Three School Shootings Prevented – Importance of Intelligence
“I really cant stand people anymore”
“I should bring a gun to school today and kill everybody bc im done with everybody”
While monitoring social media for key words and phrases on behalf of a client, Firestorm surfaced a public reference by an anonymous Twitter account related to bringing a gun to school.
While unrelated to our client, a deeper investigation into the account issuing the public message was certainly necessary and revealed a disturbing series of prior messages; these messages referenced despondency, escalating anger at others, “cutting” behavior and comments referencing suicide and self-loathing.
The key to understanding vague threats issued over social media is the next-step analysis of the context of the messaging when reviewed as a part of the entire, recent message history. Our analysts research messages to understand if they are song lyrics, movie references, idle threats related to missing concert tickets or other superficial content.
In this instance, when viewed in the context of the message history, we perceived a serious, escalating threat. The account, however, was anonymous. To move investigation and account identification forward, we next looked at the account’s connections, images (including reverse image searching), geographic references, like-messages posted elsewhere and other location clues.
We were able to identify identical messages posted – within minutes of the primary account of interest – from a differently named account. The second account was also connected, as one of the very first connected accounts, to the primary account. There were other exact connections as well.
The difference is that the secondary account did carry a unique name and location. While this is no indication of a true name or location, it bears further investigation. Combined with reverse image searching, geo-fence monitoring and other general web investigation, Firestorm was able to pinpoint the exact geo-location of the messaging source and surfaced two, primary address locations from which the account consistently, publically messaged: the account-holder’s home and school.
The school was quickly notified and the school’s behavioral risk team was able to intervene.
“Holy [Expletive] he brought a gun to school!” [image of student in class with a hand gun]
Response: “is this even our school?”
“yes in my 2nd block”
While analyzing references related to violence in schools, Firestorm surfaced a disturbing, public message with an image attached – that of a student in a classroom, showing a gun in his jacket to another student. The account had no clear, identifying information.
The Firestorm monitoring team immediately conducted a reverse image search of the attachment image to determine if this was a “gag” post; a common image or “meme” re-shared as a joke. Our team was unable to find the same image elsewhere and so next worked to identify the school. By reviewing all images posted by the account, we surfaced an image of a class schedule showing names of instructors. We quickly conducted a search of a specific class, and the associated instructor who had an unusual and uncommon name. Through this, we quickly identified the school, and contacted the school’s Principal. We explained that we were unclear as to whether the image was actually representative of that specific school, but felt it was important to alert the school nonetheless.
We shared publicly posted images, account names and connections, and the Principal was able to quickly identify the student who had posted the original message.
Our subsequent conversations with the school Principal revealed that the image was indeed posted as a “joke,” however the school in question has a policy that there are no jokes as far as threats to students are concerned. The student’s parents were contacted and appropriate discipline was dispensed.
In additional conversations with Firestorm, the school’s Principal expressed both gratitude and disappointment; gratitude to Firestorm for alerting the school to a potential issue, and disappointment in that the school had implemented a strong “See Something, Say Something” program and no one – none out of 32 students who saw, “favorited” and re-shared the original post – said anything. The second alert the Principal received – after Firestorm’s – was from a parent who saw the post on social media.
“im takin my gun to school”
Throughout the course of daily risk monitoring, Firestorm analysts identified a Twitter message that warranted further investigation. The account was titled using a nickname, and no location information was available. While there were images posted, the images were in memory of a male cousin, killed in gang violence.
One month of messaging on the Twitter account was then reviewed, and Firestorm analysts determined that the account holder was most likely female, and was named either of two possible names. Also, a disturbing content trend emerged – that of anger toward school authorities and community law enforcement due to pending charges and an upcoming court date.
A school was referenced, but by abbreviation only. Firestorm then researched account connections and quickly determined that the majority of individual connections were located in a four-mile radius of a specific high school, the name of which matched the two letter abbreviation used by the account holder.
Firestorm observed this message at approximately 10 a.m. EDT; the school referenced is located on the West Coast. Because of this, time was of the essence as the school day had not yet started on the West Coast. Within 30 minutes of seeing the original message, Firestorm contacted the school Principal with all detail we had surfaced. We were notified shortly thereafter that an intervention had occurred with a female student by the name of one name our team had surmised.
When returning to view the Twitter account in question, a new series of messages had been posted including: “I think ima be expelled from [removed] because thier was a bullet found in my locker and a clip found in my room fml”
Creating an Intelligence Network
The above examples demonstrate the necessity to monitor and identify behaviors of concern. Three different scenarios, three separate threats and three possible school shootings prevented.
In order to understand risk and put those risks into context, you must monitor social media behavior by building an intelligence network. Understanding behaviors of concern is crucial to preventing crises. The application of experience in combination with the identified risks, threats and vulnerabilities provides predictive and actionable intelligence.
Monitoring, however, must go beyond simple Google Alerts – the alerts may notify a user of brand mentions, but will not give a focused, detailed report of social media activity regarding a brand.
What you need: a holistic approach to monitoring involving senior-level management who understand the social media network and its workings.
Although an excellent starting point, external monitoring (particularly of social media) alone is not the full answer. In order for an Intelligence Network Program to be effective, possible threats must be:
- Clearly understood
- Categorized in advance with specific activities associated with each type of threat
Firestorm strives to prevent a gun from entering a school or workplace. One way to strengthen your Intelligence Network Program is by implementing a BeRThA program. BeRThA allows schools and organizations to act proactively as opposed to reactively. BeRThA (Behavioral Risk Threat Assessment) identifies behaviors of concern before they escalate to violence. The program is intended to assist in identifying, assessing, managing and monitoring those exhibiting behaviors of concern, long before they pose a threat of violence. Every program must be based on an established framework and overarching policies and procedures that define the goals of the program and how they will be achieved.
The Guiding Principals of the Behavioral Risk Threat Assessment Program:
- Assessing threats must be part of an overall strategy to reduce violence; and
- No single person has all the skills required to conduct a behavioral risk screening; and
- No single person should have the sole responsibility to assess the potential risk of a student or employee.
Learn how to identify risks before they escalate to violence on October 10th. Firestorm has partnered with OnSolve to present a no-fee webinar series.
October 10th from 2-2:45 p.m. ET: Predictive Insights – Looking for Clues in Advance of the Next Active Shooting Event
November 14th from 2-2:45 p.m. ET: Anticipating the Known and Unknown – Planning for Your Next Crisis
December 12th from 2-2:45 p.m. ET: Performing in the Darkest Hour – Responding to an Act of Violence in Your Organization
VIRTUAL EXERCISE – December 18th from 2-4 p.m. ET: Testing Your Deadly Weapons Response Plan