Threat Assessment for Mass Violence and Active-Shooter Incidents

The pathway-to-violence model, developed primarily by Calhoun and Weston in their 2003 book Contemporary Threat Management and elaborated by the FBI Behavioral Threat Assessment Unit (BTAU, now the Behavioral Threat Assessment Center, BTAC), describes the typical behavioural progression of a person moving toward a planned targeted attack. The model is not a checklist of static characteristics; it is a sequential map of the behaviours that research shows typically precede attacks, allowing intervention at any stage before the final one.

The pathway has five stages. The first is grievance: the person develops an intense, persistent grievance against a person, institution, or category of people (a school, a racial or religious group, a political figure). The second is ideation: the person begins to fantasise about violence as a solution to the grievance. This stage is characterised by rumination, research into past attacks, and identification with prior attackers. The third is research and planning: the person actively investigates targets, timing, methods, and weapons. Digital footprints (browsing history, online forum posts, manifesto drafts), physical reconnaissance, and weapon-acquisition steps characterise this stage. The fourth is probing and preparation: the person tests boundaries, may conduct dry runs or reconnaissance visits, and acquires operational materials. The fifth is attack.

The Secret Service National Threat Assessment Center (NTAC), established in 1998, has produced three major studies that provide the empirical backbone for the pathway model. The 2000 Safe School Initiative (with the Department of Education) found that in nearly all 37 school shootings studied, the attacker had told at least one person about their plans or intent before the attack, a pattern termed leakage. The 2018 Mass Attacks in Public Spaces study examined 27 mass attacks and found that in 77 percent of cases, at least one person was aware of concerning behaviour before the attack. The 2019 Protecting America's Schools report, covering 67 school attacks between 2008 and 2017, found that 93 percent of attackers had communicated their intent or distress to others.

These findings have direct operational implications. Threat assessment works when it reaches potential interveners before the attack, not after. The bystander reporting culture that school-based and workplace-based threat assessment teams aim to build is grounded in this data.

The FBI Behavioral Threat Assessment Center (BTAC), formerly the Behavioral Threat Assessment Unit, was established within the Critical Incident Response Group (CIRG) and the National Center for the Analysis of Violent Crime (NCAVC). Its operational mandate is to provide training, research, and consultation to law enforcement and institutional threat assessment teams, not to conduct assessments itself in the first instance.

The BTAC framework for targeted school violence threat assessment, described in the Making Prevention a Reality guide (2017) and operationalised in hundreds of school-based threat assessment teams across US states, has three components. The first is the threat assessment team: a standing multi-disciplinary team at each institution (school, university, workplace) that includes a mental health professional, law enforcement liaison, legal counsel, and administration. The second is the assessment protocol: a structured inquiry into the person of concern's behaviour, communications, and circumstances, drawing on the pathway model and the leakage literature. The third is the management plan: an intervention strategy calibrated to the level of concern, ranging from monitoring and support for low-level concern cases to referral for mental health evaluation or law enforcement action for high-concern cases.

Virginia's threat assessment protocol, developed in the wake of the Virginia Tech massacre (32 killed, April 2007, the deadliest US campus shooting) by Dewey Cornell and colleagues at the University of Virginia's Curry School of Education, was the first state-wide mandated school threat assessment system in the United States. The Virginia model has been replicated in North Carolina, Florida, and several other states. Cornell's research found that the Virginia model, compared with zero-tolerance disciplinary responses, reduced student suspension rates while maintaining comparable safety outcomes, a finding that shifted the conversation from punishment to intervention.

The UK's Channel programme, delivered under the Prevent strand of the UK government's counter-terrorism strategy (CONTEST), is a parallel multi-agency safeguarding and support pathway for individuals assessed as vulnerable to radicalisation. Channel is operated through Channel panels, which are multi-agency groups convened by local authorities and co-chaired by police, that assess referrals and develop support plans. The Counter-Terrorism and Security Act 2015 placed Channel on a statutory footing and created a legal duty for specified authorities (schools, prisons, NHS trusts) to refer persons of concern. Channel is not a criminal justice intervention: it operates upstream of arrest or prosecution and focuses on support and redirection. Between 2015 and 2022, approximately 6,000-7,000 individuals were referred to Channel panels annually in England and Wales.

In India, the National Investigation Agency (NIA) operates deradicalisation programmes primarily directed at individuals assessed as radicalised toward jihadist or separatist violence. These programmes do not use the Western threat-assessment framework tools described here, and no published validation of their outcomes against the pathway-to-violence model exists as of the date of writing. BNS 2023 § 113 (terrorist act, replacing The Unlawful Activities Prevention Act § 15 as the primary substantive offence for most court proceedings) and The Unlawful Activities Prevention Act (UAPA) 1967 remain the primary legal instruments for detention and prosecution of persons assessed as terrorism threats. India does not have a civil-law equivalent of the US Extreme Risk Protection Order mechanism described below.

The TRAP-18 (Terrorist Radicalization Assessment Protocol, 18 indicators) was developed by Reid Meloy, Jill Hoffmann, Karoline Roshdi, Reinhard Meloy, and Justine Guldimann, with the initial validation paper published in 2012 in Behavioral Sciences and the Law. The instrument was designed specifically for the lone-actor or small-cell targeted-violence attacker, filling a gap in the threat-assessment literature that had focused primarily on school shooters and workplace attackers rather than ideologically motivated violence.

The eighteen indicators are divided into eight proximal warning behaviours and ten distal background characteristics. The proximal warning behaviours are the more behaviourally specific and temporally closer to attack: pathway behaviour (planning, target selection, weapon acquisition), fixation (increasingly focused preoccupation with a cause, person, or group), identification (identification as a soldier or warrior, use of warfare language), novel aggression (testing of violence in unrelated incidents), energy burst (increased activity level in the final weeks), leakage (communication of intent to a third party), last-resort thinking (perception that violence is the only option), and directly communicated threat (explicit threat communication, less common in lone actors than in other violence types).

The ten distal background characteristics are biographical and psychological markers that appear more frequently in TRAP-18 case files than in non-attacker populations with similar grievances: changes in thinking and emotion, desperation or despair, failure to affiliate with extremist group, dependence on virtual community, thwarted occupational goals, recent immigration or status change, mental illness (present but not causally central), creativity and innovation (used for attack planning), use of cosplay or role-play, and interest in others who committed similar acts.

The TRAP-18 has been validated across multiple lone-actor datasets by Meloy and colleagues. A 2014 study in Behavioral Sciences and the Law applied the protocol retrospectively to jihadist lone actors in the US and Europe. A 2021 Journal of Threat Assessment and Management study by Meloy, Yakeley, and colleagues applied it to incel-motivated attackers, finding that the eight proximal warning behaviours had particularly high frequency. James and colleagues (2007) applied a predecessor model to European lone-actor cases. Across studies, the proximal warning behaviours, particularly pathway behaviour and fixation, show the highest frequency in confirmed attacker populations.

The boundary between TRAP-18 as a Module 4 instrument and TRAP-18's role in Module 7 is this: Module 4 owns the instrument's item structure, validation record, and threat-assessment workflow application; Module 7 owns the ideological pathway analysis and radicalisation typology that provides the theoretical context for the distal background characteristics. Practitioners using TRAP-18 in a casework context will draw on both perspectives.

The WAVR-21 (Workplace Assessment of Violence Risk, 21 items) was developed by Stephen White and Reid Meloy to address the distinct behavioural patterns of workplace-targeted violence, which differs from school violence and lone-actor terrorism in important ways: workplace attackers typically have or had an employment relationship with the target, the grievance is usually occupational rather than ideological, and the attack is often preceded by a formal dispute process (disciplinary action, termination, civil litigation).

The WAVR-21 contains twenty-one items covering four categories: violent ideation and intent (direct threats, indirect threats, fixation), weapons and capacity (weapon access, tactical knowledge, target research), problematic person (history of interpersonal problems, recent loss events, suspiciousness, isolation), and supervisory and management concerns (recent disciplinary action, perceived injustice, behaviour change after adverse workplace event).

The WAVR-21 is not a normed actuarial instrument in the same sense as the Static-99R: it does not produce a probability estimate from a derivation sample. It is an SPJ-style framework that guides threat assessment professionals through a structured evidence review and produces a categorical concern rating from low to critical. It is the most widely used formal threat assessment tool in US corporate security and human resources contexts, according to surveys of Association of Threat Assessment Professionals (ATAP) members.

The UK has not adopted a standardised workplace threat assessment instrument to the same degree, but the UK National Counter Terrorism Security Office (NaCTSO) publishes Protecting Crowded Places: Design and Technical Issues and related guidance that addresses the behaviour of concern / threat reporting framework used by UK businesses and institutions. The UK Centre for the Protection of National Infrastructure (CPNI) provides workplace insider-threat training that aligns with WAVR-21 categories without using the instrument by name.

Australia's national terrorism threat assessment framework, coordinated through the Australian Security Intelligence Organisation (ASIO) and the National Security Hotline, does not currently mandate a specific behavioural threat assessment instrument for workplace settings, though several Australian state police services use TRAP-18 and WAVR-21 in their assessment protocols.

The empirical validity of the threat-assessment framework rests substantially on retrospective case analysis. Four attacks from 2018 and 2019 are particularly instructive because they span different ideological motivations, three continents, and different degrees of pre-attack leakage.

The Pittsburgh Tree of Life Synagogue attack (27 October 2018, 11 killed) was carried out by Robert Bowers, who held antisemitic beliefs and had been active on the Gab platform, posting violent antisemitic content in the weeks before the attack. Bowers's social media record showed clear pathway behaviour (target identification, weapon references), fixation (intensifying antisemitism), and leakage (public posts on the morning of the attack). The attack followed a period of what TRAP-18 analysis would characterise as energy burst and last-resort thinking, with posts expressing that Jewish organisations were bringing immigrant caravans to "slaughter his people." The FBI BTAC's retrospective analysis identified multiple proximal warning behaviours that were visible in public-source digital data before the attack.

The Christchurch mosque attacks (15 March 2019, 51 killed) were carried out by Brenton Tarrant, who published an 87-page manifesto shortly before the attack. Tarrant showed a textbook TRAP-18 profile: pathway behaviour (extensive preparation, reconnaissance visits to the mosques months in advance), identification (far-right white nationalist identity), fixation (years-long preoccupation with demographic "replacement" ideology), creativity and innovation (live-streaming the attack as a propaganda tool), and interest in prior attackers (explicitly invoking the Christchurch attack of 2019 and prior far-right attacks in his manifesto). No Channel-equivalent intervention mechanism existed in New Zealand at the time. New Zealand subsequently introduced the counter-terrorism legislative package and CTERA framework following the Royal Commission report.

The Pulwama attack (14 February 2019, 40 Central Reserve Police Force personnel killed) was a vehicle-borne IED attack carried out by a Jaish-e-Mohammed operative. The attack differed from the Western lone-actor profile in that it involved a networked organisation rather than a lone actor. The BNS 2023 § 113 (terrorist act) and UAPA 1967 are the primary legislative instruments applied to Indian terrorism prosecutions. The NIA's threat assessment work in the Pulwama investigation focused on the organisational network and facilitation chain, not the individual lone-actor psychological profile. This distinction matters for instrument selection: TRAP-18 is validated for lone actors and small cells; it is not the appropriate framework for large organisational terrorist networks.

The El Paso Walmart attack (3 August 2019, 23 killed) was carried out by Patrick Crusius, who posted a manifesto on 8chan approximately twenty minutes before the attack. Crusius's manifesto showed strong pathway behaviour, identification with the Christchurch attacker, and last-resort thinking framed around anti-Hispanic demographic replacement ideology. The attack preceded the Texas ERPO (Extreme Risk Protection Order) statute by a year; the Uvalde school attack in 2022 occurred in the same state, catalysing Texas's 2023 passage of its first ERPO legislation, a measure that allows courts to temporarily remove firearms from persons assessed as an imminent risk.

The legal tools available to intervene on a pathway-to-violence case before an attack are the gap between behavioural science and the criminal justice system. Three distinct frameworks exist across the jurisdictions covered here.

In the United States, Extreme Risk Protection Orders (ERPOs), sometimes called red-flag laws, allow a family member, law enforcement officer, or (in some states) a mental health professional to petition a civil court for an order temporarily removing firearms from a person assessed as an imminent risk of violence to themselves or others. As of 2025, 21 states and the District of Columbia have enacted ERPO statutes, following California's pioneering Gun Violence Restraining Order (2016) and Connecticut's prior experience with a similar mechanism. The federal Bipartisan Safer Communities Act (2022) provided grants to states to implement ERPO programmes. Research by Everytown for Gun Safety (2021) and by Swanson and colleagues in Annals of Internal Medicine (2019) found that California's ERPO mechanism was used to prevent an estimated 58 mass shootings between 2016 and 2018. The constitutional challenge to ERPOs under the Second Amendment has been litigated in multiple circuit courts; the general trend has been to uphold ERPOs as consistent with historical firearms regulation traditions following New York State Rifle and Pistol Association v. Bruen (2022).

In the United Kingdom, the Counter-Terrorism and Border Security Act 2019 extended police stop and search powers, created offences for entering or remaining in a designated area for terrorism purposes, and amended the Terrorism Act 2000 to address publication of images and support for proscribed organisations. The existing Channel programme provides the civil pre-criminal intervention mechanism. The Terrorism Prevention and Investigation Measures Act 2011 (TPIMs) provides a civil order mechanism for individuals assessed as posing a terrorism threat who cannot be prosecuted due to evidence constraints, with restrictive conditions including electronic monitoring, residence requirements, and reporting obligations. England and Wales do not have a weapons-specific ERPO-equivalent; firearm licensing under the Firearms Act 1968 allows police to revoke licences on public safety grounds, which is a partial functional equivalent for licensed weapons.

Australia's counter-terrorism legislative framework, coordinated under the Security Legislation Amendment (Counter-Terrorism) Act 2002 and subsequent amendments, includes preventive detention orders and control orders under the Criminal Code Act 1995 Division 104. These allow courts to impose conditions on individuals assessed as terrorism risks before any offence has been committed. The Australian Security Intelligence Organisation (ASIO) provides threat assessments that inform ministerial and police decisions about these orders. Several Australian states have introduced firearms prohibition order mechanisms that function similarly to US ERPOs in non-terrorism contexts.

India does not have a civil-law pre-attack intervention mechanism equivalent to the ERPO. The UAPA 1967, as amended by the UAPA Amendment Act 2019 (which allows designation of individuals, not just organisations, as terrorists), and BNS 2023 § 113 provide criminal law tools that apply after an attack or after evidence of a criminal conspiracy has been gathered. India's Preventive Detention Act framework, including the National Security Act 1980, provides administrative detention without trial for persons assessed as threats to national security, but this is a blunt instrument. No civil pre-attack weapon-removal mechanism comparable to the ERPO exists in Indian law, and the constitutional framework for individual rights in Articles 19, 20, and 21 of the Indian Constitution would require careful legislative design to accommodate such a mechanism.

The relationship between mental illness and mass violence is one of the most distorted areas of public discourse about forensic psychology. The empirical record, summarised in comprehensive reviews by Metzl and MacLeish (2015) in American Journal of Public Health and by Peterson and Densley (2019) in Journal of Threat Assessment and Management, shows that mental illness contributes to a small fraction of overall violence, that the overwhelming majority of people with serious mental illness are never violent, and that the specific category of mass-casualty planned attacks is not primarily associated with psychotic illness.

The FBI BTAC's 2019 A Study of the Pre-Attack Behaviors of Active Shooters in the United States (2000-2013) found that of 63 active shooters, 25 percent had been diagnosed with a mental illness of some kind, but only 3 had been diagnosed with a psychotic disorder. The primary psychological characteristics of the attacker population were grievance, persecution, and despondency, not psychosis. The perpetrators of the Pittsburgh, Christchurch, and El Paso attacks all showed grievance-driven belief systems rather than psychotic symptomatology, though psychological distress was present.

This matters for threat assessment because the "look for the mentally ill person" heuristic leads evaluators toward the wrong population and away from the grievance-and-planning-behaviour pattern that the evidence actually supports. It also has significant civil liberties implications: directing mental health resources toward violence prevention rather than care creates a surveillance dynamic within therapeutic relationships that may deter help-seeking by people in genuine distress.

The trauma-informed approach to threat assessment acknowledges that many individuals on a pathway to violence have themselves experienced trauma, rejection, loss, and perceived injustice, and that early-stage intervention should prioritise support and redirection over punishment and exclusion. Threat assessment teams following the Virginia model are explicitly trained to separate the question "is this person of concern?" from "is this person bad?" and to orient toward support pathways as the first-line response for lower-concern cases.

In the UK, the Independent Review of Prevent by William Shawcross (2023) found that Channel had been effective in redirecting individuals from extremism pathways but recommended sharpening the referral criteria to focus on genuine radicalisation rather than expressing controversial political views. This tension between the legitimate threat-assessment function and the civil-liberties implications of surveilling political and religious expression runs through all threat assessment frameworks in liberal democracies.