The FBI Investigated the Evergreen Shooter for Two Months. The School Had No Idea.
- CrisisWire
- Nov 1
- 15 min read
By Warren Pulley, BTAM Certified | CrisisWire Threat Management Solutions
July 2025: The Anti-Defamation League flags a disturbing social media account to the FBI. The anonymous user posts extremist symbols, references previous school shooters by name, and documents acquisition of tactical gear.
The FBI opens an assessment. Special agents begin investigating. They track the account's activity, document concerning posts, attempt to identify the user's real-world identity.
August 2025: Classes begin at Evergreen High School in Colorado. Students return from summer break. Teachers prepare lesson plans. Administrators focus on enrollment, staffing, the usual back-to-school priorities.
The FBI continues investigating the anonymous account. Still can't identify who's behind it.
September 10, 2025, 12:24 PM: Sixteen-year-old Desmond Holly walks into Evergreen High School's hallways during lunch period. He pulls out a revolver loaded with dozens of rounds of ammunition. He fires repeatedly, reloading again and again as he roams the building searching for victims.
Two students fall critically wounded. Holly turns the gun on himself.
September 10, 2025, afternoon: Only after the shooting does the FBI connect their two-month investigation to Desmond Holly's identity. Only then do they realize the anonymous account they'd been tracking belonged to a student at the school that just experienced an attack.
Two months of federal investigation. Zero communication with the school where the actual threat existed. An information gap that allowed preventable violence to occur.
After 40 years preventing violence—from investigating violent crimes with LAPD to protecting diplomats in Baghdad under daily attack to directing campus safety operations—I can state unequivocally: The structural failure that enabled the Evergreen shooting isn't unique to that case. It's systemic across American threat assessment.
This article examines exactly why critical threat information never reaches the people who can actually prevent violence, and provides a roadmap for building the information-sharing infrastructure that would have saved lives at Evergreen.
The Information Gap That Kills
Let's map exactly what information existed before the Evergreen shooting—and who possessed it.
What the FBI Knew (July-September 2025)
Source Intelligence:
Anonymous social media account posting extremist content
References to previous school shooters
Symbols and code words associated with violent extremism
Documentation of tactical gear acquisition
Location data suggesting somewhere in Colorado
Activity patterns indicating planning behaviors
What FBI Could Not Determine:
Real name of account user
Specific address or city
Age of user
Whether user was student, adult, employed, etc.
Which school district (if user was student)
Specific threat timeline
FBI Actions Taken:
Opened formal assessment in July
Tracked account activity for two months
Attempted various identification methodologies
Continued investigation seeking probable cause for more invasive techniques
FBI Actions NOT Taken:
Notification to Colorado school districts about potential threat
Alert to state fusion center for distribution to schools
General advisory to education institutions in the region
Partnership outreach to identify potential matches
What the ADL Knew (July 2025)
Source Intelligence:
Same social media account the FBI investigated
Pattern matching with known extremist content
Indicators suggesting youth radicalization
Probable connection to education environment based on posting patterns
ADL Actions Taken:
Flagged account to FBI (standard protocol)
Documented concerning indicators
ADL Actions NOT Taken:
Direct notification to Colorado education authorities
Alert to school safety organizations in Colorado
Publication of anonymized warning about threat indicators
Partnership notification to school threat assessment networks
What Evergreen High School Knew (July-September 2025)
Absolutely nothing.
No notification from FBI. No alert from ADL. No warning from state authorities. No heads-up from any source that one of their students represented an active threat under federal investigation.
The school operated normally while federal investigators tracked threatening content from a student walking their hallways daily.
What Desmond Holly's Peers Likely Knew
Based on typical patterns in school violence cases and post-incident reporting:
Holly's social isolation and behavioral changes
His online activities and concerning posts (if they followed his accounts)
Statements he may have made suggesting violent intent
Changes in his demeanor or interests
His possession of tactical gear or related materials
What Holly's peers did NOT know:
That his behavior rose to level warranting FBI investigation
How to report concerning observations
That reporting could prevent violence
Where to report safely and anonymously
What Holly's Parents Likely Knew
Changes in their son's behavior at home
His online activities (to whatever extent they monitored)
His acquisition of tactical equipment
His social isolation or conflicts
Family stressors potentially contributing to behavioral changes
What Holly's parents did NOT know:
That concerning behaviors represented genuine threat indicators
That FBI was investigating account potentially belonging to their son
Resources available for intervention
How to access threat assessment support
The Devastating Reality
Every piece of information needed to prevent the Evergreen shooting existed. Federal investigators were actively working the case. Concerned organizations flagged the threat. Peers observed concerning behaviors. Parents witnessed changes.
But no system existed to connect these information sources before September 10th.
As I detail extensively in The Prepared Leader: Threat Assessment, Emergency Planning, and Safety, effective threat assessment requires breaking down information silos. The Evergreen case represents the most catastrophic failure of information sharing I've analyzed in 40 years working violence prevention.
Why Critical Threat Information Never Reaches Schools
The Evergreen information gap isn't accidental. It's the predictable result of structural barriers that exist across the country.
Barrier 1: No Legal Framework for Proactive Sharing
The FBI's Constraint:
Federal law enforcement operates under strict legal standards governing what information they can share and with whom. The FBI couldn't share information about their investigation with Evergreen because:
Investigative Confidentiality: Ongoing investigations are generally confidential. Disclosure could compromise the investigation, alert the subject, or create liability if information proves incorrect.
Lack of Probable Cause: Until FBI identified Holly, they had no probable cause to take law enforcement action. An anonymous account posting concerning content—while worrying—doesn't meet the legal threshold for arrest, search warrant, or many other interventions.
Privacy Considerations: Even if FBI identified Holly before September 10th, sharing that a teenager is under investigation raises significant privacy and due process concerns—especially if he hasn't committed a crime.
No Affirmative Duty: Federal law doesn't require FBI to notify schools when investigating threats potentially connected to students. No statute, regulation, or policy mandates such sharing.
The School's Constraint:
Conversely, schools face legal barriers to demanding information from law enforcement:
No Right to Investigation Information: Schools can't compel FBI or other agencies to disclose ongoing investigations. Law enforcement decides what to share.
FERPA Limitations: While FERPA allows disclosure of information to prevent imminent threats, it doesn't give schools access to law enforcement intelligence databases.
State Law Variations: Requirements for law enforcement to share information with schools vary dramatically by state—ranging from mandatory reporting in some states to no requirements in others.
Barrier 2: Cultural Divide Between Law Enforcement and Education
Having worked both as an LAPD investigator and as Director of Campus Safety at Chaminade University, I've experienced both cultures. The differences create communication barriers even when legal sharing is possible.
Law Enforcement Culture:
Information is controlled and shared on "need to know" basis
Investigations are confidential until conclusion
Evidence standards require certainty before action
Officer safety and case integrity prioritized over early disclosure
Training emphasizes investigation, not prevention partnerships
Education Culture:
Information is shared broadly to support student welfare
Transparency valued in student discipline and support
Lower thresholds for intervention (counseling, monitoring, support services)
Student development and rehabilitation prioritized over punishment
Training emphasizes education and support, not investigation
These cultural differences mean law enforcement and schools often talk past each other even when attempting collaboration.
Barrier 3: Resource and Capacity Limitations
FBI Resource Reality:
The FBI receives thousands of tips weekly. Most don't develop into prosecutable cases. Many involve anonymous accounts they can't identify. Agents must prioritize:
Imminent threats (specific, credible, time-sensitive)
Terrorism-related investigations
Cases with identified subjects and probable cause
Investigations supporting federal prosecution
A concerning but anonymous social media account in Colorado—absent specific threat, identified subject, or federal crime—competes for resources against these higher-priority matters.
School Resource Reality:
Most schools lack:
Dedicated threat assessment professionals
Relationships with federal law enforcement
Security clearances for accessing classified information
Training in intelligence analysis
Systems to receive and act on law enforcement intelligence
Even if FBI wanted to share information, most schools lack infrastructure to receive, assess, and act on it appropriately.
Barrier 4: Technology and Communication System Incompatibility
The Technical Gap:
FBI uses classified intelligence systems. Schools use student information systems and email. These don't integrate.
When law enforcement has information to share, they often resort to:
Phone calls to school administrators (who may not have threat assessment training)
Emails to general school addresses (that may not reach right personnel)
In-person meetings (requiring scheduling, travel, time)
Faxes to school offices (seriously—many agencies still use fax for "secure" communication)
None of these methods provide real-time, systematic information sharing at scale.
Barrier 5: Liability Concerns on Both Sides
Law Enforcement Liability Fears:
If they share investigation information and it's wrong, they face lawsuits for defamation, invasion of privacy, or civil rights violations
If they share and the school overreacts (expelling student who wasn't actually dangerous), they face criticism
If they don't share and violence occurs, they face criticism for not warning
School Liability Fears:
If they act on law enforcement tips that prove unfounded, they face lawsuits from families
If they demand students/employees submit to questioning based on unverified law enforcement intelligence, they face due process challenges
If they don't act and violence occurs, they face lawsuits for negligence
These competing liability concerns create risk-averse behavior on both sides—often resulting in no information sharing at all.
What Actually Works: The Information Sharing Infrastructure That Saves Lives
The barriers are real. But they're not insurmountable. Some jurisdictions have built effective information-sharing partnerships between law enforcement and schools. Here's how:
Model 1: Formal Law Enforcement Liaison Programs
What This Looks Like:
School districts and law enforcement agencies establish formal Memoranda of Understanding (MOUs) creating:
Designated Liaisons: Specific individuals on both sides responsible for information sharing
FBI field office assigns education liaison
Police department assigns school threat coordinator
School district designates threat assessment director
Regular Communication: Standing meetings regardless of active threats
Monthly coordination calls
Quarterly in-person meetings
Annual joint training exercises
24/7 emergency contact protocols
Information Sharing Protocols: Clear guidelines on what gets shared and when
FBI shares anonymized threat indicators without revealing investigation details
Schools share concerning student behaviors with law enforcement
Both sides notify each other of potential overlapping cases
Privacy protections documented and followed
Joint Training: Both sides understand each other's capabilities and constraints
Law enforcement trains on student development and threat assessment
School staff trains on law enforcement investigation and evidence standards
Combined exercises practicing information sharing in crisis scenarios
The Evergreen Application:
If this model existed in Jefferson County, Colorado:
July 2025: FBI opens investigation on anonymous account showing indicators of school violence threat in Colorado. FBI education liaison notifies Colorado school safety coordinator: "Heads up—we're investigating concerning online activity possibly connected to a student somewhere in state. Here are behavioral indicators to watch for. If you identify any students showing these patterns, contact us immediately."
Early August: Jefferson County school threat assessment coordinators receive alert. They brief building-level assessment teams and counselors: "Watch for students exhibiting these specific behaviors."
Mid-August: Evergreen teacher observes student (Holly) viewing content on phone matching described indicators. Reports to school threat assessment team.
Late August: Team investigates Holly, identifies concerning patterns. School resource officer contacts FBI liaison: "We have student matching your indicators."
Late August: FBI confirms Holly's identity matches their investigation. Joint assessment occurs. FBI shares (within legal bounds) relevant information. School implements intervention. Violence prevented.
Model 2: State Fusion Centers as Information Hubs
What Fusion Centers Are:
State fusion centers were created after 9/11 to facilitate information sharing between federal, state, and local agencies. Originally focused on terrorism, many now address all-hazards threats including school violence.
How They Can Bridge the Gap:
Sanitized Information Distribution: Fusion centers receive raw intelligence from FBI and other federal sources. They sanitize it (remove classified or investigative details) and distribute to appropriate local partners including schools.
Two-Way Information Flow: Schools report concerning behaviors to fusion centers. Fusion centers check against law enforcement intelligence. If matches exist, they facilitate connection between school and investigating agency.
Training and Technical Assistance: Fusion centers provide training to schools on threat indicators, reporting procedures, and information sharing protocols.
Legal and Privacy Protections: Fusion centers operate under established legal frameworks governing information sharing, providing liability protection for participating agencies.
The Evergreen Application:
July 2025: FBI shares with Colorado fusion center: "Anonymous account under investigation shows school threat indicators. Location: likely Colorado."
July 2025: Fusion center issues advisory to all Colorado school districts: "Alert—potential school threat. Watch for students exhibiting [specific behavioral indicators]. Report matches immediately to fusion center."
August 2025: Evergreen staff receives alert, recognizes Holly matches description, reports to fusion center.
August 2025: Fusion center connects Evergreen with FBI investigation. Coordinated intervention prevents violence.
Model 3: Threat Assessment Team Networks
What This Looks Like:
Schools form regional networks of trained threat assessment teams that share information, coordinate on cases involving multiple schools, and maintain collective awareness of threat patterns.
As I explain in my Threat Assessment Handbook, isolated threat assessment teams miss patterns that networked teams detect.
Network Components:
Regular Coordination Meetings: Monthly meetings of threat assessment coordinators from multiple school districts sharing:
Active cases (anonymized for privacy)
Emerging threat indicators
Lessons learned from interventions
Resource sharing and mutual aid
Shared Case Management System: Secure database allowing authorized personnel to:
Document cases (with privacy protections)
Check whether subjects have history at other schools
Track individuals who transfer between districts
Identify patterns across multiple schools
Law Enforcement Integration: Network includes representatives from:
Local police school resource officers
State police
FBI field office
Fusion center
Other relevant agencies
Training Standardization: All participating teams trained in common methodologies ensuring consistent assessment quality and information sharing protocols.
The Evergreen Application:
July 2025: FBI shares general threat indicators with Colorado Threat Assessment Network (hypothetical organization). Network distributes to member schools.
August 2025: Multiple schools in network observe students showing concerning patterns. Each reports to network coordinator.
August 2025: Network coordinator identifies pattern: Several schools report similar indicators in same timeframe. Coordinates with FBI to determine if related to investigation.
August 2025: FBI confirms connection. Network facilitates intervention at Evergreen and other schools where concerning behaviors identified.
Model 4: Anonymous Reporting Systems With Law Enforcement Integration
What This Looks Like:
Modern anonymous reporting systems (like Safe2Tell in Colorado, Sandy Hook Promise's Say Something program, or similar platforms) create pathways for students to report threats—and for those reports to reach both schools and law enforcement simultaneously.
How It Works:
Student Reports Concerning Behavior: Via app, text, phone, or web, student reports: "My classmate has been posting weird stuff about school shooters online."
Report Triaged to Multiple Recipients:
School threat assessment team receives notification
Law enforcement dispatch receives notification
Platform support team monitors for imminent threats
Coordinated Response:
School investigates using education-appropriate methods
Law enforcement checks against active investigations
If match found (like Evergreen case), agencies coordinate intervention
Privacy Protections:
Reporter remains anonymous
Subject's identity protected until threat confirmed
Due process maintained throughout
The Evergreen Application:
July 2025: FBI investigation ongoing. No connection to specific school yet.
August 2025: Holly's peer observes his concerning online posts. Reports via Safe2Tell: "Desmond Holly posting about school shooters and showing off tactical gear."
August 2025: Report reaches both Evergreen threat assessment team AND local police simultaneously. Police check with FBI—identify match with ongoing investigation.
August 2025: Coordinated school-FBI intervention prevents violence.
What Schools Must Do Now
If you're a school administrator or threat assessment coordinator reading this, you cannot wait for federal or state authorities to build these systems. You must take initiative.
Immediate Actions (Within 30 Days)
Action 1: Identify Your Law Enforcement Liaisons
Contact these agencies and identify specific individuals responsible for school safety:
Local police department (school resource officers, youth division, threat assessment unit)
Sheriff's office (if applicable in your jurisdiction)
State police (if they have school safety division)
FBI field office (education liaison or community outreach coordinator)
State fusion center (if one exists in your state)
Get direct contact information: names, emails, cell phone numbers, 24/7 emergency contacts.
Action 2: Request Formal Meeting
Schedule meeting with law enforcement partners to discuss:
Current information sharing protocols (or lack thereof)
Recent trends in student threats they're seeing
What information they can legally share with schools
What information schools should share with them
How to establish regular communication
Emergency notification procedures
Action 3: Document Current Gaps
Before the meeting, document your current capabilities and gaps:
Do you have trained threat assessment team?
Do you know who to contact at FBI if you identify concerning behavior?
Do your threat assessment team members have direct lines to law enforcement?
Have you established protocols for what information schools can share about students?
Do you have anonymous reporting system that routes to law enforcement?
Action 4: Join Existing Networks
Research whether your state has:
School safety fusion center or coordination body
Threat assessment team network or association
Anonymous reporting system with law enforcement integration
School safety information sharing platforms
If these exist, join immediately. If they don't exist, advocate for their creation.
Short-Term Actions (Within 90 Days)
Action 5: Establish Formal MOU
Work with your law enforcement partners to create Memorandum of Understanding documenting:
Purpose: "To facilitate appropriate information sharing regarding potential threats to school safety while protecting privacy and due process rights."
Designated Contacts: Names and contact information for liaisons on both sides.
Information Sharing Protocols:
What information law enforcement will share with schools (and limitations)
What information schools will share with law enforcement
Privacy protections and legal compliance
Documentation requirements
Communication Schedule:
Regular coordination meetings (monthly minimum)
Emergency contact procedures (24/7)
Annual review and update of MOU
Training Commitments:
Joint training exercises annually
Cross-training on respective capabilities
Scenario-based practice of information sharing
Action 6: Enhance Anonymous Reporting
If your anonymous reporting system doesn't integrate with law enforcement:
Contact your current vendor about adding law enforcement routing
Research platforms that include this capability (Safe2Tell, Sandy Hook Promise Say Something, STOPit, others)
Budget for upgraded system or implementation of new system
Train students on how to report concerning online behaviors specifically
Action 7: Train Your Threat Assessment Team
Your threat assessment team needs enhanced training on:
Working with law enforcement partners
Understanding FBI investigation processes
Recognizing when to involve law enforcement
Legal and privacy considerations in information sharing
Coordinating interventions across agencies
CrisisWire provides specialized training on law enforcement-school partnership in threat assessment contexts.
Medium-Term Actions (Within 6 Months)
Action 8: Conduct Joint Exercises
Practice information sharing through tabletop exercises:
Scenario: "FBI contacts you to say they're investigating anonymous account showing school threat indicators, possibly connected to a student at your school. What do you do?"
Walk through:
Who receives the notification?
How is information protected while investigating?
What investigation methods are legally permissible?
How do you interview the student?
When do you involve parents?
What interventions are available?
How do you coordinate with FBI?
Action 9: Advocate for State-Level Infrastructure
If your state lacks threat assessment networks or fusion center school safety integration, advocate with:
State education department
State school boards association
State school safety center (if exists)
State emergency management
Governor's office
Share the Evergreen case as example of why information sharing infrastructure matters.
Action 10: Build Regional Peer Networks
Even without formal state infrastructure, schools in a region can coordinate:
Monthly meetings of threat assessment coordinators
Shared training and resource development
Information sharing about threats crossing district boundaries
Collective relationship with law enforcement agencies
The Investment vs. The Alternative
Cost to establish effective information sharing:
MOU development (staff time): $0-$2,000
Law enforcement liaison coordination (ongoing staff time): $5,000-$8,000 annually
Enhanced anonymous reporting system: $5,000-$15,000 implementation, $2,000-$5,000 annually
Threat assessment team training on partnerships: $3,000-$5,000
Joint exercise development and execution: $2,000-$3,000 annually
Total initial investment: $15,000-$33,000 Total annual ongoing: $9,000-$16,000
Cost of one school shooting prevented: $10-50 million
ROI: 30,000-330,000%
Beyond financial return: Lives saved. Trauma prevented. Communities protected.
Conclusion: The Next Evergreen Is Preventable
Right now, somewhere in America, the FBI is investigating an anonymous account showing indicators of school violence. They can't identify the user. They don't know which school the potential threat attends.
Right now, somewhere in America, a school is operating normally while one of their students posts concerning content online, acquires tactical equipment, and moves toward violence.
The FBI knows something dangerous is happening. The school has no idea.
That's the same structural failure that enabled Evergreen. And it will enable the next school shooting unless organizations build the information sharing infrastructure to prevent it.
After 40 years preventing violence—from investigating hundreds of violent crimes with LAPD to protecting diplomats in Baghdad's combat zone to establishing campus threat assessment programs—I can state with certainty:
The information to prevent most school violence exists. What's missing is the system to connect that information to the people who can act on it.
Your school or district can build that system. You don't need to wait for federal or state action. You can establish law enforcement partnerships, create information sharing protocols, join or form threat assessment networks, and implement anonymous reporting that routes to law enforcement.
Or you can wait until the FBI contacts you after the shooting to inform you they'd been investigating your student for months.
Take Action Now
Schedule Your Free 30-Minute Threat Assessment Consultation
Discuss building law enforcement partnerships and information sharing infrastructure with a BTAM-certified expert who has worked both sides—as a law enforcement investigator and as a school safety director.
In this consultation, we'll address:
✓ Current information sharing capability with law enforcement
✓ Gaps that create vulnerability to missed threats
✓ Developing effective MOUs and liaison relationships
✓ Anonymous reporting systems with law enforcement integration
✓ Training threat assessment teams on agency coordination
✓ Building regional threat assessment networks
No cost. No obligation. Just expert guidance from someone who has built these partnerships across diverse environments.
📧 crisiswire@proton.me🌐 bit.ly/crisiswire
If your school just received concerning information from law enforcement and needs guidance NOW:
CrisisWire provides 24/7 emergency consultation for schools and organizations facing active threat situations requiring coordinated response.
📧 crisiswire@proton.me (monitored 24/7)
Additional Resources
Free Training:
Research:
Comprehensive Guidance:
Stay Informed:
LinkedIn: Warren Pulley
Twitter/X: @CrisisWireSec
About Warren Pulley and CrisisWire Threat Management Solutions
Warren Pulley is founder of CrisisWire Threat Management Solutions, bringing 40 years of experience preventing violence across military, law enforcement, diplomatic, and educational environments.
Professional Credentials:
BTAM Certified - Behavioral Threat Assessment & Management (University of Hawaii West Oahu)
20+ FEMA Certifications - IS-906, IS-907, IS-915, Complete ICS/NIMS
Former LAPD Officer - 12 years investigating violent crimes
U.S. Embassy Baghdad Security Director - 6+ years (zero incidents under daily threat)
Former Director of Campus Safety - Chaminade University
U.S. Air Force Veteran - 7 years nuclear weapons security
Published Works:
Connect:
LinkedIn: Warren Pulley
Twitter/X: @CrisisWireSec
Instagram: @crisiswire
Facebook: CrisisWire
Quora: CrisisWire
When violence is preventable, inaction is negligence.
The FBI is investigating threats right now. Is your school connected to receive that information?
Contact CrisisWire today.
© 2025 CrisisWire Threat Management Solutions. All rights reserved.
Comments