others; new or increased substance use; sudden aggressive, violent, or threatening behavior; changes in work or school attendance or performance; signs of depression or paranoia
Intense anger or aggression may be marked by impulsive angry outbursts, significant overreaction to circumstances or events, or frequent episodes of verbal or physical aggression directed at others.
impulsive angry outbursts, significant overreaction to circumstances or events, or frequent episodes of verbal or physical aggression directed at others
Planning includes researching, visiting, or following potential targets; researching, manufacturing, acquiring, or practicing with weapons; documenting preparations for an attack through hit lists, to-do lists, maps, or manifestos; researching prior attacks and tactics; developing attack plans; researching logistical concerns; or using deceptive practices to hide activities.
Specific steps taken to prepare to carry out an act of violence, including researching, visiting, or following potential targets
Final acts may include drafting a last will and testament, making financial arrangements for family members, leaving farewell messages or notes, posting goodbye messages online, and selling or giving away personal possessions.
These acts may include drafting a last will and testament, making financial arrangements for family members, leaving farewell messages or notes, posting goodbye messages online, and selling or giving away personal possessions.
Summative themes represent key questions that must be answered as part of an overall assessment.
Summative themes represent key questions that must be answered as part of an overall assessment
BTAM teams will be better equipped to make an informed assessment of risk if they have identified what is, or could be, motivating someone to become violent.
BTAM teams will be better equipped to make an informed assessment of risk if they have identified what is, or could be, motivating someone to become violent
Elicited concern in others means the individual's behaviors or communications caused fear, alarm, worry, or distress in those who observed them.
The individual's behaviors or communications have caused fear, alarm, worry, or distress in those who observed them
Particular attention should be paid to whether others are in fear for their safety as a result of the individual's behavior.
Particular attention should be paid to whether others are in fear for their safety as a result of the individual's behavior
Motive is the reason the individual engaged in the behavior that elicited concern or brought them to the attention of the BTAM team.
The reason(s) why the individual engaged in the behavior that elicited concern or brought them to the attention of the BTAM team
Motives may be multifaceted and include retaliating for grievances or perceived wrongs (e.g., bullying, failed romantic relationships, workplace issues); furthering ideological, bias-related, or political beliefs; acting in response to psychotic symptoms; having a desire to kill; achieving fame or notoriety; and committing suicide-by-cop.
Motives may be multifaceted and include retaliating for grievances or perceived wrongs
Access to weapons is the current or future ability to access weapons that could be used to cause harm, including firearms, bladed weapons, explosives, chemicals, and poisons.
Current or future ability to access weapons that could be used to cause harm
Access to weapons may include weapons readily available at home, secured or unsecured, as well as weapons in the homes of relatives or friends.
Access to weapons may include those that are readily available to the individual in their home, whether secured or unsecured, as well as those accessible in the homes of relatives or friends
Why inferred Descriptive 'may include' scope statement; typed as guidance.
Family members, friends, coworkers, neighbors, law enforcement, mental health professionals, and others may have been concerned about an individual's demeanor, mental well-being, or threatening communications.
Family members, friends, coworkers, neighbors, law enforcement, mental health professionals, and others may have been concerned about an individual's demeanor
BTAM teams will need to assess whether the individual has the means and capability to cause harm by gathering information about the weapons the individual has access to or could potentially obtain.
Lastly, BTAM teams will need to assess if the individual has the means and capability to cause harm by gathering information about the weapons the individual has access to or could potentially obtain.
Motive also includes assessing the reasons that may drive an individual to carry out an act of violence.
Motive also includes assessing the reasons that may drive an individual to carry out an act of violence.
BTAM teams will also need to understand whether people who know or have had contact with the individual have been concerned, especially if that concern relates to safety.
They will also need to understand if the people who know or have had contact with the individual have been concerned, especially if their concern is related to safety.
Figure 11 illustrates the contextual, behavioral, and summative themes that may be relevant to an assessment.
Figure 11 illustrates the contextual, behavioral, and summative themes that may be relevant to an assessment
Individuals of concern can exhibit characteristics or behaviors relevant to one or more assessment themes.
Individuals of concern can exhibit characteristics or behaviors relevant to one or more assessment themes
Each assessment theme should be understood in the context of an individual's full background and behavioral history.
Each assessment theme should be understood in the context of an individual's full background and behavioral history.
Figure 11 lists the contextual themes: Stressors, Home Life, Mental Health, Criminal History, Interpersonal Difficulties, and Lack of Consequences.
Lack of Consequences
Figure 11 lists the behavioral themes: Concerning or Threatening Communications, Interest in Violent Topics, History of Violence, Stalking, Harassing, or Bullying, Extreme Beliefs, Fixations, Behavior Changes, Desperation or Despair, and Intense Anger or Aggression.
Intense Anger or Aggression
Why inferred Figure 11 omits Inconsistency and Planning and Final Acts, which pp.69-70 describe as behavioral themes (11 in total); the figure thus shows 18 themes against the 20 stated on p.67.
Figure 11 lists the summative themes: Motives, Elicited Concern in Others, and Access to Weapons.
Elicited Concern in Others
A 37-year-old man called an impromptu meeting at his manufacturing workplace, shot five coworkers (three killed), then drove to two more locations and shot a business owner he knew.
On October 18, 2017, a 37-year-old man gathered coworkers around him by calling an impromptu meeting at the manufacturing facility where he worked
Coworkers reported the attacker's behavior to management and asked for help, but management reportedly refused to intervene because he was a good worker.
management reportedly refused to intervene because the attacker was a good worker, and no action was taken
The case table maps the attacker to contextual themes (stressors, interpersonal difficulties, mental health, criminal history), behavioral themes (intense anger or aggression, history of violence, stalking, harassing, or bullying, concerning or threatening communications), and summative themes (access to weapons, elicited concern in others, motive), each with case details such as financial hardship, felony convictions, and a purchased firearm.
Contextual Themes
The attacker drew a semiautomatic pistol and shot five colleagues in the head, killing three and injuring two.
He then drew a semiautomatic pistol and shot five of his colleagues in the head, killing three and injuring two others.
The attacker was motivated by a grievance against coworkers who frequently played pranks on others at work, of which he felt he was the victim.
The attacker was motivated by a grievance against his coworkers who frequently played pranks on others at work, of which he felt he was the victim.
After the shooting, the attacker drove to two more locations: a former workplace, where he likely targeted his former boss who was not there, and another location, where he shot and injured a business owner he knew.
including a former workplace where he likely targeted his former boss who was not there, and another location where he shot and injured a business owner he knew
Before the attack, the attacker had several stressors, including financial hardship and strained relationships inside and outside the workplace.
Prior to his attack, the attacker experienced several stressors in his life, including financial hardship and strained relationships both inside and outside of the workplace.
After his assault, the attacker was known to be paranoid, believing others were searching for him or out to get him.
In the aftermath of his assault, he was known to be paranoid, believing others were searching for him or out to get him.
To protect himself, the attacker purchased a firearm, which was illegal for him because of felony convictions on his record, and reportedly kept it with him at all times.
To protect himself, the attacker purchased a firearm illegally due to felony convictions on his criminal record and reportedly kept the weapon with him at all times.
The attacker had a history of threatening and concerning behavior at previous jobs and was terminated from those positions because of aggressive behavior.
Additionally, the attacker had a history of threatening and concerning behaviors in his previous jobs and was terminated from these positions due to his aggressive behavior.
He was arrested for assaulting a coworker by placing him in a chokehold, dragging him outside, and throwing him to the ground hard enough to cause unconsciousness.
On one occasion, he was arrested for assaulting a coworker after he put the coworker in a chokehold, dragged him outside, and threw him to the ground so hard that the coworker lost consciousness.
Six months before the attack he was fired from a previous job after a physical altercation with his manager over a raise that had been discussed but not granted.
In a separate incident six months before the attack, the attacker was fired from a previous job after initiating a physical altercation with his manager because he was not granted a raise that was previously discussed.
The attacker began working at the manufacturing facility about four months before the attack.
The attacker began working at the manufacturing facility about four months before the attack.
He was known to act in a paranoid, hostile, and argumentative manner and harassed his coworkers.
He was known to act in a paranoid, hostile, and argumentative manner and harassed his coworkers.
He accused non-English speakers of gossiping, used derogatory language toward them, threatened to kill them, and assaulted coworkers he felt disrespected him.
accusing non-English speakers of gossiping about him, using derogatory language toward them
Three years before the attack, the attacker was a victim of physical assault in a parking lot.
Three years prior to his attack, he was also a victim of physical assault in a parking lot.
Others in the workplace noticed the attacker's behaviors, and coworkers reported their concerns to management and requested help.
These behaviors were noticed by others in the workplace, and coworkers reported their concerns about the attacker's behaviors to management and requested help.
As information is gathered, the BTAM team must assess whether an individual of concern poses a risk of violence.
As information is gathered from interviews, records, and other sources, the BTAM team must assess whether an individual of concern poses a risk of violence
The BTAM team's central question is whether the individual of concern poses a risk of violence at this time.
Does the individual of concern pose a risk of violence at this time?
The BTAM team should make this determination by considering all information obtained using the Systems Approach and relevant Assessment Themes and situational factors.
The BTAM team should make this determination by considering all information obtained using the Systems Approach and considering relevant Assessment Themes
If the BTAM team determines that the individual poses a risk of harm, the team should take steps to intervene and manage the risk.
If the BTAM team determines that the individual of concern does pose a risk of harm, then the BTAM team should take steps to intervene and manage the risk posed
If BTAM teams classify assessments into levels of risk (e.g., low, medium, and high), they should ensure that each classification level is clearly defined and articulable (e.g., clarifying the distinction between low and medium risk) to avoid confusion and inconsistencies across assessments.
BTAM teams should ensure that each classification level is clearly defined and articulable (e.g., clarifying the distinction between low and medium risk) to avoid confusion and inconsistencies across assessments
BTAM protocols should allow the team to deviate from the ascribed level of risk when unique circumstances are identified during the assessment.
The BTAM team's protocols should allow for the team to deviate from the ascribed level of risk
Protocols should also allow for implementing risk management resources in all cases, including those deemed low risk.
Protocols should also allow for implementing risk management resources in all cases, including those deemed low risk
Assessing risk is a dynamic and continuous process, so the team should routinely reassess changes or new information.
Assessing risk is a dynamic and continuous process
The BTAM team should routinely assess any changes or new information that may increase, decrease, or contextualize the risk of harm.
The BTAM team should routinely assess any changes or new information that may increase, decrease, or contextualize the risk of harm posed by the individual of concern
Even when an individual does not appear to pose a current risk of violence, BTAM teams may implement risk management strategies to support the individual's well-being and prevent a potential escalation to violence.
BTAM teams may decide to implement risk management strategies to support the individual's well-being and prevent a potential escalation to violence
Organizations should develop standardized forms to give structure and consistency to documentation of the BTAM process.
Organizations should develop standardized forms to provide structure and consistency in documenting the BTAM process
Preliminary inquiry forms should capture the nature of the report, sources reviewed, initial findings, and a determination of action.
Preliminary inquiry forms to capture the nature of the report, sources of information that must be reviewed, initial findings, and a determination of action
Interview questionnaires should gather background information about the interview subject, details of the behaviors of concern, and the context for those behaviors.
Interview questionnaires to gather background information about the interview subject
Assessment forms should document the sources tapped when gathering information, such as social media and employment records, plus final findings.
Assessment forms to document sources tapped when gathering information
Some BTAM teams might prefer to classify their assessments into levels of risk, such as low, medium, and high risk, for case prioritization and management.
Some BTAM teams might prefer to classify their assessments into levels of risk (e.g., low risk, medium risk, and high risk) for case prioritization and management.
Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.
Find the Perfect Training Class For You
