How Did Thomas Matthew Crooks Get So Close to Killing Donald Trump?

Written By James Taylor
Why Was the Rooftop at Trump’s Butler Rally Left Unsecured?

Butler 2024: How Secret Service Failures Exposed Donald Trump

At Butler, A Man Identified As Suspicious More Than Ninety Minutes Earlier Was Still Able To Open Fire On Donald Trump.

On 13 July 2024, Donald Trump walked onstage at the Butler Farm Show grounds in Pennsylvania to address a campaign rally. The former president was surrounded by a protective operation involving the United States Secret Service, state police and several local law-enforcement agencies. Counter-sniper teams were positioned around the site. Spectators had passed through checkpoints. The event appeared to have the layers of security expected around a former president and major presidential candidate.

At approximately 6:11 pm, Thomas Matthew Crooks fired eight rounds from the roof of a nearby industrial building. Trump was wounded in the right ear. Corey Comperatore, a former volunteer fire chief attending the rally with his family, was killed; David Dutch and James Copenhaver suffered serious injuries. A Secret Service counter-sniper killed Crooks, ending the attack. The most consequential fact to emerge afterwards was not simply that a rooftop had been left exposed. It was that officers had noticed Crooks long before he fired, while the people directing Trump’s movements remained unaware of the developing danger.

Congressional investigators, an independent review panel, the Secret Service itself and the Department of Homeland Security inspector general have since reconstructed a chain of failures. Each inquiry approached the event differently. Together they describe defective advance planning, fractured communications, missed opportunities to question Crooks, inadequate specialist coverage and a breakdown in the decision-making system that should have brought Trump off the stage.

This investigation examines that evidence in chronological order. It also separates what is established from what remains unknown about Crooks’ intentions. The central question is not how a sophisticated foreign assault overcame an impregnable defence. It is how a series of preventable decisions permitted a local gunman to exploit an obvious vulnerability.

The Industrial Building Outside The Perimeter

The American Glass Research International complex, widely abbreviated AGR, stood near the rally grounds. Parts of the property offered an elevated line of sight towards the stage at a distance of roughly 130 yards. Security specialists recognise elevated views as an important issue in event planning, particularly when a protected speaker will remain in one place for a sustained period. Yet the complex was not included within the event’s inner security perimeter.

The distinction between an inner and an outer perimeter matters, but it does not by itself resolve responsibility. An outer area may be covered by local partners under the Secret Service’s overarching coordination. The independent review panel found that no federal, state or local personnel had been specifically tasked with securing the AGR roof or its immediate surroundings. Local counter-snipers were assigned positions inside the complex, but their understanding of their duties did not include protecting every exterior approach to the building.

This created a contradiction: officers were present within a group of buildings that contained an exposed rooftop, yet that rooftop was not reliably controlled. A passing observer might assume the presence of armed law-enforcement personnel meant the whole complex was secured. The official investigations found that such an assumption was not justified. Responsibilities had been divided without ensuring that every dangerous area was covered.

The independent panel stressed that the debate over whether AGR should have been described as inside or outside the inner perimeter was secondary. Whatever label planners used, a recognised elevated position near the stage needed an accountable security plan. The House task force reached a similar conclusion: the flaws were not confined to a boundary line on a map, but extended to the failure to confirm that assigned responsibilities were understood and fulfilled.

A Line Of Sight Was Identified But Not Neutralised

The building was not a threat discovered only with hindsight. According to the July 2026 Department of Homeland Security inspector general report, personnel had identified its line of sight towards Trump as a concern. The agency had resources available to mitigate that vulnerability but did not use them effectively. The same report found that an area outside the perimeter remained unsecured even though Pennsylvania State Police planning material indicated it would not be covered.

These findings are important because the basic problem was physical and persistent. There was a location from which a firearm could be directed towards the stage, a known concern about that location and uncertainty over who would control it. None of those conditions depended on anticipating the identity or ideology of a particular attacker. A protective system must address plausible hazards before it knows who will attempt to exploit them.

The failure should nevertheless be described accurately. Investigators did not establish that officers deliberately left the roof open for Crooks. Their conclusions concerned omissions, poor processes and confusion. The existence of an obvious weakness can justify criticism without converting that weakness into proof of a planned betrayal.

What Crooks Did Before The Rally Began

By the afternoon of 13 July, Crooks had travelled to the area of the Butler Farm Show grounds. The independent panel’s reconstructed timeline places him near the event at approximately 3:49 pm. Two minutes later, at about 3:51 pm, he launched a drone and flew it for roughly eleven minutes. Investigators concluded that the flight brought the device close enough to observe the vicinity of the rally and stage.

The drone mattered for two reasons. First, it was evidence of reconnaissance activity rather than merely presence among the crowd. Second, the Secret Service had deployed counter-drone equipment specifically intended to help detect unauthorised flights. That protective detection system suffered a technical malfunction and was not functioning as planned during the relevant period. The independent panel found that it did not become operational until approximately 4:30 pm, well after Crooks’ flight.

The July 2026 inspector general investigation added that the designated operator lacked sufficient training and that the equipment problem was not handled effectively. In other words, a technological layer existed on paper, but it was unavailable at the moment it could have provided a warning. A device cannot compensate for a staffing or training failure if the people relying on it do not have the expertise or support to keep it functioning.

It remains important not to overinterpret the flight. Its timing and location support a conclusion that Crooks was inspecting the site. They do not reveal every thought behind his decision to attend, nor do they demonstrate that anyone else was directing him. Later FBI releases have examined wider drone activity and communications, but an isolated image or flight log should not automatically be labelled an assassination target list.

The First Suspicious Sighting Came Long Before The Shots

At approximately 4:26 pm, a local counter-sniper who had been leaving the AGR area sent colleagues a message about a man behaving suspiciously near the complex. The independent review panel identified that man as someone now believed to have been Crooks. The report also notes video of Crooks near a vendor area outside the secure perimeter at around this stage.

A report of an unfamiliar person standing near a building does not, by itself, prove criminal intent. Large public rallies generate many ambiguous observations. The difficulty at Butler was that the warning did not remain a single ambiguous sighting. Crooks returned to officers’ attention, his behaviour developed, and efforts to find him continued without producing a direct law-enforcement encounter.

That progression is central to understanding why investigators were so critical. A security team must update its assessment as fresh information arrives. What begins as a routine person-of-interest report can become urgent when the same person appears repeatedly near an unprotected vantage point and begins doing something directly connected to the protected stage.

The Rangefinder Raised The Stakes

Around 5:25–5:30 pm, a local counter-sniper observed Crooks using a rangefinder while looking towards the stage. A rangefinder is a legal device with ordinary sporting and recreational uses. At this location, at this time, combined with earlier suspicious movements and an exposed rooftop, it was a substantially more consequential observation.

Local officers photographed Crooks, exchanged messages and attempted to locate him. A report about the rangefinder reached local command arrangements and was passed onward to other personnel. At approximately 5:44 pm, the Butler emergency-services commander telephoned a Pennsylvania State Police representative in the Secret Service security room, describing the suspicious person, the device and the surrounding circumstances.

The independent panel found that at least nine Secret Service personnel eventually received information about Crooks before the shooting, including the rangefinder observation. That finding directly undermines the idea that absolutely nobody responsible for event security had heard of him. The problem was that awareness was scattered among different units and never became an effective protective decision.

The report’s criticism was carefully grounded: the combination of repeated suspicious conduct, rangefinder use and intermittent visual contact should have triggered a police encounter. Officers never managed to question Crooks during the more than ninety minutes between the first reported sighting and the shooting. The gap between identifying a potential threat and resolving it grew increasingly dangerous as the event approached.

Two Communications Systems That Did Not Function As One

The Butler security operation involved the Secret Service, Pennsylvania State Police, Butler County personnel, Beaver County personnel and other partners. Such a structure is not inherently abnormal for a large event. The essential requirement is that information from any officer can travel quickly to the people authorised to act on it, particularly the leadership controlling the protectee’s movements.

At Butler, the independent panel found that the Secret Service security room and local law-enforcement command post were physically separate and did not share a genuinely integrated communications structure. Radio traffic, telephone calls and text messages moved through different routes. Some messages were passed to particular agents but not to others. Information could be present inside the security operation without reaching the decision-maker who needed it.

This distinction explains a question that sounds almost impossible: how could so many people know about a suspicious man while Trump was allowed to continue speaking? They did not all possess the same facts at the same time, and there was no dependable procedure that transformed partial sightings into a unified threat picture. The phrase “someone has been told” was not equivalent to “the presidential detail knows and has responded”.

Several reviews also identified practical limitations with cellular communications in a crowded environment. Mobile phones can be useful supplements, but protective security cannot safely depend on ad hoc personal conversations as its principal method of escalating urgent danger. The planning system is supposed to anticipate differences in equipment, channels and agency structures before the event begins.

Trump Walked Onstage While Police Were Still Looking For Crooks

By the time Trump began speaking shortly after 6 pm, law-enforcement personnel were still trying to locate the suspicious individual reported near AGR. Photos and descriptions had circulated. The precise information held by each person differed, and the law-enforcement search had not produced an encounter or cleared the concern.

The independent panel found that leadership of Trump’s close-protection detail had not been told of the escalating Crooks reports. The agents physically responsible for determining when Trump went onstage, remained onstage or should be removed therefore did not have the information necessary to make a fully informed decision. This was a major institutional failure, not simply an imperfect response to an unpredictable last-second emergency.

A crucial nuance is that not every suspicious-person report warrants cancelling a large public event. The issue is whether information about a person with repeated suspicious movements, a rangefinder and access to an elevated position crossed the proper decision threshold. Investigators concluded that the combination should have prompted intervention, especially when the suspect could not be located.

The question of whether Trump should have been delayed from going onstage is distinct from what should have happened once the rooftop report emerged. In the earlier period, officers were evaluating suspicious conduct without an identified weapon. In the final minutes, the reported facts became much more urgent. Protective leadership needed both updates, but was deprived of the full picture.

The Final Minutes: A Rooftop Report That Did Not Reach The Detail

Shortly before 6:11 pm, personnel received information that the suspicious individual was on the AGR roof. According to the independent review panel, several Secret Service personnel learned of this development in approximately the final two minutes before the shots. Critically, none informed the leaders controlling Trump’s immediate protective detail.

A Butler Township police officer was lifted towards the edge of the roof at approximately 6:10 pm and encountered Crooks. The report says Crooks directed his rifle towards the officer, causing him to retreat to the ground. Local radio traffic immediately became explicit about the weapon. Around 6:11:03 pm, an officer reported that the man was armed, and seconds later described a long gun.

The independent panel’s detailed timeline records a local radio message reporting shots fired from the AGR roof at approximately 6:11:33 pm. The exact second at which every participant saw or heard each event is less important than the documented sequence: police learned the suspect was on a dangerous roof, an officer encountered a rifle, warnings spread through local channels and Trump remained exposed when Crooks opened fire.

After the initial shots, members of Trump’s protective detail moved over him and took him down behind the lectern. The counter-sniper response ended the attack. Those immediate actions likely limited further harm. They do not erase the earlier omissions that put Trump and spectators in the gunman’s line of fire in the first place.

A Fatal Attack And A Narrow Escape

Crooks fired eight rounds from a semi-automatic rifle. Trump was injured in the right ear. Corey Comperatore died while attending the rally, and David Dutch and James Copenhaver were seriously injured. These people and their families were not incidental to the event: they were among the members of the public the protective operation also needed to safeguard.

The attack became one of the defining images of the 2024 presidential election. Photographs of Trump surrounded by agents and raising his fist travelled around the world. Yet dramatic images can obscure the more useful investigative questions: why the building was not secured, what was reported before the attack, who possessed that information and which decisions never followed.

It is often said that a small movement of Trump’s head saved his life. Trump himself has described turning towards a chart immediately before the shooting. The near miss is obvious from the fact that he sustained an ear injury while being targeted with a rifle. A precise alternate bullet path under different head positions, however, cannot be proven from the available reconstruction. It is safer to describe the incident as a narrowly survived assassination attempt than to claim an exact hypothetical trajectory.

The geography also resists the simplistic idea that Crooks carried out an exceptionally sophisticated long-range attack. The AGR roof was close to the stage compared with the distances often discussed in sniper operations. The striking feature was that a nearby elevated threat location was left uncontrolled during a high-profile event. The breach in protective planning matters more to this explanation than romanticising the attacker’s marksmanship.

Why The Counter-Snipers Did Not Prevent The First Shots

Some of the most common questions concern the visible counter-sniper teams. If trained marksmen were watching the rally, why did they not stop Crooks before he fired? The answer cannot be reduced to a single claim that they had a clear target and chose not to shoot. The official record describes fragmented observation, uncertain identification and an unfolding event in which different teams held different information.

A counter-sniper’s role is not simply to fire at anyone seen near a roof. Officers need enough information to identify a genuine armed threat and avoid hitting innocent people. Meanwhile, the responsibility for physical control of dangerous positions should not depend solely on snipers identifying a suspect at the final moment. The ideal protective action would have made the position inaccessible or resolved the suspicious-person reports before Crooks was in place.

The independent panel found that local teams inside AGR had not been assigned comprehensive external security. It also found inadequate communication between the personnel observing the emerging incident and Trump’s detail. The focus therefore belongs on the protective system as a whole: planning, perimeter, observation, communications, command and intervention all needed to work together.

The Earlier Intelligence That Was Not Shared

Another part of the story emerged in subsequent oversight. A Government Accountability Office review reported in July 2025 found that senior Secret Service officials had received classified intelligence about a threat to Trump roughly ten days before the Butler event, but the information did not reach the relevant event personnel and law-enforcement partners. Investigators identified the absence of a process for sharing certain classified threat information when it was not judged to present an imminent threat to life.

This finding is significant but susceptible to exaggeration. It does not establish that intelligence officials had advance knowledge of Crooks or his precise plan. The available summaries describe a separate threat-intelligence handling problem that could have influenced staffing and protective preparation. The distinction between a general or separate warning and foreknowledge of a specific gunman is essential.

The July 2026 inspector general report likewise found that information about a long-distance threat was not properly shared with Pittsburgh field-office leadership and key agents. The consequence identified by investigators was insufficient protective personnel for the event. This illustrates how security weaknesses can begin before anybody arrives at a rally: staffing decisions reflect the intelligence and risk assessments available to planners.

The institutional challenge is to protect classified sources while ensuring operational personnel receive actionable conclusions. An intelligence report sitting securely at headquarters is of limited protective value if those designing the actual security arrangements never learn what additional precautions might be justified.

The Secret Service Reviews Reached Overlapping Conclusions

The House task force, whose final report was released in December 2024, called the events preventable and produced 37 recommendations. It identified failures in planning, execution and leadership, rather than attributing the catastrophe to one isolated error. The bipartisan Senate interim investigation likewise concentrated on communications, coordination and security arrangements.

An independent panel appointed by the Department of Homeland Security was particularly critical of organisational culture. After reviewing thousands of documents and interviewing participants, it described the agency as bureaucratic and insufficiently adaptive to changing threats. It urged fundamental reform. That criticism came alongside recognition of the bravery of agents who had exposed themselves to danger while protecting Trump onstage.

The Secret Service’s own mission-assurance inquiry also identified inadequate command of radio communications, the failure to secure AGR and missed opportunities to direct personnel towards the suspicious person. An organisation investigating its own performance does not provide the same form of independence as congressional or inspector general oversight, but the overlap between these findings is important.

In July 2026, the Homeland Security inspector general brought several strands together: a malfunctioning counter-drone system and insufficient operator preparation, warnings not reaching the protective detail, intelligence not reaching planners, unprotected outer areas and the failure to address a known line of sight. The Secret Service agreed with the inspector general’s seven recommendations, although implementation and closure status varied.

Agreement on recommendations is not the same as a demonstration that every change has been fully deployed and tested. A reader assessing the agency’s progress should look for completed training standards, documented responsibility for exposed locations, working interagency communications and evidence that commanders receive timely warnings.

Why Did So Many Warnings Fail To Become One Decision?

This is the central organisational lesson from Butler. Protective work is distributed across specialists. One team assesses venue geometry; another monitors aerial threats; local officers watch approaches; intelligence staff handle information about broader dangers; and a close-protection detail controls the protected person’s immediate movements. Each activity can appear functional in isolation while the overall system fails.

At Butler, a roof was recognised as a potential line-of-sight problem, yet nobody effectively secured it. Counter-drone capability was present but unavailable during the relevant flight. A suspicious person was identified, but officers did not encounter him. Multiple people received warnings, but the close-protection leadership did not. In the last minutes, a report of someone on a roof failed to trigger the protective response that the full information would have justified.

The system lacked what safety investigators often call an effective escalation pathway: a dependable means of moving an observation from field personnel to accountable command, with a decision, verification and follow-up. Whether the initial report comes from a police officer, a camera operator or a technical sensor, it should not depend on personal relationships between staff or happenstance telephone calls to reach the people responsible.

This explains why Butler should not be assessed solely by asking which individual agent made the worst mistake. Individual decisions matter, and personnel accountability is legitimate. But recurring failures across independent parts of a complex operation suggest problems in design, leadership, staffing, training and institutional culture.

Was There Evidence That The Failures Were Deliberate?

Butler produced suspicion almost immediately. The building’s obvious proximity, Crooks’ extended presence and the failure to act on warnings seemed difficult to reconcile with the resources of the Secret Service. Some commentators treated those facts as proof that the attacker had been assisted or deliberately allowed to proceed. The published official investigations do not establish that conclusion.

The FBI reported in August 2024 that it had not identified a definitive motive and had found no credible evidence of co-conspirators or a foreign direction of the attack at that stage. Congressional and independent security reviews focused on operational failures rather than establishing a covert assassination scheme. Further releases may clarify details of Crooks’ activity, but ambiguous redactions or unexplained contacts are not themselves proof of an accomplice.

There is also no need to minimise the failures to reject an unsupported conspiracy. A preventable attack caused by negligence, poor coordination and inadequate preparation is itself a profound failure. Demanding documentary evidence before alleging deliberate complicity does not weaken the criticism; it makes the criticism more defensible.

In assessing new claims, three questions are useful. Does the document actually identify a named person, action and time? Is the statement a witnessed event, an investigative hypothesis or somebody’s recollection? And does independent evidence confirm the interpretation? These distinctions are especially important when reviewing heavily redacted FBI records or clips circulated without context.

What Changed After Butler?

The assassination attempt led to congressional hearings, personnel scrutiny, organisational reviews and calls for expanded protective resources. The House task force issued recommendations about planning, coordination and leadership. The independent panel pressed for a more fundamental overhaul of agency culture, training, responsibilities and technical capabilities. The Government Accountability Office and inspector general examined how information and warnings moved through the system.

Changes in formal policy do not instantly resolve operational risks. An agency can purchase equipment without ensuring personnel know how to use it. It can designate a command room without guaranteeing that every partner can communicate with it. It can expand staffing without making the protected route, viewing angles and outer approaches safer. The measure of reform is whether the entire protection chain functions in realistic conditions.

The Butler case also illustrates why assessment should remain ongoing after public attention fades. High-profile inquiries create recommendations, but the less visible work of implementing, practising and auditing procedures determines whether those recommendations prevent future harm. Later reports found areas of progress alongside recommendations that remained open, reinforcing the need to distinguish announced changes from demonstrated results.

The Difference Between The Butler Attack And The Florida Attempt

Only two months after Butler, another armed man was detected at Trump’s golf course in West Palm Beach, Florida. On 15 September 2024, a Secret Service agent scouting ahead noticed a rifle barrel protruding from concealment and opened fire. The suspect fled without shooting at Trump and was arrested. That event provided a powerful contrast, although the environments and circumstances were not identical.

In Florida, the protective operation detected and interrupted an emerging armed threat before the assailant could fire. In Butler, local observations accumulated but never produced a timely coordinated intervention. The comparison is not proof that one location had flawless security or that every later protection procedure had been corrected. It illustrates the crucial value of acting on a threat before the attacker obtains a firing opportunity.

The broader lesson is that protective success is usually invisible: a suspicious report is resolved, an exposed position is controlled, or an event is delayed without anybody becoming aware of a possible assassination. When security works, the public rarely sees the decision. When it fails, the consequences can be immediate and irreversible.

The Question Butler Still Forces America To Answer

The available record supports a clear reconstruction. Crooks approached the rally area, conducted a drone flight, was repeatedly noticed near the AGR complex and was seen using a rangefinder. Officers circulated concerns and searched for him. Critical information failed to reach the leaders responsible for Trump’s movements. The exposed rooftop remained accessible, and Crooks fired before the system stopped him.

The crucial discovery is therefore not one sensational secret. It is the extent to which apparently independent safeguards failed at the same event. The failure to manage a known rooftop, the absence of integrated command, the inability to resolve a suspicious-person report, the missed drone detection and the unsuccessful intelligence-sharing process all contributed to an avoidable danger.

Corey Comperatore’s death and the injuries to other spectators underline that presidential protection concerns more than one person. Every rally places ordinary families alongside a heavily protected public figure. A failure to control a dangerous area therefore threatens both democratic participation and the lives of people who have gathered peacefully to hear a speech.

The question for the Secret Service is not merely whether a similar attack could happen again; no security system can promise absolute safety. It is whether the organisation can demonstrate that the warnings and vulnerabilities plainly visible in Butler would now produce a timely, accountable response. That is a harder and more important standard than simply asserting that the next event will be better protected.

Sources

James Taylor
Previous

The JFK Assassination: 15 Pieces of Evidence That Challenge the Official Story
Next

Ancient Treasures Emerge From Destroyed Ukrainian Dam As Archaeologists Race To Save Lost Civilisation