It's become more difficult to identify motivations behind mass casualty attacks: DHS

A toxic brew of ideological extremism, blended with rage, anger and violent tendencies is making it increasingly difficult for authorities to identify motivations behind mass casualty attacks in America, according to a new assessment by the Department of Homeland Security.

The confidential analysis, distributed to law enforcement on Jan. 10 and obtained by ABC News, describes the growing challenge posed by perpetrators who "espoused and engaged with an array of narratives," often online, "likely fueling their mobilization to violence."

Those attackers' range of beliefs made it easier to escape the longstanding templates law enforcement uses to catch would-be threats – and made it harder for police to intervene or secure potential targets, the analysis found.

"Since 2018, we have observed mass casualty attacks in which the perpetrators held multiple grievances, challenging our ability to identify a primary motive," the bulletin said.

Examining eight attacks in the past five years which collectively killed 47 people and injured nearly 130 more, DHS' analysis found the "recent attackers influenced by mixed factors complicate target identification for law enforcement."

Understanding what spurs a mass killer to action is a crucial piece of the intervention puzzle, experts say. And, the evolving threat environment - heightened by conflict in the Middle East and fueled by hate speech rampant on social media - requires a more elastic screening process to spot warning signs among would-be attackers that might otherwise go unheeded.

"We can no longer afford to look at emerging threats the same way we looked at them 10 years ago," said John Cohen, a former senior official in the Department of Homeland Security, now an ABC News contributor. "Individuals who now engage in mass casualty attacks will typically adopt a blend of ideological beliefs and personal grievances that they cultivate through the consumption of online content – and if that is not recognized by investigators, they aren't going to understand what they are seeing."

The eight attackers analyzed by DHS "all had personal connections to their targets and exhibited a fascination with violence, judging from their digital footprint and engagement with violent content," the bulletin said. They "particularly" showed interest in school shootings and "held homicidal and suicidal ideations, including 'suicide by cop' and suicide following committing a mass casualty attack."

Some perpetrators consumed violent extremist content online, which "often promoted white supremacy narratives," while "others expressed hate-based grievances against specific groups, including law enforcement officers, women, and the Jewish community."

Attackers analyzed in the bulletin often chose "familiar targets over ideological ones." A trend starkly contrasted to "other mass casualty attackers, typically domestic violent extremists (DVEs), who had a single, discernible motive for choosing targets that furthered their ideological goals."

"It's important that the Department of Homeland Security recognize analytically what law enforcement has been confronting for almost a decade – which is the threat environment has evolved," said Cohen, whose research focuses on the people who commit mass casualty attacks. "When law enforcement looks at these online footprints, they see people who do not fit into the traditional categories of terrorism activity – so, when you're evaluating them, trying to pin the issue on one single piece of ideology as the motive is not going to allow you to assess this person's risk correctly."

The analysis describes the "disconnect between the targets these attackers threatened in their pre-attack statements and the actual targets they attacked constrains our ability to anticipate violence."

The man who opened fire on New York City subway passengers in April 2022 had "posted hundreds of videos on YouTube about his anger toward law enforcement, various ethnicities, and religions, but only mentioned the subway a handful of times to highlight the inability of government officials to protect the public in recent subway attacks, based on a review of his social media content," the bulletin said, adding that "comparatively, most [domestic violent extremist] attackers with a singular motive focus on traditional, predictable targets aligned to ideological grievances and offer opportunities for target hardening."

The "sheer amount of available violent, and often graphic, media content being shared online, particularly depicting terrorist attacks, mass killings, serial killers, accidents, school shootings, and suicide, offers a plethora of inspiration for those mobilizing to violence," the analysis said.

Beyond "suspicious behaviors online, some attackers made concerning statements to family and friends," the analysis said. It noted the man who opened fire at an Indiana mall in 2022 – who told an ex-girlfriend that "this world is not made for me and I will not live past 20 years old," and that he would "take others" with him.

"According to local law enforcement, this information was not reported to police," the analysis said, and that several years prior to the attack, the FBI "received a tip related to the perpetrator's online fascination with mass killings but was unable to link the username to the attacker."

Cohen equated the current threat environment to "salad bar extremism" where people subscribe to sundry narratives, and said the multiple-grievance actors are able to evade traditional detection models.

"That means you have to change your focus beyond simply looking at uncovering a specific plot to a specific location at a specific time, to individuals who represent a higher risk of engaging in violence, and focusing on managing the risk of those individuals," he said.

"It's not that they're not on the radar," Cohen added, "It's that we've been looking at the wrong radar screen."