Investigative overview on the principles of how to respond to a threat to your client.

1. SECURITY MEASURES FOR THREAT/RISK
MANAGEMENT
(By Don Moe)
FOUR PRIMARY ELEMENTS IN THREAT MANAGEMENT
1. The potential attacker:
• Prior history of harassment, threats.
• How did the person handle unbearable stress in the past.
2. Event:
• Any past traumatic events: relationship, financial, living arrangement,
rejection, humiliation, especially publicly perceived failure.
3. Situation:
• Individual’s specific situation at the time of peak stress.
• Are their significant people in the individuals life that would deter them from
using violence to deal with stress, or would they condone violence as a means.
4. Target:
• How well know is the target to the individual?
• Is the individual acquainted with the targets lifestyle or work habits?
• Is information readily available about the target?
• How vulnerable is the target to an attack?
• What changes in lifestyle or living arrangements could mitigate and attack?
• How concerned about safety is the target?
• How concerned are those around the target? (Family or staff)
• How open is the target to advice from security or law enforcement?
1

2. WHO IS CONSIDERED DANGEROUS
• A person who thinks that attacking a public official or figure is a desirable,
acceptable or potentially effective way to achieve a goal can be considered a
potential assassin.
Need to ask yourself:
• Does this person have a motive to attempt an attack?
• If answer is yes. What is the person’s current and foreseeable ability to attack?
• Changes in thinking, and acceptability of attacking, or change in ability to
attack itself, may decrease the threat.
DESIGNING A PROTECTIVE INTELLIGENCE PROGRAM FOR
THREAT MITIGATION
Protective Intelligence three key elements
1. IDENTIFICATION: Identifying person or groups that might pose a threat.
Self Identify Two Types:
Person will call, write, e-mail, or approach figure and indicate and unusual
interest in that person.
“Threatened”: Communicates a direct, indirect, or conditional threat.
Purpose of making the threat
• To warn of possible attack.
• To ask to be stopped.
• To demand help or attention.
• Express frustration or anger.
• Communicate distress.
“Inappropriate interest”
• A special relationship or unique assignment or role to play in their lives
or organization.
• Have extraordinary information or expertise that must be shared to the
official.
All threats should be investigated. Making a threat at minimum
is a violation of the law?
2

3. 2. ASSESSMENT: Building history and case file of behavior traits of subject
to determine whether the individual poses a threat to
protected person.
Sources of information
• Interviews with the individual and those who have had contact with them.
• Employers, coworker, neighbors, relatives, associates, caregivers,
arresting officers.
• Records from agencies and institutions that have contact with person.
• Writings by or about the individual.
• Receipts of recent purchases and travel.
• Phone records, credit card receipts, weapons purchase background checks.
Some forms of information is considered private and may only be accessible by law
enforcement assistance
3. CASE MANAGEMENT: Monitoring persons and/or groups deemed a
potential threat to target.
No threat determined: Case closed, and keep on file for future reference.
Determined to be a threat: Develop plan to manage risk.
• Periodically confirm location of individual if incarcerated, hospital
setting, and mental health setting for extended period of time.
• Pattern of contacts with family members, police, coworkers, caregivers,
Designed to prevent individual from approaching protected person and to
Decrease the risk of violence.
• Plan remains intact until deemed individual no longer poses threat.
3

4. FUNCTIONS AND APPROACHES OF CASE INVESTIGATIONS
Three Principles of Case Investigation
1. Investigation Skill
• Does the individual have the motive and the means to act on opportunity
to attack a protected person.
• Gather information to support or repute threat concern.
2. Corroboration
• Supportive objective facts that will support statements made by individual
who may pose a threat.
Example: Report individual traveled to location of protected person.
• Attempt to secure travel and lodging receipts, or speak to credible witness
who saw individual.
3. Common Sense
• Key is to look at the interest, and the motive behind the potential threat
and the means to carry it out.
Example: Angry former bank customer threatening to bring the house
down. Motive behind the threat is customer wanted late
charges of past due account removed due to poor reflection
on credit history.
• Customer made threat to vent frustration and distress around fear of
credit reprisal. Not intending to harm but to draw attention.
4

5. CONDUCTING A THREAT ASSESSMENT INVESTIGATION
Inappropriate or Unusual Interest
• It is reasonable to presume that the individual eventually will be deemed
to not pose a threat.
• Look for information the rebuts presumption that the individual does
pose a real threat.
• A brief investigation will confirm that the individual has neither the
motive, means, nor interest in mounting an attack.
• Any prior contact by individual or individual attempting to purchase a
weapon as well as contact the protected person poses a real threat.
Threats
• Anonymous or Direct threats should always be taken seriously and
investigated.
• Many people who make threats against protected persons do not pose
a real threat.
• Some make threats to signal that they are in danger of losing control.
• Some make threats to gain attention from authorities who they believe can
prevent them from acting out.
Note: Some make threats warning they are prepared to act. Any lack of
investigation may be interpreted as permission, encouragement
or deliberate indifference. This may increase the risk to follow
through with an attack.
5

6. Anonymous threat by letter, phone, or e-mail.
• Studies of a few attackers and near lethal anonymous threats were
trying to warn authorities they were considering attacking.
• They are ambivalent about attacking and were communicating with the
hope they mighty be stopped.
• They do not want to identify themselves and make it more likely to be
stopped.
Note: Anonymous threats though rarely acted upon, should be taken
seriously and investigated to the fullest extent. Specific
threats
or if threatener mentions being in proximity to protected
person
should be regarded as special consideration for protection
for
protective measures.
Investigating a case
• Primary focus of investigation is to determine the individuals:
INTEREST, MOTIVE, and CAPACITY to carry out THREAT.
• Primary goal of investigation is to PREVENT attack or violence.
• Protective intelligence investigation does not attempt to predict a
particular behavior based on cause and effect. It is the totality of the
Information received in the context of interest, motive and capacity.
6

7. Interviewing the Subject
• Interviewing the individual is a key source of information. But not the
primary source. If the individual is a member of a radical or militant
group then any information gained must be within context of the overall
strategy for investigating the group.
• Gather background and interests prior to interview. (Guide investigation
to relevancy whether the person poses a threat)
• Interview can provide insight to subjects: THINKING, MOTIVES and
BEHVIOUR.
• Interview may corroborate individual’s statements, and be the basis for
judging their viability to the case.
• Interviews give the individual an opportunity to tell their story.
• Interviews allow us to reassess and redirect their behavior away from
threatening activity.
Where to conduct the interview
• In subjects home to observe non-verbal information.
Example: (writings, pictures, and weapons that are in view).
• In the home assists in learning the individual’s lifestyle and personality
traits.
• Interview with open ended questions and allow subject to speak freely.
• Goal is to uncover behavior, and action that would support or detract the
concern for an attack.
7

8. Interviewing the mentally ill
• Mentally ill subjects will behave with how he or she perceives reality.
• Do not dismiss statements made such as: (“Aliens are telling me to do
this”) as just crazy talk. Allow them speak, and listen for details leading
towards attack preparation. (Purchased a weapon, traveled to location)
• Treat subjects with respect. Studies show they will reveal their thoughts
and actions if they perceive you are generally interested in hearing what
they have to say.
• Interviewing the subject with clear, direct, and nonjudgmental attitude
will solicit useful information rather than pretending to agree with their
delusion thinking
• Be and active listener, communicate genuine interest in hearing and
understanding the subjects story. No matter how delusional or out of touch
the story may seem.
• Listening and understanding does not infer you agree with the subjects
thinking. Respectful skepticism will elicit more useful information.
Example: “I have not had that experience, but I’m interested in what
you believe”
• Information provided by the subject may be: incomplete, misleading, or
inaccurate.
• Subject may provide different information at different points of time,
depending on current circumstances, degree of desperation, mental health
treatment and other factors.
Note: Do not rely to heavily on interviews alone. It is the totality of the
information gathered and objective facts discovered that will
support or detract from the overall threat.
8

9. Corroborated information and evidence
• Primary task is to SEEK and COLLECT information and evidence to
corroborate the statements of the subject.
• Corroborated information about the subjects thinking and behavior
will assist assessment of the subjects: INTERESTS, MOTIVES and
CAPACITY to attempt an attack on protected person.
• Corroborated evidence is more useful than subjective information or
opinion.
• Ask questions that will initiate a factual response not an opinion.
Example direct: “What is the name of the city he traveled to and when?”
Example opinion: “Do you think he is the type of person to do this?”
9

10. FIVE AREAS OF INQUIRY FOR PROTECTIVE INVESTIGATION
Areas of inquiry
1. The facts of the situation that brought the subject to your attention.
• Providers of information may have multiple motives such as:
extortion, disgruntled employee setting up another, angry wife,
husband, neighbor hoping to embarrass individual by law
enforcement action.
• Eyewitness accounts of subject’s action or behavior have a high degree of
inaccuracies. Need to establish and corroborate.
• Establish facts of a case to determine if the subject being reported is a
victim and if the informant is the true threat.
2. Three kinds of general information about the subject.
Identifiers
• Name and alias.
• Date of birth
• SSN/Military ID.
• Current address.
• Name of close relatives.
• Physical description and photograph.
• Handwriting samples.
Background information
• Education and training.
• Criminal history.
• Violent behavior history.
• Military history.
• History and experience with weapons.
• Marital and relationship history.
10

11. • Employment history.
• Mental health history. (depression, despair, suicidal, violence)
• Extremist ideas or interest in radical groups.
• History of grievances and/or harassment of others.
• Travel history in previous year.
Four purposes for gathering background:
1. Subjects past behavior.
2. Subjects interests.
3. Subjects lifestyle. (Can influence interest, motive or capacity to attack)
4. Subjects capacity to attempt an attack.
Current life situation and circumstances
• Individuals in unstable or transitional living arrangements may participate
in extreme behavior or reach out to authorities by acting out.
• Is individual in stable environment with food, shelter, clothing and
supportive human contact.
• Subject employed.
• How stable is employment.
• Is subject facing crisis or transition (Loss of marriage, job, housing)
• Subject being discharged from jail, mental health facility.
• How does current living situation compare with past situations?
• Does subject appear to be on downward course?
3. Information about attack related behaviors.
• Many attacks or near lethal approaches are preceded by attack related
behavior. (Often observed by people in subjects life)
• Such behavior should be considered a warning sign and taken seriously.
• Subjects must:
- Select target.
- Locate target.
- Secure weapon.
- Travel to target.
- Try and overcome security measures protecting target.
11

12. 4. Behaviors of concern in a threat assessment
An interest in assassination
• Visiting sites related to assassins.
• Writing to or about assassins.
• Gathering news and information related to topics of assassination.
Ideas and plans about attacking public figure or official
• Comments made to others.
• Notes in a diary or journal.
• Recent attention to travel and activities of protected person.
• Inquires to police or security about security measures.
• Attempts to breach security.
• Recent efforts to purchase or procure a weapon.
Communicating inappropriate interest in protected person or comments that express or
imply interest in attacking the person.
• Attackers rarely directly threaten a person.
• Attackers rarely communicate threat to law enforcement or security.
• Attackers will usually communicate intent to: Family, friend, co-worker,
neighbor or others.
Visiting a site linked to a protectee
• Visiting an event or site where protectee is, or believed to be.
12

13. Approaching a protectee
• Information that subject has acquired a weapon around the same time the
subject has developed an inappropriate or unusual interest in protectee.
• Presume that a subject that has engaged in these behaviors involving a
weapon, or breached security is interested in attacking if given the
opportunity.
• Investigative efforts should focus on ruling out the possibility of an attack.
• Example: Subject had valid reason to purchase a firearm. (Hunting
season, sport shooting)
Note: A subjects MOTIVES may determine whether a protectee is being
targeted for an attack.
13

14. Eight common motives found in inappropriate and/or attack related subjects.
1. Bringing themselves to the attention of persons they PERCIEVED to be
authorities.
2. Actions causing them to be involuntarily committed to a mental health or
correctional facility.
3. Change in current living situation viewed as intolerable by the subject.
4. Obtaining help, being stopped from acting violently.
5. Getting someone else in trouble.
6. Obtaining attention or notoriety or bringing a concern to public attention.
7. Achieving a special relationship with a public official or figure.
8. Correcting a perceived wrong.
Note:
• Our OPINION of the rationality of the subjects MOTIVES has no
bearing on whether the subject will take action.
• Subjects ACTS are based on their PERCEPTION OF REALITY.
• It does not matter if the subjects MOTIVES are: LOGICAL,
ILLOGICAL, RATIONAL, FOOLISH, REALISTIC or SELF-
DESTRUCTIVE.
Example: Subject believes they are a relative of the protectee and has
been invited to move into their home.
Important: The task is to UNDERSTAND how the subject VIEWS
14

15. the situation, not to REINFORCE any DELUSIONAL
IDEAS, and to attempt to GAUGE the ACTION the
subject might take based on their PERCEPTION AND
BELIEFS.
5. Target Selection
• Many attackers and near lethal approaches may consider several
potential targets and change their primary target several times.
• Factors in target selection:
Ability to travel,
Finances.
Approach opportunities with protectee,
Perceived importance given by the media,
Security around protectee.
• Be alert to the possibility that a subject has considered, is simultaneously
considering, or might consider in the future a number of officials or
figures as possible targets.
15

16. QUESTIONS TO ASK IN THREAT ASSESSMENT
1. What motivated the subject to make the statement or take the action?
2. What has the subject communicated to someone else or written in a
diary or journal concerning their intentions?
3. Has the subject shown interest in:
• Assassins or assassination.
• Weapons (Recent purchase or procurement of weapon)
• Militant or radical ideas/group.
• Murders, murderers, mass murders, workplace violence, stalking
incidents.
4. Has subject been involved in incidents of: menacing, harassing and or
stalking behaviors? These behaviors combine an inappropriate interest
with any of the following:
• Developing an attack idea or plan.
• Approaching, visiting, and/or following the protectee with a weapon.
• Attempting to overcome security measures.
• Assaulting or attempting to assault a protectee.
16

17. Two points about violence prediction
1. Violence prediction is conditional: Not a yes or no
Definition: A prediction of violence is a statement that, given certain
circumstances or conditions, a specified risk exists that a particular subject
will act violently toward a particular target.
2. Targeted violence is different than any other kinds of violence.
Example: Armed robbery, rape or attack on a roommate, is different than
an attack on a public figure, or business leader.
• A murder of a celebrity or business leader is different than a murder
of a parent or neighbor.
• Prior history of violence may not predict violence toward a public
figure. It is the totality of the information attained.
Two stage process in evaluation of violence prediction
1. Information should be examined for evidence of behavior and conditions
that would be consistent with the likelihood of attack on a public person.
2. Determine whether the subject appears to be moving toward and attack
and if so, how rapidly.
Note: ATTACK is the result of UNDERSTANDABLE and
DISCERNIBLE PROCESS of THINKING and BEHAVIOR!
17

18. References
Intelligence Threat Assessment Investigations US Dept of Justice: A guide for State and
Local Enforcement Officials. (Robert Fein/Bryan Vossekuil)
Behavioral Science and the Law Volume 17 (1999) John Wiley and Sons Ltd.
Threat Assessment: An approach to Prevent Targeted Violence (National Institute of Justice)
18