Wisconsin School Threat
Assessment Protocol
A Guide for School Personnel and
Law Enforcement Officers

Wisconsin Department of Justice
Office of School Safety

March 2019

 DISCLAIMER
This document does not constitute either an informal or formal opinion of the Wisconsin
Attorney General or the Wisconsin Department of Justice as described in Wis. Stat. §
165.015(1). It does not constitute legal advice or counsel. It does not create an attorney-client
relationship. It creates no rights beyond those established under the constitutions, statutes,
regulations and administrative rules of the United States and the State of Wisconsin. It does not
attempt to provide answers to every question that may arise regarding school safety.
This document reflects the law as of the date of its publication. It may be superseded or affected
by other versions or changes in the law.

March 8, 2019

2

 Acknowledgements
Contributions to this document were made by the following list of individuals and organizations.
Wisconsin Department of Justice, Office of School Safety
Kristen Devitt, Director
Glenn Rehberg, Deputy Director
Susan Whitstone, Program and Policy Analyst
Erin Armbrust, Program and Policy Analyst
Stephanie La Haye, Grant Specialist
Office of School Safety, School Threat Assessment Project Committee
Tricia Kilpin, Greendale School District
Sue Williams, Greendale School District
Jessie Sloan, CESA 4
Stacey Eslick, Wisconsin School Counselor’s Association
Travis Pinter, Wisconsin School Psychologist’s Association
Brian Holmquist, Madison Metropolitan School District
Brian Dean, Wisconsin Department of Public Instruction
Katie Eklund, Wisconsin Center for Educational Research
Kurt Eley, Wisconsin Council of Administrators of Special Services
National Threat Assessment Center, United States Secret Service

March 8, 2019

3

 Table of Contents
Introduction…………………………………………page 5
Threat Assessment Teams…………………………..page 7
National Threat Assessment Center………………..page 13
FBI School Threat Assessment Process…………….page 15
Wisconsin School Threat Assessment ………...……page 20
Phase I…………...……………………………………page 20
Phase II…………………………………………….....page 24
Phase III………………………………………………page 25
Information Sharing/Consent……………………….page 27
Summary……………………………………………..page 30
References…………………………………………....page 31

March 8, 2019

4

 Introduction
2017 Wisconsin Act 143 created the Office of School Safety within the Wisconsin Department
of Justice. It required that the Office of School Safety consult with the Department of Public
Instruction, Wisconsin School Safety Coordinators Association, and the Wisconsin Safe and
Healthy Schools Center. The Act required that the Office of School Safety provide best practice
guidance to schools around the state. The Wisconsin School Violence Threat Assessment is a
significant part of that guidance. This protocol was developed to assist school safety
professionals in identifying students of concern so that their behaviors can be mitigated to the
point that they no longer pose a threat.
This guide focuses on one of the most important school violence prevention tools, the school
based threat assessment. School Threat Assessment should be applied as an early intervention
tool. A well designed threat assessment protocol should help identify students that need
additional resources.
After the massacre at Columbine High School, the Governor of Colorado, Bill Owens, assembled
the Columbine Review Commission. The commission included a multidisciplinary board of
experts on the topic at hand. After reviewing records, hearing testimony, and examining law
enforcement investigations, the commission developed several recommendations that formed the
foundations of nationally recognized best practices in school safety.
The Columbine Review Commission made specific recommendations regarding the detection of
threats made in the school environment 1. First, the commission recognized that there is
reluctance to report threats to administrators and police. Either students don’t want to be seen as
a “snitch” or adults don’t see threats made by “children” as viable. This culture needs to be
changed in order to appropriately asses the lethality of any threats made.
Schools were also instructed to develop an anonymous tip line and begin bullying prevention
programs. Bullying prevention has since become a common theme in school violence prevention
and most school districts have mandated bullying prevention curriculum. However, the
implementation of anonymous tip lines is less common. While several school districts in the
state already have tip lines, statewide anonymous tip applications are currently being evaluated
across the country.
Most importantly, schools were advised by the commission to assemble a threat assessment
team. Each team should include counselors, principals, school psychologists and law
enforcement personnel. They should complete training on conducting a threat assessment,
suicide prevention and laws regarding confidentiality (FERPA) 2.

1
2

Columbine Review Commission, 2001, p. 94-97
Columbine Review Commission, 2001, p.109

March 8, 2019

5

 Since the Columbine Review Commission, the United States Secret Service, The United States
Department of Education and the Federal Bureau of Investigation (FBI) have affirmed the
recommendation for multi-disciplinary school based threat assessment teams in the following
documents;
•

Enhancing School Safety Using a Threat Assessment Model: An Operational Guide for
Preventing Targeted School Violence.
https://www.secretservice.gov/data/protection/ntac/USSS NTAC Enhancing School Sa
fety_Guide_7.11.18.pdf.

•

Threat assessment in schools: A guide to managing threatening situations and to creating
safe school climates. www.secretservice.gov/ntac/ssi guide.pdf

•

The school shooter: A threat assessment perspective. www.fbi.gov/statsservices/publications/school-shooter

•

The final report of the safe school initiative: Implications for the prevention of school
attacks in the United States. http://www.secretservice.gov/ntac/ssi_final_report.pdf

March 8, 2019

6

 School Threat Assessment Teams
In July of 2018, the National Threat Assessment Center, a component of the United States Secret
Service, released “Enhancing School Safety Using a Threat Assessment Model”. This guide
included 8 steps to developing an effective threat assessment team in the educational
environment;
1. Establish a multidisciplinary threat assessment team.
• Teams should include personnel from a variety of disciplines within the school
community.
• The team needs to have a specifically designated leader.
• Teams should establish protocols and procedures that are followed for each
assessment, including who will interview the student of concern; who will talk to
classmates, teachers, or parents; and who will be responsible for documenting the
team’s efforts.
• Team members should meet whenever a concerning student or situation has been
brought to their attention, but they should also meet on a regular basis to engage
in discussions, role-playing scenarios, and other, and other learning activities.
2.

Define prohibited and concerning behaviors.
• Establish policy defining prohibited behaviors that are unacceptable and warrant
immediate intervention (violence, weapons, threats, bullying, harassment)
• Keep in mind that concerning behaviors occur along a continuum.
• School policy should identify concerning behaviors that may not be indicative of
violence, but warrant some intervention (decline in academic performance,
truancy, withdrawal/isolation, sudden change in behavior, substance abuse,
evidence of mental health crisis)
• The threshold for intervention should be relatively low so that teams can
identify students in distress before their behavior escalates.
• During the assessment process, teams may identify other concerning statements
and actions made by the students that may not already be addressed in their
policies.

3.

Create a central reporting mechanism.
• Establish one or more reporting mechanism.
• Provide training and guidance to students, teachers, staff, school resources
officers, and parents on recognizing behaviors of concern, their roles and
responsibilities in reporting the behavior, and how to report it.
• Teams need to be sure to proactively monitor all incoming reports and respond
immediately when someone’s safety is concerned.
• There should be an option for passing information anonymously as students are
more likely to report concerning or threatening information without fear of
retribution.

March 8, 2019

7

 •

The school community should feel confident that the team members will be
responsive to concerns, reports will be acted upon, kept confidential, and
handled appropriately.

4.

Determine the threshold for law enforcement intervention.
• Reports regarding weapons, threats/acts of violence, safety concerns should be
reported to law enforcement.
• Schools should set a clear threshold for times and situations when law
enforcement will be asked to support or take over an assessment.

5.

Establish assessment procedures.
• Maintain documentation (Wisconsin School Threat Assessment Form)
• Use a community systems approach. An effective approach for gathering
information to assess a student of concern is to identify the sources that may
have information on the student’s actions and circumstances.
• Examine online social media pages, conduct interviews, review class
assignments, and consider searching the student’s locker or desk.
• Team members should also review academic, disciplinary, law enforcement,
and other formal records that may be related to the student.
• Build rapport that can facilitate information-gathering efforts.
• Evaluate the student’s concerning behaviors and communications in the
context of their age and social/emotional development.
• Examine identified investigative themes.

6. Develop risk management options.
• Once a thorough assessment has been completed, the team can evaluated
whether the student is a risk for self-harm or harming someone else.
• Teams can develop risk management strategies that reduce the student’s risk
for engaging in violence.
• Each student who is assessed will require an individualized management plan.
• The team may determine that the student is not at risk for engaging in violence,
but may need monitoring or is in need of guidance/services.
• Teams will need to recognize that removing a student from school
(suspension/expulsion) does not eliminate risk to the school. Management
plans will need to stay in place until the team is no longer concerned about the
student or the risk that they will engage in violence.
• Law enforcement should be notified immediately if a student is thinking about or
is planning to engage in violence so that they can assist in managing the situation.
• Make efforts to address the safety of any targets.
• Ask the family or law enforcement to block the student’s access to weapons.
• Remove or redirect the student’s motive (bullying prevention efforts, counseling,
mediation, restorative practices).
• Reduce the effect of stressors by providing resources and supports.
7. Create and promote safe school climates.

March 8, 2019

8

 •
•
•
•
•
•
•

Develop a positive school climate built on a culture of safety, respect, trust, and
social/emotional support.
Students should feel empowered to share their concerns with adults.
Encourage staff to create positive, trusting relationships with students.
Break down “codes of silence”.
Develop programs that help students feel more connected to their peers and their
school.
Encourage students to take part in teams/clubs based on their interests.
Actively engage students in helping to sustain safe school climates.

8. Conduct training for all stakeholders.
• Faculty, staff, and administrator.
• Students.
• Parents.
• Law Enforcement.
• Training should include the difference between “snitching”, “ratting”, or
“tattling” and seeking help.
“These techniques have been identified by the National Threat Assessment Center to be the bestpractices in preventing school violence” 3.
Preventing School Violence
The Safe Schools Initiative began in June of 1999 to determine what could be known prior to a
violent school attack. This was a joint effort by the United States Secret Service and United
States Department of Education, “to produce a factual, accurate knowledge base on targeted
school attacks. This knowledge could be used to help communities across the country to
formulate policies and strategies aimed at preventing school-based attacks” 4. The Safe Schools
Initiative was completed by collecting data from 37 school shootings from December 1974
through May 2000.
The Safe Schools Initiative listed ten key findings after the analysis of thirty-seven school
attacks:

3
4

•

Incidents of targeted violence at school rarely are sudden, impulsive acts.

•

Prior to most incidents, other people knew about the attacker’s idea and/or plan to attack.

•

Most attackers did not threaten their targets directly prior to advancing the attack.

•

There is no accurate or useful profile of students who engaged in targeted school
violence.

National Threat Assessment Center, 2018, p.23
Vossekuil, 2002, p. 3

March 8, 2019

9

 •

Most attackers engaged in some behavior prior to the incident that caused others concern
or indicated a need for help.

•

Most attackers had difficulty coping with significant losses or personal failures.
Moreover, many had considered suicide.

•

Many attackers felt bullied, persecuted or injured by others prior to the attack.

•

Most attackers had access to and had used weapons prior to the attack.

•

In many cases, other students were involved in some capacity.

•

Despite prompt law enforcement responses, most shooting incidents were stopped by
means other than law enforcement intervention 5.

Based on these ten key findings, it has been determined that school violence is often preventable.
If students who are aware of concerning behaviors are encouraged to report it, the threat
assessment process can be used to prevent an impending attack. The United States Secret Service
and the United States Department of Education believe that the use of a school threat
assessment protocol is the most important part of a school violence prevention program. With
this in mind, six principals have been developed to form the foundation of the threat assessment
process;
•

Targeted violence is the end result of an understandable, and oftentimes discernible,
process of thinking and behavior.

•

Targeted violence stems from an interaction among the individual, the situation, the
setting, and the target.

•

An investigative, skeptical, inquisitive mindset is critical to successful threat assessment.

•

Effective threat assessment is based upon facts, rather than on characteristics or “traits”.

•

An “integrated systems approach” should guide threat assessment inquiries and
investigations.

•

The central question in a threat assessment inquiry or investigation is whether a student
poses a threat, not whether a student has made a threat 6.

Models of School Violence Prevention
5
6

Vossekuil, 2002, p. 31
Fein, 2002, p.32

March 8, 2019

10

 The Columbine Review Commission reviewed several theories on the prevention of school
violence. However, most did not include law enforcement as an equal partner in preventing
school violence. Because of its’ inclusion of law enforcement as a valuable partner in school
safety, the Commission recommended John Nicoletti’s, ‘Violence Goes to School’ model. This
model focuses on the prevention of violent behavior at the school level, and it discusses school
climate, bullying prevention programs and “Zero-Tolerance” policies as prevention strategies.
The discussion on “Zero-Tolerance” policies is not regarding the behavior of the student or even
possession of things deemed “weapons” by the school. Instead, it is a description of how school
staff will handle threats of violence. This model advocates for using the term “Zero- Tolerance”
to demonstrate the importance of reporting and responding to threats of violence. It is the threat
itself that will be treated the same, in every instance, not the student 7.
The “Violence Goes to School” model has been deemed “best practice” for violence prevention
in schools, not just by the Columbine Review Commission, but by other states as well. The effect
of Nicoletti’s model on law enforcement and its requirement for police involvement in
preparation and prevention of acts of violence makes it important. However, it does not discuss
law enforcement’s need to be actively involved in the threat assessment process.
2009 Wisconsin Act 309 mirrors the recommendations set forth by the “Violence Goes to
School” model. Act 309 requires all schools in Wisconsin to have safety plans designed with
cooperation from law enforcement, fire fighters, school administrators, student services and
mental health professionals. It further requires plans for the prevention, response and recovery
from acts of violence. This law also requires two “school safety” drills per year. While act 309
required schools to take many important actions, there were no requirements for documentation
to demonstrate compliance.
2017 Wisconsin Act 143 now requires that all school districts submit blueprints of all of their
buildings to the Office of School Safety by July 1st, 2018, and that every school district shall
submit a school safety plan by January 1st, 2019 (and every year thereafter). Additionally, each
school board is now required to submit to the Office of School Safety a certification that each
school building completed at least one safety drill (and the date it was completed), the date when
school safety training was delivered to school staff (including the number of attendees), and the
most recent date that law enforcement completed a site safety assessment on their buildings.
It is also very important to note that Act 143 requires that law enforcement partner with schools
to assess the safety of their buildings, to review their safety plans, and to approve the associated
documents. These requirements align Wisconsin with the recommendations set forth by the
United States Secret Service, United States Department of Education and the FBI.
There are two school violence prevention models that are most applicable to the relationship that
law enforcement should have with schools. These models were developed by the FBI approach
and the National Threat Assessment Center. The FBI approach to school threat assessment is
7

Nicoletti 2002, p.105-106

March 8, 2019

11

 based on the findings of the research completed for the Safe School Initiative 8. This theory of
threat assessment is outlined in “The School Shooter: A threat assessment perspective”, by Mary
Ellen O’Toole. The National Threat Assessment Center approach focuses on a low threshold for
intervention for both prohibited and concerning behaviors as well as investigative themes that
should be explored during the assessment process.

8

Fein, 2002, p.11

March 8, 2019

12

 National Threat Assessment Center School Threat Assessment Guidance
The National Threat Assessment Center, a component of the United States Secret Service,
delivered their guidance regarding the school-based threat assessment process in July 2018.
Outline in their guidance were several key concepts to note in a threat assessment protocol.
They advise that there should be a low threshold of concern for completing a threat assessment
process, that there should be enhanced reporting of concerns, and that there should be a broad
community-based approach to information gathering.
Initially, each school should determine which behaviors are prohibited and which are concerning.
There is a difference between these two types of behavior that should be outlined in policy and
school code of conduct. A prohibited behavior is one that would drive a concern regarding
physical violence. This is behavior that has been determined to be unacceptable in the school
environment and would warrant immediate action. A prohibited behavior could include, but
would not be limited to, threats of violence, physical violence, possession of weapons, sexual
assault, bullying or harassment.
Concerning behaviors occur on a continuum and may not drive an immediate concern for
physical violence, but might indicate that a student is in need of assistance. Concerning
behaviors would include, but are not be limited to, decline in academic performance, truancy,
withdrawal/isolation, sudden change in behavior, substance abuse, or displaying evidence of a
mental health crisis.
Defining these concerning behaviors can assist those who observe them in deciding to report
their concerns. While a threat assessment is being completed regarding concerning behaviors a
team may discover additional statements or actions that are not addressed in the code of conduct,
but will nonetheless assist in determining if the student of concern poses a threat to themselves or
others.
When the school community has been properly trained regarding the types of behaviors that are
prohibited or concerning, it is important to also provide them with guidance on how to report
their concerns. Members of the school community and the community at large should be assured
that the information that they provide will be kept confidential and that actions will be taken to
examine the report.
When the threat assessment team is investigating a report, they should be sure to examine the
following investigative themes 9;
•
•
•
•
•
9

The student’s motives and goals.
Concerning, unusual, or threatening communications.
Inappropriate interest in weapons, school shooters, mass attacks, or other types of
violence.
Access to weapons.
Stressful events, such as setbacks, challenges, or losses.

National Threat Assessment Center, 2018, p. 8

March 8, 2019

13

 •
•
•
•
•
•
•
•

Impact of emotional or developmental issues.
Evidence of desperation, hopelessness, or suicidal thoughts/gestures.
Whether the student views violence as an option to solve problems.
Whether others are concerned about the student’s statements or behaviors.
Capacity to carry out an attack.
Evidence of planning for an attack.
Consistency between the student’s statements and actions.
Protective factors such as positive or prosocial influences or events.

Teams should keep in mind the need for building rapport with those that they are interviewing.
Some of the information that will be asked about can be considered sensitive and some may be
reluctant to share it with someone they do not trust yet. Reassuring them that this process is a
way to determine how to best help the person of concern can help develop that trust.
Additionally, paying close attention to the interviewee and using active listening skills can assist
in building trust.

March 8, 2019

14

 FBI Four-Pronged School Threat Assessment Process
Once a threat has been assessed as having a medium or high level of risk, a “four-pronged
assessment” should be completed. The person who made the threat will be assessed based on a
totality of their personal circumstances if the “four-prong assessment” is used. The four prongs
are; personality of the student; family dynamics of the student; school dynamics and the
student’s perceived role in them; and social dynamics of the student 10. In each of these four
prongs, the assessor should be careful to not to project their perception of the student. Instead,
the assessor should base the assessment on information gathered during the interview from
the student’s perspective.
The First Prong – Personality
The first prong of the assessment is the student’s personality. The FBI chooses to use the
Webster’s Dictionary definition of personality as, “the pattern of collective character, behavioral,
temperamental, emotional and mental traits of an individual” 11. An examination of a student’s
personality is warranted to determine the likelihood that they will carry out a violent threat.
One of the most important personality clues that a person is likely to carry out a violent threat is
called “leakage”. Leakage is defined by the FBI as, “when a student intentionally or
unintentionally reveals clues to feelings, thoughts, fantasies, attitudes or intentions that may
signal an impending violent attack 12. In a very overt manner, this person has a preoccupation
with violence, is full of hate, appears isolated, and hopeless. Leakage is important because, 75%
of all violent attackers told at least one other person of the impending attack, and 25% directly
told the intended targets 13.
One of the students that carried out the Columbine massacre posted the following on his AOL
webpage:
“I’m coming for EVERYONE soon and I will be armed to the fucking teeth and I will shoot to
kill.
...GOD I can’t wait ‘til I can kill you people.
Feel no remorse, no sense of shame.
I don’t care if I live or die in the shoot-out. All I want to do is kill and injure as many of you
pricks as I can especially a few people.... 14”
Additionally, according to the Columbine Review Commission, one of the student’s teachers
called a meeting with his parents and a school counselor regarding one of his writing
assignments. The teacher described it as a “ghastly thing”. Furthermore, according to the
10
11

O’Toole, 1999, p.10-24
O’Toole, 1999, p. 11

12

O’Toole, 1999, p.16
Mohandie, 2002, p.32
14 Mohandie, 2002, pp. 33-34
13

March 8, 2019

15

 commission, it was reported that the suspects would tape themselves practicing with weapons
used in the attack with Columbine High School owned A/V equipment. They would later show
these tapes to their classmates 15.
Based on the testimony provided after the attack, the suspects both experienced leakage. Several
people reported to the Columbine Commission that they both continually engaged in threatening
or concerning behavior. However, based on the “code of silence,” a failure to take the threats of a
“child” seriously, or simple denial, this attack was not managed.
Besides leakage, several other personality traits are important to consider when assessing a high
risk personality. People carrying around a rather large “hurt locker” or “hit list” could be
considered to be a high risk person. This type of person has a low tolerance for frustration and
are easily upset by real or perceived injustices. These people have poor coping skills and handle
rejection in a very immature and disproportionate manner. They lack resiliency and are unable to
regroup after failure, no matter how much time has passed. There may have been a failed
romantic relationship and they may show signs of depression because of it 16.
Individuals who make violent threats will often appear to be narcissistic, lack empathy, blame
others for their failures, are paranoid, and self-important. A person who is willing to commit acts
of extreme violence will often see other people as “beneath them” and as objects.
Showing emotion is considered a sign of weakness for these types of people and they will most
likely show an attitude of superiority or arrogance. This behavior is often to mask the low selfesteem that a person who makes a violent threat may have. Often, indications of intolerance
toward racial groups, religions or sexual orientation will be shown. Threatening individuals may
employ an insulting or inappropriate sense of humor and they may have negative role models
such as Hitler, Satan, or previous “mass casualty shooters” 17.
People who make violent threats may report feeling like an “outsider” or not fitting in, regardless
of how many people you may see them interacting with on a daily basis. These people may find
themselves spending time with a closed social group that does not include others. The closed
social group may support the student’s violent ideations, and due to the lack of outside
influences, the student may not get a “reality check” about ideas or fantasies 18.
A person who makes violent threats may show an obsessive need for attention and seek to
manipulate others. This type of person will most likely have anger problems, a lack of trust for
authority figures, and may display signs of paranoia. Often, the paranoia leads to the student’s
idea that things have to be settled their way, because they can’t trust the police or school to do it.
15

Columbine Review Commission, 2001, p. 19
1999, p. 17

16O’Toole,
17
18

O’Toole, 1999, p.18
O’Toole, 1999, p.20

March 8, 2019

16

 People who make violent threats will often appear to be rigid and opinionated, even when they
have no concrete information to base their opinion on.
An unusual interest in sensational violence and violent entertainment is common in threatening
individuals including a special interest in past violent attacks 19. Several studies have been
completed regarding the increase in violent attacks in correlation to violence in television, music
and video games. The American Medical Association, American Psychological Association,
American Academy of Pediatrics, and American Academy of Child and Adolescent Psychiatry
stated during a congressional hearing in 2002; well over 1,000 studies point overwhelmingly to a
causal connection between media violence and aggressive behavior in some children. The
conclusion of the public health community, based on over 30 years of research, is that viewing
entertainment violence can lead to increases in aggressive attitudes, values and behavior,
particularly in children 20.
While a mental health diagnosis is not indicative of being likely to carry out a violent threat,
some people may notice a sudden change in the student’s behavior. A change in academic
performance, disdain for rules, and change in dress are common. Some of these behaviors are
associated with depression. Behavior that is relevant to carrying out a threat is important to
notice. A threatening person will practice with firearms or other weapons, search the internet for
bomb making instructions, and plan to the exclusion of other activities 21.
The Second Prong – Family Dynamics
The second prong in assessing a high risk person considers the dynamics within the family unit.
A turbulent parent/child relationship could be an indicator of high risk. If the family has moved
several times or there have been past allegations of child abuse or neglect in the home, there is
elevated risk.
Parents who protect their child regardless of serious pathological behavior elevate the risk. A
child who “rules the roost” and intimidates parents in to giving them inappropriate amounts of
privacy, unlimited access to the internet and television also elevate the risk. Parents who do not
properly secure weapons or treat them casually provide direct and unsupervised access to the
means for carrying out a violent threat. This seriously elevates the risk of an attack being carried
out 22.
The Third Prong – School Dynamics
The third prong examines how the student feels they fit into the school’s dynamics. A student
that is at a high risk for violence may feel detached from the school, its students, and its
19

O’Toole, 1999, p.20
Grossman, 2009, p.163
21 O’Toole, 1999, pp. 17-21
20

22

O’Toole, 1999, pp. 21-22

March 8, 2019

17

 activities. Another risk factor is the student’s perception of the school’s tolerance for
disrespectful behavior. If the student perceives that the school ignores bullying, or does not
challenge racial/class divisions, the risk may increase. The threatening student may perceive that
there is a pecking order among students or inequitable discipline 23.
Developing and implementing a threat assessment protocol will not change the climate of a
school. The United States Secret Service (USSS) and United States Department of Education
(USDE) provide recommendations for eliminating the type of school culture that would foster
threats of violence. They recommend that schools foster a culture of respect by offering positive
role models, encouraging communication between adults and children, and where conflict is
mediated constructively. Further, they state that schools should focus on developing a “culture of
safety” where bullying is not acceptable behavior 24.
The USSS and USDE provide several guidelines for creating a safe and connected school
climate:
•
•
•
•
•
•
•

Assessment of the school’s emotional climate.
Emphasis on the importance of listening in schools.
Adoption of a strong, but caring stance against the code of silence.
Prevention of, and intervention in, bullying.
Involvement of all members of the school community in planning, creating and
sustaining a school culture of safety and respect.
Development of trusting relationships between each student and at least one adult at
school.
Creation of mechanisms for developing and sustaining safe school climates 25.

The Fourth Prong – Social Dynamics
The fourth prong examines the social dynamics of the community at large and how the student
fits into them. The way a student views the world can be controlled somewhat by parental
limitations. If there are no limits on what the student views on television or the internet there is a
higher risk of violent behavior. A student’s peer group, as mentioned before, may limit their
access to the “reality check” that another group can offer them. Though it would be atypical for a
student that commits a violent act on the scale of the Columbine massacre to be under the
influence of intoxicants, it is important to know if there is a sudden change in their use of
intoxicants 26.

23
24

O’Toole, 1999, pp. 22-23
Fein, 2002, p. 17

25

Fein, 2002, p. 19

26

O’Toole, 1999, pp. 23-24

March 8, 2019

18

 During the completion of a threat assessment tool, it is important that all four prongs of the threat
assessment be examined. This should be achieved by combing through school records (current
and previous schools), completing collateral school interviews, parent/guardian interviews,
interviews of the threatening student and potential target interviews. Additionally, records from
the juvenile justice system and child protective services (in counties of current and previous
residences) should be examined. If the parent/guardian or threatening student is unwilling to take
part in the process, law enforcement and the school should consider this an escalation of the risk.
Law enforcement should then treat the examination of the threat as a criminal investigation.

March 8, 2019

19

 Wisconsin School Threat Assessment
The following is a guide regarding the completion of the Wisconsin School Threat Assessment
Protocol. It is important to note that all documentation of actions taken should be completed on
the Wisconsin School Threat Assessment Form. The Wisconsin School Threat Assessment
Overview is not the full form and should not be considered formal documentation. The
completed threat assessment form and associated corroborating documents should be maintained
as a part of the student of concern’s discipline record.
It should be noted that the completion of a threat assessment does not excuse a school from
following all Individuals with Disabilities Education Act or Americans with Disabilities Act
requirements for students with disabilities. Instead, the threat assessment process should be
completed concurrent to any Individuals with Disabilities Education Act or Americans with
Disabilities Act required process, to determine if the child’s needs are being met by their
current services. Conversely, the presence of an Individualized Education Plan does not
excuse a school from completing a threat assessment.
Should a student transfer to another school district, there is no legal requirement to prevent the
receiving school district from viewing these records. In particular, if a student transfers to
another school district to avoid expulsion, it does not mean that this student no longer poses a
threat. Information regarding the student’s threatening/concerning behavior and actions taken to
mitigate such behaviors should be shared with the receiving school district as soon as possible.
If an expulsion process has been initiated as a result of prohibited/concerning behavior,
regardless of whether a student transfers to another school district, the expulsion process
should be completed.
There should not be any attempt to complete the threat assessment process in isolation. At least
two members of the threat assessment team (ideally more) need to be involved in the decisionmaking process. Team members should be well versed in the threat assessment process,
applicable policy and law. When a threat assessment team is uncertain how to proceed in a
situation, they are encouraged to consult with nearby schools, local law enforcement or the
Office of School Safety. Any consultation with outside resources should be documented in the
threat assessment form.
Additionally, schools should review their code of conduct, policy/procedure, and any
memoranda of understanding with outside agencies to ensure that they are aligned with
recommended best practices and current state and federal law.
Phase I
The FBI defines a threat as, “an expression of intent to do harm or act out violently against
someone or something.” However, the FBI recognizes that all threats are not equal. The two
distinctions that a viable threat holds are motivation and signposts. Motivation is developed via a
precipitating event; what caused this person to believe an act of violence is warranted? Signposts

March 8, 2019

20

 are what is pushing a threat to become an act of violence: this could include; fantasy, writing,
drawing or conversation 27.
Once the school receives information regarding a prohibited or concerning behavior, the
likelihood that the behavior could result in harm must be determined. In Phase I of the
Wisconsin Threat Assessment Protocol, the threat assessment team will make a determination
that will guide their actions in the following phases. The first step in Phase I is to document the
staff members who are completing the required tasks for Phase I. The first page of the threat
assessment form is where this information should be documented.
The next step in Phase I is to interview the reporting person. If the reporting person perceives
the concerning behavior to indicate a serious and imminent threat, Act 143 requires the reporting
person to call law enforcement immediately. Keep in mind that if there is a school resource
officer (SRO) in the building they should be a part of the threat assessment team. The staff
member may report the concerning information to the SRO instead of calling 911.
Depending on the information that the staff member provides to the threat assessment team or
law enforcement, immediate action may be required to prevent serious injury or death. If this is
the case, the threat assessment process should be postponed until the environment has been made
safe.
Documentation should be completed regarding the information gathered from the reporting
person on the “Threat or Concerning Behavior Report”. The information required on this report
is the minimum information that should be gathered. If the team determines that additional
information is needed, they should feel free to add more.
The next section in Phase I is the “Emergency Operations/Notifications” section. This is where
contact with the parents of the involved students will be documented. Mandatory law
enforcement notifications required by Act 143 and the beginning of emergency operations should
be documented here as well. Documenting who made these contacts, who was spoken to, and
the time these contacts occurred can prove to be very helpful in protecting against liability.
The next section outlines interviews that should be completed to collect information about the
concerning incident. At this time, the teacher survey should be sent either via email or
completed in person to all of the teachers that have contact with the concerning student. A
specific deadline for the return of these documents should be set. All staff members should be
trained to recognize that if they receive one of these requests that time is of the essence. Staff
members should also be trained that the request for the information (and the information itself)
contained in these documents is confidential and should not be shared with others.
The questions listed on the interview sheets for the staff members, subject of concern, target,
parents and witnesses are not all inclusive. If the team determines that there are additional
questions that need to be asked, they can be documented on a separate sheet and attached to the
documented interview.
27

O’Toole, 1999, pp. 6-7

March 8, 2019

21

 Risk Classification
As the people involved with the incident are interviewed you will attempt to determine the intent
behind the concerning behavior. This process is how the level of risk that a person will carry out
a threat is determined. When determining the level of risk associated with a threat, the central
questions is not whether a person made a threat, but rather if they pose a threat.
Once you have gathered all of the information needed in regards to the concerning behavior, the
team will need to determine the probability that the threat will be carried out. The team will
determine if the threatening behavior contained specific, plausible details (signposts), if there
was emotional content in the threat, and what are the precipitating factors (motivation)
associated with the behavior.
When evaluating the risk that a person will carry out a threat, careful attention should be paid to
statements that could be considered “leakage”. The FBI defines leakage as, “when a person
intentionally or unintentionally reveals clues or feelings, thoughts, fantasies, attitudes or
intentions that may signal an impending violent act”. Leakage can happen verbally, in written
communication and/or via digital media. This is important information to gather for the
investigation.
Based on the information collected, of the following three risk levels will be assigned to the
behavior; low, medium or high. Threats that contain a low level of risk will often be vague,
implausible, or unrealistic. Threats with a medium level of risk are more direct and concrete.
Threats with a medium level of risk give indications that they have been considered over time,
makes a general statement about place and time, but there is no sign that preparations have been
made to carry out the threat. However, threats that have a high level of risk have been carefully
planned and steps have been taken (such as practicing with weapons to be used) to carry out the
threat. A high level threat is direct, specific, and plausible 28.
Low
Vague
Implausible
Not realistic
Unlikely to carry out

Medium
More concrete
Some Planning
No Preparation

High
Direct
Specific
Plausible
Steps to Prepare

The following are examples of behaviors associated with each level of risk.
Low: An elementary school aged student says that they are going to London to throw
themselves off the London Bridge today. This is not a realistic threat, and is not likely to be
carried out.
Medium: A girl sees a picture of her boyfriend with another girl on social media. She states on
her social media profile, “I’m going to get her at school tomorrow”. There is a timeline for the
28

O’Toole, 1999, pp. 8-9

March 8, 2019

22

 attack, but the threat does not say what the suspect is going to do to the target. There is time to
intervene as the students are not in school and do not currently have access to one another.
High: A boy posts a picture of a firearm on his social media page. The caption states, “This is
my only friend. We are both coming to school today. Let the bodies hit the floor.” This is a
direct and specific threat to bring a firearm to school today. It is plausible as it appears the
student does possess his weapon of choice. It appears as though he has had some forethought
into the attack as he has obtained the weapon and posted on social media about it.
Concerning behaviors that can be associated with a low level of risk can have a variety of
resolutions. If you assess the presenting behavior as low risk, staff will need to complete Phase I
and Phase III to document the decisions made/outcomes. The following are a list of potential
outcomes;
• Code of Conduct Violations/School Discipline
• Mediation
• Restorative Practices
• Law Enforcement resolution for criminal behavior
• Referral for counseling
• Referral for special education evaluation
• No threatening behavior/no outcome
• Plan of support
• Elevation of risk based on a pattern of concerning behavior
Those evaluating the risk associated with a threatening behavior should keep in mind that
when a student demonstrates a pattern of concerning behavior over time, this behavior may
elevate the risk associated with the behavior. If you do see an escalating pattern of low level
concerning behavior, all three phases of the threat assessment process should be completed to
determine if the student requires additional resources.
Concerning behaviors that can be associated with a medium level of risk can have a variety of
resolutions. The following are a list of potential outcomes but should always result in the
completion of Phase II and Phase III of the threat assessment process.
• Code of Conduct violations/School discipline
• Mediation
• Restorative practices
• Law enforcement resolution for criminal behavior
• Referral for counseling
• Referral for special education evaluation
• Emergency detention for mental health crisis
• Elevation of risk based on a pattern of concerning behavior
Concerning behaviors that can be associated with a high level of risk can have a variety of
resolutions. The following are a list of potential outcomes but should always result in the contact
of law enforcement and the completion of all three phases of the threat assessment process.
Possible outcomes for a high risk behavior are:

March 8, 2019

23

 •
•
•
•
•

Code of Conduct violations/School discipline
Law enforcement resolution for criminal behavior
Emergency detention for mental health crisis
Law enforcement should submit a Suspicious Activity Report to the Wisconsin Statewide
Intelligence Center
The Office of School Safety should be notified

The level of risk assigned to a concerning behavior will determine the next steps to be taken in
the threat assessment process. If the behavior is determined to be low risk, and it is not
connected to an escalating pattern of behavior, you may decide as a team to proceed to Phase III
and document the outcomes associated with this behavior. However, if you determine that the
behavior should be assessed at medium or high risk, you should proceed to Phase II of the threat
assessment process.
The team will need to document the level of risk that the behavior has been classified at the
justification for that decision. If the team is made aware of additional information that will
change the risk classification, this should be documented and the date/time of the change in
classification should be noted as well.
Phase II
If it is determined that Phase II of the threat assessment process will need to be completed,
documentation should continue regarding any interviews or investigation that has been
completed thus far. Each member of the threat assessment team taking part in the assessment
should be listed, along with their position, phone number, and email address. The same team
members may take part in Phase II as in Phase I, but their information should still be entered on
the Phase II documentation.
In Phase II, all additional sources of information should be noted. Additional documents
gathered should be attached to the threat assessment paperwork. The team may discover that
more information is needed. These tasks should be assigned by the leader of the team and
expectations about when the information is needed should be clear. Care should be taken to
document each task being completed, when and by whom. Should information be required from
outside sources, be certain to document who was contacted to provide that information.
Additionally, if any consent to release information, MOU or court orders exist between entities
(in regards to this student), they should be referenced/attached as well.
It is the responsibility of the team leader to make sure all of the assigned tasks are completed
within the time limits set by the team.
Once all of the necessary information has been collected, the team will reconvene and complete
the Key Observations, Risk Factors, and Protective Factors Checklists. Once the checklists have
been completed, the team may determine that more information is needed. If the team
determines that all of the necessary information has been gathered and evaluated, they will
assign a Threat Classification to the Threat Assessment. Once a Threat Classification has been
assigned, the team will determine an appropriate response to the concerning behavior.

March 8, 2019

24

 Threat assessment teams should keep in mind that a Threat Classification can be amended based
upon new information, mitigating circumstances, aggravating circumstances or over time due to
compliance with a plan of support. In particular, if a student withdraws from a school to avoid
expulsion for concerning behavior, it does not mean that student no longer poses a threat to
the school. If the student’s behavior indicates that they still pose a threat, the Threat
Classification should not be lowered.
Phase III
Once a Threat Classification has been assigned, a determination regarding the response to that
behavior must be made. The threat assessment team will be a part of that decision in order to
examine all possible outcomes. However, each school will need to evaluate potential outcomes
based on their policy and code of conduct. Additionally, law enforcement, social services, and
other stakeholders will need to determine if there are actions they will need to take in this
situation.
Keep in mind that there may be additional stakeholders outside of the threat assessment team that
may be of value to the team in determining the appropriate outcomes or the plan of protection.
Teams should consider including any community case managers, special education case
managers, counselors/therapists, parents and mentors. Any person taking part in Phase III
decisions should be documented on the Phase III face sheet.
Once the most appropriate response is determined, documentation will need to be completed
regarding the outcome. The team will complete the Response to Threat or Concerning Behavior
Checklist. Keep in mind that this checklist does not include all possible options. If you
determine that a different resource is needed than what can be found on the checklist, please
document what that resource is and how it will be monitored. Once the checklist has been
completed a Case Plan/Plan of Support will need to be completed as well.
A Case Plan/Plan of Support will help the team determine if the concerning person is complying
with requirements to mitigate their concerning behavior, and to assist them in building capacity
to interact with peers in a more positive manner. For each requirement listed in the plan, a
person should be responsible to make sure that requirement is being complied with. This should
include the duration and frequency of assigned tasks, as well as a specific date set for the team to
review progress. A plan of support can include a variety of actions. The following is a list of
suggestions for a plan of support, but a school may take any other actions that are legal and
necessary:
•
•
•
•
•

Check-in/Check-out
Mentoring
Bag/Locker searches
Appropriate assessments by counselor/therapist
Change of schedule/placement

March 8, 2019

25

 The team should be meeting regularly to review case plans completed on previous threat
assessments. During those meetings, reports should be given to the team regarding the
concerning person’s compliance/progress. At that time, the team will determine if it is
appropriate to decrease or elevate the Threat Classification assigned to the concerning person.
The team may also decide that the person’s progress has been successful enough to discontinue
the Case Plan or Plan of Support.
Again, it is the responsibility of the team leader to make sure all of the assigned tasks in the
plan of protection are being completed successfully. If the student requires an extended
period of monitoring, regular meetings of the threat assessment team will be scheduled and
documented.
Once the concerning behavior is mitigated there should be an attempt to return to normal. It may
be difficult to determine what normal will look like for the threatening individual. As best
practice dictates in the treatment of juveniles, this should happen in the least restrictive
environment. School administrators and law enforcement should provide a supportive
environment for the threatening individual and the safest situation possible for the victims.

March 8, 2019

26

 Information Sharing/Consent
When investigating a safety issue, schools do not need consent from parents to interview their
child. Some parents may refuse the school permission to complete the assessment, to speak to
administration, or allow access to their child. It is certainly their right to refuse, but (depending
on the seriousness of the prohibited/concerning behavior) could significantly increase the risk
level associated with the threat. The reason behind this concern is that it could indicate that the
parent is refusing to recognize serious pathological behavior.
If a school is unable to complete a threat assessment because of consent issues or limited access
to a student, law enforcement can detain the student and question them (complete the
assessment). Under Wisconsin State Statute 968.24 law enforcement officers have the ability to
temporarily detain a subject and question them for a, “reasonable period of time when the officer
reasonably suspects that such person is committing, is about to commit or has committed a
crime”. The legal standard of “reasonable suspicion” is also the standard the Fourth Amendment
of the United States Constitution applies to school officials for the purposes of searching a
student or their effects for school safety reasons. A SRO or police patrol officer who has been
well trained in school law and the completion of a threat assessment would be valuable in this
process.
In the case that a police officer or SRO develops “probable cause” that the student of concern
has committed a crime or delinquent act, the officer may choose to arrest/take the student into
custody. A parent does not have the right to be present while their child is being questioned by
law enforcement. State v. Jerrell C.J., Wisconsin Court of Appeals, January 28, 2004 – 2004 WI
App 9 discusses the rights of juveniles when interrogated by the police. Ultimately, the
Wisconsin Court of Appeals states that the juvenile’s statements to the police were not
involuntary even though he was not able to contact his parents before the interview. However,
the court cautioned that the police should not ignore a juvenile’s request for parental contact.
Child welfare workers can also interview a child without parental consent, based on allegations
of child abuse or neglect.
Although the law gives schools, law enforcement, and child welfare professionals the ability to
interview a child without parental consent, it is considered best practice to have the consent and
cooperation of the parents. A positive and communicative relationship with the parents can be
a mitigating factor and make a child’s reintegration back into the school community after a
significant incident easier to manage.
One of the most important recommendations made by the Columbine Review Commission was
in regards to information sharing. In the past, schools and law enforcement did not commonly
share information about students due to concerns about federal regulations on confidentiality 29.
However, the Family Educational Rights and Privacy Act already provides some guidance as to
when schools can share student information with law enforcement.

29

Columbine Review Commission, 2001, p.108

March 8, 2019

27

 FERPA 34 CFR 99.36 informs us of what conditions apply to disclosure of information in health
and safety emergencies:
(a) An educational agency or institution may disclose personally identifiable information from an
education record to appropriate parties, including parents of an eligible student, in connection
with an emergency if knowledge of the information is necessary to protect the health or safety of
the student or other individuals.
(b) Nothing in this Act or this part shall prevent an educational agency or institution from (1) Including in the education records of a student appropriate information concerning
disciplinary action taken against the student for conduct that posed a significant risk to the safety
or well-being of that student, other students, or other members of the school community;
(2) Disclosing appropriate information maintained under paragraph (b)(1) of this section to
teachers and school officials within the agency or institution who the agency or institution has
determined have legitimate educational interests in the behavior of the student; or
(3) Disclosing appropriate information maintained under paragraph (b)(1) of this section to
teachers and school officials in other schools who have been determined to have legitimate
educational interests in the behavior of the student.
(c) In making a determination under paragraph (a) of this section, an educational agency or
institution may take into account the totality of the circumstances pertaining to a threat to the
health or safety of a student or other individuals. If the educational agency or institution
determines that there is an articulable and significant threat to the health or safety of a student or
other individuals, it may disclose information from education records to any person whose
knowledge of the information is necessary to protect the health or safety of the student or other
individuals. If, based on the information available at the time of the determination, there is a
rational basis for the determination, the Department will not substitute its judgment for that of
the educational agency or institution in evaluating the circumstances and making its
determination.
Schools can disclose information that is considered “directory” information without consent.
According to FERPA directory information includes a student's name, address, telephone
number, date and place of birth, honors and awards, and dates of attendance.
According to the Family Educational Rights and Privacy Act (FERPA), schools must have
consent to release student records. Records may be released in certain circumstances without the
consent of parents or students. One of those circumstances is to, “appropriate officials in cases of
health and safety emergencies.” Another circumstance where the disclosure of student
information is allowed without consent is under FERPA 34 CFR 99.31 “State and local
authorities, within a juvenile justice system, pursuant to specific State law.” This information is
specifically cited on the US Department of Education, Family Policy Compliance Office website.
It can be found at this link;
https://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html.
Wisconsin State Statute 118.125 (2) regarding confidentiality and disclosure of Pupil records is
the state law that covers the disclosure of student records. This statute states, “Pupil records
shall be made available to persons employed by the school district which the pupil attends who
March 8, 2019

28

 are required by the department under s. 115.28 (7) to hold a license, law enforcement officers
who are individually designated by the school board and assigned to the school district, and other
school officials who have been determined by the school board to have legitimate educational
interests, including safety interests, in the pupil records.”
What this statute indicates is that any person employed and designated by the school board may
have access to any student records. This is typical in the case of a SRO who is designated a
school administrator within a Memorandum of Understanding between their law enforcement
agency and school district. An SRO with immediate access to student records can disseminate
important information to other law enforcement officers when there is a health or safety concern.
This is important when searching for a person who poses a threat to a school.
Wisconsin Act 143 under section 23, 175.32 requires the following, “Any person listed under
s.48.981(2)(a) shall report as provided in sub. (3) if the person believes in good faith, based on a
threat made by an individual seen in the course of professional duties regarding violence in or
targeted at a school, that there is a serious and imminent threat to the health or safety of a student
or school employee or the public”. Sub (3) advises that, a person required to report under sub.
(2) shall immediately inform, by telephone or personally, a law enforcement agency of the
facts and circumstances contributing to the belief that there is a serious and imminent threat
to the health or safety of a student or school employee or the public”. Sub (4) states that, “any
person or institution participating in good faith in the making of a report under this section shall
have immunity from any liability, civil or criminal, that results by reason of the action”.
Reporting this information, because it would fall under the health and safety emergency
exception, does not violate FERPA.
FERPA does not apply to several communications regarding students. Information reported
about a student to school staff by another student, either verbally or in writing, is not protected
under FERPA. Personal observations of a student or their behavior by school staff are not
protected under FERPA. Social media posts made by a student and discovered by school
personnel are not protected under FERPA.
Any information that would be shared to complete a school threat assessment, when there is a
concern regarding health or safet,y would be allowed under both FERPA and Wisconsin State
Statutes.

March 8, 2019

29

 Summary
Although most of the research available on the development, implementation and completion of
threat assessments is twenty years old, it still holds true. The people who make violent threats
and then carry them out continue to be those who are perceived by themselves as having been
rejected from their peer group, have violent thoughts and fantasies, and have ready access to
weapons. The importance of completing a thorough assessment on every threat received is only
overshadowed by the importance of acting to manage the threat once it is determined to be
viable. It is imperative that law enforcement and schools work together to manage viable threats
and protect their targets.
If your school or law enforcement agency has questions about prohobited or concerning
behaviors, please do not hesitate to contact the Office of School Safety for consultation. We are
available to assist you and provide resources as needed.

March 8, 2019

30

 References
Candy, M., James , B., & Nease, J. National Association of School Resource Officers, (2012). To
protect & educate: The school resource officer and the prevention of violence in schools.
Hoover, AL: National Association of School Resource Officers.
Columbine Review Commission. Colorado Governor Bill Owen, Columbine Review
Commission. (2001). The report of Governor Bill Owen's Columbine Review Commission .
Retrieved from website: http://www.state.co.us/columbine/Columbine 20Report WEB.pdf
Fein, Vossekuil, Pollack, Borum, Modzleski, & Reddy, United States Secret Service & United
States Department of Education, (2002). Threat assessment in schools: A guide to managing
threatening situations and to creating safe school climates. Retrieved from website:
www.secretservice.gov/ntac/ssi guide.pdf
Grossman, D. (2009). On killing: The psychological cost of learning to kill in war and society.
(2nd ed.). New York, NY: Back Bay Books.
Mohandie, K. (2000). School violence threat management: A practical guide for educators, law
enforcement, and mental health professionals. (2nd ed.). San Diego, CA: Specialized Training
Services.
National Threat Assessment Center. (2018). Enhancing School Safety Using a Threat Assessment
Model: An Operational Guide for preventing targeted school violence. U.S. Secret Service,
Department of Homeland Security. Retrieved July 10, 2018, from
https://www.secretservice.gov/data/protection/ntac/USSS_NTAC_Enhancing_School_Safety_G
uide_7.11.18.pdf.
Nicoletti, J., & Spencer-Thomas, S. (2002). Violence goes to school. Bloomington, IN: National
Educational Service.
O'Toole, M. E. Federal Bureau of Investigation, Critical Incident Response Group & National
Center for the Analysis of Violent Crime. (1999). The school shooter: A threat assessment
perspective. Retrieved from website: www.fbi.gov/stats-services/publications/school-shooter
30

Vossekuil, B., Fein, R., Reddy, M., Borum, R., & Modzeleski, W. United States Secret Service
and The United States Department of Education, (2002). The final report of the safe school
initiative: Implications for the prevention of school attacks in the United States. Retrieved from
The United States Secret Service website: http://www.secretservice.gov/ntac/ssi_final_report.pdf

March 8, 2019

31