The field of behavioural threat assessment and management (BTAM) has grown significantly in recent years with increasing numbers of law enforcement, mental health, human resource, and school officials utilising structured assessment of behaviour to determine individuals’ trajectory to violence and to formulate informed mitigation strategies. BTAM relies on evaluators using structured professional judgment to make sense of an individual’s current and past behaviour – behavioural data. Multi-disciplinary BTAM teams are designed to reduce silos and facilitate the sharing of information from data repositories germane to the participants’ professional sectors. One such team, the Aurora Police Department’s Crisis Response Team, removes silos through interdisciplinary partnerships between crisis intervention trained police officers and mental health professionals. This team under the auspices of a public health model leverages a treatment-based approach designed to intervene at the pre-criminal stage and prevent acts of targeted violence, employing long-term case management and threat management strategies.
Other teams, such as the San Antonio Police Department’s threat assessment team also use cross-disciplinary collaboration to prevent acts of violence through information sharing and BTAM. However, many threat assessment professionals do not enjoy the benefit of being party to a multi-disciplinary team, resulting in limited access to information. As a recognised promising practice in targeted violence and terrorism prevention, championed under DHS’ Center for Prevention Partnerships and Programs, local cross-disciplinary threat assessment teams facilitate the formation of a more nuanced, informed, and complete threat picture. School officials leverage appropriate information from educational databases and mental health professionals add relevant mental health history information, while law enforcement officers provide information from criminal justice databases.
All these data sources can aid in providing a more holistic picture of an individual of concern’s behavioural history. This is a necessity in threat assessment since BTAM seeks to situate current behaviour within the context of previous behaviours to examine deviations in baseline. Some plots cannot be easily uncovered using open source methods.
However, open-source information, accessible to members of the team (regardless of their specific discipline) must also be consulted because many individuals, not only those with malicious intent engage in a variety of online activities in unencrypted spaces that can provide invaluable information to inform the threat assessment process.
There is an observed reluctance by some especially those outside of law enforcement to use open-source intelligence methods and investigative techniques to inform behavioural threat assessment and interventions. This reluctance presents a significant information gap that limits access to valuable potential data sources. Open-source data collection is applicable to adults and youth engaging in concerning behaviour. For both adults and youth, publicly available social media information can prove to be illuminating. The utility of social media in prevention efforts is evident in ideologically motivated plots and non-ideologically motivated plots aimed at schools. Furthermore, there is a complex, well-developed, and sophisticated online culture devoted to school shootings and misanthropy, that occasionally intersects with Satanism and Nazism. This utility was demonstrated when Pembroke Pines Police Officers received an anonymous tip on 23 August 2021, concerning an online post about a potential school shooting at a local high school, resulting in the arrest of two students. The Pembroke Pines Police Department uncovered an alarming social media post initially made on Instagram with a text threatening to “terrorise” the high school. The averted school attack displays both how attackers engage in leakage and how bystander or police observation of concerning content can prevent tragedies.
However, there are several significant barriers to practitioners engaging in OSINT activities during Behavioural Threat Assessment investigations of potential terrorists and other targeted violence perpetrators. First, there is stigmatisation of Intelligence within C/PVE and TVP initiatives due to an early history of surveillance motivated by racial and religious profiling following the 11 September 2001, attacks. Lack of public trust in government officials related to misuse of personal information, biased based surveillance, infringement on personal freedoms, and protection of free speech feature heavily in concerns of early CVE efforts. Furthermore, sophisticated open-source investigation requires training that is often inaccessible due to the high cost of quality OSINT training.
When considering the barriers to large scale adoption of OSINT within BTAM it is important to investigate the utility of applying the discipline within the space. Adopting open-source investigation can provide the ability to compare online activity to the offline presentation of an individual of concern. Elliot Rodgers’ story serves as a perfect example of the differences in online and offline presentation of a subject of concern. Police officers contacted Rodgers three times prior to his 2013 rampage in Santa Barbara, California. Although Rodgers’ YouTube posts caused his family and social worker concern, police found Rodgers to be polite and did not take any action. Rodger’s case also highlights how prevention efforts may suffer from unconscious bias. After the spree, commentators alleged that the lack of police action before the events resulted from Rodgers being a white-passing male. And as a result, some observers wondered whether his identity and presentation caused officers to negate his concerning behaviour online and offline (including spraying peers with an orange juice-filled super soaker and splashing coffee on a couple that he saw kissing). While these allegations have been confirmed, access to a subject of concern’s online behaviour and training on utilising that information for a data-driven, well-informed, and methodologically sound assessment can counteract unconscious bias.
Moreover, observing online leakage may present prevention practitioners with indicators of escalation and imminence. Many prevention practitioners manage a large case load of concerning subjects and clients that requires a triaging process. Observing signs of an individual’s entry to the ‘pathway to intended violence’ or preparing for an imminent act of violence may help prevention professionals to determine what cases require immediate response to prevent an act of terrorism or mass casualty attack. Recent reports by the U.S. Secret Service’s National Threat Assessment Center (2001) and the National Police Foundation’s Averted School Violence project (2001) emphasised the importance of bystanders identifying and reporting online indicators of violence with the hope of early care-based intervention.
Moreover, it is paramount that prevention practitioners build cultural competency when dealing with individuals who are members of violent extremist groups. In the book, Jihadi Culture: The Art and Social Practices of Militant Islamists, edited by Thomas Hegghammer, multiple authors describe and analyse the sophisticated and well-developed aesthetic culture within Jihadi groups. The anashid (Islamic songs or recitations), cinematography, poetry, and other material culture are present on and offline. This phenomenon is not restricted to militant Islamism. In her book, Hate in the Homeland: The New Global Far-Right, Dr Cynthia Miller-Idriss explores the culture of the spectrum of far-right activists and how this distinct culture manifest offline and online. These cultures and their specific manifestations (language, dating practices, parenting styles, symbolism, dress, music, foods, memes, etc.) are created with intention. Therefore, prevention practitioners should understand them, requiring professionals to orient themselves to online spaces where these cultures are created and disseminated. In short, prevention practitioners must devote time and effort to build cultural competency with respect to the movements that their clients participate in. Understanding culture, language and artifacts may help a practitioner determine how accultured their client is to the ideology and movement they align themselves with, inform in-person assessments, and construct well-informed intervention and case management plans.
Conclusion
Extremist recruitment is an insidious process in which online recruiters identify vulnerable persons. The recruiters invite these persons into chat rooms, send them funny memes, games, music or other materials – the strategy is to socialise first. Those individuals who engage with interest get invited into private rooms. The recruiters bond, create a connection, and slowly and methodically bring the person deeper into explicit, violent, racist, insurrectionist, anti-Semitic/anti-Muslim/anti-immigrant content, hoping to cultivate an identity, community and purpose – and in extreme incidents – acts of terrorism or mass violence.
Understanding the warning signs of a person becoming engaged in extremist ideology such as: (a) increased on-line presence beyond ‘typical activity’; (b) focus on violent, racist, xenophobic, misogynistic, anti-Semitic online platforms and forums – including memes and ‘lulz’; (c) accumulation of texts, manifestos, photographs and links to extremist ideologies and organisations (often in open, sometimes hidden); and, (d) changes in behaviour – provocative comments, increased hostility and anger toward persons, perspectives and belief systems – creates the opportunity for intervention pre-crisis and before tragedy occurs.
In this regard, GNET provides a critical behavioural threat assessment tool to identify persons in need of services and intervention. Prevention professionals and threat assessors within the private sector, public sector, and nonprofit sector need to familiarise themselves with the movements that exist online and offline, build cultural competency to improve intervention outcomes, and work with researchers to understand previous cases so that they can be studied and inform future interventions.