Warning Signs to Look for in Violent Extremism/Active Killer incidents

Many people spending more time online this past year due to COVID-19 lockdown and isolation has created limited options of socialization, forcing people to a record amount of screen time on the internet and social media. Much more than ever before. 

A report from We Are Social, Digital 2019 stated that the internet and social media have transformed the way in which people communicate. In early 2019, global internet penetration reached 57% or 4.4 billion users. And the overall number of mobile social media users reached 42% or 3.2 billion people, with an average time of 6.5 hours a day.

Online radicalization to violence is the process by which an individual is introduced to an ideological message and belief system. It encourages movement from social norms toward extreme views, primarily using online media, including social networks from Facebook to Parler and other social media platforms.

Unfortunately, the propaganda of radicalization and recruitment online has never been higher and more active. We are just beginning to see the possible implications of the 2020 pandemic with the most recent national highlighted incidents: 

March 16, 2021 – Atlanta, Georgia – 8 dead, 1 injured
A series of mass shootings occurred at massage parlors in Atlanta and its suburb Acworth, about 30 miles away. Eight people were killed in the incidents, and one person was wounded, including six women of Asian descent. Robert Aaron Long was arrested in Crisp County, about 150 miles south of Atlanta. Authorities said Long told them he was planning to continue the spree in Florida.

March 22, 2021 – Boulder, Colorado – 10 dead, 1 injured
10 people were killed, including a Boulder police officer, in a shooting at a grocery store. The suspect, Ahmad Al Aliwi Al-Issa, was shot in the leg and has been charged with 10 counts of first-degree murder and one count of attempted murder.

April 2, 2021 – U.S. Capital – 1 dead, 1 injured
25-year-old Noah Green deliberately rammed a car into the north barricade outside the United States Capitol in Washington, D.C., along Constitution Avenue. One Capitol Police officer was killed, and another officer was injured. Investigators believe Green’s attack was caused by a combination of his mental health issues and an ideological cause which he believed justified violence.

April 15, 2021 – Indianapolis Indiana – 9 dead, 7 injured
A shooting occurred outside a FedEx facility near Indianapolis International Airport. Nine people were reported dead, including the shooter, who committed suicide. The shooter has been identified as 19-year-old Brandon Scott Hole, a former employee of the FedEx facility.

To put this into perspective, these 4 attacks occurred within 30 days involving 28 killings, to include 2 law enforcement officer deaths and 10 injuries.

Looking at the litany of incidents, the first thing of note is to identify what type of domestic violence acts are being committed. These incidents fall under what is classed as the Homegrown Violent Extremism (HVE), better known as Domestic terrorism, or (Lone Actor) Active Killer situations. While they are easily grouped together, it is important to see what the differences are. And it is even more important to take note of what the similarities are in behavioural cues and mobilization between the two.

One of the hottest topics and questions is: “how can we prevent HVE or Active Killer incidents?” The majority of training organizations receive is the “Run, Hide, Fight” or a variation thereof. The problem with this type of training is that it is a reactive state that comes into play only after an incident occurs. In these life or death situations, if we wait for an incident to occur, we have already failed. Therefore, the first step to help combat these HVE/Active Killer incidents is to change the culture to become more proactive and emphasize prevention before reaction.

 So, the natural next question is how do we recognize an Active Shooter situation before it happens? We hear and see in the news that we must be vigilant and have increased situational awareness. But how does one do that? 

Understanding Situational Awareness
First, it’s important to know that there are two types of situational awareness. One type of situational awareness is called the OODA loop, which comes into play during an existing threat. The OODA Loop is the decision process of Observe, Orient, Decide, and Act, developed by military strategist and United States Air Force Colonel John Boyd. Boyd applied the concept to the combat operations process, often at the operational level during military campaigns. This process is a great tactical response as a complement to the decision process to the Run, Hide, Fight of an active threat situation when it occurs.

The second type of situational awareness is during the moments before an active threat. We call this type of awareness – Situational Awareness Threat Assessment (SATA). SATA provides real-time threat assessment of an existing environment. This type of situational awareness is designed to detect a threat before it becomes a threat. SATA was created on the premise of being able to read, understand, and establish a baseline for your environment. An environmental baseline is the ability to establish the environment’s current conditions and identify the current “norm” of your surroundings. By doing this, you are establishing a starting point for the environmental baseline. 

Establishing An Environmental Baseline
To properly establish an environmental baseline, we need to understand two main elements in the environment. One is the physical environment, and the other is the human factor. There is a third sub-element which is special events. Special events directly correlate and influence how the first two elements (physical environment + human factor) interact. Figure 1 shows how the three elements come together to create an environmental baseline.

Physical Environment: This is the part of the environment that includes the physical factors such as the immediate surroundings to include the physical layout of indoors or outdoors spaces. Things to consider in the physical environment are whether there are structures such as office buildings, theatres, or malls in the surrounding area. Are you in a public area such as a shopping center, concert, amusement park, beach, city street or just out in public? What about tangible, miscellaneous items such as equipment, parked vehicles, traffic flow or that unattended bag or package that has no explanation for being there? Also, consider the time of the day, day of the week, or what the weather is outside. 

Human Factor: This is the study of how humans behave physically and psychologically in relation to a particular environment, situations, physical actions, or services. Although human factor is a large area of study, including responses in relation to emotional and other sensory stimuli, we will concentrate on the human factor of Deviant Behavior Detection (DBD) or the ability to identify high-risk individuals.

Deviant Behavioral Detection in threat assessment terms is also known as Behavioral Threat Detection (BTD). DBD or BTD is used as a real-time threat assessment tool in law enforcement and security operations. It identifies high-risk individual(s) and analyzes deviant behavioural patterns that may predict deceptive or violent behaviours not conforming to social norms, including criminal activities such as acts of terrorism or active killer situations. Both homegrown Violent Extremist and lone actor, Active Killer Situations can exhibit the same mobilized behavioural cues moments prior to an attack, so it is crucial to identify high-risk individuals that give off such signals.

Detecting High-Risk Individuals
Human Factor Warning Signs: When an individual is being deviant and is trying to hide something, such as stealing, smuggling, or conducting pre-attack operations such as surveillance, the moments before committing a crime is called the “fear of discovery.” Fear of discovery is the individual’s emotional state when they have increased anxiety of being discovered prior to completing their mission. During the fear of discovery phase, a person will have behaviour leakage that gives off signals of their deviant conduct or ill will. 

Behavioural leakage occurs when psychological stress manifests in emotional and physiological reactions that are experienced by an individual confronting the demands of the situation, which goes beyond their coping capabilities. The effects of the stress can be emotional, psychological, and physical such as excessive sweating, fidgeting, shifting, or uneasiness, or being overly nervous and stuttering when speaking. An individual that reaches the peak of their coping capabilities will create leakage in such anomalous behaviour. It is these behaviours that can be noticed and observed in order to assess a high-risk individual.

Physical Environment Warning Signs: Another important factor to consider when assessing one’s behaviour is the interplay between an individual’s physical appearance relative to the environment. Physical appearance indicators to consider are individuals that might be wearing improper attire for climate, loose, bulky clothing, or unusual bulges in clothing. Does such an individual appear to be in disguise or attempting to cover their physical appearances to conceal their identity? Are they wearing a low-lying hat or hoodie, or sunglasses? How about that individual who appears to be taking photos or video in an unusual area or has a covert demeanour? These are important factors when comparing the physical appearances of an individual to the environment and how they interact with each other. 

Special Events: Special events can also have a direct effect that can change or influence the environmental baseline. For instance, special events could increase the population density within an area, such as large gatherings like concerts. Other special events could draw the attention of outside rallies or protests, such as political venues where there is a higher risk of incidents. 

When assessing a crowd, you need to recognize the crowd composition, namely what type of crowd do you have, what is the overall demeanour of the crowd? What is the crowd flow of movement, are there any restrictions? What is the overall age range or age profile of the crowd? Is there controlled entry and egress? Or is it a public forum with no entry/egress controls, such as public space like city streets or public beaches? 

Large crowd gatherings and special events may be appealing to active assailants as they can easily evade authorities and move more easily undetected. For the active assailant, the risk vs. reward is low risk with high rewards. Basically, they are getting a bigger bang for their buck. No pun intended. Every threat starts and ends with a person. If you stop the person, you will stop the threat.

These are all the questions you would take into consideration while assessing the environmental baseline. It is important to note that any environmental baseline you establish is contentious and ever-evolving so it needs constant updating. As time and space changes, so does the need to reassess the environmental baseline. 

With that said, having these types of situational awareness and recognizing anomalies prior to an attack is the crucial first step. But what if you could recognize potential violent behavioural indicators days, weeks or even months before an attack? In the next installment of the Circuit, we dive into this truly proactive approach to prevention before reaction by dissecting and understanding the radicalization and recruitment processes to get into the mindsets that lay the foundation for the attack. 

Sources:
Pathway to Violence: Fredrick Calhoun & Steve Watson, Contemporary Threat Management – 2003.

Pre-Attack Behaviors: Federal Bureau of Investigation – Behavioral Analysis Unit

World Internet Penetration Rate: https://www.internetworldstats.com/stats.htm

Active Shooter Incidents/Statistics – Open-Source Information: NBC, ABC, CBS, FOX, CNN. All other public media outlets.

 

---

Behavioral Analysis Part 1
By Craig Burns

Craig A. Burns is the President and CEO of TACT Consulting, LLC, a behavioural detection
and analysis company that specializes in pre-attack behaviours of an active killer, behavioural threat assessment, situational awareness training and public/special events in high-risk venues such as political events, parades, and concerts and sports entertainment.
He has 25 years of experience in private and public sectors, specializing in security operations and physical security with multiple corporate 500 companies and the U.S. Department of Homeland Security/Transportation Security Administration Behavioral Analysis, Threat Assessment Division. Craig Burns has held positions with the National Training Team assigned out of the Federal Law Enforcement Training Center (FLETC) as a Behavior Detection Supervisor.