The Communicated Threat

James Cousineau
Dec 27, 2025
17 min read

An Exhaustive Analysis of Leakage, Warning Behaviors, and Prevention Opportunities in Targeted Mass Violence

By: James Cousineau, Journalist youthandviolence@gmail.com

December 27, 2025 -The prevailing cultural narrative surrounding mass shootings and targeted violence often relies on the trope of the perpetrator who "snaps"—a sudden, unpredictable break from reality leading to spontaneous violence. This perception of the "impulsive avenger" suggests that such tragedies are inevitable forces of nature, immune to prediction or prevention. However, decades of rigorous research conducted by the Federal Bureau of Investigation (FBI), the United States Secret Service National Threat Assessment Center (NTAC), and academic bodies such as The Violence Project and Alfred University dismantle this myth. The data consistently demonstrates that targeted violence is the culmination of a detectable pathway of behavior, characterized by planning, preparation, and, most critically, the communication of intent to third parties—a phenomenon known as "leakage."

This report provides a comprehensive examination of the prevalence of leakage and warning behaviors among mass attackers, with a specific focus on school shooters. It analyzes the statistical frequency of these signs, the psychological underpinnings of why attackers communicate their intent, the sociological barriers that prevent bystanders from reporting these threats, and the comparative differences between completed and averted attacks. The synthesis of this data reveals that the vast majority of mass violence incidents, particularly in educational settings, are preceded by observable precursors that offer a window for intervention. The tragedy of mass violence is frequently not a failure of intelligence gathering, but a failure of information sharing and bystander intervention—a gap between the "signal" of the threat and the "noise" of daily life.

The Prevalence of Leakage and Observable Warning Signs

To understand the preventability of mass violence, one must first quantify the frequency with which attackers signal their intentions. The available data indicates that leakage is not an anomaly but a standard feature of the pre-attack behavior of mass shooters. Leakage is defined as the intentional or unintentional revelation of clues to a third party regarding feelings, thoughts, fantasies, attitudes, or intentions that signal an intent to commit a violent act.1 It is distinct from direct threats in that it may not be communicated to the intended victim but rather to a third party, often a peer or family member.

Statistical Frequency of Leakage

Research across multiple agencies confirms that the majority of attackers communicate their intent or display behavior that elicits concern prior to the event. The consistency of these findings across different methodologies and time periods underscores the reliability of leakage as a predictor.

United States Secret Service (NTAC) Findings: In a comprehensive review of mass attacks in public spaces between 2016 and 2020, the NTAC found that 75% of mass attackers exhibited concerning behaviors and communications prior to their attacks.3 More specifically, regarding school violence, the Secret Service's analysis of targeted school violence (Protecting America's Schools) revealed that 80% to 93% of school shooters shared their violent plans or engaged in behaviors that caused others to be concerned.2 In 59% of these cases, the attacker told more than one person, indicating that the information was not just leaked but disseminated.

FBI Active Shooter Study (2000–2013):

The FBI’s study of pre-attack behaviors found that 56% of active shooters leaked their intent to commit violence.1 However, this aggregate number obscures a critical age-related variance. When isolating school shooters (aged 17 and younger), the leakage rate skyrockets to 88%.1 This suggests that adolescent offenders are significantly more likely to broadcast their intentions than adult offenders, likely due to developmental factors and the social nature of the school environment.

The Violence Project:

In their broad database of mass shootings, The Violence Project identified that 44.1% of perpetrators leaked their plans ahead of time.7 While this figure is lower than the school-specific statistics, it reinforces that nearly half of all mass violence incidents involve specific pre-attack communication. Furthermore, recent studies focusing on the deadliest shootings suggest leakage rates may be even higher, with one study of the 15 deadliest shootings finding 87% of perpetrators leaked violent thoughts or intent.8

Demographic Variances in Leakage

Leakage is not uniform across all demographics. Research has identified significant correlations between the likelihood of leakage and factors such as age, race, and gender.

Age: As noted, leakage is significantly more common among younger shooters. 88% of active shooters aged 17 and younger leaked their intent, compared to 51% of adult active shooters.1 This disparity suggests that adolescents may use leakage as a form of social signaling or a "cry for help" more frequently than adults, who may be more socially isolated or operationally secure.

Race and Ethnicity: Studies indicate that White shooters are statistically more likely to leak their plans than those from other racial and ethnic groups. In one analysis, 53.9% of White shooters leaked their plans compared to 38.3% of shooters from other groups.9 This finding is critical for threat assessment teams to avoid bias; the absence of leakage in non-White subjects should not necessarily be interpreted as a lower risk, given the lower baseline frequency of leakage in that demographic.

Gender: In specific studies examining leakage, all perpetrators who leaked their plans were men.9 This aligns with the overwhelming overrepresentation of males in the perpetrator population but also highlights a potential gendered component to the communication of violent intent.

Table: Comparative Leakage Statistics by Agency and Demographic

The following table synthesizes data from multiple major studies to present a comparative view of leakage rates.

Source

Population Studied

Percentage Exhibiting Leakage/Warning Signs

Key Context

USSS NTAC (Protecting America's Schools)

School Shooters (K-12)

80% - 93%

"Signaling the attack" behaviors; 59% told more than one person.2

FBI (Pre-Attack Behaviors 2000-2013)

Active Shooters (Under 18)

88%

Significantly higher than adult shooters.1

FBI (Pre-Attack Behaviors 2000-2013)

Active Shooters (Adults)

51%

Leakage less common in older populations.1

USSS NTAC (Mass Attacks 2016-2020)

Mass Attackers (Public Spaces)

75%

Exhibited concerning behaviors/communications.3

The Violence Project

Mass Shooters (All Ages)

44.1%

Specific leakage of plans.7

Specific Study (Deadliest Shootings)

Top 15 Deadliest Shootings

87%

Higher lethality correlates with higher leakage.8

Safe School Initiative

School Shooters

81%

At least one person knew; in 59% of cases, multiple people knew.2

The Anatomy of Warning Behaviors

While leakage refers specifically to the communication of intent, "warning behaviors" encompass a broader spectrum of observable actions that indicate an individual is on a pathway to violence. The FBI and Secret Service have cataloged these behaviors to aid threat assessment teams in identifying individuals who may pose a threat before they act.

The Five Key Indicators (FBI)

The FBI identified five primary indicators present in the majority of active shooter cases. These indicators provide a behavioral roadmap of the attacker's progression 6:

Grievance (79%):

The vast majority of attackers act on a grievance—a real or perceived injustice. In 90% of these cases, the grievance was personal, such as bullying, adverse employment action, or domestic issues.6 This challenges the notion of "senseless" violence; to the attacker, the violence is a rational, albeit pathological, solution to a perceived wrong. The grievance is the fuel for the pathway to violence.

Mental Health Struggles (62%):

While mental illness alone is not a predictor of violence, and the majority of people with mental illness are not violent, attackers often display symptoms of undiagnosed or untreated mental health stressors. These include depression, anxiety, and paranoia, often exacerbated by life stressors.1 Importantly, leakage is often associated with suicidality, linking this indicator directly to the communication of intent.

Problematic Interpersonal Interactions (57%):

A history of conflicts with peers, family, or authority figures is common.6 This reflects the social friction that often precipitates the grievance.

Leakage of Intent (56%): As detailed in Section 1, the explicit communication of intent is a primary indicator.

Reduced Quality of Thinking or Communication (54%):

This includes confused or irrational thought processes, negative self-talk, "catastrophizing" (expecting the worst), and "filtering" (focusing only on the negative).6 This cognitive deterioration often precedes the attack as the individual becomes increasingly isolated and desperate.

Fixation and Identification

Beyond the FBI's top five, the Secret Service and other researchers emphasize "fixation" and "identification" as critical warning signs. Approximately one-fifth of attackers demonstrate an obsessive interest in past mass attacks (e.g., Columbine, Sandy Hook) or violent media.3

This phenomenon, often described as the "copycat effect" or "social contagion," involves the attacker researching the tactics, weapons, and manifestos of previous shooters.11 For example, in 2019, several attackers referenced the Christchurch mosque shootings or the Marjory Stoneman Douglas High School shooting in their own planning.11 This fixation serves as a form of "social script," providing the potential attacker with a blueprint for action and a warped path to fame.7 The attacker identifies with previous perpetrators, viewing them as anti-heroes or martyrs, and seeks to emulate their notoriety.

Preparation and Capacity

Warning signs also include logistical preparations, which distinguish a "transient threat" (expression of anger) from a "substantive threat" (intent to act). The FBI found that 77% of subjects spent a week or longer planning their attack, and 46% spent a week or longer engaging in actual preparation, such as procuring weapons or conducting surveillance.13

Firearm Acquisition:

Most active shooters (40%) purchased firearms legally specifically for the attack, while 35% already possessed them.1 This underscores that the acquisition of a weapon is often a late-stage warning sign.

Unusual Firearm Behavior:

A change in firearm behavior, such as increased practice, fascination with tactical gear, or contextually inappropriate interest in weapons, was observed in 21% of cases.10

Legacy Tokens:

The FBI identified that 30% of active shooters created "legacy tokens"—manifestos, videos, or social media posts deliberately created to claim credit and articulate motives.14 These items are often prepared in advance and leaked or scheduled for release immediately prior to the attack.

The Psychology of Leakage—Why Do They Tell?

A common misconception among the public and even some law enforcement professionals is that attackers who leak their plans are merely bragging, joking, or seeking attention without intent to act. However, clinical analysis suggests that leakage serves complex psychological functions, often acting as a desperate "cry for help" or a mechanism for social validation. Understanding why they tell is crucial for understanding how to respond.

The "Cry for Help" Hypothesis

Recent research suggests that leakage is strongly associated with suicidality and prior counseling. A study of 170 perpetrators found that leakage was linked to a history of receiving counseling (Odds Ratio: 7.0) and suicidality (Odds Ratio: 3.7).9 This indicates that for many attackers, the communication of intent is an ambivalent signal—a subconscious hope that someone will intervene and stop the progression toward violence.

As noted by Dr. Jillian Peterson of The Violence Project, leakage is often a "last minute cry into the void," asking, "Is anyone going to stop me?".15 The attacker is often caught between the drive to commit the act (to resolve the grievance) and the fear of the consequences (death or imprisonment). The leakage creates an opportunity for external control when internal control has failed. This ambivalence is a critical intervention point; the attacker has not yet fully committed to the act and may still be divertible.

Fame and Legacy Tokens

Conversely, leakage can also serve a narcissistic function. Many attackers are motivated by a desire for notoriety, viewing the attack as a means to achieve fame and validation that was denied to them in life.12 The "media contagion effect" plays a significant role here; attackers see the intense media coverage of previous shooters and seek to achieve similar status.

By leaking intent, the attacker begins the "performance" of the attack before the first shot is fired. They garner attention, fear, and "respect" from their peers. The creation of legacy tokens—manifestos, videos—is part of this performance, ensuring that their narrative survives their death.14 In the digital age, this performance is often played out on social media stages, where "likes" and shares provide immediate reinforcement for violent ideation.

The Bystander Dilemma—Barriers to Reporting

The data presents a paradox: if 80-90% of school shooters tell someone beforehand, why are so few attacks prevented? The answer lies in the complex behavioral dynamics of the bystanders—primarily students—who receive this information. The failure is rarely in the transmission of the signal, but in the reception and relay of that signal to authority.

The "Code of Silence" and Peer Dynamics

In 4 out of 5 school shootings, at least one other person had knowledge of the attacker's plan but failed to report it.16 The FBI found that in 54% of cases where concerning behavior was observed, the observer did nothing.10

Alfred University’s landmark study on lethal school violence provides deep insight into why students stay silent. The findings reveal a profound "Code of Silence" governed by social norms and fears:

The Snitching Stigma:

There is a culturally ingrained prohibition against "snitching" or betraying a peer's confidence. This is particularly strong in adolescent peer groups where loyalty is paramount.

Minimization:

Students often dismiss threats as "joking" or "not serious." Research indicates that when threats are overt or repetitive, bystanders may paradoxically view them as less serious, assuming that a "real" attacker would not be so open.18 They rationalize the behavior as "just talk" or "blowing off steam."

Fear of Repercussions: Students fear retaliation from the potential attacker or social ostracization from their peer group if they are identified as the reporter.20

The Normalization of Deviance

A critical sociological barrier is the "normalization of deviance." In environments where aggressive language, dark humor, or fascination with violence is commonplace, genuine threats lose their signal value.21

Desensitization: Constant exposure to violence in media, video games, and news cycles can lead to emotional desensitization. Students may process a threat of a school shooting as a mundane aspect of modern American life rather than an imminent emergency.23 The threat becomes background noise.

The "Boy Who Cried Wolf" Effect:

If a student frequently makes idle threats or jokes about violence, peers may habituate to this behavior and fail to recognize the escalation when the threats become substantive.25

Who Do Students Tell?

When students do decide to report, their choice of confidant is crucial for prevention protocols. Alfred University found distinct preferences in who students trust:

Teachers: 80% of students would tell a teacher.

Parents: 75% would tell a parent.

School Staff: 68% would tell a counselor.

Law Enforcement:

Only 51% would tell a security guard or police officer.26

This data suggests that maintaining strong, trusting relationships between students and teachers is a more effective intelligence-gathering mechanism than hardened security measures. Students are significantly more likely to disclose sensitive information to an educator they trust than to a uniformed authority figure. This highlights the importance of "school climate" as a safety feature.

Fatalism and the "Nothing Can Be Done" Attitude

Alarmingly, 13% of students believe that nothing can be done to stop school shootings. This fatalism is significantly higher (40%) among students identified as "most dangerous" (those with both the means and inclination for violence).27 This belief system creates a dangerous feedback loop where potential attackers feel their actions are inevitable, and bystanders feel powerless to intervene. This fatalism is likely exacerbated by the high visibility of successful mass shootings in the media, creating a perception of inevitability.

The Digital Dimension—Social Media as a Leakage Vector

The landscape of leakage has evolved with the digital age. Social media platforms provide a low-barrier, high-visibility outlet for potential attackers to broadcast their grievances and intentions. The shift from physical diaries to digital posts has transformed leakage from a private act to a public performance.

Shift from Diaries to Digital Posts

Historically, leakage might have been found in a private journal or a note passed in class. Today, it appears on TikTok, Snapchat, Discord, and 8kun.

Non-Specific Threats:

The Violence Project notes that social media leakage often takes the form of "non-specific violence" threats, which can complicate threat assessment.28 A post might reference "doom" or "revenge" without naming a time or place, leading moderators or peers to dismiss it as teen angst.

Case Study:

Oxford High School: The Oxford High School shooting serves as a grim exemplar of ignored digital and behavioral signs. The perpetrator exhibited clear warning signs, including searching for ammunition on his phone at school and drawing violent images with the captions "blood everywhere" and "the thoughts won't stop - help me".7

Parental Liability:

In a legal precedent, the parents were charged and convicted of involuntary manslaughter for failing to secure the firearm and ignoring these acute warning signs.29 This case highlights that "bystanders" includes parents, who are often the best-positioned observers of leakage (spouses and family members observe concerning behavior in 83% of adult cases).10

The Challenge of Online Anonymity

While social media increases the volume of leakage, it also introduces anonymity. Threats made on platforms like Yubo or 4chan may be viewed by strangers who have no connection to the attacker's physical location or identity, making reporting difficult.31 A user in California might see a threat from a user in Florida but have no way to identify the school or the individual.

However, when these threats are reported to specialized entities (like the FBI Guardian system), they can be successfully traced. Recent averted plots have relied heavily on digital forensics to deanonymize threats and locate suspects before they can act.

Comparative Analysis—Completed vs. Averted Attacks

Comparing completed attacks with those that were successfully averted reveals that the primary differentiator is not the absence of danger, but the presence of reporting and intervention. The difference between a headline about a tragedy and a headline about an arrest is often a single report.

The Role of Reporting in Aversion

A study of averted school shootings found that the majority (66%) were prevented specifically because of the offender's verbal or written leakage of violent intent, which was reported by a peer.32

Completed Attacks:

In completed shootings, leakage was often present but dismissed or not reported to authority figures who could intervene.32 The signal was sent, but the receiver failed to act.

Co-Conspirators:

Plots involving more than one offender are far more likely to be foiled. The communication required to coordinate an attack increases the "surface area" for leakage and detection. All failed mass school shootings in one study involved single offenders, whereas co-conspirator plots were consistently intercepted.32 Solitary offenders are harder to detect because their leakage may be more subtle or internal.

Success Stories: The System Working

Recent examples demonstrate the efficacy of reporting systems when leakage is recognized and acted upon:

Lubbock, Texas (2025): An anonymous tip regarding "alarming online activity" led the FBI to a suspect who was preparing to attack an elementary school. He was arrested after a standoff.35 This case illustrates the vital link between digital observation and physical intervention.

Palm Beach, Florida (2024): An FBI Guardian Tip regarding online threats led to the arrest of a suspect with a "shocking level of preparation," including automatic weapons, police uniforms, and hundreds of pounds of ammunition. The suspect had communicated with a school shooter in Wisconsin, highlighting the interconnected nature of the online threat community.36

Mooresville, Indiana: A tip to the "Say Something" anonymous reporting system about a student purchasing body armor and admiring past shooters led to an arrest and the prevention of a planned attack.35

In these cases, the "leakage" was not dismissed. It was recognized, reported, and acted upon by threat assessment teams and law enforcement. The "If You See Something, Say Something" model, when supported by responsive infrastructure, works.

Implications for Prevention and Policy

The data gathered in this report points to several critical implications for school safety and public policy. The focus must shift from reactive security to proactive behavioral assessment.

The Primacy of Behavioral Threat Assessment (BTA)

Physical security measures (metal detectors, active shooter drills) address the attack after it has commenced or reached the school door. However, the data on leakage confirms that the most effective intervention point is days, weeks, or months before the attack.

Recommendation:

Schools and workplaces must establish multidisciplinary Behavioral Threat Assessment (BTA) teams. These teams, trained in models like the Virginia Model or the NTAC guidelines, can distinguish between "transient" (non-serious) and "substantive" (serious) threats.19

Holistic Approach: Intervention should not just be punitive (arrest/expulsion) but therapeutic. Since leakage is often a cry for help linked to suicidality, connecting the subject with mental health services can de-escalate the pathway to violence.9 Expelling a student without addressing the underlying grievance or mental health crisis may simply remove the student from the school's observation zone while leaving the threat intact.

Cultivating a Culture of Reporting

To overcome the "Code of Silence," institutions must shift the cultural narrative from "snitching" to "care-taking."

Anonymous Reporting Systems: Programs like "Say Something" and other anonymous tip lines have proven effective in lowering the barrier to reporting.35 These systems remove the fear of social retaliation.

Education: Students and staff must be trained to recognize that "joking" about mass violence is a high-risk indicator. The "normalization of deviance" must be countered with explicit training on the signs of leakage.21 Students need to understand that reporting a threat is not getting someone in trouble, but getting them out of trouble (and preventing tragedy).

The Role of Parents and Gun Safety

With 70-80% of school shooters obtaining their weapons from the home 38, and parents often being the observers of leakage 10, parental education is paramount. The Oxford High School precedent suggests that failure to act on known leakage and failure to secure weapons may carry severe legal liability.29 Parents must be educated on the warning signs and the absolute necessity of secure firearm storage.

The question "What percentage of mass attackers speak of the attack prior to acting?" yields a definitive and actionable answer:

The majority do.

With 56% of all active shooters, 75% of mass attackers, and up to 93% of school shooters communicating their intent or displaying observable warning signs, the notion that these attacks are unpredictable "lightning strikes" is statistically unfounded. The tragedy of mass violence is often not a failure of intelligence gathering, but a failure of information sharing and bystander intervention.

The gap between a completed massacre and an averted tragedy is frequently a single conversation—a peer who decides to take a "joke" seriously, a parent who acknowledges a child's fixation with violence, or a teacher who reports a disturbing essay. The data supports a shift in focus from solely hardening targets to "softening" the barriers to reporting, ensuring that when an attacker leaks their intent—as they almost always do—there is a system ready to listen and intervene.

Summary of Key Statistics

See the drop down menu for resources and information CLICK HERE FOR WEBINAR INFO

The Communicated Threat

Recent Posts

Comments