OAN Staff Brooke Mallory, Sophia Flores and Blake Wolf
9:52 AM – Sunday, July 13, 2025
Before Thanksgiving, in 2023, Thomas Crooks led a “fairly typical” online life for a 20-year-old — scrolling through social media, streaming music, and browsing a slew of left-wing and right-wing news websites.
However, behind this seemingly ordinary facade, a dark plan for mass violence was quietly taking form. To carry it out, Crooks compartmentalized his existence — a skill that he had honed since childhood, when he kept most people at a distance.
His few friends and acquaintances knew very little about his private life or his close-knit family, rarely being invited to the Crooks household to hangout or socialize.
Nonetheless, by late 2023, Crooks had shifted to harboring a more sinister set of secrets: assembling homemade improvised explosive devices in his bedroom and plotting an assassination, all while outwardly pursuing a career in engineering.
Then, on July 13, 2024, Crooks targeted an election rally for President Donald Trump in the small town of Butler, Pennsylvania, “firing eight shots” from a rooftop — with each one narrowly missing its mark, yet coming alarmingly close to altering the course of American history.
According to intelligence agencies at the time, he allegedly “left behind no manifesto,” and “no explanation” for his attempt on the future 47th president’s life.
Now, in the year since the shooting, investigators and those who knew him have still struggled to piece together what compelled Crooks to climb that roof in Butler — still facing a slew of unanswered questions.
CBS News has since conducted an investigation, which the outlet argues offers the most comprehensive portrait to date of the reclusive young student. It draws upon interviews with more than two dozen friends, professors, law enforcement officials, and others, as well as open records requests from multiple agencies and a meticulous review of thousands of documents.
Born in 2003, Crooks spent his entire life in a suburban home, purchased by his parents, before he and his older sister were born.
Nestled on a tree-lined street in Bethel Park, Pennsylvania, just outside Pittsburgh, the house was the backdrop to his childhood. Growing up, Crooks reportedly enjoyed Legos, adored his cat, built and crafted model airplanes, was a Pittsburgh Steelers fan, and enjoyed cooking with his family.
Both of his parents were social workers who took great pride in their professions. In 2008, his father, Matthew, registered the family coat of arms online, expressing a hope to pass down to his children a deep sense of unity alongside the values of generosity, sincerity, hope, joy, and service to the country, according to CBS News.
Crooks often prepared dinner alongside his mother, a registered Democrat, who is visually impaired. During the holidays, the entire family pitched in on the cooking effort as a time of bonding.
“For Thanksgiving, me and my dad will cook turkey and mashed potatoes together. At Christmas, me and my mom will bake dozens of cookies together, and on New Year’s Eve, my mom and I will bake the pork and the sauerkraut together,” Crooks said in a video that he previously recorded for a college class.
As a child, Crooks met a boy named Tristan Radcliffe in kindergarten. They quickly became friends and would go on to share lunches throughout elementary, middle, and high school. Their friendship reportedly continued as the two men went on to enroll at the same college.
“I’ve known Tom, like, all of my life,” Radcliffe stated. “He was cool. You know, he was kind of just Tom to me.”
However, strange aspects about Crooks remained constant over the years: despite seeing each other almost daily, Radcliffe admitted that there was still not a lot that he knew about his “friend.” Crooks never invited him over, and would rarely, if ever, talk about his family.
Nonetheless, Radcliffe still described him as a “nice” boy who “kept to himself.” Additionally, neighbors echoed this sentiment, noting that the whole family kept to themselves and “rarely had visitors or socialized much with others on the block.”
“He always seemed like he focused on his work more, you know, like he came off smart,” Radcliffe continued.
Crooks’ grades and test scores reflected his academic strength. He earned a 1530 on the SAT, placing him in the 99th percentile nationally. In 2022, he enrolled at the Community College of Allegheny County, telling an adviser that he was saving money before transferring to a four-year engineering program.
As the cramped classrooms and crowded hallways of high school gave way to the sprawling campus and remote classes of commuter college, Crooks’ social ties gradually faded — allowing much of his private life to go unnoticed.
According to the findings of the investigation, his teachers were consistently impressed by his work, frequently praising his effort and dedication. One even emailed to commend Crooks for “getting such an early start” on a project, while another thanked him for his valuable contributions throughout the semester. According to former engineering professor Patricia Thompson, Crooks stood out clearly among his peers.
“I thought he was a star student. He had his head on straight and he was on a path [to] success,” Thompson said.
However, another strange element of the investigation revolved around how “Crooks did not leave a lasting impression. Several former students said they did not realize he had been in the same class. Even some who had emailed and worked on projects with Crooks said they couldn’t recall interacting with him.”
“I currently only live with my Mom and Dad. There are no other adults in my house and I have one sister who lives nearby that could potentially come over to be part of this audience,” Crooks previously wrote. “I do not have access to any other adults.”
During the summer, in 2023, Crooks purchased a firearm from his father for $500 and joined a local shooting range. He quickly became a regular at Clairton Sportsmen’s Club, about nine miles from his home, logging more than 40 visits to the rifle range in the final 11 months of his life, according to records.
Around the same time, records obtained by CBS News also revealed that he began using encryption services and VPNs that he believed would hide some of his internet activity, alongside more typical online visits to sites like Facebook, Instagram, TikTok, and X.
However, that fall, his habits shifted rapidly. To his professors, Crooks still at least appeared focused on earning straight A’s and preparing applications for engineering programs at the University of Pittsburgh and Robert Morris University. Yet, his online activity suggested his attention was elsewhere. He increasingly used an encrypted email service called Mailfence and a virtual private network (VPN) named Mullvad — tools people use when they wish to keep their online life private.
Nonetheless, intelligence agencies have been known to target or even operate VPN services as part of surveillance operations, as those who use these services typically have “something to hide,” which could make them a suspect in an investigation.
An analysis by CBS News of Crooks’ internet usage revealed a growing interest in news, explosives, ammunition, and secrecy in general. The records, covering nearly a year of his activity on his college’s Wi-Fi network, show hundreds of visits to a wide range of sites — from academic emails and discussion boards to bank accounts, news outlets, gaming platforms, social media, weapons blogs, and Steelers fan pages.
“Logs of Crooks’ on-campus internet activity, which CBS News obtained through a public records request, indicate that in the last months of his life, he became increasingly rigid about secrecy, shrouding his activities through encrypted services. Two particular days — Dec. 6, 2023, and Jan. 24, 2024 — stand out. On Dec. 6, 2023, Crooks checked various news sites and the White House website’s archives from Mr. Trump’s first administration, followed by visits to firearms websites. The following month, on Jan. 24, Crooks showed the single largest number of internet requests in the logs, at 1,364. He started to consistently use the VPN after that day,” the outlet reported.
However, not every day during that period was the same. Crooks occasionally shopped for and researched ammo, firearms, and other weapon-related accessories.
After Thanksgiving break, Crooks dramatically increased his online news consumption — visiting more news sites in just eight days than he had in the previous three months combined.
January 24, 2024, marked the peak of his internet activity, with a record 1,364 requests logged in a single day. Around this time, he also began consistently routing his traffic through Mullvad, a virtual private network designed to conceal online activity. Following that day, the logs show activity on 25 additional days — but nearly all entries are limited to just a handful of requests, all directed to Mullvad.
In December 2023, just a month before his final semester began, Crooks’ life appeared to split in two. On one hand, he was focused on his college applications — on the other, he was increasingly consumed by thoughts of mass violence.
On one day, he emailed himself to review a draft of his personal statement. On another, he contacted customer service to complain about a delayed shipment of explosive fuel. Investigators later determined that Crooks had the knowledge and means to build bombs in his bedroom — without his parents ever knowing.
Around this time, a few people close to Crooks also began to notice troubling changes in his behavior.
According to excerpts from a Pennsylvania State Police report — made public in December by a House task force investigating the assassination attempt — his father later told investigators that, in hindsight, he had noticed signs of his son’s mental health deteriorating.
“Crooks’ father explained that within the last year he observed several instances of his son dancing in his bedroom throughout the night,” an investigator told the outlet. “He would occasionally see Crooks talking to himself with his hands moving, which he expressed as uncommon and had become more prevalent after he had finished his last semester.”
Radcliffe, his friend, similarly noticed strange changes to Crooks behavior when he bumped into him on campus as well.
“He would always move his legs around a lot, and he would kind of talk pretty fast,” Radcliffe recalled, suggesting that he possibly had ADHD, mania (Bipolar), or was on some sort of amphetamine.
Crooks eventually graduated from community college in May 2024. On June 14th, less than a month before the assassination attempt, he sent one final email from his college account. It was addressed to the registrar, asking when he could expect to receive his diploma.
In the month leading up to July 13th, Crooks shifted his focus to the presidential campaign, conducting more than 60 online searches related to both candidates. According to the FBI, his queries included “DNC convention” and “when is the RNC in 2024,” both searched on July 5th.
He visited the Butler Farm Show grounds in person on July 7th and later searched online for “butler farm show photos,” investigators said. He also looked into AGR International, a company with buildings adjacent to the showgrounds. Then, on July 12th, the day before the attack, Crooks made one final visit to the rifle range.
On the morning of July 13th, he drove to the Butler Farm Show grounds and stayed for just over an hour before returning home.
At around 1:30 p.m., investigators say that Crooks retrieved his rifle — the same one he purchased from his father the year before. His father told investigators that he believed his son was simply “heading to the range.”
Crooks also stashed a drone and two homemade bombs in his trunk before purchasing ammunition and returning the the Butler Farm Show grounds.
Back at the rally, Crooks was able to fly his drone for around 12 minutes as supporters of then-candidate Donald Trump ecstatically lined up outside of the venue, seemingly engaging in recon to view the podium positioning where Trump was scheduled to speak.
Local authorities first noticed Crooks at around 5 p.m., noticing that he was isolated from the crowd.
“He was walking around the grassy area between AGR and the secondary fence line, kept looking up, looking at the building. One point that is what raised my suspicion is he was looking directly at the window I was positioned at,” a sniper told investigators.
Authorities reportedly kept tabs on Crooks, as just after 6 p.m. a local police officer told investigators that he saw Crooks grab a backpack before he “took off running.”
Officers quickly chased after Crooks, who “disappeared” between buildings in the area, which was described as an “organizational failure within the Secret Service,” according to Secret Service deputy director Matt Quinn.
Nevertheless, rallygoers began alerting law enforcement at 6:02 p.m. after noticing Crooks on the rooftop.
A few moments later, at 6:11 p.m., a local Butler detective attempted to engage with Crooks on the roof, before quickly falling backwards as Crooks aimed his firearm at the detective.
“I see Crooks facing downrange towards the stage, but his eyes are back at me as I’m coming up. And I would say, like, his facial expression was surprised. His eyes were very big, like, what are you doing up here?” the Butler detective stated.
In the seconds following the exchange, Crooks began opening fire, letting off eight shots in total. Firefighter Corey Comperatore was killed, while President Trump and two others were injured.
The Secret Service was then quickly able to return fire at Crooks, killing him on the spot.
The chaos of the shooting culminated into the unforgettable moment Trump rose to his feet after coming millimeters away from death and chanted “Fight! Fight! Fight!”
The same night the shooting took place, around 10:45 p.m., covert surveillance of the Crooks home was taking place. However, 11 minutes later, Crooks’ father dialed 911, expressing his worry that his son has not returned home after he claimed to be going to the gun range much earlier that day.
As officers responded to the call, Crooks’ father, Matthew Crooks, asked “Is it true?” after a CNN reporter called and stated that his son “shot Trump.”
Investigators then questioned Crooks’ family and anyone who had contact with Crooks, visited the local gun store where he purchased the ammunition, and investigated his online activity.
Since then, questions remain as to Crooks’ motive, as he seemingly left no explanation or inclination as to why Trump was targeted.
Crooks’ parents have declined to accept interview requests, while a neighbor described the family’s presence on the street as “ghostlike.”
Former engineering professor Patricia Thompson has since reflected on Crooks’ life, questioning the motive behind the shooting.
“Why would this kid who had his whole future, you know, laid out for him, [a] positive future — why would he do something like this?” Thompson questioned.
Stay informed! Receive breaking news blasts directly to your inbox for free. Subscribe here. https://www.oann.com/alerts