The FBI Files on Thomas Crooks: What the Newly Released Evidence Actually Reveal

The Thomas Crooks FBI Files: The Drone Flights, Strange Messages and Unanswered Questions

The Most Revealing FBI Records About The Butler Gunman Are Not Proof Of A Hidden Conspiracy.

On 13 July 2024, Thomas Matthew Crooks fired at Donald Trump during a campaign rally in Butler, Pennsylvania. Trump was wounded, Corey Comperatore was killed, and two other attendees were seriously injured. Crooks was killed by a Secret Service counter-sniper. More than two years later, the case still raises two separate questions: why did Crooks choose to attack, and how did the protective operation allow him to fire from a rooftop overlooking the rally?

The FBI's release of Thomas Crooks Part 09 on 14 October 2026 adds documents that can be read alongside congressional and inspector-general investigations. Its significance lies less in a single dramatic revelation than in its mix of drone data, extracted communications, investigative leads and technical records. Much is redacted. A newly released document is not necessarily a newly discovered fact, and investigators' decision to examine something does not mean they found it incriminating.

This analysis separates what the records establish from what they merely invite us to ask. It also compares the new material with the House task force's detailed 2024 reconstruction and the Department of Homeland Security inspector general's findings published in July 2026. The result is a clearer picture of preparation and protective failure, while the gunman's precise motive remains unresolved in the public evidence.

What The Latest FBI Release Actually Contains

Part 09 forms part of the FBI Vault's rolling disclosure of investigative documents. The Vault identifies it as a file of approximately 43 megabytes, published on 14 October 2026. It is a collection of investigative material, not a newly issued final report or a verdict on competing theories. Individual records date from the investigation following the 2024 attack. Reading them requires particular care because names, communications and procedural details may be redacted, while adjacent documents may address different investigative leads.

The material includes extracted telephone messages, drone-related images and forensic paperwork. Its existence establishes that federal investigators gathered and examined those categories of evidence. It does not, by itself, establish that any correspondent was a co-conspirator, that every location photographed was a potential attack site, or that the federal government had advance knowledge of Crooks' intentions.

That distinction is essential. Public discussion of assassination investigations often compresses three different propositions into one: a person undertook suspicious activity; investigators noticed the activity; therefore the activity proves a broader plot. Neither the second step nor the third automatically follows from the first. Each requires independent corroboration, dates, identities and a plausible causal connection to the attack.

The Drone Evidence: Preparation, Familiarity And Limits

The strongest cross-checked evidence concerns drone use. The House task force's final report says Crooks operated a DJI drone near the Butler rally on 13 July. Its controller contained logs of multiple activations or flights. Investigators reconstructed what Crooks might have been able to see by analysing data captured by the drone and controller, then using an exemplar of the same model for further work. That is meaningful evidence of reconnaissance on the day of the attack.

According to the House report, the Butler flight began at approximately 3.51 pm and lasted 11 minutes and 52 seconds. The report also explains an important forensic limitation: the FBI recovered a number of images from the drone, but none of the retrieved images was from that particular Butler flight. Digital flight telemetry can establish that an aircraft moved through space; it cannot automatically establish what its operator watched, thought or intended at each moment.

Records within the more recent FBI release also refer to earlier drone images in the Pittsburgh region, including sporting venues and other locations. Such material can demonstrate familiarity with aerial photography and certain places. Standing alone, however, it cannot tell readers whether Crooks was selecting future targets, practising a hobby, exploring equipment or doing something else. A pattern of activity becomes more probative when it can be tied to operational behaviour, not simply when a map contains recognisable landmarks.

This leaves two questions worth distinguishing. The earlier photographs concern his background and possible habits. The Butler flight concerns preparations immediately before a specific public event. The second has a much more direct evidentiary relationship to the attack. Treating them as equivalent would exaggerate what the earlier material shows.

A Security System Failed To Detect The Drone

The July 2026 Department of Homeland Security inspector general report adds an especially important detail: the Secret Service failed to detect Crooks' drone flight because of an under-trained operator and an equipment malfunction. That finding is directly relevant to accountability. The attacker undertook aerial reconnaissance before the event, while the protective system designed to help identify such risks did not function as intended.

The inspector general also identified a wider problem of coordination. Security personnel did not share information effectively about Crooks being observed with a rangefinder, a long gun and on the American Glass Research complex roof. A joint communications room with local law enforcement had not been established, leaving important warnings fragmented between different teams. These are documented organisational failures rather than inferred motives.

The report further found that personnel failed to adequately account for the area outside the established perimeter, even though the Pennsylvania State Police's plan indicated it would be unsecured. Resources that might have addressed the known line-of-sight concern were not used. The argument that nobody could have anticipated an elevated threat is therefore difficult to reconcile with the official inspection findings: the vulnerable line of sight had already been identified.

The Communications: Investigative Leads Are Not Proof Of Accomplices

Part 09 includes extracts from electronic communications, including messages that look mundane, incomplete or difficult to interpret without the surrounding conversation. Investigators also examined contacts and device activity. Such work is standard in a serious criminal investigation: analysts try to determine who communicated with a suspect, when, using which devices, and whether the exchanges bear on motive, preparation or participation.

A strange phrase in a chat log can attract enormous attention online. Yet an isolated fragment lacks the safeguards normally needed to make a meaningful allegation. We need to know whether the extraction preserved context, whether the account was correctly attributed, whether the message was sent or received, whether there were earlier jokes or references, and whether independent records corroborate a criminal meaning.

The public release does not provide a demonstrated chain connecting an identified correspondent to an instruction to attack Trump. This is not the same as proving every interaction was innocent; it means the visible evidence is insufficient to accuse another person. Redactions are an access limitation, not a licence to substitute speculation for missing words.

The FBI and congressional investigators have faced legitimate questions about the completeness and timing of disclosures. Those questions concern public accountability and access to evidence. They should not be conflated with a conclusion that someone inside the government supplied operational help to Crooks. That much stronger allegation requires evidence of deliberate participation, which the documents examined here do not establish.

What Happened In Butler: The Verified Sequence

The House task force reconstructed how Crooks came to occupy a rooftop within firing distance of the stage. The event involved the Secret Service, Pennsylvania State Police, local law-enforcement teams and counter-sniper personnel, operating under a security plan with consequential gaps. An industrial complex near the rally remained outside the most closely controlled area despite its relationship to the stage and its elevated sightlines.

During the afternoon, local officers identified a suspicious individual and tried to track him. Reports about his behaviour did not become a shared, decisive understanding of the threat among all relevant protective personnel. The important issue is not whether someone noticed him at all: several people did. It is why noticing him failed to produce an effective response before he reached the roof.

Shortly after 6.11 pm, Crooks fired eight rounds from a semiautomatic rifle. Trump was struck in the ear, while spectators suffered fatal and serious injuries. A Secret Service counter-sniper subsequently killed Crooks. The exact sequence of warnings, decisions and missed opportunities has been reconstructed through interviews, radio records and other evidence considered by multiple official reviews.

The House committee unanimously adopted findings describing failures in planning, execution and leadership. Its report contained 37 recommendations. These conclusions matter because they identify specific organisational mechanisms: responsibility was unclear, communication was incomplete, security arrangements did not adequately cover a known threat area, and personnel with limited experience occupied important advance-planning roles.

Why An Elevated Rooftop Was Left Available

A public event involves more than the immediate stage and the nearest fence. Protective planners must consider roads, structures, adjoining land, possible observation points and the relationships between local jurisdictions. The Butler site illustrated how security could be weakened by assuming that a boundary drawn for one team's responsibilities was also a complete protective boundary against gunfire.

The House report said experienced personnel were not consistently assigned to critical tasks, and that some did not fully understand the division of responsibilities. That can produce a dangerous result without any single person deciding to leave a roof exposed: one team assumes another team has control, warnings pass through different channels, and nobody with appropriate authority integrates the information quickly enough.

That explanation does not absolve the agency. A protective system is supposed to anticipate precisely these coordination problems. The inspector general's later findings make the institutional criticism more concrete by identifying the undetected drone flight, unshared intelligence and unavailable or unused safeguards. An attacker exploited the conditions that existed, whether or not he understood every weakness in advance.

What We Know About Crooks Before The Attack

Crooks was 20 years old. His public background contained ordinary educational and employment details, firearms interests and electronic activity investigated after the shooting. The FBI recovered devices and scrutinised records in an effort to understand his preparation and possible motives. It is tempting to assemble every unusual detail into one coherent personality portrait, but that is rarely justified by partial records.

The distinction between capability and motive is especially important. A person who has practised shooting may possess the capability to use a firearm. A person who owns a drone may possess the capability to survey an event. Neither fact alone explains why that person decided to kill. Nor can isolation, awkwardness, a political message received on a telephone or a collection of internet searches establish a diagnosis or ideology.

Investigators have examined possible ideological drivers and connections, but no definitive public explanation of his motive is established by Part 09. Absence of an announced motive is not unusual in cases where the perpetrator dies before interrogation. Some motivations leave documentary traces; others do not. A responsible account should identify the gap rather than fill it with an attractive narrative.

The Victims And The Consequences Beyond Trump

The Butler attack is often recounted through the image of Trump ducking behind his lectern and then rising surrounded by agents. That image documents one immediate consequence, but it should not obscure the people in the audience. Corey Comperatore was killed, and David Dutch and James Copenhaver were seriously injured. Their presence at a political rally placed them within the attacker's field of fire even though they were not the public figures at the centre of the event.

The harms extended beyond physical injuries. A public gathering had become the site of lethal violence, and families were left to deal with its consequences while official investigations examined the failures. A useful account of accountability must therefore ask not merely how a former president survived but why ordinary attendees were exposed to preventable danger.

The congressional task force's recommendations addressed the system as a whole. Better warning transmission, clear ownership of security duties and effective oversight of outside-perimeter areas matter because future protective failures could threaten both public figures and everyone around them.

Does The Evidence Point To A Conspiracy?

Three claims are frequently mixed together: Crooks prepared for the attack; the Secret Service made serious mistakes; and unknown accomplices planned the assassination. The first two are documented. The third is not established by the public evidence considered here. Drone reconnaissance and failures to stop it do not, by themselves, reveal who else, if anyone, knew of his intentions.

A meaningful conspiracy finding would require more than an odd message, a deleted account or heavy redactions. It would need corroborated communications, financial transfers, witness evidence, coordinated actions or other records tying identifiable individuals to the plan. Investigators' collection of a device or pursuit of a lead is evidence of an investigation, not evidence that the lead proved criminal involvement.

There is also a difference between evaluating agency negligence and alleging agency orchestration. Official reviews have identified serious negligence and organisational failure. Those findings are sufficiently important without expanding them into an unsupported theory of deliberate facilitation. Responsible scepticism examines government conclusions closely while holding alternative explanations to the same evidentiary standard.

What The Release Still Cannot Answer

Part 09 does not offer a complete, unredacted account of every communication, every investigative interview or every item of forensic testing. Its documents cannot establish a final psychological motive. Nor can readers infer the full significance of a partially visible contact without knowing the underlying identities and context. Some information may be protected for lawful investigative or privacy reasons; other withholding may deserve challenge and explanation.

The key unanswered evidentiary questions include the development of Crooks' intention to attack Trump, how his planning changed in the days before the rally, and whether later disclosures materially alter the known timeline. Answering those questions requires cross-checking new releases with the House task force records, law-enforcement interviews, contemporaneous communications and technical metadata. A document dump is most valuable when it can be fitted accurately into that larger evidential picture.

What Butler Reveals About Presidential Protection

The central institutional lesson is unusually clear. The security apparatus was not wholly unaware of potential danger. It had intelligence, local officers, specialised personnel and opportunities to act. The failure occurred in converting fragments of information and known site vulnerabilities into timely protection. That is a more precise and consequential explanation than saying simply that security was weak.

It also explains why successive reviews have concentrated on planning, authority and communications rather than technology alone. A better camera or detector can be useful, but only when somebody is trained to operate it, its warnings reach the correct decision-maker, and the organisation is prepared to interrupt an event. Butler exposed a breakdown across several of those steps.

The newest FBI material offers a clearer view of what investigators gathered about Crooks' activities, particularly his use of technology and communications. The July 2026 inspector general report supplies a strong explanation for how some of that activity escaped protective scrutiny. Together, the records document an attacker who prepared and a protective operation that failed. They do not establish a hidden network directing him.

Future releases may answer questions about chronology or motivation. Until then, the most important finding is already supported by official evidence: the shooting was not an inevitable event that modern security could do nothing to prevent. Known vulnerabilities, failed communication and missed opportunities allowed an armed attacker to fire into a crowd. That conclusion merits scrutiny regardless of which political figure was standing on the stage.