Before the Night in Moscow: Foreseeability vs. Predictability Through a BTAM Lens and Application of the SHIELD Rapid TriageTM Protocol

Introduction

The homicides of four University of Idaho students in Moscow, Idaho, shook the public not only because of their brutality, but because they reignited a recurring, and often misunderstood, question after targeted violence: Could this have been prevented? That question tends to trigger a search for certainty, who “should have known,” what warning sign “proved” intent, and why no one “predicted” the outcome. Behavioral Threat Assessment and Management (BTAM) offers a different, more operationally useful frame. BTAM is not built to predict the future with confidence, but rather, it is built to recognize when risk becomes reasonably foreseeable based on behavior, context, and trajectory, and to intervene in a way that is proportionate, defensible, and prevention-focused.

This article examines the Idaho murders through a BTAM lens to clarify an essential distinction: predictability vs. foreseeability. Predictability asks whether someone could have forecast, with meaningful accuracy, that a specific individual would commit a specific act at a specific time. In rare cases, predictability increases when there is high specificity (e.g., explicit threats, identifiable targets, overt planning). However, predictability typically remains low because human behavior is dynamic and targeted violence is a low–base rate event. Foreseeability is the more relevant standard for BTAM and for legal consideration. It asks whether, given what was known or reasonably knowable at the time, a serious harmful outcome was a plausible feared outcome that warranted structured attention and proportionate controls, even absent certainty that an attack would occur (OSHA, n.d.).

The goal here is not to litigate guilt, sensationalize tragedy, or claim perfect hindsight. It is to demonstrate how BTAM translates observable information into defensible prevention steps: identifying potential drivers and stressors, evaluating escalation and “pathway” indicators, assessing access and opportunity, and implementing interventions that reduce vulnerability while additional information is gathered. When the public asks, “Why didn’t anyone see this coming?” the BTAM-informed answer is rarely, “They should have predicted it.” The more accurate and more useful question is: Were there indicators that made severe harm foreseeable, and were there practical points of intervention that could have disrupted the trajectory? 

By anchoring the discussion in foreseeability rather than prediction, the analysis also clarifies what organizations, schools, and communities can reasonably be expected to do, what “reasonable steps” look like, and how BTAM strengthens both prevention and defensibility when the stakes are high.

A critical note at the outset: I neither have, nor had, any direct involvement in this case, no access to non-public information, and no role in any investigative, prosecutorial, defense, or university response efforts. This is an analytic piece intended to use a widely known incident as a learning example. The Idaho murders are a valuable case study precisely because they have drawn sustained public attention and professional debate around foreseeability, predictability, and preventability, and because they illustrate how easily the discussion can become anchored to “prediction” rather than structured prevention.

Contextual Case Overview

In the early morning of November 13, 2022, four University of Idaho students, Madison Mogen, Kaylee Goncalves, Xana Kernodle, and Ethan Chapin, were found murdered in an off campus home near the university in Moscow, Idaho, launching an intense multi agency investigation that drew sustained national attention. Investigators publicly released limited details early on, while quietly building a case. According to subsequent court filings and reporting, the case focused on a constellation of behavioral and forensic indicators rather than a single, causal factor. The publicly known investigative narrative includes a knife sheath recovered at the scene that was later linked to Kohberger through DNA testing, along with analysis of surveillance and video associated with a white Hyundai Elantra, and cellular records used to examine movement patterns and potential proximity to the area.

On December 30, 2022, authorities arrested Bryan Kohberger, then a criminology PhD student at nearby Washington State University, and he was charged with four counts of first degree murder and one count of felony burglary. The case proceeded through extensive pretrial litigation and high media scrutiny, with court records and timelines widely covered as the matter moved toward adjudication.

For purposes of this article, this overview provides the minimum context needed to analyze the event through a BTAM frame, a high impact targeted violence incident, a complex investigation built from multiple information streams, and a case that, because of its visibility, has become a reference point in ongoing discussions about what was predictable versus what may have been foreseeable and therefore potentially interruptible with the right structures and information pathways.

A Storm Warning

This section synthesizes reported and alleged pre-incident behaviors attributed to Kohberger as described in released investigative documents and subsequent media reporting. These accounts largely reflect witness perceptions, interview summaries, and investigative notes, not adjudicated findings about pre-attack conduct. The purpose is contextual, to illustrate how BTAM practitioners separate low-specificity “concern” information from higher-specificity indicators of boundary testing, fixation, approach, and trajectory.

Interpersonal Relations and Engagement with Women at Washington State University

In the months before the homicides, multiple graduate students and faculty reportedly described Kohberger as condescending, conflict-seeking, and particularly disparaging toward women. Witnesses described him as argumentative in class and prone to prolonged verbal sparring with professors, often attempting to position himself as the most dominant or important person in the room. (Boone, 2025; Gainor, 2025) Peers also described repeated “intense staring” that they interpreted as a dominance behavior, and a pattern of positioning himself near women in ways that made them uncomfortable. Several accounts characterized his presence as persistently unsettling rather than simply socially awkward. (Gainor, 2025) 

Boundary Intrusions and Controlling Behaviors

In multiple accounts, the most concerning features were not isolated comments but repeated boundary intrusions in ordinary campus settings. A faculty member reportedly told investigators that Kohberger would enter an office where female graduate students worked and physically block the doorway, prompting her to intervene after hearing a student express she “needed to get out.” (Boone, 2025) Other reports described him trailing peers after class, blocking someone’s path when they tried to disengage, or standing close enough to “trap” someone at a desk. One professor reportedly described Kohberger attempting to prevent him from leaving his office, refusing to leave when directed, and then following him into the hallway when the professor tried to end the interaction (Gainor, 2025).

Program-Level Concern and Attempts to Address Behavior

Reporting based on the released investigative files indicated the department received multiple complaints about Kohberger’s conduct, including rude and belittling behavior toward women, and that the program held meetings focused on his behavior and expectations. (Boone, 2025). Faculty discussions reportedly included consideration of altering his funding and teaching assistant role because he was viewed as “highly problematic,” and one faculty member was quoted as warning colleagues that if he later became a professor, he could harass, stalk, or sexually abuse students, reflecting the degree of alarm some staff described (Boone, 2025; Gainor, 2025).

Informal Protective Actions

Across several accounts, peers described informal protective behaviors that often emerge when a group feels someone’s boundaries are unreliable, such as intercepting him when a woman appeared uncomfortable, inserting themselves into conversations, or acting as a “buffer” between him and a female coworker or student. These narratives are notable because they suggest a shared perception among some peers that normal social exit cues were not reliably respected.

Pre-Incident Concerns Near the Victims’ Residence

Separately, released documents and reporting describe pre-incident concerns raised by at least one victim about feeling watched, and unusual observations at the Moscow residence such as a door found ajar or appearing damaged. Reporting emphasizes that these incidents were not confirmed as directly linked to Kohberger, but they became part of the investigative record as potential context around vulnerability and perceived surveillance (Associated Press, 2025).

Mental Health Concerns as Context, Not Causation

In later court-related reporting, Kohberger disclosed that he received four diagnoses in February 2025: autism spectrum disorder, obsessive compulsive disorder (OCD), attention deficit hyperactivity disorder (ADHD), and avoidant/restrictive food intake disorder (ARFID), an eating disorder characterized by persistent food avoidance or restriction due to sensory sensitivities, fear of negative consequences like choking or vomiting, or low interest in eating, leading to significant nutritional, weight, or functional impairment without concerns about body image (State of Idaho v. Kohberger, CR01-24-31665, 2025). Kohberger did not claim these diagnoses rendered him incompetent or not of sound mind for purposes of his plea. This information may be relevant for clinical context discussions, but it does not, on its own, explain targeted violence, nor should it be treated as causal (Spargo, 2025).

From “Creepy” to Credible: Why Subjective Perception Still Matters in BTAM

Perception, standing alone, is subjective. Terms such as creepy, weird, or unsettling describe an observer’s internal reaction, not an objective fact, and BTAM does not treat those labels as evidence of intent or as a substitute for behavioral assessment. A person’s discomfort may be influenced by individual experience, culture, context, or sensitivity to threat, which is why subjective impressions must be handled carefully and never elevated above observable conduct.

The BTAM value of such perceptions lies not in the label itself, but in what prompts it and whether that concern is corroborated. The relevant lesson is one of pattern recognition, not retrospective validation of intuition. When multiple independent observers, across settings and over time, report similar concerns and those concerns can be tied to specific behaviors, such as blocking exits, interfering with disengagement, intrusive proximity, repeated staring, following after class, or persistent contact after clear social cues to stop, the significance comes from the convergence of the reports and the consistency of the conduct. In that context, the subjective descriptor is not the finding, it is merely a cue to examine the underlying behavior more closely.

BTAM therefore asks structured, behavior-based questions: Are the same actions being reported by different people? Do the reports describe repeated boundary violations rather than isolated awkwardness? Is the conduct persistent, escalating, or spreading across environments? Are others changing their own behavior in response, seeking buffers, escorts, or other protective adjustments? These questions move the inquiry away from intuition and toward corroboration.

This distinction matters because BTAM is designed to identify risk under conditions of uncertainty. A single uneasy interaction may have little meaning. A documented pattern of similar, observable conduct reported by multiple sources is different. It allows a team to move from impression to analysis, from anecdote to pattern, and from fragmented concern to a more reliable understanding of foreseeable harm in the immediate environment.

Application of the Pathway to Violence

(Calhoun & Weston, 2003, 2016; Talbot & Dias, 2025).

In BTAM, the pathway-to-violence model is used to organize facts into a multi-interval trajectory, not to claim certainty about an outcome. Talbot and Dias (2025) caution that pathway models should not be read as a fixed, stepwise sequence. In practice, movement toward harm is often nonlinear and iterative, people can advance, pause, regress, or oscillate as stressors shift, consequences land, access changes, and the environment responds. Some individuals show late stage behavior with little visible buildup; others linger in early stages for long periods and then accelerate quickly after a destabilizer. The absence of a clear “later stage” indicator at a given moment therefore does not equal stability, it reflects only what is known at that time. This is why BTAM requires centralized documentation and ongoing reassessment. Pathway analysis is best treated as a living formulation that is updated as new information emerges, with the goal of recognizing directional change and applying timely, proportionate interventions that can disrupt momentum and reduce foreseeable risk (Talbot & Dias, 2025).

The core question that the application of the pathway model aims to answer, is whether there is evidence of movement from early precipitating stressors or grievance-driven dynamics into contemplation, planning, preparation, and approach. The accounts from peers and faculty depict a pattern of conflict-seeking, condescension, and dominance-oriented interactions, particularly toward women, coupled with repeated complaints across observers. BTAM would not treat rudeness as predictive on its own, but it would recognize that persistent antagonism and entitlement, especially when reinforced through repeated clashes, can function as an early driver of escalation in interpersonal violence cases.

The next interval asks whether there is evidence of ideation, meaning thoughts of harming others, fantasizing about harm, or framing violence as a solution. Though accessible reports do not clearly document statements of intent to harm specific people or direct expressions of violent ideation, BTAM would still consider the presence of behaviors that can precede ideation such as coercive interpersonal control, repeated boundary intrusions, and persistent unwanted proximity. In many real-world cases, teams must work with incomplete information at this stage, which is precisely why structured documentation and follow-up interviewing matter.

The pathway then considers research and planning. Here, BTAM looks for observable behaviors suggesting the person is studying targets, environments, routines, or methods, or rehearsing scenarios. The accessible information reflects interpersonal and boundary behaviors rather than clear planning signals, so a BTAM team would likely code this stage as “insufficient information,” while actively testing for it through additional information gathering. In practice, that means asking structured questions about escalating behaviors, schedule probing, repeated presence in certain locations, attempts to learn routines, or any talk suggesting curiosity moving beyond academic discussion.

The fourth interval, preparation, focuses on steps that increase capability or reduce barriers, such as acquiring tools, testing access, arranging transportation, or modifying routines to enable an act. The information depicts, and what BTAM would treat as operationally important, preparation for interpersonal control and access within the campus context, for example, using proximity, blocking exits, lingering near desks, or leveraging a teaching assistant role in ways that peers reportedly experienced as intrusive. Even if those acts are not indicative of preparing for homicide, BTAM recognizes that they are forms of rehearsal for violating boundaries and normalizing coercive dynamics, and they elevate foreseeable risks of harassment, intimidation, and retaliatory behavior.

Finally, the pathway model assesses approach behavior, meaning movement toward the target, the target environment, or circumstances where harm becomes more immediately possible. In the reported narratives from Washington State University, approach-like behaviors appear in the form of trailing peers after class, timing exits, and repeated unwanted proximity in offices and work areas. These are not approach behaviors toward a lethal attack, but they are approach behaviors within a harassment or stalking-like frame, where physical closeness and obstruction function as control tactics, and personal boundaries are disregarded. BTAM would treat repeated approach-like conduct, especially when it continues after clear disengagement cues, as a meaningful escalation signal that warrants immediate controls.

The BTAM conclusion from this pathway framing is not that the later violence was “predictable” from these campus behaviors alone. It is that the institution plausibly had enough information to recognize an escalating pattern of coercive boundary violations and fixation-like proximity behaviors, which are foreseeable precursors to harm in the environment, and therefore warranted structured assessment, centralized case management, and proportionate mitigation.

Application of Pre-Attack Warning Behaviors

(Meloy et al., 2012; Talbot & Dias, 2025)

BTAM also uses pre-attack warning behavior concepts to separate vague discomfort from observable indicators that often show up before targeted violence or other serious harm. When applied to this case, the most salient category is fixation. Multiple reports describe persistent staring, repeated proximity seeking, and a tendency to remain in the general area of people who did not want contact, along with timing exits and following them after class. A BTAM team would document these as fixation-like behaviors because they reflect repeated attention and approach that appears resistant to social cues and avoidance attempts.

A second relevant category is novel aggression. BTAM looks for new or increasing acts of intimidation, coercion, or boundary violations that represent a change in baseline or usual behavior. Reports say that when he blocked doorways, trapped people at their desks, got in the way of exits, or refused to let others walk away, it showed a new and more serious form of aggressive behavior because he was using his body to limit someone else’s ability to move freely. Even without overt, physical violence, novel aggression is relevant because it reflects a willingness to impose control in a way that can intensify over time, particularly if the person experiences consequences or rejection. All such behavior is “novel” in that there is no apparent, direct link to the quadruple homicide he would go on to commit.

BTAM also screens for leakage, which involves communicating intent, justification, or fascination with a violent outcome to third parties, directly or indirectly, and typically not directly to the intended target(s). In this matter, there is no clear pre-incident evidence of classic leakage about harming the Idaho victims. However, the post-incident comments in the next section may be appreciated as post-offense concern-relevant communications because they suggest identification with the act and cognitive engagement with the offender’s performance. Those statements, if accurately reported, are not pre-incident leakage, but they do illustrate the kind of content BTAM teams treat as meaningful in understanding the dynamics of the offender when occurring prospectively.

The model also considers direct threats which are among the higher-specificity indicators because they provide a clearer window into intent and target selection. The available information does not describe Kohberger making direct threats toward identified individuals, which is important. A BTAM team would not invent them but would actively test for their presence through structured interviews and review of prior complaints, communications, and conduct documentation. The absence of a direct threat does not eliminate risk, but it changes how the team calibrates concern and interventions; in many completed attacks, direct threats did not precede targeted attacks.

Another warning behavior construct is identification, which can include adopting the role of a predator, aligning with violent actors, or signaling a self-concept tied to dominance or harm. In this case, identification shows up more subtly in the alleged dominance behaviors and the repeated need to control interactions and space, rather than in explicit ideological statements. BTAM would treat that as a hypothesis, not a conclusion, and would look for corroborating indicators such as statements of admiration for offenders, self-referential comparisons, or escalating “predator-like” language, while being careful to avoid confirmation bias. However, additional information would emerge post-incident suggesting the relevance of this concept to Kohberger.

Johnston (2025) highlights Kohberger’s reported interest in Elliot Rodger, the 2014 Isla Vista perpetrator whose violence was framed around grievance, rejection, and misogynistic retaliation. According to Johnston, classmates recalled that while Rodger’s case prompted discomfort in many students, Kohberger appeared unusually engaged and “fascinated,” suggesting more than routine academic curiosity. Johnston also discusses the possibility that Kohberger may have examined passages associated with Rodger’s manifesto, and she notes the thematic parallels some commentators have drawn between Rodger’s narrative of resentment in a college-town environment and aspects of the Idaho case. Relatedly, she addresses the unverified “Papa Roger” online posts, emphasizing that if authored by Kohberger, the username and content could reflect an identification dynamic, namely adopting an offender-adjacent role by analyzing the crime in a way that appears to align with, rationalize, or “teach” about offender behavior.

Framed within BTAM warning behavior concepts, these points are best treated as potential indicators of identification only when they converge with other corroborated risk signals, such as grievance themes, persistent boundary violations, fixation-like behavior, or escalating hostility. Academic exposure to violent cases is common in criminology and is not inherently concerning; the concern here is the quality and pattern of engagement that may suggest psychological alignment rather than detached study.

Finally, BTAM assesses energy burst and last-resort dynamics, meaning sudden increases in activity, agitation, or desperation, often associated with a perceived crisis or narrowing options. The pre-incident WSU information does not strongly document such patterns, though it does describe repeated concerns and potential institutional consequences being discussed. A BTAM team would note that impending disciplinary action and role loss can function as destabilizers in some cases and would treat that as a reason to tighten monitoring, clarify boundaries, and ensure support and accountability are both present.

This application supports that the behaviors that matter most aren’t vague opinions about someone, they’re the repeated actions that many different people notice, the way those actions keep happening even after others ask the person to stop, and the way people around them start changing their own behavior to stay safe. A BTAM team uses these constructs to document patterns, calibrate concern, and justify proportionate interventions that reduce foreseeable harms, whether or not a catastrophic outcome is predictable.

Post-Incident Shifts and Comments from Peers

Some peers reportedly described behavioral changes in Kohberger after the homicides, including altered phone habits, appearing more disheveled, or avoiding discussion of the murders. One report also described Kohberger making comments about the offender being “pretty good” and speculating the murders might have been a “one and done” event, as relayed in interview summaries (Boone, 2025). Other documents also described digital activity including a search for a police scanner site in the early morning hours of November 13, 2022, and other behavior framed as consistent with monitoring the students’ environment, though these details are part of the broader investigative narrative rather than “pre-incident” conduct (Ruiz & Rumpf-Whitten, 2025).

Information Sharing as Prevention Infrastructure

Risk rarely arrives as a clear, complete story. It emerges as fragments scattered across people, offices, and systems. One professor experiences a “difficult” student. A graduate student reports being followed after class. A staff member hears concerns about staring. Another person observes doorway blocking. A coworker feels the need to buffer a colleague. If these remain separate, each fragment can be minimized as an isolated incident, personality conflict, or social awkwardness. In silos, no one sees frequency, persistence, escalation, or patterning. The organization stays trapped in a realm of “not enough to act,” right up until hindsight makes the pattern suddenly obvious.

A BTAM model relies on the opposite approach: a single intake channel, a single case record, and a process that consolidates disparate reports into one coherent timeline. A centralized repository is not an administrative convenience; it is a core violence-prevention control. It allows a team to evaluate the whole trajectory rather than evaluating each report as a standalone problem. It reduces gaps created by informal conversations, fragmented documentation, and the assumption that someone else is managing the issue. It also makes responses fairer and more defensible, because decisions are tied to patterns and corroboration rather than a single reporter’s subjective impression.

When information is shared, the picture resolves. The team can apply consistent thresholds, identify plausible feared outcomes, implement least-restrictive controls, and reassess as new data arrives. When information is siloed, the picture remains incomplete, interventions are delayed or inconsistent, and the organization is left reacting to fragments instead of managing a trajectory.

SHIELD Rapid Triage^TM: A Conceptual Application to Pre-Incident Observable Behavioral Risk Indicators

SHIELD Rapid Triage™ (Dias & Talbot, in press) is a structured intake screening and prioritization tool used to sort cases efficiently, guide proportionate interim measures, and support early coordination during the information-gathering phase using known and reasonably available facts; ratings are expected to be revisited and refined as information is verified and fuller case review occurs. SHIELD Rapid Triage^TM is not a risk assessment and does not predict violence or assign probability of harm, it provides a relative triage rating to help teams manage competing demands and determine when expedited review and interim controls may be warranted. It does not replace clinical judgment, BTAM processes, legal or HR review, student conduct procedures, law enforcement response, emergency management, or any applicable organizational policies, statutes, or directives, which remain controlling. Because intake information may be incomplete or evolving, users must document the basis for ratings, distinguish verified facts from unconfirmed reports, and update the triage as new information becomes available.

The SHIELD Rapid Triage^TM domains are rated on a simple scale: each risk-enhancer domain is rated 0–2 and each protective-factor domain is rated 0–2. Because SHIELD Rapid Triage™ includes four (4) risk-enhancer domains and two (2) protective-factor domains, the Total Risk Enhancer score ranges from 0–8 and the Total Protective Factors score ranges from 0–4. It consists of 6 domains (4 risk enhancing domains and 2 risk mitigating or protective factor domains) as follows:

• S - Stability: Screens for acute destabilizers or functional decline that increase volatility and reduce self-regulation.

• H - Harm Potential: Gauges practical capability and opportunity to cause harm or serious disruption, including access, proximity, and barrier reduction.

• I - Isolation: Assesses lack of pro-social connection, credible supervision, or protective relationships that can slow escalation.

• E - Escalation & Engagement Pattern: Captures momentum, persistence, fixation/grievance dynamics, and approach-like behaviors indicating directional movement toward a feared outcome.

• L - Leverage: Identifies stabilizers and intervention anchors you can activate quickly, including engagement pathways and workable alternatives.

• D - Deterrence: Evaluates constraints and accountability factors that make escalation less likely because consequences are expected and meaningful.

Based on this application to Kohberger and the alleged pre-incident behavioral concerns, the strongest signal in the SHIELD Rapid Triage^TM profile is E (Escalation & Engagement Pattern = 2) because the concerns are not just subjective discomfort, they are repeated, behaviorally anchored reports of boundary intrusions and approach-like conduct described across observers and settings. In triage terms, this is the kind of persistent, patterning behavior that tells a BTAM team to not treat this as an isolated problem. It warrants case consolidation, structured review, and early controls because boundary unreliability and persistence are reliable precursors for harm in harassment or stalking-like trajectories even when no direct threat is present.

The remaining domains cluster in the “mixed/unclear but concerning enough to track” range (S/H/I = 1 each), which is exactly what SHIELD Rapid Triage^TM is designed to surface: what is known is meaningful, but several high-impact unknowns remain. Stability is not clearly acute in the information provided, but there are plausible factors that can act as destabilizers. Harm Potential is elevated to a degree since he demonstrated capability and opportunity for coercive intimidation in ordinary campus spaces. However, there is no verified pre-incident evidence of weapons access, barrier-reduction behavior, or concrete planning. Isolation indicators are suggested by social friction and peer buffering as described, but the protective network picture is incomplete. On the protective side, Leverage and Deterrence are only partially present (L=1, D=1): the program appears to have real institutional levers (supervision, role limits, conduct expectations, boundaries), but his persistence implies leverage is not reliably working; consequences may exist, but they do not appear certain or salient enough to constrain the pattern.

Taken together, SHIELD Rapid Triage^TM yields an Elevated triage score (3). This does not suggest “high priority,” but it does suggest a high enough priority to move the case out of informal handling and into a centralized BTAM workflow with a time-anchored plan. Ultimately, this is a case where early, proportionate intervention is justified because the escalation pattern is behavioral and persistent, and because the biggest danger in the 3–5 range is siloing, when multiple people each see a fragment, but no single entity owns the whole trajectory.

This retrospective application of SHIELD Rapid Triage^TM can’t tell us that such a protocol would have stopped the homicide, but it does tell us what reasonable, earlier intervention triggered by a corroborated Escalation/Engagement Pattern might have changed in the conditions that make homicide possible. In prevention terms, those interventions work by disrupting trajectories, not predicting outcomes.

If a BTAM team had treated the repeated boundary intrusions and approach-like behavior as an Elevated priority case, the most plausible prevention effects may have been:

• Earlier consolidation of pattern and faster escalation of concern: Centralizing complaints into one case record can turn “multiple minor issues” into a documented pattern of persistence and boundary unreliability, which often triggers earlier supervisory review, stronger controls, and earlier referral to structured assessment.

• Reduced opportunity for boundary violations and approach behavior: Interim safeguards (role restrictions, supervised interactions, no-loiter expectations, access adjustments, clear “no contact / no blocking / no following” directives with enforcement) can meaningfully reduce a person’s ability to rehearse coercive proximity behaviors in the environment and can limit their access to vulnerable settings where they can select targets, study routines, or practice control tactics.

• Behavioral testing that generates clearer risk signal: A structured plan forces a team to consider if a person complies with boundaries and supports, or if they resist, escalate, retaliate, or shift to covert behaviors. Noncompliance, retaliation, or escalation after clear limits is often what moves cases into higher concern categories, prompting more intensive monitoring, documentation, and involvement of additional stakeholders.

• Potential earlier removal or restriction of institutional access: If the intervention pathway led to loss of role, changes in building access, closer supervision, or formal conduct actions, it could have reduced the individual’s access to people, spaces, and information in that institutional setting. Whether that would affect an off-campus crime is unknowable, but reducing access and privilege is one of the most reliable levers organizations can apply.

• Possible identification of higher-specificity indicators sooner: Structured follow-up (collateral interviews, records review, review of communications, checking for stalking-like behaviors, assessing grievances and fixation) sometimes surfaces indicators that were previously hidden or siloed. If more specific markers had been identified (targeted fixation, surveillance, weapon acquisition tied to grievance), that could have triggered more urgent protective actions.

• Increased protective awareness around potential targets: If a credible pattern had been recognized, BTAM-informed steps could include discreet safety planning for those reporting concerns, guidance on reporting escalation, and practical environmental hardening. Again, not predictive of homicide, but it can reduce vulnerability and speed detection of escalation.

Those steps might not have prevented the Moscow homicides, particularly given the limits of what a university can control off campus. What they could have done is reduce system lag, tighten supervision and documentation, and constrain opportunities for escalation in the near environment. Consistent, enforced boundaries and interim controls may have interrupted his persistence, limiting emboldening that can occur when repeated intrusions meet no meaningful response. They also could have influenced additional, higher-specificity indicators to surface with structured follow-up and information sharing, increasing the chance of timely disruption for an individual on a trajectory toward serious harm.

Foreseeability and Duty of Care

In broad U.S. negligence principles, liability typically turns less on whether an institution could predict a specific crime and more on whether harms were reasonably foreseeable and whether the institution took reasonable steps under the circumstances. Negligence is generally framed as a failure to act with the level of care a reasonable person or entity would exercise in similar circumstances, and duty arises where the law recognizes an obligation to act. 

When the underlying harm is caused by a third party, many jurisdictions start from a general rule that there is no duty to control another person’s conduct, unless a special relationship, control, or specific circumstances create one. In practice, foreseeability is often evaluated using facts like notice of prior concerning behavior, pattern and escalation, and whether the entity had reasonable, practical control levers to reduce risk. This is exactly where centralized information sharing and structured BTAM protocols strengthen an organization’s duty-of-care posture as they create a consistent mechanism to recognize patterns, document notice, and deploy proportionate risk controls before the harm occurs.

When institutions lack a shared repository and reports remain siloed, it becomes much easier for a foreseeable risk pattern to look, on paper, like a series of unrelated minor issues. A BTAM framework, paired with strong information-sharing infrastructure, is designed to prevent that fragmentation and to convert early “subjective” concerns into defensible, behavior-based risk management decisions.

Summary

The Idaho student homicides underscore a reality that BTAM practitioners confront routinely, that prevention is rarely about predicting a specific act with certainty, it is about recognizing when harm becomes reasonably foreseeable and responding with structured, proportionate action before a trajectory sharpens. Cases like this are often framed through the wrong lens in public conversation, a search for a single missed clue that should have made the outcome obvious. BTAM instead asks whether observable behaviors, viewed in their full context and pattern over time, created a credible basis to anticipate plausible feared outcomes and implement reasonable risk reduction steps, even without proof that a mass killing was imminent.

When the pre-incident information is examined behaviorally, the most instructive theme is not a subjective label like “creepy,” but the cluster of reported boundary intrusions and coercive positioning behaviors that multiple observers described across settings. In isolation, any one report can be rationalized as awkwardness, misunderstanding, or a personality conflict. In aggregation, repeated allegations of intimidation dynamics, persistence despite disengagement cues, repeated signals of fixation-like attention, and third-party alarm reflected in peers “buffering” for one another, begin to look less like noise and more like a pattern. BTAM treats that pattern as actionable, not because it proves intent, but because it indicates that normal boundaries are not reliably respected, that some individuals feel restricted in their freedom of movement, and that the likelihood of escalation or harm in the near environment is elevated enough to justify intervention.

A BTAM-informed response does not require a crystal ball. It requires infrastructure and discipline. Structured triage consolidates reports into a single case record, reducing information silos that keep the picture fragmented. A behavioral formulation identifies plausible drivers and trajectory without diagnosing. Protocols guide decisions about access, supervision, role suitability, and interim controls tied directly to observable behaviors, with clear thresholds for escalation if conduct persists. These steps are not punitive by default, and they are not predictions of homicide. They are the operational core of prevention: reducing opportunities for harm, constraining boundary violations, protecting potential targets, and documenting the rationale for each action in a way that is fair, consistent, and defensible.

This is also where the foreseeability conversation becomes most relevant. Foreseeability is not the claim that someone “knew” a quadruple homicide would occur. It is the recognition that, given a documented pattern of concerning conduct and sufficient notice, an organization’s duty of care may require reasonable protective measures within its sphere of control. Whether legal liability attaches in any given case depends on jurisdictional rules and the specific facts, particularly scope, control, and causation. Yet the BTAM lesson remains stable across settings: organizations are judged less by perfect prediction and more by whether they had a reasonable basis to act on foreseeable risk, used a consistent process, and implemented proportionate controls that aligned with the information available at the time.

Ultimately, the preventive value of this case study lies not in hindsight certainty but in systems thinking. Risk lives in the gaps between departments, between reports, and between people who each hold only a fragment of the story. When information is siloed, patterns remain invisible, and action is delayed. When information is shared and evaluated through a structured BTAM framework, vague perceptions can be translated into behavior-based risk signals, interventions can be tailored and documented, and the odds of disruption improve. BTAM does not promise that every tragedy can be stopped. It does, however, offer a defensible pathway to earlier recognition, more coordinated response, and the best chance of prevention when risk becomes foreseeable long before it ever becomes predictable.

About the Author

Dr. Matt Talbot, PhD, LCSW, CFMHE, CCFC, CTM, is a subject matter expert in behavioral threat assessment, violence risk assessment, forensic mental health, and workplace violence prevention. He has helped develop violence prevention programs for Fortune 50 corporations, major healthcare institutions, and K–12 schools and created the first collegiate certificate in behavioral threat assessment and engagement at Alliant International University. Dr. Talbot previously served as President of the South Central Chapter of the Association of Threat Assessment Professionals and is a renowned public and keynote speaker. He holds a PhD in Forensic Psychology, is a clinically licensed social worker in several states, and is a Certified Threat Manager, Certified Forensic Mental Health Evaluator, and Clinically Certified Forensic Counselor.

References

1. Boone, R. (2025, August 20). Kohberger’s sexist, creepy behavior alarmed university faculty and students before Idaho murders. ABC30. https://abc30.com/post/bryan-kohbergers-sexist-creepy-behavior-alarmed-university-faculty-students-before-idaho-college-murders/17594574/

2. Calhoun, F. & Weston, S. (2003). Contemporary Threat Management: A Practical Guide for Identifying, Assessing, and Managing Individuals of Violent Intent. Specialized Training Services.

3. Cornell Law School. (2021). Foreseeability. Legal Information Institute. https://www.law.cornell.edu/wex/foreseeability

4. Dias, B. & Talbot, M. (in press). SHIELD Rapid Triage. Key Operational Insights.

5. Gainor, D. (2025, August 19). Bryan Kohberger described as creepy, domineering by college peers in months before Idaho killings, newly released files show. CNN. https://www.cnn.com/2025/08/19/us/kohberger-washington-state-university-peers-police-interviews-hnk

6. Johnston, J. E. (2025, July 15). A psychological autopsy of Bryan Kohberger: The evidence, the psychology, the plea. Substack. https://joniejohnstonpsyd.substack.com/p/a-psychological-autopsy-of-bryan

7. Meloy, J.R., Hoffmann, J., Guldimann, A., & James, D. (2012). The role of warning behaviors in threat assessment: an exploration and suggested typology. Behavioral sciences & the law, 30(3), 256–279. https://doi.org/10.1002/bsl.999

8. Occupational Safety and Health Administration. (n.d.). Field Operations Manual, Chapter 4: Violations. https://www.osha.gov/fom/chapter-4

9. Ruiz, M. (2025, February 10). Prosecutors get Bryan Kohberger’s mental health records as he fights death penalty. FOX 13 Seattle. https://www.fox13seattle.com/news/bryan-kohberger-mental-health-records-prosecutors

10. Ruiz, M., & Rumpf-Whitten, S. (2025, July 24). Newly released documents reveal Bryan Kohberger’s disturbing behavior before Idaho murders. FOX 5 Atlanta. https://www.fox5atlanta.com/news/bryan-kohberger-new-documents-disturbing-behavior

11. Spargo, C. (2025, September 3). Bryan Kohberger diagnosed with 4 “mental health disorders,” he reveals in handwritten guilty plea. People. https://people.com/bryan-kohberger-mental-health-disorders-autism-11803100

12. State of Idaho v. Kohberger, B. C. (2024). Defendant’s response to state’s motion in limine re: neuropsychological and psychiatric evidence (Case No. CR01-24-31665). District Court of the Fourth Judicial District of the State of Idaho, County of Ada.

13. Talbot, M. & Dias, B. (2025). Predators, Posers & Pained Personalities: Defensible and Effective Strategies to Prevent Targeted Violence and Manage Malevolent Behaviors. Key Operational Insights, LLC.