This DAP highlights – Neo-Nazis in Ohio and faith-based organizations targeted by multiple ransomware gangs. DAP also has More Faith-Based Stories and Select All-Hazard Stories. These updates are shared to help raise the situational awareness of Faith-Based organizations to best defend against and mitigate the impacts from all-hazards threats including physical security, cybersecurity, and natural disasters.
Faith-Based Organizations Continue to Be Targets of Hostile Events
Mass Shooting at the Covenant School
By Sadie-Anne Jones, Gate 15 Analyst
Faith-Based Organizations continue to be targets for violence and hostile events. By far, the most prevalent of these hostile events have been in the form of violence and low-tech terrorism such as fall-out from protests and the repercussions of the June 2022 ruling in the Dobbs v. Jackson Women’s Health Organization Supreme Court case, commonly known as the Dobbs ruling. There have been seven notable attacks in the past five years – the mass shooting at the Covenant School marks the eighth notable attack. A mass shooting is defined as three or more killings in a single incident.
On 05 April, the Faith-Based Information Sharing and Analysis Organization published a case study on the hostile event at the Covenant School that resulted in the deaths of six individuals. The TLP:AMBER case study was distributed to members using our report distribution platform. The case study evaluates the threat actor’s actions against the Hostile Events Attack Cycle (HEAC) and calls out additional suspicious indicators that could be used to help organizations train employees on identifying suspicious activities leading up to a hostile event that could disrupt their planning. The HEAC is a 7-step process that threat actors go through, consciously, or not, in planning and executing an attack. It begins with Initial Target Considerations and goes through the attack and sometimes the escape. For more details about the HEAC, please reference Gate 15 White Paper on The Hostile Event Attack Cycle (HEAC), 2021 Update.
What follows below is a summary of the mass shooting incident and some observations from the attack itself.
On the morning of 27 March, three adults and three children were killed by a threat actor at Covenant School, a private Christian elementary school near Nashville, Tennessee. Covenant teaches students in pre-K through 6th grade and only has about 200 students enrolled.
The attack started around 10:11am with the first call to authorities happening around 10:13am. Video footage from the school shows the shooter roaming from room to room carrying multiple firearms. According to investigators, “the shooter was armed with two AR-style guns — a rifle and a pistol — as well as a handgun.” The incident came to an end around 10:27am after police arrived at the scene. Police were able to neutralize the shooter.
The Shooter was identified as 28-year-old Audrey Hale who was initially identified as female, but authorities later explained that Audrey Hale went by he/him pronouns. Hale had previously attended Covenant School as a child. The Metropolitan Nashville Police Chief John Drake stated that the three firearms used by Hale in the attack were part of a collection of seven “Hale had legally purchased in recent years from five Nashville-area stores.” Nashville Metro police also stated that Hale had “plans to target two other schools in the area but abandoned them due to their high level of security.” A search of Hale’s possessions uncovered detailed maps of the building, a list of other possible attack locations, as well as a “manifesto.” The Metropolitan Government of Nashville & Davidson County website shared that the Homicide Unit in consultation with the FBI’s Behavioral Analysis Unit are currently investigating the writings left by Hale as well as determining the motive for the attack.
There were at least two known indicators that Hale was capable of violence before the attack took place:
- At 9:57 am the morning of the incident, a basketball teammate of Hale’s from middle school received a message over Instagram from Hale reading, “I’m planning to die today. THIS IS NOT A JOKE! You’ll probably hear about me on the news after I die.” Concerned by the message, the recipient, Averianna Patton, contacted authorities, but by the time an officer arrived in person to take Patton’s statement at 3:29 pm, the shooting had long been over.
- It was also shared by Hale’s parents that they believed Hale “should not have owned any weapons due to mental health concerns.” However, as noted by one source, “under Tennessee law, mental illness is not grounds for police to confiscate weapons, unless a person is deemed mentally incompetent by a court, ‘judicially committed’ to a mental institution, or placed under a conservatorship ‘by reason of mental defect.’” Therefore, it is unlikely that this information would have prevented the shooting from occurring.
Hale’s identity is a rare one in mass shooting cases for a couple reasons. First, very few mass shooters have been assigned female at birth as Hale was – the overwhelming majority of mass shooters being cis-gender men. In fact, according to the Violence Project – a non-partisan research group which tracks data on mass shootings in the US from the 1960s to present day – there are only four others who fall into this category. Secondly, Hale is one of only two mass shooters who is trans or gender nonconforming. Unfortunately, while Hale’s identity is an exception to the norm among mass shooters, as one article notes, this will likely not stop those who wish to seize “on Hale’s trans identity to forward culture war objectives.”
The tragedy at Covenant School has spurred other schools to assess their own security protocols and trainings. The church overseeing Franklin Classical School will be holding “a review of security protocols and already had training planned for the week after Easter.” The principal of Standifer Gap Seventh-day Adventist School in Chattanooga TN urged others to “know your people around you, know who could be a possible threat and don’t ignore any threats that you might see online. Teach kids to report what they hear.” This advice aligns with that of an FBI report on school shooters stating, “nonviolent people do not ‘snap’ or decide on the spur of the moment to meet a problem by using violence. Instead, the path toward violence is an evolutionary one, with signposts along the way.” Therefore, it is important to be vigilant of the signs and prepare before an incident occurs.
Security protocols for schools like Covenant vary. One source notes a comment from the department of Education stating, “private schools generally do not face as many requirements as public schools for developing security plans. In Tennessee, laws requiring schools to develop and submit safety plans do not apply to private schools.” Even so, many private schools have well maintained security protocols and Covenant School was one of them. City police spokesperson Brooke Reese stated that, “most U.S. school systems conduct active-shooter and lockdown trainings, and the Nashville school had in fact undergone active-shooter training in 2022, which prevented further loss of life during [the Covenant School] shooting.” However, as the head of Brainerd Baptist School in Chattanooga TN noted, “the Covenant School shooting exposed how deadly such attacks can be even when school leaders ‘did everything right.’”
These events are true tragedies, and it will be critical that organizations, especially Faith-Based Organizations that may own or operate schools or child-care facilities, review the investigations, and make appropriate updates.
Some immediate considerations include:
- It will be important to review and assess security plans as soon as possible and be vigilant for potential copy-cats or inspired threat actors who may seek to strike leveraging some of the tactics revealed.
- Conduct a security walk through and assess all perimeter access points. If you have perimeter fencing, consider if is adequate to meaningfully impede an intruder.
- Talk to your staff and ensure they know how to identify and report suspicious incidents.
- Review various security scenarios and ensure employees, or individuals working and in and around your organization, know how to respond. Some potential scenarios could include:
- Harassment phone calls or emails.
- Vandalism.
- Confrontations or threatening actions.
- Unattended bags or suspicious packages.