Threat assessments and the subject of targeted violence date back to the 19th Century France and Italy where the work of Laschi Lombroso was well known and suggested that criminals could be identified based on physical defects. More recently, research has been directed by issues of mental disorder and driven by those from the world of psychiatry and psychology.
This changed in the late 1990s when Fein and Vossekuil were tasked by the US Secret Service to research all assignations and attempts, to ascertain what could be learnt from them and how this might change their operational approach. This project, which is now widely known as the Exceptional Case Study Project (ECSP) started considering targeted attacks, a term created by them, from a security rather than a mental health perspective. When tasked with assessing the threat that an individual may pose, it is not unusual for investigators to utilise Open Source research. The question is; what is it that you are looking for? Previous criminal history? Association with groups of interest? All very useful, but do they tell you the whole story and could you be missing vital information, information that might enable a more forensic assessment? Methodology introduced by Philip Grindell MSc Msyl to aid the investigation of abuse targeted at British politicians and now used by Defuse Global, a specialist consultancy he launched to assess threats against public figures, suggests that a more forensic approach is possible.
Hunter or Howler?
One of the key aspects is the understanding that those who make threats do not necessarily pose them. In essence, this involves identifying whether the threats are emanating from a ‘Hunter’ or a ‘Howler’. These terms were originally devised by Calhoun & Weston and supported the findings of the ECSP where they found that none of the attackers studied communicated a direct threat to the target directly or to law enforcement. This suggests that attention should be focused on those who pose a threat, whether or not they have made a threat. This finding is supported by the study into the role of mental disorder in attacks on European politicians between 1990-2004 where they could find no evidence that the person targeted was subject to a direct threat. Human behaviour is more complicated and it would be risky for a security manager to assume this theory as always true as a person of concern who threatens can also attack and the others argued that those who breached the security were more likely to be a threat than those who simply approached. However, it is appropriate to take the view that those that threaten are often ‘Howlers’ and have no intention to attack. Logic suggests that someone intending to attack is unlikely to give prior notice. ‘Hunters’ on the other hand are predators, who may leak indicators that they are in pre-attack planning mode. Predatory behavior, once necessary for survival, is now used to satisfy other needs such as to achieve notoriety, wealth, dominance and revenge. Very often the predator will express a complete lack of any emotion during the attack. Developing from the theory of ‘Hunters’, it is argued that this can be explained by two differing types of violence that separate those who attack a politician as opposed to those who engage in ‘everyday’ violence.
Affective or Predatory Violence?
Termed as either Affective or Predatory violence, one highly emotional and the other cold and calculated, they have very different purposes. Affective violence is highly emotional, with a sense of arousal, anger or fear. This is ‘everyday’ violence seen in street fights, domestic violence and gang murders. Predatory violence is not preceded by emotion. In fact, it is the lack of arousal and emotion and the presence of cognitive planning that separate it from the everyday violence we are all too familiar with. The purpose of affective violence is to defend oneself against a perceived threat. There is a growing body of evidence that psychopaths are more likely to engage in predator violence. This can be seen in stalkers. Intimate stalkers who turn violent threaten their victims and when they attack are often impulsive, choking, pushing, punching and pulling hair. Public figure stalkers plan their attack, rarely threaten and often use weapons. The theory of pre-attack warning behaviors is a key element of Defuse Global’s assessment. The term ‘warning behaviors’ was used to suggest that the subject had changed their behaviour and was on a period of acceleration towards the attack. They do not predict who is going to attack, but are usually are based on facts, dynamic, acute, and often indicate an acceleration.
Seven Warning Behaviours
They can be useful to help threat assessors manage low frequency intentional acts of violence towards an identified target. In the previously referred to research into attacks on European politicians, 46% showed signs of the warning behaviors before their attacks. The assessment looks at seven warning behaviours. It doesn’t suggest that they all will or need to be present, but clearly the greater the cluster, the greater the threat:
- Pathway to violence: This is described as the period in which the subject researches and plans the attack. This path, often initiated by a grievance, real or perceived, then leads them on to the idea that violence is the only way to resolve this issue and from there they start to research and plan the attack. This grievance can be either personal or ideological. The subject can move along the model escalating or de-escalating the threat depending on a number of variables. Once a grievance has occurred and the subject had decided that violence is the answer, it follows that they will then start to research and plan what to do next. In the ECSP they found that 67% of the subjects had a grievance at the time of the incident and more than 80% who had a grievance blamed their target for it. However, they also stated that the attacker often considered more than one target before deciding who to attack.
- Fixation warning behaviour: This is described as an increased pathological preoccupation with either a person or an ideology or cause. Fixation can be a normal part of life, such as the emotion of loving, however when that fixation then consumes your every waking moment and becomes obsessive, it becomes pathological and is often linked to stalking behavior. From a security perspective this can be difficult to identify, however an unnatural volume of interest may be an indicator. One of the risks attached to such fixation is the need for close proximity and when this is frustrated it can metamorphise into strong emotions of anger and emotionally hijacks their lives. Research conducted into attacks on British politicians this century indicated that the fixation in each case was on a cause or ideology rather than the individual. Thomas Mair, the killer of Jo Cox MP, was fixated on extreme rightwing ideology and the idea that immigrants were taking over.
- Identification warning behaviour: This is described as behaviour that suggests a psychological desire to be a ‘pseudo-commando’. This is often associated with those who consider themselves to be ‘soldiers’ of a cause and dress up in military style outfits. A good example of this is Anders Behring Breivik who dressed up in military uniforms, identified himself as a Commander in the Knights Templar and considered that he was fighting a cause. The research suggests the subjects who demonstrate this behaviour have emotions of anger and resentment. Another sign of this behaviour is the association and research into the actions of other attackers. The subject will have researched other attacks and seek to link himself to that attack or gain confidence. from
- Novel Aggression warning behaviour: This is best described an act of violence or aggressive behaviour in which the subject is testing their ability to act in such a way. It is usually unrelated to the ‘pathway’ on which they are travelling and can be totally out of character. The act may be completely unrelated to what they intend on doing and property crimes may be an indication. In October 2014, Michael ZehafBibeau murdered Corporal Nathan Cirillo, a Canadian soldier, and injured three others. Three years earlier, in December 2011, he had walked into the Royal Canadian Mounted Police (RCMP) field office in Burnaby, British Columbia, and said he wanted to be arrested for an armed robbery he committed a decade earlier; no such recorded crime existed. The next night, he tried to rob a McDonald’s restaurant with a pencil, then waited for the police to arrive.
- Energy Burst warning behaviour: This is a key indicator that the intention is escalating and can occur in the hours, days or weeks before the actual event. It is characterised by an increase in pre-attack activity and can be signs of final preparations, purchasing equipment or conducting hostile reconnaissance or internet activity. In May 2010 Roshonara Choudhry, having radicalised herself online, dropped out university and made an appointment to see her local Member of Parliament, Stephen Timms. She then quickly paid off her student loan and closed her account before buying knives on her way to attending his office where she attempted to kill him. This all happened in a matter of days before the attack.
- Leakage Warning behaviour: This is where the subject communicated their intention to a third party. This can be done in person, online, in a journal or letters. A recent example of this is Jack Renshaw who told his associates that he was planning to murder someone: Rosie Cooper, his local Member of Parliament. A member of his group subsequently informed on him. There are number of theories as to why someone might ‘leak’ intent of an attack. These motivations could vary from the need for excitement, a sense of accumulating power, a desire to frighten or intimidate, seeking of attention, or fear and anxiety concerning the impending act. Recently, we have increasingly seen attackers publishing their ‘manifesto’. This perhaps suggests that they want to be remembered or associated with the attack in the contemplation of their arrest or death.
- Last resort warning behaviour: This behaviour is evidenced by language of no hope. It suggests that the subject sees no alternative, and nothing left to live for. It is an indication of a view that there is no alternative other than violence and seeks to justify the action. It can also be witnessed by reckless behaviours which show no concern for future consequences. This behaviour was evidenced by the Westminster attacker five days before the attack in a “goodbye visit” he visited his mother as he [Masood] was leaving the house, he turned over his shoulder and said: ‘They’ll say I’m a terrorist, I’m not’. When a threat is received, these steps, when taken together can provide a forensic basis on which it can be assessed, increase accuracy and provide those tasked with providing a detailed rationale for their decision making. It is worth noting that any assessment is just that, an assessment and no model can prove unequivocally that no threat exists. Defuse Global is a consultancy whose clients include public figures and those who have a high profile, many of whom receive communication that is threatening, abusive or intimidating. Prior to launching Defuse Global, its founder, Philip Grindell was brought into Parliament following the murder of the politician Jo Cox, and to set up and run the team tasked with stopping the next attack whilst investigating the abuse, threats and intimidation directed at British politicians. Having researched threats assessments and relevant research and tested many within Parliament, Defuse Global formulated their forensic assessment of threats, which forms part of `The SAFER Model’.
Philip Grindell MSc MSyI is a member of Association of Threat Assessment Professionals (ATAP), is qualified in Stalking Risk Profile, a member of ASIS and a member of The Security Institute. In addition, he is a trained Counter Terrorist Security Co-Ordinator. The former Scotland Yard detective is founder and CEO of Defuse Global:www.defuseglobal.com or @Defuseglobal on Twitter/ Instagram.
