Breaking Down Information Silos

Contributed by Jim Brigham, LCG VP of Risk Management, Former Operations Chief, State of Vermont, Office of Safety and Security

Turning Reports into Actionable Intelligence

When I worked for the State of Vermont, our team did not treat an SSIR submission as simply a complaint to be documented. It initiated a structured, multidisciplinary assessment. Each team member was assigned a specific role so that the available information could be collected quickly, independently verified, and evaluated within the larger context.

Depending on the circumstances and available legal authority, that work could include:

• Open-source intelligence research, including social media and other publicly available information.
• Background research using authorized subscriber databases.
• Criminal justice and records-management system inquiries.
• Determining whether the person was under the care or supervision of the Department of Corrections.
• Contacting other state agencies that may have relevant information.
• Coordination with Human Resources, legal counsel, agency leadership, IT, physical security, and compliance personnel.
• Referrals to law enforcement, mental health agencies, or social service providers.

Those external referrals were important because not every person of concern was primarily a criminal justice problem. Financial instability, housing insecurity, untreated mental health concerns, family conflict, substance use, loss of employment, and other unmet basic needs could contribute to a person’s grievance, desperation, or movement toward violence. Addressing those underlying stressors was often essential to reducing risk.

Each case was evaluated using principles consistent with the U.S. Secret Service National Threat Assessment Center’s behavioral threat assessment model. The objective was not to predict who would become violent, an impossible standard, but to determine whether the person’s behavior suggested movement along a pathway toward violence and what intervention might interrupt that progression.

The assessment considered several central areas:

Motivation and Context

What motivated the statement or behavior? Did the underlying grievance still exist? Who or what did the person blame? What efforts had been made to resolve the problem, and did the person recognize any peaceful alternatives?

Communications and Planning

Had the person communicated violent ideas, intentions, targets, or plans to others, either directly or online? Did collateral interviews, observed behavior, or available records support or contradict what the person was saying? Was there evidence of research, preparation, surveillance, weapons acquisition, or other planning?

Relationships and Support

Did the person have trusted relationships or meaningful connections to others? Were family members, coworkers, friends, or service providers concerned that the person might act? Did anyone discourage the behavior, minimize it, enable it, or reinforce violence as an acceptable solution?

Past Behavior and Escalation

Had the person generated previous concerns? Were there recent changes in mood, conduct, communications, or functioning? Was there a history of violence, domestic abuse, stalking, weapons-related behavior, criminal activity, or fixation on previous attackers and acts of mass violence?

Environmental and Protective Factors

What conditions increased or decreased the risk? Did the person have access to the intended target, weapons, transportation, technical knowledge, or other means necessary to carry out the threatened conduct? Conversely, were there protective factors, supportive relationships, treatment, stable housing, employment, supervision, or willingness to accept assistance that could help manage the situation?

The U.S. Secret Service framework emphasizes examining motives, communications, stressors, weapons access, planning, capacity, consistency, protective factors, and whether violence is increasingly viewed as an acceptable option. It also supports the creation of multidisciplinary teams and centralized reporting mechanisms, precisely because no single department is likely to possess all the relevant information. U.S. Secret Service NTAC operational guide

This was where information became intelligence. A concerning social media post might mean little by itself. A disciplinary problem, unusual computer activity, domestic conflict, access to weapons, and an escalating grievance might also appear manageable when viewed separately. When those pieces were brought together, however, they could reveal a pattern that no individual department could see.

That is the danger of information silos: each person may perform their assigned function correctly while the organization collectively misses the threat developing directly in front of it.