PART III - Section 2
Threat Assessment

• Introduction
• Threat Assessment Resources
• Excerpts from Threat Assessment: An Approach to Prevent Targeted Violence

---

Introduction

Threatened employees want to know what the agency is doing to protect them and what measures they should take to protect themselves. Since it is impossible to know with any certainty whether a threat is going to be carried out, the agency should always treat threats in a serious manner and act as though the person may carry out the threat.

This section will provide a basic understanding of the threat assessment process. It gives background information for the non-specialist, not instructions on threat assessment techniques.

Threat assessment assistance

As the case studies in Part II illustrate, many cases involving threatening behavior can be handled expeditiously and effectively by a supervisor with the assistance of one or more members of the agency's incident response team. The security or law enforcement representative on the agency's team will ordinarily assess risks, often in consultation with the Employee Assistance Program and employee relations staff, and make recommendations for appropriate strategies and security measures to protect employees. However, it may be helpful for the agency's planning group to identify experts in threat assessment ahead of time, in case a situation requires more expertise than team members can provide.

Gathering information

It is also a good idea to work out ahead of time who will gather which types of information on an individual who makes a threat. Multiple sources of information need to be consulted to better understand the person's behavior.

In some cases, the agency's incident response team can collect current and reliable information (which would include an investigative report) and then consult with a threat assessment professional to develop options for managing the situation. In other cases, the agency's incident response team uses a threat assessment professional to conduct the initial investigation, assess the risks, and make recommendations for managing the situation.

Threat assessment investigations differ from criminal or administrative investigations in that the purpose of the threat assessment investigation is to provide guidance on managing the situation in a way that protects the employees.

---

Threat Assessment Resources

Threat assessment is an evolving technical field. It is important to find a qualified professional to assist you if the need arises. Several Federal agencies have experienced threat assessment professionals within their organizations; some have threat management units within their criminal investigative services. If your agency does not have access to such professionals, law enforcement agencies (such as the Federal Protective Service, Federal Bureau of Investigation, and state and local police) may be able to assist you in identifying experts in threat assessment.

If your agency uses a threat assessment professional who is outside the organization, you should ensure that the individual is aware of all relevant Federal laws and regulations. For example, as explained in PART III: Section 3, Federal regulations in 5 CFR Part 339 prohibit ordering a psychological examination under most circumstances and the threat assessment professional thus must understand the limits of the inquiry. Another example is the Privacy Act provisions of 5 USC 552a which include obligations for guarding personal data.

The remainder of this section consists of excerpts from a research brief on the topic of threat assessment issued by the U. S. Department of Justice's National Institute of Justice. Entitled Threat Assessment: An Approach To Prevent Targeted Violence, written by Robert A. Fein, Ph. D., Bryan Vossekuil, and Gwen A. Holden, it explains the functions of a threat assessment program, including the investigation, risk assessment, and case management components. This research brief can be especially helpful for an agency's planning group to gain an understanding of the process of conducting threat assessments so that group members can better identify experts in threat assessment before they are actually needed and learn how they can coordinate efforts with them when the need arises.

---

Traditional law enforcement activities aim at apprehending and prosecuting perpetrators of violence after the commission of their crimes. In most circumstances, the primary responsibility of law enforcement professionals is to determine whether a crime has been committed, conduct an investigation to identify and apprehend the perpetrator, and gather evidence to assist prosecutors in a criminal trial. However, when police officers are presented with information about a possible future violent crime, their responsibilities, authority, and investigative tools and approaches are less clear. "Threat assessment" is the term used to describe the set of investigative and operational techniques that can be used by law enforcement professionals to identify, assess, and manage the risks of targeted violence and its potential perpetrators.

Individuals utter threats for many reasons, only some of which involve intention or capacity to commit a violent act. However, a person can present a grave threat without articulating it. The distinction between making and posing a threat is important.

• Some persons who make threats ultimately pose threats.
• Many persons who make threats do not pose threats.
• Some persons who pose threats never make threats.

Postponing action until a threat has been made can detract attention from investigation of factors more relevant to the risk of violence.

Data from two recent studies suggest that at least some approachers -- and attackers -- of public officials/figures show an interest in more than one target.⁵ U.S. Secret Service experience indicates that a number of would-be Presidential assassins, such as Arthur Bremer and John Hinckley, considered several targets, and changed targets, before finally making an attack. Data on relationship stalking murders and workplace violence murders point to suicide, as well as homicide, as a possible outcome.⁶ These examples suggest that, in some cases, the perpetrator may ultimately become his or her own final target.

The threat of sanctions, such as a long prison sentence, may not deter a person who desperately desires revenge or is prepared to die to achieve his objective. Passage of enforceable laws that define and prohibit behaviors that could presage violent attacks is one important step in preventing such attacks. Forty-nine States have passed anti-stalking laws in the past four years, and the National Institute of Justice, together with the National Criminal Justice Association, published a model anti-stalking law.⁷ Additionally, authorities in some jurisdictions are reviewing various threat and harassment laws to determine whether they might apply to threat-of-violence situations. However, laws by themselves are unlikely to prevent stalking, workplace, or public figure-centered violence, unless law enforcement and security professionals know how to identify, evaluate, and manage persons at risk of committing these violent acts.

---

Fundamental Principles of Threat Assessment

Notwithstanding the growing importance of threat assessment for law enforcement and security professionals, systematic thinking and guidance in this area have been lacking in many organizations. Some law enforcement and security communities currently do not have clearly articulated processes or procedures to steer their actions when they are made aware of threat-of-violence subjects and situations. Without guidelines for making threat assessments, otherwise competent law enforcement professionals may be less thoughtful and thorough than they might be in handling such incidents. To fill the void, this report presents four fundamental principles that underlie threat assessment investigation and management. They are followed by a model and process for conducting comprehensive threat assessment investigations.

1. Violence is a process, as well as an act. Violent behavior does not occur in a vacuum. Careful analysis of violent incidents shows that violent acts often are the culmination of long-developing, identifiable trails of problems, conflicts, disputes, and failures.
2. Violence is the product of an interaction among three factors: The individual who takes violent action; stimulus or triggering conditions that lead the subject to see violence as an option, "way out," or solution to problems or life situation; and a setting that facilitates or permits the violence, or at least does not stop it from occurring.
3. A key to investigation and resolution of threat assessment cases is identification of the subject's "attack-related" behaviors. Perpetrators of targeted acts of violence engage in discrete behaviors that precede and are linked to their attacks; they consider, plan, and prepare before engaging in violent actions.
4. Threatening situations are more likely to be successfully investigated and managed if other agencies and systems -- both within and outside law enforcement or security organizations -- are recognized and used to help solve problems presented by a given case. Examples of such systems are those employed by prosecutors; courts; probation, corrections, social service, and mental health agencies; employee assistance programs; victim's assistance programs; and community groups.

Functions of a Threat Assessment Program

The three major functions of a threat assessment program are: identification of a potential perpetrator, assessment of the risks of violence posed by a given perpetrator at a given time, and management of both the subject and the risks that he or she presents to a given target.

Identifying the Perpetrator

The process of identifying a potential perpetrator involves: (1) defining criteria that could lead to a person becoming a subject of a threat assessment investigation; (2) determining the areas within the law enforcement or security organization that will be responsible for receiving information about possible subjects and conducting threat assessment investigations; (3) notifying those individuals and organizations that might come in contact with -- or know of -- potential subjects about the existence of a threat assessment program; and (4) educating notified individuals and organizations about the criteria for bringing a concern about potential violence to the attention of investigators.

Assessing the Risks

The second goal of a threat assessment program is to evaluate the risks persons under suspicion may pose to particular targets. Risk assessment involves two primary functions: investigation and evaluation.

Investigation

The primary objective of a risk assessment investigation is to gather information on a subject and on potential targets. Multiple sources of information should be consulted to learn about a subject's behavior, interests, and state of mind at various points in time.

• Personal interviews with the subject.
• Material created or possessed by the subject, including journals and letters, and materials collected by the subject, such as books and magazines, that may relate to the investigation.
• Persons who know or have known the subject, including family members, friends, coworkers, supervisors, neighbors, landlords, law enforcement officers, social service or mental health staff, and previous victims of unacceptable behavior (including violence) committed by the subject.
• Record or archival information, including police, court, probation, and correctional records; mental health and social service records; and notes made by those aware of the subject's interest in a particular target, such as security personnel, managers, victims, or colleagues.

Information about the subject

At the beginning of a threat assessment investigation, it is important to secure detailed descriptions of the subject's behaviors and actions that prompted other persons to notice the subject. The kinds of information useful for threat assessment include data about overwhelmingly or unbearably stressful experiences and the subject's ability to cope at such times. Behavioral data about the subject's motives, intentions, and capacities is critical; of particular importance is information about attack-related behaviors:

• The subject has expressed interest in possible targets, including particular, identifiable targets.
• The subject has communicated with or about potential targets.
• The subject has considered and/or attempted to harm self or others.
• The subject has secured or practiced with weapons.
• The subject has followed or approached potential targets, either with or without weapons, at events or occasions.

Interviewing the subject

Whether to interview the subject of a threat assessment investigation can be a key question; the decision depends on several factors:

• The investigator's need for information.
• The facts leading to initiation of investigation.
• The investigator's legal standing in relation to the subject.
• The resources available to the investigator.
• The investigator's training and experience in interviewing.
• The stage of the investigation.
• The investigator's strategy for resolving the case.

---

A decision to interview a subject should be made on the basis of case facts. Generally, when there has been face-to-face contact between subject and target or the subject has communicated a threat to the target, an interview is a good idea. An interview under such circumstances may have several goals. It may signal that the subject's behavior has been noticed, permit the subject's story to be related to a third party, gather information that is the basis for corroboration, and provide an opportunity for communicating that the subject's behavior is unwelcome, unacceptable, and must cease.

Any interview is a vehicle for gathering information about the subject that can be used to assess the threat that a subject poses and to manage that threat. Therefore, threat assessment interviews are most productive if they are conducted respectfully and professionally. The task of the investigator is twofold: To gather information about the subject's thinking, behavior patterns, and activities regarding the target(s) and to encourage change in the subject's behavior. By showing an interest in the subject's life that is neither unduly friendly nor harsh, an investigator can increase the likelihood of the interview's success.

In some cases, however, an interview may intensify the subject's interest in the target or increase the risk of lethal behavior. For example, a desperate and suicidal subject, self-perceived as having been abandoned, who has been stalking a former partner, may sense that time is running out and be prompted by an interview to engage in more extreme behavior before "they put me away." In such a circumstance, the investigator may need to expend additional resources, perhaps increasing security for the target, arranging hospitalization or arrest of the subject, or monitoring or surveilling the subject. Subject interviews, therefore, should be considered and conducted within the context of overall investigative strategy.

Information about the target

A man who, over days and weeks, has been following a secretary whom he met once, but with whom he has no relationship, appears to have picked out a potential target. An employee, fired by a manager whom he blames for discriminating against him and causing the breakup of his family, has told former coworkers that he will "get even" once again, a potential target appears to have been selected. To prevent violence, the threat assessment investigator requires information on the targeted individual. Relevant questions about the target might include the following:

• Are potential targets identifiable, or does it appear that the subject, if considering violence, has not yet selected targets for possible attack?
• Is the potential target well known to the subject? Is the subject acquainted with a targeted individual's work and personal lifestyle, patterns of living, daily comings and goings?
• Is the potential target vulnerable to an attack? Does the targeted individual have the resources to arrange for physical security? What might change in the target's lifestyle or living arrangements that could make attack by the subject more difficult or less likely, e.g., is the targeted individual planning to move, spend more time at home, or take a new job?
• Is the target afraid of the subject? Is the targeted individual's degree of fear shared by family, friends, and/or colleagues?
• How sophisticated or naive is the targeted individual about the need for caution? How able is the individual to communicate a clear and consistent I want no contact with you message to the subject?

Evaluation

A two-stage process is suggested to evaluate information gathered about the subject and the potential target(s). In the first stage, information is evaluated for evidence of conditions and behaviors that would be consistent with an attack. The second stage of evaluation seeks to determine whether the subject appears to be moving toward or away from an attack. After analyzing the available data, the threat assessor is left with these questions:

• Does it appear more or less likely that violent action will be directed by the subject against the target(s)? What specific information and reasoning lead to this conclusion?
• How close is the subject to attempting an attack? What thresholds, if any, have been crossed (e.g., has the subject violated court orders, made a will, given away personal items, expressed willingness to die or to be incarcerated)?
• What might change in the subject's life to increase or decrease the risk of violence? What might change in the target's situation to increase or decrease the risk of violence?

---

Case Management

The first component of threat assessment case management involves developing a plan that moves the subject away from regarding violence against the target as a viable option. Such a plan is likely to draw on resources from systems within the threat assessment unit's parent organization, as well as those outside it. The second component is plan implementation. The best developed and supported case management plan will be of little use in preventing violence if the plan is not implemented and monitored. The plan must remain flexible to accommodate changes in the subject's life and circumstances. The final management component is formal closing of the case.

Case management development

Once an evaluator determines that a given subject presents a risk of violence to a targeted individual, the next task is to develop a plan to manage the subject and the risk. The evaluator then proceeds to identify those internal and external systems that may be helpful in managing the problems presented by the subject. In certain situations, such as those in which the subject has been stalking an identifiable target in a jurisdiction that has an enforceable and effective anti-stalking law, the best way to prevent violence and minimize harm to the targeted individual may be to prosecute the case vigorously.

A good relationship between threat assessment investigators and prosecutors can influence the priority assigned to the case and the extent to which prosecutorial and judicial processes facilitate its resolution. Such relationships also may affect the court's disposition of the case, including sentencing of a convicted offender.

Even conviction and imprisonment, however, do not guarantee that the target will be safe from the subject. If the subject has been unable or unwilling to let go of the idea of a relationship with the target, or if the subject attributes the pains and misfortunes of his or her life to the targeted individual, it may make sense to consider strategies by which the subject is encouraged to change the direction, or intensity, of his interest. A subject engaged in activities that bring success and satisfaction is less likely to remain preoccupied with a failed relationship. Family, friends, neighbors, or associates may play a role in suggesting and supporting changes in the subject's thinking and behavior. In addition, mental health and social service staff may be of great assistance in aiding the subject to formulate more appropriate goals and develop skills and strengths that are likely to result in life successes.

At least one aspect of a case management plan concerns the target. If the subject is to be prohibited from contact with the target, the target needs to understand what to do (i.e., whom to call and how to contact the official handling the case) if the subject initiates direct or indirect contact.

Case management implementation

The most carefully crafted plan will have little effect if it remains in the investigator's files and is not translated into action. Although no procedures or techniques can guarantee that a subject of comprehensive threat assessment will not attempt violent action toward a target, two activities are known to help reduce the risk of violence, and, in the instance of a bad outcome, assist the threat assessment team in any post-incident review.

First, documentation of data and reasoning at every stage of a threat assessment investigation is essential. Undocumented or poorly documented information-gathering and analysis are suspect in and of themselves, and they provide little foundation for review or for efforts to learn from -- and improve on -- experience. Without clear documentation, investigators are left with only their recollections, which can be both partial and faulty and are subject to criticism as retrospective reconstruction. A carefully and comprehensively documented record may be criticized for imperfect data-gathering or flawed analysis, but such a record also demonstrates both thoughtfulness and good faith -- critical questions in any post-incident review.

Second, consultation at every major stage of the threat assessment process can be a significant case management tool. Consultants may be members of the threat assessment unit or external experts. To be effective, a consultant should be knowledgeable in areas relevant to the case and be known and trusted by the investigators. For example, in a case where a subject has a history of diagnosed mental disorders and the primary investigator is unfamiliar with mental health language and concepts used in the records, an expert in psychology or psychiatry can provide invaluable insight and advice.

In addition to providing special expertise, consultants may notice and ask about questions in a case that remain to be explored or answered. Even proficient investigators are occasionally vulnerable to "missing the forest for the trees." A consultant, such as a fellow threat assessment specialist who has not been involved with the case, may offer a comment that can redirect or sharpen an ongoing investigation.

In the event of a bad outcome, use and documentation of consultant expertise may demonstrate that the threat assessment team sought additional perspectives and ideas and did not get stuck with "tunnel vision."

Closing the case

The final task of threat assessment case management is closing the case. When a threat assessor determines that the subject has moved far enough away from possible violent action toward the target to no longer cause appreciable concern, the case can be considered for closing. At this time, it may be important to ask:

• What has changed in the subject's life that appears to lessen the likelihood that the subject is interested in or will attempt violent action toward the target?
• Which components of the case management plan seemed to affect the subject's thinking or capacity to initiate violent action, and to what extent?
• What life circumstances might occur that would again put the subject at increased risk of contemplating, planning, or attempting violent action toward the original target or other potential targets?
• Are there supports in place (or that can be developed) that will be known and available to the subject at a future time when the subject is again at risk of moving toward violent behavior?

While social commentators and analysts may debate the myriad reasons that lead to growing national concern about targeted violence, law enforcement and security organizations are increasingly being called on to examine individual situations and make judgments and determinations about the risks of violence that one person might present to an identifiable target. In cases related to stalking behaviors, workplace violence, attacks on public officials and figures, and other situations where targeted violence is a possibility, comprehensive and carefully conducted threat assessment investigations can safeguard potential targets, deter potential attackers, and serve the public.

For further information about threat assessment, a new publication entitled Protective Intelligence and Threat Assessment Investigations: A Guide for State and Local Law Enforcement Officials will soon be available through the Department of Justice.

Case Study 7 provides practical examples of some of the issues discussed in this section.

Footnotes
³ Series: NIJ Research in Action, Published: September 1995, NCJ 155000. Disclaimer: Points of view in this document are those of the authors and do not necessarily reflect the official position of the U. S. Department of Justice.
⁴ About the authors: Robert A. Fein, Ph. D., a Visiting Fellow at the National Institute of Justice, is a Consultant Psychologist for the U. S. Secret Service; Bryan Vossekuil is Assistant Special Agent in Charge, Intelligence Division, U. S. Secret Service; and Gwen A. Holden serves as Executive Vice President of the National Criminal Justice Association.
⁵ Dietz, P. E. and D. A. Martell, Mentally Disordered Offenders in Pursuit of Celebrities and Politicians, National Institute of Justice, Washington, D. C., 1989, 83-NI-AX-0005; Dietz, P. E., D. B. Matthews, D. A. Martell, T. M. Stewart, D. R. Hrouda and J. Warren, Threatening and Otherwise Inappropriate Letters to Members of the United States Congress, Journal of Forensic Sciences, 36 (September 5, 1991): 1445-1468; Dietz, P. E., D. B. Matthews, C. Van Duyne, D. A. Martell, C. D. H. Parry, T. M. Stewart, J. Warren and J. D. Crowder, Threatening and Otherwise Inappropriate Letters to Hollywood Celebrities, Journal of Forensic Sciences, 36 (January 1, 1991): 185-209; and Fein, R. A. and B. Vossekuil, The Secret Service Exceptional Case Study Project: An Examination of Violence Against Public Officials and Public Figures, National Institute of Justice, study in progress, 92-CX-0013.
⁶ For example, both Thomas McIlvane, in the Royal Oak, Michigan post office attack, and Alan Winterbourne, in the Oxnard, California unemployment office attack, killed themselves.
⁷ National Criminal Justice Association, Project to Develop a Model Anti-Stalking Code for States, National Institute of Justice, Washington, D. C., 1993.