Using Situational Awareness to Identify Pre-Attack Indicators

Know the signs of an individual who might act out immediately - or weeks or years from now - so you can address student, teacher and staff challenges, as well as prevent violence on campus.
Published: March 20, 2015

If a gunman or someone else with ill intent were on your campus, when would you want to know about them? At the parking lot, or main entrance? The parking lot. At the main entrance or in the lobby? The main entrance. Lobby, or in the hallway? The lobby. Hallway or classroom? The hallway. You get the idea.

Situational awareness allows you to recognize the early signs of danger in order to prevent violence or at least mitigate an attack. More of an attitude than a hard skill, situational awareness is the ability to identify and process information about what is happening on and around your campus. It is something we all have some of the time but not all of the time.

RELATED: PAINs: Warning Signs of an At-Risk Individual

As is the case with most abilities, there are varying levels of situational awareness. Jeff Cooper, a Marine and innovator of tactical training, pioneered the concept of levels of awareness.  His system, Cooper’s Color Codes, has been used to train military and law enforcement for decades.  Cooper’s Color Codes have nothing to do with warning code phrases or the outdated Homeland Security alert system; they simply assign a color to describe a level of awareness.

Yellow is the goal for optimum situational awareness. By being prepared, alert and relaxed you are best able to observe your environment and notice changes that may pose a risk. Sometimes these observations are subtle and identified via intuition. Intuition is not magical; it is an educated hunch based on your knowledge and experience. Nothing is more intuitive than survival. Intuition is a natural defense mechanism that alerts us to possible danger.

——Article Continues Below——

Get the latest industry news and research delivered directly to your inbox.

To enhance situational awareness, take time to understand the baseline of typical activities where you work. This operational environment analysis will help you to quickly identify concerning behavior and orient yourself if emergency response is needed.  Early recognition enhances response, which is critically important when seconds matter. Response to attack and decision-making will be addressed later. First let’s look at prevention.

Campus Violence Doesn’t Just ‘Happen’
Prediction can seem daunting when a mass killing is framed only within the context of the shooting. Imagine the same hypothetical killer mentioned earlier, but instead of you seeing him exhibiting concerning behavior in the parking lot, you observe his intention in the form of a social media post months before the first shot is fired. Despite how they are portrayed by the media, active shooter attacks do not start when the first shot is fired.

The length and observability of these precursor incidents increase the possibility of prevention. The challenge is having the situational awareness to observe a potential threat and then direct the appropriate resources towards the person in question before it is too late.

On April 20,1999, 13 people were murdered at Columbine High School. While not the first mass killing in a school, Columbine is the event that coined the term “active shooter.”  “Active shooter” certainly describes the event that immediately surrounds the tragic murders, but the Columbine attack did not start on April 20.

The attack did not start at 11:19 a.m. when, according to a witness, one of the two killers yelled, “Go! Go!,” and they both pulled guns from beneath their trench coats and began shooting. Nor did it begin at approximately 11:18 a.m. when the two assailants left their vehicles in the junior parking lot after their explosive devices failed to detonate. It did not begin when they carried the explosive devices into the school and attempted to set them to detonate at 11:15 a.m. during a busy lunch shift.

The attack did not start on April 20 when they loaded their weapons, or even that year when they rehearsed their attack. While we will never know the exact date, the attack probably started in 1996 when a blog associated with an online gaming site took a violent turn. From that point forward, warning signs were exhibited, and there was a chance to prevent what eventually happened three years later.

PAINs: Pre Attack INdicators
Few mass killing attacks are preceded by a direct threat. While threats should never be ignored, they should be viewed more as a promise than a guarantee. Threats are typically issued to obtain a desired response such as fear rather than forecast imminent danger. Preventing an attack requires the observation of subtle Pre Attack INdicators (PAINs); not just waiting for direct threats.

When PAINs are observed, caution must be taken to consider the context of the warning signs, and a determination must be made as to whether a threat assessment is needed. The focus of a threat assessment is not if a person makes a threat but if they pose a threat. Simply put, threat assessment is the process to determine dangerousness.

Determining if Someone Is Dangerous
In his book The Gift of Fear, Gavin de Becker outlines a powerful way to efficiently define dangerousness. JACA is an acronym for Justification, Alternatives, Consequences and Ability. Apply JACA from the viewpoint of the person you are assessing, not your own, and answer the following questions:

  • Does the person feel justified in taking violent action?
  • Does the person feel there are alternatives to violence?
  • Is the person concerned about the consequences of a violent action?
  • Does the person have the ability to carry out an attack?

If one or more elements of JACA are present, a formal threat assessment is likely needed. JACA is simply a snapshot and does not replace the need for a formal and comprehensive threat assessment and case management program.

Threat assessment programs take advantage of early warning signs. When these signs are missed and the situation escalates to imminent violence, PAINs are still present but they are more often associated with attack-related behavior. Recognizing PAINs immediately prior to an attack may not enable prevention, but it can mitigate the casualties.

First Timer’s Syndrome
Mass killers rarely have an exit strategy; they expect to die (suicide or suicide by cop) or be captured. Because the attack will be their first and last act of extreme violence, they will exhibit behavior and physical PAINs immediately before the attack. An apt description of these PAINs is First Timer’s Syndrome. Working in Code Yellow (prepared, alert and relaxed) allows you to observe PAINs that slightly deviate from baseline operations and may pose danger.

Physical PAINs include appearance and dress. Behavioral PAINs include overt actions and more subtle gestures. It’s important to note that these PAINs a
re almost always consistent with perfectly innocent explanations and do not automatically indicate danger. When the behavior is carefully and prudently explored and the person is determined not to be a danger, our intuition learns how to better distinguish future threats.

It is your intuition, training and experience that help you determine if the situation poses no threat; if further investigation is needed or if immediate response is required. In the very rare instances when immediate action is required, your mindset (Cooper’s Color Code Red) can improve your response.

Adopt an Appropriate Level of Awareness
Try to avoid Code White (unaware) when you are at work or in public places, and make condition Code Yellow a habit. When you observe potential PAINs, quickly analyze the situation. A valuable system to make rapid decisions under pressure is the Observe-Orient-Decide-Act (OODA) Loop (sometimes referred to as Boyd’s Cycle after its creator, retired U.S. Air Force Col. John Boyd).

According to Boyd’s theory, response can be seen as the result of Observe-Orient-Decide-Act (OODA) cycles. The process begins by observing the situation. Orientation is next and is critical because most emergencies happen too quickly to process information as it is observed. Think of orientation as gaining perspective. Once orientation is gained, it is time to decide. The decision considers factors in information from orientation and your training and experience. The last step is to act on the decision. The “loop” occurs when the situation changes. This cycle continues throughout an incident.

Throughout the day, strive to have good situational awareness (Code yellow). If you identify potential dangers, switch to Code Orange and apply the OODA Loop. In the very rare instances that require immediate response, move to Code Red or switch back to Code Yellow if no threat exists. Repeat this exercise and situational awareness will become habit.

Be Aware, but Don’t Look for Mass Killers
In “Just 2 Seconds” a resource guide for those charged with protecting public and high profile people, the authors (De Becker, Marquart & Taylor) point out that it is futile to “look for assassins.” Trying to look for someone who could be an attacker in a crowd is like looking for a needle in a stack of needles. What student does not have a backpack? Are any shirts actually tucked in?

Rather than trying to imagine how every person could be a threat, maintain good situational awareness and allow yourself to recognize physical and behavioral activities that differ from the baseline. Whenever possible, observe persons as they exit vehicles or move to enter buildings or buses. Watch for physical and behavior indicators when people approach new areas such as a school or bus.

Response to PAINs Varies
If you wait for a guarantee of danger, you will eliminate the opportunity to prevent violence or seriously limit your ability to mitigate casualties. PAINs are simply warning signs that almost always deserve some attention but rarely warrant immediate action.  When you observe PAINs you should either:

  • Eliminate the person as a threat and move back to Cooper’s Code Yellow; or
  • Continue to investigate and remain in Cooper’s Code Orange; or
  • Act and implement emergency response plans (Cooper’s Code Red).

The decision is based on your observations, circumstances and experience. If you cannot eliminate the situation as a threat and are unsure if the situation is dangerous, remain focused (Code Orange) and investigate. How you investigate is situational. While interacting with a potential threat may seem counter-intuitive, it may be a necessity if you are responsible for the safety of others.

When contemplating the implementation of preparedness programs, leaders should consider the following decision-making possibilities:

  • Do nothing and hope nothing happens.
  • Do nothing and it does happen.
  • Do something and nothing happens.
  • Do something and it happens

Protecting campuses can be incredibly difficult and tragically imperfect, but situational awareness and PAINs are strategies that can help make schools, universities and hospitals even safer.

Brad Spicer is founder and president of SafePlans, a firm that specializes in all-hazards preparedness solutions. For more information, visit SafePlans.com.

Strategy & Planning Series
Strategy & Planning Series
Strategy & Planning Series
Strategy & Planning Series
Strategy & Planning Series