On some days, he left little trace of his activity, choosing instead to first turn on Mullvad. Virtual private networks, known as VPNs, route a user’s web traffic through encrypted tunnels, hiding their activity from prying eyes, such as a college’s web tracking security software. While Crooks was using Mullvad, his browsing history was effectively sealed off.
Mullvad CEO Jan Jonsson told CBS News that the VPN service used by Crooks was designed to “provide anonymity, censorship circumvention and surveillance protection.”
“This sadly also means that if somebody abuses the service for nefarious purposes, we cannot block that individual user and unfortunately can’t provide any additional information about them,” Jonsson said.
In December 2023, a month before Crooks’ final semester started, his life began to split in two. He was focused on his college applications, and at the same time fixated on mass violence. One day, he emailed himself to review his personal statement for his application; on another, he emailed customer service to complain that the explosive fuel he ordered had not yet shipped. Investigators later concluded he would have been able to engineer bombs in his bedroom without his parents knowing.
Around this time, some in Crooks’ life did notice erratic behavior.
Crooks’ father told investigators that, in retrospect, he spotted signs of his son’s declining mental health, according to excerpts of a Pennsylvania State Police report. Those excerpts were first made public in December by a House of Representatives task force on the attempted assassination.
“Crooks’ father explained that within the last year he observed several instances of his son dancing in his bedroom throughout the night,” a Pennsylvania investigator wrote. “He would occasionally see Crooks talking to himself with his hands moving, which he expressed as uncommon and had become more prevalent after he had finished his last semester.”
Radcliffe noticed similar changes when he bumped into Crooks on campus.
“He would always move his legs around a lot, and he would kind of talk pretty fast,” Radcliffe recalled.
Crooks graduated from community college in May 2024. On June 14, less than a month before the assassination attempt, he sent one last email from his community college account.
It was to the registrar. Crooks wanted to know when he’d receive his diploma.
Searching for the opening he needed
In the month before July 13, Crooks turned his attention to the presidential campaign, researching the candidates online more than 60 times, including searches on July 5 for “DNC convention” and “when is the RNC in 2024,” according to the FBI. He visited the Butler Farm Show grounds in person on July 7, and searched for “butler farm show photos,” according to investigators. He also researched AGR International, a company with buildings adjacent to the grounds.
The day before the attack, July 12, Crooks made one last visit to the rifle range.
On the morning of the attack, Crooks drove to the Butler Farm Show grounds, and stayed for a little more than an hour before driving home.
Investigators said that at about 1:30 p.m., Crooks got his rifle from the house. It was the gun he had purchased from his dad the year before. Crooks’ father told investigators he believed his son was going to the range.
In addition to the rifle, Crooks put a drone and two homemade bombs in his trunk, along with remote transmitters capable of detonating them from more than 1,000 feet away. He left a partially assembled explosive device in his bedroom.
Crooks went to a store near his home and bought ammunition, according to investigators, and then returned to the Butler Farm Show grounds. As Trump supporters lined up to enter the highly publicized rally in the height of the presidential campaign, Crooks took a drone out of his car and flew it over the rally site for nearly 12 minutes, beginning at 3:51 p.m., potentially using the drone’s cameras to view the podium where Mr. Trump would soon speak.
Three local police officers first noticed Crooks around 5 p.m. One officer, a sniper, said Crooks “stood out.” Crooks was alone, the officers noted, and he wasn’t paying attention to the campaign festivities.
“He was walking around the grassy area between AGR and the secondary fence line, kept looking up, looking at the building. One point that is what raised my suspicion is he was looking directly at the window I was positioned at,” the sniper told investigators. The AGR building was approximately 150 yards from where Mr. Trump was speaking.
Local officers began keeping tabs on Crooks. One saw him using a rangefinder and snapped photos of him. At 5:39 p.m., one officer suggested notifying the Secret Service about the suspicious young man.
After Action Beaver County ESU/SWAT Report 
A Pennsylvania State Police sergeant later told investigators that he alerted Secret Service personnel to the suspicious person. Congressional task force investigators said there’s no indication that message reached Secret Service personnel on the stage or in charge of security.
Just after 6 p.m., an officer saw Crooks near a picnic table, and watched him grab a backpack before he “took off running,” one local officer told investigators. Officers began to leave their posts to look for Crooks, who had seemingly disappeared between two buildings.
Butler County District Attorney Richard Goldinger said in an interview with CBS News that poor planning and communication gave Crooks the opportunity he had been seeking.
“Local police weren’t apprised of the Secret Service’s security plan until the afternoon of the shooting,” Goldinger said. “It was never specified to local law enforcement that they were assigned to secure the area where Crooks was able to climb onto the building.”
Secret Service deputy director Matt Quinn said the agency tasked with protecting Mr. Trump bears responsibility for what happened next.
“I would ask Americans to understand that it was an organizational failure within the Secret Service, and we are laser focused on making sure that it never happens again,” Quinn said.
At 6:02 p.m., Mr. Trump took the stage. Crooks ascended to the rooftop three minutes later. Panicked bystanders began calling the police.
At 6:11 p.m., moments before Crooks opened fire, a Butler detective decided to pursue Crooks on the roof. He later described to congressional investigators the look on Crooks’ face as the detective began to pull himself up.
“I see Crooks facing downrange towards the stage, but his eyes are back at me as I’m coming up. And I would say, like, his facial expression was surprised. His eyes were very big, like, what are you doing up here?” the local detective said.
Crooks turned his gun toward the detective, who fell backwards and immediately radioed that the suspect was armed. The message never made it to the security detail for Mr. Trump.
A few seconds later, Crooks fired eight shots, killing firefighter Corey Comperatore, injuring Mr. Trump and two others. A Secret Service sniper returned fire, hitting Crooks in the face and killing him.
“The shooter is down. He’s down hard,” a local police officer radioed. Mr. Trump was swarmed by Secret Service agents trying to remove him from the stage.
“Wait,” Mr. Trump said, before he stood, raised his fist and yelled to the crowd, “Fight! Fight! Fight!”
