Identifying Pre-Attack Indicators for Special Events

Before he went on a shooting rampage that claimed seven lives (including his own) in a California college town, Elliot Rodger had already left clues about his deadly intentions. He posted numerous threatening videos online. He e-mailed a 140-page manifesto that detailed the perceived wrongs against him and how he intended to “set them right.” He made vague verbal threats, proclaiming that he was going to kill “them.”

The video threats, the manifesto, and other verbal threats that preceded Rodger’s 23 May 2014 rampage in Isla Vista, California, were pre-attack indicators – detectable manifestations of an attacker’s intent and capability to harm. Such pre-attack indicators are important because earlyentification, by knowing what threatening behavior to search for, can save lives.

Recipe for Disaster – Intent & Capability 

A person only will carry out an attack if he or she has the intent and the capability for violence. Intent is the desire to harm or attack a person, place, or thing, whereas capability refers to having the capacity to carry out the intended harm. Intent and capability have different sets of indicators.

According to 2011 research published in Behavioral Sciences and the Law, indicators of intent include the following actions and behaviors: suicidal and/or homicidal thoughts; psychopathy; affiliation with terrorist or hate groups; vague or direct threats; and last-resort behaviors. Such indicators exhibit in a variety of ways. For instance, the research found that calls to violence typically indicate a possible attack by terrorists or hate groups; issuing a call to violence for a specific venue signals a direct threat with a strong intent to harm. A 2013 report published by the RAND Corporation provided examples of capability indicators, including: gathering weapons or weapon-making materials; training for weapons or paramilitary forces; gathering security information; testing venue security; conducting dry runs; and conducting surveillance on venues.

Once a person or group has evinced the intent and capability for an attack, other kinds of pre-attack indicators may emerge. These actions, onceentified, require quick response because they typically signal that the onset of an attack is imminent. Based on security literature, such as the 2013 RAND Corporation report, actions that security personnel should look for include the following:

  • Positioning actions – Asking directions to ensure correct target, attempting to clear the area of “innocents,” hesitating to ensure maximum effect of attack, and communicating onsite between co-conspirators;
  • Evading detection indicators – Avoiding checkpoints, making robotic like or unnatural movements, hiding information, and possessing suspicious containers or bags;
  • Stress indicators – Hiding traditional stress signals, displaying subtle, less obvious signs of stress; and
  • Imminent action – Possessing a visible weapon.

External Factors & Internet Clues 

In addition to pre-attack indicators, there are external factors – including location, time of year, and previous attacks – that can increase the chance of an attack or violence. Location factors include vulnerable spots in specific venues or areas where known terrorist-affiliated members live. Time-of-year factors are key dates and trigger events. Large venues are often more heavily trafficked during holidays and special events; these larger crowds may attract attackers who seek to maximize harm. Trigger events – loss of a job, harassment, or the death of a colleague or loved one – may contribute to an attacker’s motive, aggression, and method. Additionally, widely reported violence triggers future attackers by giving them theea that large-scale attacks receive media attention. Attackers may view this media coverage as a reward.

Although security personnel are familiar with the pre-attack indicators themselves, specific ways to spot them are less certain and constantly changing. The Internet, for example, is one medium through which pre-attack indicators often surface – on social media sites or through conventional search engines. Security directors for large venues that hold special events could find pre-attack indicators by searching for specific terms, including: name of the event; location of the event; names of high-profile speakers, performers, guests, and attendees; previous attacks on similar events; name of the event plus controversial topic; and trigger events. It is important that security personnel who are responsible for searching online activity download and save any evidence of threats they have discovered.

In summary, pre-attack indicators are clues that may enable security personnel to prevent an attack or mitigate the consequences of an attack. Internet searches provide means to detect pre-attack indicators. To prevent deadly incidents like the one in Isla Vista, anyone close to a potential attacker must be able toentify and promptly report pre-attack indicators to proper authorities, which in turn must be able to recognize the threat and, when necessary, take swift action.

Jessica A. Gladfelter

Jessica A. Gladfelter is a rising senior at Roanoke College in Salem, Virginia. She has done research in psychology for three years and is currently pursuing a BS in psychology. Jessica has presented multiple research posters at conferences around the country. She currently serves as intern at a federal agency.

Dallas R. Mosier

Dallas R. Mosier is a rising junior at Saint Francis University in Loretto, Pennsylvania. She is pursuing a BS in chemistry, as well as a BS in criminal justice. She has done research in the chemistry field for the past year and has presented her research at various symposiums. She currently serves as intern at a federal agency.



No tags to display


Translate »