Within the Virginia Tech Review Panel's report on the killing of 32 students by a fellow student, Seung Hui Cho, that occurred on the VT campus this spring are many recommendations U.S. universities and colleges should heed.
The report's recommendations break down primarily into information sharing and threat assessment, notification, and response.
The most important set of recommendations concern how schools should handle a troubled student and share information internally and externally to ensure that the student gets the help he or she needs while protecting the school community. At Virginia Tech, despite a history of dark and disturbing writings and behavior noticed by students and teachers, and numerous complaints which led to Cho's involuntary evaluation at a mental health clinic, the dots were never connected and a possible intervention by the university to get Cho the help he desperately needed never materialized.
Maybe the worst oversight—owing to "overly strict interpretations of federal and state privacy laws," according to the report—was the failure to contact Cho's parents. Asked what they would have done if they knew of Cho's threatening behavior, Cho's parents answered, "We would have taken him home and made him miss a semester to get this looked at...but we just did not know... about anything being wrong." The report responds by recommending that universities share information internally and externally, especially with parents, when health and safety issues arise.
Internally, it says, universities must develop reporting guidelines for faculty and staff to ensure that information regarding a student's "aberrant, dangerous, or threatening behavior" makes it to the university's threat assessment group, which should include among its members relevant personnel from across the university spectrum, including, most critically, student health and university police.
At Virginia Tech, a police representative was not a standing member of the "Care Team," which resembled a threat assessment group. This critically hampered information sharing. Because they had no police representative, members of the Care Team were never informed of Cho's run-ins with police due to his threatening behavior and harassment of female students.
The report further recommends that universities design some process to ensure that troubled students have access to mental health services on or off campus. Cho did have access to both mental health resources of Virginia Tech and the state of Virginia, but the necessary follow-ups to ensure that a patient was healthy or progressing were absent. It is necessary for universities to track mentally a disturbed student's progress to balance the student's best interest and "the rights of all others for safety."
As noted above, a strangle point for information sharing was the university's strict interpretation of federal privacy laws. But the report concludes that much blame rests with the privacy laws as well. The report states:
The panel's review of information privacy laws governing mental health, law enforcement, and educational records and information revealed widespread lack of understanding, conflicting practice, and laws that were poorly designed to accomplish their goals. Informaiton privacy laws are intended to strike a balance between protecting privacy and allowing information sharing that is necessary and desirable. Because of this difficult balance, the laws are often complex and hard to understand. (my italics)
The report's recommendations primarily concentrate on what changes should be made to federal privacy laws to facilitate the flow of sensitive information necessary to make an accurate threat assessment of a disturbed student.
A critical recommendation is for schools to designate law enforcement and medical staff as "school officials with an educational interest in school records." This would allow school officials to share disciplinary records with the police without violating FERPA— The Family Educational Rights and Privacy Act of 1974.
Virginia Tech and its police were criticized in the report for the decision to wait nearly two hours afer two bodies were discovered before notifying the campus community of the shooting (Cho first shot two people in a dorm before proceeding later to slaughter 30 in classrooms). When the community was notified, the report says, the alert provided was not commensurate with the threat.
The Virginia Tech police made the fateful decision to treat the first double murder as an isolated incident, domestic in nature. The panel concluded that university police in the future should not focus on one theory and communicate that in confidence to university decision makers in the preliminary stages of an investigation.
Next, the panel turned to the university's emergency message, which they determined was too vague. Nowhere in the message did the university communicate that a double murder occurred. The university's description of the incident as "a shooting," the panel wrote, "might have implied firing a gun and injuries, possibly accidental, rather than two murders. To rectify this, the panel recommends:
All key facts should be included in an alerting message, and it should be disseminated as quickly as possible, with explicit information.
Another key recommendation is the panel's advisement to institute multiple communication systems, with components not dependent on high technology. Many universities have already taken note of that lesson and acted on it. Since the massacre, mass notification systems have quickly proliferated across U.S. campuses.
Virginia Tech was in the process of acquiring the high-technology solution of a mass notification system when the massacre occurred and was simultaneously erecting six sirens as a low technology solution. Within the university's emergency plan, a "last-ditch resort" outside of technology was using resident advisors and floor wardens to personally warn people in dorms and classrooms and give instructions.
Responding to and acknowledging criticisms that the campus should have been locked down or classes at least cancelled, the panel recommends that plans to cancel classes and lock down a campus should be included in a school's emergency operations planning and, when feasible during a crisis, implemented.
The one area where the report finds no fault is in the university police's response to the mass shooting at Norris Hall. Because university police had established a mutual-aid agreement with the local police and had trained in active-shooter response with the local police, a team of first responding VTPD and the Blacksburg Police Department officers quickly entered Norris Hall and startled Cho into ending his own life.
Holding the VTPD up as an example, the report says:
Campus police everywhere should train with local police departments on response to active shooters and other emergencies.
As well as:
Other campus police and security departments should make sure they have a mutual aid agreement as good as that of the Virginia Tech Police Department.
Finally, because Cho had chained three of the four entrances to Norris Hall shut, giving him extra time to kill, the report recommends that schools check their "hardware" on outside doors to see if they can be chained shut.
Although there are many factors to consider when a campus draws up its emergency management plan, such as institution size and budget, the panel's recommendations are sharp and comprehensive. Any campus which goes about implementing as many as it can, will be a much safer place, ready not only for the next Cho, but any calamity that may strike.
(See Security Management's August cover article, "Preventing the Next Campus Shooting," which addressed these issues in the immediate aftermath of the incident and tracks many of the recommendations in the report.)