Many in the media attempt to create a profile describing the “average” attacker. The data do not support a profile beyond sex and number of attackers. Attackers were male 96.2% of the time. Furthermore, the attacker commits the attack by him/herself 97.5% of the time. Beyond these characteristics, attackers are somewhat more varied.

Attacker Race/Ethnicity
The racial/ethnic makeup of attackers roughly mirrored that of the general population, though Caucasians were under-represented and African Americans were over-represented. Most attackers were either Caucasian (46.3%) or African American (30%). All other racial/ethnic groups (e.g., Latino, Asian, Middle Eastern) only accounted for around a quarter of attackers (23.7%).

Attacker Age
While the median age of attackers was 31 years old, attackers ranged in age from 12 to 88. Attackers in their twenties were the most plentiful group compared to any other decade of life. The age-trend of attackers adheres to the classic “age-crime curve” observed for nearly every crime type, peaking in late adolescence/early adulthood and steadily declining throughout the rest of the life course.

Weapon Type
Active attacks can be carried out using any weapon though, in reality, only a very small minority of attacks (6.2%) were carried out using weapons other than firearms (e.g., knife, vehicle). Among types of firearms, handguns made up a clear majority (56.1%), while rifles (e.g., AR15s) and shotguns were used in 28.4% and 8.1% of the time, respectively.

Defining where an attack occurred can be difficult. For instance, on January 8, 2011 a shooter attacked a meeting for U.S. Representative Gabrielle Giffords. This attack happened in the parking lot of a local Tucson grocery store. Had the attack happened in the store it would have been classified as a business event; however, since the attack occurred in the parking lot it is coded as an outdoor event. Bear these fine distinctions in mind when examining the visualizations in this section.

Location Type
As seen here, the plurality of events happen at places of business (42.7%). Places of business include factories/warehouse, retail locations, and office space. Around a quarter of attacks (26.8%) happened in public (outdoor) spaces. Schools were attacked 76 times (13.4%). These events are aggregated and include attacks on all types of educational facilities, including K-12 and institutes of higher education. Lastly, 97 attacks (17.1%) happened at “Other” locations (e.g., houses of worship).

Relationship to Location
In a vast majority of attacks (64% of all attacks), the attacker(s) had no prior association with the attack location. For attackers with some relationship to the location, former/current students (11.3%) and current/former employees (10.6%) were the most common relationship types, followed by indirect (e.g., the attacker’s wife was associated with the location; (7.2%)) and “other” associations (6.9%).

Relationship by Location Type
When looking within location types, we find that most attackers had no relationship to the locations. Going beyond attackers with no relationship,
we find some interesting patterns. Depsite making up only 10.6 of attackers generally, attackers of businesses were current/former employees 20.7% of the time. A similar trend is observable in schools, though in this case, the vast majority of attackers were current/former students (82.9%). Only a small percentage of attacks (11.8) on schools were perpetrated by an attacker with no relationship to the school.

Time of Day by Location Type
When grouped by location type, the tendency of attacks to occur around midday is still observable, though it is modest. The most noticeable trend can be see with attacks at schools, where there is a strong tendency for attacks to occur during the morning hours prior to midday. Note: this plot shows the density of attacks within location types, meaning that the concentration of attacks is relative to other attacks within the same location type and not to concentrations displayed for other location types.

There were 3,913 casualties from active attacks between 2000 and 2023. Of these, 1,382 people died. The visualizations in this section examine these fatalities.

Attacks vs. Fatalities by Year
Attacks and total fatalities have been increasing over the course of data collection (2000-2023). For specific years, however, there are noticeable spikes in the number of deaths. These spike often correspond to some of the more well-known attacks. For example:

• 2007: The attack on Apr. 16th at Virginia Tech, Virginia, resulted in 32 deaths, accounting for 47.1% of all attacks that year.
• 2009: The attack on Nov. 5th at Fort Hood (now Fort Cavazos), Texas, resulted in 13 deaths, accounting for 20% of all attacks that year.
• 2012: The school shooting on Dec. 14th at Sandy Hook Elementary School, Connecticut, resulted in 26 deaths, accounting for 29.2% of all attacks that year.
• 2017: The attack on Oct. 1st in Las Vegas, Nevada, resulted in 58 deaths, accounting for 39.5% of all attacks that year.

Of note, while the number of active attacks did not decrease during the COVID-19 pandemic, the lethality of attacks did decrease to less than half the number of any of the four years previous. In 2021, however, the number of attacks increased and the number of deaths returned to pre-pandemic levels.

Fatalities per Attack (Interactive)
Most attacks (96.1%) resulted in fewer than 10 fatalities, with 31.9% of attacks resulting in no deaths at all. Hover over the points on this plot to get information about that specific attack.

Fatalities per Weapon Type (Interactive)
While most attacks (56.1%) were committed using handguns, the only such attack that resulted in more than 20 fatalities occurred at Virginia Tech, 2007. Attacks using rifles accounted for all of the remaining attacks that surpassed 20 deaths. Hover over the points on this plot to get information about that specific attack.

It is the mission of the Research Ring at ALERRT to make the Active Attack Data as freely accessible as possible. Please feel free to explore the raw data in the window to the right or download the data as a .csv file using the download button below. The codebook for the data is also accessible below as a .docx file. The codebook includes variable names, value labels (i.e., for factor/character variables), and summary statistics.

Before downloading the data, please familiarize yourself with the following notes:

1. The dataset is organized so that each row corresponds to a unique active attack. This means that some variables, like attacker characteristics, need some special handling. Because some events involved multiple attackers, variables like age, race/ethnicity, and sex, are given a special suffix (e.g., _1, _2, _3) that correspond to specific attackers. For an attack with only one shooter, the demographic variables ending in _2 and _3 will contain missing values. Keep in mind, the suffixes were assigned randomly and should not be taken as an indication that individuals described by variables ending in _1 were somehow more central to the attack than the other people involved.

2. The dataset also includes several variables with the _incl suffix. This suffix refers to an “inclusive definition” applied to the the variables’ coding scheme. ALERRT applies more stringent definitions than does the FBI for coding active attack cases. For instance, injuries that were sustained during an active attack but not directly by the attacker (e.g., sprained ankle from running away) are not counted by ALERRT as injuries in our wound_tot variable. For this reason, there may be differences between our numbers (and visualizations) and the official FBI reports (represented in the variables ending in _incl).

Data (.csv)

Codebook (.docx)