An active shooter, the other insider threat: ANALYSIS

Less than a week ago, a shooting suspect in Virginia Beach walked through his place of employment, a municipal building, killing 12 people, and injuring several more. The suspect had no reported previous criminal record or disciplinary issues at work. One colleague regarded him as a “nice guy” who gave candies to administrative staff at Christmas.

On the morning of the shooting, the suspect submitted his sudden resignation via email. In the bathroom of the office, brushed his teeth, told a coworker to have a good day -- then opened fire.

Mass deadly shootings in the U.S. -- when more than four people are killed -- occur most frequently in places of business, according to the FBI. During those attacks, this “targeted violence” most often stems from a personal grievance and retaliation for perceived wrongs related to their workplace, according to the Mass Attacks in Public Spaces analysis conducted by the Secret Service.

That makes protecting businesses, schools, or government offices challenging. Since employees often don’t go through the same security protocols as guests do at these locations, how can you identify when something just isn’t right?

Virginia Beach City manager David Hansen, speaking after the shooting, said the alleged gunman was not forced to resign, his performance was “satisfactory," he was in “good standing” in his department and had no ongoing discipline issues.

Though we may never know the motivations behind the shooting, there is significant overlap between warning signs for what the FBI calls a potential “insider threat” of a workplace employee, which usually applies to theft, and what the Secret Service classifies as “indicators” for acts of “targeted violence”

Some of the behavioral indicators of an “Insider Threat,” according to the FBI, include:

■ Anger/Revenge: disgruntlement to the point of wanting to retaliate against the organization.
■ Problems at work: a lack of recognition, disagreements with co-workers or managers, dissatisfaction with the job, a pending layoff.
■ Vulnerability to blackmail: extra-marital affairs, gambling, fraud.
■ Ego/Self-image: vulnerability to flattery or the promise of a better job.
■ Compulsive and destructive behavior: Drug or alcohol abuse, or other addictive behaviors.
■ Family problems: Marital conflicts or separation from loved ones.

A perpetrator of a Mass Attack in a Public space, according to the Secret Service analysis, may have the following behavioral indicators:

■ Family/romantic relationships, such as spousal estrangements, divorces, romantic breakups, rejected proposals, physical or emotional abuse, or the death of a parent.
■ Personal issues, such as unstable living conditions, physical illnesses, or other significant disorders.
■ Work or school environments, such as being fired or suspended, filing grievances, being bullied at work or at school, feeling disrespected, or being the subject of real or perceived gossip.

In both the insider threat and mass attack analysis, it is clear that many of the behavioral indicators are similar. When related to issues at work, issues at home or addiction problems, these could be triggers to propel someone to conduct an attack in the workplace.

One thing is also clear: the actions of these individuals and their “red flag” behaviors don’t occur in silence. Most attackers engage in threatening or concerning communications such as overly angry statements, racist comments, references to past attackers, suicidal language, or comments indicative of their intent to carry out an attack, according to the Secret Service.“Though the presence of prior threats to the target is unusual for some forms of targeted violence (e.g., assassination), it is often seen in cases involving domestic or workplace violence, which together represent over a third of the mass attacks described in this report,” the Secret Service analysis reads.

The sudden resignation of the alleged Virginia Beach gunman was a red flag, as was his propensity, according to neighbors, to stay up all night. A sudden resignation or sudden change in personal circumstances or behaviors should elicit concern that begs the question: what is going on?

What is glaring in both the analysis of workplace insider threats and active shooters or acts of “targeted violence,” is that often people notice something is wrong, but fail to say something.

In many situations, the studies show that concerns were raised about an individual’s behaviors that many thought was odd or suspicious, and caused alarm in those who observed them.

For places of business, government or schools looking to better identify and protect themselves from this type of insider threat, there are three fundamental steps to follow.

1. Identification. Paying attention to the identified behavioral indicators can be a key to prevention

2. Intervention. Once a behavioral indicator is identified, the “see something say something” rule should kick in. An informal or formal intervention with the person, depending upon the situation, maybe in order. All organizations should have some type of procedures in place when someone exhibits this type of behavior. The John Jay College of Criminal Justice, for example, has a “behavior intervention team” in place to avert a crisis on campus.

3. Inoculation. Just like with viruses, after a potential threat is identified, it’s time to go on the offense and ensure no other threats are looming and all and any avenues of an attack at mitigated. This mitigation could include speaking with other employees about the identified employee’s behaviors, doing a forensic search of issued computers or cell phones for threatening information, or contacting family to see if they had noticed any issues. If the potential attacker was going to take advantage of a vulnerability, ensure that vulnerability is addressed and if an organization understands the scope of the plan. Do a forensic investigation and pull the attacker’s plan apart and ensure you address each aspect that the potential attack may have taken advantage of.

For any organization looking to develop a crisis response plan, that plan should include the full scope of law enforcement, fire, EMS, as well as psychological and other supportive entities that could respond to and support an organization in a time of need.

But before that, it is imperative that all organizations pay attention to behavioral signs, and take time to plan and prepare for any type of a threat before the threat plans against you.

Donald J. Mihalek is an ABC News contributor, retired senior Secret Service agent and regional field training instructor who also serves as the executive vice president of the Federal Law Enforcement Officers Association Foundation.

Richard Frankel is an ABC News contributor and retired FBI special agent who was the special agent in charge of the FBI's Newark Division and prior to that, the FBI's NY Joint Terrorism TASK force. He is currently the Vice President of Investigation for T&M Protection Resources.