Hourglass explains why school shootings are unpredictable
A seemingly simple hourglass shows why it's impossible to predict when, where, and why mass violence will happen.
I started writing this article in 2018 and couldn’t figure out how to finish it until now. I hope you enjoy reading it. Please let me know what you think via comments or email.
I’ve had an hourglass on my desk for the last decade. I don’t use it to keep track of time, instead it reminds me how things that look very simple can be impossibly complex.
When you flip the hourglass and the sand starts to fall, it forms a little mountain. For the first ~10 seconds, the sand piles up into a uniform mound. But then, a single grain lands on the peak and it triggers a landslide. Sometimes the landslide happens in 8 seconds, other times it takes 15 seconds. There can be a little landslide down the edge, or half the pile collapses all at once.
On the surface, it shouldn’t be that hard to figure out. The hourglass is a closed system that isn’t impacted by wind and moisture. There are a finite number of equal sized grains that fall through exactly the same hole each time. But even with only a few thousand variables, predicting the time and intensity of the landslides is impossible.
We can’t predict the seemingly simple landslide because each grain of sand has unpredictable impacts on hundreds of other grains. When each action causes a cluster of impacts rather than a linear chain of action/reaction, this is a complex system. In a simple system, each action has one reaction. A complicated system is a chain of linear actions/reactions. The hourglass is a complex system because each element (grain of sand) has a non-linear and unpredictable impact on the larger outcome (entire sandpile).
In a complex system like an hourglass, the only way to figure out how a landslide happened is to analyze it after the pile slides. While you can spend hundreds of hours drawing a process map showing the path of every grain to figure out exactly which one caused the landslide, this analysis still doesn’t help predict how or when the next landslide will happen.
Every school shooting is different (and complex)
If you know every detail about each second of the Parkland shooting, your perfect knowledge of what happened is like studying each grain of sand in one landslide. The Parkland Landslide Commission might write a report concluding: “The landslide was caused by Grain #4,102 so we need a monitoring system that identifies a pile that is 4,000 grains high and stops the flow of sand.”

But that’s a fundamental misunderstanding of both physics and complexity because grain #4,102 didn’t cause the landslide and the exact position of Deputy X didn’t determine where or how the shooting would end. The landslide was caused by the critical state of the entire pile because each new grain falling added to the system’s cumulative complexity. You can drop the exact same grain of sand onto the exact same spot twenty times, and all nineteen times nothing will happen. On the twentieth time, maybe the whole pile collapses…or maybe it doesn’t.
When I look at decades of data from the K–12 School Shooting Database, no two shootings have exactly the same circumstances in the same order. Every time a school shooting occurs, people try to look for the single broken cog in a linear machine. By looking retrospectively at the grain of sand that caused the collapse, they point to a specific red flag, a door left unlocked, a police officer who didn’t go inside fast enough, or a social media post that didn’t get investigated. But this is applying linear, cause-and-effect thinking to a phenomenon that is fundamentally non-linear.
To help explain this, I categorized 114 school shootings that meet the FBI’s definition of an active shooter into a complexity framework developed by IBM engineer Dave Snowden. His ‘Cynefin Framework’ explains how we need to think differently about Simple, Complicated, Complex, and Chaotic systems.
Cumulative Sandpile of School Violence
When an individual decides to bring a gun to a school, they are the product of an hourglass pile of red flags that has been accumulating “sand” for years. These grains can include:
Early childhood trauma and parental neglect.
Pervasive social isolation.
Suicidal sense of hopelessness and clinical depression.
History of violence and aggression.
Persistent bullying causing feelings of constant fear at school.
Suspension or expulsion from school removing social and supportive structures.
Devaluation of life by radicalized online communities (True Crime Community).
Feeling of nihilism, purposeless, and no better future ahead.
Identification with hate-based and nazi content.
Deep fascination or obsession with guns.
Aspiration to be in the military but disqualified from service.
Guns and shooting sports are their family’s primary bonding activity and hobby.
Easy access to firearms in the home (98% of school shooters).
There are 60,000,000 kids in k-12 schools and hundreds of thousands of them have three, four, or maybe even all of these risk factors piled on top of them. Just like most grains won’t cause a landslide in the hourglass, the vast majority of ‘high risk’ students will never commit an act of violence.
If you think about the Parkland, FL or Oxford, MI school shooters, they each had 10 of these factors that were causing the sand to rapidly pile-up towards a catastrophic collapse. There are also school shooters who had very few of these factors just like a tiny sandpile that slides after just a couple grains.

In my opinion, the biggest flaw of modern threat assessment models is the belief that an assessment team can predict exactly which grain of sand will trigger the landslide. The final catalyst is irrelevant because a landslide only happens when the system (sand pile) is already at its critical tipping point. Instead of focusing threat assessments on the final straw in an acute crisis, there need to be more general efforts to keep the sand from piling up across the entire system.
Applying the Cynefin Framework
The Cynefin framework is a conceptual tool created by Dave Snowden to show that problems sit in different spaces (Clear, Complicated, Complex, and Chaotic) that each have their own definition, framing, and approach.
At the beginning of the data collection and coding for the K-12 School Shooting Database, I was very interested in the Cynefin framework because I saw Dave Snowden speak at a conference. I thought this might be a novel and useful way to categorize the shootings so I coded each incident to one of the four domains.
I defined the four domains for school shootings as:
Simple: Obvious connections (e.g., current student says I’m going to shoot up my school on this date for this reason, and then does exactly that)
Complicated: Lots of factors but they can be connected in a linear path when studied carefully (e.g., indirect threats, red flags without specific threat of violence)
Complex: Multiple variables that would make prediction impossible but can be retraced in a logical manner (e.g., elements leading up to Parkland shooting can only be explained with hindsight but not foresight)
Chaotic: No logical connection between the factors (e.g., no clear reason or connection to the school such as the Edmund Burke School sniper attack and the Amish Girl’s School shooting in rural Pennsylvania)
From my analysis, very few school shootings (11%) are simple problems where there is a short linear cause-effect chain to identify and stop the attack.
Keep reading with a 7-day free trial
Subscribe to Riedman Report: Risk, AI, Education, & Security to keep reading this post and get 7 days of free access to the full post archives.




