Resources
Dark Humor or Leakage? How Educators Can Tell the Difference
Last revised: July 29, 2026
Professional Reflection
A student cracks a joke about "finally snapping." Perhaps you overheard it in the hallway. Perhaps another student reported it, half worried and half embarrassed to come to you. Your stomach drops a little, and then comes the question every educator faces at some point: is this anything?
In my clinical work consulting with schools and threat assessment teams, that moment of uncertainty is precisely where educators lose their footing. Most of the time, no. Once in a while, yes. And the difference between those two answers is not instinct — it is pattern recognition. The research on targeted school violence provides a more reliable framework than intuition alone, and it begins with two words: venting and leakage.
Practical Guidance
Venting is emotional release. Students process frustration much as adults do, just with less filter. A student who mutters something dark after a difficult exam, swears about a coach, or trades gallows humor with close friends is processing stress out loud. It is developmentally common and typically dissipates when the stressor does.
Leakage is something different. The term comes from threat assessment research, and it refers to distress or intent surfacing in what a person writes, says, draws, or posts before violence occurs. These two things can look similar on the surface, but four questions help distinguish them.
Start with the audience. A private joke between close friends is different from the same words directed at a student the speaker barely knows, or posted where strangers can read them. Venting stays within trusted circles. Leakage tends to travel outward.
Then listen for specificity. "I could just punch someone" is a mood. "What if I came to school tomorrow and nobody could stop me" is a scenario, and scenarios warrant serious attention. A named person, a particular place, a timeframe, planning language: each additional detail moves a statement further from complaint and closer to communication of intent.
Persistence may be the most useful signal available to an educator. A single dark joke is a moment. The same violent idea resurfacing over weeks, deepening with each occurrence, circling the same grievance or the same individual, is a pattern. In my experience, pattern is the variable that matters most; isolated moments are rarely sufficient on their own.
Finally, look at what else is changing. Leakage rarely appears in isolation. A student who is also withdrawing from activities they once valued, nursing a grievance long past the point where others have moved on, or showing visible deterioration in mood or daily functioning is presenting what researchers call convergence — the clustering of multiple risk indicators across different domains of life (Cornell & Sheras, 2006; Meloy & Hoffmann, 2021). Convergence is the threshold the research consistently identifies as meaningful.
One practical guide: one joke with nothing else behind it warrants a conversation. Specificity combined with persistence and visible withdrawal warrants a report.
Reporting a concern is not calling law enforcement on a student. Most schools have a threat assessment team — typically some combination of an administrator, a counselor or psychologist, and a school resource officer — trained to evaluate exactly these situations. Their job is to understand what is happening and to connect the student with appropriate support. Assessment drives the response; the process is designed to help, not to punish, and in my experience it works as intended when given accurate, specific information to work from.
When you report, provide observations, not conclusions. The exact words you heard. When and where. Who else was present. Any pattern you have noticed over time. The assessment team's job is interpretation; specific, documented observations are the raw material they need.
Know your reporting obligations before you need them. Mandatory reporting duties vary by state and district policy. Reading your school's protocol on a quiet afternoon is worth considerably more than trying to reconstruct it under pressure.
Common Mistakes
Almost every failure in this area falls into one of two bins.
Some adults escalate everything: police for a joke, interrogation for a doodle. Trust dies, students stop talking, and the quiet kid who actually needed help learns to stay quiet. Over-escalation does real harm. Treating a single off-hand comment as an emergency teaches every student who witnesses the response that honesty with adults carries consequences. That cost falls hardest on students who are already misread — neurodivergent students, students of color, students whose expressions of frustration read differently to different adults. The answer is not to ignore dark statements. It is to use pattern as the threshold for escalation, not the isolated moment.
Other adults normalize everything: "boys talk like that," "it's just memes," "he's fine in my class." In the case record, many individuals planning targeted violence continued to function at school — some with strong grades — right up until they acted. Looking fine and being fine are different things.
The task is the middle ground: take patterns seriously, respond to isolated moments humanely, and stay close enough to your students to know which one you are looking at.
Research Snapshot
The concept of leakage comes from threat assessment research. In the Safe School Initiative's study of completed attacks, 81% of attackers let at least one other person know the idea beforehand (Vossekuil et al., 2004). In the Secret Service's later study of averted plots, nearly half communicated their intent outright, and 93% showed some observable concerning behavior (U.S. Secret Service NTAC, 2021). Leakage rarely arrives as a deliberate warning; carrying that weight in silence is genuinely difficult. The ideation surfaces in essays, in journals, in comments to peers, in social media posts (Meloy & O'Toole, 2011).
The concept of convergence — the clustering of multiple risk indicators across different domains of a student's life — is grounded in Cornell & Sheras (2006) and Meloy & Hoffmann (2021). The research consistently identifies this clustering, rather than any single behavior or statement, as the meaningful threshold for escalating concern.
Educator Takeaway
The goal is not prediction. No assessment framework can reliably predict violence from a single data point, and anyone who suggests otherwise is overstating what the research supports. What is achievable is pattern recognition: understanding what leakage looks like, how risk factors converge across a student's life, and how your school's assessment process works.
Use pattern as your threshold. An isolated moment deserves a conversation. Specificity combined with persistence and observable change in functioning warrants a report. Respond humanely, document specifically, and trust the threat assessment team to interpret what you bring them. That preparation means that on the day something real crosses your desk, you already know what to do with it.
References
Cornell, D. G., & Sheras, P. L. (2006). Guidelines for responding to student threats of violence. Sopris West Educational Services.
Meloy, J. R., & Hoffmann, J. (Eds.). (2021). International handbook of threat assessment (2nd ed.). Oxford University Press.
Meloy, J. R., & O'Toole, M. E. (2011). The concept of leakage in targeted violence. Behavioral Sciences & the Law, 29(4), 513–527.
Riedman, D. (n.d.). K–12 School Shooting Database. Retrieved from https://k12ssdb.org
U.S. Secret Service National Threat Assessment Center. (2021). Averting targeted school violence: A U.S. Secret Service analysis of plots against schools. U.S. Department of Homeland Security.
Vossekuil, B., Fein, R. A., Reddy, M., Borum, R., & Modzeleski, W. (2004). The final report and findings of the Safe School Initiative: Implications for the prevention of school attacks in the United States. U.S. Secret Service and U.S. Department of Education.