Three Guns, Three Schools
“I really cant stand people anymore”
“I should bring a gun to school today and kill everybody bc im done with everybody”
While unrelated to our client, a deeper investigation into the account issuing the public message was certainly necessary and revealed a disturbing series of prior messages; these messages referenced despondency, escalating anger at others, “cutting” behavior and comments referencing suicide and self-loathing.
The key to understanding vague threats issued over social media is the next-step analysis of the context of the messaging when reviewed as a part of the entire, recent message history. Our analysts research messages to understand if they are song lyrics, movie references, idle threats related to missing concert tickets or other superficial content.
In this instance, when viewed in the context of the message history, we perceived a serious, escalating threat. The account, however, was anonymous. To move investigation and account identification forward, we next looked at the account’s connections, images (including reverse image searching), geographic references, like-messages posted elsewhere and other location clues.
We were able to identify identical messages posted – within minutes of the primary account of interest – from a differently named account. The second account was also connected, as one of the very first connected accounts, to the primary account. There were other exact connections as well.
The difference is that the secondary account did carry a unique name and location. While this is no indication of a true name or location, it bears further investigation. Combined with reverse image searching, geo-fence monitoring and other general web investigation, Firestorm was able to pinpoint the exact geo-location of the messaging source and surfaced two, primary address locations from which the account consistently, publically messaged: the account-holder’s home and school.
The school was quickly notified and the school’s behavioral risk team was able to intervene.
“Holy [Expletive] he brought a gun to school!” [image of student in class with a hand gun]
Response: “is this even our school?”
“yes in my 2nd block”
While analyzing references related to violence in schools, Firestorm surfaced a disturbing, public message with an image attached – that of a student in a classroom, showing a gun in his jacket to another student. The account had no clear, identifying information.
The Firestorm monitoring team immediately conducted a reverse image search of the attachment image to determine if this was a “gag” post; a common image or “meme” re-shared as a joke. Our team was unable to find the same image elsewhere and so next worked to identify the school. By reviewing all images posted by the account, we surfaced an image of a class schedule showing names of instructors. We quickly conducted a search of a specific class, and the associated instructor who had an unusual and uncommon name. Through this, we quickly identified the school, and contacted the school’s Principal. We explained that we were unclear as to whether the image was actually representative of that specific school, but felt it was important to alert the school nonetheless.
We shared publicly posted images, account names and connections, and the Principal was able to quickly identify the student who had posted the original message.
Our subsequent conversations with the school Principal revealed that the image was indeed posted as a “joke,” however the school in question has a policy that there are no jokes as far as threats to students are concerned. The student’s parents were contacted and appropriate discipline was dispensed.
In additional conversations with Firestorm, the school’s Principal expressed both gratitude and disappointment; gratitude to Firestorm for alerting the school to a potential issue, and disappointment in that the school had implemented a strong “See Something, Say Something” program and no one – none out of 32 students who saw, “favorited” and re-shared the original post – said anything. The second alert the Principal received – after Firestorm’s – was from a parent who saw the post on social media.
“im takin my gun to school”
Throughout the course of daily risk monitoring, Firestorm analysts identified a Twitter message that warranted further investigation. The account was titled using a nickname, and no location information was available. While there were images posted, the images were in memory of a male cousin, killed in gang violence.
One month of messaging on the Twitter account was then reviewed, and Firestorm analysts determined that the account holder was most likely female, and was named either of two possible names. Also, a disturbing content trend emerged – that of anger toward school authorities and community law enforcement due to pending charges and an upcoming court date.
A school was referenced, but by abbreviation only. Firestorm then researched account connections and quickly determined that the majority of individual connections were located in a four-mile radius of a specific high school, the name of which matched the two letter abbreviation used by the account holder.
Firestorm observed this message at approximately 10 a.m. EDT; the school referenced is located on the West Coast. Because of this, time was of the essence as the school day had not yet started on the West Coast. Within 30 minutes of seeing the original message, Firestorm contacted the school Principal with all detail we had surfaced. We were notified shortly thereafter that an intervention had occurred with a female student by the name of one name our team had surmised.
When returning to view the Twitter account in question, a new series of messages had been posted including: “I think ima be expelled from [removed] because thier was a bullet found in my locker and a clip found in my room fml”
Creating an Intelligence Network
The above examples demonstrate the necessity to monitor and identify behaviors of concern. Three different scenarios, three separate threats and three possible school shootings prevented. In 80 percent of behavioral-threat scenarios (like the ones above), someone else knew an event was going to occur. In 60 percent of those cases, two or more people knew.
In order to understand risk and put those risks into context, you must monitor social media behavior by building an intelligence network. Understanding behaviors of concern is crucial to preventing crises. The application of experience in combination with the identified risks, threats and vulnerabilities provides predictive and actionable intelligence.
Monitoring, however, must go beyond simple Google Alerts – the alerts may notify a user of brand mentions, but will not give a focused, detailed report of social media activity regarding a brand.
What you need: a holistic approach to monitoring involving senior-level management who understand the social media network and its workings.
Although an excellent starting point, external monitoring (particularly of social media) alone is not the full answer. In order for an Intelligence Network Program to be effective, possible threats must be:
- Clearly understood
- Categorized in advance with specific activities associated with each type of threat
Firestorm strives to prevent a gun from entering a school. One way to strengthen your Intelligence Network Program is by implementing a BeRThA program. BeRThA allows schools and organizations to act proactively as opposed to reactively. BeRThA (Behavioral Risk Threat Assessment) identifies behaviors of concern before they escalate to violence. The program is intended to assist in identifying, assessing, managing and monitoring those exhibiting behaviors of concern, long before they pose a threat of violence. Every program must be based on an established framework and overarching policies and procedures that define the goals of the program and how they will be achieved.
Behavioral Risk Threat Assessment Program
- Establish Investigation Methodology and Documentation
- Identify and train individuals who will be qualified to conduct an investigation
- Determine when legal counsel will need to be involved in the process
- Designate a Behavioral Assessment Team (BAT)
- Determine Screening Tools BAT will utilize (e.g. Cawood, WAVR 21, Mosaic, protocols: Secret Service, FBI)
- Determine how BAT will be notified to convene
- Upon conclusion of investigation /screening, implement corrective action plan
- Investigation: The investigation process will document the incident/threat or behavior of concern and result in an initial threat-level determination
- Behavioral Risk Screening: The Behavioral Risk Screening, conducted if the threat-level is medium or higher, includes gathering further documentation, reviewing the Central Repository for prior reports on the Subject, and speaking with witnesses. Findings from the Behavioral Risk Screening may determine a need for a comprehensive behavioral risk assessment by a third-party mental health professional (e.g., forensic psychologist)
- Action Plan: Following the investigation or Behavioral Risk Screening, an action plan for short-term or long-term interventions will be documented and implemented by the HR Representative or BAT
- Monitoring Plan: Upon determination of the action plan, the BAT will make arrangements for supervision and monitoring of the Subject’s behavior
- Sign Off and Record Keeping: Upon completion of all forms, each must be signed by all participating BAT members and then filed in a pre-established, confidential Central Repository