January 2025
When You Hear Hoofbeats, Think Horses, Not Zebras
- Guidance given to medical school students that encourages them to consider the most likely diagnosis first.
Imagine that you are a threat manager for an organization called in to assess an employee who has been making threats. Investigating this employee’s history you discovered the following:
- 2013: The employee had a dispute with a professional accreditation body over recognizing foreign qualifications. During a phone call, the employee threatened to commit “an act that people would remember and would attract international attention,” referring to the Boston Marathon bombing. Law enforcement found no signs of extremism but charged the employee with disturbing the peace.
- 2014: After being denied government financial support, the employee threatened to “commit an act that would draw international attention” and mentioned suicide. Although law enforcement intervened, no further action or mental health referral followed.
- 2018: The employee unsuccessfully attempted to join a refugee relief organization, leading to heated disputes over the organization’s political affiliations.
- 2018–2023: Representatives from multiple refugee relief organizations reported ongoing harassment, stating the employee “terrorized us for years over political affiliation and accusations of improprieties.”
- 2023: An anonymous social media complaint was filed after the employee asked followers, “Would you blame me if I kill 20 people?”
- 2023 Threats: Security officials and the employee’s home country alerted law enforcement about threats made against government officials. Authorities dismissed these warnings as “unspecific,” citing the employee’s lack of a violent history.
A Real-World Case
This scenario describes Taleb Al Abdulmohsen, the suspect behind the 2023 Christmas market vehicle attack in Magdeburg, Germany, which killed five and injured over 200. Following the attack, the head of Germany’s Federal Criminal Police acknowledged potential failures, stating:
“We’re putting everything on the table now, and we will certainly need to examine whether we, as security authorities overall, might have missed something. But again, we are dealing with a completely atypical profile here.”
The Attacker’s Background
Abdulmohsen, a 50-year-old Saudi national and long-term German resident, had a history as an anti-Islam activist and vocal critic of the Saudi government. He became politically aligned with Germany’s far-right AfD party, criticizing the country’s immigration policies for allowing Muslim immigration. In statements before the attack, he expressed a desire to “punish Germany for lax pro-Islamic immigration policies.”
Challenges in Threat Assessment
Despite evidence to the contrary, conspiracy theorists speculated the attack was a “jihadist false flag” or that German authorities were covering up the attack’s true nature. Terrorism expert Peter Neumann from King’s College London captured the bewilderment of professionals when he posted on social media:
“A 50-year-old Saudi ex-Muslim who lives in East Germany, loves the AfD, and wants to punish Germany for its tolerance towards Islamists—that really wasn’t on my radar.”
Reports later revealed that German authorities had disregarded warnings from Saudi security services, assuming these were politically motivated attempts to suppress dissidents. Initially viewing the attack as jihadist was understandable, but as more information emerged, it became evident this case defied typical patterns.
In this case, the attacker was a zebra—someone who defied conventional profiles. Did authorities overlook critical warnings because the suspect didn’t fit preconceived notions? Threat assessment teams must use proven analytical techniques and focus on behaviors of concern, not just demographics.
The Implications of Target Selection – Context is Key
Conspiracy theorists, media pundits, and self-proclaimed terrorism experts all pointed to the attack’s location—a Christmas market—as proof of anti-Christian motives. However, timing may have been the determining factor.
While target selection can be a significant indicator of motive, context is critical to make this assessment. In this case, was the selection of a Christmas event simply based on the timing of the attack? Had the attacker decided to conduct his attack in the fall would an Oktoberfest celebration have been the target? Germany’s immigration policies seem to be the grievance that motivated the attack not a grievance based on religion.
In many cases target selection has symbolic value rather than a specific grievance against the targeted location. Consider the case of Robert Bowers who conducted the deadly Pittsburgh synagogue attack. Bowers harbored deep anti-Semitic and white supremacist beliefs and specifically targeted the synagogue due to his belief that the Hebrew Immigrant Aid Society was responsible for sponsoring an invasion of immigrants into the United States.
In other cases, attackers select targets based purely on convenience. Consider the August 28, 2022, shooting at a Safeway grocery store in Bend, Oregon. The shooter, 20-year-old Ethan Blair Miller, initially planned a mass shooting at his former high school on September 8th, coinciding with the start of the school year. However, Miller grew impatient and instead attacked the Safeway supermarket directly across from his apartment.
Another example is the New Year’s Day explosion of a Tesla Cybertruck in front of the Trump Hotel in Las Vegas. Occurring just hours after an ISIS-inspired vehicle ramming attack in New Orleans, investigators initially feared a connection between the two incidents. However, they quickly determined this was an elaborate suicide by active-duty U.S. Army Green Beret Matthew Livelsberger. Investigators uncovered multiple notes written by Livelsberger explaining his motives. He stated:
“This was not a terrorist attack; it was a wake-up call. Americans only pay attention to spectacles and violence. What better way to get my point across than a stunt with fireworks and explosives?”
He also expressed a desire to “cleanse my mind” of the memories of lives lost and “the burden of the lives I took.”
Despite the discovery of these detailed writings, conspiratorial chatter persisted on online platforms and from some public figures. Investigators and threat managers appropriately considered all possibilities, given the incident’s timing and political implications. The recent alliance between Donald Trump and Tesla CEO Elon Musk made a political motivation the primary initial theory. However, once Livelsberger’s writings came to light, investigators rightly dismissed any political motives. Sometimes a horse is just a horse.
Implications for Threat Management
There is no profile for the perpetrator of a mass attack. While many fit certain demographic patterns, assumptions based on ethnicity, religion, or political ideology can lead threat managers astray. While it is true that most masked attackers tend to be young white males assumptions based on solely on demographics can be incomplete or even misleading for threat assessment purposes.
The only reliable factors for threat managers and threat management teams to consider our behavioral. Specific behaviors as described in the Pathway to Violence Model and the distal and proximal warning factors in threat assessment tools such as the TRAP-18 and the WAVR-21 are the only reliable tools for threat assessment. Threat managers should obviously consider factors such as demographics and political ideology but only within the context of identified behavioral threat indicators.
In the case of the Germany attack we did in fact have a zebra, an individual that did not fit a commonly accepted profile. Did the German police miss critical warning signs because they did not fall within a preconceived profile of what this attacker should be? History will be the judge.
Threat assessors must consider all possibilities, particularly during the initial stages of an investigation. It is a wise practice to explore multiple, sometimes contradictory lines of inquiry in this stage. When properly coordinated, this approach can be a productive investigative best practice period however, as new information emerges, assessors must remain disciplined and decisive in discarding avenues of investigation disproven by established facts. Failing to do so wastes valuable time and resources.
In most cases, a horse is just a horse. But if it has stripes, it might be a zebra, and while unicorns may be myths, if you see a horse with a horn, you must be ready to consider the possibility.
