Workplace Violence: You’re Focused on the Wrong Things

Share Your Thoughts: Facebooktwitterlinkedin

“If you go to guns, you’ve failed,” former CIA protective agent Steve Tarani

Have you ever listened to a 911 call from a workplace experiencing an act of violence?

It is a frightening, chaotic thing to hear. The chaos we hear is a reflection of the shock, horror and fear of the victims. No matter how many hours of training have been spent on what to do in an active attacker/ active threat situation however, no one can truly predict what will evolve in an actual event.

An active attacker (or attackers) is an individual actively engaged in killing or attempting to kill people by any means including but not limited to firearms (most frequently used), bladed weapons, vehicles, or any tool that in the circumstance in which it is used constitutes deadly physical force. In most cases, there is no pattern or method to their selection of victims. Most active shooter situations are unpredictable, evolve quickly, and are over within minutes. Because active shooter situations are also frequently over prior to the arrival of law enforcement, individuals must be prepared both mentally and physically to deal with an active shooter situation prior to law enforcement arrival. (Source:, The Interagency Security Committee (ISC)).

We know that a major component of any active shooter program or plan is preparedness.

We  encourage and concur with best practices that are geared toward measures that can be taken to reduce the risk of violent behavior as well as mitigate the impacts of violent behavior should it occur.

The 2013 Report on the National Summit on Multiple Casualty Shootings identified five non-linear components of mass casualty violence prevention:

  • Identifying a person posing a potential threat of violence;
  • Notifying the appropriate authorities with this information;
  • Evaluating the threat credibility;
  • Intervening to prevent the threat; and
  • Documenting the intervention and disseminating the information within applicable laws and regulations.

Internal and external partners, programs, and processes can assist with these steps. As a partner to many organizations in this regard, we must stress that if you are training only on an active threat response – and while it is critically important that you do – you’re focused on the wrong thing.

While no pure profile exists for an active attacker, research indicates there are signs or indicators – behaviors of concern – that may help identify potentially violent actors. Employees can and should learn the signs of a potentially volatile situation that could develop into an active attacker incident. Each employee should be empowered to proactively seek ways to prevent an incident with internal resources or additional external assistance.

“Situational awareness is essential and involves efforts to identify both risks and resources ahead of time. Risks, of course, are those things that will likely be problems or that may hurt us; resources are the people, places and things that might help us if the going gets tough. Remember that we don’t do our best thinking during moments of terror. Having a plan in mind ahead of time and engaging in mental rehearsal of your crisis response can make a big difference if things go wrong.”

Steve Crimando, MA, CTS, CHS-V

Intervening early in a threatening or potentially violent situation is vital to preventing its escalation. There are many intervention options, and they vary greatly depending upon the situation. Early intervention may defuse the initial situation and give the organization an opportunity to thoroughly review options for resolution.

In 2010, the U.S. Secret Service (USSS), U.S. Department of Education, and the FBI collaborated to produce the report Campus Attacks: Targeted Violence Affecting Institutions of Higher Education, which examined lethal or attempted lethal attacks at U.S. universities and colleges from 1900 to 2008.

The report featured several key observations related to pre-attack behaviors, including the following:

  • Concerning behaviors were observed by friends, family, associates, professors, or law enforcement in 31 percent of the cases. These behaviors included, but were not limited to, paranoid ideas, delusional statements, changes in personality or performance, disciplinary problems on site, depressed mood, suicidal ideation, non-specific threats of violence, increased isolation, “odd” or “bizarre” behavior, and interest in or acquisition of weapons.
  • In only 13 percent of the cases did subjects make verbal and/or written threats to cause harm to the target. These threats were both veiled and explicit and were conveyed directly to the target or to a third party about the target.
  • In 19 percent of the cases, stalking or harassing behavior was reported prior to the attack. These behaviors occurred within the context of a current or former romantic relationship and in academic and other non-romantic settings. They took on various forms, including written communications (conventional and electronic), telephone contact, and harassment of the target and/or the target’s friends and/or family. Subjects also followed or visited the target(s) or their families or damaged property belonging to the target(s) or their families prior to the attack.
  • In only 10 percent of the cases did the subject engage in physically aggressive acts toward the targets. These behaviors took the form of physical assault, menacing actions with weapons, or repeated physical violence to intimate partners.

Clearly, one of the priorities should be to enhance preparedness to prevent, mitigate, communicate, respond and recover from these events. Educational training, informational materials and high-quality workshops can be part of the effort to better prepare people to prevent or survive an active shooter situation. Most important is to raise awareness of behaviors that represent pre-incident indicators and characteristics of active shooters.

A recommended first step is to conduct a Risk Assessment and train your employees on escalation signs to look for – and the steps that need to be taken in response – to make a significant difference in a potential threat situation. The levels or stages of escalation are divided into three groups: guarded, elevated and severe. In each one of these stages, different actions are taken to manage the situation at hand.

All risk levels require that a written Action and Monitoring Plan be developed and implemented to minimize potential harm.

  • Guarded Risk Level will warrant some supervision and intervention regarding the incident that prompted the screening, with a date-certain for follow up.
  • Elevated Risk Level will require more enhanced supervision and intervention regarding the incident that prompted the screening, with a date-certain for follow up.
  • Severe Risk Level will require that the Subject be removed from the workplace until he/she is judged to no longer pose a threat of imminent harm to self or others. A written Action and Monitoring Plan will take into account re-entry requirements as well as monitoring to be implemented upon his/her return.  Additional steps must be taken to protect the existing workforce from early return or retaliatory action by the Subject.

As we look at identifying and monitoring behaviors of concern, there must be a framework and a structure within the organization to support this effort. It is critical that you perform the same actions every time a behavior of concern occurs to ensure a uniform approach of how to deal with these situations. We call this structured program Behavioral Risk Threat Assessment or BeRThA™. BeRThA™ is intended to assist in Identifying, Assessing, Managing and Monitoring those persons exhibiting ‘behaviors of concern’ long before they pose a threat of violence to themselves or others.

Every program must be based on an established framework and overarching policies and procedures that define the goals of the program and how they will be achieved.

I encourage every organization to focus on the right things; to implement a prevention program, train on what to look for and create an environment of “see something, say something, save someone.”


Firestorm is hosting a series of April webinars focused on identifying behaviors of concern and threats via social media. Join one of the seven sessions of: Intelligence Network. During the sessions, I will discuss selecting the right tools and people to manage the components of a sound intelligence network, including:

• Creating intelligent conversation aggregators
• Utilize geo-coding and spheres of influence

Share Your Thoughts: Facebooktwitterlinkedin