(CNN) To help thwart potential school violence, students and staff need to beware of certain warning signs -- and feel comfortable reporting them.
But "the general public, they really don't know what to look for," said former FBI special agent and profiler Mary Ellen O'Toole, who has studied school shootings for more than 20 years.
The clues can range from subtle to overt. And students are often in the best position to notice concerning behavior from classmates, O'Toole said.
Here is what experts say students and schools should recognize as disturbing behavior -- and what they should do:
It can be tough figuring out whether a student might be contemplating harm, or if they're simply being irritable, angry or withdrawn.
The key is to look out for drastic changes in behavior, said school safety consultant Melissa Reeves, past president of the National Association of School Psychologists.
Those drastic changes can show up in different ways.
For some, it's increased outward behavior. "So we will see an escalation in grievances. An escalation, potentially, in anger. We will see an escalation in difficulty managing their emotions," Reeves said.
Others might do the opposite and become more isolated.
"We're still seeing significant changes, but they may now be starting to withdraw," Reeves said. "They're no longer interacting with groups of friends. They're starting to spend more time on the internet."
Broad statements of hostility, such as "I hate everybody," are another red flag, Reeves said.
School shooters often leak hints about their plans before they carry them out, said O'Toole, the former FBI profiler.
"I've seen it in nearly every case. And leakage is very specific because it is the shooter talking about what they're going to do before they do it," she said.
"They're typically done because the offender is really excited about what they're going to do. Some people say it's a cry for help ... if they're discovered beforehand, then they could be used for that purpose," O'Toole said.
But for those bent on violence, "They plan it. They think about it. They fantasize about it. They prepare for it. And all of that period of time in which that is done, that's very pleasant for them. They enjoy it."
A few days before the 2021 school shooting in Oxford, Michigan, the 15-year-old suspect posted a photo of a gun on Instagram with the caption: "Just got my new beauty today. SIG SAUER 9mm," Oakland County Prosecutor Karen McDonald said.
By itself, that post isn't necessarily a cause for alarm, Reeves said. In Michigan, residents under age 18 can possess a gun under certain circumstances.
"However, if you pair this with other risk factors and/or warning signs, it could very well be a sign of leakage," Reeves said.
The morning of the shooting, a teacher found a drawing by the suspect depicting violence and phrases such as "the thoughts won't stop help me," "blood everywhere" and "my life is useless," the prosecutor said.
The drawing is a clear sign of leakage, Reeves said.
Leakage can also involve a fixation on previous mass shootings "to the point where the English teacher knows about it, their friends at the lunch table know about it," O'Toole said.
While a troubling social media post or a disturbing comment in class might not indicate any threat, it's still worth telling a teacher or school official because others might have additional concerns, O'Toole said.
"Educate the students and the faculty to what the red-flag behaviors are ... and make it so that students can call in on a confidential line," O'Toole said.
Some schools use websites or apps to report concerns anonymously. Even an old-fashioned drop box and note cards can work, O'Toole said.
But no mechanism will work unless students feel comfortable using it.
"You have to educate the student body that this is not an effort to rat out your fellow student or get a fellow student in trouble," O'Toole said.
"We strive for prevention -- based on knowing what warning behaviors are, how to spot them and how to use appropriate intervention in an objective and compassionate way," she said.
Regardless of how students report concerns, those messages should be actively monitored, and the information should go to a school threat assessment team, according to best practice recommendations from the US Secret Service National Threat Assessment Center and US Department of Education.
Ideally, every school or school district should have a behavioral threat assessment team with protocols on handling potential threats, Reeves said.
The core team "should include an administrator, at least one school mental health professional (school psychologist, school counselor, school social worker), and a school resource officer (SRO)/law enforcement," Reeves and colleagues wrote about behavioral threat assessment and management in K-12 schools.
Just because a student gets called in to meet one or more team members doesn't mean that student is in trouble.
"It's not designed to be punitive," Reeves said. "It is an intervention process to get them help. And it does prevent acts of violence."
Reeves said she and other school psychologists have worked with students who had started planning or even started gathering materials to cause harm.
But when there's intervention and support, many students "no longer had the desire to want to harm others," she said.
"Oftentimes, when we're doing the threat assessment is where we find out there's abuse going on in the home. Or that one parent just got arrested for domestic violence and they're sitting in jail. Or the one grandma that was their caretaker who they loved just died. Now they feel that they have nobody," Reeves said.
"Through this process, we oftentimes identify stressors that nobody knew about. And then when we can intervene, we prevent them from escalating."
Knowing when to involve law enforcement is another important role of the threat assessment team.
"If an individual makes a threat but it is found to be not true, low level, or transient, then law enforcement will not likely need to be directly involved. School personnel can work with the student and parents by implementing a problem solving and/or conflict resolution process," Reeves and her colleagues wrote.
"However, if the threat is legitimate and mitigation actions need to be taken, an SRO/law enforcement officer may become engaged in a consultative or direct role. ... Reports involving weapons, threats of violence, and physical violence should immediately be reported to local law enforcement."
The mass shooting in Oxford, Michigan, prompted questions about whether schools can search a student's backpack or locker.
Hours before the deadly attack, a teacher reported seeing a drawing by the suspect that included "a semiautomatic handgun pointing at the words 'the thoughts won't stop help me," the lead prosecutor said. She said it also included a drawing of a bullet with the words "blood everywhere" written above it, along with the words "my life is useless" and "the world is dead."
The student was "immediately removed from the classroom" and taken to the guidance counselors' office, where he told a counselor "the drawing was part of a video game he was designing," the school district's superintendent said.
During that meeting, the 15-year-old suspect had a gun in his backpack, the prosecutor said.
The gunman later admitted in court that he hid a gun in his backpack and pulled it out in a bathroom before opening fire on his schoolmates.
The school district did not publicly say whether the suspect's backpack had been searched.
Schools can search a locker or backpack if they have "reasonable suspicion that there is potentially some sort of weapon or something that could be used as a weapon," Reeves said.
"It's a very low bar for a school to search a backpack or a locker," CNN Senior Legal Analyst Elie Honig said. "We know that from the Supreme Court -- it's reasonable suspicion, which is very low."
But just because a school can search a locker or backpack doesn't mean it's obligated to, the former federal prosecutor said.
When there are hints a student might cause harm, O'Toole said it's critical to ask both the student and their parents questions about guns, such as:
• Whether there are any firearms in the home
• Whether those guns are safely secured
• Whether the student might otherwise have access to a gun
If there's a high level of concern, and the student says they don't have access to a gun, "you can't stop there," O'Toole said.
"Self-reported information is some of the least reliable information that you can have. So you need to find other sources to corroborate what this person is telling you," the former FBI special agent said.
"So you would certainly want to look for anything else that might suggest that this person is experiencing violent ideation of some kind," she said. That means talking to the parents, teachers and even law enforcement to see if there have been any reports of incidents at the home.
School officials shouldn't rush to suspend or expel a student who might cause harm, Reeves said.
"Human instinct is to kick the student out of school, but this can actually escalate risk," she said.
Separating the student from school or socialization "can further escalate emotions," Reeves and her colleagues wrote.
"In addition, further disconnecting the student can increase grievances."
Therefore, "these types of consequences should be implemented only after careful team consideration and should always be paired with supportive interventions," the team of school psychologists wrote.
On the other hand, keeping the student of concern supervised at school "decreases the opportunity for them to be at home alone where they have more time to conduct research and plan how to carry out the act of violence."
"One of the most proactive ways that we can identify individuals early on is we need to be doing more prevention programs in schools," Reeves said.
Those can include programs on bullying prevention, suicide prevention, conflict resolution and anger management.
"In addition, parent awareness and engagement is critical," Reeves said.
"We need parents to be more aware of what is happening in their child's life and what they may have in their possession. While we need students and school staff to report, we also need more parent engagement at home and also need them to reach out when their child is struggling."
In October, after police said a 19-year-old gunman returned to his former St. Louis high school with an AR-15-style rifle and killed two people, the school district announced plans to add gun safety to its curriculum.
"Not just reading, writing, and arithmetic but reading, writing, arithmetic and gun safety," Saint Louis Public Schools Superintendent Kelvin Adams said.
To maximize school safety, anyone who sees a warning sign should report it, O'Toole said.
While a single incident might not prompt serious concern, "you don't just look at that alone," she said.
"It's the totality of all those behaviors. So one person may know about leakage. One person may know, 'Yeah, I heard that he has access to a gun.'" And another person might report a separate concern about the same student, O'Toole said.
"So you pull all those together and you say, 'Ah-ha, now I'm really concerned' or 'Nope, there's nothing else here. Nothing to see here.'"
Reeves said students are often in the best position to notice red flags -- whether those clues are on social media, in the classroom or outside of school.
"Students, quite honestly, are our biggest eyes and ears that are out there."