THREAT AND
CRISIS UPDATE
IOBSE
LARRY BARTON, PH.D.
COPYRIGHT © 2017
Why Threat Assessment Matters
We have a daunting responsibility. As the chief security officer of a major entity, please
remember the essentials:

Duty to Care: it is not enough to share with employees the notion that: “we care about
your safety and well-being.” If you are not offering training programs on the signals of a
potentially disruptive customer or associate and communicating known or suspected
threats in a timely manner (someone informs you of a potential suicide because of a
comment on a blog, for instance) the employer could be found culpable of failing to
care, as required by statute.

Duty to Warn: once you are aware that a person at risk has made a threat, in a staff
meeting, a briefing or even if they are on PTO—if they work for you (including a
contractor in many jurisdictions), you may have a responsibility to intervene. This
includes warning co-workers if the threat mentions direct harm. How you communicate
a threat to co-workers in this arena is an art. It must be done with speed without being
alarmist. It often requires the engagement of legal counsel and a communications
specialist.

Duty to Act: an associate informs you that her ex-husband has threatened to come to
work and kill her; she presents you with her personal restraining order (PRO) but says,
“Please don’t do anything—I just wanted you to have this for the records. I’m afraid he
may actually do it if you tape a poster and photo at the door.” The employer is in a nowin position, and this is a common quagmire. Determining what can be done, and
when, merits serious evaluation.

Duty to Supervise: several years ago, we rarely heard used this term. Today,
unfortunately, litigators are aiming at your organization with this as their core theme.
The duty encompasses a broad array of statutes and requirements. It means that
legitimate disputes and claims should be reviewed in a timely manner. It also means
that when a person begins to act strangely, or talks about self-harm, that the
supervisors who work in your company simply cannot look the other way. And don’t kid
yourself—some do, and will. “Let’s keep this at the site level. There’s no reason for HQ
to stick their nose in our business” is common. It may be, in many ways, one of the
most fundamental culture gaps in the very best of companies.
Threat Assessment is thus a legal duty as well as an affirmation of all aspects of your Human
Resources processes. Clearly, “slapping together” an ad-hoc team when a threat is received is
certainly not prudent.
1
A Threat Assessment Team (TAT) often consists of a senior representative of senior leadership,
HR and the Law Department with this author assisting that team on higher risk situations. We
often write scripts on how to approach a person who is struggling- as a victim of domestic
violence, for instance, or even as a person making a threat who may benefit from the Employee
Assistance Program or more direct intervention. The TAT can make an enormous difference by
serving as an extension of your risk management architecture. How?
1
The TAT reduces exposure to physical harm. Since injuries and fatalities cause
enormous personal pain and litigation exposure that can trigger years of expensive
defense work, the team has an intervention opportunity that should never be
underestimated from a safety and financial perspective.
2
Associates generally appreciate the fact that a TAT is part of your organizational
landscape. Rather than exclaiming, “My God, is it so bad around here that we must
have a threat team?” what I often hear from associates is, “I’m glad someone is
ready to look at a critical case if we experienced one.” We need to remember that
associates are far more sophisticated in identifying a co-worker at risk than we give
them credit for. They realize that angry customers make extreme comments and
sometimes act on them. They are aware that volatile persons are often known or
suspected in advance to have shared violent ideation in advance, often due to
alleged performance appraisal mismanagement or separations (e.g., an AnheuserBusch distributorship in Manchester, CT in 2010, a Kraft Foods plant in Philadelphia
in 2010, or the murder of six persons at Accent Signage in Minneapolis on
September 12, 2012 after an associate was told he was fired.)
3
Persons at risk have repeatedly been “talked down” from acting on a threat by a
skilled TAT. I have personally supported dozens of companies over the years in
hundreds of cases of suggested, or overt, violence. In many borderline situations
where a person was hinting about self-harm or hurting others, but had not explicitly
stated such, the TAT played an enormous role in helping a “person with a problem”
avoid becoming “the problem person” by listening and intervening, sometimes with
psychological or psychiatric care, and on other occasions, deciding that corporate or
law enforcement engagement was safer and more suitable.
Differentiation
Note that each of us, as someone interested in workplace safety, must try diligently to
differentiate “the person with a problem” from “the problem person.”
Various empirical studies suggest that about one in five workers will come to your organization
tomorrow with some serious problem in their personal life that will negatively impact their work
performance for three or four days. This may include relationship stress, financial problems—
possibly their teenager was arrested for a DUI over the weekend. Whatever the issue, these
individuals bounce back from these detours in their life. They are “the associate with the
2
problem” but they are not “the problem person” who becomes permanently derailed by deviant
or unusual behavior patterns.
By contrast, the problem person is the nightmare we fear. Their actions or statements cause
alarm. These persons can be draining to supervisors and coworkers. Their attitudes and actions
can cause dismay for customers and distractions for others. Their behaviors can lead to
accidents, violence, fraudulent behavior, lowered morale and potential litigation. They can be
bullies one moment, without affect the next. Whatever the source of the problem, we are now
uniquely focused on “what next?” for the employer.
Let us look at some challenges associated with how threat assessment is currently gauged
before we look at emerging strategies that could enhance safety at work.
Content Analysis: There is considerable benefit to measuring how many times a person
suggests they are aggrieved in an email or on a blog, and words such as “hate,” “kill” and
“revenge” are meaningful, for sure. Countless attempts to murder public officials, and
numerous others, have been thwarted by the U.S. Secret Service, FBI and other agencies with
advanced forensic tools. However, an exclusive or heavy reliance on such systems alone
suggests that virtually every perpetrator will communicate their anger or plan in advance. This is
clearly not always the case, and, as the Secret Service suggests in its training, there is a notable
difference between someone who poses a threat versus one who constitutes a threat.
For the past several years, four researchers have assisted me in the analysis of over 1,300 cases
of threats and assaults at work; in approximately 80% of all cases, perpetrators communicated
intent in advance (variability by year was 76–81%). However, only about half of persons at risk
communicated in writing on a blog or letter—the remaining persons yelled at a co-worker,
talked about suicide to a supervisor, or made some other comment or gesture that caused
alarm and concern.
It should also be noted that the volume of written communication used by associates or other
grievance collectors (such as the August 2012 murders at a Sikh temple in Wisconsin) has
mushroomed to enormous new heights in recent years with the proliferation of Twitter,
Facebook, and blogs. Threat assessors can no longer sit back and claim that “Dr. Smith is
analyzing those emails and letters—he’ll know what to do.” Reliance on content analysis alone
can lead to one-sided . . . and thus imbalanced conclusion. It is the interpretation of findings
that is influenced by looking at behavioral patterns and milestones that enriches threat
assessment. The questions that an HR or Security lead should be asking may include:




3
How do we know if we have an accurate representation of what this person has
written?
Do they have one or more web sites, blogs or screen names?
Who are their “friends” on their social networking sites? Are we also analyzing what
those persons are writing?
Do they mention specific managers or co-workers in their messages or do they bifurcate
the employer as they discuss their personal demons?


Are we checking to see if the individual is involved in any litigation, foreclosure or
bankruptcy notice or other public filing? Do we know what has been written by them,
or their co-workers, in any filings with an internal ethics or compliance group?
Has any department leader been contacted by the person who is making or posing a
threat?
Substance Abuse: We know from a variety of empirical studies that well over 70 percent of all
the persons now in federal prisons in the United States were drunk or on illegal drugs when they
killed; these statistics include domestic and neighborhood killings as well as workplace
homicides. Because a disinhibitor can cause people to do things they would otherwise avoid if
cognizant and not indulging, and because their use is often undetected until after a critical
incident, the reality is that we have relatively few ways to keep this issue in check.
On a positive note, the rumor mill can play an especially curious role. Many associates,
especially immediate co-workers, have tremendous insight into the substance habits of
coworkers. If you are worried about a person who is agitated, is a grievance collector and who
is targeting a specific person or group and you are made aware of potential substance issues, my
suggestion is that your assessment process should assume as urgent, priority status.
RISK FACTORS
At various threat and violence conferences, broad statements are made about perpetrators, and
such commentary has caused considerable confusion among leadership. Well intentioned,
these speakers are often chiefs of police, sociologists, criminologists and retired federal
profilers. Many of them discuss cases that include serial killers, school shooters and other
perpetrators whose baseline characteristics have little or nothing in common with workplace
perpetrators. The confusion caused by their presentations is best seen when a serious case
emerges in their entity and the TAT begins to look at factors that they recall from past cases that
have nothing to do with this circumstance. Simply put, the mother who drowns two of her
children in a pond clearly has mental illness, but comparing her behavioral patterns to a worker
who feels betrayal and acts in retaliation to a co-worker is scientifically unacceptable.
Let us begin with the role of geography. What follows pertains only to the USA, but we have
conducted considerable research into numerous parts of the world. For 2016 alone, what
follows is a report from 24/7 Wall St:
“Based on CDC data… the 10 states with the most firearm-related deaths… including suicides,
homicides, and accidents, appear below. Firearm death rates represent the CDCs age-adjusted
figures, to avoid distortion in states with large populations of young people. We also considered
4
data from the Bureau of Alcohol, Tobacco, Firearms, and Explosives (BATF) on the time between
a gun’s purchase and its involvement in a crime. Violent crime data are from the Federal Bureau
of Investigation’s Uniform Crime Report. Poverty and income figures are from the U.S. Census
Bureau’s American Community Survey. Information on firearm policies for each state are from
the National Rifle Association’s (NRA) Institute for Legislative Action.”
10.
South Carolina
9.
New Mexico
8.
Alabama
7.
Arkansas
6.
Montana
5.
Oklahoma
4.
Wyoming
3.
Alaska
2.
Mississippi
1.
Louisiana
Then we add to the mosaic. Unlike loss prevention perpetrators, the potentially violent
perpetrator poses a unique challenge to the TAT because associates know about access and
vulnerability of the site. They do not need to study routine; they know it instinctively. And,
unlike an LP headache, the associate offender typically does not care about the consequences of
their crime: they are often very aware that they may be killed (e.g. suicide by cop) because of
their actions.
Just think for a moment about what we know—and don’t know—about the people we work
with. Here’s what we know, in almost all cases, about our co-workers:
What We Know






5
Name, DOB, Social Security number
Salary, title, work location, work history
Education, if validated
Active, or not, on major social networking sites
Supervisor name/relationship
Benefit plan, beneficiaries, PTO status

Salary infringement, if court-ordered
What We Don’t Know








Where they currently live, and with whom?
Who are they fighting with
What medications they are on/off
Their true financial condition
Their true emotional well-being
Who has betrayed them
Who they have betrayed
Some social networking activity
Obviously, we should be preoccupied during the TAT process with how we complete the gaps
about what do not know—and need to know—to make an informed decision about appropriate
actions when a person at risk poses a serious challenge to the employer.
In recent cases where an employer contacted me regarding an agitated associate or contractor,
we discussed risk factors. These factors are well known, but it is useful to summarize the most
prominent of them:








recent, negative milestones such as divorce, relationship ending, child custody battle,
order of protection or financial insolvency
a negative performance review that becomes all-consuming for the associate
an incident where they are humiliated or bullied on the job, notably in front of others
acute onset of mental illness or exacerbation of pre-existing mental illness
substance abuse on and/or off the job
declining physical health
outbursts, notably those directed at specific persons such as a supervisor or co-worker
anger that has been communicated to others, whether in writing on a blog, in letters or
emails, or verbally
RETAIN OR RELEASE THE ASSOCIATE?
When a serious case is reviewed by the TAT, that group must work within a legal, HR and
cultural framework influenced by several considerations. What is the safest thing we can do to
protect all associates? Will dismissing the associate only inflame him or her? Are there
language, culture, expatriate and tribal issues that may influence a positive outcome? Can we
ask or mandate that the person work from home until we complete our review? What are the
6
perimeters of a Fitness for Duty Evaluation or Return to Work agreement? Will the union
support our decision?
In a surprising number of cases where I am called to assist a TAT, there is typically at least one
senior executive who will summarily state that the person’s actions have been so disturbing that
the individual should be “terminated now, today, and let’s ensure that their photo is available at
the security desk. We have an obligation to 300 people—and let’s have the attorneys deal with
the legal issues. We have a business to run.”
My recommendation to any TAT is that immediate dismissal should be seriously considered in
specific, limited circumstances. There are multiple—literally, dozens, of alternative strategies
that could be employed to protect the body politic and still allow the team to evaluate optionssafely.
What I can tell you is this: terminating and exiting a potentially violent person may give you a
sense of finality because you have taken their security badge, closed their email account and
ended their credit card access. However, you now have no sense of where they are, how they
look, how they are acting, what they are writing or saying, who they are upset with, whether
their mental deterioration has escalated or stabilized. In short, you know far less when
communication and engagement ends with that person. They may be rushing to their attorney’s
office or filing for unemployment, but they may also be rushing to the shooting range for target
practice. You know far more when that person reports to work under controlled circumstances
where you increase security and surveillance. You lose considerable opportunity to monitor the
individual when they are sent home to drink, drug, sulk, complain, plan.
If you carefully analyze various studies by the Justice Department and others, you will realize
that in recent years, aggravated assaults account for about 94% of workplace victimization while
rape and sexual assault account for about 2% of incidents. Over the past four annual studies by
the Bureau of Labor Statistics, you find that about one-third to one fourth of workplace
homicides are attributable to real or perceived disputes between co-workers, strongly-held
grudges, extreme beliefs/delusions or mental illness.
We must also realize that statistics on workplace assaultive behavior are sparse and unreliable
because of a wide number of factors that include:



underreporting, especially because small and family-owned businesses are less likely to
report incidents and assaults to OSHA and law enforcement
inadequate study designs
differing definitions of what constitutes an injury, being especially sensitive to the
country where the threat originates
Thus, ingredients of successful threat assessment include these: a collaborative interdisciplinary
approach towards problem solving, a realistic assessment of facts and a sense of timeliness.
Because the company employs a diverse and energized associate base, the need for managers
to be even more attuned to unique cases, strange comments and even bizarre threats is high.
In the midst of a pending threat, standard operating procedures, task forces and multiple
conference calls may be a luxury. Lives may be endangered; perpetrators have no respect for
7
your calendar, vacation or hours of business. The TAT has every opportunity to use the
concepts in this White Paper and find an appropriate resolution to even the most complex
cases.
Today, progress is being made in many counties regarding threat assessment, executive
preparedness and associate awareness. When we face resistance from any member of
management that possibly the topics of violence may create unnecessary panic in the
workplace, we need to counter such negativity with a blunt reality: our children are being
trained on active shooter situations in kindergarten. Certainly, we can discuss the warning signs
of the client, associate or former associate who poses a risk in a non-threatening, but
informative manner, in the workplace.
Finally, because about half of the membership of the organization has responsibilities for human
and other assets outside of the United States, please remember that ongoing changes to
statutes regarding bullying, harassment and case management of persons who pose a risk are
underway. I will be pleased to assist any member with briefings we have recently presented in
EMEA, AsiaPac and the Latin and South American regions, for example. A good example of a
legislative effort underway is Rule 26 in Canada, currently pending before the Canadian
parliament. The law will impose mandatory time off for employees who inform the employer
that they have been the victim of emotional and sexual abuse at home or work. In general,
Canada is more progressive than the U.S. in terms of how their OSHA counterpart governs
workplace violence, and mandated training in Ontario for all employers with three or more
workers, currently in place, will likely be extended to all provinces by 2018.
____________________________________________________________________________________
BEHAVIORAL THREAT ASSESSMENT: INITIAL INTAKE QUESTIONS
_____________________________________________________________________________________
Based on research by Randy Borum, Robert Fein, Bryan Vossekuil and John Berglund, the following
represents the most definitive insight on ten essential questions that each TAT should consider when
evaluating a person who may pose a risk. The initial questions are from the original research studies of
these specialists with the U.S. Secret Service, with interpretive questions added by this author.
Question 1: What motivated the subject to make the statements, or take the action, that caused
him/her to come to our attention?
Question 2: What has the subject communicated to anyone concerning his/her intentions? This includes
social networking/blogs, verbal comments and ideation shared to strangers.
Question 3: Has the subject shown an interest in targeted violence, perpetrators of targeted violence,
weapons, extremist groups, or murder? Have they referenced other recent or historical violent events
as examples of why others are motivated to hurt others (validation)?
8
Question 4: Has the subject engaged in attack-related behavior, including any menacing, harassing,
and/or stalking-type behavior? This may include phantom communications or overt “chance” meetings
intended to cause alarm/paranoia.
Question 5: Does the subject have a history of mental illness involving command hallucinations,
delusional ideas, feelings of persecution, etc. with indications that the subject has acted on those
beliefs? This often includes illusions of grandeur, a savior complex and a righteous true believer.
Question 6: How organized is the subject? Is he/she capable of developing and carry out a plan? Many
of those with mental illness and a plan to harm also have a high IQ and lack OCD.
Question 7: Has the subject experienced a recent loss and or loss of status, and has this led to feelings of
desperation and despair? High occupational identity can be a major factor in this regard, as well as
ongoing disputes with loved ones and pending civil/criminal charges, often involving children and
spouses.
Question 8: Corroboration: What is the subject saying and is it consistent with his/her actions? Be
observant of changes in content, writing style, references to historical events, specific persons and
potential targets and mention of a parallel universe, dinosaurs and celebrities.
Question 9: Is there concern among those that know the subject that he/she might act based on
inappropriate ideas? The best predictor of future behavior is near past behavior: what has the person
recently done or said that is noteworthy?
Question 10: What factors in the subject's life and/or environment might increase/decrease the
likelihood of the subject attempting to attack a target? This may include recent medical or psychological
diagnoses, bankruptcies, denial of legal or work-based claims and recent losses in hearings with a union,
court or other formal organizations.
Below: Omar Thornton, an employee of Hartford Distributors, who shot and killed eight co-workers on
October 3, 2010 prior to a suicidal act. This case is discussed during our IOBSE briefing.
9
10
https://upload.wikimedia.org/wikipedia/en/e/e9/Omar_S._Thornton.jpg
ABOUT THE AUTHOR
Larry Barton, Ph.D. is one of the world’s leading experts in threat assessment and workplace
violence prevention. He is the highest rated instructor at The FBI Academy in Quantico, Virginia
and U.S. Marshals Service where he teaches threat assessment and crisis leadership. He works
with law enforcement agencies throughout the United States and authors a monthly column in
the FBI-LEEDA Magazine.
A former faculty member at Harvard Business School, Penn State and Boston College, Dr. Barton
was named Distinguished Professor of Crisis Management and Public Safety at the University of
Central Florida (UCF) in January, 2017. Dr. Barton assists teams with real-time counsel during
serious incidents and threats at work, and is the 24/7 threat assessor for many leading
multinational corporations and agencies. He teaches crisis intervention for law enforcement
agencies nationwide and is a certified instructor for Breaking Bad News ®.
Today, his consulting practice includes threat assessment; real-time counsel to employers facing
complex threats, and highly acclaimed training programs for executive teams. He has offered
over 1,800 training programs for organizations worldwide. Dr. Barton was on air commentator
for such crimes as the 2012 Sandy Hook, CT murders (CNN), the 2013 Washington Navy Yard
massacre (CNBC) and the 2016 Pulse massacre in Orlando (CNBC), among many others. He
serves on the editorial board of five peer reviewed journals internationally, including Violence
and Gender.
Dr. Barton is the author of four widely acclaimed books on risk and threats at work; his most
recent book, Crisis Leadership Now, was named one of The Best Business Books Of The Year by
Soundview Executive Books. His research has been showcased at The American Bar Association,
The Conference Board, US State Department OSAC and numerous other organizations. He is the
recipient of numerous awards for advancing public safety from law enforcement, corporate and
non-profit organizations.
For more information, please call
Dr. Larry Barton at 602.740.4888 or email
[email protected]
11