Posted .


The contributors to this blog, Andy Patrick and Rich Wilson, are Senior Consultants with Sigma Threat Management Associates and will be presenting on the topic of Protective Intelligence Investigations at the ASIS International Conference in Atlanta, Georgia on September 30, 2014


What happens when a CEO receives increasingly frequent and bizarre letters from someone claiming his mind is being invaded by the company’s product and vows to make it stop no matter what? When a public figure or elected official is approached by an overly admiring or disturbed individual? When a former student or employee expresses a profound sense of injustice and begins to spiral into the throes of despair? Organizations and institutions are often unprepared to deal with these types of external threats from non-affiliates or “outsiders” especially when the behavior skirts the threshold for triggering criminal, civil or mental health crisis interventions. Typically the strategy defaults to “watch and wait” with lots of waiting and little watching supplemented by a response plan masquerading as a management plan.

An approach that can be helpful in moving past these largely defensive and reactive responses is integrating a protective intelligence investigation into the assessment process. The concept of a protective intelligence investigation, as pioneered by the United States Secret Service in 1998, provides a useful construct for how to assess and manage threats especially when controlling interventions are either not an option or might in fact be counterproductive. The goal of the investigation is to learn enough about the situation and the person of concern to – if not redirect or refocus their behavior – at least prevent them from getting close enough to stage an attack. Although originally intended as resource for state and local law enforcement officials, many of the concepts can be broadly applied by security departments and threat assessment teams in multiple environments.  Protective intelligence is a component of the assessment process that Sigma has long advocated.

Failing to conduct a thorough investigation is one of the most common oversights teams – especially ad hoc ones – make when assessing a case. Often times the investigating authority or threat assessment team relies upon initial reports and immediately begin considering intervention options.  When investigative efforts fall under the domain of human relations specialists or student affairs officers, they often do so with the goal of determining what policy violations or codes of conduct infractions might be applicable. The limited focus of these administrative inquiries yields little to assessing and managing the situation and person of concern.

Conversely, protective intelligence investigations take a more holistic look at the situation and leverages the skills of multiple team members, particularly those of mental health professionals, security and law enforcement.  The goal is to gather as much information as possible about the subject from multiple and corroborated sources to better understand their past behavior, current life circumstances, grievances, motivation, worldview and what future events might impact the risk and protective factors as they relate to mounting an attack.

The discreet mining of open source information such as social media, blogs, and public records can provide a trove of information prior to advancing into the more active phases of conducting collateral interviews,  monitoring by third party, civil restraining orders, interviews of the subject or surveillance operations.

Interviewing the subject when practical can provide a great deal of insight and the opening of a rapport that can lend itself to ongoing monitoring and assessment. There are many factors to be weighed in deciding if, when, and where an interview will be conducted and by whom. The foremost consideration should be safety followed by a risk – benefit analysis of what might be gained versus alerting the individual they are on your radar. The interviewer should be trained in protective intelligence investigations and have experience in dealing with the mentally ill. There may be times, however, when the most qualified person to conduct the interview may not be the best choice. An example would be when another team member already has established a trusting relationship with the subject or they may have a better pretext for engaging them. In these instances the interviewer should be prepared through scripting, coaching, and rehearsing by those who can convey the skills. Integrating such role playing into team training can help build confidence in advance versus hastily conscripting someone during an active investigation. Often times these cases can extend across numerous jurisdictions and require coordination with several layers of law enforcement agencies and community resources such as hospitals, mental health crisis response teams and other social services that might be marshaled to help stabilize and support a subject.  Some of the best outcomes are often a function of what can be done for the subject rather than what we can do to them. Effective liaison relationships are best when there are reciprocal commitments from all parties so that information and concerns about individuals or situations can be shared in a timely way. Consequently, it is important to ensure that investigators are cognizant of the types of legal and ethical conflicts inherent to dual relationships, privileged communication or privacy concerns. Notwithstanding, one way communication that might trigger a Tarasoff warning is far better than no communication at all. Finally, safety planning begins the moment a case presents itself and is adjusted accordingly as new information warrants or as the assessment changes in one direction or the other. Often with external threats there is a false belief that if you can’t control the subject you can’t control the situation. A good management plan, however, calls for factoring in other influencing dynamics such as the setting and environment, victim management and the stressors or likely precipitating events that might trigger escalation.

Influencing victim awareness through safety briefings, having them keep a log of activity, preserving evidence and providing them direct points of contact for non-emergency situations all help to enhance safety while also empowering victims who might otherwise feel helpless. Coordinating with other law enforcement jurisdictions to provide situation reports, flagging addresses, vehicles and persons of interest and connecting victims with representatives from those agencies adds further layers of security to the management plan. It is also important to stay attuned to precipitating events, anniversary dates and current events that might trigger a subject to approach or attack. The use of reliable 3rd party monitoring by those who may have frequent opportunities to observe or interact with the subject can also provide valuable information. Likewise, knowing if the subject is associating with others who might encourage the use of violence or expose them to alcohol or substance abuse is important. As noted earlier, if the subject has a caseworker or is in treatment you can provide information to those parties with the understanding that while they may not be able to share or reciprocate the exchange of information immediately, there may come a time when a Tarasoff warning could be triggered. Temporary relocation or work from home arrangements are an option as is temporarily relocating parking or office locations as well as safety escorts. Briefing gatekeepers and those with natural surveillance as well as making use of CTTV, visitor management protocols access control and increasing security patrols can all serve to harden the target.  Considerations regarding plain clothes or uniformed police officers will depend upon how visible or discrete you want to be and should be done in consultation with law enforcement. It is also important that local police be familiar with the layout of the office, facility or campus in the event that an emergency response is warranted.

The discussion on this topic barely scratches the surface of the many tools, techniques and nuances to consider in conducting a protective intelligence investigation. Our primary goal was to provide a very general overview of the utility and applicability of a protective intelligence investigation especially when dealing with external threats or internal threats soon to be external such as when severing ties with an employee or student. We would encourage you to learn more through the resources cited here or to seek training from qualified providers so as to better inform your efforts creating a capacity for protective intelligence investigations.




Deisinger, G., Randazzo, M., O’Neill, D., & Savage, J. (2008). The handbook for campus

threat assessment & management teams. Stoneham, MA: Applied Risk



Fein, R. A., & Vossekuil, B. (1998). Protective intelligence & threat assessment

investigations: A guide for state and local law enforcement officials. Washington,

D.C.: U.S. Department of Justice, Office of Justice Programs, National Institute of