When Joel Cauchi walked into Bondi Junction Westfield with a concealed weapon, few could have predicted what would happen next.
Moments after entering the shopping centre in April, Cauchi produced a knife and went on a stabbing rampage, killing six people and injuring a dozen more before being shot dead by a police officer.
Weeks later, Adelaide's Westfield Marion centre was locked down after an altercation between armed teenage boys escalated, sending crowds streaming and screaming out of emergency exits.
But one Australian security and behaviour expert says there are behavioural "tells" that might help security teams identify pre-violence indicators that could help prevent such armed attacks taking place.
Scott Taylor has spent more than a decade training with the likes of the former head of the FBI behaviour unit and lead interrogator at Guantanamo Bay, learning to detect the signs of someone who is about to stage an attack.
"My initial intent was from a terrorism point of view and mass gatherings - if I can pick people that have bad intent before they get to these areas, then we can give some advice and support, even from control rooms or CCTV," he told AAP.
Mr Taylor has trained in body language, facial micro-expressions, deception detection, influential behaviours and statement and word analysis, and is bringing this knowledge to security teams around Australia with his consultancy Praesidium Risk and Resilience.
"There's body language tells that people do when they have bad intent and so we teach people how to pick those," Mr Taylor said.
"How to pick people who are going to steal before they steal, and who's got violent aggressive tendencies as well.
"People with good intentions want to be noticed, people with bad intentions don't."
Shoplifters tend to move their arms up to 15 per cent less than anybody else; they keep their head down, their blink rate increases.
If they are stopped by security and want to get away, their feet will often be pointed away from the guard.
Armed attackers also display "unusual changes to baseline behaviour".
They will frequently check the place where they have concealed their weapon and are "more people-centric, rather than item-centric around the shopping centre".
No security guard has the right to act on just these suspicions, Mr Taylor clarifies. In fact, they have no more legislative powers for arrest and use of force than an everyday citizen does.
But if suspects can be identified and monitored, guards can be better prepared if an attack is launched, he says.
The next challenge is getting civilians to safety, but that has its own hurdles.
"People have got their heads in devices and they've got two noise-cancelling headphones on, so they wouldn't even hear the audible warnings," Mr Taylor said.
And passers-by can sometimes whip out their phone and start filming rather than run to safety.
"People disassociate from what's in front of them ... meaning they react too late to the threat."
As well as putting themselves at risk, they are also potentially signalling to others that there is no immediate danger, which stops them from taking action.
They should focus on getting as far away from the site as possible, he says, even if that means leaving others behind.
"You don't stop and talk people into coming with you, because the longer you stay around, the more likely you are to become a target as well," he said.
Mr Taylor believes security guards should be offered additional training but also be fitted with stab-proof vests.
But watching for behavioural changes is something everyone can do ahead of time.
"If you are around people and there's sudden behavioural changes, they start talking about aggressive incidents, getting their affairs in order, all these sort of things: be mindful, escalate it, report it," he said.
