Digital Threat Assessment Toolkit
Digital Evidence

6.0 Applying Behavioral Threat Assessment Principles to Digital Content

All threat assessments should include a comprehensive review of the individual’s online behavior and digital footprint as this is where blatant pre-incident indicators, leakage, and evidence of pre-existing symptom development can be found.

Threat Assessment Terminology Definitions

Baseline of Behavior

Establishing the behavioral baseline of an individual is important in understanding whether their current behavior is outside their norm. Typically, a change in their behavioral and digital baseline indicates an increasing level of risk.


It is brought to your attention that a student has posted photos of guns on his social media accounts. After investigating and speaking with him, you determine that he is a hunter and that the photos he had posted were in the context of hunting during hunting season. This shows that this is his behavioral baseline, or what is the typical pattern of behavior for him.

This is a very different scenario than someone who has posted photos of guns with threats on his social media accounts, and after investigating and speaking with him, you find that he has never posted something like this before. This shows there has been a shift in his digital behavioral baseline and can indicate an increasing level of risk.

Tip: It is critical that you follow threat assessment protocols when investigating any concerning behaviors or threats.

Social media is a prominent contributing source of student threat assessment data. An accurate risk determination cannot be made without considering an individual’s entire digital baseline.

Because social media content is user-generated, we now have access to data on likes, dislikes, peer dynamics, and social hierarchy, in addition to photos, videos, comments, and posts. This data can provide valuable insight into a threat maker’s thoughts and motives. Most importantly, it will show whether that individual is engaged in behaviors consistent with their threat. This data can be obtained from open source (public) content without violating privacy.

Specificity of the Threat

A key variable in assessing the seriousness of a threat is specificity. Generally, the more specific the threat is regarding target(s), time, location, and weapon, the higher the risk.

In examining the language of a social media post, pay close attention to the amount (or lack thereof) of detail given.


Not a specific threat: “The school is going to blow”

Specific threat: “Taking my strap to McThermot HS tomorrow morning and shooting everyone in the cafeteria”

Access to the Means

A crucial question to ask in the initial response to a threat is: Does the threat maker have the means to carry out their threat?

If a student posts a picture of a gun on social media and writes that they are going to kill a classmate, a key variable for law enforcement and threat assessment teams to ascertain is whether this student has access to that gun. One way to do that is to determine whether the image in their post is “stock” (sourced online - not original) or “unique” (not sourced anywhere else online - original). This is a foundational Digital Threat Assessment tool that is covered in Section 9 called Reverse Image Search.

Pathway to Violence

The “Pathway to Violence” is the result of a process of thinking and behavior that begins with an idea, progresses to the development of a plan, moves onto preparation for carrying out the plan, and culminates in the implementation of the violent act. DTA helps to identify these signs, assess the individual’s likelihood of acting on their threat, and manage the situation by continuing to monitor online activity. The goal is to prevent an individual from continuing down the pathway to violence.

    For more information about the threat assessment process, the TxSSC has created a separate toolkit linked below. This toolkit provides information about how a threat assessment team identifies, assesses, and manages threats. The toolkit also includes guidance and resources for forming and implementing a team in your school or district. (Note: The link below will open in a new tab.)

  • Behavioral Threat Assessment and Management for Educators and Administrators Toolkit