In an Age of Cyberbullying and Exploitation, Digital Footprints Remain a Limited Part of Schools’ BTAM Processes
Do your school behavioral threat assessments take into account a holistic view of the student’s life? In 2024, U.S. teenagers spent an average of 4.8 hours a day using seven popular social media apps, according to research from the American Psychological Association. But only 15 percent of schools review a student’s publicly available online or social media footprint during every behavioral threat assessment case to assess a student’s risk of harm, 2025 data from the U.S. Secret Service National Threat Assessment Center (NTAC) said.
The NTAC report, The State of Behavioral Threat Assessment and Management (BTAM) in K-12 Public Schools, found that the adoption of BTAM as part of school safety efforts is becoming nearly ubiquitous in the United States, producing reductions in crime, violence, and self-harm. But many schools lack consistent implementation, including in what information is gathered and used to produce a holistic picture of the student’s risk profile—either to themselves or to others.
While most schools used interviews with the student in question, witnesses to the concerning behavior (both peers and staff) and disciplinary records in every BTAM case, social media use was less common, despite the pervasive nature of online activity in students’ social lives today. Most schools reported using publicly available social media or online footprint information in some cases, either frequently (23.9 percent), sometimes (34.1 percent), or rarely (18.7 percent). Another 8 percent never reviewed this online information during threat assessments.
“Really, every threat assessment needs to be not only local, but it also needs to be digital, international, because that’s where these people are living,” says Joe Hendry, PSP, principal consultant at COSECURE Enterprise Risk Solutions and leader of the firm’s K-12 practice. Hendry regularly assesses schools’ active assailant preparedness and BTAM processes.
Among Schools with BTAM Teams, Percentage That Use Various Sources of Information to Assess a Student’s Risk of Harm, by Frequency
| Source of information | Every time | Sometimes* | Never |
|---|---|---|---|
| Interviews with . . . | |||
| Student | 73 percent | 26 percent | 1 percent |
| Witnesses | 64 percent | 34 percent | 1 percent |
| Teacher/school staff knowledgeable about student | 57 percent | 43 percent | 0 percent |
| Parents or guardians | 55 percent | 44 percent | 1 percent |
| Potential target of a threat | 53 percent | 45 percent | 2 percent |
| Records | |||
| Discipline records | 60 percent | 40 percent | 0 percent |
| Special education records | 58 percent | 41 percent | 1 percent |
| Academic records | 43 percent | 55 percent | 2 percent |
| Other in-district schools a student attended | 38 percent | 59 percent | 2 percent |
| Other out-of-district schools a student attended | 29 percent | 68 percent | 3 percent |
| Outside medical organizations | 20 percent | 75 percent | 5 percent |
| Law enforcement records | 17 percent | 64 percent | 19 percent |
| Outside governmental organizations | 15 percent | 74 percent | 11 percent |
| Student's social media/online footprint | 15 percent | 77 percent | 8 percent |
Source: U.S. Secret Service National Threat Assessment Center, The State of Behavioral Threat Assessment and Management (BTAM) in K-12 Public Schools
* Respondents selected either "frequently," "sometimes," or "rarely." Percentages were condensed into one column here for readability.
The global reach of digital spaces and social media puts students at wider threats of bullying and harassment than activity solely within the school district, he says. In addition to hybrid in-person and online bullying conducted within school populations, vulnerable students can be recruited online to bully others or can be targeted by coordinated bullying or exploitation campaigns, including by violent online networks like 764 or The Com. These incidents are rare, compared to cyberbullying overall, but the results are so egregious that the online networks’ effects are worth considering as part of school safety and security efforts.
In an open letter to parents, guardians, and teachers, the FBI field office in Dallas said the Bureau is investigating more than 450 people tied to violent online networks and other nihilistic violent extremist groups, including individuals who allegedly exploited minors into creating child sexual abuse material (CSAM) or gore content of themselves.
“Violent online networks such as 764 operate around the world, including right here in North Texas. Some are driven by hatred, sexual gratification, or a desire for chaos,” the letter said. “Regardless of their motivation, they have a common target: children and other at-risk individuals. These networks use the trust they initially build to manipulate victims into harming themselves or others. They coerce victims into sharing personal information and explicit pictures and videos, which are then used to blackmail their victims into creating more content depicting escalating sexual and violent behavior. Members of these networks sometimes livestream this content. When victims refuse to comply, their pictures and videos are sent to family members or made publicly available online. They might further coerce their victims by swatting, doxxing, or vandalizing their homes.”
Victims of 764 and other violent online networks are typically between 10 and 17 years old, although the FBI has recorded some victims as young as 8 or 9.
These groups deliberately recruit vulnerable children to threaten, harass, coerce, and extort others, as well as encouraging vulnerable people—including children being bullied—to harm themselves or others. One alleged 764 member in Arizona was charged last year with producing and distributing CSAM and conspiring to provide material support to terrorists—specifically a guide he allegedly wrote and posted for others to use to identify, groom, and extort their own victims, customizing tactics based on the target’s mental health problems.
“Predators are victimizing children or youth for many reasons including: building up their online notoriety ‘clout chasing’; furthering ideological motivations and degrading society; recruiting; vetting/initiating and radicalizing others; and desensitizing children and youth in preparation for further violence,” according to an explainer from the Royal Canadian Mounted Police.
The groups frequently operate in very accessible online spaces, including social media platforms, online games, and apps. Children do not need to venture into Dark Web spaces to find themselves communicating with violent online network members. Initial contact typically happens on accessible forums and then moves to more encrypted or hard-to-find spaces like Discord, Telegram, or other chatrooms to hide activity from parents, teachers, or authorities. While those platforms regularly report or delete groups that violate prohibitions on inciting violence or creating CSAM, the groups shift and respawn quickly.
The scope is widespread. In the first half of 2025, the U.S. National Center for Missing and Exploited Children (NCMEC)’s CyberTipline had a major spike in cases of online enticement and sadistic online enticement. Both categories practically doubled.
“One mother told NCMEC a violent group member made her daughter cut its screen name into her arm with a razor blade, then told her she was a good girl and that they love her,” according to a NCMEC blog on the topic. “Her mother couldn’t believe her daughter’s response: ‘I love you, too!’
“ ‘These guys are very scary,’ the mother told NCMEC. ‘Just the power they have over my daughter is mind blowing. Please help!’ ”
The perpetrators also use their abuse and exploitation efforts to push victims toward bigger and bigger acts of harm, including school shootings, according to an article from Bloomberg.
The bullies and tormentors are often children themselves, or young adults, and they can be manipulating victims from anywhere in the world.
“The children, they’re 15 years old and were tormenting girls and getting them to commit suicide and thinking it was funny,” Hendry says. “And men in their early 20s taking advantage of teenage girls and making them cut themselves, send sexually explicit pictures, all these things. That’s all online, and if you’re not going there and doing a digital assessment of what’s happening and really delving into a student’s—male or female—activity on the Internet, you’re not getting a full picture.
“We’ve moved threat assessment into a local level, and we really need to take that up one more notch to having digital threat assessment and getting people trained in local law enforcement and schools on how to identify things online, how to ask those questions to students when they’re interviewing them, and things like that,” he adds.
That expertise and training doesn’t necessarily come cheap, though, and schools may need to reassess how they spend safety and security grant money.
“Physical security things are good; people spend it on cameras and alarms and panic buttons, things like that,” Hendry says. “The physical security’s important, but the behavioral assessment pieces cannot be ignored. This is where we prevent things.”
If school officials get early warning signs that a child is being victimized or is victimizing others (including social withdrawal, signs of self-harm, changes in academic performance, or newfound affinities for extreme online messaging or conspiracy theories), they can intervene, determine what behavioral issues the child may be having, and address those issues through psychologists, medication, behavior modification, and other BTAM methods. If a bully is found, schools should strive to help uncover the person’s victims to help with identification and aid before the abuse escalates, Hendry adds. Many of those targets have been indoctrinated to see themselves as willing participants in online abuse, or they are too scared to find help.
“When we see behavioral issues in schools, the digital footprint of the student who’s experiencing the behavioral issues might not indicate a threat, but it could show that they may need great assistance,” he says. In these cases, BTAM can focus more on behavior as a sign of struggle than a sign of an impending threat, allocating resources and human connection rather than discipline.
“Part of the problem with the [COVID-19] pandemic was that students are not as resilient as they used to be, and that resilience makes them very susceptible to people who want to take advantage of them,” Hendry explains. “When things do happen, they don’t know how to respond. I think we’re moving more into a phase where we have to get back to having trusted adults in the school system that kids can go to talk to. Having better relations and actually showing that you care about people is extremely important.”
He adds, “The bad guys want to make them think that they’re dirt. You have to make them think they’re flowers.”
If you or someone you know is having thoughts of suicide or self-harm, help is available. A global list of helplines is available here.
Claire Meyer is editor-in-chief of Security Management. Connect with her on LinkedIn or via email at [email protected].
