The September 2024 active shooter attack that four dead at Apalachee High School in Winder, Georgia illustrates again how tragic a school incident involving guns can be and how quickly the news and impact of the event can spread globally. In June 2024, the FBI in their Active Shooter Incidents in The United States report designated 48 shootings as active shooter incidents in the U.S. in 2023. Of those 48 incidents, 28 (58%) occurred in open spaces, followed by 14 in commerce (29%), three in education (6%), two in healthcare (4%), and one in a residence (2%).
The number of active shooter incidents in education may seem low. However, when compared to the total number of active shooter incidents in a year, given the amount of attention they receive from the media, plus the fact that such shootings involve children in a setting where parents trust their children to be safe, it continues to be a topic of great concern.
Understanding the threat is imperative to preventing active shooter incidents. Schools and universities are now focusing on prevention associated with information sharing, situational awareness, and specifically, behavioral threat management teams (BTMT). K-12 and college campuses are attempting to develop a list of anomalies based on behaviors that go beyond a baseline of expectations on campus – anomalies that would cause concern.
Eliminate Siloes to Encourage Information Sharing
The first step towards schools shifting their focus to prevention is to review a school’s information sharing policies. Many campuses have at four or more different groups on campus observing and collecting informal information about student behavior: classroom teachers/faculty, guidance counselors or mental health professionals, school/campus leadership or administration, and school/campus security/public safety. Some of these professionals are more likely to notice changes in behavior, some are more likely to know about changes in home life or social life, while others are more likely to notice broader changes in academic performance and engagement. These groups can be easily siloed, so schools must come up with formalized ways of sharing information across these groups.
Formalized communication systems allow for behavioral threat management teams to have the best information possible when making decisions about taking preventive steps. These systems also need to have enough stakeholders present to decide the proper balance between supporting the student and maintaining the safety of the broader school community.
Good Situational Awareness Helps Campuses Identify Behavior Anomalies
Identifying what is an anomaly not only depends on knowing what behavior is considered normal. It also greatly depends on situational awareness.
Shortly after the 9/11 attacks, the “See Something, Say Something” campaign began circulating. Although a very successfully campaign, it seemed to miss the mark on helping people determine what is considered “something.”
Related Article: See Something Say Something: Tips Thwarted 6 School Shooting Plots in February
It’s important to understand what is considered a normal environment to determine what’s abnormal, or an anomaly. We make such determinations typically based on situational awareness.
In the simplest terms, situational awareness focuses on knowing your surroundings. Global Guardian goes into greater detail:
- “Situational awareness is the perception and comprehension of one’s surroundings or situation, coupled with the ability to project future events and make informed decisions based on that understanding.
- “Situational awareness goes beyond observation: it requires actively perceiving, comprehending, and projecting information to make informed decisions in real-time. Picture a firefighter assessing a burning building, or a project manager leading a high-stakes meeting — though very different situations, both rely on situational awareness to assess risks, anticipate obstacles, and adapt strategies on the fly.”
What Is a Behavioral Threat and Management Team (BTMT)?
After the mass shooting at Virginia Tech, schools and universities across the country developed campus-wide teams to assess and mitigate behavioral threats. While these teams focus primarily on student behaviors, assessing the broad landscape of risk management from various constituents is paramount to a holistic approach to proactive intervention.
Team members typically include staff members responsible for student wellness, student services, security, and academics. Some teams are fairly large, while others are quite small. Teams may use off-the-shelf tracking and analyst platforms, while other teams might use a simple spreadsheet. BTMTs have multiple responsibilities, but none more important than connecting the dots to prevent an active shooter attack. More formal definitions of BTMTs include:
- “Behavioral Threat Assessment and Management (BTAM) is the systematic process of investigating and assessing concerning behaviors. The primary goal of BTAM is to evaluate the difference between making a threat and posing a threat to a school community and then to build a management plan that supports the safety of the entire community.” (SchoolSafety.gov)
- “A proactive, prevention-based approach for recognizing, evaluating, assessing, and managing threatening or concerning behavior before an act of violence has occurred, including terrorism. The approach provides public safety personnel with options for responding to individuals whose behavior demonstrates they are at risk of committing future acts of violence, particularly when traditional law enforcement tools are unavailable, by working with non-law enforcement community partners. A key element of the model is an effective TATM Team—a multidisciplinary group that evaluates concerning behavior and applies a tailored management strategy to prevent violence.” (Joint Counterterrorism Assessment Team).
- “The primary component of a threat assessment program is a multi-disciplinary threat assessment and management team. Involving members from an array of disciplines enhances the team’s ability to: Identify developing concerns/threats. Gather information from multiple sources and organizational silos. Maximize skills and resources to address concerns. Monitor outcomes. Enhance the district’s/school’s overall ability to: Communicate(to, from, and within the team). Collaborate (working together for the best awareness and outcomes). Coordinate (engaging in purposeful planning and coordination of actions and interventions within the team and with outside partners).” (Texas School Safety Center)
BTMTs typically meet as a full team once a week to discuss any timely concerns, review recent reports, and provide continued monitoring as needed of situations and individuals that the team has previously reviewed. There are various structures and compositions based on the nature of the school or college, but minimally such teams should include a representative from public safety, from mental health, and from the appropriate administrative authority with oversight for conduct process, such as a representative from the dean of students office or similar institutional administrator.
Related Article: Part 1: School and University Behavioral Threat Assessment and Management (BTAM) Basics
If an institution of higher education has on-campus housing, a representative from residence life is commonly a team member, along with a representative from healthcare if the campus has a clinic or similar health services. Other useful team members can include representatives from access and accommodations (disability services), legal counsel, Title IX/sexual misconduct, and academic advising or similar student support services.
Some teams include a member of the faculty. There are pros and cons to this approach. Having someone who represents academic affairs administration can be helpful, especially when special arrangements are needed in a classroom setting, although having a rotating faculty member, such as a representative of a governance body like a faculty senate can be challenging, especially given the highly sensitive nature of the cases the team will discuss.
If the team is comprehensive, meaning it reviews all concerns involving any member of the community or individuals who might be a threat to the community in any way, even if external to the institution, then it can also be helpful to have someone from human resources in case any employee-related concerns arise.
It is best to structure the team to include a core group that is consistent and will work together over time. The team should not be too large. If special cases arise, others with appropriate expertise and/or situational knowledge can be consulted.
Even though the team may only meet weekly, it is imperative to have a team leader who is constantly monitoring cases to ensure timely response, and many teams create a subgroup to conduct time-sensitive review. Often those sub-teams can help conduct on-going case triage and should be small enough to gather and respond quickly.
For example, a three-person triage team could include representatives from the dean of students, public safety/campus police, and counseling. Legal counsel can also be useful to have at the ready should a desired action require quick legal review.
Manage Your Database Carefully
Data management is also critically important. There are numerous case management databases that exist, some are localized software and some are robust, cloud-based data systems. Someone must be assigned as the primary database manager, whether that is the team chair or a designated administrator. There should also always be back-up administrators to ensure continuity and timely response in case the lead administrator is not readily available.
Many of these systems include notification features that can alert designated team members on their cell phones when a new case is submitted. Ideally such systems should allow for web-based public access for report submissions. Some schools and universities prefer restricted access with the required log-in to identify the reporter, where others offer an anonymous reporting option. There are pros and cons to each approach, and often it is best to have systems that provide both options simultaneously.
Related Article: Part 2: Training and Exercising Your Behavioral Threat Assessment and Management Team
Many robust systems also have multiple levels of access control to allow certain members of the team to administer cases and others to view cases. Some allow opportunities to request information from others outside the team who might have relevant information to include in the case file. Many systems also have communication features to allow the generation of emails and letters. Some are embedded within or connected to other data systems, for example a conduct or Title IX database. Some allow easy transfer of cases between different categories in situations when a report begins in BTAM and then transitions into a conduct case, or vice versa.
Being able to track the actions of the team is important, whether in a robust system or simple spreadsheet. There is a balance in how much information is captured since some data may be subject to open records and/or must be made available for review by the individual(s) involved in the case. Working with legal counsel to ensure all members of the team understand applicable laws, like the Family Educational Rights and Privacy Act (FERPA) and Freedom Of Information Act (FOIA) is critically important.
Train Your Team and Adopt Good Case Management Policies
It is also important to ensure team members are appropriately trained. There are various state, regional, and national organizations that provide resources in this area, such as the National Association for Behavioral Intervention and Theat Assessment (NaBITA). Even when the team members are highly trained in their respective fields, having team training can assist in helping all members understand a common approach to how cases will be evaluated and how to assess levels of threat and risk.
Some teams use a formal risk matrix where others take a more organic approach. Some formally assign a risk level to each case, which can be helpful, but should also be regularly monitored to adjust risk levels as circumstances change.
Case management and follow up can take many forms, and in some cases, documenting the situation is sufficient if something has not risen to a level of needing to intervene. Some cases need a simple “check in” to assess the well-being of a reported individual to determine if the person needs to be connected to resources. Some cases need a high level of intervention depending on the nature and level of risk the individual is presenting. Striking a balance between personal rights and protecting the community is often a nuanced exercise, which is why having a sufficiently diverse and well-trained team is paramount.
‘Connecting the Dots’ Can Prevent Active Shooter Attacks and Get Students Help
Review any active shooter manuscript or training class, and you’ll soon learn that there are many behavior traits that may be considered concerning or raising a red flag. Before exploring a wide range of anomalies and red flags that would raise concerns on campus, it’s important to remember that in most cases:
- The shooter had a grievance toward the target location
- At least one other person knew in advance about the shooters intentions or had a concern.
Students are not necessarily a threat when they display some of these behaviors, but it does become a concern when the behaviors multiply, and/or go beyond what is considered normal (baseline) for a particular setting. Connecting the dots and considering the totality of the situation (and behavioral characteristics) provides an opportunity for early intervention. Early intervention is not always the result of knocking down an active shooter threat but can simply be the avenue to reach out to a student to help them get back on track so they can reach their academic and personal goals or needs.
Related Article: Behavioral Threat Assessments, Safety-Conscious Students Critical to School Violence Prevention
Change is also an important aspect of understanding behaviors and anomalies. If a student’s academic or personal behavior suddenly or drastically changes, it may be a cause to seek more information. This could be said for the way a student acts, dresses or even who he/she associates with.
DHS’ Behavioral Approach to Violence Prevention may serve as an initial discussion benchmark. Institutions should use national research and then interpolate the behaviors for their individual educational setting to come up with their own behavioral anomalies.
Page three of this document from the Joint Counterterrorism Assessment Team provides additional behavioral warning signs leading to violence. Again, these behaviors don’t always illustrate the potential for violence, but if nothing else, should warrant some kind of discussion or intervention.
Take Notice of These Broader Perspective Behaviors
- social isolation
- abnormal mood swings or depression
- withdrawn behavior
- decrease in hygiene
- paranoia
- sudden and dramatic changes in behavior or personality
- detected or stated or plans of violence
- internet searches for weapons, acts of violence, extremist websites (likely unable to know)
- social posts featuring weapons, extreme views, endorsing violence
- escalating unsafe or aggressive behaviors; aggression or threats toward other students
- expressed hostile feelings of injustice or perceived wrongdoing
- distancing from friends
- changes in academic performance
- loss of significant relationships
- changes in financial status
- changes in living arrangements
- major adverse changes to life circumstances
- feelings of humiliation or rejection on the part of the shooter
- acquiring weapons after expressing grievance or desire for violence
- talking or hinting about suicide
Site-Specific Behaviors That Could Cause Concern
- behavior not normally associated with event or location
- someone in an area where they do not belong…especially a non-academic area
- someone avoiding authorities (teachers, security, etc)
Understanding and Identifying Behavior Anomalies Could Save Lives
Schools and universities must plan for all phases of an active shooter incident: mitigation, preparedness, response, and recovery. One could argue that great improvements have been made in the response phase since the Columbine active assailant attack. However, more attention must be paid to strengthening the other phases, as well as planning and research.
Learning and sharing behavioral anomalies not only help prevent active shooter incidents, it provides the BTMT with tangible means to intervene before shots are fired. It is also important for all campus officials and students to be part of the solution and know how to pass on critical and timely information.
Remember: a single behavioral characteristic, even an anomaly, may not raise the level of concern for intervention, but serious anomalies along with clusters of anomalies from different departments must be taken seriously. Social media, too, is perhaps the most prevalent means of identifying triggers, which adds to the importance of seeking assistance from the entire community in identifying and reporting potential red flags.
Campus officials must learn from past incidents and understand that seldom do two events ever happen the same in the future. Yesterday’s active shooter mode of operation may be totally different today. And, as illustrated in the Texas State University’s Advanced Law Enforcement Rapid Response (ALERRT) training manual, “terrorist organizations around the world have identified the active shooter/small-arms attack model as a viable scenario to bring violent chaos and destruction in furtherance of their ideological ideals.”
Regardless of the educational setting (K-12, private or public, university, etc.), how the campus culture adapts to the safety and security is everyone’s responsibility.
Establishing and understanding baselines leading to observable behavioral anomalies on campus gives schools and colleges a chance to prevent an active shooter incident. Connecting the dots, and assessing the totality of the situation gives security and school officials an opportunity to help a student in need, but may even prevent an active assailant incident.
Andy Altizer is the Emergency Management Coordinator at Westminster Schools in Atlanta. He has worked in emergency management for over 25 years, including at Kennesaw State University, Georgia Tech, Oglethorpe University and Georgia Emergency Management Agency. He also has over 10 years of military experience.
Brooks Batcheller is the Dean of Students at Westminster Schools in Atlanta. He has worked in education for 20 years and has worked in school leadership positions for the past 13 years. He currently serves on Westminster’s Circle of Care and behavioral threat management teams.
Dr. Michael Sanseviro is the Vice President for Student Engagement at Georgia State University in Atlanta, GA. He has worked in higher education for over 35 years serving in various administrative roles including Associate Vice President and Dean of Students at Kennesaw State University, Director of Residence Life at Kennesaw State University, Director of Student Life at Georgia Perimeter College, and Student Services Associate to the Vice Chancellor for the University System of Georgia.
NOTE: The views expressed by guest bloggers and contributors are those of the authors and do not necessarily represent the views of, and should not be attributed to, Campus Safety.
