According to a database compiled by AP, USA Today and Northeastern University, more mass killings occurred in the United States in 2019 than in any year since at least the 1970s. While concerning, this record is unfortunately not surprising given the recent uptick of public attacks in the country. But the number of such attacks in 2019 would have been far higher had it not been for citizens adhering to the "see something, say something" principle. Indeed, in December alone, several mass shootings were apparently thwarted by good Samaritans who alerted authorities to the potential attacks.

That's because potential perpetrators, regardless of their varying motives, all have to follow the same steps prior to an attack. And this, combined with the indications of intent attackers often also leak, leaves a trail of breadcrumbs that ordinary citizens can spot and report to authorities before it's too late.

Following the Breadcrumbs

The Attack Cycle: There are two key reasons why "see something, say something" works — the first being that attacks are the result of a discernible planning process, which we refer to as "the attack cycle." While this cycle is typically associated with terrorist attacks, the same general framework can also be applied to non-ideologically motivated mass attacks, such as workplace or school shootings. The perpetrator behind the 2017 mass shooting in Las Vegas, for example, clearly followed the attack cycle before slaying 58 people at a music festival, as did the gunman who murdered 17 students and adults at Florida's Marjory Stoneman Douglas High School in 2018.

Of course, there is a great deal of flexibility in how various actors progress through the cycle for different types of attacks. The exact steps leading up to a vehicle bombing are going to look different than those leading up to an assault with an edged weapon or firearm. But while attack cycles will vary in complexity and length, every actor is still bound to the same general process as they progress through their respective preparations. Specifically, they all need to identify their target, plan out how they will conduct the attack, conduct surveillance and acquire their weapon of choice, making them vulnerable to detection at each step of the way.

Individuals do sometimes conduct ill-conceived, poorly executed attacks that involve shortcuts in the planning process, though even half-baked attacks and plots follow this same general process. No amount of training, nor any ideology or motive, absolves one from having to follow this cycle either. This means that while a professional with advanced terrorist tradecraft may be better at concealing his activities while acquiring weapons or conducting surveillance, he is nevertheless bound to cycle through the same identifiable actions as a rank amateur. Likewise, the same attack cycle applies to a white supremacist every bit as much as it does a jihadist, "incel" attacker or Columbine-like school shooter. 

Leakage: In addition to behaviors related to the attack cycle, there are frequently far more blatant signs that someone may be plotting something malicious. A surprisingly large number of would-be attackers either reach out to other people for help conducting the attack first, or broadcast their intent to third parties through direct threats, boasts, warnings or other statements. In the wake of an attack, it is very common to hear witnesses discuss how the perpetrator had made direct threats beforehand or had shown signs of becoming increasingly radicalized, whether in person or on social media. Statements that reveal a potential attacker's feelings, thoughts, fantasies, attitudes or intentions are often referred to as "leakage." Reported leakage has resulted in stopping numerous attacks, as well as leading to dozens of sting operations in recent years that have stopped aspiring attackers before they could cause harm. 

On Dec. 5, for example, the San Diego Joint Terrorism Task Force arrested a man who had posted videos of himself on social media in which he pointed guns at pedestrians from a hotel room and threatened to conduct a mass shooting. Upon conducting a search warrant on his home, authorities seized 15 firearms, including three illegally altered rifles (presumably to fire fully automatic). On Dec. 13, a Saudi student at the University of New Mexico was also arrested and charged with illegally possessing a firearm after a concerned citizen told authorities that he had reportedly made a list of people he wanted to kill before he left the United States. Over the past month, two separate school attacks were also thwarted in Florida and upstate New York after citizens reported their plots to authorities. 

Better Safe Than Sorry

So while we may be living in a time in which mass attacks from a variety of actors have grown increasingly common, these attacks do not appear out of a vacuum, meaning they can be detected and stopped. It's thus imperative that the public understands the attack cycle and leakage so that they know which "somethings" to spot and report to authorities. This allows people to identify the tactics, tradecraft and behavior that can provide indications of an attack cycle in progress. Knowing what to look for also makes it possible for people to detect if their neighbor is involved in activities that may signal an impending attack, such as experimenting with bombs.

Of course, I'm not saying that every kid lurking suspiciously outside a school is a killer, or that every small explosion indicates terrorist activity. Visiting a public building and observing security measures isn't inherently criminal either, nor is standing on the street to watch a top executive's arrival at an office building. But such actions could provide a vital glimpse into a malicious plot in motion.

If someone engaged in such behavior exhibits demeanor that suggests some sort of ill intent, it's thus worth reporting it to the appropriate authorities. Even in cases where the authorities can't legally stop such behavior, they can still identify the potential assailant and launch an investigation to determine if he poses any real threat. So while the recent increase in mass public attacks is alarming, we are far from helpless, as an alert public can — and has — saved lives. 

'See Something, Say Something' Still Works. Here's Why. is republished with the permission of Stratfor Worldview, a geopolitical intelligence and advisory firm.

Image: Reuters.