The Threat Assessment That Doesn't Fit the Playbook
At 8:40 on a Thursday night before a three-day weekend, a teacher forwards you a screenshot: a 15-year-old student posted a photo of a rifle with the caption 'don't come Monday.' By 9:15 the image is circulating among students, and two parents have emailed asking whether school will be open. The student has no discipline history, has an IEP for an emotional disability, and lost a parent in September. The school resource officer wants an immediate 10-day suspension, a police report, and an expulsion recommendation; your district's threat assessment protocol requires a team within 24 hours and prohibits exclusion beyond 10 days without a manifestation determination. A rumor says the student has a 'list,' but no one has seen one. The photo may have been taken on a relative's hunting trip; the student's mother answers the phone and insists the rifle is locked and the post was 'a joke.' Your superintendent is unavailable until morning.
1. What do you do in the next 12 hours? Identify your first actions, who must be involved, and what you must not do on the officer's timetable alone.
Read the worked answer
Treat the first 12 hours as evidence preservation and risk reduction, not discipline. Verify the post, preserve screenshots with timestamps, and identify who has seen it. Notify the superintendent's designee and district security immediately; do not wait until morning. Contact the mother to confirm the weapon's location and ask for voluntary cooperation; if she cannot confirm secure storage, involve law enforcement without delay. Convene the threat assessment team by phone that night or first thing Friday, including an administrator, counselor, school resource officer, and special educator. The team's first job is to determine whether school can open safely and whether the student should be on campus Monday.
Do not impose a 10-day suspension on the officer's timetable alone. Under the district protocol, the team gathers information and assigns a level; under IDEA, a change of placement beyond 10 days requires a manifestation determination, and an interim alternative setting is available only in specified circumstances, not automatically for an online photo. If there is an imminent threat, use the narrowest emergency removal the policy allows and document why. If not, a safety plan with supervision, no access to weapons, and check-ins may be more appropriate than exclusion. Assign one person to communicate with the family, one to manage the investigation, and one to prepare Monday. Keep a timeline log. The most common failure is a fast suspension that feels decisive but leaves the threat assessment undone.
2. How should the threat assessment team weigh the online post, the rumor of a list, the IEP, and the mother's explanation? What outcome options are defensible?
Read the worked answer
Use the protocol as designed, but do not let it become a paper exercise. The team needs specific information: the authenticity and origin of the photo, the timing and audience of the post, whether any list exists, the student's access to firearms, recent losses and stressors, peer reports, and any prior threats. Interview the student with a parent present or promptly notified, and coordinate with law enforcement so the school does not compromise a criminal inquiry. Separate transient statements such as ventilation, humor, or bravado from substantive threats with planning, access, and intent. The IEP is relevant but is neither a shield nor an excuse: the team must consider the disability's role in the behavior, and the district special education director must be at the table before any placement change.
If the assessment finds a substantive threat, the response can include an interim alternative educational setting, a reentry plan, counseling, and a safety agreement with the family. If it finds a transient threat, document the reasoning and provide supports. In either case, do not return the student to the same unstructured settings without a plan, and reassess before any return. The danger of overreacting is real: a student with a disability can be pushed out for a post that was dark humor. But the danger of underreacting is greater when a firearm is in the picture. Make the decision as a team, in writing, with the evidence you had at the time.
3. Draft the communication approach for staff, families, and the community over the weekend and Monday. What can you say with incomplete information, and what must you avoid?
Read the worked answer
Communicate on a need-to-know schedule with one voice. Before Monday, send staff a factual briefing: what is known, what is being done, what not to share, and whom to contact. Do not disclose the student's identity, disability, or discipline. Tell staff that the threat assessment is active and that a safety plan is in place; give them a specific person to report new information to. For families, send a short message Friday or over the weekend: the school is aware of a social media post, is working with law enforcement and the district, and will open Monday with additional supervision if the assessment supports it. Avoid saying there is no threat unless the team has actually concluded that; false reassurance destroys trust if the story changes.
Prepare a Monday morning plan: visible adults, a script for teachers, a counseling space, and a rumor-control message. Anticipate media calls and route them to the district office. If the assessment is incomplete by Sunday, say so and give the next update time. After the event, send a follow-up that explains the process in general terms and the reporting channels, without revisiting confidential details. The test is whether families believe the school will tell them what it can, when it can, and will not minimize what it does not yet know.