This practitioner reflection examines how counterterrorism experience helped shape a broader, multidisciplinary approach to targeted violence prevention. The cases that follow illustrate four operational lessons for today’s homeland security professionals: assess behavior rather than labels, match interventions to the threat, sustain ownership across handoffs, and build partnerships before a crisis.
At the FBI’s sixth annual Threat Assessment and Threat Management Symposium, I was asked to reflect on how the prevention community evolved from a primarily investigative and enforcement-oriented counterterrorism posture toward a broader, multidisciplinary approach to threat assessment and management. The assignment brought me back to the symposium’s origins during my final year as chief of the Behavioral Analysis Unit, where the Behavioral Threat Assessment Center was housed, and to the operational lessons that continued to shape my work after I entered the private sector.
In 2018, following the tragic active assailant attacks in Las Vegas, Nevada, and Parkland, Florida, my unit embarked on a mission to bring a multidisciplinary prevention model to every layer of government. The initiative was established as a national FBI effort. We worked to build interagency partnerships, develop standard operating procedures, provide legal guidance to field offices, and train a new cadre of FBI Threat Management Coordinators. The work later expanded to state and local law enforcement partners and behavioral health professionals. At its best, the effort broke down barriers, built new relationships, aligned prevention objectives, and helped save lives.
Returning to the symposium in its sixth year offered strong evidence, in my judgment, that the program continues to mature. Representatives from FBI field offices were joined by attendees from 11 countries. It was a practitioner-led forum where new ideas were exchanged, updates on best practices were shared, and the evolving threat landscape was examined through the lens of real operational experience. As the nation approaches the 25th anniversary of September 11, 2001, I was asked to begin the discussion with a story of evolution: how the prevention community moved from a primarily investigative and enforcement-oriented counterterrorism posture toward a more deliberate, multidisciplinary approach to threat assessment and management.
What follows is not a comprehensive history of counterterrorism or targeted violence prevention. It is a practitioner’s reflection on cases and inflection points that shaped my understanding of prevention. Identifiable events are described only through facts available in the public record. Other examples have been anonymized and generalized, and the analysis reflects my own professional judgment rather than an official FBI account. Operational details, investigative methods, and information that could identify subjects, personnel, or partner organizations have been omitted unless already publicly documented. Some lessons were learned through success. Others came through missteps, friction, or tragedy. Together, they underscore a central point for homeland security professionals across government, the private sector, academia, and civil society: prevention requires disciplined assessment, lawful and timely information sharing, proportionate management, and the humility to learn from each case in ways that can inform the broader homeland security enterprise.
My journey began before 9/11, when I entered the Bureau as a new Agent in 1998. I came from an investment banking background and was assigned to the Washington Field Office after al-Qaida’s embassy bombings in Kenya and Tanzania. At the time, I knew very little about terrorism. I had received only limited training at the Academy and had only begun to understand the issues that would soon dominate my career. I was assigned to the office’s lone international terrorism squad, where the work initially felt both important and frustratingly constrained. Much of it involved compiling information about people connected, directly or indirectly, to terrorist groups overseas. I briefly moved to a criminal squad, where I ran sources, worked undercover operations, made arrests, and developed the operational instincts that later shaped my approach to threat management. Then 9/11 happened. I was driving back to the office from an arrest when I first heard reports of the attacks. We went immediately to the Pentagon, and my professional transformation began.
In the immediate aftermath of 9/11, the FBI rapidly shifted from investigating federal crimes after they occurred to bridging the gap between criminal investigation and intelligence collection in service of a new priority: preventing terrorism. The early instinct was understandable. The country had been attacked, the hijackers were dead, and investigators needed to identify associates, supporters, contacts, facilitators, and anyone else who might present an ongoing threat. But the prevention mission was still developing, and the early cases revealed how difficult it can be to balance urgency, disruption, accountability, and long-term threat management.
Early Lessons: Consequences Beyond the Immediate Case
One early case involved two young men, whom I will refer to as Subject A and Subject B, who traveled overseas around a major holiday shortly after 9/11/2001. A family member had written a letter describing the emotions he felt as one of the men appeared to be leaving to commit jihad. The letter was discovered by foreign authorities when the men arrived. After several days of interviews and additional inquiry, the authorities returned them to the United States and notified my squad that they were en route.
At the time, we treated the matter as a serious counterterrorism case. We conducted aggressive interviews of the travelers and the family member who wrote the letter. We pursued legal process, considered prosecution options, and used every tool available to put pressure on the subjects, including the material witness warrant, which had been used much less frequently before 9/11. The case garnered media attention and our investigative tools significantly disrupted the lives of the travelers and many others in their social orbit. Ultimately, there was no plot nor was there a plan to conduct some an attack during their journey.
Looking back, the case forced an important question that remains relevant today: what are the second- and third-order effects of our interventions? A prevention strategy that focuses only on immediate disruption can create new stressors, alienation, humiliation, or instability if it does not also consider long-term management and a viable disengagement for the person of concern.
The lesson from that case was straightforward but significant. Prevention work must account for second- and third-order effects, not only the immediate investigative or enforcement outcome. Law enforcement tools may be necessary, but they are rarely the only threat management strategy. If prevention is truly the priority, agencies and partner organizations must be willing to examine their interventions honestly, learn from mistakes, and consider whether a given action reduces risk over time or merely displaces it.
Using Intelligence to Calibrate Action
Not long after the prior case concluded, I began to focus on another one which featured an English-speaking lecturer whose teachings attracted thousands of followers. His message emphasized end-times narratives, a coming clash of civilizations, and the obligation to fight. Some followers had military experience, and several were drawn into a group that treated ideological commitment as preparation for violence.
When we first discovered this group and we began recruiting sources, gathering intelligence, and learning more about the members of the group in a deliberate way. We learned that some members had participated in organized paramilitary-style activities before 9/11. Individuals with prior military experience reportedly imposed structure and purpose on those activities, while others traveled overseas for additional training and returned with accounts that reinforced the group’s identity and worldview.
Over time, we narrowed our focus to those who appeared to present the greatest risk and those whose conduct created the clearest criminal liability. Intelligence was not a separate product sitting beside the investigation; it informed the threat assessment, shaped investigative priorities, and helped determine where limited resources should be directed.
After 9/11, the focus for this group had shifted. The attacks were justified within the group’s ideological frame, jihad was described as obligatory, and those who were physically able were told to fight. Some traveled. Some backed out. Others were later recruited into broader plots. Eventually, arrests and prosecutions followed. Intelligence helped inform not only the threat assessment but also investigative strategy, charging decisions, cooperation decisions, and resource allocation. The outcome was a success because dangerous individuals were incapacitated and an immediate threat was disrupted.
The broader lesson was that intelligence should drive assessment and assessment should drive action. That does not mean abandoning prosecution as an option or becoming less aggressive where the facts support intervention. It means being calibrated. Practitioners need to understand triggers for mobilization, use credible intermediaries or “pulse takers” where appropriate to assess movement toward violence, and avoid reducing people to labels such as “true believer.” Even highly committed extremists remain people with families, needs, identities, grievances, and attachments that may be relevant to assessment and management.
Avoiding Groupthink and Proportioning the Response
A few years later, after I transitioned to the FBI’s Counterterrorism Division, I was assigned to manage cases involving al-Qaida matters and a set of investigations across roughly 10 field offices focused on a group (Group A). The group had its own religious leader, reported training activity overseas, and a history that included prior violence by older members. There was a great deal of concern around the group, and to many observers the facts initially appeared alarming.
As we examined the facts more objectively, however, the picture became more complicated. Despite some violent rhetoric and a distant history of ideological violence, the present activities did not amount to much more than minor criminal activity, such as the sale of counterfeit goods. The threat was assessed differently across the team of assigned investigators. In my role I had to weigh the risk that the highest-threat interpretation of the group would drive a response disproportionate to the available evidence. Some advocated an aggressive tactical operation at the group’s compounds. Others, including me, assessed that such an approach could needlessly escalate the situation, create unnecessary risk, and produce consequences that undermined the goal of prevention.
The lessons were directly relevant to today’s version of threat assessment and management. A multidisciplinary approach helps guard against groupthink, especially when facts appear alarming and operational pressure is high. Management strategies should be proportionate to the threat as assessed through a deliberate process, not simply responsive to the most severe possible interpretation of the facts. Homeland security professionals must also consider second- and third-order effects while pursuing prevention, because an unnecessarily aggressive response can create avoidable risk, reinforce grievances, or undermine community trust.
When Process, Information Sharing, and Persistence Matter Most
One of the most influential cases in my career involved a public-sector employee whose communications with a person associated with extremist messaging raised concern. A lead from another office indicated that the employee had been in contact with that individual. Some of the communications warranted closer review, and we began seeking additional context to assess the potential threat.
The matter was worked in a limited multidisciplinary fashion by the joint terrorism taskforce I led. We reviewed what we could access and identified a plausible explanation for some of the contact. The employee had received positive professional recognition, and aspects of the employee’s work appeared to provide logical context for the outreach. At the same time, the available information did not fully resolve the concern. We had to calibrate our next step, mindful of investigative limitations, operational sensitivities, and the potential consequences of a premature or poorly targeted inquiry.
The outreach appeared to have a plausible professional explanation, but that context did not resolve the concern. Before initiating inquiries that could expose sensitive collection, damage a career, or compromise a broader investigation, we needed additional information from the office that owned the larger case. Without that context, we could not make a fully informed assessment or establish an appropriate long-term management strategy.
Ultimately, we did not obtain all of the information we believed was necessary, the inquiry lost momentum, and the matter was closed. A later act of violence showed that the concern had not ended with the closure of the inquiry. For me, the case became a painful reminder that a process can appear reasonable based on the information available and still fail when the information picture is incomplete, continuity is lost, or risk is not reassessed over time. In prevention work, incomplete information is itself a condition that must be managed through persistence, disciplined escalation, and sustained ownership when appropriate.
The lessons from that tragedy remain among the most important. Practitioners must do everything reasonably available to fully assess the threat, work creatively through obstacles, and recognize that people are counting on prevention professionals to do the work carefully and well. A disciplined process improves decisions in real time and provides accountability when a case is later reviewed. Just as important, leaders must watch for friction, overload, or conflict within and between teams, because those dynamics can affect continuity, judgment, and the quality of the threat management effort.
Proportionate Disruption and the Role of Undercover Operations
Other cases demonstrated how the same lessons could be applied more successfully. Two examples involved individuals who were mobilizing toward violence in separate matters.
In one case, an individual was radicalizing through repeated exposure to extremist lectures and wanted to travel overseas to fight. He was seeking assistance and was willing to leave his family behind. Investigators used confidential sources and an undercover operation to assess his intent, capability, and movement toward violence. During the operation, he took concrete steps in support of a proposed attack on public transportation before authorities intervened.
In another case, investigators learned that two individuals were radicalizing and expressing a desire to attack religious institutions in order to provoke broader race related conflict. Sources provided insight into their motivations, grievances, and movement toward action. Investigators used that information to structure undercover operations as the individuals progressed along the pathway to violence.
In both situations, undercover operations were used not simply to build prosecutable cases, but to better understand motivation, intent, capability, planning, and movement along the pathway to violence. Such techniques warrant scrutiny and careful oversight. In appropriate cases, however, they can provide a proportionate means of assessing mobilization, prioritizing limited resources, and intervening before violence occurs.
Managing Mental Health, Civil Liberties, and Operational Uncertainty
Another case involved a former service member who was posting inflammatory statements online, some of which suggested a possible mental health crisis. People who knew him raised concerns, and we opened a preliminary assessment to better understand the risk. We did not find strong evidence of a prosecutable threat, but because some posts referenced the U.S. President, we coordinated with the U.S. Secret Service and federal prosecutors. Anticipating possible mental health or crisis concerns, we also involved local crisis professionals. The plan was to conduct an interview and reassess based on what we learned.
The interview itself was not initially confrontational, but an unexpected medical issue and a misunderstanding among supporting personnel changed the dynamics. The law enforcement presence escalated quickly, and the former service member was taken into temporary custody for a mental health evaluation.
The lesson was not simply that mental health-related cases are difficult. It was that prevention professionals must continue improving how they plan, coordinate, and execute these engagements. If agencies and partners do not act with care, they can make the situation worse. Partner integration matters: everyone involved must understand the plan, the thresholds for action, the intended tone of the engagement, and the available off-ramps before contact is made.
The BAU Transformation and the Move Toward Community-Based Prevention
In May 2017, I arrived at BAU-1. I did not have a psychology background, but I had significant operational experience. One of my first reactions was frustration that I had not better understood or used the team’s expertise earlier in my career. The Behavioral Analysis Unit had tools, processes, and analytic frameworks that could help field offices think more deliberately about violence risk, grievance, leakage, mobilization, protective factors, and management options. The question was how to make those capabilities more available, more integrated, and more consistently applied.
The urgency became clearer after Las Vegas in October 2017 and Parkland in February 2018. Las Vegas raised questions about the FBI’s role in mass violence investigations and prevention. Parkland demonstrated once again how warning signs can exist across systems without being connected in time. Federal, state, local, school, behavioral health, and community partners may each hold pieces of the puzzle, but prevention fails when those pieces remain isolated.
That realization drove my creation of Threat Management Coordinator training and certification. The goal was not simply to teach a new vocabulary. It was to build bridges between disciplines, align partners around a practical process, and help offices and communities apply prevention principles before a case reached crisis.
A Whole-of-Society Model in Practice
One case that illustrated the value of this approach involved an individual I will refer to as Subject C. A field office was managing the matter while also carrying a heavy operational workload. Subject C first came to attention after reportedly threatening violence against a former school. An interview and search indicated that the individual was struggling with significant mental health concerns, expressed allegiance to a foreign terrorist leader, displayed extremist material at home, and praised a recent domestic attack while critiquing its execution. Despite the clear indication of radicalization, the squad did not have a viable arrest option and initially relied on surveillance-oriented management strategies.
As the investigation progressed, Subject C became increasingly paranoid, and the team grew concerned that some management strategies might be exacerbating the risk. The squad supervisor reached out to BAU for assistance. We brought in additional behavioral threat assessment expertise, including Psychiatrist. When an opportunity arose to make a local arrest on a menacing charge, the purpose was not simply to “do something.” It was to leverage the local prosecutor, the U.S. Attorney’s Office, and the courts to create an opportunity for a mental health evaluation and assertive treatment. The approach worked, and we later received expressions of gratitude from Subject C and his parents for the way the case was handled.
This case captured several core lessons that remain central to prevention. The most effective model is not only whole-of-government; it is whole-of-society. More people need to be trained to recognize concerning behavior, understand pathways to violence, and work cases through a shared prevention framework. Bridges between law enforcement, courts, prosecutors, behavioral health providers, schools, employers, families, and community organizations are essential. Community threat assessment and threat management teams can provide a practical structure for that collaboration, and the same principles are applicable in the private sector, where organizations increasingly face complex concerns involving workplace violence, insider risk, grievance-driven behavior, and targeted threats.
Carrying the Work Forward
The evolution from post-9/11 counterterrorism investigations to today’s broader threat assessment and management field has been shaped by successes, failures, legal constraints, operational pressures, tragic attacks, and near misses. Three lessons emerge from that evolution: prevention must extend beyond specialized units, multidisciplinary teams must be built before a crisis, and practitioners must remain humble about the limits of prediction while applying a disciplined process for assessment and management.
The burden carried by today’s prevention professionals is significant. They are asked to identify risk early, protect civil liberties, avoid overreaction, intervene before violence occurs, and coordinate across systems that were not always designed to work together. The work is difficult, but the path forward is clearer than it once was. Prevention is most effective when it is collaborative, evidence-informed, proportionate, and rooted in the shared responsibility of a whole society.
The work now extends beyond government. Private-sector organizations increasingly need multidisciplinary capabilities to identify concerning behavior, assess risk, manage complex cases, and coordinate with law enforcement, behavioral health, legal, human resources, and other stakeholders. The same principles developed through public-sector experience—disciplined assessment, proportionate intervention, sustained ownership, and partnership before a crisis—remain central in these settings.
The work that began for me in 2017 continues today through an overlapping team-of-teams model that connects government, law enforcement, behavioral health, community partners, employers, and other public- and private-sector stakeholders around a shared prevention mission. The setting may change, but the central requirement does not: prevention depends on disciplined assessment, sustained ownership, proportionate intervention, and relationships built before a crisis.
