Interrupting the Pathway to Violence

Five Stages of Attacker Progression

Active attack incidents start long before the act of violence takes place. A majority of attackers go through a series of stages prior to the attack occurring. At any point during the pre-attack stage prevention may be possible if the threat is identified early and proper reporting and interventions are implemented. This post will examine the five stages of an active attack and look at how each can be identified for proper intervention.

Grievance

A large number of active attackers are motivated by a grievance of some sort. This may be in the form of a percieved slight or injustice the attacker believes a boss, co-worker or someone else in authority has committed against them.  This grievance may be from a real source such as bullying in school where the attacker has dealt with the issue for an extended period of time. When this belief, real or imagined continues for a long period the attacker may then move on to the next phase which is violent ideation.

In order to prevent unnecessary grievances schools should make sure that bullying is identified and stopped as soon as it is observed. There should also be anti-bullying training in place to alert students and parents to the psychological and emotional toll this behavior illicits. In the workplace employeers should ensure that the environment is free from harrassment and other negative forms of behavior. This will help ensure that employees are treated fairly and can prevent some of these perceived wrong doings.

Violent Ideation

The next phase in the pathway to violence is violent ideation. It is during this phase that the attacker begins to believe an appropriate course of action in addressing their grievence is through violent behavior. During this phase others may begin to notice the person’s intent to carry out an attack. In the violent ideation phase the attacker may begin to present leakage to others. Leakage, as defined by the FBI, is the communication of an intent to cause harm to a third party. Leakage serves as a significant warning behavior to others. This communication will allow others to observe the attacker’s motivation and potential target for attack.  Leakage is the number one indicator of violent behavior that can be observed by others and reported to law enforcement.

According to a study by the National Threat Assessment Center another commonly observed symptom prior to an attack are symptoms of altered mental health. Over half of the attackers analyzed in the study exhibited mental health symptoms prior to or at the time of their attacks, including depression, psychotic symptoms, and suicidal thoughts. These symptoms can contribute to distorted perceptions, impaired judgment, and the rationalization of violent actions.

Another concerning behavior identified by the study was an obsessive interest in violent topics. This interest is often evidenced by behaviors such as viewing or studying prior active attacks, posting online about previous attacks and indicating a positive reaction to prior violent incidents. It is during the violent ideation phase that any of the above behaviors can be observed by others and reported. These behaviors are major warning signs that a person may be contemplating violent behavior against others. Schools and workplaces should ensure they have reporting mechanisms in place to report such behavior. These reporting mechanisms should involve law enforcement in the threat mitigation process as well.

Research and Planning

Following the violent ideation phase the attacker will enter the research and planning phase. It is during this phase that the attacker will research ways to carry out the attack and begin to plan how they will execute their violent action. The attacker may use online resources to research how to carry out their attack. This may include looking at the types of weapons to use and the specific location and time of day so that the attack can inflict the most injuries or deaths.

If the attacker is not associated with the location of the attack they may look at floor plans or security features of the location during the research and planning phase. The attacker may also visit the site and conduct a walk-through of the area and probe for security weaknesses at the attack site location. During this phase co-workers, friends or family members may come across writings or websites the attacker has visited which may give an indication of their plans to carry out an attack. If the attacker visits a site, they are not associated with, employees or security personnel may notice the person’s odd behavior or attempts to probe security deficiencies. This is why it is important that employees follow security protocols and not let individuals piggy-back into buildings or provide non-employees with secure information about the facility. This phase of the attack can take days or weeks to carry out, giving others time to notice and report these efforts when observed.

Preparation

During the preparation phase the attacker begins to put together the equipment, training and resources they need to carry out the attack. The attacker may purchase firearms or bomb making material at this stage. The attacker may also go to a shooting range to help hone their firearm skills before the attack. During this phase, family and friends may notice a sudden fascination with acquiring guns and training where the individual did not seem overly interested in these areas before.

It is also during this phase that the attacker may begin to get their affairs in order. They may write a suicide or end of life note if they do not expect to survive the attack. They may begin to write a will or give family and friends some of their possessions. The attacker may also write or record a manifesto to explain to others their reason for their attack. These are all signs that if someone comes across should be key indicators of the person’s intent to carry out an attack or maybe a sign the person intends to harm themselves.

Attack

This is the final phase of the pathway to violence. At this point the attacker thoroughly researched and planned the attack. They have gained the necessary weapons and training to carry out the attack. This phase is the hardest to stop through prevention once it has started. If people associated with the attacker have not observed and reported behavior in the other phases it will usually be too late to stop this phase of the attack pathway. During this phase once the attack begins the intended victims can only react to the attacker. This is why it is important that potential victims have prior training for how to respond to an active attacker. The reactive approach applies to the law enforcement response as well. The best-case scenario in this situation is that someone observes the armed attacker approaching the site and can go into a lock-down and alert law enforcement before the attacker enters the attack site.

As can be observed by viewing the steps in the pathway to violence there are several steps during the pathway where others can observe the attacker’s behavior and potentially prevent a violent attack. For this to happen friends, family, and co-workers must receive training on what concerning behaviors to look out for. They must also have training on how to report their observations in their organizations and to law enforcement. Ideally the best-case scenario is that an attack is prevented before it is carried out. If an attack cannot be prevented, then individuals must have proper training on how to respond once an attack has begun. If the attacker chooses a location they are not associated with then there may not be a chance to prevent it from occurring. This is where it is imperative that individuals learn and practice how to respond to an active attack incident.