‘They don’t fit’: The ABC’s of spotting an active shooter

Last week, just days before a 17-year-old gunman killed 10 people at a Texas high school, the FBI released its latest active shooter report. The bottom line: 2016 and 2017 were 140 percent deadlier than the years before.

2016 and 2017 were the years that active shooters opened fire at the Pulse Nightclub in Orlando, First Baptist Church in Sutherland, Texas, and the Route 91 Harvest Festival in Las Vegas. During those two years, 50 active shooters killed 220 people, up from the 92 killed in 2014 and 2015, the FBI reported. This year 2018, it seems that uptick continues as high-profile school shootings in Parkland, Fla. and now in Santa Fe, Texas, have galvanized student and parent activists, lobbyists, and politicians.

In all cases, these active shooter events unfold in what seems like seconds, but Michael Rozin, CEO of Rozin Security, said that well-trained security and law enforcement officers can spot potential threats long before these active shooters pull a trigger. We asked him just how security personnel can spot an active shooter before they attack.

Active shooter events happen fast. Do shooters have “tells,” that security officers should be on the lookout for?

There’s a little myth that you can spot a perpetrator solely by behavioral indicators. Behavior in a vacuum means nothing. But it’s sexy, and it’s certainly the most interesting, because it involves psychology and physiology.

When we encounter something dangerous, our brain tells our body, “Look, you gotta’ prepare for the worst-case scenario.” So, when a perpetrator believes they might get caught, when they’re observed by security or law enforcement, we have seen clusters of behavioral indicators.

First, we tend to pacify ourselves: We start suddenly massaging our neck, we start chewing our fingers, we rub our shoulders. Then, as your body prepares for fight or flight, you warm up. You start sweating on your forehead, upper lip, underneath the chin. Another indicator is nervousness. We’re not comfortable. We tend to block the front of our body, our movements tend to be more rigid, we tend to be more hyper-aware of our environment and more.

Does this kind of behavior profiling lead to false flags? There are a lot of reasons someone might be nervous—they don’t like crowds, or they’ve had run-ins with the police before.

The short answer is Yes if you’re very good or trained properly. There’s a little myth here that you can spot a perpetrator solely by behavioral indicators, which sometimes you can do. But behavior by itself in a vacuum is not enough.

The TSA, for example, has their version of a detection program that has been heavily scrutinized, and their performance hasn’t been that great all around. And, the reason is, because they zero in on behavior. And, they make decisions solely on behavior. It’s not working. There’s not enough information. You don’t know many things simply by observing behavior.

So how do you give the profile more context?

We have a system we call ABCD. It’s actions, behaviors and appearance, belongings, contextual profile, and documents. And contextual profile and actions are by far more important than actual behavior.


Yes, actions and behavior are different. We call them aggressors’ methods of operation or AMOs. It’s simply the type of things that you need to do to be successful in carrying out any violent act.

For example, when Sandy Hook shooter was staging his attack, he visited over 13 schools in Connecticut. He would spend some time in each one of those schools. When he settled on Sandy Hook Elementary School, he would go there seven different times over the course of two to three weeks and each time he spent anywhere between one hour to an hour and 30 minutes, and sometimes more.

This is called intel gathering and surveillance. He was collecting information about the school. Is there security there? Are they armed? Where are they positioned? What are the security measures in the school right now? When can he get in? When can he get out? What times do the classes start? What is the routine of the school?

He then designed the plan for attack, another phase. He was collecting the weapons that he needed to collect. The day before the attack he went back to the school, and that is what we call dry run, for example. It was a rehearsal. Another AMO. And, only then he proceeded to carry out the attack after he killed his mother.

These phases that I described are very common. Sometimes all of them are displayed, sometimes only part of them are displayed.

So, what do these phases look like in the real world? How do you tell a potential attacker surveilling your school or office from someone in their car on a cigarette break?

Intel gathering is a process of collecting information. Typically, the way to collect information is to ask a lot of questions. You do that under different pretexts. You might be a visitor, a student, a shopper, a researcher. Often, they ask operational questions that are odd or unusual.

Surveillance is different because you simply have the be in the area in such way that you don’t stand out, whether it’s in a car or on a bench or in a coffee shop. You tend to take notes and you tend to collect videos and pictures, and later you go back and think it through, “Okay, so I saw that the buses arrive at 9:00. I saw that by 9:30 everyone is in. I saw the security guard is not outside anymore.” They do that multiple times to be certain that Monday is not going to be different than Friday.

That’s a lot of executive planning for people widely considered to be unhinged.

These guys are not sophisticated terrorists, but because they want to succeed in their plan they’re simply forced to learn their environment. They’re trying to figure out the weak points of their environment and trying to figure out how to carry their act so they can kill the most people.

And this ladders up into a contextual profile?

A profile is a combination of actions, of behavior, belongings, identity, attire, all those elements that work together. Do they fit the norm? Meaning, if you were looking at the shooter— Parkland, Columbine, Virginia Tech— moments before the shooting, you’ll see that they completely don’t fit with the display of profile of a typical student. Their attire is completely different. Their actions are extremely different than everybody else. Their belongings are not present or they carry very different belongings.

What kind of belongings?

So, often we see assault rifles or shotguns are used in shootings. They need to first bring them in or position themselves without attracting attention. They can’t simply walk in with an AK-47 from their vehicle, right? So, they conceal their weaponry until they’re ready to strike.

Commonly, they conceal it under their clothing. They would wear baggier clothing and they would hold an AK-47, AR-15, or other weaponry underneath the clothing. So, you see from a distance the way they walk, how they’re positioned, the way they’re clothing appears, is very different.

Second common thing is they’ll try to bring musical instrument cases and they’ll try to conceal a weapon inside a musical instrument case. That’s another common thing.

And when you see those things all together…

Along with behavioral cues? Then you know that you have something that you really have to investigate and very fast.

Many of the articles within the media pages of the patriot1tech.com website are 3rd party in origin and have been included for informative purposes only. Decisions to include articles are solely based on the timely nature of the storyline as it applies to the security industry in general and to the proliferation of threats to public safety in particular. The inclusion of these articles does not imply that PATRIOT ONE its management, agents or employees endorses any statements expressed. The public is advised to fully investigate any contentious claims or assertions prior to arriving at any conclusions. Any hyperlinks included in these articles does not imply that PATRIOT ONE monitors or endorses these websites. Accordingly, PATRIOT ONE accepts no responsibility for such websites. Additional information regarding exclusions and liability limitations are outlined here.