“In a hyper‐polarized political climate with heightened tensions and acute civil unrest, waves of threatening and problematic communications can overwhelm security professionals who must identify the true danger amidst the noise.” – Simons and Tunkel, 2021.
During times of crisis, conflict, or when faced with highly charged political or social issues, organizations and threat managers may be faced with multiple threats from a variety of sources, including anonymous threatening communications. We refer to these events as threat surges. Threat surges present unique challenges to threat managers as they must assess the credibility and actionability of multiple threats from varied sources all relating to the same theme. While it is tempting to ignore such communications and often the sheer volume of communications poses challenges, threat managers must remain vigilant for actual threats.
Threat surges are primarily the byproduct of two concepts, contagion, and the copycat effect. The American Psychological Association defines Social Contagion as “the spread of behaviors, attitudes, and affect through crowds and other types of social aggregates from one member to another.” The copycat effect theorizes that some perpetrators of mass violence are motivated by the extensive media coverage of past violent events and are seeking instant fame and notoriety.
A phenomenon known as the Columbine effect has been extensively documented in academic studies of incidents of targeted mass violence. Twenty-four years after the massacre at Columbine High School in Colorado there have been over 100 plots of targeted violence worldwide inspired by Columbine, with 21 carried out, killing 89 people. In April 2019, an eighteen-year-old woman who was fixated on Columbine flew from Miami to Denver and headed to a local gun store where she bought a pump-action shotgun. Authorities closed and locked down hundreds of schools in the Denver region while police searched for her, soon finding her dead from a self-inflicted gunshot wound in the nearby mountains.
Dr. Reid Meloy, a leading pioneer in behavioral threat assessment, has distinguished between the concepts of contagion and copycat: “contagion” refers to an imitation of the act after a widely publicized mass attack, typically several weeks. “Copycat” describes the imitation of the act and actor and can extend over months or years.
Several notable recent threat surges
Bud Light Controversy – After rolling out an advertising campaign centered around a transgendered individual Anheuser-Busch faced significant backlash. In addition to an avalanche of social media postings and criticism, Anheuser-Busch facilities received many credible threats of violence. Anheuser-Busch employees, in particular delivery truck drivers, reported episodes of threats and verbal harassment while driving Bud Light branded trucks.
The retailer Target faced a similar aggressive threat campaign regarding the line of merchandise indicating support for the LGBTQ+ community. In addition to social media campaigns of threats and harassment, several individuals appeared at Target stores and engaged in verbal confrontations with staff and in some extreme incidents vandalized and destroyed merchandise displays.
The most recent example of a threat surge is currently ongoing as Republican members of the House of Representatives attempt to select a new Speaker of the House. Following the failure of Republican Representative Jim Jordan to receive enough votes from his own caucus to be elected Speaker those fellow Republican representatives who voted against Jordan reported receiving multiple threats including specific and violent death threats directed at family members. The representatives targeted by these communications have noted that the vast majority of violent and threatening communications did not originate from their home districts but came from various locations nationwide.
The Impact of Social Media
The rise of social media has only exacerbated this problem. Social media serves as an incubator, accelerator, and amplifier of threats, misinformation, disinformation, and conspiracy theories.
Dr. Mario Scalora is a psychology professor at the University of Nebraska who studies targeted violence and terrorism. During a recent presentation on the role of social media and threats, he highlighted the following:
The illusion of perceived anonymity of online communications leads to increased disinhibition and lowered behavioral constraints.
The deindividualizing and disinhibiting effects perceived within social media may encourage users to behave in antisocial or violent ways because they cannot be held accountable for their actions and the ease of quick‐replying and other platform components may contribute to verbally aggressive language.
Aggressive or threatening behavior can also be facilitated and amplified by the ease of finding like‐minded persons who may reinforce inappropriate beliefs or behavior.
In his studies, Dr. Scalora has observed several recent noteworthy trends in electronic communications, including social media posts.
- Threatening language is more prevalent
- More intense politically driven activity and rhetoric
- More extremist language from a range of domestic and transnational sources
- Victims set a higher threshold for reporting electronic threats and are less likely to report threats received on social media
- Social media also facilitates violence by normalizing online hate, aggression, and antisocial behavior.
Bad actors and perpetrators of acts of mass violence utilize electronic communication for several goals.
- Highlight grievances
- Incite others to action
- Venue to express leakage (public statement indicating the intent to attack)
- Celebrate acts of violence
- Portray acts of violence near or in real-time
Guidelines For Response to Threat Surges
Threat surges are acutely problematic for organizations and threat managers in that they generate significant media attention and can inspire multiple copycat offenders. The resulting snowball effect results in a cascade of new and additional threats as other individuals feel inspired to send their own threatening communications.
All threats must be taken seriously and investigated and several key factors threat managers and threat management teams should consider when assessing the severity and actionability of threats during a threat surge.
- Are the threats specific or random and unfocused? Do these threats target a wide range of recipients or are they concentrated on one individual or entity? In a general sense, broad targeting may represent a lower level of concern than specific targeting of a person.
- Is there any evidence of approach behavior, has the potential attacker shared any information that indicates they may have conducted actual physical surveillance of the target? Actual physical surveillance of a target can show a high level of a potential attacker’s intensity of pursuit which can be considered a high risk factor.
- Is the threat surge correlated to an event such as mass layoffs, a social or political issue, or an election? If the communication appears to be reactionary and not related to a specific and personally held grievance this may represent a lower threat level. Conversely, if there is evidence of personalization of the issue this could indicate a higher level of risk for this specific potential attacker.
- The overwhelming majority of communications within a threat surge will lack evidence of a personalized grievance or intensity of effort in research, construction, or delivery. When evaluating threatening communications threat assessors and threat management teams should be alert for the following high-risk factors:
- Does the communication show evidence of a personally held grievance specific to the intended target?
- Does the communication reference previous mass shooters (“role models”)?
- Does the communication show any impatience or intolerance for delay,
- Is there a time element associated with threat? Does the potential attacker perceive a closing window of opportunity for the attack? This could be related to deteriorating health, pending arrest, future limited access to the potential victim, or other limiting circumstances.
- Does the communication suggest the attacker has any indication of “Last Resort” behavior? Experts have defined this as the inability to recognize or pursue any other path but violence.
- Does the communication contain any references to preparations the potential attacker may have made to procure weapons or conduct any other operational planning?
- Does the communication contain pictures of acquired or homemade weapons, such as firearms or explosives?
- Does the potential attacker include hateful language against a specific minority or describe any homicidal or suicidal intentions?
- Do they describe any triggers or motivations for an attack? Do reveal details of a tactical plan?
- Does the potential attacker communicate across multiple platforms and modalities?
- Has there been an escalation or change in the frequency and intensity of the communications?
- Has the potential attacker indicated an intent to approach the target?
Threat assessors and threat management teams should focus on the pattern and nature, not the modality of any threatening communication. The following communication should be considered high risk:
- Messages/postings encouraging violence
- Content suggesting approach or inciting approach
- Content justifying violence
It’s Not All Bad News
While the impact of social media has been profound in the world of threat assessment the news is not all bad. Analysis of recent attacks by the FBI’s Behavioral Analysis Unit has found that mass shooters are increasingly announcing their grievances and violent ideation on social media before attacking. This is a significant development among a pool of offenders who were otherwise often socially withdrawn and hard to detect. This posting of open-source content provides investigators with an opportunity for early detection of a planned mass shooting and provides invaluable insight that can inform efforts to craft and employ interventions. Online radicalization is always followed by on-the-ground preparation, behavior, and actions that are observable and reportable by family, friends, coworkers, and other bystanders.
While the rise of social media has introduced new complexities to threat assessment, it has also provided new opportunities for early intervention and prevention.
