Monitoring the Unpredictable: What Can Law Enforcement Do to Track Potential Active Shooters?

pdf icon - download pdf

Robert REyna


Over the last 20 years, few incidents have caused law enforcement more challenges than an active shooter incident. Mass casualty incidents instantly capture the media’s attention, and depending on the severity of the attack, may thrust an agency into the national spotlight. As the investigation progresses, the shooter’s identity is quickly uncovered, along with any potential warning signs missed by those closest to the suspect. In time, attention turns to law enforcement and any prevention efforts attempted by police or lack thereof. Ultimately, the public begins to ask agencies what course of action they took to prevent the attack? The only way an agency can truly prepare itself to answer that question is to plan accordingly before an untimely attack.

Since the Texas Tower incident in the mid-1960s, agencies have dealt with active shooter attacks that have steadily increased in frequency and severity.[1] After each watershed event, investigating agencies were forthcoming with lessons learned and later shared those experiences with allied agencies through after-action reviews or government-sponsored publications. Naturally, law enforcement trainers focused efforts on response and incident command issues. Most agencies gravitated towards issues quantified by metrics, such as improving response times, safer tactics, or casualty prevention. Rarely did organizations focus on active shooter intervention efforts or investigative red flags, primarily because these concepts were not readily available or fully developed.

In the mid-1990s, the United States Secret Service tasked forensic psychiatrist Robert Fein and United State Special Agent Bryan Vossekuil with a study that examined pre-attack behaviors shared by targeted threat suspects, potential assassins, on public figures.[2] That research helped set the foundation for a publication they authored for local law enforcement on conducting threat assessments for possible targeted threats suspects. After the Columbine incident, experts built upon Fein and Vossekuil’s research and tailored prevention measures on the active shooter threat. Most threat assessment guides offered recommendations that agencies could modify according to need. The main goal was to provide a pathway so law enforcement had a definitive plan and avoided scrambling to develop protocols based on limited resources. Some departments took advantage and implemented a threat assessment program, but most did not make the appropriate changes.

Factors that this study focused on were the gaps created by a lack of a tracking or monitoring process after the investigation of a targeted threat. In nearly all threat assessment models, experts agree that investigators must assess the dangers an individual poses to the public and determine if that person requires monitoring. The goal of a tracking process is to establish a plan if the suspected active shooter begins to exhibit concerning behaviors and mobilize resources before he turns to violence.[3] These resources can come in the form of mental professionals, councilors, or school staff who can help a person in crisis and prevent an active shooter attack.

The thesis answers the question: What can law enforcement do to track potential active shooters? Initially, the purpose of the research was to identify best practices to help agencies establish protocols to help prevent active shooter attacks. The study uncovered a series of guidelines established long ago by numerous experts that give recommendations to law enforcement on case management, threat assessments, and even a monitoring process. The research caused the study to pivot and focused on why most law enforcement agencies were not implementing these practices and what gaps materialized that led to an attack. The thesis presents case research from the Marjory Stoneman Douglas (MSD) shooting, the Virginia Tech shooting, the Odessa-Midland shooting, and the Las Vegas Mass shooting to examine apparent gaps in the prevention process. In most incidents, the shooter exhibited red flags where intervention efforts could have helped a person in crisis, but in other cases, forecasting an attack was impossible to predict.

Besides showing the importance of law enforcement establishing a plan to monitor potential active shooters, the case studies helped identify gaps in the threat assessment process. The study categorizes each case study to gauge the effectiveness of intervention based on what information investigators had during the initial investigation. Many active shooter studies point to evidence where most active shooter suspects display concerning behaviors, commonly referred to as red flags, before committing a mass shooting. Additionally, because of the magnitude of an active shooter event, most people believe intervention measures can always help prevent an attack. The study uncovered that in some cases, they were simply unavoidable. For example, in the Las Vegas Shooting, the suspect was wealthy, had no criminal history, and kept to himself. He left no manifesto, diary, or reason why he decided to turn to violence.[4] In this case, mobilizing resources to prevent an attack would never occur because no one knew this individual was in crisis. The reality that not all mass shootings may be prevented solely on a threat assessment process is disturbing. However, the study explains why intervention methods are successful in some cases and not others. Additionally, it helps reinforce the need for law enforcement to continue other measures related to response to mitigate casualties, such as police active shooter training, public awareness training, and site assessments to improve security measures.

The research findings identified noticeable gaps that existed in the tracking or monitoring process in most prevention efforts. The main reason why agencies did not have a tracking or monitoring plan in place varies, but at the core of every decision is whether a department believes a monitoring process is a priority. With so many different problems that law enforcement consistently faces, allocating resources for a threat assessment program or monitoring process may not seem significant to some departments. Many agencies face staffing shortages, and placing resources to monitor suspects who may be involved in low-frequency events may be difficult for a department to justify. A second obstacle that the study uncovered is related to information sharing, which had as much to do with organizational culture as procedural or technological hindrance. Many of the same silos or information-sharing issues that plagued federal law enforcement before the 9/11 attacks are the same obstacles local law enforcement is experiencing.[5] Finding ways to use intelligence resources like fusion centers to distribute information is a problem that some agencies still need to resolve. The final issue that surfaced was a lack of a standardized tracking program. Although plenty of federal agencies have published guidelines for establishing a threat assessment program that encompasses a monitoring process, most experts have not adopted a universal standard. While few departments operate the same, some police procedures are universally adopted as best practices. For example, a rapid response to an active shooter event was accepted by many agencies after the Columbine incident, and although not mandated, most agencies followed suit.[6] Finding a common practice accepted by leading experts might help agencies hesitant of establishing a monitoring process for fear of civil or legal implications.

The findings concluded that the gaps identified in the monitoring and tracking process were causing significant issues in active shooter prevention efforts. In some instances, establishing a threat assessment program was not the only answer, as the follow-through and notification process was lacking. For example, in the case of the MSD shooting, the school had a threat assessment process established but no oversight occurred at the district level to ensure the program was working effectively.[7] Furthermore, even though the police had access to student records via its School Resource Officer, little was done to share information about the threat assessment process.[8] The notification process after any investigation to warn stakeholders or allied agencies is an important piece that often is forgotten.

The analysis of the findings has revealed a series of recommendations for closing the active shooter prevention gaps. First, agencies need to establish a threat assessment process that encompasses a tracking and monitoring program to mitigate a mass casualty incident. The plan should include stakeholders with the resources to aid a person in crisis and help assess an individual’s progress. Moreover, investigators need to ensure they establish a process to cease monitoring if the subject is no longer deemed a threat. Second, law enforcement needs to make information sharing and notification a priority. Establishing a network that extends beyond the initial threat assessment stakeholders enables investigators to receive and distribute information quickly. Many states provide law enforcement with an avenue to obtain private information from public agencies during emergencies or when related to a criminal manner. Investigators must learn to use those resources to gather as much information as possible while also collaborating with stakeholders.

With each watershed moment, active shooter prevention techniques evolved, and some were adopted as best practices. The monitoring and tracking process did not gain the recognition as did other prevention efforts, but they hold a significant place in mitigating future attacks. While agencies may find it challenging to allocate resources to a threat assessment process that includes a monitoring component, the alternative is to answer questions on why preventing an attack has not been a priority. The key to protecting an agency and community is not necessarily the resources spent on an active shooter prevention plan but that an agency had implemented a plan.

[1] Audrey McGlinchy, “Changes in Police Response,” Texas Tower Documentary, accessed January 15, 2021,

[2] Robert A. Fein and Bryan Vossekuil, “Assassination in the United States: An Operations Study of Recent Assassins, Attackers, and Near-Lethal Approaches,” Journal of Forensic Sciences 22, no. 2 (March 1999): 321,

[3] James Silver, Andre B. Simons, and Sarah Craun, A Study of the Pre-Attack Behaviors of Active Shooters in the United States between 2000–2013 (Washington, DC: Federal Bureau of Investigation, 2018), 17,

[4] Vanessa Romo, “FBI Finds No Motive in Las Vegas Shooting, Closes Investigation,” National Public Radio, January 19, 2019,

[5] The Commission on Terrorist Attacks upon the United States, The 9/11 Commission Report: Final Report of the National Commission of Terrorist Attacks Upon the United States (Washington, DC: 9-11 Commission, 2004), 408.

[6] John P. Blair et al., Active Shooter Events and Response (Boca Raton: CRC Press Taylor and Francis Group, 2013), 12.

[7] Marjory Stoneman Douglas High School Public Safety Commission, Initial Report (Tallahassee, FL: Marjory Stoneman Douglas High School Public Safety Commission, 2019), 282,

[8] Marjory Stoneman Douglas Public Safety Commission, 272.

No Comments

Post a Comment