Don’t Wait: Recognize and Report Indicators of School Shooters

Of the 23 school shootings over the past five years in the United States, 63 percent of shooters [1] were current students at the time of the attack, according to the Naval Postgraduate School’s Center for Homeland Defense and Security, providing an opportunity for teachers and administrators to identify red flags and engage with law enforcement. Indicators for school personnel include: social media posts with alarming content; stalking or harassing behavior; increased depression; changes in behavior and appearance; drug use; expressions of suicidal thoughts; and erratic behavior.


  • A US Secret Service study found 93 percent of mass attack assailants [2] made prior threatening comments or in some way elicited concern within the community before the shootings. In May, two students who attacked their STEM School in Colorado, killing one and injuring eight, told classmates the day before “don’t come to school tomorrow.”

  • Nickolas Cruz, the assailant responsible for killing 17 students and staff members at Marjory Stoneman Douglas High School in February 2018, had a disturbing digital footprint. In addition to expressing extremist views, Cruz made disturbing comments on social media, such as “I wanna shoot people with my AR-15.” He claimed he was going to become a “professional school shooter” and posted photos of himself with a shotgun on his Instagram account.

  • Mass violence in schools may be motivated by past grievances; differing ideologies or beliefs; or as a result of bullying. In March of 2018, Austin Wyatt Rollins, a student at Great Mills High School in Maryland, opened fire on a classmate. His target, who suffered fatal injuries, was a female with whom he had a relationship that ended before the attack. The shooter took his own life.


The NTIC recommends the following to better protect yourself and your school against potential attacks:

  • Trust your instincts. If an individual demonstrates one or more of the common identifiers, report it. To report suspicious activity, visit iWATCH or call (202) 727-9099.

  • Utilize the District’s resources to prepare for an attack, such as AlertDC—a free emergency alert system—and Stop the Bleed—a campaign that trains and equips bystanders on how to handle a bleeding emergency.

  • Employ DC's Active Shooter Emergency Response Protocol

* Evacuation: For use when conditions outside are safer than inside.


* Alert Status: For use in securing access to the building, usually in a community emergency event.


* Lockdown: For use to protect building occupants from potential dangers in the building or outside.


[1] According to the Naval Postgraduate School Center for Homeland Defense and Security an active shooter at a K-12 school is an individual actively engaged in killing or attempting to kill people in a populated area.

[2] According to the US Secret Service National Threat Assessment Center, a mass attack is an incident where three or more individuals are harmed.


Additional Resources:

Download PDF

Provide Feedback on This Product

The NTIC is governed by a privacy, civil rights, and civil liberties protection policy to promote conduct that complies with applicable federal, state, and local laws. The NTIC does not seek or retain any information about individuals or organizations solely on the basis of their religious, political or social views or activities; their participation in a particular noncriminal organization or lawful event; or their race, ethnicities, citizenships, places of origin, ages, disabilities, genders, or sexual orientations. No information is gathered or collected by the NTIC in violation of federal or state laws or regulations.