Is he going to come back and shoot up the place? That question, or one similar, is typically what we hear when someone is contacting us regarding surveillance about a workplace violence case. Some may envision a depiction of surveillance like Popeye Doyle in The French Connection trying to catch the drug dealers in the act, however when used as a tool for threat management, surveillance can both protect and provide critical assessment information that helps make threat mitigation possible.
Threat assessment (a fact-based approach of assessing the credibility of threats and interrupting persons who are on a path toward committing an act of targeted violence) can help to identify and mitigate concerning behavior before it escalates to a violent act. In the Department of Defense’s Personnel and Security Research Center newsletter, The Insider, Dr. Russell Palarea, President of the Association of Threat Assessment Professionals, says attacks committed by insiders “afford coworkers and supervisors the opportunity to observe the concerning behavior escalating over time, and thus implement threat management strategies to prevent the attack.” The physical surveillance (the clandestine observation, place, and activity) of a person of concern is one investigative tool to be used as an assessment and management strategy. Physical surveillance used alone or in tandem with social media research can help in gathering fact-based intelligence. Doing so can contribute to a threat management team’s understanding of the risk and help in developing mitigation strategies. For example, physical surveillance has identified a former employee, who was terminated for a workplace violence incident, returning to the worksite with a gun in his possession. Overall, physical surveillance contributes to the goal in protecting people, assets, and property to help ensure a safe working environment for employees and visitors.
We often get asked the question, “When should an organization consider surveillance?” Surveillance, when applied to a threat investigation, is many times primarily a protective function, not an evidentiary pursuit of illegal activity. This unique objective requires focus and attention on targeted violence risk factors and stabilizing conditions that lend insight into the concern for risk of violence. For example, after terminating an employee for posting threatening communications on the company’s internal network, a retail company decided to have AT-RISK conduct surveillance of the subject to see if he returned to the worksite or his manager’s building. The company also wanted to know if the employee engaged in activities like visiting a gun store or range which may be an indication that there is a shift in behavior, was the subject devolving or moving on with his life? In this case, surveillance revealed the subject was interviewing for employment with another company. This valuable piece of information helped inform the threat assessment team that the former employee was moving on with his life and therefore the company could make an informed decision about whether to continue spending resources on armed guard presence. In another example, after a terminated employee (who lived within two blocks of his former workplace) threatened to return to the workplace on a specific day, a healthcare company engaged AT-RISK to surveil the perimeter of its campus to see if the subject approached the property. Finally, in a third example, an employer engaged AT-RISK to conduct surveillance of a terminated employee for whom the company had a restraining order. In this case, the company was attempting to renew the order and needed behavior and lifestyle details to support its request before the court. Additionally, the company needed to know the subject’s whereabouts as key dates approached that were significant to the subject’s grievance. These three examples illustrate how and when physical surveillance can be used to both protect and gather assessment data for the threat response team.
It is important to point out though that surveillance is not always advised. There are situations where the use of physical surveillance may not be suitable. Physical surveillance should be carefully considered because if discovered by the subject, it may represent an aggravating issue and compound the problem. For example, one company had placed an employee on paid leave while it investigated his menacing statements. The employer was about to terminate the employee for his threatening communications and asked that surveillance of the subject be put in place. During the consultation, AT-RISK’s threat managers learned that the subject believed his employer had bugged his delivery truck. Moreover, the employee had not made any indications he intended to approach the worksite and he lived a long distance from the company’s headquarters. Threat managers found a coworker and a union representative who were able to give insight into the subject’s personal life, providing meaningful background into his mindset and activities. In this case, with other monitoring means available coupled with the subject expressing delusional thoughts the company had bugged his truck, the risk of the subject discovering the existence of physical surveillance was too high.
While the mechanics of any surveillance operation will remain relatively consistent, even for those with varied goals, the objectives of a surveillance operation in support of a threat assessment investigation do differ from surveillance designed to surface evidence of illegal activity. In short, what we are focusing on is simply observed behaviors. These behaviors, when seen individually, oftentimes do not reach the threshold of any illegal activity, but rather can provide tangible information for threat assessment investigators to successfully intervene and mitigate a potential violent outcome. In this sense, surveillance is the art of prevention. Surveillance can provide insight to a situation that is possible in the process of escalation towards violence. The surveillance agent’s goal when watching a person of concern is focused on learning behaviors and context that may suggest the situation is escalating. For example, if the person made concerning or threatening comments in the past and now the surveillance team sees the subject going to a gun range or buying ammunition, especially if that is not normal for the individual, this alerts threat managers that the subject’s move toward violence may be accelerating. The information gathered is used to supplement those managing a threatening situation by providing integral information that helps the team assess, manage, and mitigate a potential workplace violence incident. Surveillance agents need to focus on activities and behaviors which may indicate the subject has made a progression from a grievance to a preparation for attack and could be progressing towards violence.
There are basic objectives that will remain constant in all surveillance operations, such as logging activity about the subject – the where, and when. Surveillance conducted in a workplace violence case attempts to discern the intent behind the subject’s actions. For example, we recently worked a surveillance case in which the subject left his home and went to the public library. It was important for us and the threat managers, that we follow the subject into the library and learn why he was there. Was he meeting someone? Was he researching anything of concern?
Intentional violence is the result of a decision and there are often indications of a person’s movement toward a harmful act. Individuals that may pose a future risk of violence usually demonstrate behaviors over time which are observable to the attentive eye. The perception that people just “snap” and act out with spontaneous violence is for the most part a fallacy. Rather, people that act out violently generally make a conscious decision that their violent act is “justified” as the only means to address their grievance, perceived or otherwise. The FBI Behavior Analysis Unit concluded in their study of Pre-Attack Behaviors of Active Shooters in the United States between 2000 and 2013, that many concerning behaviors such as anger, threats/confrontations, poor work performance, and interpersonal interactions, were displayed by active shooters before the attack. Moreover, 89% of the demonstrated behaviors were observed in multiple ways by friends, family members, partners, and other persons. The challenge is knowing about concerning behaviors. They may not evolve out of a single source of conflict. They may struggle with work life and personal stressors that collectively influence their violent ideations. As their ability to cope with these stressors decreases, they begin to recognize fewer realistic solutions and pursue ones that are not acceptable. Underlying factors could contribute to a person’s movement toward a harmful act. These red flags may inform you about the person’s inability to cope and his/her movement toward violent action. A key factor for consideration in violent ideations is how stress can impact their ability to cope with the current conflict. Stressors at work may include extreme pressure to deliver on projects, perceived risk of termination, etc. Some of these stressors may be evident to a supervisor however, there may also be hidden contributory stressors. Perhaps an employee is struggling to complete a project and is also overwhelmed with personal, financial or health conditions simultaneously. The question should then arise on how well they can manage the accumulation of stressors. Some people engage in positive stress relief such as exercising or speaking with others. In other cases, individuals do not identify coping mechanisms, or worse, select coping mechanisms that place them at a higher risk such as drugs and alcohol. As they struggle to manage their stress and their capacity to cope is diminished, they become more vulnerable to thinking and behavior that may elevate their risk of harm to themselves or others. In the book entitled Protective Intelligence and Threat Assessment Investigations: A Guide for State and Local Law Enforcement Officials authored by R. A. Fein and B. Vossekuil, the statement was made that the “progression from an idea to intended violence is known as pathway warning behavior – any behavior that is part of research, planning, preparation, or implementation of an attack.” Physical surveillance is one tool that can observe behaviors of concern to inform the threat assessment team. Questions to consider when determining if a person’s behavior suggests escalation of violence risk or diminishing ability to cope are:
- Is there a fixation with weapons or violence?
- Is the subject visiting their old workplace?
- Is the subject utilizing probing activity to see what and where they can access before being challenged?
- Is the subject seeking treatment for mental health issues or other medical concerns? Were they in weekly counseling and have suddenly stopped?
- What is the subject’s demeanor – any unusual or concerning behavior that may indicate extreme changes in behavior or pattern?
- Does the subject have any support structure? Friends? Family? Has family or friends cut off ties with them?
- Are there indications that the subject has the inability to cope with basic life needs, such as deterioration of personal hygiene and basic property maintenance?
- What is the subject’s payment method for purchases? Description of purchases? Any sources of income identified?
- Any interactions with other people? If so, describe the interaction.
- Is the subject receiving packages (U.S. mail, Amazon, etc.)?
- Any use of electronics – phone, pads, computers?
- Any discernible “routines” identified?
Companies and security personnel may quickly turn to surveillance as a remedy to their security concern, but the use of this investigative technique must be well thought out. To the untrained, the use of surveillance can exacerbate the problem. Unless the surveillance request is well thought out, the effort can be costly and not yield the desired results. For example, a retail company engaged AT-RISK to conduct surveillance on a workplace violence subject however the organization didn’t know when to end the surveillance operation and security managers liked having it in place because they felt it insulated them if something went wrong. When thinking about using surveillance as an investigative activity companies should consider the following questions:
- What is the specific objective of the effort? Is it to obtain behavior data? Is it to determine if the subject approaches?
- If the surveillance is discovered, will it aggravate the subject and cause him/her to escalate?
- Will the surveillance be conducted around the clock or only during certain hours?
- When will the surveillance end and what are the markers to inform decision makers when the objective(s) is achieved?
- Are there other approaches such as social media monitoring, or engaging management partners like family or friends that can augment surveillance, or serve to achieve the objective(s)?
Threat assessment and management requires a holistic team approach to problem resolution, and physical surveillance of a person of concern plays a part. The goals of physical surveillance supporting threat assessment investigations are to protect and learn if the subject is progressing towards violence. To do this, surveillance agents must be focused on behaviors of concern that may suggest the subject is exhibiting concerning flags as well as indicate how he/she is coping with a difficult situation. Open lines of communication need to exist between the surveillance team and threat managers. The use of surveillance must, however, be well thought out and carefully considered, it may not be suitable in all situations and can aggravate an already contentious situation. Surveillance agents are looking for indications that the subject is moving from the idea of committing a violent act to the planning of it. The time between the subject’s ideation to their potential violent act is when surveillance is best positioned to provide timely and critical information that can enable a threat assessment team to implement intervention and mitigation strategies to prevent a violent outcome.
By John Gallo and Sheldon Beddo
