Distance (Sometimes) Makes the Threat Grow Stronger
By TorchStone Senior Analyst, Kori Sidwell and Intelligence Analyst, Jane Morency
TorchStone has tracked Persons of Interest (POIs) and analyzed threats involving individuals who have traveled vast distances to confront or attack high-profile targets. These incidents underscore the importance of a robust protective intelligence program capable of tracking threat actor movement and providing timely alerts regarding changes in proximity to a protected individual. Numerous recent examples illustrate how aggrieved or fixated individuals are willing and capable of traveling significant distances to reach their target and conduct an attack. This article highlights several of these examples and notes how protective intelligence helps to identify, track, and mitigate this risk.
The 2026 White House Correspondence Dinner: A Case Study in Long Distance Threats
In late April at the Washington Hilton Hotel in Washington, D.C. a gunman attempted to breach the annual White House Correspondents’ Dinner by charging through a security checkpoint and shooting a Secret Service agent. The gunman was not from D.C., but traveled cross-country (2,688 miles) from Torrance, CA to attempt his assault.
The gunman had no criminal record and was not on law enforcement’s radar before the event, despite displaying several escalating behavioral indicators of concern leading up to the attack. For example, the suspect’s digital profile had shifted in recent years. In 2022, his social media content consisted mostly of posts about video games; more recently, he shared posts comparing President Donald Trump to Adolf Hitler and encouraged others critical of his presidency to purchase guns. This language was echoed in a “manifesto” the gunman sent to family members minutes before the attack. This document laid out a plan to target Trump administration officials and expressed deep frustration and anger at their perceived actions.
Speaking with law enforcement following the attack, the gunman’s sister shared that her brother “had a tendency to make radical statements, and his rhetoric constantly referenced a plan to do ‘something’ to fix the issues with today’s world.” She also disclosed that he recently purchased two handguns and a shotgun, secretly storing them at their parents’ home.
These factors are indicative of a concerning escalation pattern along the pathway to violence and underscore the necessity of proactive threat monitoring. Though U.S. Secret Service agents successfully intervened before the suspect reached his target, the incident demonstrates how individuals with no prior criminal history or direct proximity to their target can still pose a significant threat to principals.
Not an Isolated Incident
TorchStone frequently encounters the assumption that concerning individuals (Persons of Interest) who are geographically removed from the principals pose a lower threat. While it’s true that geographic location is crucial in understanding the imminency of a potential threat, that factor alone does not accurately determine a potentially malicious actor’s overall risk profile. The White House Correspondence Dinner attack is one of several recent cases in which an aggrieved individual traveled significant distances to locate and attack a target.
In April 2026, an anti-AI activist from a Houston, TX suburb traveled to San Francisco and threw a Molotov cocktail at OpenAI CEO Sam Altman’s home before attempting to breach OpenAI’s downtown headquarters. The suspect later told security that he planned to burn the building down and kill anyone who was inside. In August 2025, the 345 Park Avenue shooter drove from Nevada to Manhattan to carry out his deadly attack, likely targeting NFL Headquarters. And, in December 2024, UnitedHealthcare CEO Brian Thompson’s murderer also traveled from out of state to Manhattan to conduct his targeted assassination.
These types of attacks are not reserved for large-scale, politically motivated shootings and killings – geographically removed stalkers and fixated individuals can also pose immediate threats.
In May 2025, a man traveled from Mississippi to Los Angeles to reach Jennifer Aniston, whom he had previously stalked, later crashing his vehicle through the gate of her Bel Air residence. More recently, in March 2026, police arrested a woman accused of driving across the country from Florida to open fire on Rihanna’s Beverly Hills home. In this case, the woman who carried out the attack had a long history of subscribing to online conspiracy theories about Rihanna and other celebrities.
When Principal Travel Meets the Threat
Another critical consideration is principal travel into areas where persons of interest (POIs) may reside or operate. Public awareness of a principal’s movements is increasingly common, whether driven by media coverage tied to a high public profile, corporate announcements regarding speaking engagements or events, or self-disclosure through the principal’s own social media activity. This visibility can create opportunities for malicious actors to exploit known itineraries and facilitate unwanted approaches or targeted attacks. For this reason, TorchStone strongly recommends conducting comprehensive Travel Risk Assessments (TRAs) prior to principal travel. Beyond evaluating the broader threat and operational landscape of a destination, TRAs help identify known POIs in the area, assess their proximity and capability, and inform mitigation strategies designed to reduce exposure and enhance protective readiness. On multiple occasions, TorchStone Travel Risk Assessments have identified POIs who attempted to approach principals during travel outside of their own home region.
Protective Intelligence in Action
Identifying and mitigating these threats requires ongoing visibility into the POI’s online and physical activity even despite geographical distance. Doing so keeps security teams informed of directional threat movement, whether danger may be approaching the principal, or the principal may be approaching potential danger. At TorchStone, we’ve supported cases where this type of intelligence-driven monitoring enabled teams to do just that.
In March 2024, TorchStone Senior Intelligence Analyst, Mare Cunningham, identified an international person of interest who signaled plans to travel to a major U.S.-based music industry office. She immediately began monitoring the individual’s public social media activity and provided timely updates to the organization’s physical security team as the situation developed, including off-hours notifications. This real-time reporting gave the investigations team and onsite security personnel advance notice of the individual’s likely arrival and allowed them to prepare a coordinated response. The person later appeared at the office as indicated, and security teams managed the encounter without disruption or escalation.
“One of the key lessons from my FBI experience,” stated Cunningham, “is that prevention often depends on recognizing and acting on subtle warning signs. This case highlights how protective intelligence, continuous monitoring, and close coordination with onsite security can help mitigate potential threats before they impact people or operations.”
Key Takeaways
Protective intelligence begins with the early identification of potential threats, regardless of proximity to principals, so teams are aware of aggrieved or fixated individuals before behavior escalates. Analysts then monitor online activity, communications, and other behavioral indicators to establish a baseline risk assessment and identify changes in behavior, whether that’s increased activity, complete silence, or events that could trigger one to take action. Tracking movement patterns and location-based activity also helps determine whether a subject may be planning travel or, in the case illustrated above, en route to the principal’s location. From there, security teams can take proactive steps through coordinated response measures like BOLOs (be on the lookout), vehicle identification, enhanced physical security, and law enforcement notification, when necessary, to mitigate the threat.