The young man was pacing around the edges of the Donald Trump campaign rally, shouldering a big backpack and peering into the lens of a rangefinder toward the rooftops behind the stage where the former president would stand.
His behavior was so odd, so unlike that of the other rallygoers, that local law enforcement took notice, radioed their concerns and snapped a photo. But then he vanished.
The image was circulated by officers stationed outside the security perimeter on that hot, sunny Saturday afternoon. But the man didn't appear again until witnesses saw him climbing up the side of a squat manufacturing building that was within 135 meters (157 yards) from the stage.
That's where he opened fire, six minutes after Trump began speaking, in an attempt to assassinate the presumptive GOP presidential nominee. The gunman killed one rallygoer and seriously wounded two others. Trump suffered an ear injury but was not seriously hurt, appearing just days later at the Republican National Convention in Milwaukee with a small bandage over the wound.
Now come the questions, and there are plenty. Multiple investigations have been launched, both into the crime itself and how law enforcement allowed it to happen. It's becoming increasingly clear this was a complicated failure involving multiple missteps and at least nine local and federal law enforcement divisions that were supposed to be working together. Law enforcement has also warned of the potential for copycat attacks and more violence.
This story is based on interviews with eight law enforcement officials, some of whom spoke to The Associated Press on condition of anonymity to discuss the investigations into the attempt on Trump's life.
Multiple agencies work together to secure events
The Secret Service always partners with local law enforcement when a president, political candidate or other high-level official comes to town, and Saturday's rally was no different. An advance team comes early to scope out the scene and identify potential areas of concern. They order vehicles moved. They set up barriers. They block off roads.
In some larger cities, one or two local agencies may work alongside the federal teams. In more rural areas, one local agency won't have enough manpower so multiple agencies are often involved. On Saturday, the show of force included members of at least six different agencies, including two sheriff's offices, local police, state police and multiple teams within the Secret Service, plus fire and emergency rescue officials. Within those agencies are individual divisions that have different duties.
In theory, more manpower is better. But it can often create communication problems, and it's unclear how the information about Thomas Matthew Crooks was transmitted. For instance, it's not clear how widely his photo was circulated or whether everyone was equally aware of the potential threat.
All the extra officers can be a drain on resources, leaving agencies stretched thin. The Secret Service at any given time is protecting the president, candidates and others, plus running point on major national security events. It's the same for local police, who told the Secret Service they didn't have enough people to station officers outside the building all day.
The Secret Service controls the area inside the perimeter, after people pass through metal detectors. Local law enforcement is supposed to handle outside the perimeter.
Reports of someone on the roof
The shooter, later identified as Thomas Matthew Crooks, disappeared from the crowds of Trump supporters decked out in red, white and blue. The stream of supporters entering through the metal detectors was slowing. Trump was getting ready to go on.
The rooftop from which Crooks fired is in a complex of buildings that form AGR International Inc., a supplier of automation equipment for the glass and plastic packaging industry. The building was closed for the day, except to law enforcement.
Crooks was spotted again when members of a local SWAT team, stationed inside the building complex, noticed him walking around and looking at the roof. One officer took a photo of Crooks and radioed to others to be on the lookout for a suspicious person looking through a rangefinder — a small device resembling binoculars that hunters to measure distance from a target.
Not long after, witnesses reported seeing him scaling the squat building closest to the stage. He then set up his AR-style rifle and lay on the rooftop, a detonator in his pocket to set off crude explosive devices that were stashed in his car parked nearby.
Outside, a local officer climbed up to the roof to investigate. The gunman turned and pointed his rifle at him. The officer did not — or could not — fire a single shot. But Crooks did, firing into the crowd toward the former president and sending panicked spectators ducking for cover as Secret Service agents shielded Trump and pulled him from the stage. Two countersniper teams were stationed on buildings behind Trump, and the team further away from Crooks fired once, killing him.
Many investigations, few answers
“We are speaking of a failure,” Homeland Security Secretary Alejandro Mayorkas told CNN. “We are going to analyze through an independent review how that occurred, why it occurred, and make recommendations and findings to make sure it doesn’t happen again.”
House Oversight Committee Republicans have subpoenaed Secret Service Director Kim Cheatle. House Speaker Mike Johnson said he would set up a task force to investigate, and some Republicans have called on Cheatle to resign. Security has been stepped up for Trump and President Joe Biden, and independent presidential candidate Robert F. Kennedy Jr. also received a protective detail.
Biden has ordered an independent review of the shooting. The Department of Homeland Security’s inspector general also opened an investigation into the Secret Service’s handling of the shooting.
But it's a big task. There were special agents, presidential protective teams, counterassault and countersniper teams all there that day. There were also roughly 50 firefighters and emergency personnel, plus dozens of officers from the Butler Township police, deputies from Beaver County and Butler County and Pennsylvania State Police troopers.
It will take weeks — if not months — to interview all the officers involved and determine exactly how Crooks was able to pull off the most serious attempt to kill a president or presidential candidate since Ronald Reagan was shot in 1981.
The shooter had prepared for carnage. Investigators found he brought multiple loaded magazines. He also bought 50 rounds on the day of the shooting. The rifle was purchased legally by his father years earlier.
Investigators found a bulletproof vest in his car and another rudimentary explosive device at his home, where over the past few months he had received several packages, including some that had potentially hazardous material. The FBI gained access to Crooks’ cellphone, scoured his computer, home and car, and interviewed more than 100 people so far.
But the investigation has failed to lift the mystery surrounding the biggest question: Why did he do it?
