Case Study · Terrorism Preparedness · 2018
February 14, 2018. Seventeen people killed at Marjory Stoneman Douglas High School in Parkland, Florida. Dozens of calls to the Broward County Sheriff's Office. Two FBI tips. A 13-minute tip call on January 5 — 40 days before the shooting — that described Cruz's gun collection, social media posts expressing the desire to kill, and the caller's specific fear that he would "get into a school and just shoot the place up." The FBI closed the case without forwarding it to the local field office. Warning sign systems only protect communities when they actually act on the warnings they receive.
Parkland, Florida · February 14, 2018
Nikolas Cruz was not an unknown to the people around him. The KPBS account of the Parkland shooting documents the scope of what was known: Cruz "was the subject of dozens of 911 calls and at least two separate tips to the FBI. He also came to the attention of the Florida Department of Children and Families." In November 2017 — three months before the shooting — the Broward County Sheriff's Office received a call describing Cruz collecting guns and knives and the fear that he "could be a school shooter in the making." The school he had been expelled from knew his history. Students and teachers described him as the person they had long expected to do exactly what he did: "I think everyone had in their minds if anybody was going to do it, it was going to be him."
The most specific warning came 40 days before the shooting. On January 5, 2018, a woman who knew Cruz called the FBI's tip line. The NYT account of the call, obtained from the transcript, documents what she said over 13 minutes: Cruz had a growing collection of guns purchased with life insurance money after his adoptive mother's death. His Instagram accounts showed photos of sliced-up animals and the firearms he had amassed. He had posted online that "he wants to kill people." And the caller's own assessment was direct: "I know he's going to explode." She was worried he was "getting into a school and just shooting the place up." The Fox News account of the Congressional briefing adds the specific institutional failure: the FBI call taker connected Cruz's name to a prior tip from September 2017 — a YouTube comment by user "nikolas cruz" that read "I'm going to be a professional school shooter." The call taker and supervisor knew both tips existed and were related. They decided not to pursue. The case was closed. The tip was not forwarded to the local FBI field office in Miami, which was positioned to investigate.
The FBI subsequently acknowledged what the evidence showed. FBI Director Wray admitted the failures. FBI Deputy Director Bowdich told Congress that proper "protocols were not followed" and that despite knowing the two warnings were related, the case was closed without action. The FBI acknowledged it "could have prevented" the shooting. Seventeen people were killed on Valentine's Day. Seventeen more were wounded. The students who survived became the most prominent youth activists for gun safety policy in a generation. And the institutional lesson — that warning signs only protect communities when there is a system designed to act on them, not merely receive them — was documented clearly enough that it drove both federal legislation and the expansion of threat assessment programs nationwide.
Feb 14, 2018
Valentine's Day
17 killed
17 Wounded
40 days
After 13-Min FBI Call
Case closed
Without Forwarding
36+ calls
To Sheriff Over 6 Years
The Preparedness Framework
Think of a warning sign system as having two essential components: the input (people reporting concerns) and the receptor (the institution or team that receives the report and does something with it). Parkland had the input: dozens of calls, multiple FBI tips, DCF involvement, school expulsion, teachers and classmates who all said "we knew it was going to be him." What failed was the receptor. The FBI national tip line received two specific, detailed warnings about Cruz — connected them — and a supervisor closed the case without forwarding to local investigators who could act on it. The Broward County Sheriff's Office received 36+ calls over six years about Cruz's behavior — the pattern was never aggregated and assessed as a whole. The DCF involvement concluded he was "not a risk to harm himself or others" based on an assessment that didn't include the full picture. Every receptor in the system received a piece of the picture. None assembled the complete image.
The specific failure of the FBI tip line in the Parkland case was not that the individual call takers were incompetent — the January 5 call taker correctly connected Cruz to the prior tip. The failure was structural: a national call center is designed to receive, route, and triage information, not to investigate or intervene. The call went to a call center. A call center supervisor made a routing decision. The routing decision was wrong. A Behavioral Threat Assessment Team would have operated differently: it would have pulled the existing picture from multiple sources (Broward County Sheriff calls, school records, social media information), evaluated the complete behavioral portrait, and initiated a targeted intervention — a welfare check, a conversation, a mental health referral, a recommendation for legal action. The BTAT is an active assessment function; a tip line is a passive intake function. Parkland demonstrates why communities need the former, not just the latter.
The Parkland case documents what happens when a concern is reported to a single channel that fails. A concern reported through multiple channels simultaneously — to the school, to local law enforcement, to the FBI, to a threat assessment team — is more likely to reach a channel that will act on it. The FBI's own guidance after Parkland updated its tip-forwarding protocols: tips that meet specific thresholds must now be forwarded to local field offices. States passed laws mandating threat assessment teams. But the community preparedness lesson is simpler: if you have a concern about a specific person's potential for violence, report it to every relevant channel simultaneously — don't assume one report to one tip line will be sufficient. Document what you reported, to whom, and when. Follow up if you don't receive acknowledgment.
Timeline
01
Six years: 36+ calls to Broward County Sheriff's Office about Cruz's behavior. Late 2016: Florida DCF involved after Cruz cuts himself, posts images to Snapchat. DCF report: "not a risk to harm himself or others." November 2017: Broward County Sheriff receives call — Cruz collecting guns and knives; caller feared he "could be a school shooter in the making." September 2017: FBI tip — YouTube comment by "nikolas cruz": "I'm going to be a professional school shooter." FBI reviews tip; says no identity confirmation possible; case handled. November 2017: Cruz's adoptive mother dies of pneumonia; Cruz moves in with friend's family.
02
January 5, 2018: Woman who knows Cruz calls FBI tip line. 13-minute call. She describes: Cruz's gun collection purchased with life insurance money; his Instagram posts showing sliced-up animals and firearms; his online statement that "he wants to kill people"; her fear he is "getting into a school and just shooting the place up." Her assessment: "I know he's going to explode." FBI call taker connects Cruz to September 2017 YouTube comment — knows both tips are related. Call taker and supervisor decide not to pursue. Case closed. Tip NOT forwarded to Miami field office. "Proper protocols were not followed." (FBI Deputy Director Bowdich to Congress.)
03
Valentine's Day. Nikolas Cruz, 19, former student, arrives at Marjory Stoneman Douglas High School. 17 students and staff killed. 17 wounded. Cruz in custody. Pleads guilty; sentenced to life in prison. School resource officer Scott Peterson, assigned to the school, does not enter the building during the shooting; later charged with child neglect and other counts. Peterson found not guilty in 2023 trial. FBI Director Wray acknowledges failures. FBI admits it "could have prevented" the attack. Congress briefed on specific failures.
04
2018: Florida's Marjory Stoneman Douglas High School Public Safety Act — background check expansions, age restriction for certain rifles, guardian program, required threat assessment teams in all Florida schools. 2018: STOP School Violence Act — federal funding for school security improvements, training, threat assessment. FBI updates tip-forwarding protocols. Thousands of MSD student activists form March for Our Lives; drive national policy debate. CISA expands threat assessment resources. ALERRT and other training organizations scale civilian and institutional threat assessment training. Threat assessment team adoption accelerates nationally.
Human Decisions
The system failures
The FBI national tip line is designed as an intake system: receive information, assess urgency, route to appropriate channels. It is not designed as an investigation or intervention system. The specific failure at Parkland was a routing failure: a tip that met the threshold for forwarding to a local field office was not forwarded. The call taker made the connection between two tips correctly; the supervisor made the wrong routing decision. This is a structural problem, not just a personnel failure — a call center with thousands of daily tips, operating under triage protocols, is not equivalent to a threat assessment team with access to contextual information and the mandate to investigate. The lesson: communities should not rely on national tip lines as their primary threat assessment resource. Local Behavioral Threat Assessment Teams — which have access to behavioral context, can conduct interviews, and have relationships with local institutions — are more capable receptors for the specific kind of threat that Cruz represented.
The Parkland case documents a phenomenon that appears in many targeted violence reviews: widespread community awareness that was never converted to institutional action. Cruz's classmates, teachers, and neighbors all had a sense of him as dangerous. Students described him in terms that suggested they would not have been surprised if he committed an act of violence. This ambient community knowledge — the informal collective assessment of a specific person as dangerous — is valuable information that rarely has a formal channel. Institutionalizing the collection and assessment of that informal knowledge is what threat assessment teams do: they provide a channel for the "everyone knew" knowledge to be formally evaluated. The key preparedness action for community members is knowing the reporting channels — the specific phone numbers, emails, and forms — for their school's threat assessment team, their local law enforcement, and their state's tip line.
The broader pattern
The Secret Service's National Threat Assessment Center (NTAC) has studied targeted school violence for over 25 years. Its findings document that most perpetrators of school violence: were known to others as troubled; communicated their intent to harm to at least one person; had experienced a recent significant loss or stressor; and showed behavioral changes before the attack. The warning signs are behavioral, not diagnostic — they don't require mental health credentials to recognize. The NTAC model emphasizes that targeted violence is not impulsive; it is typically planned, and the planning process leaves behavioral evidence. What Parkland adds: even when those behavioral signs are recognized and reported, the institutional processing of that report must function correctly for the report to be protective.
The MSD students who survived the February 14 attack became the most prominent youth advocacy movement for gun safety policy in decades. Within weeks, hundreds of thousands attended the March for Our Lives events. Their activism directly influenced state legislation in Florida and contributed to national conversations about background check expansion, red flag laws, and school safety funding. The Florida Marjory Stoneman Douglas High School Public Safety Act was passed within weeks of the shooting — requiring background check expansions and mandatory threat assessment teams in Florida schools. The STOP School Violence Act provided $75 million in federal funding for school safety. These legislative outcomes were the direct product of the students' advocacy, and they represent the community response dimension of preparedness: communities that demand institutional change after preventable events are the ones that create systems that reduce the probability of the next one.
The cascade lesson
Parkland is the case study for the gap between "warning signs were seen" and "warning signs were acted on." The January 5 call is one of the most specific and actionable threat tips in the documented history of school violence prevention: it described a named individual, his specific weapons, his online statements, and a direct prediction of a school shooting. It was received. It was connected to a prior tip. And it was closed. The lesson is not that people shouldn't report — reporting is the essential first step, and the January 5 caller did everything right. The lesson is that reporting to a single channel is not sufficient, that national tip lines have structural limitations that local threat assessment teams don't, and that communities that demand and support functioning threat assessment infrastructure in their schools and workplaces are communities where the January 5 caller's warning would have been acted on.
What You Can Do Now
The Parkland lesson is about what happens between "I'm worried about this person" and institutional action. These five actions close the gap between seeing a warning sign and ensuring the right system is positioned to act on it.
The January 5 Parkland caller did everything right — she was specific, persistent, and accurate. The system failed her, not the other way around. The lesson for anyone with a genuine concern about a specific person's potential for violence: report to multiple channels simultaneously. For a student or school employee: report to the school's threat assessment team AND local law enforcement AND, if the concern is serious, to the FBI's local field office. The national FBI tip line (1-800-CALL-FBI) is a call center; the local field office is an investigative office. Both are valuable; local is more actionable for local threats. Document every report with date, time, recipient, and a summary of what you said.
Threat reporting channels and guideThe Secret Service's National Threat Assessment Center documents the warning signs most consistently associated with targeted school violence: directly or indirectly communicating intent to harm (to anyone, in any medium); experiencing a recent significant loss, rejection, or humiliation; expressing feelings of extreme grievance, persecution, or hopelessness; increasing social withdrawal combined with fascination with weapons or violence; and behavioral changes that others notice and mention. You do not need to diagnose or be certain — report a genuine concern and let threat assessment professionals evaluate it. The Parkland case specifically documents: the people around Cruz knew, consistently and clearly, that something was very wrong. Their informal assessment was right. The institutional channels to receive and act on it were not working.
Behavioral warning signs guideFlorida's Marjory Stoneman Douglas High School Public Safety Act, passed weeks after Parkland, required threat assessment teams in all Florida schools. Many states have since passed similar requirements. But many schools, workplaces, and institutions still do not have formal threat assessment infrastructure. Asking your school principal or HR director two simple questions — "Does this institution have a threat assessment team?" and "How do I report a concern?" — tells you whether the institutional receptor exists and positions you to use it when you need it.
School and workplace threat assessment guideThe Parkland case documents a tip that was filed and then closed without action — and the person who filed it had no way of knowing that. If you report a genuine concern about potential violence and don't receive acknowledgment within 24–48 hours, follow up. Call back. Email the school administrator or law enforcement contact directly. Ask whether your report was received and whether it is being evaluated. You are not obligated to manage the institutional response — but you are in a position to notice if your report has fallen into a process gap. The January 5 caller was told the FBI would follow up; it didn't. Following up is the individual action that addresses the passive receipt problem.
Threat report follow-up guideThe threat assessment research is consistent: many perpetrators of targeted violence had significant, untreated mental health needs that — if addressed earlier and more effectively — could have interrupted the path toward violence. Cruz had documented mental health history; the interventions he received were insufficient to address his actual risk level. Funding and supporting community mental health services, school counselors, crisis intervention teams, and mental health first aid training (Mental Health First Aid USA, MHFA, offers 8-hour training) is both a mental health equity issue and a violence prevention issue. Communities with robust early mental health intervention infrastructure are communities where people on a path toward violence are more likely to be identified and helped before they act.
Community mental health and violence preventionTerrorism preparedness case study series
Columbine 1999 covers the law enforcement doctrine that changed after 44 minutes. Virginia Tech 2007 covers warning signs not connected across systems. Sandy Hook 2012 covers physical facility security and lockdown. Las Vegas 2017 covers outdoor event preparedness.
Full terrorism preparedness case study seriesSources