Dr. Brennan M.R. Spiegel is associate professor of medicine at UCLA's David Geffen School of Medicine and Fielding School of Public Health, where he teaches decision analysis. Besides his medical degree from New York Medical College, he has a master's in health services from UCLA. Dr. Spiegel is writing a book on the science of threat detection. This op-ed was published in the Pittsburgh Post-Gazette on June 9, 2013.The envelope, wrapped in thick transparent tape and marked with oversized handwriting, arrived at my office on Feb. 23, 2012. It reminded me of the "anthrax letters" that circulated in the wake of the 9/11 attacks. I hesitated before opening it. Soon, much would change. There would be warnings, a gun battle, deaths and outrage.
The letter inside was from someone I did not know. That was not unusual. As a professor of medicine and public health at the University of California, Los Angeles, I frequently receive questions from strangers who find my work on the Internet. But this man sought help for bizarre ailments. In his rambling letter, he claimed that staff at the University of Pittsburgh Medical Center had refused to provide him treatment and held him up at gunpoint. He seemed delusional and paranoid. "Your work may save my life," he concluded. "UPMC will not. Would you help?"
Many people knew about John Shick's aberrant behavior, but few of them communicated with each other or compared notes about Shick's mental health. Shick's "threat-detection network" shows many dead-ends.
Under the crowd-sleuthing scenario, doctors and others involved with John Shick would have compared notes about his behavior and identified him as a public-safety threat before he opened fire at UPMC's Western Psychiatric Institute and Clinic. This diagram shows the possible scope of communication among the people in Shick's network.

Click to enlarge:
Diagram 1
Many people knew about John Shick's aberrant behavior, but few of them communicated with each other or compared notes about Shick's mental health. Shick's "threat-detection network" shows many dead ends.
Diagram 2
Under the crowd-sleuthing scenario, doctors and others involved with John Shick would have compared notes about his behavior and identified him as a public-safety threat before he opened fire at UPMC's Western Psychiatric Institute and Clinic. This diagram shows the possible scope of communication among the people in Shick's network.
The letter triggered a gut feeling that something was amiss. But I had no proof the author intended to harm others. I decided to act anyway -- not as some heroic deed but merely as a prerequisite for a good night's sleep. On Feb. 25, 2012, I wrote UPMC about the letter and shared my feeling that the author could be a serious threat. "This is out of the ordinary," I said in one of two emails to UPMC. "I live over 2,000 miles away, but am nonetheless quite disturbed."
Twelve days later, national media reported that a man named John Shick entered UPMC's Western Psychiatric Institute and Clinic with two semiautomatic pistols and a mind overtaken by paranoid schizophrenia. By the time police killed Shick in a gun battle, one young victim was dead, five others were injured and pundits were anguishing over another lethal tragedy.
Shick. He was the man who wrote me the letter.
In the months that followed, investigators learned Shick's crime was anything but random or unpredictable. Shick triggered countless alarms, over years, that something was gravely wrong. Students in college kept their distance. Co-workers sensed that Shick was dangerous. College administrators detected Shick's increasingly aberrant personality.
Police had dealt with Shick's threats with a Taser -- once after he made menacing gestures with a flashlight and another time after he wielded a knife. Administrators, doctors, crisis counselors, clinic schedulers, clerks, social workers, security guards and neighbors sniffed out the threat. Even I got it, sitting in an office in Los Angeles.
So what happened? Scores of people had a gut feeling that something was wrong with this man. Why did the tragedy happen? And what about Tucson, Ariz.; Aurora, Colo.; Columbine, Colo; Newtown, Conn.; or Boston? Every moral citizen is deeply heartbroken and agonized by these tragedies, too. We wonder: Aren't we better at detecting and preventing threats?
As individuals, we are remarkable threat detectors. Without even thinking, you scan for signs of empathy in other people. If someone smiles at you, you smile back. If someone winks at you, you feel special inside. If someone looks you in the eye while you are speaking, you feel good about yourself and trust the listener. If someone shakes your hand and says "hello," you feel a physical and emotional bond.
The converse is also true. If someone has a flat affect, fails to smile, doesn't laugh at your jokes or looks stiff and mechanical, you get jittery. If this same person cannot look you in the eye, or won't greet you in passing or say "thank you," you get suspicious. If he also seems aggressive, angry or menacing, you get scared. And if he increasingly discusses guns and violence, you may feel an imminent threat. Our inborn threat detectors are outstanding at discerning trouble. We have incredibly sensitive gut feelings.
As an academic gastroenterologist, I study the science of gut feelings and recognize how the mind-body connection can empower us to act before it's too late. But I also realize that we make mistakes when trying to detect threats -- lots of mistakes. We indict on false charges, misperceive intentions and misclassify information. Whether trying to identify a future killer, prevent domestic violence or stop a shoe bomber, our intuition can lead us astray; sometimes, we need to second-guess our gut feelings.
Some criminologists say that we cannot accurately detect future killers because we make too many false accusations. They say it is too difficult to distinguish a future killer from, say, an awkward, socially uncomfortable, anti-social kid. Without the benefit of hindsight, they argue, finding the rare mass killer is like finding a needle in a haystack. In a blog post written shortly after the Newtown shooting, James Alan Fox, a leading expert on mass killers, concluded: "Any attempt to predict would produce many false positives. Actually, the telltale warning signs come into clear focus only after the deadly deed."
Not so with Shick.
When experts talk about the difficulty of pinpointing a mass killer, they usually are referring to how inaccurate any one person is at the task -- like an individual therapist sitting with a disturbed client, or a school administrator worried about a troubled student or a citizen concerned about whether an antisocial, quiet and suspicious neighbor might do something terrible. These experts are not referring to the collective accuracy of a coordinated network of people and information sources. If we are going to prevent the next Western Psych, Newtown or Columbine, we have to develop better ways to tie our threat detectors into one cohesive unit. The experts are correct that no single person can figure this out.
Consider how investigators in Boston found Dzhokhar and Tamerlan Tsarnaev. By weaving together thousands of information threads from common citizens, the FBI efficiently "crowd-sleuthed" its way to the brothers within days of the marathon bombings. This extraordinary effort demonstrates how working as a harmonized team supports rapid threat detection. But it all happened after the fact.
Is "before-the-fact" crowd-sleuthing possible? Shick's story is Exhibit A for how the process might work.
A network of finely tuned detectors surrounded Shick's most every move. If we view Shick's crowd-sleuthing network from 10,000 feet, we recognize that most all of the lines are dead ends. This is hardly a network. A network implies dynamic communication among participants, allowing information to disseminate widely and rapidly. But Shick's network does not look dynamic -- it looks static. In fact, it looks downright compartmentalized. Based on media reports and legal documents available so far, there are only three cross-connections within the network (me to the UPMC Division of Gastroenterology, Hepatology and Nutrition, from that division to UPMC risk management and from the UPMC Primary Care Clinic to the county Department of Human Services). Additional cross-connections had so much potential to drive collective intelligence. Without these connections, the network comprises a set of highly informed individuals who are collectively ignorant.
In 2012, Shick was one of 16 mass shooters in a nation of about 314 million. How can we raise our collective consciousness to find impending, yet rare, threats? How can we find someone like Shick before he strikes?
PG graphic: Diagram 3
(Click image for larger version)
(Click image for larger version)
By Dr. Spiegel's estimate, about 7,000 Americans -- young men who meet all the criteria at the center of this diagram -- are at risk of becoming the next Shick. Many people share some of these characteristics but relatively few have all of them.
In the parlance of epidemiology and test theory, the answer boils down to balancing true positives and false positives. A true positive means your gut feelings are spot on -- you've detected a real threat. A false positive occurs when our gut feelings backfire and we misjudge someone. How do we minimize these false positives? Said another way, how can we find the needle in the haystack when every piece of straw resembles a needle?
We need to start by shrinking the haystack way down. Our mission is to find a unique composite of features -- a very unique composite. We cannot call the cops on every young man who fails to make eye contact and speaks in a monotone. But if that same man (and 95 percent of mass killers are young men) also shows a complete lack of empathy and evidence of advanced psychopathy, aggression and hostility, a discordant social life and an exuberant interest in violence and firearms, then it's time to get serious. We're looking for the rare individuals who live in the middle of the Venn diagram shown on this page. How many people in the United States meet all or most of these clues? Although the epidemiologic justification is beyond the scope of this essay, there may be as few as 7,000 Americans who are simultaneously young, male, severely psychopathic, hostile, emotionless and obsessed with guns. That's about one-third of the people attending a sold-out Penguins game.
Seven thousand is not a lot. And we can do better still. Human threat detectors surround each of these men. The detectors are monitoring and gauging everything about them, including their body language, verbal language, intelligence, interests, relationships, threats, behavior and family dynamics. Did one of those 7,000 men just dye his hair red, like James Holmes before opening fire at a Batman movie premiere in Aurora? Did one of them shave his head and post a picture of a gun on My Space, like Jared Lee Loughner did before shooting U.S. Rep. Gabrielle Giffords and 18 others in Tuscon? Is one threatening to break his classmates' bones, tear off their heads or gun them down in cold blood, like Eric Harris did before Columbine? Does one have a mother who takes him to the firing range for target practice, like Newtown shooter Adam Lanza? Did one just walk into a clinic waiting room with a baseball and a psychotic mind, like Shick did days before the shooting? The haystack is smaller than some might think.
But shrinking the haystack is not enough. We need a better needle detector. Crowd-sleuthing provides the framework for a path forward. We cannot rely on any single source to detect impending violence. But searching as a team parlays the advantage of sequential testing. The idea of sequential testing is to install checkpoints along a diagnostic pathway. Using this approach, we stack one test result after another and require that every test is positive before settling on a final decision. This strongly protects against false positive overcalls.
For example, I was recently following a city bus in Los Angeles and noticed that every time it approached an intersection, the traffic light was either already green or mysteriously turned green. I initially assumed that this was a coincidence. But it kept happening. Even with erratic traffic, the lights seemed to align perfectly -- like waters were parting for the bus. After eight consecutive lights, I formed a hypothesis: this bus is causing green lights. And I was right. I subsequently learned that Los Angeles uses signal synchronization to prioritize certain buses. The point is that I couldn't make that call after only one or two lights. I subjected the bus to eight sequential tests and only then felt confident that something strange was afoot.
The same applies to finding future killers. To build a better needle detector, we need more needle detectors. One detector is not enough. Think about Shick: One Taser incident does not make for a future killer. Nor do two Taser incidents. But combine two weapon-bearing showdowns with police and relentless threats to clinic staff, students, doctors and neighbors, and it becomes clear that Shick triggered one too many traffic lights; he triggered hundreds of traffic lights. Shick was the real deal -- a true positive.
What does this all mean for detecting the next Shick? For starters, we should prioritize research that evaluates how to crowd-sleuth more efficiently and disseminate the findings to the public. For the Shick case, an efficient, integrated, crowd-sleuthing network might have positioned John Shick and his parents as a central dyad, with his parents quarterbacking the game plan while actively communicating with relevant caretakers in advocacy of their son. (Shick's parents actually were on a multiyear sea voyage on their private boat as Shick spiraled into darkness.) And there would be fewer dead ends and one-way streets. There would be free-flowing communication at all times -- early and often. Doctors might talk to one another about Shick and place a violent-behavior flag in his electronic health record (as occurs with veterans using the national system of VA hospitals). Neighbors, clinical sites and other concerned citizens might have contacted the police with information about menacing threats. College officials might have talked to one another as Shick journeyed from institution to institution.
This is not about assigning fault with any one organization or person. The entire network failed, precisely because it didn't function as a network in the first place. Careful study of other recent mass killings reveals the exact same pattern.
Is this easy? No, it isn't. But if we learned anything from the Shick case, it's that we collectively can do better. It's up to all of us. In order to avoid mass murders, we have to develop better ways to empower social networks within and among organizations (health-care systems, schools, businesses). Rather than lament that threat detection is too hard or risky, we should test better ways to find and prevent the potential mass killers in our midst. At the very least, we owe Shick's victims a fresh look at this age-old problem.
Future killers are out there now -- not many, but they're out there. They've already been detected, but detection is not enough. Let's figure out how to work with law enforcement and within our own organizations not just to detect, but also to prevent their diabolical momentum through responsible crowd-sleuthing.
