Pre-Attack Indicators (PAINs)

Identifying Active Assailants Before the First Gunshot

Booth 1863

Before “X”

Between the ages of three and 19 the killer at Marjorie Stoneman Douglas (MSD) High School had 69 documented acts of violence,

threats, or other concerning behavior.

2002 Feb. 13, 2018

Age 3 Age 19

Pre-Attack INdicators (PAINs)

“If you go onto his Instagram pages, you’ll see all the guns,” the woman said. “He’s so into ISIS, and I’m afraid this is, something’s gonna happen because he doesn’t have the mental capacity. He can’t. He’s so outraged if someone talks to him about certain things. ... I just want someone to know about this so they can look into it,” she told the FBI. “If they think it’s something worth going into, fine. If not, I just know I have a clear conscience if he takes off and just starts shooting places up.”

PAINs

From 13-minute call to FBI P.A.L. on January 5, 2018

Jan. 5, 2018 Feb. 14, 2018

PAINs• MSD had eight people assigned to school security roles.

• One minute and 38 seconds before the first gunshot, a campus safety monitorobserved the killer exit an Uber holding a black ballistic nylon rifle case.

• The first alert to secure the campus is made 3 minutes and 22 secondsafter the first gunshot.

• 14 students and three staff were killed.

2:19:54

2:19:54 PM 2:21:32 PM

PreventionEvery organization should have a Violence Prevention Program to identify potentially dangerous behavior with the goal of providing assistance, preventing violence and making the organization SAFER.

When does an active shooter attack begin?

JACA?

JACA: Defining “Dangerousness”

Justification: A mass killer feels justified in extreme violence.

Alternatives: A mass killer does not perceive alternatives to violence.

Consequences: A mass killer is unconcerned about the consequences of violence.

Ability: A mass killer has the ability to carry out an attack.

Dangerousness & First Timer’s Syndrome

When someone is truly dangerous all elements of JACA exist. The same mental and physical states that make a mass killer extremely dangerous can also make them detectable. These include:

• A high stress factor making it difficult to control behavior

• Being committed to a tactical plan creating focus lock

• The need for concealment of intention and weapon

Detection requires proper situational awareness.

Situational Awareness & Cooper’s Color Codes

Level 1: Observation

Level 2: Interpretation

Level 3: Prediction

Situational Awareness

Situational Awareness is the ability to observe what is happening, interpret meaning, and predict potential outcomes.

Observation

Interpretation

Prediction

Expertise develops schema which enhances our ability to

interpret and predict; increasing our desire to observe.

Schema

Interpretation

Prediction

Observation

• Most basic element of SA.

• You observe something.

SA1: Observation

1. Observation

Requires expertise or schema to interpret what

has been observed.

2. Interpretation1. Observation

SA2: Interpretation

Anticipate what could happen.

(Schema pattern complete.)

3. Prediction

SA3: Prediction

2. Interpretation1. Observation

1. Observation

SA1: Observation

1. Observation 2. Interpretation

SA2: Interpretation

Requires expertise or schema to interpret what

has been observed.

1. Observation 3. Prediction2. Interpretation

SA3: Prediction

Anticipate what could happen.

(Schema pattern complete.)

Follow the Yellow Backpack

Observation

Observe

Focus Lock is caused by a distraction, event or goal that is so distracting it greatly limits the ability to observe other stimulus.

Observe

Just 2 Seconds is a resource guide for protecting public and high profile people. In it, the authors point out that it is futile to “look for assassins.”

Looking for a would-be attacker in a crowd “is like looking for a needle in a stack of needles.”

Sam Walton, the founder of Wal-Mart, coined the “10-Foot Rule.”

How to Observe

20-10 Rule

How to Observe

• Enhances Situational Awareness•Creates a positive climate•Mitigates Focus Lock•Reduces boredom• Enables intuition• Encourages interpretation

20-10 Rule

Knowing without understanding why.

• Gut feeling

• Hunch

• First impression

Intuition is the result of the way our brains store, process and retrieve information on a subconscious level.

Intuition is the brain making a decision so fast that all we are aware of is the general feeling - not the process.

Interpretation and Intuition

IntuitionSri Lankan Easter AttacksZion ChurchBomber was denied entry and detonated IED outside of church.

Intuition

“I can’t point to one thing,” he said. “I just had that feeling you have when you walk out of the house and know you forgot something — you got your keys, it’s not that — and need a few moments to figure out what it is.”

Sgt. First Class Edward TierneyMosul, Iraq

• Fear

• Normalcy Bias

Normalcy BiasThe phenomenon of disbelieving imminent danger and/or catastrophe, because these circumstances are not normal.

Enemies of Intuition

Non-violence is the norm - normalcy bias is the denial of danger in favor of the desire for safety.

Denial & Normalcy Bias

Intuition- Ignored• Package was addressed to retired association president

• Package was excessively taped and poorly labeled

• Staff joked it might be a bomb

• New president Gilbert Murray was killed by blast

FBI Reproduction

Questioning Intuition

• What do I think is happening? (Worst case)

• What factors make this situation more dangerous?

• Have I seen this situation before?

• What factors make this situation safe?

Local knowledge and schema enhance the ability to

observe and interpret changes to the baseline.

• Pre-Attack Behaviors

• Routes

• Parking Patterns

• Visitor Patterns

• Intended Users

Interpretation

Interpreting People

Geographics

Atmospherics

IconographyBiometrics

Proxemics

Science and Interpreting Pre-Attack Behaviors

Geographics

Geographics - reading familiar and unfamiliar patterns of behavior within a given environment.

2:19:54

An Operational Environment Analysis is the process of analyzing geography, architecture and operations to better understand baseline activities.

Geographics & Understanding the Physical Space

Know the Usual to Better Interpret the Unusual

Territoriality is the act of controlling an area of space, or a territory, in order

to control people and things.

It is in our nature to be territorial. Infringements on our territory are easy to

observe and interpret. To key elements of territoriality are:

• Habitual Areas (Common)

• Anchor Points (Controlled)

Geographics & Territoriality

Habitual Area: A common space that is unregulated.

Territoriality

It can harder to detect an attacker in Habitual Areas.

“Left of Bang”http://cp-journal.com

Anchor Point: A space that is controlled.

Geographics & Territoriality

Anchor Points can create additional stress for an attacker.

“Left of Bang”http://cp-journal.com

Proxemics - the way subjects use the space around them and interact with surrounding people.

Proxemics

Iconography

Iconography - the expression of beliefs and affiliations through symbols.

AtmosphericsAtmospherics - the collective attitudes, moods, and behaviors present in a given situation or place.

NY Times Analysis of the Harvest Music Festival Shootinghttps://www.nytimes.com/video/us/100000005473328/las-vegas-shooting-timeline-12-bursts.html

Biometrics

Biometrics - human beings’ uncontrollable and automatic stress response.

Amygdala: Triggers all systems alarm.

Pituitary Gland: Produces chemicals that activate the thyroid and adrenal systems.

Hypothalamus: Links all signals and systems to prepare body for action.

Hippocampus: Associates the event with danger (stored long-term memory).

When unprepared or startled, Freeze is a common initial response.

Possible Indicators

• Awkward pause

• Startle

• Stutter

• Submissive movement

• Eyes widen

• Eyes close

Biometrics: Freeze

Flight is typically the preferred survival response. This does not mean the subject must actually flee.

Possible Indicators

• Pulling away

• Stepping back

• Head turn (scanning for exits)

• Eyes scanning for exits

• Heavy breathing (body preparing for exertion)

• Accelerated heart rate (body preparing for exertion)

Biometrics: Flight

Fight is typically the last survival response. This does not mean the subject must actually fight.

Possible Indicators

• Stepping closer and squaring shoulders

• Blading body (indicates training)

• Hands raising (attack or protect organs)

• Eyes locked (tunnel vision)

• Heavy breathing (body preparing for exertion)

• Accelerated heart rate (body preparing for exertion)

Biometrics: Fight

Anger: Face of Attack• Most dangerous emotion

• Provides courage to fight (reduces critical thinking)

Biometrics: Anger

Biometrics: Fear

Fear: Close to Anger

• Flight and Freeze

• Situational

• Can lead to increased vigilance

1. Creature of habit

2. Lazy

3. Bad liars

4. Limbic system control (Biometrics)

5. Telegraph intentions (do everything twice)

6. Predictable

7. Unable to multi-task

8. Clueless (Poor Situational Awareness)

*Source: DoD SenseMaking Project

People are Predictable*

Predict

Main causes of First Timer’s Syndrome

The more accurate the observation and refined the schema, the better the prediction.

Predict

You observe something…A gun.

You interpret the information. You activate the appropriate schemaand predict.

You hear gunshots and someone approaches.

Pattern Completed

Building Schema for PAINs

Pre-Attack INdicators (PAINs): Observable behavior that is exhibited prior to an act of violence.

Because PAINs are common, PAINs become a concern when they appear in clusters of three or more.

Categories of PAINs

Physical

• Routes

• Proxemics

• Iconography

• Blading

• Body language

• Concealing items

• Confirmation touch

• Dominant/Submissive

Behavioral

• Dress

• Patterns

• Biometrics

• 1,000-yard stare

• Muttering

• Interested/Uninterested

• Eye contact

Universal Danger or Clusters of Three or More = Security Concern

Pre-Attack INdicators (PAINs)

Pre-Attack INdicators (PAINs)

Enhancing Prediction

Build Schemas and Practice

• Recognize when you observe a change to a baseline.

• Analyze obvious changes. What is the worst case scenario?

• Connect real world events to training to enhance schema.

Observation Can Improve Prevention

“Remember it is not cowardly to pick low hanging fruit. AKA Don’t attack heavily guarded areas to fulfill your COD fantasy. Attack low security targets... Do not throw away your life on an unnecessarily dangerous target. If a target seems too hot, live to fight another day.”

Quote from the murderer at the El Paso Walmart's manifesto.

How to Observe PAINs and Act

Filter Out Low Risk Active Threat Groups

Observe Intelligently

Universal Danger

Anything that JustDoesn’tLookRight

PAINs

Engage: 20-10 Rule

Focused Conversation

If a person’s behavior causes a concern, but there is no sign of immediate danger, security should initiate a Focused Conversation.

Everyone has a Trip Story.

A. Future (where they are going)B. Past (completed their trip)

Focused Conversation

1. Goals of a Focused Conversation: a) Determine dangerousnessb) Provide assistance

2. Do Not Over-React3. Respect Personal Space4. Use Non-threatening Words and Body Language

Focused Conversation

Use Open-Ended Questions

• Requires an answer with details and/or explanation.

• Requires the subject to provide information without getting ideas

from the interviewer.

•Examples:

•“How did you get here?”

•“Where are you going?”

•“Why are you going there?”

Focused Conversation

Example: An employees arrives late wearing a backpack, but also holding a second backpack next to his chest. They are reluctant to make eye contact.

Ask About Purpose of Trip

Closed question: Are you going to the gym after work?

Open question: Good morning, why to backpacks?

Babysitter

Heightened Security

If after a Focused Conversation there is still a concern for danger, implement Heightened Security procedures such as:• Implement a soft lockdown • Continue to monitor the person of concern• Request Law Enforcement Presence• Secure Entrances• Increase Security Patrols/Staffing• Restrict Interior Movement/Hallway Access• Secure Offices• Close for Business

Event-Driven Schema Can Enact ChangeDo Something“The head of the Federal Aviation Administration announced today that his agency would soon propose a rule requiring airlines to place a bulletproof shield around pilots to protect them….Until now, the airlines have followed the wishes of hijackers to provide maximum assurances that no one would be hurt.”

New York Times Article

Use Past Events to Build Schema

• Eastern Airlines 1970• John Devivo barges into the cabin of the

plane brandishes a handgun and order the pilots to fly until the plane runs out of fuel. A struggle ensues and Devivo shoots Captain Robert Wilbur and Co-Polit James Hartley. Though shot, Wilbur is able to land the plane safely.

• Delta Airlines 1974

– Samuel Byck, armed with a handgun and gasoline

bomb shot his way onto a Delta jet at Baltimore

International Airport.

He killed a security officer and shot the pilot before

police shot him.

His plan was to crash the plane into the

White House

Practice Situational Awareness

• 1986

– David Burke stormed the cockpit of a jetliner over

San Diego and shot both pilots.

He crashed the plane into the ground.

All 43 people on board died.

Fight Normalcy Bias

• Federal Express 1994

– Fed-Ex employee named Auburn Calloway attacked the Fed-Ex

pilots with two hammers.

Even though seriously injured, the pilot and co-pilot land the plane.

Calloway’s plan was to kill the pilots and crash the plane.

Do Something

©2019 SafePlans, LLC

Sabika SheikhSanta Fe High School

May 18, 2018

bspicer@alicetraining.comwww. alicetraining.com Entrance

Booth 1863

People don’t rise to the occasion. They fall back to their lowest level of training.