The First Thirty Minutes
The period immediately after an online threat is reported is the highest-stakes window in the response process. The actions taken in those first thirty minutes establish the information base that all subsequent decisions will rest on, and the mistakes made in that window are the hardest to correct. Slowing down to be systematic, even when pressure to act immediately is intense, produces better outcomes.
The first priority is documentation. Capture the threat exactly as it appeared: a screenshot that includes the platform, the account name, any visible metadata, the timestamp, and the full text or image. Do not paraphrase. Do not rely on a verbal description from a student. The original documentation is essential for law enforcement, for your threat assessment process, and for any subsequent review of how the incident was handled.
The second priority is containing the spread of information while you assess. Online threats travel quickly through student social networks, and speculation about what a threat means or who made it can develop faster than your assessment process can run. Asking the staff member who received the report to hold the information while you convene your threat assessment team is not suppression. It is creating the conditions under which a careful assessment is possible.
Assessing the Threat Before Responding to It
Not all online threats carry the same level of risk. Research from the Secret Service, FBI, and academic threat assessment literature consistently shows that the form and content of a threat are meaningful indicators of its risk level, and that response decisions should be calibrated to that assessment rather than applied uniformly. A school that treats every online threat as an imminent danger exhausts its community and its credibility. A school that treats all online threats as low-risk misses the genuine ones.
Structured threat assessment asks a specific set of questions: Is there evidence of planning? Does the person of concern have access to means? Is there a history of concerning behavior? What is the context in which this statement was made? These questions do not have obvious answers available in the first thirty minutes, but they frame the information-gathering process that should begin immediately and produce an evidence-based risk picture within hours.
Involve your threat assessment team, which should include at minimum an administrator, a counselor or psychologist, and a law enforcement liaison. Do not make the assessment a solo administrative decision. The team structure exists precisely because high-stakes judgments under time pressure benefit from multiple perspectives and distributed responsibility. If your school does not have a functioning threat assessment team, that is the most important gap this incident has revealed.
The Law Enforcement Conversation
Law enforcement should be notified of credible online threats. The threshold for that notification, and what it means practically, is something schools benefit from working out with their local partners before an incident occurs rather than negotiating it in real time. If your school resource officer or local liaison has a pre-established relationship with your threat assessment team, that notification is a phone call. If no prior relationship exists, establishing one is significantly harder under pressure.
When you contact law enforcement, provide the documentation you have gathered, share your preliminary threat assessment information, and be specific about what you are asking for. Are you seeking a threat assessment consultation? A welfare check on the person of concern? Active investigation of the account that posted the threat? Law enforcement has different capabilities and authorities than schools, and clarity about what you need produces more useful assistance than a general notification that a threat was received.
Law enforcement will make their own independent assessment and may take actions that differ from your school's response plan. Understanding that your response and their response are parallel processes that need coordination rather than a single unified action helps prevent the confusion that often arises at this stage. Designate a single point of contact on the school side and ask for a counterpart on the law enforcement side.
Communicating With Your Community
Communication with parents and the broader school community is one of the most consequential decisions in an online threat response, and it is frequently handled poorly in both directions. Schools that communicate nothing allow rumor to fill the vacuum, often producing more anxiety and more disruption than the original threat. Schools that communicate before they have completed an assessment often amplify concern or share information that later proves inaccurate.
The appropriate timing for community communication is after your threat assessment team has completed a preliminary review and law enforcement has been contacted, not before. The content of that communication should tell parents what happened in general terms, what the school has done in response, what measures are in place for the coming school day, and where they can direct questions. It should not include speculative information about who made the threat or what their motive may have been.
After the immediate incident is resolved, most online threats reveal something worth examining: a gap in your threat assessment process, a student in distress who needed earlier intervention, a platform or behavior pattern you had not previously encountered. Building a brief post-incident review into your standard protocol converts every incident into an improvement opportunity and builds the institutional knowledge that makes future responses more effective.