Quick ReferenceBeginner

Pre-Attack Indicators: What to Watch For

Documented behavioral and environmental indicators that precede violence. The JABS framework, specific observable behaviors, and how to respond when indicators are present.

Salt & Prepper TeamMarch 30, 20264 min read

Pre-Attack Indicators (JABS Framework)

J — Jettison Discarding items before engaging: setting down bags, removing jacket, clearing encumbering objects.

A — Adrenalization Visible stress response without clear cause: rapid breathing, flushed face, tremor, jerky movement, voice change.

B — Balling of Fists Hands fisting and releasing, tension in shoulders and arms, physical preparation for action.

S — Shifting Weight shifting, foot repositioning, body blading (turning sideways to reduce profile) or squaring up.


Additional Behavioral Indicators

  • Target glancing: Repeated glances at a specific person or position
  • Interview: Seemingly purposeless contact to assess you as a target
  • Weapon-hand concealment: One hand consistently concealed (pocket, waistband, behind back)
  • Closing distance: Moving toward you against normal traffic flow with focus
  • 1,000-yard stare: Unfocused gaze, not tracking normal environmental stimuli

Response Protocol

  1. Move to Condition Orange: heightened specific alertness
  2. Create distance — move to 21+ feet if possible
  3. Position with back to wall, egress visible
  4. Run "if-then": if X occurs, I will Y
  5. Leave the environment if indicators persist or escalate

The JABS Framework

JABS (Jettison, Adrenalization, Balling of fists, Shifting) is a teaching framework for the four most consistently observed pre-attack physical preparations. These are physiological and behavioral responses to the aggressor's own stress and preparation for action.

Jettison: Before physical engagement, most people unconsciously or consciously clear encumbrances. Dropping a bag, removing a coat, setting down a drink. The person carrying items who suddenly puts them down is physically preparing for movement.

Adrenalization: Adrenaline produces visible physiological effects before action. Pupil dilation (not observable at distance), facial flushing or pallor, increased breathing rate, voice change, slight tremor. A person whose physiology suddenly shifts to adrenalized state in a normal low-stress environment has something significant happening internally.

Balling of fists: Pre-aggression muscle tension expresses in the hands. Fists clenching and releasing, hands going white at the knuckles, arm tension. This is physical preparation for impact.

Shifting: Weight and foot positioning for action. Blading the body (turning one shoulder toward the target), weight shifting to forward foot for momentum, or squaring up directly. These are fighting stance preparations that occur before conscious decision-making about whether to engage.

The 21-Foot Rule and Distance

Research on knife attacks demonstrated that a person with a blade can close 21 feet and strike before most trained people can draw and fire. The practical implication extends beyond firearms: 21 feet is the general boundary at which someone already moving toward you with hostile intent may reach you before you can effectively respond.

If pre-attack indicators are present and a person is within 21 feet, closing distance is a critical warning signal. If they're outside 21 feet, you have time for assessment and repositioning.

Response to detected closing: Don't wait to see what happens. Move. Create distance. Change direction. Get a physical barrier between you and the approaching person if available (car, table, corner of a building). Movement itself disrupts the attack pattern — an aggressor who was committed to a specific approach vector has to adapt, which buys time.

Environmental Pre-Attack Indicators

Pre-attack indicators exist in the environment, not just in the aggressor's body language:

Crowd behavior: A crowd moving rapidly away from a specific point, sudden silence followed by screaming, people dropping to the floor. These are responses to a threat that other observers have detected. Act on them immediately without waiting for your own threat assessment.

Sound anomalies: Unusual sounds without visual explanation, rapid footsteps where none were expected, glass breaking. These trigger investigation and readiness.

Vehicle behavior: A vehicle moving slowly with occupants watching a specific location, a vehicle that has looped the same route multiple times, a vehicle stopped in an unusual position with running engine.

Timing and pattern: In a neighborhood, a person or vehicle that appears near your home at irregular intervals, a vehicle you see in multiple unrelated locations, unfamiliar people who ask specific questions about your household or schedule.

When to Act Without Complete Certainty

The failure mode is waiting for certainty before responding. Certainty often arrives at the moment of attack — too late to act.

Gavin de Becker's principle applies: if something feels wrong, act on it immediately. Increase distance, change environment, heighten alertness. The social cost of responding to a false positive (appearing slightly cautious or abrupt) is trivially low compared to the consequence of ignoring a true positive.

You don't need to be right about a threat to act appropriately. You need to act when your threat assessment indicates potential danger — and accept that most such assessments will be false alarms. That's normal, correct, and costs nothing.

Sources

  1. Gavin de Becker - 'The Gift of Fear' (1997)
  2. Marc MacYoung and Rory Miller - Pre-violence indicators research
  3. FBI - Active Shooter Pre-Attack Indicators

Frequently Asked Questions

Are these indicators reliable? Can you really predict violence?

Pre-attack indicators improve detection probability — they are not certainties. Research on violence shows these patterns appear consistently in pre-attack behavior, but many people display some indicators without ever committing violence. The appropriate response to indicators is increased alertness and preparation (moving from Yellow to Orange), not accusation or assumption. You're gathering information and positioning yourself to respond if needed.

What's an 'interview'?

In personal security terminology, an 'interview' is a brief contact initiated by a potential aggressor to assess you as a target. Common interview forms: asking a seemingly harmless question while evaluating your response (Are you paying attention? Are you distracted? Would you be an easy target?), creating a short distraction to gauge your reaction, or establishing proximity under a benign pretext. The content of the interview is less important than the pattern: it establishes contact, assesses you, and positions the person for follow-on action if they choose. A person whose conversational approach feels wrong, even when the words are benign, may be conducting an interview.

What if I'm wrong and confront someone who wasn't a threat?

Don't confront. The correct response to pre-attack indicators is to create distance and increase alertness — not to confront or accuse. Leave the environment if possible. Change your route. Increase the distance between you and the person who triggered concern. Confrontation based on suspicion creates the confrontation you were trying to avoid. Avoidance based on suspicion costs nothing if you're wrong.