Skip Navigation


January-February 2010

ResizeResize Text: Original Large XLarge Untitled Document Subscribe

Threat Assessment in College Settings

In 2007, the landscape of campus safety changed abruptly with the Virginia Tech shooting and the subsequent wave of anonymous threats in colleges across the country. It seemed that the school shootings that have plagued K-12 schools were now advancing to colleges and universities. In response to the tragedy, the Virginia state legislature mandated that every public institution of higher education establish a “threat assessment team.”

As a professor of education at the University of Virginia, I study school safety, and as a forensic clinical psychologist, I have evaluated many homicide offenders, including youth who have committed shootings in schools. So soon after the Tech shootings, Donna Bowman, the director of the Virginia Center for School Safety in the state's Department of Criminal Justice Services, contacted me to inquire whether the threat assessment guidelines I developed for K-12 schools could be adapted to college settings and, without waiting for a reply, asked how soon I could schedule a training program.

Since the school shootings of the 1990s generated a widespread conviction that schools had become dangerous places, there has been a nationwide adoption of zero-tolerance discipline policies, resulting in thousands of students being suspended or expelled from school each year, often for minor transgressions (such as bringing a plastic knife to school in a lunchbox) that do not constitute a serious threat to others. In 1999, I was invited to participate in the FBI conference on school shootings and to confer with the FBI's criminal profilers in their subsequent report and recommendations for schools (available at This experience led me to develop a prevention-oriented threat assessment protocol that could replace the excessively punitive, but politically popular, zero-tolerance approach.

Over the past ten years my colleagues and I have trained teams for thousands of primary and secondary schools across the country to use our Guidelines for Responding to Student Threats of Violence. Field studies show that our training helps educators to reduce their anxiety about school violence and to take a different perspective on students who engage in threatening behavior. Most importantly, we have found that threat assessments can be conducted safely without the numerous suspensions and expulsions that characterize a zero-tolerance approach. We emphasize a problem-solving method that attempts to resolve peer conflicts and stop bullying before it escalates into violence, identifying only a small number of more serious cases for more extensive intervention and mental health treatment.

Threat assessment as a violence prevention strategy

Too often, extreme cases like the Virginia Tech shooting lead to a myopic focus on preparing for an attack. But both the FBI and the U.S. Secret Service have conducted studies of school shootings and concluded that threat assessment offers an important prevention component to comprehensive safety planning (for more information, go to Although it is important for colleges to have a well-designed plan for first-responders, a comprehensive approach to campus safety should not be limited to security measures, warning systems, or crisis-response plans that are designed to react to violence. Threat assessment is a form of violence prevention that should be undertaken well before a gunman appears in the parking lot. The history of many school shootings reveals that the attack was preceded by threatening statements and behavior that aroused the concern of others weeks or months in advance.

The term “threat assessment” has sometimes been used broadly to mean any attempt to identify dangerous situations. The Secret Service and FBI use the term more narrowly to mean the investigation of an individual (or group) who has communicated a threat or engaged in some kind of threatening behavior. Threats may be expressed directly to an intended victim or, more often, communicated indirectly to friends or associates. Threatening behavior can range from angry outbursts that arouse fear and concern to the acquisition of weapons for an attack.

Threat assessment can be distinguished from criminal profiling, which attempts to identify perpetrators by matching them to a set of characteristics theorized to indicate potential for violence. Both the FBI's criminal profilers and the Secret Service's special agents have unequivocally rejected profiling as a viable method for preventing school shootings, for two reasons: (1) shootings are statistically so rare that the possibility of detecting the few cases among thousands of schools and millions of students is unrealistic; and (2) the characteristics shared by many attackers—such as feelings of persecution or mistreatment, suicidal depression, and preoccupation with violent video games or other violent forms of entertainment—are not specific to violent individuals. As the FBI cautioned in its 2000 report, “Trying to draw up a catalogue or ‘checklist’ of warning signs to detect a potential school shooter can be shortsighted, even dangerous. Such lists, publicized by the media, can end up unfairly labeling many nonviolent students as potentially dangerous.”

Many individuals who make threats do not actually pose a danger once the nature and circumstances of the threat are understood.

Threat assessment focuses on a narrower group of individuals who have either communicated a threat or aroused concern because of threatening behavior. Nearly all of the multi-victim shootings studied by the FBI and Secret Service were committed by individuals who could have been identified by a threat assessment approach. In many cases, the individuals had clearly expressed their intentions to carry out a shooting, and some had warned potential victims of a specific time and place to avoid. The critical shortcoming was a failure to identify and investigate threats.

Once a threat has been identified or reported, a threat assessment team determines how serious it is. Many individuals who make threats do not actually pose a danger once the nature and circumstances of the threat are understood. This requires examination of the context in which the threat was made and what conflict or problem motivated the person to make it. Judgments regarding the person's potential for carrying out the threat rely on evidence that the person has engaged in behavior that indicates the capability and intent to carry it out. Based on this assessment, the team develops a response plan. Such plans can range from clarifying a misunderstanding or informally resolving a dispute to taking formal administrative or legal action. Each case requires an individualized approach.

Crime on college campuses

Threat assessment involves making judgments about the risk of a violent outcome. However, human judgment about probability is notoriously subjective and inaccurate. After a fatal airplane accident, travelers are more nervous about flying, although statistically the odds of a crash are remote and have not increased as a result of the recent event. Similarly, the Virginia Tech shooting dramatically increased public perceptions of the probability of campus violence. Just as the airline industry likes to remind us that flying is safer than driving an automobile, it might be worthwhile to point out that living on a college campus is statistically safer than living off campus.

Threat assessment teams must make judgments that are grounded in facts and informed by an understanding of the base rate for crimes in their setting. The most recent available studies indicate that campus crime is far lower than the national crime rate. According to a 2008 report of the U.S. Bureau of Justice Statistics (retrieved at, the rate of serious violent crime in 2004 was 62 violent crimes per 100,000 students on campuses with 2,500 or more students, which is seven times lower than the rate of 466 per 100,000 for the nation as a whole. Moreover, colleges are growing safer; violent crime on college campuses with 2,500 or more students declined 9 percent between 1994 and 2004.

The risk of homicide is a special concern in threat assessments, but the available data indicate that the rate of homicide on college campuses is extraordinarily low. As shown in Figure 1, for the years 1997 through 2007, there was an average of 25.5 murders per year on college campuses, according to U.S. Department of Education reports (see This rate, however troubling, is a small fraction of the average of 16,539 murders for the nation as a whole, as documented by FBI Uniform Crime Report statistics (found at

Considering that the U.S. Department of Education collects crime data from more than 9,000 individual campuses (including four-year, two-year, and less-than-two-year institutions), the likelihood of a murder occurring at any one is remote. As a rough approximation, the average campus could expect an on-campus murder approximately every 353 years (9,000 divided by 25.5).

Figure 1. Murder on College Campuses

Figure 1. Murder on College Campuses

Statistics for individual states can be more compelling to local authorities and to the public. For example, data from the Virginia State Police (retrieved at indicate that schools and colleges are much safer than other locations, especially in comparison to residences, roads, stores, and parking lots (see Figure 2). From this perspective, the focus on “school violence” or “campus violence” as though it were a special category of crime seems misplaced. Serious violent crimes are more frequent in restaurants than at schools and colleges, yet “restaurant violence” is not a subject of public concern.

But despite the reassurance offered by the statistics, the specter of campus violence remains compelling. The 2007 murders at Virginia Tech were a statistical anomaly, but the worry is not completely unfounded: High-profile crimes can trigger copycat behavior, ranging from prank threats to serious acts of violence. At least one shooting, at Northern Illinois University in 2008, was committed by a gunman who admired the Virginia Tech shooter, according to a report by David Vann published in Esquire (August, 2008).

Figure 2. Virginia 2008 ViolenT Crime Locations

Figure 2. Virginia 2008 Violent Crime Locations

Most copycat effects are temporary, however. Although there was a surge in prank threats following the 1999 Columbine shooting, the incidence of school shootings declined in subsequent years. (Of course, the decline may be due in part to increased awareness and prevention efforts by school authorities and law enforcement.) Nevertheless, ten years after Columbine there continue to be news reports of students being arrested for planning or conspiring to commit Columbine-type shootings. These incidents often come to light through the investigation of threats reported to authorities.

Assessing threat

The basic function of a college threat assessment team is to provide consultation and assistance to other units of the institution when dealing with a potentially dangerous situation. The Virginia guidelines recommend that threat assessment teams include representatives from college administration, law enforcement, mental health, and legal counsel. The administrative members should be selected to cover the range of possible cases, including threats made by students, employees, faculty members, and others in the community, although the full team might not be needed in every case. The team should be notified anytime someone in the college observes or learns about a threat of violence or a situation that appears to be threatening.

There are four basic steps in threat assessment.

1. Identify threats. The first step is to identify threats of violence. Because truly dangerous situations must not be overlooked, the net should be cast wide: Any communication of intent to harm someone, whether the threat is expressed to the intended victim or to someone else, should be included, as well as any behavior that indicates possible dangerous intentions, such as angry outbursts, brandishing or illegally concealing a weapon, or any suggestion of planning or preparation to carry out a violent act. Because of this broad definition, there should not be any automatic adverse consequences associated with a threat investigation, unless the threat itself constitutes an illegal act (such as calling in a false bomb threat or harassing someone) or is found to be serious.

It is essential that all persons in help-providing and supervisory roles in the institution—ranging from dormitory advisors to mental health counselors, faculty advisors, law enforcement officers, and deans—understand that all threats must be passed along to the threat assessment team. Written policies and a clear chain of reporting should be established. This is perhaps the primary lesson learned from the Virginia Tech shooting. Many individuals had concerns about the student who carried out the attack, but these concerns were not routed to one central place where the magnitude and seriousness of his problems could be identified.

Figure 3. Virginia Threat Assessment Decision-Tree

Figure 3. Virginia Threat Assessment Decision-Tree

There may be resistance to the idea of reporting threats because it seems like a form of snitching, which is widely disparaged in our society. And in recent years, there has been a movement, most notably expressed in some rap music, to discourage community cooperation with law enforcement by calling it snitching and threatening retaliation. However, snitching can be more properly defined as the act of informing on someone for personal gain. Messages to the community and to help-providers should stress that seeking help is not snitching.

If the institution is able to help people who are upset, angry, depressed, or troubled in some way, many problems can be addressed before they rise to the level of a threat.

A broader and more palatable principle than threat-reporting is the promotion of all forms of help-seeking for people in distress. In a caring community, everyone should be encouraged to seek help for anyone they perceive to be in distress (including themselves). If the institution is able to help people who are upset, angry, depressed, or troubled in some way, many problems can be addressed before they rise to the level of a threat. However, whenever a help-provider recognizes a threat in the course of helping someone, he or she should report the threat up the chain of command to the threat assessment team.

2. Evaluate the seriousness of the threat. As the FBI quipped in its report on school shootings, “All threats are not created equal.” The first task of a threat assessment team is to gather as much information as possible to determine the seriousness of the danger. This may range from interviewing a few witnesses to determine what happened to conducting a formal law enforcement investigation with an extensive background check of the subject. In the most serious cases, the team's law enforcement representative might seek a search warrant to look for evidence of a violent plan, bomb-making materials, etc.

The focus of a threat assessment is on uncovering facts that indicate the threat reflects a genuine intent to harm someone. In its report, the Secret Service noted that anyone can make a threat, but relatively few individuals actually pose a threat. In other words, someone may express a threat rhetorically, perhaps as an expression of anger or frustration, but lack either the means or the intention to carry it out. Such threats may be cause for concern because they indicate a problem or conflict, but they are less serious than threats that are indications of violent plans and intentions.

Levels of threats are depicted along a continuum in Figure 4. In the simplest case, someone may use threatening language in a rhetorical manner, such as making the statement “I could kill you for that!” in jest. Such cases are not actual threats, but there is always the potential that someone may misunderstand them and become concerned. At the next level are threats that express anger but are still merely rhetorical. Someone could make the same threat to kill as an expression of anger, but without actual intent or motivation to kill someone. Usually such threats can be resolved when the person calms down and discusses the problem or conflict that generated his or her strong feelings.

Moving up the continuum, more serious threats may be designed to intimidate or coerce someone or to disrupt the institution. They are malicious but still may not involve a real intent. For example, most bomb threats in the U.S. appear to be made by persons who have no plans for making a bomb. Another example is the former boyfriend who uses threats to harass his ex-partner, with the goal of punishing the victim with fear and anxiety. However, coercive and disruptive threats still require investigation, because a person angry enough to make such a threat may over time decide to take aggressive action.

The most serious threats are those that are expressed by individuals who are planning or preparing to carry out a violent act. The FBI report referred to this situation as “leakage” of the subject's intentions. In most of the school shootings the FBI studied, as well as cases that were thwarted by authorities before a planned attack could be carried out, the individual communicated or leaked his or her intentions, usually by making threatening statements to third parties rather than directly to the targeted victims.

Administrators are understandably wary of adopting threat assessment procedures that could be time-consuming and burdensome. In the less serious cases, a comprehensive assessment is not necessary. For this reason, the threat assessment procedures we developed for K-12 schools introduced the distinction between transient and substantive threats. Transient threats can be quickly and readily resolved because the threat is an expression of feelings and does not reflect a substantive intent to harm someone. Such cases are identified and disposed of through a kind of triage procedure. A member of the threat assessment team collects some initial information from witnesses about the reported threat and then meets with the person who made it. If the threat can be resolved at this stage, a more comprehensive assessment is not necessary. In a field test of these guidelines in 35 primary and secondary schools that responded to 188 threats of violence, approximately 70 percent of the cases were resolved as transient threats.

3. Intervene to reduce the risk of violence. However, if the team member finds that the threat cannot be easily explained and resolved or is unsure about the subject's intentions, the case should be treated as a substantive threat and evaluated further. The remaining 30 percent of the incidents in the field test were considered substantive cases and received more intensive investigation and intervention.

A substantive case by definition is one in which there is some risk of harm to others, and therefore any identifiable victims or targets of attack should be contacted. Victim notification is a sensitive and controversial issue for mental health professionals, who understandably want to maintain the confidentiality of their treatment relationship. However, the duty of mental health professionals to warn potential victims—and, more generally, to take protective action to prevent violence—dates back to the California Supreme Court ruling in the 1976 Tarasoff case.

Figure 4. Continuum of Threats

Figure 4. Continuum of Threats

In this case, a student at the University of California-Berkeley who was in treatment at the college mental health center expressed thoughts of killing a young female friend who had spurned his romantic advances. Although the treating psychologist took the threats seriously and notified the campus police, he was judged negligent by the court for failing to take more directly protective action such as contacting and warning the woman that she was in danger. As the court decision famously concluded about the privilege of doctor-patient confidentiality, “The protective privilege ends where the public peril begins.” Many, but not all, state courts have made rulings consistent with the Tarasoff decision, which has had a profound impact on mental health practice in the United States. In our training programs, we remind mental health professionals that “safety trumps confidentiality.”

There is no single protocol that can cover all cases, because the nature and circumstances of threats are so variable. Threats are often signs of frustration and impasse and might well be amenable to some effort at conflict resolution or dispute mediation. There also may be reason to seek mental health counseling or treatment for the person making a threat. In some cases, as a last resort, the institution may need to take legal action, such as obtaining a restraining order to bar an individual from the campus. Such actions must be considered carefully, however, because they have the potential to provoke an aggressive response. In all cases, the threat assessment team will emphasize treating all parties with respect and working toward a resolution that does not aggravate a volatile situation.

4. Follow-up to monitor and re-evaluate effectiveness of the safety plan. Each case requires some kind of follow-up plan. In the simplest cases, this may involve merely maintaining a record of the case and inviting the relevant parties to contact the team should there be any new developments that raise concern.

In cases where there has been an intense interpersonal conflict or dispute, it may be appropriate for the team to check in periodically with the referral source or other individuals who would be knowledgeable about the threat situation. It could be appropriate as well to check with the individual who made the threat in order to verify that he or she continues to feel satisfied with the resolution of the case.

It is difficult to say when a team's interest in a case should end. In the most serious cases where there is continuing concern about an individual's mental state and potential for violence, it may be advisable to keep the case open for several years—e.g., as a student proceeds toward graduation. Even after graduation, a team should maintain records in the event that there is a new incident or reason for concern. For example, in the 2002 shooting at Appalachian School of Law and the 2007 shooting at Northern Illinois University, the attacker was a former student. Similarly, former employees, particularly those who leave the institution under unhappy circumstances, may warrant continued concern.

Record-keeping is a thorny issue for threat assessment teams because threat records represent a novel archive that does not fit established conventions in most institutions of higher education. The Virginia guidelines recommend that threat assessment teams keep their own records and treat them as confidential law enforcement/security materials. They should be accessible only to the threat assessment team.

Threat assessments of students do not become part of the student's academic record and thus should not be considered to be under the jurisdiction of the Family Educational Rights Privacy Act, or FERPA. Although they may contain information obtained from mental health professionals about a subject's mental condition, threat assessment records should also not be regarded as medical records under the jurisdiction of HIPAA. Of course, if the team does obtain copies of a student's academic records or medical records, then the storage of those copies may be subject to FERPA or HIPAA restrictions.

Critical features of a successful threat assessment team

Threat assessment, like any violence-prevention strategy, depends on the quality of its implementation. There are three prerequisites to the successful operation of a threat assessment team:

1) Administrative support – The leadership of the institution must convey clear support for the threat assessment team, so that all administrative units of the institution will be willing to provide information and accept the team's guidance in dealing with threatening situations. There must be clear policies and procedures that establish the team's authority and scope of action.

2) Campus-wide education – Students, faculty, staff members, and the community as a whole should be educated about the importance of seeking help for persons in distress, whether or not a threat is involved. The institution's help-providers must be able to identify threats and understand the importance of reporting them immediately to the team.

3) Cross-disciplinary teamwork – A threat assessment team should draw upon the expertise of professionals in law enforcement, mental health, and higher education. Team members must develop the mutual trust and respect that permits them to work creatively to develop individual solutions for each case.

The institution's help-providers must be able to identify threats and understand the importance of reporting them immediately to the team.

In order to understand the value of threat assessment, it is important to appreciate the difference between prediction and prevention. A few weeks after the Virginia Tech shooting in 2007, I was called to testify before the House Education and Labor Committee in its hearing on “Best Practices to Make College Campuses Safe.” Most of the committee members seemed receptive to my ideas about using threat assessment on college campuses, but one congressman was certain this approach would not work. In an imperious tone, he challenged my recommendations and told me that he had consulted with two of the nation's leading experts on violence and that they had confirmed what he already knew, which was that these kinds of shootings, and criminal violence in general, could not be predicted. So, he argued, it was pointless to attempt to prevent them.

Ironically, I knew both of the experts he cited, one a psychiatrist and the other a retired FBI agent; both are heads of threat assessment consulting companies who strongly endorse threat assessment as a violence-prevention strategy. The error in the legislator's reasoning was that prevention does not require individual prediction. For example, we do not know which smokers will develop lung cancer, but we know that more than 400,000 persons die of tobacco-related illnesses and that prevention efforts aimed at reducing smoking in the general population will save lives. Although violence often cannot be predicted in individual cases, a college campus that strives to help troubled individuals and intervene in threatening situations will prevent violence as surely as a college that reduces alcohol intoxication among its students will prevent automobile fatalities.

There is no typical college shooting. Although most attention has been given to student-perpetrated violence, threats to campus safety can come from any number of individuals, including faculty, staff, and members of the community. Many of these individuals have engaged in troubling or threatening behavior that has indicated a need for help.

For example:

2002 University of Arizona. 41-year-old Robert Flores, a nursing student and Gulf War veteran, fatally shot three instructors before killing himself. Flores was allegedly angry and upset because he was failing his classes. He left a 22-page suicide note describing his misfortunes and mistreatment since childhood.

2003 Case Western Reserve University. 62-year-old Biswanath Halder, a former MBA student, engaged in a seven-hour shooting standoff, killing one and wounding two. Halder was familiar to university authorities because he had filed a lawsuit accusing a computer lab supervisor of hacking into his computer.

2006 Shepherd University. 49-year-old Douglas Pennington fatally shot his two sons, students at Shepherd University, before killing himself. Pennington was receiving psychiatric treatment and his family had attempted to have him hospitalized.

2007 University of Washington. 41-year-old Jonathan Rowan fatally shot his ex-girlfriend, a university researcher, and then killed himself. The former girlfriend had obtained a restraining order in which she reported that he had repeatedly threatened to kill her.

2007 Virginia Tech. 23-year-old student Seung-Hui Cho killed five faculty members and 27 students before killing himself. Cho had repeatedly come to the attention of university faculty, police, and mental health professionals because of his disturbing behavior.

2008 Northern Illinois University. 27-year-old former student Steven Kazmierczak wounded 15 and killed five before killing himself. Mr. Kazmierczak had a long history of bipolar disorder and substance abuse. Friends knew he was becoming depressed and withdrawn and was increasingly preoccupied with the Virginia Tech shooting and fantasies of violence.

2008 Louisiana Technical College. 23-year old student Latina Williams killed two female students and herself in a classroom. Allegedly, she was living in her car and showing signs of paranoia; she had called a crisis center to explain that she planned to kill herself.

2009 Henry Ford Community College. 20-year-old student Anthony Powell killed a black female classmate and himself following a theater class. Mr. Powell had a history of mental illness and had posted YouTube videos expressing hatred toward black women and an intention to kill himself.

Dewey Cornell is a professor of education in the Curry School of Education at the University of Virginia and a forensic clinical psychologist. He directs the Virginia Youth Violence Project (at and teaches in the Curry programs in clinical and school psychology.

The Virginia guidelines for carrying out threat assessments are summarized in a manual, Recommended Practices for Virginia College Threat Assessment. The manual was introduced and explained in a series of workshops for college threat assessment teams in the spring of 2009 and is available on the Internet at

In this Issue

On this Topic


© 2016 Taylor & Francis Group · 530 Walnut Street, Suite 850, Philadelphia, PA · 19106