On June 1, 2009, Abdulhakim Mujahid Muhammad shot two soldiers outside an Army-Navy recruiting center in Little Rock, Arkansas, killing Private William Long. When researchers later applied the TRAP-18 to the case, most of the protocol’s indicators were already visible in the attacker’s history before that morning.
TRAP-18 stands for the Terrorist Radicalization Assessment Protocol, an 18-indicator instrument developed by forensic psychologist J. Reid Meloy. It has nothing to do with animal traps, whatever confused summaries circulate online: it is a structured professional judgment tool for assessing the risk of lone-actor terrorism and targeted violence.
This guide explains the TRAP-18 as practitioners actually use it. We walk through the eight proximal warning behaviors and ten distal characteristics, how a structured assessment runs, the reliability and validity evidence, and where the protocol sits beside actuarial tools like the Texas Risk Assessment System.
What the TRAP-18 Risk Assessment Actually Is
Meloy laid the foundation in 2012 with the warning behaviors typology, then operationalized the full protocol for empirical testing in the APA’s Journal of Threat Assessment and Management. The instrument organizes accumulating case information on a person of concern so professionals can judge whether risk is accelerating.
Its users are specific: mental health clinicians, law enforcement, intelligence analysts, and protective services, the community organized by the Association of Threat Assessment Professionals. Counterterrorism practitioners across North America, Europe, Australia, and South Africa apply it, and Scotland’s Risk Management Authority reviews it among validated instruments.
| Attribute | The TRAP-18 is | The TRAP-18 is not |
| Type | Structured professional judgment (SPJ) instrument | An actuarial score or algorithm |
| Focus | Lone-actor terrorism and targeted violence | General criminal reoffending |
| Output | Pattern judgment: monitor or actively manage | A probability or a verdict |
| User | Trained threat assessment professionals | A self-assessment checklist |
| Basis | Published, peer-reviewed indicator research | A proprietary black box |
The architecture is the insight, and it separates the protocol from a generic risk assessment. Eight proximal warning behaviors capture how someone is moving toward violence now, ten distal characteristics describe the developmental pattern, and the split tells the assessor which question they are answering: manage actively, or keep watching.
The Eight Proximal Warning Behaviors in a TRAP-18 Risk Assessment
Proximal behaviors are the accelerants, the near-term signals that separate attackers from the far larger population of grievance-holders. Four of them, pathway, identification, leakage, and last resort, correlated with violence at medium to large effect sizes in the reliability and validity research.
Figure 1. The TRAP-18 architecture: eight proximal warning behaviors beside ten distal characteristics.
| Warning behavior | What it looks like |
| Pathway | Researching, planning, or preparing for an attack |
| Fixation | Increasingly pathological preoccupation with a person or cause |
| Identification | Warrior mentality; identifying with previous attackers or armies |
| Novel aggression | A first violent act that tests the capacity for violence |
| Energy burst | A spike in activity related to the target as the attack nears |
| Leakage | Communicating intent to harm to a third party before the attack |
| Last resort | Violence framed as the only option left, with time pressure |
| Directly communicated threat | A threat delivered to the target or to authorities |
Leakage deserves special attention because it is the interceptable one. The FBI’s Behavioral Analysis Unit built its prevention publications around exactly that window, and the US Secret Service’s National Threat Assessment Center documents leakage repeatedly across its mass attack studies.
The Ten Distal Characteristics the TRAP-18 Scores
Distal characteristics sit further back in the life history, and no single one predicts anything on its own. The pattern is the point: the TRAP-18 asks whether the developmental picture, grievance, ideology, social failure, and psychological features, hangs together with proximal behavior into a coherent trajectory toward violence.
| Distal characteristic | What it captures |
| Personal grievance and moral outrage | Perceived injustice fused with anger, often after loss or humiliation |
| Framed by an ideology | A belief system that justifies violence as necessary or righteous |
| Failure to affiliate with a group | Rejected by, or rejecting, an extremist or other group |
| Dependence on the virtual community | Online spaces standing in for real-world belonging |
| Thwarting of occupational goals | A major career or academic failure |
| Changes in thinking and emotion | Hardening, simplifying, us-versus-them cognition |
| Failure of intimate pair bonding | Absence or collapse of intimate relationships |
| Mental disorder | Symptoms present, with relevance assessed case by case |
| Creativity and innovation | Novel tactics or targets; inventive planning |
| History of criminal violence | Prior instrumental violence toward others |
Handle the mental disorder indicator with the care the literature demands. Research in the clinical threat assessment tradition rejects any simple equation of illness with terrorism, and the TRAP-18 treats diagnosis as one contextual feature among eighteen, never a predictor standing alone.
The distal list has intellectual roots reaching back to Eric Hoffer’s 1951 study of the true believer, the mass-movement joiner seeking purpose through a cause. The TRAP-18 turns that older insight into checkable indicators, the same evolution from intuition to method that runs through all of risk assessment methodology.
How a TRAP-18 Risk Assessment Runs in Practice
The protocol is a structured professional judgment, so process discipline carries the weight. Assessors gather records, interviews with family or colleagues, online activity, and prior police or clinical contacts, then code all eighteen indicators as present, absent, or unknown, building the file the way any step-by-step risk assessment builds evidence.
| Step | What happens | Output |
| Data collection | Records, interviews, digital behavior gathered | Documented case file |
| Indicator coding | All 18 indicators coded present, absent, or unknown | Indicator profile |
| Pattern judgment | Proximal and distal pattern weighed together | Risk formulation |
| Management decision | Monitoring versus active management chosen | Intervention plan |
| Reassessment | New information re-coded as it arrives | Updated formulation |
The Little Rock case study shows the method retrospectively. Researchers coding the attacker’s history found most TRAP-18 indicators present before June 2009, including pathway and leakage, the kind of finding that justifies structured review of every person of concern instead of ad hoc judgment calls.
The output is a management posture, and DHS’s prevention framework pairs naturally with it. Proximal activity present means active management: intervention, disruption, protective moves.
A distal pattern without proximal movement means active monitoring, keeping the case open while watching for acceleration, the cadence logic behind how often risk assessments should be conducted.
TRAP-18 Reliability and Validity: What the Evidence Shows
Reliability came first, and it is strong. Across the studies collected in the peer-reviewed review, mean interrater agreement reached a Cohen’s kappa of 0.895 with a range of 0.69 to 1.0, which means trained raters looking at the same case file code it the same way.
Figure 2. Validity in brief: four proximal warning behaviors carry the strongest documented association with violence.
Validity evidence is promising and honestly bounded. Content, criterion, discriminant, and predictive findings support the instrument, and a 2021 forensic-linguistic study validated indicators in attackers’ own writings, yet researchers stress that low base rates make certain individual prediction impossible for any tool.
That boundary matters for practice. The protocol identifies patterns deserving intervention resources; it does not label future terrorists, and the FBI’s Lone Offender Terrorism Report reached the same conclusion across 52 US attacks: prevention rests on recognizing behavior, never on profiling demographics.
TRAP 18 vs Actuarial Risk Assessment Tools
The sharpest way to place the TRAP-18 is against its actuarial cousins. Instruments like the Texas Risk Assessment System and the Ohio Risk Assessment System score fixed factors into risk levels for supervision decisions, while the TRAP-18 supports expert formulation of a specific, evolving threat.
| Dimension | TRAP-18 (SPJ) | Actuarial tools (TRAS, ORAS) |
| Question | Is this person moving toward an attack? | How likely is reoffending on supervision? |
| Method | Structured expert judgment | Fixed weights and cut scores |
| Population | Persons of concern, lone-actor threat | Sentenced supervision populations |
| Base rate | Extremely low (terrorist attacks) | Moderate (criminal recidivism) |
| Output | Pattern formulation and management posture | Low, moderate, or high risk level |
Base rates drive the design choice. Recidivism is common enough to model statistically, while lone-actor terrorism is so rare that actuarial cut scores would drown in false positives, which is why the field reserves qualitative expert methods for the rare-event end of the likelihood spectrum.
Common TRAP 18 Questions Practitioners Ask
What does TRAP-18 stand for?
Terrorist Radicalization Assessment Protocol, with 18 referring to its indicators: eight proximal warning behaviors and ten distal characteristics. Forensic psychologist J. Reid Meloy developed it as a structured professional judgment instrument for assessing the risk of lone-actor terrorism and other forms of targeted violence.
Who can administer a TRAP-18 risk assessment?
Trained threat assessment professionals: forensic psychologists and psychiatrists, law enforcement threat units, intelligence analysts, and protective services. The published manual and formal training exist because coding indicators consistently requires preparation, the same discipline any guide to how to conduct a risk assessment teaches, and untrained scoring undermines the demonstrated reliability.
Is the TRAP-18 an actuarial risk assessment?
No. It is a structured professional judgment instrument: the indicators structure what the assessor examines, but the conclusion is an expert formulation, and no arithmetic converts indicator counts into a risk score. That design fits terrorism’s extremely low base rate, where actuarial cut scores would generate overwhelming false positives.
What are the TRAP-18 warning behaviors?
The eight proximal warning behaviors are pathway, fixation, identification, novel aggression, energy burst, leakage, last resort, and directly communicated threat. Research finds pathway, identification, leakage, and last resort carry the strongest documented association with subsequent violence, at medium to large effect sizes.
How reliable is the TRAP-18?
Interrater reliability is the instrument’s strongest card: a mean Cohen’s kappa of 0.895 across studies, ranging from 0.69 to 1.0. In plain terms, two trained assessors reviewing the same case file will code the indicators the same way nearly all of the time.
Can the TRAP-18 predict who will become a terrorist?
No tool can, and the protocol’s own researchers say so plainly. Terrorist attacks are statistically rare events, so the honest use of the TRAP-18 is triage and management: identifying which persons of concern show an accelerating pattern that warrants intervention, monitoring, or protective action right now.
Where is the TRAP-18 used today?
Counterterrorism and threat assessment practitioners apply it across North America, Europe, Australia, and South Africa. It also informs behavioral threat assessment teams in workplaces and schools, where published threat assessment reports keep reinforcing the same prevention logic: multidisciplinary teams acting on observed behavior.
Where TRAP-18 Risk Assessments Go Wrong
Threat assessment reviews keep finding the same implementation failures, and each is preventable with process discipline. The table collects the recurring traps, and the common thread is treating a structured judgment instrument as either a magic checklist or a formality, mistakes any risk identification program would recognize.
| Pitfall | Root cause | Fix |
| Checklist thinking | Counting indicators instead of forming judgment | Weigh the pattern; SPJ is not arithmetic |
| Untrained coding | Indicator definitions drift without training | Formal training and calibration exercises |
| Mental illness shortcut | Diagnosis treated as the predictor | Code relevance case by case, in context |
| Dismissing leakage | Tips written off as venting | Every leak triggers a structured review |
| One-time assessment | Person of concern coded once and filed | Re-code as new information arrives |
| Overselling prediction | Tool presented as forecasting | Frame outputs as a management posture |
| Working alone | Single-assessor bias | Multidisciplinary threat assessment team |
Where TRAP-18 Research Goes Next
Watch the computational validation line first. The 2021 forensic-linguistic work testing TRAP-18 indicators in attackers’ own language points toward semi-automated screening support, with human judgment kept firmly in charge of the formulation, since no court or agency will accept an algorithm’s word on a person of concern.
By 2028, expect tighter integration with behavioral threat assessment programs in schools and workplaces. The Secret Service keeps pressing multidisciplinary team models, and the TRAP-18 gives those teams a terrorism-specific lens to pair with the threat and risk assessment and physical security risk management practice they already run.
Figure 3. The TRAP-18 in four numbers: structure, reliability, lineage, and reach.
Comparative validation is the third thread to follow. Researchers keep testing the protocol head to head against instruments like the VERA-2R and the ERG22+, and the reviews to date, including Scotland’s Risk Management Authority evaluation, place the TRAP-18 among the best-evidenced tools in the lone-actor space.
Our position for practitioners is careful: the TRAP-18 is the most validated instrument for lone-actor threat, and it still earns its value only inside a disciplined process, with trained assessors, documented components of a risk assessment, multidisciplinary review, and reassessment whenever the facts change.
Go Beyond the TRAP-18 With Risk Publishing
Security and risk leaders come to us to place instruments like this inside a wider assessment program. Explore our services for frameworks across the risk spectrum, from physical security risk assessments to enterprise methods, or contact us to talk through the assessment program your organization actually needs.
Chris Ekai is a Risk Management expert with over 10 years of experience in the field. He has a Master’s(MSc) degree in Risk Management from University of Portsmouth and is a CPA and Finance professional. He currently works as a Content Manager at Risk Publishing, writing about Enterprise Risk Management, Business Continuity Management and Project Management.