What a month of foiled plots tells us about “leakage,” tips and the readiness to act on them

A phone lights up in Aurora

Nobody knows exactly where this person was standing when the message came in. Picture a kitchen in Aurora, Illinois, a phone buzzing on the counter, and a name on the screen that usually means nothing heavier than a question about the next shift. It is October, the season of Navratri, when the Hindu community gathers for music, dancing and prayer. According to police, the sender had driven to a Hindu temple earlier that day with an AR-style rifle, and the rifle jammed. He stayed about 13 minutes and then drove away. Now he was writing to say he would try again once the gun was fixed.[1]

The person holding that phone was not a detective or an analyst. Just a coworker, someone who happened to share a workplace with a 19-year-old. We can only imagine the questions that ran through that coworker’s mind in the next few seconds. Is he serious? Is this some kind of sick joke? Do I really call the cops on a guy I work with?

The coworker called anyway. Police arrested the suspect that same evening, and investigators say they later recovered more weapons, ammunition, Nazi imagery and a manifesto.[2] A jammed rifle bought that community some time, and one phone call made sure the time was not wasted.

The pattern behind the call

Threat assessment professionals have a word for what happened on that counter. J. Reid Meloy and Mary Ellen O’Toole called it “leakage,” which they defined as the communication to a third party of an intent to do harm to a target.[3] The idea has been part of the field’s literature for well over a decade. This past month put it on display in case after case, and each one followed the same arc. The person planning harm talked, someone nearby listened, and then that someone had to decide whether to pick up the phone.

In Texas, court documents say a man told another person he planned to go to the State Capitol and “shoot it up.” That tip came in on a Tuesday evening, and by about 3 a.m. SWAT officers had him in custody.[4] He also faces a federal charge for possessing a firearm with an obliterated serial number, a detail that should catch the eye of every crime gun intelligence unit in the country.[5]

In Quincy, Illinois, the warning came from a total stranger. Picture a restaurant with plates clattering and coffee going cold, while a man at a nearby table talks a little too loudly about envelopes he says he mailed to members of Congress, envelopes that held suspicious substances. Someone overheard him and called the FBI without leaving a name.[6] That call may well have opened the way so many good tips open: “I don’t know if this is anything, but…” It was something. Agents interviewed the man at his home, and authorities say he confessed.

The call from inside the building

Not every warning arrives as a text or an overheard conversation. At OpenAI, the company found a recording device hidden inside a television in an executive conference room, the same screen leaders sit in front of when they talk through their most sensitive plans.[7] Prosecutors say the engineer charged in the case had no authority to enter that room, yet people saw him near it again and again. He also allegedly used an AI productivity agent to research meeting rooms, calendars and partner venues.[8]

The company did not wait for a perfect case before it acted. It restricted his access, placed him on leave, investigated internally and brought in the FBI, which arrested him on October 9.[9] A physical check found the device, employees noticed behavior that did not fit, and digital records filled in the rest. None of that would have mattered without an organization willing to make the referral.

The call before the bell

Schools produced the tightest timelines of the month. In Pierce County, Washington, a parent reported a threat on social media minutes before the school day began, and deputies found the student had a firearm when his bus arrived.[10] In Canton, Georgia, the FBI flagged threatening posts to school police, and three people now face charges of conspiracy to commit murder.[11]

Clay High in Florida offers a caution every tip line supervisor should keep in mind. A student reported a threat written on a bathroom wall, and investigators later figured out that the same student had written it.[12] Every tip deserves to be taken seriously, and so does a hard look at the person who submitted it.

Who answers the phone

Leakage is the warning sign. People who plan violence usually tell someone, whether that is a coworker, a friend, or a table full of strangers. The work begins with making sure the person who hears it knows what to do next.

Speed gets built before the tip arrives. A tip at dinnertime and a SWAT arrest by 3 a.m. does not happen by accident. Call it “the 3 a.m. test.” Who picks up the tip line at 9 p.m. on a Tuesday? Who decides whether the information is credible? Who has the authority to move on it before sunrise? If those answers live in one person’s head, that is a capability gap worth closing now.

Some saves come down to luck. Had that rifle in Aurora worked, this would be a vastly different article. No agency should build its safety plan around a jammed gun.

Make the call easy. The coworker, the parent and the diner were not trained analysts. They were ordinary folks who felt something was wrong. They needed to know where to send it, to believe someone would take it seriously, and to trust that it would not blow back on them.

Verify the messenger. Clay High is the reminder that the person waving the red flag is sometimes the one who planted it.

The front door

VIGILITI exists for moments like the one that coworker faced. Most warning signs are not ignored because nobody noticed. They slip away because what someone noticed felt too vague, too small, or too awkward to put into words, and the person carrying it had no clear place to take it.

VIGILITI is a patented, multilingual intake platform for suspicious activity reports, tips, leads, insider threat concerns, and whistleblower complaints, serving public safety agencies and enterprises alike.[13] It works as the “front door” of investigation and analysis. A report that arrives as a half-formed worry leaves as structured, review-ready information, so the analyst on the other end starts with something to work rather than something to chase. That matters when the clock is running toward 3 a.m.

The same door serves the conference room as well as the kitchen counter. Organizations get one consistent channel for insider threat and whistleblower reporting, hosted in a secure GovCloud environment, and agencies can connect it to the case management, CAD and RMS systems their people already use.[13] None of this replaces the investigator’s judgment. Our aim is to sharpen it, by putting a better report in front of the right person sooner.

Back to the phone on the counter

Public safety exists to bring justice to victims, resolution for their families, and peace to affected communities. The cases this month point to something better still, which is no victims at all. Every one of those saves started with an ordinary person who felt a knot in the stomach and spoke up.

Somewhere tonight, another phone is going to light up on another counter. If the person holding it reads that message, will they know where to send it?

And when they do, will anyone be ready to answer?

The cases referenced involve pending charges. Every person charged is presumed innocent unless and until proven guilty in a court of law.

Sources

1. AP via Atlanta News First, Aurora coworker tip
2. Gulf News / AP, Aurora temple plot
3. Meloy, J. R., and O’Toole, M. E. (2011). The concept of leakage in threat assessment. Behavioral Sciences and the Law, 29(4), 513-527
4. KTAR / AP, Texas Capitol arrest
5. CBS News, Texas Capitol complaint
6. WTTW, Quincy letters
7. NBC News, OpenAI arrest
8. Nextgov, OpenAI insider threat
9. ASIS Security Management, OpenAI case
10. Courier-Herald, Pierce County student arrest
11. ABC News, Canton, Georgia plot
12. BNO News, Clay High
13. Carahsoft, VIGILITI overview