The 2026 White House Correspondents' Dinner

What the White House Correspondents’ Dinner Shooting Teaches Us About Behavioral Threat Assessment

When an armed individual approached a security checkpoint at the White House Correspondents’ Dinner on April 25, 2026, and opened fire, the immediate reaction was predictable: How did this happen? Where did security fail?

Those are fair questions—but they are also incomplete.

Because in this case, the most important failure may not have been at the checkpoint. It may have occurred well before the suspect ever arrived at the venue.

The Illusion of Perimeter Security

High-profile protective operations, particularly those involving the United States Secret Service, are built on layered security:

• Outer environment: open, fluid, largely unscreened

• Middle layer: credentialing and access control

• Inner layer: hardened checkpoint with armed personnel

That final layer worked.

The suspect was stopped at the checkpoint. A federal agent was protected by body armor. The attack did not reach its intended targets.

From a purely tactical standpoint, the system performed as designed.

The More Important Question: Why Was He There at All?

According to the federal charging documents, the suspect:

• Planned travel across multiple states

• Booked a hotel room weeks in advance

• Brought firearms with him

• Sent a scheduled email to family immediately prior to the attack

• Attached a written explanation outlining motive, targeting, and intent

This was not a spontaneous act.

This was planned behavior progressing along a recognizable pathway.

This Is a Behavioral Threat Assessment Case

The suspect’s actions align with well-established pre-incident indicators:

Ideation

He articulated grievances and assigned responsibility to specific individuals and institutions.

Planning

He coordinated travel, secured lodging, and brought weapons to the target environment.

Leakage

He communicated intent in advance through a written message sent to others.

Pathway Behavior

He moved from thought → preparation → approach.

On the Manifesto and Its Limits

A longer version of the suspect’s manifesto has circulated publicly, including sections not contained in the federal affidavit. Comparison confirms that significant portions of the document are authentic, as they align closely with excerpts cited by investigators. However, the affidavit explicitly notes that statements are presented “in substance and in part,” indicating that the publicly available version may represent a more complete, but not yet formally authenticated, iteration of the same document.

As such, additional sections should be treated with appropriate caution. They may provide insight into the subject’s mindset, but they do not carry the same evidentiary weight as material included in the charging documents.

What the Manifesto Does Show

Even the verified portions of the document are revealing.

The suspect outlines:

• targeting priorities

• rules of engagement

• willingness to use force if necessary

• attempts to limit, but not eliminate, collateral harm

One notable feature is a section structured as responses to anticipated objections. This format is commonly observed in cases of targeted violence. Offenders often construct internal dialogues in which they preemptively address moral, religious, or practical criticisms of their intended actions.

From a behavioral standpoint, this reflects cognitive rehearsal and commitment reinforcement. By resolving these objections in advance, the individual reduces internal resistance and strengthens justification for violence.

By the time someone is writing in this format, they are no longer debating whether to act. They are preparing to follow through.

Perception vs. Reality: “No Security”

Some versions of the manifesto include statements describing a perceived lack of security at the venue. Even if those statements are authentic, they should not be interpreted as objective assessments.

Individuals progressing toward violence frequently misinterpret their environment. They may fail to recognize layered or non-visible security measures and instead interpret the absence of overt control as absence of protection altogether.

What matters is not whether the environment was objectively permissive, but that the subject believed it was.

That belief lowers internal barriers and reinforces the decision to act.

The Real Gap: Detection and Intervention

There is a persistent tendency after incidents like this to focus on visible security measures:

• more screening

• more personnel

• more control

Those measures have value—but they are reactive.

The more consequential question is this:

How did a motivated individual progress this far along the pathway to violence without effective intervention?

He traveled, planned, communicated intent, and positioned himself at the target.

That is not a failure of magnetometers.

That is a gap in detection, assessment, and disruption.

The Takeaway

You cannot harden every hotel. You cannot screen every guest.

But you can build systems that identify individuals moving toward violence; especially when they are signaling intent.

This incident will likely prompt reviews of physical security and protective protocols. Those are necessary.

But if the focus stops there, the most important lesson will be missed.

The failure was not that an armed individual reached a checkpoint. The failure was that a determined individual progressed this far without interruption.

That is the space where behavioral threat assessment matters most.

Interpreting Video Evidence Without Hindsight Bias

Video evidence has become central to modern use-of-force review. Body-worn cameras, in-car cameras, surveillance systems, and publicly recorded footage frequently provide valuable information about police encounters. At the same time, video evidence presents unique analytical challenges, particularly the risk of hindsight bias.

Hindsight bias occurs when knowledge gained after an event influences how earlier decisions are judged. In the context of use-of-force review, this often means evaluating an officer’s actions based on information that was not available to the officer at the time force was used.

Avoiding hindsight bias is essential to fair, accurate, and standards-based analysis.

Understanding the Limits of Video

Video does not capture events exactly as they were perceived by participants. Camera angle, lighting, distance, frame rate, and audio quality all shape what is visible and audible. Body-worn cameras, in particular, record from a fixed position and may not reflect where an officer’s attention was directed at a given moment.

Video may also omit critical contextual information, such as peripheral activity, environmental conditions, or cues perceived through senses other than sight. A complete review recognizes that video is an important source of information, but not a complete reconstruction of human perception.

The Problem of Pause, Replay, and Slow Motion

Reviewers often have the ability to pause, replay, and slow down video footage. Officers involved in use-of-force incidents do not.

Frame-by-frame analysis can reveal details that were not observable in real time. While this can be useful for understanding what occurred, it can also distort evaluation if those details are treated as information the officer should have recognized during a rapidly evolving encounter.

Proper analysis distinguishes between what is visible to a reviewer after repeated viewing and what was reasonably perceivable to an officer making split-second decisions.

Separating Outcome from Decision-Making

Another common manifestation of hindsight bias is allowing outcomes to influence evaluation of decisions. Injuries, severity of force, or the eventual resolution of an encounter may color perceptions of earlier actions.

Standards-based review focuses on decision-making at the time force was used, based on the information available to the officer and the circumstances then present. The appropriateness of force is not determined by whether an outcome was favorable or unfavorable, but by whether decisions were reasonable within the totality of the circumstances.

Integrating Video with Other Evidence

Video should be evaluated alongside other evidence, not in isolation. Reports, witness statements, physical evidence, training materials, policies, and scene documentation all contribute to understanding what occurred and how decisions were made.

When video appears to conflict with other evidence, the task is not to elevate one source automatically, but to assess how each piece of information fits within the broader context. This integrated approach reduces the risk of overreliance on video alone.

Documenting Analytical Assumptions

A defensible use-of-force review documents how video evidence was interpreted. This includes acknowledging limitations, noting what is and is not visible, and explaining how video was weighed relative to other information.

Explicitly addressing these factors demonstrates that conclusions were reached thoughtfully and without reliance on hindsight or outcome-based reasoning.

Maintaining Objectivity in a Public Environment

Video evidence is often viewed by multiple audiences, including the public, media, and decision-makers. External reactions to video footage may be immediate and emotionally charged. A professional review process remains grounded in standards, evidence, and objective analysis, regardless of public reaction.

Maintaining this discipline is essential to credibility and fairness.

Video evidence is a powerful tool in use-of-force review, but it must be interpreted carefully. Avoiding hindsight bias requires disciplined analysis, attention to context, and a clear understanding of what information was available to officers at the time decisions were made. When video is evaluated thoughtfully and in conjunction with other evidence, it enhances accountability without distorting judgment.

Independent use-of-force review and analysis grounded in objective evaluation of video and other evidence are among the services offered by Riggs Advisory Group.

What To Look for in a Use of Force Investigation

A use-of-force investigation is only as strong as the steps taken in the earliest moments and the thoroughness of the follow-up. Whether conducted internally or reviewed externally, the quality of the investigation often determines whether decision-making, supervision, and accountability can be meaningfully assessed.

Several core elements consistently distinguish a comprehensive use-of-force investigation from a deficient one.

On-Scene Investigation and Scene Management

A proper investigation begins at the scene. This includes securing the location, identifying involved areas, and documenting conditions as close in time to the incident as possible. Early scene management helps preserve evidence and prevents later disputes about what was present or observable at the time force was used.

The investigator should be a supervisor who had no involvement in the use-of-force incident. This includes any supervisor who was on scene and in a position to direct or control the use of force, participated in planning the incident if it was pre-planned, or otherwise directed or took part in the incident.

Investigators should canvass the scene to identify physical evidence, potential witnesses, and relevant vantage points. This step is critical, particularly in public settings where bystanders, vehicles, and nearby structures may affect what was seen or recorded.

Identification and Documentation of Evidence

A thorough investigation requires active searching for evidence, not simply relying on what is immediately visible. This includes locating and documenting physical evidence, markings, damage, or environmental features that may be relevant to the use of force.

Equally important is documenting where evidence was found and how it relates spatially to the incident. Photographs, diagrams, and measurements help preserve context that cannot be reconstructed later.

Witness Identification and Perspective

Witness identification should extend beyond those who come forward voluntarily. A scene canvass should include efforts to locate individuals who were present but may not immediately identify themselves as witnesses. The investigating supervisor should document the extent and results of the canvass, including specific street addresses and whether they spoke with someone at each address.

Witness interviews should capture not only what each person reports seeing or hearing, but also where they were positioned at the time of the incident. Documenting witness viewpoints through photographs taken from their stated locations or diagrams showing lines of sight adds critical context when evaluating the reliability and scope of witness observations.

Review of All Available Video Evidence

Comprehensive video review is a cornerstone of modern use-of-force investigations. Investigators should make reasonable efforts to identify and review all available video sources, including:

• Body-worn cameras

• In-car cameras

• Fixed surveillance cameras

• Private or commercial security video

• Cell phone video recorded by witnesses or bystanders

Video review should be systematic and documented. The absence of video from an expected source should be noted and explained, rather than assumed.

Video from News Media and Public Sources

In addition to agency-generated video, use-of-force reviews should consider whether footage exists from news media or has been captured and disseminated publicly. In many incidents, video may be recorded by journalists, bystanders, or community members and later broadcast, uploaded to social media platforms, or otherwise shared online.

Such footage can provide additional perspectives, timelines, or context that may not be captured by body-worn or in-car cameras. Investigators and reviewers should make reasonable efforts to identify, preserve, and review publicly available video, recognizing that online content may be edited, reposted, or removed over time.

When video originates from external sources, it is important to document where the footage was obtained, what portion was reviewed, and any limitations related to angle, continuity, or authenticity. The existence of publicly circulated video should be acknowledged in the review, even when it does not materially alter investigative findings.

Failure to identify or account for widely available video may raise questions about the thoroughness of a use-of-force review and undermine confidence in the investigative process.

Interview of the Person Upon Whom Force Was Used

A complete investigation includes an effort to interview the individual upon whom force was used, when medically and legally appropriate. This interview provides information that may not be captured elsewhere, including the individual’s perceptions, physical condition, and account of events.

Investigators should also address medical considerations, including requesting a medical records release. If a release is refused, that refusal should be documented. Medical records, when available, can provide important information about injuries, timing, and treatment related to the force event.

Officer Statements and Involved Personnel

Investigations should obtain statements from all involved officers and any witnessing officers. These statements should be evaluated in light of training, policy, assigned roles, and individual responsibilities at the scene.

Supervisory actions and command decisions should also be documented, including notifications, approvals, and post-incident responsibilities. Use-of-force investigations are not limited to the actions of a single officer; they encompass the broader operational response.

Supervisory Intervention and Timely Retraining

When a supervisor conducting a use-of-force investigation identifies a concern with tactics, decision-making, or policy application, timely corrective action is critical. Waiting until an investigation is formally completed or closed may allow problematic practices to continue unchecked.

Supervisory intervention does not necessarily mean discipline. In many cases, it means immediate retraining, clarification, or corrective guidance to address an identified issue. If no feedback or retraining occurs, the involved officer may reasonably conclude that their actions were acceptable and repeat the same behavior in subsequent encounters.

Timely retraining reinforces expectations, supports professional development, and reduces the likelihood of repeated errors. From an accountability and risk-management perspective, addressing issues as they are identified is often more effective than relying solely on post hoc conclusions.

Documenting corrective action taken during the investigative process also demonstrates active supervision and a commitment to continuous improvement, rather than passive review.

Equipment and Force-Option Data

When force options involving equipment are used, relevant data should be preserved and reviewed. This may include downloading and documenting data from conducted electrical weapons, reviewing deployment information, and ensuring that associated evidence is retained in accordance with policy.

Failure to preserve or review available equipment data can significantly undermine the completeness of an investigation.

Documentation, Completeness, and Review

Finally, a use-of-force investigation should demonstrate completeness. Required investigative steps should be clearly documented, deviations from policy should be explained, and supervisory review should be evident in the record.

An investigation that omits key steps or leaves unanswered questions makes it difficult to assess decision-making, supervision, or accountability. Thorough documentation supports transparency, defensibility, and meaningful review.

However, the investigation itself is only the first step in the accountability process. A complete review requires an independent adjudicative determination, in which the designated reviewer evaluates all collected evidence and explicitly determines whether the force used was reasonable under the totality of the circumstances and consistent with agency policy. This review should also identify any tactical, training, or decision-making issues revealed by the investigation, or clearly document that such issues were already addressed by the investigating supervisor through timely corrective action or retraining.

A well-conducted use-of-force investigation is foundational to accountability, risk management, and organizational learning, but it is not the endpoint. Meaningful oversight requires both a thorough investigation and a documented, independent evaluation of the incident’s reasonableness, policy compliance, and training implications. Attention to investigative fundamentals—such as scene management, evidence collection, witness perspective, video review, and documentation—allows agencies and reviewers to evaluate use-of-force incidents within the totality of the circumstances and in alignment with professional standards.

Independent review of use-of-force investigations and investigative quality is among the services offered by Riggs Advisory Group.