CASE STUDY – "PROFESSIONAL SCHOOL SHOOTER"
On February 14, 2018, Nikolas Cruz arrived at Marjory Stoneman Douglas High School in Parkland, Florida. Cruz was armed with an AR-15 semi-automatic rifle. He carried several magazines full of ammunition. Early reports indicated that Cruz was also armed with smoke grenades and wore a gas mask. The Broward County Sheriff later corrected this, making it clear that Cruz did not have smoke grenades or a mask. Cruz made entry into the school, triggered the fire alarm, and opened fire on students and teachers as they emerged from classrooms. When the carefully planned and executed assault was over seventeen people were killed and several were injured, some critically.
Cruz attended Marjory Stoneman Douglas High School the previous school year. Reports indicate that Cruz had disciplinary problems a school and had been expelled.
“... that he had been kicked out of two private schools, had been held back twice”
Nikolas Cruz is believed to have been the victim of bullying while attending high school. Cruz was adopted. Both of his adoptive parents are deceased with his mother passing away last year.
Nikolas Cruz was described as a
“He was always to himself and never tried to associate himself with anyone,”
stated a fellow student. In addition, the student stated,
“...as far as I know, he didn’t have any friends.”
“...students would joke that if anyone were to open fire inside the school, it would be Mr. Cruz. Because of that, students feared him and mostly stayed away from him, ..”
There are reports that in September of 2017, the FBI was notified about a
who wanted to be a
"professional school shooter"
The Facebook user, a blogger known as Ben Bennight, contacted the FBI to inform them that someone had made the disturbing comment in response to one of his social media posts.
Initial reports on Nikolas Cruz’s social media activity paint a clear yet disturbing picture.
“Screen shots of an Instagram page said to belong to Mr. Cruz show many photos of a man holding firearms and ammunition used in a semi-automatic AR-15 rifle. One photo shows several guns, including rifles with scopes, laying on a bed. Another appears to show a frog that had been killed.”
The fact that Nikolas Cruz possessed a significant arsenal of weapons was not a secret to anyone including students, faculty and local law enforcement.
"One of my friends said that he used to follow him on social media accounts where he would regularly post videos of him with guns and knives."
Based on his social media posts, Cruz displayed instances of cruelty to animals.
Ominously, Nikolous Cruz appears to have had fascination or fetish with Islamic terrorism. His social media posts contain references to “Allahu Akhar.”
School authorities recognized Cruz’s anti-social, delinquent, and erratic conduct as a threat.
“flagged [Cruz] as a possible threat.”
School officials were concerned enough to issue directives that Nikolas Cruz was not allowed on campus with a backpack.
Nikolas Cruz did everything except email the school to tell them he was going to attack. When Nikolas Cruz was expelled from school, administrators may have assumed that the threat he posed no longer existed. This was a fatal miscalculation. The emotional, technical, and social warning signs were abundant.
The FBI possesses vast technological resources. The organization has extraordinary open source intelligence collection and analysis capabilities. Shockingly they were unable to connect the dots and link the
“professional school shooter”
post to the actual Nikolas Cruz.
A cascade failure of policy, security operations, and threat analysis set the stage for an horrific tragedy.
There appears to be no administrative policies or legal authorities in place allowing school officials to directly monitor open sources for indications of threats posed by current and former students, faculty, or parents.
The school district did not have a dedicated security operations center (SOC). This unit would be tasked with monitoring social media and other open sources in order to gather threat intelligence. The target of the intelligence gathering effort would be students, current and former, who have displayed or voiced violent intentions.
Intelligence gathered via open sources should have been subjected to continuous analysis in order to develop a threat assessment.
Vigilox Security Operations Solutions provides the human and technical resources needed to build, manage, and operate a dedicated Security Operations Center purpose-built to address the unique security challenges of education administrators. This Security Operations Center (SOC) would provide school administrators with an EARLY WARNING system. The SOC, internally managed or delivered as a managed security service, would empower school administrators and other stakeholders with the ability to collect open source intelligence (e.g. social media posts, photos). The SOC would would feature the level of automation with which to continuously gather open source intelligence on subjects of interest. The open source intelligence would be correlated with data from closed sources (e.g. school records, medical records, etc.) The data gathered would be analyzed to create a Threat Assessment. Based on the threat assessment, school officials would activate the next phase of the protocol: Intervention or Interdiction. If the Threat Assessment indicates that the subject IS NOT a threat to self or others, then a collaborative INTERVENTION is orchestrated for the welfare of the child. If the Threat Assessment indicates that the subject poses an eminent threat, then an INTERDICTION is performed. In the rare case that an Interdiction is called for, the appropriate law enforcement, and perhaps Child Welfare, authorities would take the lead.