Mass Casualty Threat Assessment and Prevention: Moving Beyond Guessing

by | October 17, 2018

Triple beeps blare over a primary police frequency and the dispatcher activates the emergency tone.

“Shots fired at XYZ Company, multiple casualties.”

As a chief officer you get the text alerting you to a critical incident. You dial in that frequency as you speed to the scene. Your worst fears have become reality. Or, have they?

You soon learn your department was aware of this shooter, have contacted him and were even alerted to his violent tendencies. You could have prevented this terrible incident. You and your personnel spend countless hours training on active-shooter response, but in typical police fashion, little time learning how to prevent such events. And yet active-shooter incidents are often over before the police arrive.

Here in Santa Cruz, we recently experienced an event that made us think about how our officers and investigators respond to threats, or to reports from citizens who are fearful a person they know may become a shooter. As chief, I entrust the decision-making to officers not specifically trained in threat assessment. But this recent event made me realize we weren’t adequately equipping officers to analyze and respond to potential active-shooter threats. And I don’t think I’m alone. Police executives have collectively failed to teach officers how to assess a mass casualty threat and, more importantly, what to do about it.

The School Shooter

It’s not surprising that we have difficulty identifying potential shooters through our regular processes. According to a recent FBI study, specific mental health diagnoses are apparent in less than 50 percent of cases. Criminal histories are present in less than one of four shooters. These are the two primary strategies an officer will consider when investigating a threat. At a recent incident in one of our schools, we realized just how inadequate these strategies are.

Ralph (not his real name) was upset at fellow students. The 11-year-old became enraged and threatened to kill a fellow student by name. He then proceeded to have an emotional breakdown, tearing up the classroom and barricading himself, while the teacher efficiently evacuated students to safety. Officers arrived on scene and deescalated the situation, talking Ralph into getting help.The next day at an operational debrief, a member of the command staff inquired about the severity of the threat and what kind of follow-up was conducted to ensure school safety. We collectively realized there was no measuring stick to determine the validity of a school threat. Even with a threat from an 11-year-old, officers take a wild guess, not knowing for sure, but hoping they are right. In this case, officers got consent to search his home and located a loaded 9mm handgun. Still, we lacked the ability to determine if there was a genuine threat. Clearly, not all people with access to a gun pose a risk of becoming a shooter. There is a difference between making and posing a threat.

Active-Shooter Characteristics

After the event with Ralph, Santa Cruz police began the process of researching how to conduct an accurate threat assessment. We believed officers needed a process or a plan to analyze the severity of the threat based on behavioral evidence. We do not want them to guess if the person is the next shooter. Up to this point, like most police agencies, we were guessing.

Officers quickly learned what they thought was true about the shooters was inadequate for determining whether someone poses a risk. Research shows that often, active shooters follow a path of behaviors, and if those behaviors are identified quickly enough, there is the potential to prevent shootings.

Characteristics common to active shooters include:

  • Shooters, on average, had 3.6 major stressors in their life. Examples include loss of a job, loss of custody of a child, a blow to one’s personal esteem, public humiliation, financial ruin, an arrest, death of a family member, a perceived injustice, and working in high-stress jobs such as deployed military and police officers. From death of loved ones to loss of respect and humiliation, mass casualty actors were predictable.
  • On average mass casualty actors displayed four to five concerning behaviors prior to the attack.
  • 77 percent of shooters planned and prepared for the attack in advance of the incident.
  • 46 percent of shooters took a week or longer to prepare for the attack.
  • In 64 percent of cases, shooters specifically targeted a person or persons.

Researchers also discovered several red flags that could indicate a disgruntled person is ready to act. They include surveilling the attack location, especially when armed, or attempting to defeat security measures. In addition, when the shooter associates a grievance against an individual with a group, institution or community, it raises the level of concern and could signal the nearness of an attack.

Either situation is a call for police intervention. Think of this in terms of terrorism—what concerns us is access to radicalized propaganda, pre-operational surveillance, overt actions and behaviors, changes in behavior and signaling intent to act.

New Procedure and Training

The situation with the 11-year-old underscored we needed a better way to assess threats. Based on research from the FBI and publications from the U.S. Secret Service, National Institute of Justice, and academic journals, we developed a new procedure to ensure thorough follow-through when a potential threat is identified.

This tool asks officers to consider 12 questions:

  1. What motivated the subject to make the statements, or take action, that caused him/her to come to our attention?
  2. Was there a triggering event (recent or historical) that caused the person to make threats?
  3. What has the subject communicated to anyone concerning his/her intentions?
  4. Has the subject shown an interest in targeted violence, perpetrators of targeted violence, weapons, extremist groups, or murder?
  5. Has the subject engaged in attack-related behavior, including any menacing harassing, and stalking-type behavior?
  6. Does the subject have a history of mental illness involving command hallucinations, delusional ideas, or feelings of persecution?
  7. What is the level of the subject’s organization skill? Is he/she capable of developing and carrying out a plan?
  8. Has the subject experienced a recent loss and or loss of status and had this led to feelings of desperation and despair?
  9. What is the subject saying and is it consistent with his/her actions?
  10. Is there concern among those who know the subject that he/she might take action based on inappropriate ideas?
  11. What factors in the subject’s life and environment might increase/decrease the likelihood of the subject attempting to attack a target?
  12. Does the subject possess or have access to weapons?

Unlike criminal cases where the officer builds the case around the suspect and collects evidence for a conviction, mass casualty threat assessment seeks objective information to dispassionately determine the legitimacy of the threat. Changing the mindset from a competitive nature (build the case) to more analytical and objective is a shift in thought and process for detectives and officers. This is a key the police executive should stress in training. Of course, if evidence is discovered that demonstrates the need, investigators can switch from fact-finder to detective again.

We rolled out the new threat assessment protocol with a training curriculum consisting of about 4 hours of classroom-based instruction.

The Disgruntled Worker

Shortly after training our personnel on the new protocol, we had an opportunity to test it in action.

Recently Sam (not his real name), an employee going through a disciplinary process, raised red flags for managers, fellow employees and legal representatives. Santa Cruz officers became aware of the concern when HR asked for an officer to “standby” during an appeal hearing. As we learned more about the individual and his behaviors, our level of concern grew exponentially. Like a terror case, this threat had to be assessed and run to ground as quickly as possible. We no longer let these cases lag but work around the clock to bring closure.

Using our new assessment tool, officers identified the subject had seven documentable stressors in his life. There were 20 firearms registered to him. Roommates noted he was acting bizarrely, including arming himself while “chasing demons.” He mentioned he was angry at his boss for being terminated, although did not speak of it often. He did not, however, conduct preoperational surveillance that we knew of, nor did he extend a threat to coworkers or fellow employees.

Sam exhibited enough warning signs for us to believe the potential was there for him to be a mass casualty subject. We gathered a team and stopped him away from his house. We had previously obtained a gun violence restraining order (GVRO). He submitted to our requests and allowed us to temporarily seize his guns and refer him to counseling.

Was Sam going to be an active shooter? We don’t know. But as chief I would rather prevent a shooting than respond to it. Mass casualty threat assessment training for our officers is a good start.

Eliminating the Guesswork

Threat assessments must be more than a gut feeling or hair-raising hunch. Our officers need a plan that guides them in the examination of behavioral commonalities common among shooters. Our mass casualty threat assessment will evolve as we have an opportunity to refine it. We may not be able to prevent the next mass casualty incident, but we can do everything within our power to try. Moving from guessing to assessing based on research and practical experience is a good first step.


ANDREW MILLS was appointed chief of the Santa Cruz (CA) Police Department in 2017 after four years as chief at the Eureka (CA) Police Department, where he implemented progressive policing strategies. He was with the San Diego Police Department for nearly 30 years, including serving as lieutenant for Gang Investigations, Lieutenant for Criminal Intelligence, and a Captain. Follow Andy via his blog at


BRADLEY BURRUEL is a police officer, field training officer and emergency services unit (SWAT) operator for the Santa Cruz (CA) Police Department. He has worked as a police officer for 12 years and has been a POST-certified defensive tactics instructor for 8 years. Bradley grew up in Castro Valley, CA, and received a bachelor’s degree from the University of California-Berkeley, where he helped lead the Division I varsity rugby team to three national championship victories. He is married and has two children.




Use of Force Policies: Dispelling the Myths

Share this post:

The Briefing – Your source for the latest blog articles, leadership resources and more