BLACKSBURG, Va.—As university risk managers last week hurriedly reviewed their crisis management plans, security experts stressed that the tragedy at Virginia Polytechnic Institute and State University underscores the need for threat assessment as well as improved emergency communications.

But few institutions try to identify potentially dangerous students and employees by the warning signs they typically display before exploding into fits of rage, security and legal experts said.

"A lot of people say these things can't be predicted, but there always are indication signs," said Gary Salmans, a Troy, Mich.-based executive vp of risk management services in the Critical Incident Prevention Management division of Arthur J. Gallagher & Co.

When an emergency does develop, effective campuswide communications have to be at the center of crisis management, experts agreed. There may be little time to do anything else on a sprawling campus than warn students and faculty to protect themselves, they said.

At Virginia Tech, gunman Cho Seung-Hui, a 23-year-old English major with a history of behavioral problems, killed 32 students and faculty on April 16 before taking his own life.

But after the first two murders, the gunman did not strike again for more than two hours. During part of that time, he left the campus to mail to NBC News a multimedia package in which he attempted to justify his actions.

During much of that interim, school officials assessed the progress of the investigation by police, who had made an off-campus traffic stop to question a male friend of one of the first two victims, a young woman.

More than two hours after the initial shootings, school officials first informed students and faculty--via e-mail--of the crime and asked them to report any suspicious activity. Most of the second group of victims were in class when the group e-mail was sent--about 20 minutes before the gunman struck again.

Prior complaints

The gunman had not gone unnoticed by university officials before last week. According to the school, two female students complained in late 2005 to campus police that he was stalking them. Neither woman pressed charges. In a later incident, police persuaded him to seek counseling, which led to a court finding that he was a danger to himself. The court ordered him to receive additional outpatient mental health treatment.

Earlier that fall, an English professor notified school officials about violence depicted in the student's work, but campus police took no action because the writings were not threatening and were part of a class assignment, according to the university.

In part because of federal and state privacy regulations governing students' mental health records, officials at many universities feel constrained about trying to identify possible student threats, security experts said.

There is "no consistent approach" among the nation's 4,000 higher education institutions to identify threats, said Jean Demchak, a managing director the education practice leader at Marsh Inc. in Hartford, Conn.

But identifying potentially dangerous people, who typically have "extreme control personalities," is "the most important thing" universities can do to prevent violent outbursts on their campuses, Mr. Salmans said.

"There certainly is a lot more work that colleges and universities can do in this area," said Allen J. Bova, president of the Bloomington, Ind.-based University Risk Management & Insurance Assn. and director of risk management at Cornell University in Ithaca, N.Y.

But compiling the necessary information on a possible threat can be difficult, in part because of privacy laws, Mr. Bova said. In addition, the information is not always accurate, the identified individual is not always a threat, and not all potentially dangerous individuals behave in a manner that draws serious attention before they become violent, he said.

Privacy laws, though, are not a stumbling block to threat identification programs, said Anne Mulholland, director of the higher education practice for Aon Corp. unit Aon Risk Services Inc. of Chicago.

"The threat assessment concept is not predicated on counselors breaking a confidence," Ms. Mulholland said. Instead, the concept is based on documenting and acting on an individual's "outward behavior."

Threat assessment

Peter Lake, an insurance law professor at Stetson University in DeLand, Fla., said threat assessment programs are "the best chance" universities have to prevent student and employee violence.

But confusion over privacy laws is hindering development of those programs, Mr. Lake said. Many university officials believe the laws are more restrictive than they are, he said.

Ms. Demchak pointed to a risk management program at the University of Arizona in Tucson as a threat identification model that has made the campus safer while not running afoul of privacy laws (see story, page 20).

In addition, because of a federal privacy law provision, a university counselor may disclose a student's mental health status if the student signs a pretreatment waiver that allows such disclosures when a counselor believes the student is suicidal or a threat to the lives others, Ms. Demchak said.

In that situation, if the student or his or her parents do not agree that going home is the best option, then the school should attempt to persuade the student to seek inpatient hospital treatment, she said.

"It becomes an intervention," and the student is given choices, she said.

But Laura M. Knoblauch, a member of the Baltimore-based American College Health Assn., cautioned against asking students to sign broadly worded waivers that would give counselors wide discretion in disclosing student information. Such waivers still would violate privacy laws, because the student would not know which private information would be released, said Ms. Knoblauch, who also is the privacy officer and student health service risk manager for Illinois State University in Normal, Ill.

Campus communications

When a crisis does occur, campuswide communications--more so than any other security measure--have to be effective to prevent or mitigate harm to students and faculty, experts said.

The problem with other security measures is the difficulty of quickly implementing them across sprawling campuses, experts said.

For example, Steve Holland, director of risk management and safety at the University of Arizona, said a campuswide lockdown at his institution--which is much smaller than the Virginia Tech campus--would take hours to implement. He noted that one building on his campus has about 50 doors that would have to be locked before that building would be secure.

But while effective communication is critical, it is "the No. 1 weakness in all of the exercises we perform" on crisis management plans at higher education institutions, Ms. Demchak said.

For example, many exercises that universities run do not even test how they would communicate with students and faculty, she said.

When the communications programs are tested, problems often emerge, Ms. Demchak said.

Aon's Ms. Mulholland said most schools now are examining the idea of installing a combination of emergency notification systems that would alert students and faculty by phone, e-mail and even sirens that would signal them to seek more information.

But the noise-muffling headphones for portable music players that so many students use mitigate the effectiveness of even combination emergency alert systems, Mr. Holland said.

Hank Chase, executive director of federal programs at SMART Business Advisory & Consulting L.L.C. of Devon, Pa., agreed. As a result, campuses might also have to install strobe light emergency warning systems. The effectiveness of strobe lights, though, is reduced during daylight, he said.

"There's probably not a perfect way" to alert a campus during a crisis, he said.

Even so, software developed by the U.S. military that has just been made available commercially could dramatically improve emergency communications, Mr. Chase said. The software can send an emergency alert message simultaneously to cell phones, laptop computers, and pagers as well as to landline phones, he said.

Another communication system that should be available shortly is a public address system unlike any used in elementary or high schools or on subways, he said.

The so-called "giant voice" system essentially combines an air raid siren with a public address system, Mr. Chase said. The result is a clear-voice loudspeaker system that can boom out emergency messages that can be heard from several hundred yards to more than a mile, he said.