The Ligue has been busy fielding reporters’ questions following the targeted killing of a CEO of a major healthcare company outside a Midtown Manhattan hotel (e.g., this Reuters article). One question we’re getting is if other companies should be worried about copycat attacks.
• Are copycat incidents a real thing?
• Does it make sense to temporarily increase security when an incident occurs or is it just a waste of money?
• And if it does make sense, how long should high-alert security be maintained?
These questions are particularly relevant to terror attacks. Rather than an act of violence born from individual grievance, ideologically motivated violence has additional potential to inspire attacks across the globe. In the case of the recent killing of a Healthcare insurance executive, in which denial of coverage seems as if it may have been the motive, it seems the personal and ideological may be mixed. So, is the copycat phenomenon real or a myth?
A study examining data on shootings in the US, including 232 mass killing events between 2006 to December 2013 and 220 school shootings between 1997 and 2013, concluded that copycat killers are a real thing (“Contagion in Mass Killings and School Shootings,” Plos One, 2015).
The researchers said data seems to prove that mass killings and school shootings can be “contagious.” The study concludes: “We find significant evidence that mass killings involving firearms are incented by similar events in the immediate past.”
Sensationalism is at the root of this phenomenon, so it is reasonable to assume that the same risk following a school shooting applies now. It’s not necessarily the victim count that raises the risk of copycat events—it’s the attention the incident receives. Given significant attention, any sensational violent event may promote ideation in vulnerable individuals. That is, some mass killings with few victims may nonetheless receive a saturation of coverage by news organizations and on social media that can spur copycats.
Clearly, then, businesses need to address the real threat of copycat events—but for how long? For example, if a mass killing event occurs in a shopping mall and news coverage of the event is significant, then for how long might other shopping malls want to beef-up their security?
The answer is about two weeks. “On average, the temporary increase in probability lasts 13 days, and each incident incites at least 0.30 new incidents,” said researchers.
Because so many perpetrators of these acts commit suicide, the researchers said it’s hard to ever know on a case-by-case basis who was inspired by similar prior acts, but data suggests that extra security in the wake of highly publicized events is a worthwhile and warranted safety precaution.
This is why tiered implementation is a valuable approach, one that enacts a set of measures that is most appropriate for the current risk environment and includes plans for actions to take if risk changes. Plans should address how to ramp-up security quickly in the face of enhanced risk, including pre-contracting for equipment or supplemental security staff. The security measures a business takes should be driven by the risk of an event and since risk can change—the result of a specific threat, intelligence, a special event, or event frequency—tiered implementation is a useful strategy.
Of course, when events evoke strong emotions, such as in the wake of a high-profile event, people focus on its potential harm rather than on its likelihood to occur. For an organization, this can result in misalignment between security and risk. Furor raises the possibility that organizations will overreact to one-off events or media reports, ignoring more realistic risks that are present every day for employees and operations. Organizations must be reactive to risk, but also pragmatic to ensure that statistically larger risks aren’t ignored—something a trusted and expert security partner can ensure.
In short, it is critical for corporations to partner with security firms for resources that ensure an agile response to immediate threats, but a protection posture should derive from thoughtful and objective risk assessment that avoids recency bias and distortions from emotionally charged events.