Thomas Crooks bought rifle parts on Amazon under the name "Bob Dole." He routed his internet traffic through CyberGhost VPN, browsed with Bravenet Browser, and communicated through encrypted email providers GMX and Mailfence. He was twenty years old, had no friends, and had never shown interest in girls.
He also nearly killed the President of the United States in Butler, Pennsylvania.
Newly reviewed federal records fill in what two years of official narrative have carefully left vague. The picture that emerges isn't the "disturbed loner" shorthand we've been fed. It's a methodical operator who understood digital footprints, used pseudonyms for procurement, and took specific steps to avoid detection while acquiring the tools to assassinate Donald Trump.
The records show Crooks used the "Bob Dole" alias on Amazon to order parts, tools, and items designed to increase the capacity of his rifle. When his father, Matthew Crooks, raised concerns after his Citizens Bank account was hacked — with fraudulent charges appearing on BetMGM — Thomas pushed back. He argued that privacy tools made them "less likely to be compromised by outside actors." A twenty-year-old was lecturing his father on operational security.
Matthew Crooks warned his son that "simply using a pseudonym would not necessarily protect the buyer from being hacked." The father's concern was about consumer fraud. The son's concern, we now know, was about something considerably darker.
The personal profile in the records reads like a clinical case file. Crooks was described as emotionless since birth. He frequently talked to himself. He became obsessed with guns during his teenage years. The family lacked significant financial means — so limited, according to the records, that they could not afford their own son's funeral after he was killed by Secret Service counter-snipers.
Mary Crooks, Thomas's mother, took leave from work afterward to "process the situation." Matthew Crooks took early retirement. The family unit dissolved quietly while the rest of the country was still arguing about how a kid with a rifle got within range of a presidential candidate at an outdoor rally.
That's the question these records sharpen rather than answer. We now know Crooks wasn't browsing with Chrome and ordering gun accessories under his real name on a shared family Prime account. He was running layered digital concealment — VPN, encrypted email, alias purchases — the kind of tradecraft that would make a cybersecurity consultant nod approvingly. And none of it triggered a single flag at any federal agency.
The FBI had two years to explain how its surveillance apparatus, the same one that tracks grandmothers who walked through the Capitol rotunda, missed a young man running encrypted communications while stockpiling rifle modifications under a fake name. The records don't contain that explanation. They contain the evidence that should have generated one.
A family that couldn't pay for a burial somehow produced a son fluent in counter-surveillance. A kid with zero social connections executed a procurement and operational security plan that went undetected through every layer of federal monitoring. The agencies that catalog our metadata, flag our bank transactions, and monitor our keyword searches had nothing on Thomas Crooks until he was on a rooftop in Butler with a clear line of sight.
Two years of records, and the question is exactly where it started: not how a troubled kid got radicalized, but how every system designed to catch exactly this missed every signal he was sending.
