Instrumental and Affective Mass Murder: Establishing a Predictive Typology with Computer-Mediated Linguistic Analysis

Dr. Heather Leffew Obelus Institute May 2026

The Prediction Problem

Theoretical Background

Existing typologies of mass violence fall into three categories: those that distinguish mass murderers from the general population, those that distinguish them from other violent offenders, and those that distinguish kinds of mass murderers from each other. The first two have produced workable likelihood-of-attack screens (Knoll & Meloy, 2014; Langman, 2009; Verlinden, Hersen, & Thomas, 2000). The third has not. Theoretical proposals from Dietz (1986), Holmes and Holmes (1994), and Kelleher (1997) have not been empirically replicated, and recent attempts at empirical within-groups typology (Langman, 2009; Ioannou, Hammond, & Simpson, 2015) sort attackers ex post facto without predicting how an attack will unfold. The literature has missed a within-groups distinction with statistically validated ties to specific attack behaviors.

In threat assessment, the standard frame separates threat (the probability an event will occur) from risk (the potential impacts if it does). A burglary of an unoccupied home is low-threat and low-risk. A school shooting is low-threat and high-risk: low probability for any given school, catastrophic impact when it happens. An armed individual with credible communicated intent at an accessible location is high-threat and high-risk. The dissertation does not address the threat side of this matrix (whether an attack will occur). It addresses the risk side (what kind of attack is more likely, given that a pre-attack communication has been discovered), by treating that communication as a measurable psychometric signal.

Threat: Probability of Event →

Risk: Impact of Event →

Low Threat / High Risk

Example: A school shooting in the abstract. Dire consequences for any individual school, but low base rate.

High Threat / High Risk

Example: An armed individual with credible communicated intent attacking an accessible location. Mandates immediate tactical intervention.

Low Threat / Low Risk

Example: Burglary of an unoccupied home. Low probability for any given home, limited impact.

High Threat / Low Risk

High-probability events with minimal destructive impact. Procedural deterrence is the standard response.

Separating attackers into affective and instrumental types allows linguistic signals from a discovered pre-attack communication to inform what kind of attack is more likely, rather than waiting on the event itself to disclose its character.

02 / Methodology

A Detectable Divide

Cluster Analysis

K-means cluster analysis of the four LIWC summary variables produced two groups with no fuzzy boundary. Linear discriminant analysis correctly classified 100% of the 100 cases under cross-validation, with Analytic (r = .64), Clout (r = .88), and Authentic (r = -.80) carrying the strongest contributions to component separation and Tone (r = .48) carrying a moderate one.

Cluster 1, the Affective Type (n = 53), shows the lower Analytic, lower Clout, lower Tone, and higher Authentic profile. Their writing reads personal, present-tense, narrative, tentative, often saturated with hostility and despair. Cluster 2, the Instrumental Type (n = 47), shows the inverse profile: higher Analytic, higher Clout, higher Tone, lower Authentic. Their writing reads formal, logical, hierarchical, confident, guarded; closer to ideological treatise than to personal grievance. The split aligns with the theoretical distinction in the violence literature between emotionally-driven and goal-driven offending (Dodge, 1991; Glenn & Raine, 2009; McEllistrem, 2004; Meloy, 1988), but applies it within the mass-murder population for the first time.

Relative Profile Absolute Scale

Analytic

Tone

Clout

Authentic

Affective Type (n=53)

Instrumental Type (n=47)

Analytic

Tone

Clout

Authentic

Affective (LIWC percentile)

Instrumental (LIWC percentile)

04 / Behavioral Predictions

Predictive Signal Matrix

Logistic Regression

The first binary logistic regression used the raw H1-H5 predictors (lethality, connection, targeting, perpetrator killed) and was significant (χ²(4) = 30.58, p < .001, McFadden R² = 0.22), but two of those variables were too coarse to do their work. "Targeting" was coded as yes/no without distinguishing between specific-individual targeting and demographic targeting; "connection" was coded without distinguishing between the perpetrator's home and a less intimate site like their school or workplace. A second iteration refined both: targeting became demographic-based targeting specifically, and connection became perpetrator's home among the attack locations specifically. The refined model improved fit to McFadden R² = 0.24 (χ²(4) = 32.52, p < .001) and produced the odds ratios below. Each of the four predictors is significant when controlling for the others.

Odds Ratio % Change in Odds

Perpetrator KilledOR 14.11

Home as Attack LocationOR 5.0 inv.

Demographic TargetingOR 4.83

Per Victim KilledOR 1.14

RUST = PREDICTS AFFECTIVE TYPE  ·  GLACIAL = PREDICTS INSTRUMENTAL TYPE

Perpetrator Killed+1,311%

Home as Attack Location+400%

Demographic Targeting+383%

Per Victim Killed+14%

CHI-SQUARED(4) = 32.52  ·  P < .001  ·  McFADDEN R² = 0.24

06 / Type Exemplars

Threat Management Efficacy

Practical Constraints

The intended use of this typology is narrow and worth stating precisely. It does not predict whether an attack will occur. It predicts what kind of attack is more likely, conditional on a pre-attack communication being discovered and submitted for analysis. The work belongs to risk management (the impact side of the threat-assessment equation), not threat detection (the probability side).

Institutional Implementation Scenario

A university threat assessment team is presented with what appears to be a pre-attack communication composed by a student. Running the text through the LIWC summary variables and applying the cluster model classifies the author as Affective. The team then knows the author is more likely to attack a location with personal connection (potentially the campus itself), more likely to commit suicide at the conclusion, and likely to be in an acute emotional state. Response shifts accordingly: target hardening of the connected location, mental-health-led de-escalation rather than counter-terror posture.

The same model applied to an Instrumental classification points elsewhere: lower likelihood of personal connection to attack location, higher likelihood of demographic-based targeting, substantially higher likelihood that the attack continues until the perpetrator is apprehended or killed by another person. The two response postures are not interchangeable.

Limitations stated transparently. n = 100 is small for a field with low base rates; power analysis suggests significance may be underestimated for small and moderate effects. Stephen Paddock (Las Vegas, 2017) and other perpetrators who left no pre-attack communications are necessarily excluded. The within-sample classification accuracy of 100% is a property of the sample; out-of-sample validation on new pre-attack communications is the appropriate next step. Earlier work on increased communicated power drives in mass-murder manifestos (Leffew, 2017) was the seed for this dissertation's variable selection.