This phase provides the school administration and assigned staff the priorities for conducting predictive analytics with sensitive data. During this process, the authorities determine what threats are oriented towards the school based on historical data (i.e. bully, bomb threats, harassment, shootings, etc.), and prioritize them for the analyst. Consideration of data sources is also critical in creating the largest possible repository for analysis. Depending on the scope, schools should be looking at their own data, regardless of the type or form, and any other sources they would like to query, i.e. law enforcement, open-source, dark web data, etc. Attention should be placed on any limitations or compliance requirements to ensure the data is accessed in accordance with the law/regulations. In this shooting case, there were several data sources that, if available to an analyst, would have provided information regarding the shooter. He had records and reports in the school, law enforcement, local medical systems, as well as social media.

Identify Data to be Analyzed, Data Sources, and Authorities | Obtain Access to Information | Monitor for New Instances

During this phase, the analyst is querying the approved databases, texting platforms, social media alerts as well as law enforcement, state, and federal databases, if possible, for relevant information. The information would be stored in an onsite database behind a firewall for processing and subsequent reporting. If information identifying an immediate threat is found, the school should escalate it to the attention of the authorities.

It is quite possible the school shooter might have been located as data relevant to him from school, law enforcement, and social media records would have been processed during this phase for analysis and assessment. Monitoring of the data would have brought new information regarding arrests or social media posts into the analysis flow.

Search, Store, and Format Relevant Data through Federated Searches | Process Data with Tools and Technology to Aid Analysis

During this phase, the school analyst takes the data from the earlier queries, applies it to an existing or new use case, and readies it for analysis by applying filters, algorithms, and schema to make the data inter-relational. Data determined to be irrelevant is dumped, while data driving other cases may be discovered, and initiate new cases begin based upon it.

Any information collected is formatted in a way to simplify the association between a potentially violent person to events and actions that would become increasingly evident in the next phase.

Identify Data to be Analyzed, Data Sources, and Authorities | Obtain Access to Information | Monitor for New Instances

At this point, the school analyst is applying more advanced tools and technologies to analyze the data to identify links between entities and events, update existing cases, or linking a potentially violent offender to an immediate threat. The analysis is continuous, on a daily basis new data is being analyzed to value its connections to existing use cases. Threats identified are validated through data sharing or vetting with authorities prior to submission as a report.

This would have been the step in the process where the school shooter could have been identified. The data collected by no would have been difficult to overlook. Using link and temporal analyses, and identity extraction tools an analyst would be able to identify numerous events that would indicate intervention is needed.

Share and Disseminate Results and Findings in a Variety of Formats

In this final phase, the analyst prepares the report to submit to the authorities for validation and action. The report can be produced in any required format but should contain the information necessary to support the analyst’s claim.
If required, supporting documentation can be provided from the use case
assigned to the individual.