Thomas Crooks was pacing next to a warehouse building outside the Butler Farm Show grounds as a crowd gathered for one of former President Donald Trump's signature outdoor rallies.

Crooks had already been flagged as suspicious by law enforcement. By the time two police officers walked over to check him out, he was on the roof, belly crawling.

“He’s got a gun,” a bystander yelled.

One officer hoisted the other to the lip of the roof. As the officer pulled his head over the edge, a long-haired young man wearing glasses turned toward him, wielding an AR-15 -style rifle. The officer dropped back to the ground, the Butler County sheriff told Reuters.

Crooks, an introverted 20-year-old computer whiz who had just earned a spot at a college engineering program, turned back to his target about 400 feet away. He squeezed off several shots at Trump, clipping the former president’s ear, killing an audience member and wounding two others before Secret Service snipers on a nearby building killed him with counterfire.

This account of the first assassination attempt to injure a U.S. president since 1981 is based on interviews with more than two dozen people, including law enforcement officials, Crooks’ school associates and witnesses who attended the rally, along with public records and news accounts.

Crooks fired his rifle at approximately 6:10 pm, according to a Reuters photographer at the rally. Trump winced and grabbed his right ear. Secret Service agents tackled the former president and some supporters dived for cover. A bullet hit what appeared to be the hydraulic line of a forklift that held a bank of speakers to the right side of the stage. Fluid spewed across the crowd and the lift's arm collapsed. To the left, screams erupted where a spectator had been fatally shot.

As Secret Service agents tackled the former president, some supporters scrambled for safety. Others grabbed children and hustled towards the gates.

"The audience wasn't like what you'd expect out of a crowd that just experienced something like this,” said Saurabh Sharma, a Trump supporter sitting near the front. “Everyone was really quiet. There were a few women crying. They were, you know, saying, ‘I can't believe they tried to kill him’.”

Four days after the assassination attempt, a coherent picture of the moments before the shooting was emerging. But Crooks’ ideology and reasons for pulling the trigger remained a mystery.

A review of Crooks’ phone by the Federal Bureau of Investigation found he had searched for images of both President Joe Biden and Trump, as well as other famous figures, in the days before the shooting, the New York Times reported on Wednesday, citing U.S. lawmakers briefed on the law enforcement investigation.

Crooks had been searching for the dates of Trump’s public appearances and of the Democratic National Convention, the report said. He had also looked up “major depressive disorder” on his phone, the Times said. Reuters was unable to independently confirm the report.

The shooting comes amid a years-long rise of political violence and threats in the U.S. When that violence turns deadly, it has been more likely to be perpetrated by people on the American right, according to a Reuters analysis published last year. But the ideological motivation behind Saturday’s attack remains unclear.

POLITICALLY DIVIDED TOWN

Crooks seemed to have a bright future, said two people who knew him at the Community College of Allegheny County, where he graduated in May with a two-year associate’s degree in engineering.

One college instructor told Reuters that she had gone back through his assignments this week, bewildered that the conscientious student who distinguished himself by going “above and beyond” could have turned murderous.

The instructor, who declined to be identified, said his homework responses were thoughtful and his emails polite. He excelled at an assignment to redesign a toy for people with disabilities. “He did a chess set for the blind. He 3D-printed it. He put the Braille on it. He talked to experts in the field,” she recalled. “He really took a lot of care.”

Crooks made less of an impression on classmates. Samuel Strotman, also enrolled in CCAC’s engineering program, took two online classes with Crooks. Strotman said Crooks never spoke in the lectures and had his camera turned off.

A college employee who knew Crooks said he was quiet but pleasant. “It's just very, very, very unexpected,” the employee said. Crooks had seemed interested in pursuing a career in mechanical engineering, the employee said.

The college closed its engineering program on June 30. Crooks was planning to continue his engineering education at nearby Robert Morris University, that school confirmed.

Most recently, he worked as a dietary aide at a nursing home, where he “performed his job without concern,” the center said. The job was down the street from his home in Bethel Park, a middle-class suburb of Pittsburgh, where he had lived in a modest brick home with his parents and older sister.

At Bethel Park High School, where he graduated in 2022, he kept a low profile, according to classmates. One former classmate told The Philadelphia Inquirer that Crooks expressed conservative views in a history class where other students leaned liberal. Others said his views were never apparent. His photo was missing in his senior yearbook, with his name listed under “not pictured.” He enjoyed gaming and building computers, a classmate told Reuters.

Crooks’ town, Bethel Park, is divided almost down America’s political middle. In the 2020 election, Trump eked out a 65-vote margin in the borough of about 33,000 people, results show.

The political split showed up in the Crooks household. Thomas was a registered Republican. His father is a Libertarian and his mother is a Democrat, voter registration records show. Both are social workers. When Crooks was 17, he made a $15 donation to a political action committee earmarked for a Democratic turnout group, according to federal election data.

His school counselor Jim Knapp, who retired in 2022, said Crooks rarely came across his radar because he wasn’t a “needy type kid.” Knapp occasionally checked on him at lunch because he was sitting alone. “I’d say, ‘Do you want to sit with somebody?’ And he’d say, ‘No, I’m okay by myself,’” Knapp recalled.

Former high-school classmate Max Rich said Crooks was shy and “never seemed like the type” to commit such violence. He left virtually no digital footprint. He spent time on Discord, a gaming platform, but the company said it found “no evidence that it was used to plan this incident, promote violence, or discuss his political views.”

Crooks was a member of the local Clairton Sportsmen's Club, a gun club. He was wearing a shirt advertising “Demolition Ranch,” a YouTube channel for firearms enthusiasts, when he was killed. After the shooting, Matt Carriker, a Texas veterinarian who runs the Demolition Ranch channel, posted a video on X saying he was “shocked and confused” to learn that Crooks was wearing his channel’s merchandise. “We keep politics out of it,” he said, adding that he did not know and had never met or communicated with Crooks.

HOMEMADE BOMBS & AMMUNITION

Crooks appeared to spend at least some time preparing for the Trump event. He bought ammunition on the day of the rally, stopping at a gun store in his hometown of Bethel Park to pick up 50 rounds, according to a joint bulletin issued this week by the Department of Homeland Security and the Federal Bureau of Investigation, which is leading the investigation.

He built three homemade bombs – two found in his car and another in his home, according to the bulletin, which was reviewed by Reuters. In the preceding months, the bulletin noted, Crooks had received “multiple packages, including some marked as possibly containing hazardous material.”

At the rally, Crooks caught the attention of local law enforcement while pacing around the grounds before Trump took the stage. One officer called in a report of a suspicious person and snapped a photo that was distributed electronically to other officers at the scene, according to Butler County Sheriff Michael Slupe, a Trump backer who was seated near the front of the rally as a special guest.

As two Butler Township Police officers responded to the call, people in the crowd already had noticed a man on the roof. Some yelled that he had a gun, according to crowd-shot video reviewed by Reuters. Slupe told Reuters the officer who initially pulled himself onto the roof had no time to unholster his gun when Crooks turned on him, leaving him no option but to drop back to the ground.

Secret Service officials have said their agency is responsible for securing the area within the event’s security perimeter; the building used by Crooks was just outside it. But some former agency officials and other security experts have disputed that contention, arguing that buildings with a direct sight line and within firing range of the former president should have been swept and under constant surveillance by the service’s sniper teams.

Local officials have bristled at any suggestions that town or county law enforcement was responsible for securing the building.

“The Butler Township Police Department had no security detail for this event,” Butler Township commissioner Edward Natali wrote in a Tuesday post on Facebook, noting that the township had seven officers on site solely for traffic duty. Even though the officer who confronted Crooks on the roof had to fall back, he added, the encounter “most likely forced the shooter to hurry his shots.”