​A large, international finance company was recently planning to fire one of its employees, but the company’s leadership was concerned. The employee, whom we’ll call John, had a history of being aggressive towards his supervisors.

Thankfully, the actual termination went smoothly and without incident, but that’s where the company’s good fortune ended. During the days that followed John’s termination, several employees received notes from him on social media instructing them to “consider not going to work” on a specified day.

As a precautionary measure, the company contracted for additional physical security at its main office building. However, when it became aware of the social media threats, the company reached out to the author’s international protection, investigations, and consulting firm for advice on how to handle this new challenge.

The firm immediately began conducting physical surveillance, following John’s movements. It also started analyzing his social media accounts and noticed that he had made several posts about the company’s vice president of human resources. 

Upon further observation, the firm discovered that John had recently driven to an intersection about one mile from the company’s building. This location was also on the route that the vice president took to get to work every day.

Using the intelligence gathered from social media and physical surveillance, the firm observed John’s behavior in real time and contacted law enforcement to prevent him from causing any harm to the vice president or to the company’s facility.

Not all workplace violence threats are so successfully mitigated. An average of 551 workers were killed each year between 2006 and 2010 as a result of work-related homicides, according to the most recent numbers from the U.S. Bureau of Labor Statistics (BLS). And as many as 2 million workers report having experienced workplace violence each year, according to the Census of Fatal Occupational Injuries.

Most alarmingly, shootings accounted for 78 percent of all workplace homicides—83 percent of which occurred within the private sector. 

Unfortunately, the traditional corporate climate is reactive because most companies only respond after there’s been a highly publicized workplace violence incident. Furthermore, many do not enact changes at all once the dust settles and the incident is no longer in the media. 

With concern growing over workplace violence from all sectors, there is a demand for protective intelligence, which can avert a crisis instead of reacting after it occurs. To put it simply, you cannot mitigate a risk that you have not anticipated.​

INTELLIGENCE

The primary objective of protective intelligence is to collect information to help determine if an individual demonstrates the intent and capability to formulate and execute a violent plan of action.

To determine this, most use the intelligence cycle—an important process for investigators or anyone who collects information for assessment or analysis. 

Originally implemented by the U.S. Military Intelligence Division during World War I, this process is leveraged by many government entities and for a wide spectrum of tasks, such as by organizations like the Federation of American Scientists. This process is most notably used in the investigative processes within the FBI and within the U.S. Secret Service, namely the National Threat Assessment Center. 

The FBI defines the intelligence cycle as “the process of developing unrefined data into polished intelligence for the use of policymakers.” Protective intelligence investigations differ from other kinds of investigations because the goal is to prevent violence or a loss, not simply secure the requested facts. 

An individual, group, or organization must collect information that will develop the critical intelligence required to take preventative actions. The U.S. Secret Service defines this process as “gathering and assessing information about persons who may have the interest, motive, intention, and capability of mounting attacks against public officials and figures.”

The intelligence cycle has six steps. These steps are: identify requirements, plan and provide direction for intelligence that is to come, collect and gather information, process and exploit collected information, analyze and convert that information to produce raw intelligence, and disseminate intelligence to those who will use it for tactical, operational, and strategic decision making.

Identify requirements. The first step is to identify the requirements the information is designed to satisfy. This step will help filter data into the most critical pieces of information and organize them by relevance.

For workplace violence investigations, investigators should focus on information that will help answer the fundamental question: Does this subject present a threat to protected individuals, groups, or organizations?

Some companies do designate internal employees as threat response personnel. Protective intelligence investigations are performed most effectively by those who have experience and training doing them and who are also unbiased, such as a third-party consultant. 

Plan and provide direction. The second step in the cycle is to create a plan and provide direction for the intelligence that is to come. 

Collect and gather information. Gathering of information is the third step and includes researching online databases, performing physical surveillance, and conducting interviews. 

Process and exploit. After col­lecting relevant information, the fourth step of the intelligence cycle is to process and exploit that information. This means filtering the data into useable bits for the decision-making processes defined by the requirements in the first step; the bits can be referred to as the dots. 

For example, when conducting an investigation of a subject who may be on the path to violence, social media or other tools may reveal his whereabouts during certain times that may be indicative of a hostile planning process. Critical decision points for likely pathways the subject would take to commit an act of violence could be established, and their correlation with the information that has been revealed would create the dots. 

This can be a time-consuming burden, especially for investigators using social open-source intelligence (SOSINT). To be effective at this task, investigators should combine resources by directly researching on social media sites and by using search engines to do the task. With this methodology, investigators can start to connect the dots, enabling analytical confidence—particularly when dealing with the concern of targeted violence.

Analyze and convert. The fifth step of the process is to analyze and convert these bits of data to produce raw intelligence.

In the event that a subject’s behavior reveals the impending manifestation of a perceived threat, these connected dots are used to make decisions that will effectively impede the process.

Disseminate. The final step of the cycle is disseminating the intelligence to those who will use it for tactical, operational, or strategic decision making. ​

SOURCES 

Although most would believe that intelligence is gathered from secret or covert sources, the largest collection of information available to investigators is open-source intelligence (OSINT), or intelligence collected from publicly available resources.

Within the intelligence community, the term “open” refers to overt, publicly available sources drawn from public resources, such as the Internet, media coverage, photos, and geospatial information. However, it’s important to keep in mind that there is no authority ensuring the accuracy of any information available through OSINT. Because of this, employers who use this collection method have a responsibility to verify—or at least corroborate—its validity. 

SOSINT, the collective term for information from sources such as Facebook, Twitter, blogs, and microblogging sites, is becoming more important within the intelligence community. SOSINT is a content-rich gold mine and a valuable investigative tool when seeking corroborative information about individuals or groups, such as behavioral changes, interests, emulations, gang activity, and general life circumstances.

Social media is particularly useful to investigators for several reasons. The first is the immediacy in which content is not only created, but disseminated. The Facebook news feed is the epitome of a media outlet for such content because there is no delay in publication and almost no restriction in its ability to spread virally. Social media provides a variety of ways for potential subjects to distribute thoughts or request tactical assistance, along with numerous ways for investigators to gather that information.

In 2014, LexisNexis published a survey, Social Media Use in Law Enforcement, of federal, state, and local law enforcement professionals in the United States who are users of social media on the job. The survey details how social media can enhance the assessment and threat management process. 

The survey found that “respondents indicated several real-world examples in which they prevented or thwarted pending crime, including stopping an active shooter, mitigating threats toward school students, executing outstanding arrest warrants, and actively tracking gang behavior.” 

For the private investigator seeking information on the behavioral circumstances of a subject, something as quick and easy as analyzing a subject’s status updates, check-ins, and posted photos may provide the information necessary to conclude if a legitimate threat exists.​

SURVEILLANCE 

Physical surveillance is one of the oldest and most common practices within investigative services, yet it remains the best option in cases when real-time information is required. To do this, employers must hire a licensed professional who can conduct surveillance legally.

Surveillance in the investigative field is used mostly as a tool for developing factual evidence to prove or disprove circumstance. However, surveillance can also provide information that is critical to the decision-making pro­cess for a much broader spectrum of investigations than most private detectives recognize.

In conducting protective intelligence investigations, surveillance is a viable option to gather the necessary information on a subject because not all attackers make direct threats. This increases the difficulty of validating or legitimizing the threat through other sources. 

Using information from OSINT may reveal the threat, such as general ideas and interests, but it is typically not specific. Surveillance can be used to confirm a suspected threat or to find out more details.

Furthermore, the analytical confidence from deriving conclusions based on direct observations versus assessing the quality and quantity of third-party information is an important factor. This provides the investigator and analyst a more profound confidence in the facts at hand. 

In one such instance, upon investigating a subject who was facing possible termination following a history of unsatisfactory performance and increasingly aggressive behavior, the author’s firm noted a hunting license in the subject’s background investigation. 

Taken in isolation, this is not a threatening piece of information. However, during the day of a contentious announcement of the firing from the company’s CEO, it was decided by the author’s firm—hired to provide executive protection for the company—to restrict access to the facility.

Local law enforcement helped bar the subject from the property. The former employee had a hunting rifle in his vehicle even though no hunting seasons were in effect. There was no violence that day, but the potential mitigation was worth the effort.

Once the subject is identified and background information has been collected, the main factors investigators should concentrate on during surveillance are the current living characteristics of the subject and context of the subject’s daily routine. 

Surveillance should focus on factors in the subject’s life and environment that might increase the probability of an outburst or attack, such as living arrangements; actions and behavior; and daily activities and social interactions, particularly compared to possible known historical circumstances and behavior of the subject. This focus on routine can provide valuable information that can help assess the subject’s stability.

For example, if the subject does not currently have the means to satisfy the basic needs of food, clothing, shelter, or social interaction, then he or she may be in desperate crisis with no option left but to act out. 

Additionally, researching, planning, and coordinating the attack are critical to the attacker’s success. The steps required in developing a plan will reveal the person’s intentions, actions, and acquaintances. 

For instance, this can be seen in the events that led up to the kidnapping of Sidney Reso, former president of Exxon Co. Reso was kidnapped by Irene Seale and her husband Arthur Seale from the end of Reso’s driveway in suburban New Jersey on April 29, 1992. Reso was shot in the arm during the kidnapping, and died a few days later. However, the Seales claimed that he was alive and demanded $18.5 million in ransom before finally being discovered and apprehended.

Prior to kidnapping Reso, the Seales watched his home from a van parked down the street for almost a month. These preparations were highly visible and could have been easily identified. The Seales could have potentially been intercepted with a counter surveillance effort as part of an executive protection program.

For violent attackers, the chances of success and escape are the predominant factors in determining the location to attack. Therefore, research and planning efforts on site selection and even tactical decisions pertaining to that site are particularly revealing during physical surveillance. The subject’s behavior and rituals during this process are also extremely revealing because the attacker’s intention may not include any escape plans at all, potentially indicating the worst case scenario of a suicide attack. 

This type of behavior was demonstrated by Khalid al-Mihdhar and Nawaf al-Hazmi who flunked their flying lessons because they were disinterested in the landing process, administrative actions, or flying anything other than Boeing jets. The two individuals failed to obtain their pilot’s license, but ended up being two of the four “muscle men” on American Airlines Flight 77, which flew into the Pentagon on 9/11. 

The potential attacker will want to gain familiarity with the location, how to get there, and—in most cases—how to escape. He or she may even take pictures of the location for reference later in the planning process, and may conduct rehearsals to discover what the security response might be during a crisis or how effective access control is. 

In the investigation that followed the mass shooting in the Aurora, Colorado, movie theater, it was revealed that gunman James Holmes had purchased his ticket for that showing of The Dark Knight Rises more than a week in advance, carefully selecting the time and place for his attack. 

Additionally, he had set explosive traps at his apartment, planning for them to be tripped prior to his attack to send resources to that incident instead of the movie theater. 

Real-time information gathered via surveillance can lead to making preventative decisions sooner and more reliably than other methods of investigation.OF INVESTIGATION.

Examples of behaviors that may indicate the coordination or planning of an attack could be visiting others who share the same ideas and interests, visiting websites linked to the company, obtaining supplies, or purchasing weapons. At this point, the investigator should avoid bias and assumption, concentrating only on facts.

For example, if a suspect who has no historical interest in firearms obtains weapons and ammunition over the course of an investigation and then proceeds to a target location, investigators conducting the surveillance may be able to involve the authorities immediately. 

To be effective at surveillance, the investigators must anticipate the subject’s actions. Investigators must ask themselves where the subject would have to be and what materials would have to be obtained. To that end, investigators should develop a list of locations and activities that may be part of the subject’s target selection or planning processes. 

For investigators, protectors, and those who conduct threat assessments and evaluations, protective intelligence programs are a critical aspect of proactively preventing workplace violence incidents before they occur. When it comes to reducing workplace violence as a whole, we all share the responsibility of identifying, assessing, and intervening as early as possible.  

--

Joseph M. LaSorsa, CPP, is senior partner at LaSorsa & Associates, an international protection, investigations, and consulting firm. He manages and conducts protective operations training courses and specializes in executive and bodyguard services; risk management consultations and seminars; workplace violence prevention seminars and intervention services; security consultations and seminars; private investigations; and technical surveillance countermeasures. ​