Skip to content
Menu
menu

Photo by iStock

New Study Identifies Common Behaviors of Concern Among Mass Attackers

There have been 40 mass shootings in the United States so far this year. These attacks left 73 people dead and scores injured, according to data from the Gun Violence Archive through the morning of 25 January. The archive defines a mass shooting as an incident in which four or more people were injured or killed.

In the past week alone, there were eight mass shootings, including at a ballroom dance hall in California; at a club in Baton Rouge, Louisiana; and during an allegedly targeted home invasion in Chicago, Illinois. Another California shooting—this time at two mushroom farms in Half Moon Bay—left seven people dead after the suspect allegedly targeted his own workplace. 

While many of these attacks were on a smaller scale, “attracting little to no attention beyond the areas where they took place,” The New York Times noted, the number of mass shootings in the United States seem to spawn more attacks, whether driven by copycats, radicalization, or the vast number of weapons available. Researchers and government officials are continuing to track these incidents and look for trends to help communities mitigate risks and respond to potential threats.

Finding Commonalities in Mass Attacks

While no two mass attacks are the same, half of these incidents in the United States from 2016 to 2020 were sparked by personal, domestic, or workplace disputes or grievances, according to a U.S. Secret Service National Threat Assessment Center report released today.

The report, Mass Attacks in Public Spaces: 2016-2020, analyzed 173 targeted attacks in public or semi-public locations, such as schools, houses of worship, and businesses, and the attack types included shootings, vehicle ramming attacks, and other methods of mass violence. These attacks resulted in physical harm to 1,747 people—including 513 who were killed.

Attackers’ grievances were most often related to a personal factor (27 percent), such as bullying, stress related to health or finances, ongoing feuds with neighbors, or feelings of victimization. In 17 percent of cases, grievances were related to current or former domestic relationships; in 10 percent of cases, grievances were workplace-related. Other motivations included ideological, bias-related, or political beliefs (18 percent); psychotic symptoms (14 percent), a desire to kill (7 percent), and fame or notoriety (6 percent).

The report found that the majority of attacks (69 percent) occurred in public locations that are freely accessible, 34 percent occurred in semi-public spaces such as workplaces or educational institutions. The most common locations for mass attacks were businesses (51 percent, or 88 attacks), followed by open spaces (35 percent) like outdoor events, streets, sidewalks, and parking lots. Thirteen attacks took place at educational institutions.

In 53 percent of the attacks, the attacker had no known affiliation with the location—some appeared to open fire randomly while others selected target locations for what they represented or offered. In the remaining cases, though, the attacker was affiliated with the site—13 percent were current or former employees, and 9 percent were customers or clients.

“In some cases, attackers were affiliated with a site indirectly through another person, for example, by selecting a family member’s restaurant or the workplace of a former romantic partner,” the report said.



In 68 percent of attacks, the perpetrator did not appear to aim at specific individuals and instead directed harm toward random people. In some cases, however, the targeting was based on gender, religion, race or ethnicity, or toward members of specific groups such as police officers or homeless people. In the remaining third of incidents, attackers had one or more specific targets in mind. In nearly all of these attacks, at least one preselected target was harmed, and in most (45 out of 55) at least one random victim was harmed.

“The specific targets included current or former romantic partners, current or former coworkers, and family members,” the report said. “In some cases (n = 10, 6 percent), the attackers targeted people were connected to one of these individuals, such as their ex-girlfriend’s current boyfriend, their wife’s divorce attorney, or their in-laws. Other targets included bullies at school or individuals with whom the attackers had a grievance, such as neighbors.”

How did these incidents end, though? It depends on who was being targeted.

The researchers found that attackers targeting specific individuals were more likely to end the attack on their own (78 percent vs. 42 percent of attackers without named targets). The majority of attackers who were stopped by external forces—law enforcement or bystanders—were targeting random individuals (86 percent vs. 60 percent of attacks ended by other means).

Troubling Signs

One of the goals of the report is to promote proactive behavioral threat assessment to prevent targeted acts of violence.

The researchers outlined a variety of observable, concerning behaviors along the pathway to violence, indicating that “targeted violence is preventable when communities are equipped with the appropriate tools, training, and resources to intervene before violence occurs. Behavioral threat assessment programs are critical components of these community violence prevention efforts. These programs are not designed to predict who will become violent, but rather to identify, assess, and intervene with individuals who display threatening or other concerning behaviors that indicate they may pose a risk of harm to themselves or others.”

This upsetting behavior is common—most attackers exhibited signs that elicited concern from family members, friends, neighbors, classmates, coworkers, and others. In many cases, those individuals feared for their safety or the safety of others. Many attackers also had a history of physically aggressive or intimidating behaviors, and many experienced stressful events across various life domains, including family or romantic relationships, personal issues, employment, and legal issues, the report found.



SM7

[New] Newsletter

Subscribe to SM7

Find out your top seven security news stories, delivered to your inbox weekly, and powered by ASIS International. 

The 180 attackers studied in the report had a few traits in common. Demographically, 96 percent were male, 47 percent were white non-Hispanic, and 34 percent were Black. One-third were known to be employed at the time of the attack, and 21 percent were unemployed (employment status could not be determined for 47 percent of attackers).

Regarding job loss, 29 percent of attackers had at least one voluntary or involuntary job loss prior to their attacks; most within five years of the attack and eight within one month. For three attackers, their employment ended the same day as the attack. One attacker “opened fire during a disciplinary meeting after being told he was going to be fired,” the report said.

Nearly two-thirds of attackers had prior criminal histories—not including minor traffic violations. More than one-third had faced charges for violent offences, such as domestic violence, aggravated assault, robbery, or animal cruelty. Many of the attackers (43 percent) exhibited criminal behavior that was unknown to law enforcement, including domestic violence. Across all 180 attackers included in the report, 73 had a history of engaging in at least one incident of domestic violence.

Fixations (intense or obsessive preoccupations with a person, activity, or belief) were also frequently seen among attackers—29 percent engaged in these behaviors, primarily aimed toward current or former romantic partners, the attackers’ beliefs, personal delusions, and prior mass attacks. In addition, 21 percent of attackers showed an excessive or inappropriate interest in violence—including an obsession with weapons.

Conspiratorial, topic-specific, or hate-focused belief systems were observed in 26 percent of attackers (note: these beliefs were not always related to the attacker’s motive). Gender-based biases and extreme misogyny were observed in 19 percent of attackers; 8 percent engaged in online misogynistic behavior. At least six of the attackers became radicalized through online engagement, but overall 23 percent of attackers were “found to have conveyed concerning communications online, such as threats to harm others and posts referencing suicidal ideations, previous mass shootings, violent content, and hate toward a particular ethnic group.”

In addition, 15 of the attackers engaged in known hate speech toward an individual or a group—most frequently focused on white supremacist or anti-Semitic beliefs. The report found that “most of the attackers who engaged in hate speech were motivated by their ideology to commit their attack.”

Fifty-two of the attackers were socially isolated. More than one-third had a history of bullying or harassing others.

One-third of attackers had a history of using illicit drugs, misusing prescription medication, or abusing a substance (including alcohol or marijuana). In 12 percent of attacks, the perpetrators were under the influence of drugs or alcohol at the time of the attack.



While the report is careful to note that the vast majority of people in the United States affected by mental health issues do not commit acts of crime or violence, researchers found that 58 percent of the attackers experienced mental health symptoms prior to or at the time of their attacks. A quarter of the attackers had suicidal thoughts prior to their attacks.

“For one-quarter of the attackers, others expressed or demonstrated concern over their mental health, having observed behaviors that appeared indicative of depression, paranoia, anxiety, or a deterioration of their general mental or emotional well-being,” the report said.

Stressors and Signals

Three-quarters of attackers exhibited behaviors that elicited concern in others before their attacks. In 64 percent of cases, the behavior was so objectively concerning or prohibited, it should have been met with an immediate response, but for 22 percent of attackers, “the behavior or communication was not reported to anyone in a position to respond, demonstrating a continued need to promote and facilitate bystander reporting,” the report noted.

Overall, two-thirds of attackers engaged in threatening or concerning communications—both online and offline—prior to their attacks. One-third of attackers who made threatening communications directed those threats toward the intended target.

But not all communication or behavior reaches that level of direct concern—52 percent of attackers displayed concerning activity that would require additional information and analysis to understand the level of concern needed.

“These contextually concerning behaviors can be described as part of a constellation of lower-level behaviors,” the report said. This includes unusual statements, erratic behaviors, increased anger, and uncharacteristic changes in appearance, demeanor, or behavior.

The report listed specific categories of concern, noting that 54 percent of attackers exhibited behavior from three or more of these categories, and 46 percent exhibited behaviors from one or two:

  • Demeanor or mental well-being, including sudden displays of intense anger, erratic behavior, and possible changes in mental health

  • Disturbing communications and direct threats

  • Physical violence

  • Stalking or harassing

  • Weapons-related actions

  • Violent or unusual interests

  • Self-harm

  • Changes in behavior

  • Isolating or withdrawing

  • Substance use or abuse

Who was most likely to notice risk factors and demonstrate concern? Family members are the primary force here, with 70 percent of attackers eliciting concern from family, followed by others known by the attacker (employers, coworkers, neighbors, or school staff).

But did these groups take action? In many cases, yes—before 93 percent of the attacks studied, someone took overt action. In 68 percent of cases, someone confronted the attacker about their behavior or discouraged those behaviors; in 61 percent of cases, someone reported the behavior to a person in a position to respond. In 58 percent of cases, people took more cautious action, including expressing concern, asking others to help, or protecting themselves or others.

The report concluded that for more than 25 years, research from the National Threat Assessment Center has “demonstrated that these acts of violence are rarely spontaneous and are almost always preceded by warning signs that are observed by family members, coworkers, classmates, neighbors, and others across the community. Future tragedies are preventable if the appropriate community systems are in place to identify and intervene when community members report these concerns, and the U.S. Secret Service stands ready to support our community partners in this vital public safety mission.”

arrow_upward