SHARE THIS ARTICLE
A Scoping Review of the Research on Suspicious Activity Reporting Indicators, Terrorism, and Non-Ideological Targeted Violence
Noah D. Turner1 
1 Paul H. O’Neill School of Public and Environmental Affairs, Indiana University – Indianapolis and National Counterterrorism Innovation, Technology, and Education Center (NCITE)
Article History: Received November 24, 2025 | Accepted April 8, 2026 | Published Online July 13, 2026
ABSTRACT
The Nationwide Suspicious Activity Reporting (SAR) Initiative (NSI), which facilitates the process of reporting and investigating suspicious behaviors potentially indicative of terrorist activity, has been identified as a tool that can be used to concurrently prevent both terrorism and targeted violence. The NSI captures preoperational behavior in 16 discrete SAR indicators which have been evaluated in the context of terrorism. Yet, these indicators lack systematic evidence to substantiate the application to non-ideological targeted violence, despite a growing body of research on preoperational behavior preceding acts of mass and school violence. This study conducts a scoping review of empirical research on SAR-related behaviors, terrorism, and non-ideological targeted violence. Findings from this review indicate the empirical evidence on SARs is preliminary but growing, and points to key gaps in data, methodology, and focus of existing research. The purpose of this review is to contextualize the current evidence base informing the NSI program and guide future research contributing to this area of research.
KEYWORDS
suspicious activity reporting, mass violence, school violence, terrorism, targeted violence
At 3:55 pm on May 31st, 2019, an aggrieved employee at the City of Virginia Beach exited his workplace at the Municipal Center in Virginia Beach, VA, just hours after sending in his letter of resignation, and retrieved a suppressed .45 caliber handgun from his vehicle in the parking lot (Virginia Beach Police Department [VBPD], 2021). He walked to another vehicle parked nearby and killed his first victim before entering Municipal Center Building 2 and opening fire on employees. In an attack that lasted approximately 44 minutes, the assailant killed 12 people and injured several others (VBPD, 2021). Weeks before the attack, the assailant reportedly engaged in numerous preoperational behaviors to prepare for his attack, including researching the layout of the Municipal Center, acquiring ammunition and a rifle case, and testing his security access to Building 2 (Cowan & Lankford, 2024).
The mass shooting at Virginia Beach represents an emergent threat in the Homeland: non-ideological targeted violence (NITV). The Department of Homeland Security (DHS) defines targeted violence as “any incident of violence that implicates homeland security and/or DHS activities in which a knowable attacker selects a particular target prior to the violent attack…[which] includes attacks that lack a clearly discernible political, ideological, or religious motivation” (DHS, 2020, p. 1). By these standards, NITV can be understood as premediated violence not driven by ideology, but instead by other violent, or hateful beliefs to include mass violence, school violence, rampage shootings, workplace shootings, or assassinations.
Recent research suggests only about 15% of mass public shooters are driven by an ideological goal (Capellan et al., 2019), and studies indicate mass murderers are often even more disconnected from wider social networks than lone-actor terrorists (Clemmow, Gill, et al., 2020). The solitude in which these attacks typically fester poses numerous challenges for detecting and preventing these plots before they materialize. Consequently, policymakers and practitioners have begun to consider how existing tools and infrastructure designed to prevent acts of terrorism, or violence perpetrated to advance a social, political, economic, or religious goal (Freilich et al., 2014; LaFree & Dugan, 2007), can be simultaneously leveraged to prevent acts of NITV. Specifically, DHS now situates terrorism and targeted violence as “intersecting threats” and asserts there is “some alignment in the tools used to counter them” (DHS, 2019). The Nationwide Suspicious Activity Reporting (SAR) Initiative (NSI), a program developed to facilitate the detection and investigation of suspicious preoperational behavior, has been identified as a tool that is jointly applicable (DHS, 2019). The logic underpinning this application is that perpetrators of both terrorism and targeted violence demonstrate preoperational behavior that could indicate mobilization to violence, as observed in the Virginia Beach shooting.
Numerous large-scale studies have attempted to evaluate the NSI program in the context of terrorism. Most evaluations have focused on estimating the frequency of SAR indicators within terrorist plots and attacks (Gruenewald et al., 2015; Jensen & LaFree, 2024), but studies have also attempted to identify which SAR indicators are associated with a greater likelihood of a plot being interdicted by law enforcement (Gruenewald, Klein, & Drawve, 2019). This evidence base, as well as empirical attention to the preoperational behavior of terrorists, continues to grow. Such systematic evidence is absent for acts of NITV, despite the emerging body of research on preoperational behaviors to forms of NITV like mass violence and school shootings (Abel et al., 2024; Meloy et al., 2012; Meloy & Hoffman, 2021). With deliberations around if and how the NSI could be expanded to include acts of NITV, there is a need to take stock of our current evidence based on the connection between SARs, terrorism, and NITV.
This study conducts a scoping review of empirical evidence investigating the connection between SAR indicators, terrorism, and NITV. A systematic search protocol is employed to identify studies examining this connection, and an exploratory review process is used to evaluate which types of terrorism and NITV SAR-related behaviors have been studied in connection to, as well as what data sources and methodological approaches have been used to produce this evidence base. In doing so, the purpose of this study is to assess the current evidence base, evaluate the quality of existing evidence, and identify areas where improvement is needed to better inform policy decisions related to the NSI program. Before explaining the scoping review processes, the study begins with a brief explanation of the NSI program and SAR indicators.
Background
The findings of the 9/11 Commission Report highlighted the need for a centralized system of information-sharing on potential terrorist activity. Led by the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI), in partnership with the Program Manager for the Information Sharing Environment (PM-ISE) and the Criminal Intelligence Coordinating Council, developed the NSI (DHS, 2022). Officially implemented nationwide in March 2010, the NSI is a program that connects over 18,000 law enforcement and intelligence agencies to an information sharing environment (DHS, 2022). The National Threat Evaluation and Reporting Center (NTER, 2025) has since assumed responsibility for managing the NSI program.
Suspicious Activity Reports (SARs) are the functional products of the NSI program. SARs are initiated by law enforcement officers based on their observations on duty or tips from the public (Steiner, 2010). Once filed, the initiating agency forwards the potential SAR to the local fusion center for vetting and analysis. If the SAR is considered relevant to the terrorism-nexus of activity and an investigation is warranted, the SAR is sent to federal authorities at the FBI or DHS. Once investigation into the SAR concludes, the SAR is documented and uploaded to the FBI eGuardian system (Steiner, 2010). Other law enforcement and intelligence officials are then able to access the SAR information for future investigations (Steiner, 2010).
There are 16 SAR indicators designating distinct forms of preoperational behavior that may warrant a SAR. SAR indicators are defined in the Information Sharing Environment-SAR (ISE-SAR) Functional Standard 1.5.5 (DHS, 2015), reported in Table 1. Seven indicators relate to criminal behavior with a possible nexus to terrorism, and the other nine are potentially criminal behaviors that require more investigation to ascertain their nature (DHS, 2015). SAR indicators were designed to capture preoperational behaviors indicating involvement in terrorism or terrorism-related activities, while also safeguarding citizen’s civil liberties and right to freedom of speech and expression (DHS, 2022).
(Click table to enlarge)
Notably, SAR indicators are categories of behavior, and most studies on preoperational behavior do not operationalize variables according to the definitions in the Functional Standard, often opting for more granular operationalizations. In other words, empirical research in this area typically examines specific behaviors that fall within a SAR indicator category but is not explicitly described in the ISE-SAR definition. For example, studies often consider whether a perpetrator participated in firearms training at a practice range (Gill et al., 2016; Kelly & Alexander, 2022; Meloy et al., 2015). This behavior is not explicitly mentioned in the Acquisition of Expertise definition but captures a more discrete behavior within the SAR category. In this review, behavior captured by a SAR indicator category is referred to as “SAR-related behavior” to appropriately represent the connection between the SAR category and related preoperational behavior.
Another important distinction exists between SAR-related behavior and broader warning or pre-event behavior. SAR indicators were developed with input from multiple civil liberties advocacy groups to protect the rights and privacy of citizens (DHS, 2022). As such, SAR-related behavior must meet a legal threshold of “reasonably indicative of preoperational behavior,” meaning the behavior must signal active involvement in a terrorist plot (DHS, 2015). This threshold is necessary given reported SARs that are deemed credible provide law enforcement with cause to investigate and enact legal sanctions if required. Alternatively, warning behaviors signal an accelerating risk that an individual may be on the pathway to committing a violent act (Meloy et al., 2012), constituting a wider scope of pre-event behaviors that are not subject to any legal threshold. Warning behavior may range from behavior fully protected by constitutional rights, such as expressing interest in past terrorist attacks or an obsession with military paraphernalia, to preoperational behavior that could qualify as a SAR, like researching attack sites or obtaining weapons (Meloy et al., 2012). To retain focus on the NSI program and its applicability to NITV, this review exclusively focuses on SAR-related behavior, while acknowledging that larger universe of warning and pre-event behaviors that do not meet the SAR threshold remain equally important to the study of mobilization to violence.
Methodology
The current study conducts a scoping review of the research to appraise the evidence base on SAR indicators, terrorism, NITV. This review produces a preliminary assessment of an evidence base to situate the nature and quality of an existing evidence base. Scoping reviews are comparable to systematic reviews, in that they can utilize a systematic process to compile and review literature, aiming for transparency and replicability (Grant & Booth, 2009). Contrary to systematic reviews, scoping reviews are not typically restricted to a single study design and rather include a variety of study designs to provide narrative and tabular summaries of the evidence base (Grant & Booth, 2009). This approach is more appropriate for examining the existing research on SAR indicators and terrorism/NITV, as empirical inquiry into these behaviors has not been uniform or synchronized. In addition to the various operationalizations for behaviors captured by SAR indicator categories (described above), studies have similarly assessed a diverse range of terrorism and NITV outcomes, including terrorist attacks, lone-actor attacks, thwarted violent plots, mass public attacks, school shootings, and averted school shootings, to name a few. Because of this variation in operationalization and measurement, attempts to systematically aggregate or collectively interpret the existing evidence base would be misleading and difficult to reconcile. Nonetheless, this scoping review adopts a structured, multi-step approach for locating, collating, and critically reviewing relevant studies (Grant & Booth, 2009; Page et al., 2021).
Systematic Search Process
The systematic search of the literature to identify studies for the scoping review was completed by a research team composed of one lead investigator and two graduate assistants, supervised by three co-investigators. The search process was conducted between June and July 2024. A supplemental search was conducted in July 2025 to identify studies published in the last year.
Eligibility Criteria
To be included in this review, studies must have satisfied three criteria. First, studies must have been published in a peer-reviewed journal or governmental report. Theses, dissertations, or non-refereed articles were not included. While there are variations in the peer-review process for governmental and academic publications, this criterion ensured studies included in the review were refereed by experts in the field. Second, studies included in this review assessed at least one variable measuring SAR-related behavior – that is, behavior captured by a SAR indicator(s) category – in connection to acts of terrorism or NITV. Consistent with the purview of violent attacks described in the DHS Strategy, studies on terrorism, violent extremism, hate/bias crime,1 mass violence, school violence, assassinations, or other targeted violence are included in this review (DHS, 2019). Additionally, stemming from discussion in previous sections, only studies leveraging variables related to or captured by a SAR indicator category are included. Studies on warning or pre-event behaviors that are not captured by the SAR indicator categories – that is, do not meet the legal threshold of preoperational behavior used to define SAR-related behaviors – are not included in this review. While this criterion limits the scope of this review, it assures that all included studies are contributing to the evidence base directly informing SARs and the NSI program. Finally, studies included in this review must have employed an empirical methodology (i.e., quantitative or qualitative) when examining the connection between any SAR Indicator(s) or SAR-related behaviors and acts of terrorism or NITV. Conceptual pieces or commentaries were not included to retain focus on the empirical evidence base.
Additionally, this review also includes studies on terrorism and NITV within and beyond the United States, so long as the study was written in English; non-English articles were not included. While the NSI is a domestic program, studies have examined the preoperational behaviors committed by perpetrators of terrorism and NITV internationally. Such evidence remains instructive to understanding how these actors plan, prepare for, and execute their attacks.
Searching Protocol
The systematic search process is displayed in Figure 1. The first step of collecting relevant studies for the review was to complete a comprehensive search protocol to identify an initial set of potentially relevant studies with topical relevance to SAR Indicators and terrorism and targeted violence. This process involved directed searches on three search engines – Google Scholar, ProQuest, and EBSCOhost – using a series of keyword pairings and combinations. Google Scholar was the primary search engine used in the search process, as research indicates Google Scholar remains the most powerful academic search engine (Khalid et al., 2025). ProQuest and EBSOChost were incorporated as additional search engines to ensure comprehensiveness, as these services were compatible with the institutional credentials of the research team. Each search included a keyword focused on the outcome being assessed (e.g. “mass violence”) as well as a keyword(s) related to the SAR-related behavior(s) under study. The list of keywords used is reported in Figure 1. Keywords were initially generated by consulting prior literature on SARs and preoperational behavior to build a lexicon of terms directly associated with SAR indicators, terrorism, and NITV. Additional keywords were added to the protocol throughout the search process as studies were identified and reviewed. No date restrictions were used in the searching process – studies published at any time were considered.
(Click figure to enlarge)
During the initial search process, three research team members conducted searches with each combination of keywords to ensure the search process was exhaustive and collected as many potentially relevant studies as possible. To ascertain relevance, team members conducted cursory reviews of abstracts and main texts of identified studies to determine relation SARs, terrorism, and NITV. When a team member located a potentially eligible study, it was downloaded and stored in a folder shared with other team members, so that duplicate studies were not collected. Each team member searched until every keyword combination was used and returned results were saturated – that is, new searches did not produce any unique results. Additionally, for searches being conducted on Google Scholar, team members were instructed to use the “Cited by” and “Related articles” functions for identified studies as an additional strategy for locating potentially eligible studies. A preliminary pool of 152 studies was identified in the initial search process.
Subsequently, at least two members of the research team then evaluated each study individually to determine if all eligibility criteria were satisfied. This process involved reading through studies in their entirety to identify their empirical approach and topical relevance to SAR-related behavior, as well as to identify any additional studies cited in the manuscript that could be relevant to this review.2 If an identified study did not meet all three eligibility criteria, it was excluded from the final sample. A consensus-based approach was used, where team members must have agreed on whether a study should be included, and disagreements were resolved through discussion. Most studies excluded at this stage in the search process were topically relevant but did not conduct empirical inquiry (e.g. conceptual studies, commentaries), or were initially included because of a specific variable, but further inspection revealed the variable was not aligned with any SAR indicator categories. After reviewing the initial pool of 152 studies, 81 studies met all eligibility criteria and were included in the final sample for review (see Appendix A for full list of studies).
Assessment and Review Process
The assessment and review process was threefold. First, each study was individually reviewed by the three members of the research team and inductively coded for (1) the specific type of violence studied, (2) the source of data for the study,3 and (3) the empirical methodology employed. The emergent codes were input into a Microsoft Excel spreadsheet. Second, due to the variation in the outcomes examined and methodologies used across the (n = 81) studies, codes for the type of violence, source of data, and methodology were reviewed and revised into thematic categories to aid assessment and interpretation. Four resultant categories were constructed for the type of violence studied: (1) Terrorism/Violent Extremism, (2) Mass Violence, (3) School Violence, and (4) Other Targeted Violence. Three categories were constructed for the types of data utilized: (1) Open-Source Data, (2) Closed-Source Data, and (3) Multiple Sources. Five categories were constructed for methodological approaches: (1) Descriptive Statistics, (2) Inferential Statistics, (3) Case Study, (4) Qualitative, and (5) Mixed Methods. The operationalizations for these resultant categories are described in their respective sections below.
Third, the three coders – two student assistants and one lead investigator – were required to ascertain whether the study examined a variable that captured preoperational behavior aligned with a SAR indicator category in relation to terrorism or NITV. While at least two research team members had to agree that each study in the sample examined at least one SAR-related behavior during the systematic search process, many studies examined multiple variables related to multiple SAR indicators. Coders had to interpret the operationalization for each variable in a study and determine whether the variable was operationally congruent with a SAR indicator category. If coders determined a variable was aligned with a SAR-related behavior, then they coded that SAR indicator as being “Examined” for that study. If the study did not include a variable related to a SAR indicator category, then coders input a “Not examined” code for that indicator for that study. Importantly, coders did not categorically code for whether a study provided supportive evidence for a SAR indicator. Due to the variation in types of violence examined and methodologies employed, such determination could not be concluded with an objective threshold. Accordingly, the purpose of this coding scheme was to evaluate which SAR indicators have been studied most frequently and consistently across the empirical literature.
Importantly, timeline constraints restricted the full research team’s involvement after the data were coded. While steps were employed to enhance the reliability and transparency of this review (described below), the results of this review reflect the sole author’s interpretation and appraisal of this study’s findings. To minimize subjectivity, subject matter experts reviewed and provided feedback on the results of the review, which were integrated to improve clarity, interpretation, and accuracy of the results.
Reliability
An emergent coding scheme as designed in this study faces challenges with reliability. Research team members were required to inductively code (a) what type of violence was studied, (b) what source of data was used, (c) what type of methodology was used, and (d) whether a variable related to a SAR indicator category was examined. The former three variables required little initial interpretation, as coders were instructed to be as specific as possible when inputting the types of violence examined, data sources used, and methodologies used. However, when these codes were revised and refined into resultant categories, coders were required to interpret studies’ data, sample, outcome variables, and analytic strategies to determine which categories accurately reflect their topical focus and methodological approaches. Similarly, to determine whether SAR-related behavior was examined in a study, coders were required to effectively map each study’s variables capturing discrete preoperational behaviors onto SAR indicator categories that, as discussed above, do not explicitly nor exhaustingly identify the specific behaviors that may be captured by each category.
Several strategies were implemented during and after the coding process to improve reliability. First, during the initial coding phase, the three research team members completed coding on the first five studies together. These initial cases helped increase familiarity with the SAR indicator categories and provided student assistants with the opportunity to ask clarifying questions under the direction of the lead investigator. After the initial coding phase, all three members of the research team began individually completing coding on the full sample of (n = 81) studies. Student assistants consulted the lead investigator for additional clarification throughout this full coding process. The lead investigator also reviewed each of the student assistants’ codes for all their assigned cases, providing feedback and guidance as needed. Due to aforementioned timeline constraints, interrater reliability was not conducted at this stage in the process, but all coding decisions made by student assistants were reviewed and approved by the lead investigator, bolstering consistency of coding decisions between coders.
Interrater reliability remains a concern despite this oversight, as the lead investigator was also required to interpret, evaluate, and determine appropriate coding decisions for each study. To ensure coding decisions are not only consistent between the three members of the research team, but also consistently aligned with the operationalizations for each variable, an external student assistant not involved in the full coding process was recruited to complete a post-hoc reliability coding procedure. The student assistant was provided with the operationalization for each variable, and equivalent instructions by the lead investigator. Post-hoc reliability coding was completed on a random sample of 20 studies (25%) from the full sample of studies.
Table 2 presents the results of this post-hoc coding procedure. Cohen’s kappa (k) was estimated for the type of violence studied, data source used, and methodological approach employed using the resultant categories constructed during the original coding process, as well as for the determination of whether a study examined a variable aligned with a SAR indicator category. Most variables reported moderate-to-strong Cohen’s k estimates (>.60; McHugh, 2012), indicating reliable operationalizations for coding the type of violence studied, the data source used, the methodology utilized, and most SAR indicators. Breach/Attempted Intrusion reported a kappa statistic near this threshold (k = .62), despite high agreement between coders (90.48%), but the Cohen’s k estimate may be biased downward due to the limited variation in this variable, as variables with high skewness are highly penalized for disagreements in Cohen’s k estimation (Xu & Lorber, 2014).
(Click figure to enlarge)
A similar artifact may be observed for Weapons Collection/Discovery, albeit to a lesser extent. While agreement for this variable is at the lower threshold of acceptability (>80%; McHugh, 2012), the Cohen’s kappa for this indicator suggests weak reliability (k = .53; McHugh, 2012). A qualitative assessment of the disagreements in this variable reveals four discrepancies, stemming from overlooking relevant qualitative evidence or confusing weapon use variables with weapon collection or acquisition behaviors. Accordingly, while coders agreed on most coding decisions for Weapons Collection/Discovery, this post-hoc assessment indicates a degree of caution should be exercised when interpreting findings related to that SAR indicator.
Results
Findings from this review are presented in four sections. The first section examines the different types of violence studied by the (n = 81) studies in this review. The second section reviews the sources of data used to produce this evidence base. The third section assesses the methodological approaches leveraged by these studies. Finally, the fourth section evaluates the distribution of evidence across each SAR indicator in relation to each distinct type of violence. Figures illustrating frequency counts are presented to report the findings of the review. Studies discussed in-text alongside these tabular summaries are provided as illustrative examples to review this body of research, reflecting findings that are patterned or contradictory across studies.
Types of Violence
The 81 studies in this review examined a wide range of outcomes related to terrorism and NITV. After inductively coding the specific type of violence each study assessed, four thematic categories were constructed to separate terrorism and NITV outcomes: Terrorism/Violent Extremism, Mass Violence, School Violence, and Other Targeted Violence. While it would be intuitive to distinguish the outcomes into either terrorism or NITV, this strategy may mask the nuance of different forms of NITV, and studies were often solely focused on a specific type of targeted violence (e.g. school violence, mass shootings). Moreover, unlike acts of terrorism and violent extremism, which require an ideological motivation to be classified as such (FBI & DHS, 2020), mass violence is defined solely by the action itself. The Congressional Research Service defines mass shootings as
a multiple homicide incident in which four or more victims are murdered with firearms—not including the offender(s)—within one event, and at least some of the murders occurred in a public location or locations in close geographical proximity (e.g., a workplace, school, restaurant, or other public settings), and the murders are not attributable to any other underlying criminal activity or commonplace circumstance (armed robbery, criminal competition, insurance fraud, argument, or romantic triangle. (Krouse & Richardson, 2015, p. 10)
Numerous studies on mass violence heed this definition when composing their studies’ sample (Capellan et al., 2019; Peterson & Densley, 2021; Peterson, Erickson, et al., 2021), and multiple other studies use similarly broad definitions that could encompass a wide range of targeted violence acts, including terrorist attacks, mass shootings, and school shootings, dependent on the modus operandi and casualty counts of the attack (Alathari et al., 2023; Lankford et al., 2019). Where possible, the research team attempted to distinguish results directly related to terrorism and NITV. Several studies in this review considered multiple types of violence, such as lone-actor terrorists and mass murderers, and discretely presented findings respective to each type (Capellan et al., 2019; Clemmow, Gill, et al., 2020). Because these studies examined each outcome, they were coded as studying both rather than one or the other, which is reflected in the reported totals for each type of violence in Figure 2. However, other studies’ analytic approaches did not allow such discernment. Thus, the count of studies focused on Mass Violence should be interpreted as a combinative category which can include acts of both ideologically and non-ideologically motivated targeted violence. Overall, Mass Violence was the second most frequently studied form of violence in the empirical literature, with 33 studies examining SAR-relevant variables as precursors to mass attacks.
(Click figure to enlarge)
Terrorism/Violent Extremism was the most studied type of violence in this review, with 34 studies assessing the connection between SAR-related activities and acts of terrorism and violent extremism. Several studies directly focused on certain types of terrorists, such as lone-actors or jihadist ideologues (Gill et al., 2013; Lindekilde et al., 2019; Meloy et al., 2021; Schuurman et al., 2018), while others considered a wider slate of terrorists using large-scale datasets. Additionally, the only three studies known to evaluate the prevalence of all 16 SAR indicators were all conducted using samples of terrorist or violent extremist plots and attacks (Gruenewald et al., 2015; Gruenewald, & Drawve, 2019; Jensen & LaFree, 2024).
School Violence was the third most common type of violence studied in this review (n = 19). Most studies focused on shootings within a K-12 school facility (Alathari et al., 2019; Alathari et al., 2021; Capellan et al., 2019; Freilich et al., 2021; Gerard et al., 2016; Silva et al., 2023), though some research did consider shootings on college campuses as well (Langman et al., 2013; Silva et al., 2023). While most studies on this type of violence examined characteristics of school shooting attacks and their perpetrators, several studies also evaluated outcomes tangential to school shootings, such as school shooting threats (Oksanen et al., 2015; Peterson et al., 2024) or averted school shootings (Alathari et al., 2021; Cowan et al., 2022), that provided evidence directly related to specific SAR Indicators.
Finally, four studies in this review examined outcomes related to other forms of NITV. The Other Targeted Violence category includes instances targeted violence against public officials (Fein & Vossekuil, 1999; Vossekuil et al., 2015), and more general examinations of targeted violence in Canada (Almond et al., 2023).
Data Sources
Across this review, studies sourced data in a variety of ways. As reported in Figure 3, the distribution of data sources was comparable across the four violence categories, albeit closed-source data was used more frequently to study Mass Violenceand School Violence than Terrorism/Violent Extremism. Nonetheless, the majority of studies assessing Terrorism/Violent Extremism, Mass Violence, and School Violence utilized open-source data to conduct their examinations. Open-source data is a powerful resource and is the most popular data source for studying rare events like terrorist attacks and mass shootings (Chermak et al., 2025). Studies using open-source data collect publicly available information on a people, groups, or events from a range of open-sources, including but not limited to court records, police reports, academic research, and news media. Of the (n = 81) studies in this review, 49 relied exclusively on open-source data. The development of large-scale open-source datasets such as the American Terrorism Study (ATS; Gruenewald et al., 2015; Gruenewald, Klein, et al., 2019; Smith et al., 2016), Extremist Crime Database (ECDB; Gruenewald et al., 2015), or the Profiles of Individuals Radicalized in the U.S. (PIRUS) dataset (Jensen & LaFree, 2024) has facilitated the empirical study of preoperational behavior for terrorism and violent extremist events. Further, the recently introduced dataset from The American School Shooting Study (TASSS) includes open-source data on school shooting events in the U.S. (Freilich et al., 2021), and several open-source datasets focus specifically on public mass shootings (e.g. Capellan et al., 2019; Greene-Colozzi, 2022). In addition to these quantitative datasets, researchers may also draw on raw open-source materials for textual qualitative data on events, groups, or people (e.g. Abel et al., 2024; Gill et al., 2018).
(Click table to enlarge)
Alternatively, 12 studies exclusively utilized closed-source data – or data that is not publicly accessible and requires specific authorization or access – to examine the connection between SAR-related behaviors and terrorism and NITV. These sources varied in form and content, with studies drawing on law enforcement case files (Almond et al., 2023; Bondu & Scheithauer, 2018; Gibson et al., 2020; Holkeri et al., 2015; Scalora et al., 2020; Silver, Simons, et al., 2018; Tampe & Bondu, 2025), litigation records (Meloy & Kupper, 2026), clinical data (Geck et al., 2017; Lindberg et al., 2012), tipline data (Hendrix et al., 2022), and data from violence prevention programs (Silva & Madfis, 2025). Importantly, despite including variables or measures aligned with a SAR indicator category, no study in this review utilized closed-source data from fusion centers on actual SAR reports. This absence is problematic given this evidence base collectively informs the NSI program but includes no analyses of data exclusively stemming from reported, vetted, and/or documented SARs. While several studies tailored their data towards reported threats or individuals who have issued threats in the past (e.g. Geck et al., 2017; Gibson et al., 2020; Lindberg et al., 2012; Scalora et al., 2020), these efforts can only partially capture the scope of suspicious behavior that may be reported, analyzed, and investigated by authorities through the NSI program.
Twenty studies triangulated data across multiple sources to study SAR-related behaviors. The combinations of data were diverse. One study leveraged multiple sources of closed-source data, assessing police reports of school shooting threats and medical files on those who issued threats (Oskanen et al., 2015). Another study assessed both open-source data and survey data of the general population (Clemmow, Schumann, et al., 2020). Other studies combined open-source and closed-source data, supplementing open-source material with official police case files (Cowan & Lankford, 2024; Duwe, 2020; Lindekilde et al., 2019; Schildkraut et al., 2024; Silver & Silva, 2022), or interviews with law enforcement officials (Meloy et al., 2015; Schuurman et al., 2018). Three studies drew on The Violence Project’s public mass shooting database (Peterson, Densley, et al., 2021; Peterson, Erickson, et al., 2021; Silva & Greene-Colozzi, 2024), which is based on both primary and secondary data sources (Peterson & Densley, 2021). Similarly, two additional studies used the Averted School Violence dataset, which includes self-reported data from officials and open-source information on incidents of averted school attacks (Cowan et al., 2022; Winch et al., 2024). Although triangulation can help mitigate limitations associated with individual sources (Anderson et al., 2011), closed-source data on SARs remained notably absent in these studies as well.
Methodological Approaches
Methodological approaches vary in scope, purpose, and rigor, but appraising the methodological approaches employed to produce this evidence base offers insight into the breadth and depth of the empirical research in this area. As aforementioned, studies in this review needed only to employ an empirical methodology – there were no restrictions on type or rigor. This inclusive approach was more appropriate for taking stock of the current evidence base and identifying areas of improvement to strengthen the body of research informing SARs and the NSI program.
Figure 4 shows the methodological approaches employed by the studies in this review. Similar to the data sources used in this body of research, a comparable proportion of studies employ each methodological approach in relation to each type of violence. Most studies in this review (n = 32) conducted descriptive quantitative analyses, represented proportionally across the different forms of violence. These studies often investigated the count or frequency of SAR-related behaviors in samples of targeted violence events or perpetrators. Studies using descriptive analyses can provide preliminary insight into the relative prevalence of SAR-related variables prior to ideological and NITV attacks, which is an essential step to building a robust evidentiary base in this area.
(Click table to enlarge)
While descriptive statistics cannot draw correlational or causal inferences, they lay the foundation for such pursuits (Sutanapong & Louangrath, 2015). Building on this evidence, 30 studies in this review estimated inferential statistics, including bivariate and multivariate analytic techniques, to assess the connection between SAR-related behaviors and forms of targeted violence. Context is important for these studies, however, because the inferential tests varied in rigor and focus. Among the 30 studies that utilized inferential statistics, nearly half (n = 14) used bivariate tests to compare the prevalence of SAR-related behaviors between distinct samples of offenders or events. Bivariate tests are useful for estimating the direct relationships between two variables, but in the same breath are unable to account for exogenous variables. Several studies employ multivariate regression models to estimate the relationship between SAR-related behaviors and distinct outcomes, such as the success or failure or terrorist attacks (Gruenewald, & Drawve, 2019), aversion or completion of school shootings (Winch et al., 2024), workplace violence incidents (Geck et al., 2017), or leakage pathways (Peterson, Erickson, et al., 2021), to name a few.
Other studies have advanced the methodological rigor of this research further by deploying innovative tools and approaches that extend beyond independent effects, accounting for conditions like behavioral clustering (Clemmow, Gill, et al., 2020; Horgan et al., 2018), behavioral sequencing (Meloy et al., 2021; Silva et al., 2023; Silver & Silva, 2022), and estimating base rates (Clemmow, Schumann, et al., 2020). One study used machine learning to predict whether an individual mobilized to extremist action based on their online posting behaviors (Brown et al., 2026). While these methodological approaches are relatively few in this body of research, the recency of these studies suggests research examining SAR-related behaviors is improving in quality and rigor.
Case studies were the third most frequently utilized methodology in this review. Approximately 13 studies analyzed specific cases of ideological and NITV to identify which SAR-related behaviors preceded attacks, how they were committed, and when they occurred in proximity to the attack. Case studies are useful analytic tools that can provide rich information on a particular SAR-related behavior, including the details of the behavior and the context in which it occurred. In one study, case study analysis was used as a comparative tool to identify similarities and distinctions between acts of terrorism and non-ideological mass murder (Kelly & Alexander, 2022). Other studies opted to conduct nuanced investigations into preoperational behaviors perpetrated by school shooters (Abel et al., 2024; Schildkraut et al., 2024), mass shooters (Cowan & Lankford, 2024), violent extremism (Allely & Faccini, 2019), and workplace rampage shooters (Illardi et al., 2024). While case studies often lack generalizability to broader populations, they compensate in their detailed descriptions of social phenomena (Flyvberg, 2006). In this way, these case studies provide a degree of qualitative nuance to the evidence base connecting SAR Indicators and terrorism and NITV.
Four studies in this review employed a mixed methods approach, utilizing both quantitative and qualitative data to examine the connection between SARs and targeted violence in multiple ways. In all four studies, researchers paired descriptive statistics with case study analysis to explore characteristics and behaviors of violent jihadist terrorists (Clutterbuck & Warnes, 2011), averted school violence (Cowan et al., 2022), assassinations (Fein & Vossekuil, 1999), and targeted violence in schools and against public officials (Vossekuil et al., 2015). Finally, two studies in this review utilized qualitative designs other than case studies. Both studies, instead, conducted qualitative content analyses. Slemaker (2023) explored pre-attack warning behaviors demonstrated by (n = 23) mass shooters by assessing their manifestos. Alternatively, Gill et al. (2018) studied how terrorists plan and commit attacks by assessing the text of (n = 49) autobiographies published by individuals who were involved in at least one terrorist event. By studying the words of terrorists and mass shooters, these studies aim to explore the decision-making processes that underly attack planning and preparation activities at a granular level.
SAR Indicators
The preceding sections indicate empirical evidence on SARs, terrorism, and NITV is mostly preliminary, and studies on different types of violence are proportionately similar in their data sources used and methodological approaches employed. A closer inspection of the SAR-related behaviors examined by the studies in this review suggests more discrepancies in this evidence base. Figure 5 reports the count of studies in this review for each SAR indicator category examined, distinguished by the type(s) of violence under study.4 This distribution illustrates how uneven the empirical evidence base on SARs is, with a disproportionate focus on certain SAR indicator categories and limited attention to others. Among the seven SARs capturing criminal behavior, six were rarely studied in the empirical literature, almost exclusively in relation to Terrorism/Violent Extremism. Most studies found behaviors related to these SAR indicators – Breach/Attempted Intrusion, Misrepresentation, Theft/Loss/Diversion, Sabotage/Tampering/Vandalism, Cyberattack, and Aviation Activity – seldom preceded terrorist or violent extremist attacks (e.g., Gruenewald et al., 2015; Gruenewald, Klein, & Drawve, 2019; Jensen & LaFree, 2024, Smith et al., 2016). For the non-criminal SAR indicators, few studies examined Photography and Sector-Specific Incident behaviors, reporting similarly low prevalence among terrorist samples.
(Click table to enlarge)
Two indicator categories – Expressed/Implied Threats and Weapons Collection/Discovery – are exceptions to this uneven focus. This consistent attention could be because descriptive estimates indicate threats are the most common preoperational behavior in terrorist plots and attacks (Capellan et al., 2019; Gill et al., 2021; Gruenewald et al., 2015; Gruenewald, Klein, & Drawve, 2019; Jensen & LaFree, 2024), and are comparably prevalent among mass violence events (Alathari et al., 2023; Gibson et al., 2020; Lankford et al., 2019; Peterson, Erickson, et al., 2021), school violence (Alathari et al., 2019; 2021), and assassination attempts (Fein & Vossekuil, 1999). Research also suggests expressing threats or communicating attack plans prior to an attack is predictive of whether a terrorist plot is thwarted (Gruenewald, Klein, & Drawve, 2019) or a school attack averted (Winch et al., 2024). Similarly, studies report behaviors related to Weapons Collection/Discovery frequently precede terrorist events (Bouhana et al., 2018; Clemmow, Schumann, et al., 2020; Gruenewald et al., 2015; Jensen & LaFree, 2024; Lindekilde et al., 2019; Schuurman & Eijkman, 2015), mass shootings (Greene-Colozzi & Silva, 2022), and attacks on schools (Alathari et al., 2019; 2021). When compared directly, findings suggest a comparable proportion of ideological and non-ideological attackers attempted to acquire weapons (Capellan, 2015; Capellan & Silva, 2019; Clemmow, Gill, et al., 2020; Kelly & Alexander, 2022), possibly explaining the proportionate distribution of studies on this SAR indicator across different types of violence.
Terrorism/Violent Extremism was the only violence category which every SAR Indicator was studied in reference to and accounted for a disproportionate number of studies on 14 of the 16 total SAR indicators. This discrepancy is unsurprising given the NSI was originally developed as an infrastructure for preventing terrorist attacks, but points to the clearly uneven distribution of evidence across other types of violence. Six of the seven criminal activity SAR indicators (see Table 1) have minimal evidence to inform their application to NITV. The non-criminal SAR indicators – besides Weapons Collection/Discovery, and with the exception of Photography and Sector-Specific Incident – have been studied to some extent in relation to terrorism and NITV, but most evidence for each of these indicators relates to Terrorism/Violent Extremism. There were less than 10 studies on Mass Violence in connection to Eliciting Information, Testing/Probing Security, Recruiting/Financing, Observation/Surveillance, and Materials Acquisition/Storage. Although 12 studies examined behaviors indicative of Acquisition of Expertise behaviors as precursors to Mass Violence, nearly twice the number of studies (n = 23) focused on Terrorism/Violent Extremism. Similarly, less than five studies assess School Violence for each non-criminal SAR indicator besides Weapon Collection/Discovery. Other Targeted Violence was not studied in relation to any SAR indicator beyond Expressed/Implied Threats or Weapons Collection Discovery, except for one study that briefly examined interest in aviation activity before assassination attempts (Fein & Vosselkuil, 1999).
Overall, there is a clear disparity in how SAR indicators have been studied in relation to terrorism and NITV. The previous sections highlighted a relatively proportionate distribution of data sources and methodological approaches across the different types of violence. However, this section contextualizes those findings to show that most evidence on Mass Violence, School Violence, and Other Targeted Violence is concentrated on two key SAR indicators – Expressed/Implied Threats and Weapons Collection/Discovery, with limited empirical attention dedicated to other SAR indicator categories.
Discussion
Law enforcement officers bear the institutional responsibility of filing suspicious activity reports and ultimately investigating those reports that are vetted and deemed potential threats (Steiner, 2010). The NSI program facilitates this process by prescribing the behaviors indicative of preoperational behavior so that officers, as well as members of the general public, are aware of which behaviors warrant filing a SAR (DHS, 2015). However, because these SAR indicators were developed to detect terroristic threats, recent calls to expand the NSI program to capture non-ideological forms of targeted violence are unsubstantiated by systematic empirical evidence. This scoping review aimed to examine the current evidence base and critically evaluate the types of violence assessed, data sources used, and methodological approaches employed to study the connection between SAR indicators, terrorism, and NITV. Several key findings emerged.
First, a plurality of studies focused on terrorism, and the only studies that evaluated all 16 SAR indicators focused exclusively on terrorist plots and attacks (Gruenewald et al., 2015; Gruenewald, Klein, & Drawve, 2019; Jensen & LaFree, 2024; Smith et al., 2016). Mass violence, which could have included both ideological and non-ideological attackers, was comparably studied, but this evidence was largely concentrated on Expressed/Implied Threats and Weapons Collection/Discovery behaviors. Of the 16 SAR indicators, six were not studied in the context of mass violence, and two others had less than two studies related to mass violence. The discrepancy is more pronounced in the research on school violence. Only three SAR indicators were assessed in five or more studies related to school violence, and half of the indicators were not studied in this context. Overall, it is likely no coincidence that the most studied SAR indicators are also the indicators that empirical evidence substantiates as relevant precursors to both terrorism and NITV. The uneven distribution of evidence across the SAR indicator categories, as well as the relatively preliminary methodological nature of the evidence base, indicates significant gaps in our understanding on the connection between SAR indicators, terrorism, and NITV remain.
Several other SAR indicators report smaller evidence bases with disproportionate focus on Terrorism/Violent Extremismoutcomes. For some indicators, this disparate attention may be explained by differential applicability. For example, with regard to Recruiting/Financing behaviors, a wealth of studies have examined how terrorist groups recruit for and fund their operations (e.g. Clutterbuck & Warnes, 2011; Gill et al., 2017; Lindekilde et al., 2019), and recent estimates indicate these behaviors commonly precede terrorist attacks (Jensen & LaFree 2024). However, studies in this review suggest mass attackers are even more disconnected from wider social networks than lone-actor terrorists (Clemmow, Gill, et al., 2020), and school attackers rarely look to recruit others into their plans (Alathari et al., 2019). Moreover, given school attackers typically target locations they are familiar with – schools where they are often a current or former student – Observation/Surveillance behaviors are largely unnecessary (Alathari et al., 2019; 2021). Similarly, mass attackers frequently aim to attack ‘soft’ targets where security is minimal (Allely & Faccini, 2019; Allely et al., 2024; Capellan et al., 2019; Silva & Greene-Colozzi, 2024), so behaviors related to Testing/Probing Security are rendered inapplicable since there is limited security to test.
Ultimately, it is these qualitative differences between terrorism and forms of NITV that may explain the uneven distribution of focus across this evidence base. It is unsurprising that indicators like Cyberattack, Aviation Activity, or Sector-Specific Incident were rarely studied in the context of NITV, because these indicators are not reflective of the modus operandi nor current threat environment of non-ideological attackers. However, these distinctions do prompt questions about how the NSI program can be appropriately expanded to capture SAR-related behaviors connected to both terrorism and NITV, and the uneven distribution of evidence across indicators suggests more research is needed to further elucidate these nuances.
Other elements of the existing evidence base must also be considered. Specifically, more than half of the studies in this review utilized open-source data to examine the connection between SAR-related behaviors, terrorism, and NITV. Open-source data is a useful tool for studying terrorism and targeted violence, but it is also limited in several ways (Chermak et al., 2025). In addition to inconsistencies in defining phenomena and outcome of interest, which may partially explain the variation in outcomes within each type of violence examined by studies in this review, open-source data also faces numerous measurement issues. Namely, variables are coded based only on information that is publicly reported and available at a given point in time (Chermak et al., 2025). It is plausible that a perpetrator could participate in SAR-related behavior, but their participation was not reported or documented in open-source materials. Although studies reiterate the value and efficacy of open-source data for studying rare events (Parkin & Gruenewald, 2017), future research in this area should pursue other forms of data to build on this evidence base further. Specifically, despite several studies in this review using closed-source data to study SARs, no identified study assessed actual SAR reports from fusion centers. Obtaining and assessing closed-source SAR data could be especially consequential for evaluating SARs and the NSI program, particularly as it seeks to expand its preventative purview to both terrorism and NITV.
Further, findings from this review indicate a diverse range of methodological approaches characterize this body of research. In appraising these methodologies, a key takeaway is the reliance on approaches that yield preliminary, albeit instructive results, like descriptive statistics and case studies. The increasing use of inferential statistics can help elucidate statistical relationships between SAR-related behaviors and different types of violence, but many of these inferential tests remain limited to bivariate assessments. The few multivariate tests such as those examining the connection between SAR indicators and thwarted plots (Gruenewald, Klein, & Drawve, 2019), identifying latent clusters of preoperational behavior (Clemmow, Gill, et al., 2020), or sequencing behaviors (Meloy et al., 2021; Silva et al., 2023; Silver & Silva, 2022) exemplify the methodological tools that could advance this evidence beyond preliminary evidence. Similarly, rich qualitative assessments advance the depth of this evidentiary base, like detailed case studies or thematic assessments of primary source materials (e.g. autobiographies; Gill et al., 2018). Scholars doing research related to SARs or preoperational behavior should aim to build on the strong foundation established by past research by conducting innovative, meaningful, and rigorous methodological approaches.
As the main objective of this scoping review was to identify and describe the current evidence base connecting SARs to terrorism and NITV, methodological advancement could also enable future researchers to conduct more systematic reviews that produce aggregated findings across studies. Meta-analyses or meta-syntheses that impose methodological standards can produce stronger aggregated findings on the relationship between SAR indicators and terrorism and NITV (Grant & Booth, 2009). While such pursuits were not the objective of this study, nor were they plausible given the current variation in methodology and scope of the outcomes assessed in this literature, leveraging more powerful methodologies – both quantitative and qualitative – will pay dividends for future efforts to synthesize this body of research.
Accordingly, this review cannot definitively conclude whether the NSI program should or should not be expanded to include NITV, nor was this the goal of this study. While sufficient evidence supports the relevance of some key SAR indicators to NITV, most indicators have not been extensively studied in this context, which precludes any conclusive determination on the applicability of the NSI program. Moreover, this review is limited to the body of evidence that was identifiable and eligible for inclusion. The search protocol was designed to be comprehensive but also restricted to SAR-related behaviors and terrorism or NITV outcomes. It is possible that, given the search protocol’s reliance on keyword searching in academic databases, that eligible studies were not identified if the exact keywords were not used. Moreover, SAR indicators define categories of behavior, but the coders were required to interpret and decide which behavior aligned with those definitions to decide which studies would be included in the review and how they would be coded. While the post-hoc reliability estimates indicate strong reliability for this coding scheme, it is plausible that, due to differences in interpretation, behavior outside the scope of SAR indicator categories was coded for, or that behavior in-line with the SAR indicators was excluded.
Additionally, while Google Scholar, EBSCOhost, and ProQuest are reliable search engines for locating research studies, it is possible that relevant studies were stored in repositories not captured by these search engines. Future research could expand the suite of search engines utilized to mitigate this concern. Further, the research team treated the search process as a collective endeavor, locating and storing studies in a shared folder and adopted a consensus-based approach for evaluating eligibility criteria. This approach was ideal for efficiency and thoroughness but also precluded estimation of reliability metrics that could be used to compare search results across the three team members. Scholars have demonstrated the utility of such metrics in open-source data collection as a tool for enhancing the reliability and transparency of open-source searching protocols (Greene-Colozzi, 2022). Future studies conducting systematic assessments of the literature can bolster the strength of their search process by integrating reliability tests in the searching phase.
Included studies also had to employ an empirical methodology and be peer-reviewed. These criteria were necessary for maintaining the integrity of this review but nonetheless exclude potentially relevant articles or studies (i.e. doctoral dissertations) with valuable insights into the application of SAR indicators to NITV. Additionally, the discrete focus on SAR-related behavior was a conservative approach for locating and reviewing empirical evidence directly relevant to the NSI program. Although SAR indicators define behaviors that can qualify a SAR report, this criterion disqualified studies from important and growing bodies of research on warning behaviors (Meloy et al., 2012), averted plots (Dahl, 2011; Gruenewald, Klein, Freilich, et al., 2019), law enforcement investigation (Klein et al., 2019), intelligence sharing (Carter & Carter, 2012), and risk profiles (Clemmow, Bouhana, et al., 2020; Lankford & Silva, 2025). These studies may not directly align with SAR indicator categories but demonstrate clear relevance to the NSI program and its functional processes for gathering, analyzing, investigating, and sharing SARs. Future research related to suspicious activity reporting and terrorism and targeted violence prevention would benefit from considering a wider scope of empirical evidence related to pre-event behaviors beyond the SAR indicator categories.
Similarly, there were no studies connecting SAR-related behaviors to hate or bias crime in this review. This exclusion was not a deliberate choice by the research team – as shown in Figure 1, both “hate crime” and “bias crime” were keywords used for outcomes in the search protocol to accurately reflect the priorities described in the DHS Strategy (DHS, 2019). However, the search process yielded no study that discretely examined SAR-related behavior of hate or bias crime perpetrators. In fact, the research team was unable to locate any study examining preoperational or warning behaviors to hate and bias crimes – an issue that other scholars have highlighted elsewhere (Allison & Gruenewald, 2026). Although it is plausible that some hate crime offenders could be included in samples of violent extremists given motivations for hate crimes can potentially overlap with terrorist or violent extremist ideologies (DHS, 2019), it may be prudent to study the behaviors that precede these crimes more discretely. While research on hate and bias crime continues to grow, significant gaps remain in our understanding of these crimes and their precursors (Vergani et al., 2024). One recent advancement is the newly developed Bias Homicide Database, which could help facilitate more research in this line of inquiry (Allison & Gruenewald, 2026).
In sum, this scoping review offers a checkpoint for researchers, policymakers, and practitioners alike to take stock of where we are and where we can go. Pragmatically, empirical support is just one of a myriad of considerations that must be deliberated when deciding whether to expand the NSI to include NITV. The frequency by which a SAR indicator is observed in plots may be instructive for law enforcement or intelligence officials to be aware of which behaviors they are most likely to observe, but this should not be the determinant of whether an indicator is relevant or not. Suspicious behaviors related to the aviation sector are rarely observed in terrorist plots (Jensen & LaFree, 2024), but this does not mean Aviation Activityshould be removed as a SAR indicator. Instead, we must endeavor to ensure the full scope of preoperational behavior indicative of terrorist activity is represented in the slate of SAR indicators. Consequently, if the NSI is expanded to include NITV, any preoperational behaviors unique to NITV should be incorporated into the SAR catalogue. Collaboration between academics, practitioners, and policymakers will be critical in the continued evaluation and refinement of the NSI program to ensure the homeland is secure and citizens’ civil liberties are protected.
NOTES
- Hate/bias crime were included in the original scope of this review, but the systematic search process described below produced no studies specifically examining the connection between SAR-related behaviors and hate/bias crimes. As a result, hate/bias crime is not explicitly named as an outcome of interest throughout the remainder of this study. This issue is explored in more detail in the Discussion.
- If a potentially relevant study was identified through this strategy, it was collected and stored in the same shared folder used for the initial search, and subject to the same individual evaluation to determine eligibility. Thus, the initial pool of 152 studies includes the total count of studies located either in the initial search or by reviewing identified studies.
- The source of data for the study was inductively coded and categorized after the initial data collection and coding process was complete. The lead investigator completed this coding alone but implemented the post-hoc reliability coding procedure to improve reliability in coding decisions (described above).
- Studies that assessed multiple types of violence are counted for each type of violence examined in Figure 4 to accurately represent the distribution across studies.
ARTICLE APPENDIX
An appendix to the article containing the study’s case list is available below.
(Click table image to enlarge)
DISCLOSURE STATEMENT
The author discloses that this research was conducted in affiliation with the National Threat Evaluation and Reporting Program Office (NTER). The author asserts that this relationship did not influence the design, analysis, interpretation, or reporting of the findings presented in this article.
FUNDING DECLARATION
This project was funded by Award No. 2020-D6-BX-K001 from the U.S. Bureau of Justice Assistance and the U.S. Department of Homeland Security.
ACKNOWLEDGEMENTS
The author would like to recognize the research team that made this project possible: Samantha Peterson, Jeffery Jones, Charlie Maas, Dr. Erin Kearns, Dr. Gina Ligon, & Dr. Matt Allen. The author also thanks the National Threat Evaluation and Reporting Center for their support. The findings and opinions expressed in this article do not necessarily reflect the opinions of sponsoring or funding agencies.
REFERENCES
Abel, M. N., Chermak, S., & Freilich, J. D. (2024). Pre-attack warning behaviors of 20 adolescent school shooters: A case study analysis. Crime & Delinquency, 68(5), 786-813. https://doi.org/10.1177/001128721999338
Alathari, L., Drysdale, D., Driscoll, S., Blair, A., Mauldin, D., Carlock, A., McGarry, J., Cotkin, A., Nemet, J., Johnston, B., & Vineyard, N. (2021). Averting targeted school violence: A U.S. Secret Service analysis of plots against schools. U.S. Secret Service, National Threat Assessment Center. https://www.secretservice.gov/newsroom/reports/threat-assessments/schoolcampusattacks/details-0
Alathari, L., Drysdale, D., Driscoll, S., Blair, A., Mauldin, D., Carlock, A., McGarry, J., Cotkin, A., Nemet, J., Johnston, B., Vineyard, N., Foley, C., & Bullwinkel, J. (2019). Protecting America’s schools: A U.S. Secret Service analysis of targeted school violence. U.S. Secret Service, National Threat Assessment Center. https://www.secretservice.gov/sites/default/files/2020-04/Protecting_Americas_Schools.pdf
Alathari, L., Drysdale, D., Driscoll, S., Carlock, A., & Cutler, M. (2023). Mass attacks in public spaces: 2016–2020. U.S. Secret Service, National Threat Assessment Center. https://www.secretservice.gov/sites/default/files/reports/2023-01/usss-ntacmaps-2016- 2020.pdf
Allison, K., & Gruenewald, J. (2026). An open-source data approach to studying bias murder: An introduction to the bias homicide database (BHDB). Homicide Studies. https://doi.org/10.1177/10887679251409766
Allely, C. S., & Faccini, L. (2019). Clinical profile, risk, and critical factors and the application of the “Path toward intended violence” model in the case of mass shooter Dylann Roof. Deviant Behavior. 40(6), 672-689. https://doi.org/10.1080/01639625.2018.1437653
Allely, C. S., Wicks, S. J., & McLaren, S. A. (2024). The application of the path to intended violence model and the TRAP-18 in the case of the Christchurch Mosque shooter. Journal of Threat Assessment and Management. 11(1), 32-47. https://doi.org/10.1037/tam0000211
Almond, M. F. E., Nicholls, T. L., Petersen, K. L., Seto, M. C., & Crocker, A. G. (2023). Exploring the nature and prevalence of targeted violence perpetrated by persons found not criminally responsible on account of mental disorder. Behavioral Sciences & the Law, 41(2-3), 124-140. https://doi.org/10.1002/bsl.2626
Anderson, J. F., Reinsmith‐Jones, K., & Mangels, N. J. (2011). Need for triangulated methodologies in criminal justice and criminological research: exploring legal techniques as an additional method. Criminal Justice Studies, 24(1), 83-103. https://doi.org/10.1080/1478601X.2011.544390
Bondü, R., & Scheithauer, H. (2015). Kill one or kill them all? Differences between single and multiple victim school attacks. European Journal of Criminology, 12(3), 277-299. https://doi.org/10.1177/1477370814525904
Bouhana, N., Corner, E., Gill, P., & Schuurman, B. (2018). Background and preparatory behaviours of right-wing extremist lone actors: A comparative study. Perspectives on Terrorism. 12(6), 50-163. https://www.jstor.org/stable/26544649
Brown, O., Smith, L. G., Davidson, B. I., Racek, D., & Joinson, A. (2026). Online signals of extremist mobilization. Personality and Social Psychology Bulletin, 52(1), 70-89. https://doi.org/10.1177/01461672241266866
Capellan, J. A. (2015). Lone wolf terrorist or deranged shooter? A study of ideological active shooter events in the United States, 1970–2014. Studies in Conflict & Terrorism. 38(6), 395-413. https://doi.org/10.1080/1057610X.2015.1008341
Capellan, J. A., & Silva, J. R. (2019). An investigation of mass public shooting attacks against government targets in the United States. Studies in Conflict & Terrorism, 44(5), 387-409. https://doi.org/10.1080/1057610X.2018.1551294
Capellan, J. A., Johnson, J., Porter, J. R., & Martin, C. (2019). Disaggregating mass public shootings: A comparative analysis of disgruntled employee, school, ideologically motivated, and rampage shooters. Journal of Forensic Sciences. 64(3), 814-823. https://doi.org/10.1111/1556-4029.13985
Carter, J. G., & Carter, D. L. (2012). Law enforcement intelligence: Implications for self-radicalized terrorism. Police Practice and Research, 13(2), 138-154. https://doi.org/10.1080/15614263.2011.596685
Chermak, S. M., Freilich, J. D., Greene-Colozzi, E., & Klein, B. R. (2025). Open-source research in criminology and criminal justice. Annual Review of Criminology, 8(1), 141-170. https://doi.org/10.1146/annurev-criminol-022422-013842
Clemmow, C., Bouhana, N., & Gill, P. (2020). Analyzing person‐exposure patterns in lone‐actor terrorism: Implications for threat assessment and intelligence gathering. Criminology & Public Policy, 19(2), 451-482. https://doi.org/10.1111/1745-9133.12466
Clemmow, C., Gill, P., Bouhana, N., Silver, J., & Horgan, J. (2020). Disaggregating lone-actor grievance-fueled violence: Comparing lone-actor terrorists and mass murderers. Terrorism and Political Violence. 34(3), 558-584. https://doi.org/10.1080/09546553.2020.1718661
Clemmow, C., Schumann, S., Salman, N. L., & Gill, P. (2020). The Base Rate Study: Developing base rates for risk factors and indicators for engagement in violent extremism. Journal of Forensic Science. 65(3), 865-881. https://doi.org/10.1111/1556-4029.14282
Clutterbuck, L., & Warnes, R. (2011). Exploring patterns of behavior in violent Jihadist terrorists: An analysis of six significant terrorist conspiracies in the U.K. RAND Corporation Europe. https://www.rand.org/content/dam/rand/pubs/technical_reports/2011/RAND_TR923.pdf
Cowan, R. G., & Lankford, A. (2024). The Virginia Beach municipal center mass shooting: A retrospective threat assessment using the WAVR-21. Journal of Threat Assessment and Management, 11(2), 83-105. https://doi.org/10.1037/tam0000203
Cowan, R. G., Tedeschi, P. J., Corbin, M., & Cole, R. F. (2022). A mixed-methods analysis of averted mass violence in schools: Implications for professional school counselors. Psychology in the Schools, 59(4), 817-831. https://doi.org/10.1002/pits.22647
Dahl, E. J. (2011). The plots that failed: Intelligence lessons learned from unsuccessful terrorist attacks against the United States. Studies in Conflict & Terrorism, 34(8), 621-648. https://doi.org/10.1080/1057610X.2011.582628
Duwe, G. (2020). Patterns and prevalence of lethal mass violence. Criminology & Public Policy, 19, 17-35. https://doi.org/10.1111/1745-9133.12478
Federal Bureau of Investigation & U.S. Department of Homeland Security. (2020). Domestic terrorism: Definitions, terminology, and methodology. U.S. Department of Justice. https://www.fbi.gov/file-repository/counterterrorism/fbi-dhs-domestic-terrorism-definitions-terminology-methodology.pdf/view
Fein, R. A., & Vossekuil, B. (1999). Assassination in the United States: An operational study of recent assassins, attackers, and near-lethal approachers. Journal of Forensic Sciences, 44(2), 320-333. https://www.secretservice.gov/sites/default/files/2020-04/ecsp1.pdf
Flyvbjerg, B. (2006). Five misunderstandings about case-study research. Qualitative Inquiry, 12(2), 219-245. https://doi.org/10.1177/1077800405284363
Freilich, J. D., Chermak, S. M., Belli, R., Gruenewald, J., & Parkin, W. S. (2014). Introducing the United States extremis crime database (ECDB). Terrorism and Political Violence, 26(2), 372-384. https://doi.org/10.1080/09546553.2012.713229
Freilich, J. D., Chermak, S. M., Connell, N. M., Klein, B., & Greene-Colozzi, E. (2021). Understanding the causes of school violence using open-source data. National Institute of Justice. https://www.ojp.gov/pdffiles1/nij/grants/301665.pdf
Geck, C. M., Grimbos, T., Siu, M., Klassen, P. E., & Seto, M. C. (2017). Violence at work: An examination of aggressive, violent, and repeatedly violent employees. Journal of Threat Assessment and Management, 4(4), 210-229. https://doi.org/10.1037/tam0000091
Gerard, F. J., Whitfield, K. C., Porter, L. E., & Browne, K. D. (2016). Offender and offence characteristics of school shooting incidents. Journal of Investigative Psychology and Offender Profiling, 13(1), 22-38. https://doi.org/10.1002/jip.1439
Gibson, K. A., Craun, S. W., Ford, A. G., Solik, K., & Silver, J. (2020). Possible attackers? A comparison between the behaviors and stressors of persons of concern and active shooters. Journal of Threat Assessment and Management, 7(1-2), 1-12.https://doi.org/10.1037/tam0000147
Gill, P., Corner, E., Conway, M., Thornton, A., Bloom, M., & Horgan, J. (2017). Terrorist use of the Internet by the numbers: Quantifying behaviors, patterns, and processes. Criminology & Public Policy, 16(1), 99-117. https://doi.org/10.1111/1745-9133.12249
Gill, P., Horgan, J., & Deckert, P. (2013). Bombing alone: Tracing the motivations and antecedent behaviors of lone-actor terrorists. Journal of Forensic Sciences, 59(2), 425-435. https://doi.org/10.1111/1556-4029.12312
Gill, P., Marchment, Z., Corner, E., & Bouhana, N. (2018). Terrorist decision making in the context of risk, attack planning, and attack commission. Studies in Conflict & Terrorism, 43(2), 145-160. https://doi.org/10.1080/1057610X.2018.1445501
Gill, P., Silver, J., Horgan, J., & Corner, E. (2016). Shooting alone: The pre-attack experiences and behaviors of U.S. solo mass murderers. Journal of Forensic Sciences, 62(3), 710-714. https://doi.org/10.1111/1556-4029.13330
Gill, P., Silver, J., Horgan, J., Corner, E., & Bouhana, N. (2021). Similar crimes, similar behaviors? Comparing lone-actor terrorists and public mass murderers. Journal of Forensic Sciences, 66(5), 1797-1804. https://doi.org/10.1111/1556-4029.14793
Grant, M. J., & Booth, A. (2009). A typology of reviews: An analysis of 14 review types and associated methodologies. Health Information & Libraries Journal, 26(2), 91-108. https://doi.org/10.1111/j.1471-1842.2009.00848.x
Greene-Colozzi, E. A. (2022). Mitigating the harm of public mass shooting incidents through situational crime prevention (Doctoral dissertation, City University of New York). https://www.proquest.com/openview/e26a1a98676588418d5acdf83d643983/1
Greene-Colozzi, E. A., & Silva, J. R. (2022). Mass outcome or mass intent? A proposal for an intent-focused, no-minimum casualty count definition of public mass shooting incidents. Journal of Mass Violence Research, 1(2), 27-41. https://doi.org/10.53076/JMVR63403
Gruenewald, J., Klein, B. R., Drawve, G., Smith, B. L., & Ratcliff, K. (2019). Suspicious preoperational activities and law enforcement interdiction of terrorist plots. Policing: An International Journal. 42(1), 89–107. https://emeraldinsight.com/1363-951X.htm
Gruenewald, J., Klein, B. R., Freilich, J. D., & Chermak, S. (2019). American jihadi terrorism: A comparison of homicides and unsuccessful plots. Terrorism and Political Violence, 31(3), 516-535. https://doi.org/10.1080/09546553.2016.1253563
Gruenewald, J., Parkin, W. S., Smith, B. L., Chermak, S. M., Freilich, J. D., Roberts, P., & Klein, B. (2015). Validation of the nationwide Suspicious Activity Reporting (SAR) Initiative: Identifying suspicious activities from the Extremist Crime Database (ECDB) and the American Terrorism Study (ATS). National Consortium for the Study of Terrorism and Responses to Terrorism (START). https://www.start.umd.edu/sites/default/files/publications/local_attachments/START_Validation ofNationwideSARInitiative_Feb2015.pdf
Hendrix, J. A., Planty, M. G., & Cutbush, S. (2022). Leakage warning behaviors for mass school violence: An analysis of tips reported to a state school safety tip line. Journal of Threat Assessment and Management, 9(1), 33-51. https://doi.org/10.1037/tam0000171
Holkeri, E., Oksanen, A., & Räsänen, P. (2015). Crime and context: Comparing conventional and ICT-related school shooting threats. European Journal on Criminal Policy and Research, 21, 407-423. https://doi.org/10.1007/s10610-014-9258-2
Horgan, J., Shortland, N., & Abbasciano, S. (2018). Towards a typology of terrorism involvement: A behavioral differentiation of violent extremist offenders. Journal of Threat Assessment and Management, 5(2), 84-102. https://doi.org/10.1037/tam0000102
Ilardi, G., Smith, D., Winter, C., & Spaaij, R. (2026). The 2019 Christchurch terror attack: An assessment of proximal warning behaviors. Behavioral Sciences of Terrorism and Political Aggression, 18(2), 142-162. https://doi.org/10.1080/19434472.2024.2374758
Jensen, M., & LaFree, G. (2024). The mobilization puzzle: How individual, group, and situational dynamics produce extremist outcomes. National Institute of Justice (NIJ). https://www.ojp.gov/pdffiles1/nij/grants/308549.pdf
Kelly, R. F., & Alexander, D. C. (2022,). Insights from comparing pre-attack variables in the Las Vegas mass shooting with ideologically motivated violent extremist attacks. Perspectives on Terrorism, 16(3), 37-49. https://www.jstor.org/stable/27140395
Khalid, S., Almutairi, S., Namoun, A., Khan, J., Ali Khattak, H., & Shah, H. (2025). Comprehensive review of academic search systems: Evolution, analysis, and future research directions. Social Network Analysis and Mining, 15(1), 66. https://doi.org/10.1007/s13278-025-01476-1
Klein, B. R., Gruenewald, J., Chermak, S. M., & Freilich, J. D. (2019). A mixed method examination of law enforcement investigatory strategies used in jihadi and far-right foiled terrorist plots before and after 9/11. Qualitative Criminology, 7(2), 29-58. https://assets.pubpub.org/tvus1guf/11669815553031.pdf
Krouse, W. J., & Richardson, D. J. (2015, July 13). Mass murder with firearms: Incidents and victims, 1999–2013. Congressional Research Services (CRS). https://sgp.fas.org/crs/misc/R44126.pdf
LaFree, G., & Dugan, L. (2007). Introducing the global terrorism database. Terrorism and Political Violence, 19(2), 181-204. https://doi.org/10.1080/09546550701246817
Langman, P. (2013). School shooters on college campuses. Journal of Campus Behavioral Intervention. 1, 6–39. https://doi.org/10.17732/JBIT2013/1
Lankford, A., & Silva, J. R. (2025). What effect does ideological extremism have on mass shootings? An assessment of motivational inconsistencies, risk profiles, and attack behaviors. Terrorism and Political Violence, 37(6), 749-768. https://doi.org/10.1080/09546553.2024.2372427
Lankford, A., Adkins, K. G., & Madfis, E. (2019). Are the deadliest mass shootings preventable? An assessment of leakage, information reported to law enforcement, and firearms acquisition prior to attacks in the United States. Journal of Contemporary Criminal Justice. 35(3), 315–341. https://doi.org/10.1177/1043986219840231
Lindberg, N., Oksanen, A., Sailas, E., & Kaltiala-Heino, R. (2012). Adolescents expressing school massacre threats online: Something to be extremely worried about? Child and Adolescent Psychiatry and Mental Health, 6(1), 39. https://doi.org/10.1186/1753-2000-6-39
Lindekilde, L., O’Connor, F., & Schuurman, B. (2019). Radicalization patterns and modes of attack planning and preparation among lone-actor terrorists: An exploratory analysis. Behavioral Sciences of Terrorism and Political Aggression. 11(2), 113-133. https://doi.org/10.1080/19434472.2017.1407814
McHugh, M. L. (2012). Interrater reliability: The kappa statistic. Biochemia Medica, 22(3), 276-282. https://hrcak.srce.hr/89395
Meloy, J. R., Goodwill, A., Clemmow, C., & Gill, P. (2021). Time sequencing the TRAP-18 indicators. Journal of Threat Assessment and Management, 8(1-2), 1-19. https://doi.org/10.1037/tam0000157
Meloy, J. R., & Hoffman, J. (Eds.). (2021). International handbook of threat assessment, 2nd Edition. Oxford University Press.
Meloy, J. R., Hoffmann, J., Guldimann, A., & James, D. (2012). The role of warning behaviors in threat assessment: An exploration and suggested typology. Behavioral Sciences & the Law, 30(3), 256-279. https://doi.org/10.1002/bsl.999
Meloy, J. R., & Kupper, J. (2025). Going dark redux: The 2018 Capital Gazette mass murder. Journal of Threat Assessment and Management, 13(2), 139-165. https://doi.org/10.1037/tam0000244
Meloy, J. R., Mohandie, K., Knoll, J. L., & Hoffmann, J. (2015). The concept of identification in threat assessment. Behavioral Sciences & the Law, 33(2-3), 213-237. https://doi.org/10.1002/bsl.2166
National Threat Evaluation and Reporting Office. (2025). National programs. Department of Homeland Security. https://www.dhs.gov/nter-national-programs
Oksanen, A., Kaltiala-Heino, R., Holkeri, E., & Lindberg, N. (2015). School shooting threats as a national phenomenon: Comparison of police reports and psychiatric reports in Finland. Journal of Scandinavian Studies in Criminology and Crime Prevention, 16(2), 145-159. https://doi.org/10.1080/14043858.2015.1101823
Page, M. J., McKenzie, J. E., Bossuyt, P. M., Boutron, I., Hoffmann, T. C., Mulrow, C. D., … & Moher, D. (2021). The PRISMA 2020 statement: An updated guideline for reporting systematic reviews. BMJ, 2021, 372. https://doi.org/10.1136/bmj.n71
Parkin, W. S., & Gruenewald, J. (2017). Open-source data and the study of homicide. Journal of Interpersonal Violence, 32(18), 2693-2723. https://doi.org/10.1177/0886260515596972
Peterson, J. K., & Densley, J. A. (2021). The Violence Project database of mass shootings in the United States, 1966–2019 (Version 4). The Violence Project. https://www.theviolenceproject.org/wp-content/uploads/2019/11/TV-Mass-Shooter-Database-Report-Final-compressed.pdf
Peterson, J., Densley, J., Erickson, G., Fay, E., Higgins, S., Jensen, A., Janssen, M., Klumb, H., Knapp, K., Lindgren, J., McMahon, G., & Peterson, H. (2021). A multi-level multi-method investigation of the psycho-social life histories of mass shooters. National Institute of Justice. https://www.ojp.gov/pdffiles1/nij/grants/302101.pdf
Peterson, J., Densley, J., Riedman, D., Spaulding, J., & Malicky, H. (2024). An exploration of K–12 school shooting threats in the United States. Journal of Threat Assessment and Management, 11(2), 106-120. https://doi.org/10.1037/tam0000215
Peterson, J., Erickson, G., Knapp, K., & Densley, J. (2021). Communication of intent to do harm preceding mass public shootings in the United States, 1966 to 2019. JAMA Network Open, 4(11), e2133073. https://doi.org/10.1001/jamanetworkopen.2021.33073
Scalora, M., Hawthorne, D., Pellicane, T., & Schoeneman, K. (2020). A glimpse of threat assessment and management activity performed by the United States marshals service. Journal of Threat Assessment and Management. 7(1-2), 85-97. https://doi.org/10.1037/tam0000149
Schildkraut, J., Connell, N., Barbieri, N., & de Azeredo, R. (2024). American uniqueness revisited: A comparative examination of two school shootings using the path to intended violence. International Journal of Comparative and Applied Criminal Justice, 48(2), 143-158. https://doi.org/10.1080/01924036.2023.2221751
Schuurman, B., & Eijkman, Q. (2015). Indicators of Terrorist Intent and Capability: Tools for Threat Assessment. Dynamics of Asymmetric Conflict, 8(3), 215-231. https://doi.org/10.1080/17467586.2015.1040426
Schuurman, B., Bakker, E., Gill, P., & Bouhana, N. (2018). Lone actor terrorist attack planning and preparation: A data-driven analysis. Journal of Forensic Sciences, 63(4), 1191-1200. https://doi.org/10.1111/1556-4029.13676
Silva, J. R., & Greene-Colozzi, E. A. (2024). Assessing leakage-based mass shooting prevention: A comparison of foiled and completed attacks. Journal of Threat Assessment and Management, 11(4), 203-217. https://doi.org/10.1037/tam0000205
Silva, J. R., & Madfis, E. (2025). School threat assessments of firearm and school shooting concerns. Journal of School Violence, 24(3), 343-359. https://doi.org/10.1080/15388220.2025.2473531
Silva, J. R., Silver, J., & Greene-Colozzi, E. A. (2023). A behavioral sequence analysis of mass school shooters examining stressors, antisocial behaviors, mental health issues, and planning and preparation activities. Deviant Behavior, 44(10), 1480-1497. https://doi.org/10.1080/01639625.2023.2210730
Silver, J., & Silva, J. R. (2022). A sequence analysis of the behaviors and experiences of the deadliest public mass shooters. Journal of Interpersonal Violence, 37(23-24), NP23468-NP23494. https://doi.org/10.1177/08862605221078818
Silver, J., Simons, A., & Craun, S. (2018). A study of the pre-attack behaviors of active shooters in the United States between 2000 and 2013. Federal Bureau of Investigation. https://www.fbi.gov/file-repository/pre-attack-behaviors-of-active-shooters-in-us-2000- 2013.pdf
Slemaker, A. (2023). Studying mass shooters’ words: Warning behavior prior to attacks. Journal of Threat Assessment and Management. 10(1), 1-17. https://doi.org/10.1037/tam0000198
Smith, B. L., Gruenewald, J., Damphousse, K. R., Roberts, P., Ratcliff, K., Klein, B. R., & Brecht, I. (2016). Sequencing terrorists’ precursor behaviors: A crime-specific analysis. National Institute of Justice. https://www.ojp.gov/pdffiles1/nij/grants/256017.pdf
Steiner, J. E. (2010). More is better: The analytic case for a robust suspicious activity reports program. Homeland Security Affairs, 6(3). https://www.proquest.com/scholarly-journals/more-is-better-analytic-case-robust-suspicious/docview/1266215295/se-2
Sutanapong, C., & Louangrath, P. I. (2015). Descriptive and inferential statistics. International Journal of Research & Methodology in Social Science. 1(1), 22-35. https://zenodo.org/record/1320727/files/Descriptive%20and%20Inferential%20Statistics%2C%20VOL%201%2C%20NO%201.pdf?download=1
Tampe, L., & Bondü, R. (2025). “Killing all infidels”: Leaking prior to Islamist terrorist attacks in Germany. Terrorism and Political Violence, 37(3), 424-439. https://doi.org/10.1080/09546553.2023.2237480
U.S. Department of Homeland Security. (2015) Information sharing environment (ISE) – Suspicious activity reporting (SAR) functional standard, version 1.5.5. https://www.dhs.gov/xlibrary/assets/privacy/privacy-pia-dhswide-sar-ise-appendix.pdf
U.S. Department of Homeland Security. (2019). Strategic framework for countering terrorism and targeted violence. https://www.dhs.gov/sites/default/files/publications/19_0920_plcy_strategicframework-countering-terrorism-targeted-violence.pdf
U.S. Department of Homeland Security. (2020). Strategic framework for countering terrorism and targeted violence: Public action plan. https://www.dhs.gov/sites/default/files/publications/cttv_action_plan.pdf#:~:text=The%20three%20documents%20describe%20a%20concept%20of%20targeted,a%20particular%20target%20prior%20to%20the%20violent%20attack.
U.S. Department of Homeland Security. (2022). About the NSI. https://www.dhs.gov/nationwide-sar-initiative-nsi/about-nsi
Vergani, M., Perry, B., Freilich, J., Chermak, S., Scrivens, R., Link, R., Kleinsman, D., Betts, J., & Iqbal, M. (2024). Mapping the scientific knowledge and approaches to defining and measuring hate crime, hate speech, and hate incidents: A systematic review. Campbell Systematic Reviews, 20(2), e1397. https://doi.org/10.1002/cl2.1397
Virginia Beach Police Department (VBPD). (2021). May 31, 2019 final investigation summary report. https://vpc.org/wp-content/uploads/2022/03/VA-Beach-Investigative-Report-March-2021.pdf
Vossekuil, B., Fein, R. A., & Berglund, J. M. (2015). Threat assessment: Assessing the risk of targeted violence. Journal of Threat Assessment and Management, 2(3-4), 243-254. https://doi.org/10.1037/tam0000055
Winch, A. T., Alexander, K., Bowers, C., Straub, F., & Beidel, D. C. (2024). An evaluation of completed and averted school shootings. Frontiers in Public Health, 11, 1305286. https://doi.org/10.3389/fpubh.2023.1305286
Xu, S., & Lorber, M. F. (2014). Interrater agreement statistics with skewed data: Evaluation of alternatives to Cohen’s kappa. Journal of Consulting and Clinical Psychology, 82(6), 1219. https://doi.org/10.1037/a0037489
About the Author
Noah Turner is an Assistant Professor of Criminal Justice in the Paul H. O’Neill School of Public and Environmental Affairs at Indiana University – Indianapolis. He received his Ph.D. from the School of Criminal Justice at Michigan State University in 2024 and was previously a post-doctoral Research Associate at the National Counterterrorism Innovation, Technology, and Education Center (NCITE) in the School of Criminology and Criminal Justice at the University of Nebraska at Omaha. His research applies criminological theory to understand various forms of extremist crime and violence, with the goal of producing actionable policy implications that address pressing issues in criminal justice and homeland security. Dr. Turner specializes in open-source data collection and analysis and previously managed the development of the Extremist Cyber Crime Database (ECCD) and the Risk and Protective Factors Dataset (RPFD). His recent work has been published in leading academic journals such as Criminology & Public Policy, Annual Review of Criminology, Crime & Delinquency, Terrorism and Political Violence, and Studies in Conflict and Terrorism.
CITATION (APA 7th Edition)
Turner, N. D. (2026). A scoping review of the research on suspicious activity reporting indicators, terrorism, and non-ideological targeted violence. Journal of Mass Violence Research. https://doi.org/10.53076/JMVR61378
