Category: Federal Bureau of Investigation FBI Crime News

Auto Added by WPeMatico

Posted on

Director Wray’s Remarks at the 2024 Aspen Cyber Summit

Source: Federal Bureau of Investigation FBI Crime News

Together, we’re working around the clock to investigate this.

And now I’d like to get into those cyber issues I promised to discuss this morning.

For three-quarters of a century, the Aspen Institute has helped leaders throughout industry, academia, and government identify not just the greatest challenges we face, but opportunities we have to join forces to overcome them.

And while the cyber threats I want to discuss here weren’t even the stuff of science fiction 75 years ago, ultimately, today’s threats still boil down to an age-old conflict: the conflict between good and evil, between the rule of law and the criminals and foreign adversaries who seek to harm our people, our organizations, and our businesses.

And, unfortunately, then and now, there’s no shortage of bad guys out there looking for ways to hurt us.

So, where does that leave us?  

It’s almost inevitable that your organization will be the victim of a cyberattack. And, when that happens, working with the FBI can help you navigate what otherwise might be an incredibly costly ordeal.

And to be clear—in many cases that may even mean saving your organization money—just how much I’ll get into in a few minutes.

Working with us can also save you precious time, helping you reconstitute your operations faster, and may keep not just your organization—but the American people themselves—safe from future attacks 
 
Focusing on victims 

It’s no secret that the volume of cyber incidents has increased exponentially.

Cybercriminals and nation-state hackers, alike, have demonstrated they’re not only willing, but more and more able, to hit the services people really cannot live without: things like hospitals and schools, utility companies and transportation providers.

Between 2021 and 2024, 15 of our country’s 16 critical infrastructure sectors—sectors like telecommunications, energy, emergency services—fell victim to ransomware, and that’s just ransomware.

Because those services are so essential, criminals and hackers backed by nation-states know they can score big by: 

  1. Locking up your data until you pay an outrageous ransom;
  2. Conducting what we call double extortion: stealing your data and threatening to release it—or sell it to the highest bidder; and
  3. Conducting triple extortion by preventing access to your website through denial-of-service attacks—or by harassing or threatening your organization’s employees and executives.

So, given the ubiquity and the severity of the cyber threat, more and more, it can sometimes seem like the odds are stacked against us.

Mindful of this evolving landscape, four years ago, I announced a new strategy to drive the FBI’s cyber work.

The cornerstone of that strategy is our unwavering support for victims—everyone from private citizens targeted by fraudsters to billion-dollar corporations suffering data breaches.

That means our mission revolves around you: using every piece of intelligence available to us to help keep your organizations—and others like them—safe from future attacks, and working with you when a cyberattack does occur to help you minimize your losses and get up and running again.

Now, depending on the circumstances, the work we do can vary from victim to victim.

And we believe in using every tool we’ve got to make life harder for our adversaries.

For example, when an attack happens, we can deploy one of our FBI Cyber Action Teams. These are elite specialty groups that can deploy around the world in a matter of hours to respond to cyberattacks onsite.

That’s what we did last year, for instance, when a telecommunications company found suspicious behavior on their network and asked for our help.

Our team was able to identify malicious activity associated with Volt Typhoon—a group of hackers sponsored by the Government of China. They’d been hiding inside the network, lying in wait. Fortunately, our Cyber Action Team gave the company the information they needed to mitigate the compromise across their system. And when we discovered Volt Typhoon was also using a botnet made up of hundreds of compromised, privately owned routers to conceal their activity—and the fact that it was being directed by China—we conducted a court-authorized operation that not only severed their connection to the botnet, but also prevented re-infection of those victim devices.

Volt Typhoon is just one facet of a broader campaign by the Chinese government to infiltrate U.S. infrastructure, co-opt devices in your organizations—and, frankly, a whole lot of homes—and use them to target us and our allies.

Today, for the first time, we’re able to publicly speak about a second joint, sequenced operation that we conducted last week as part of our ongoing efforts to take China’s botnets offline. This botnet was run by a different group of hackers, again working at the direction of the Chinese government.

Known as Flax Typhoon, they represent themselves as an information security company—the Integrity Technology Group. But their chairman has publicly admitted that for years his company has collected intelligence and performed reconnaissance for Chinese government security agencies.

Flax Typhoon was targeting critical infrastructure across the U.S. and overseas, everyone from corporations and media organizations to universities and government agencies.

And, like Volt Typhoon, they used internet-connected devices—this time hundreds of thousands of them—to create a botnet that helped them compromise systems and exfiltrate confidential data. But, unlike Volt Typhoon, they targeted more than just routers. Flax Typhoon hijacked Internet of Things devices like cameras, video recorders, and storage devices—things typically found across big and small organizations—and about half of those hijacked devices were located here in the U.S. 

Flax Typhoon’s actions caused real harm to its victims, who had to devote precious time to clean up the mess when they discovered the malware. One organization in California, for instance, suffered an all-hands-on-deck cybersecurity incident, and IT [information technology] staff needed to work long hours to remediate the threats and replace hardware—all of which took swaths of the organization offline and caused a significant financial loss.

But, working in collaboration with our partners, we executed court-authorized operations to take control of the botnet’s infrastructure. When the bad guys realized what was happening, they tried to migrate their bots to new servers and even conducted a DDOS [distributed denial-of-service] attack against us. Working with our partners, we were able to not only mitigate their attack, but also identify their new infrastructure in a matter of hours. At that point, as we began pivoting to their new servers, we think the bad guys realized that it was the FBI and our partners that they were up against. And, with that realization, they burned down their new infrastructure and abandoned their botnet.

Ultimately, as part of this operation, we were able to identify thousands of infected devices, and, then, with court authorization, issued commands to remove the malware from them, prying them from China’s grip.

Now, this was another successful disruption, but make no mistake: It’s just one round in a much longer fight.

The Chinese government is going to continue to target your organizations and our critical infrastructure—either by their own hand or concealed through their proxies. And we’ll continue to work with our partners to identify their malicious activity, disrupt their hacking campaigns, and bring them to light.

Of course, we’re also working hard to provide your organizations with information to proactively build resilience and defend yourselves before an attack even happens.

That was the case earlier this year, when we joined our partners to warn the private sector about a group of pro-Russian hacktivists, cybercriminals using a particular known vulnerability to compromise operational technology networks. They had set their sights across our critical infrastructure—from dams and wastewater systems to the energy, food, and agriculture sectors. And, after we sounded the alarm, we heard from our partners throughout industry. Because of the advisory we’d issued, they were able to prioritize fixing that specific vulnerability, keeping their companies—and the American public—safe.

When we learn of a potential attack—through our intelligence collection or our global partnerships—we’re focused on working with you to stop criminals and foreign adversaries before they can cripple your networks, like we did in 2022 to protect a major American political party’s networks. Through information collected using our FISA Section 702 authorities, we learned hostile nation-state actors were just days away from conducting a cyberattack. So, working together with the targeted organization, we denied that adversary’s access and prevented any damage.

And, as you saw from our announcement last month regarding Iran, foreign targeting of our political parties remains a serious concern.

Saving organizations money 

Now, hardening systems, fixing vulnerabilities, mitigating network compromise—that’s all essential.

But, what happens if—or, maybe, when—your organization finds itself the victim of a ransomware attack you cannot defend against, and you’re faced with the prospect of shelling out millions of dollars—or even hundreds of millions—to unlock your network and free your data? 

Well, the Bureau can help there, too.

And, in fact, the kind of help we provide sets us apart from every other agency on the planet.

Because victims are our highest priority, we’re constantly hard at work developing decryption capabilities to combat known ransomware variants. And when we’ve got them, we put them to very good use.

I’m extremely proud to report that in just the past two years, the FBI has handed out nearly 1,000 decryptors, and we’ve saved victims around the world something like $800 million dollars in ransom payments.

Let me repeat that: Partnering with the FBI saved ransomware victims around $800 million in the span of just two years, and that’s just the money saved in ransoms not paid. It does not include the almost incalculable savings by organizations not paralyzed by an attack, operations not suspended with systems and data taken offline.

And that $800 million saved? That could have been even more. 

What do I mean by that? 

Before we can use many decryptors, we need to know who the victims actually are—whose data each of these unique keys unlocks.

So, if your organization gets hit by ransomware and tries to go it alone? We might not be able to make that match—and we might not be able to save you that ransom payment.

Now, it’s been more than seven years since I was working in the private sector, but I think I still understand the importance of profit to a business, so let me say this as plainly as I can: If you’re a victim of ransomware, call the FBI right away, because together, we can try to save your money.

Saving organizations time 

But money’s not the only thing the Bureau can help you save.

When you’re the victim of a cyberattack, every second counts, and involving the FBI right from the outset can save your organization precious time when it matters most.

In fact, an IBM study last year proved exactly that.

The lifecycle of the average data breach is 33 days longer when the victim organization does not involve law enforcement in their response.

Can you afford an extra 33 days of downtime after a cyberattack? 

Consider, for example, the case of the Los Angeles Unified School District. It’s the nation’s second-largest school district, with 600,000 students and 100,000 employees. Two years ago, they were hit by a ransomware attack over Labor Day weekend and immediately called the FBI. We had our experts onsite within an hour, and, by the end of the weekend, we’d helped them halt the ransomware, turn their network back on, and restore priority systems—all without paying the hackers a cent and without losing a single day of operations.

Or what about the U.S. cancer treatment center that was the target of a ransomware attack last summer? Hackers had encrypted the center’s systems and data, leaving scores of patients without access to critical medical care. It’s hard to think of a case when the criminals were more callous—or when getting back online fast mattered more. Fortunately, the center engaged with the FBI fully, right from the start. And, in addition to investigators and technical experts, we also deployed crisis negotiators.

So, while we were busy working with our partners to provide indicators of compromise and share information about the hackers’ tactics and procedures, we were also helping the center negotiate the ransom payment, getting it from $450,000 down to $50,000. Using the decryption key the hackers then provided, the center was able to resume operations—just four days after the attack. In that instance, not only was it time-saving to work with the Bureau. According to the victim cancer center, it was also life-saving.

Saving organizations from becoming victims in the future  

But the value you’ll find in working with the FBI is more than just time and money.

The FBI has a suite of unique authorities and capabilities that are key to stopping and preventing attacks and essential to our work with victims before, during, and after they’re hit.

One particularly critical authority is Rule 41, which I know many of you are familiar with. It allows law enforcement to seize “instrumentalities of a crime.”

Think malware that’s been secretly installed on victim networks.

With Rule 41 search and seizure warrants, we can combat illicit cyber activity that spans multiple states, seizing the bad guys’ domains and servers, removing malware and webshells, or conducting operations to kick adversaries out of our systems. 

In the case of Volt Typhoon and Flax Typhoon, we could not have protected our nation’s critical infrastructure—your networks—without our Rule 41 authorities and the help of our partners in the private sector. In many of these cases, it’s the private sector that helps us identify the threat actors and understand those critical technical details. And, in some cases, we’re able to work with private sector companies and our government partners to develop mitigation measures, helping shut the doors the bad guys have propped open.

For us to continue to successfully execute our Rule 41 operations, information and intelligence sharing is critical because, bottom line: The FBI, our government partners, and the private sector each tend to have a piece of the puzzle, and everyone has to share their piece to complete the picture to help us impose the greatest possible cost on our adversaries.That’s how essential all of you are in our nation’s cybersecurity.

And we need you to keep playing a role in this space, because the threat is only going to get more severe as adversaries like China, Russia, and Iran turn to AI [artificial intelligence] to infiltrate our networks and steal our information. We’re going to need all the help we can get.

Conclusion 

The mission of the FBI always has—and always will—prioritize victims.

Working to keep people and organizations safe, providing the assistance they need in the aftermath of a crime: That’s what we do.  

And if the criminals and hostile nation-states behind today’s cyber threats had their way, everybody would be a victim—not just you and your networks, data, and livelihoods; but all Americans and the essential services they depend on.

So, if there’s only one thing you take away from my time here today, I hope it’s this: The FBI needs and wants to work with you. Let us save you money, save you time, and save you from future attacks so that you can keep your organization’s focus where it should be: on your operations, and—together—we can help keep our nation safe.

Thank you.

Posted on

FBI Miami Special Agent in Charge Jeffrey Veltri’s Updates to the West Palm Beach, Florida, Assassination Attempt Investigation

Source: Federal Bureau of Investigation FBI Crime News

Good afternoon. For quick introduction, my name is Jeffrey Veltri, and I am the special agent in charge of the FBI’s Miami Field Office.  
 
The FBI immediately responded to the scene here in West Palm Beach, Florida, and we are investigating this matter as an apparent assassination attempt on former President Trump.  

We view this as extremely serious and are determined to provide answers as to what led up to the events that took place.  
 
I want to emphasize we are just a little over 24 hours into this investigation, so we are going to provide as much as we can publicly while our investigation is ongoing. We must also stress the U.S. attorney’s office is pursuing charges, and that limits some details we can publicly disclose. 
 
Arrest 

Yesterday afternoon, Martin County Sheriff’s Office took custody of Ryan Routh, and he was transported back to Palm Beach County Sheriff’s Office. Our FBI agents then attempted to interview him, and he invoked his right to an attorney. 
 
FBI’s law enforcement activities  

In the last 24 hours, the FBI and our partners have been dedicated to investigating the incident and utilizing all available resources. These efforts have included:  

  • DOJ and USAO engagement: Our investigative team and the USAO’s for the Southern District of Florida and DOJ’s National Security Division are actively working hand-in-hand to pursue and subsequently execute several warrants. Thus far, the warrants include a video recording device, subject’s cellular devices, vehicle, and other electronic devices located at previous known residences.  
  • Interviews: We are coordinating with United States Secret Service to complete the interviews of numerous agents. We have also interviewed seven civilian witnesses at the scene. That is just the beginning. FBI’s Honolulu and Charlotte Field Offices have initiated the interviews of several family members, friends, and former colleagues of the subject. 
     
  • FBI deployed several specialty teams and assets from FBI Headquarters and Quantico’s Lab Division, to include evidence and critical incident response personnel.  
  • Evidence Response Team is collecting and processing multiple evidentiary items. These range from the rifle—which is a SKS model with a scope and obliterated serial numbers—two bags, the subject’s electronics, and what appears to be ceramic tiles. DNA has also been collected from those items, which are being sent to Quantico for testing. We will also process Routh’s vehicle for evidence.
     
  • Cellular Analysis Survey Team conducted thorough analysis of the subject’s cellular device’s location. The CAST analysis aligns with the witness’ account of the subject’s presence at the scene both before and around the time of the incident on September 15. More specifically, we are continuing to conduct analysis and will be compiling the subject’s movements in the days and months leading up to September 15. Cellular data shows the subject was in the vicinity of the golf course roughly 12 hours before the engagement with the U.S Secret Service. 
  • Our investigative teams conducted a neighborhood canvas in an effort to collect and obtain relevant video footage.  
  • The subject had an active online presence, and we are going through what he posted and any searches conducted online. In addition, we are going through media reports and public statements he made that he wanted to recruit Afghan soldiers and others to fight for Ukraine. 
  • The FBI has sent multiple requests to companies for returns on the subject’s phone and social media accounts. We received several returns and are waiting on additional responses from other companies as well. Our investigative team is completing analyses of the returns and actioning leads as needed; we anticipate continuing until the FBI knows the full totality of the subject’s social media presence.  
  • Law enforcement holdings and history: In 2002, the subject was charged and convicted in North Carolina for possession of a weapon of mass destruction. Law enforcement checks also revealed that from 1997 to 2010, the subject had numerous felony charges for stolen goods.  I can also share with you that he was the subject of a previously closed 2019 tip to the FBI where it was alleged he was a felon in possession of a firearm. In following up on the tip, the alleged complainant was interviewed and did not verify providing the initial information. The FBI passed the information to local law enforcement in Honolulu.  

Law enforcement coordination

On behalf of the FBI, I would like to thank Palm Beach County Sheriff’s Office and Martin County Sheriff’s Office for their incredible work in actioning the witness’ information and rapidly apprehending the subject. 
 
I would also like to thank the United States Secret Service; the USAO Southern District of Florida; Department of Justice’s National Security Division; Bureau of Alcohol, Tobacco, Firearms, and Explosives; and our FBI field offices, Honolulu and Charlotte, who have been conducting additional law enforcement activity related to the subject.  
 
Your continued partnerships have been invaluable.  
 
Call to action 
 
Oftentimes in law enforcement, we tell our citizens to be vigilant and aware of their surroundings. Yesterday, a citizen provided remarkable assistance, which led to the arrest of the subject.  
 
We appreciate the public’s diligence in passing potential tips and important information regarding the subject and this incident to the FBI.  
 
If you have any information, please call 1-800-CALL-FBI or go online to tips.fbi.gov.

Posted on

2023 Cryptocurrency Fraud Report Released

Source: Federal Bureau of Investigation FBI Crime News

Losses related to cryptocurrency fraud totaled over $5.6 billion in 2023, a 45% increase in losses since 2022, according to a report from FBI’s Internet Crime Complaint Center (IC3) published on September 9, 2024. The number of complaints from the public regarding cryptocurrency fraud continues to steadily increase, reaching 69,000 in 2023.

Cryptocurrency is a type of digital currency that you can use to buy goods or services or to invest. Examples of cryptocurrencies include bitcoin, ether, or tether. As the use of cryptocurrency in the global financial system continues to grow, criminals are increasingly using cryptocurrency due to its decentralized nature, the speed of irreversible transactions, and the ability to transfer value around the world. Using cryptocurrency also makes it harder for victims to recover stolen funds. Once an individual sends a payment, the recipient owns the cryptocurrency. Recipients often quickly transfer that digital currency into an account overseas for cashout purposes.

Criminals can exploit cryptocurrencies in many types of criminal schemes. In 2023, most cryptocurrency complaints involved investment scams. These losses totaled $3.9 billion and accounted for almost 71% of all losses related to cryptocurrency in 2023. Other examples of scams associated with cryptocurrency include tech support, confidence and romance, and government impersonation scams.   

Cryptocurrency investment fraud is the most common type of cryptocurrency scam. In this type of fraud, criminals use various means of manipulation to convince victims to deposit increasing amounts of money into financial “investments” using cryptocurrency. In truth, these investments are fake; criminal actors who are usually located overseas control—and ultimately steal—all victim money. As a result, victims typically lose everything they invested.

Losses from cryptocurrency-related investment fraud schemes reported to the IC3 rose from $2.57 billion in 2022 to $3.96 billion in 2023‚a 53% increase. Many individuals have accumulated massive debt to cover losses from these fraudulent investments.

Individuals aged 30-39 and 40-49 filed the most complaints related to cryptocurrency investment fraud (approximately 5,200 reports in each age group). But complainants over the age of 60 reported the highest losses (over $1.24 billion).

Learn more about the process behind cryptocurrency investment fraud 

The FBI, along with the Department of Justice, law enforcement, regulatory agencies, and financial institution partners, is dedicated to identifying the perpetrators of these schemes and bringing them to justice.

The FBI’s IC3 is the central intake hub for individuals in the U.S. or abroad to report fraud and cybercrime. The IC3 analyzes complaints and aggregates them to identify trends and help develop strategies to combat these schemes and protect scam victims from loss. IC3 also shares the complaints it receives with FBI field offices, other law enforcement agencies, and regulatory entities for further investigation or action, as appropriate.

In February 2022, the FBI formed the Virtual Assets Unit (VAU), a specialized team dedicated to investigating cryptocurrency-related crimes. The VAU centralizes the FBI’s cryptocurrency expertise into one nerve center, providing technological equipment, blockchain analysis, virtual asset seizure training, and other sophisticated training for FBI personnel. 

Posted on

Director Wray’s Remarks at U.S. Department of Justice Election Threats Task Force Meeting

Source: Federal Bureau of Investigation FBI Crime News

Thank you, Attorney General [Merrick B.] Garland and Deputy Attorney General [Lisa] Monaco, for bringing the task force together for this meeting.

I know this group is busy year-round working with our partners—especially our brothers and sisters in state and local law enforcement who are often the first line of defense in protecting election workers from violence and threats of violence. And, as we get closer and closer to Election Day, we’ll continue to step up our collective efforts to protect those charged with ensuring our elections run smoothly.

As I’ve said before, election workers—many of whom are volunteers, and all of whom are public servants—are the lifeblood of our elections, and we’re committed to ensuring that threats directed at election workers receive the swift and thorough response they deserve.

Of course, our commitment to protecting elections and Americans’ right to vote extends to an even broader array of threats—threats the FBI, as both a law enforcement and intelligence agency, will continue to work 24/7 to uncover and disrupt. That means aggressively combatting attempts by foreign adversaries to undermine confidence in U.S. elections, sow discord, and damage our democratic institutions.

The actions announced today focus on Russia, but Russia is by no means the only adversary we’ve seen try to meddle in our society and democratic processes. Just last month, for instance, the FBI—working with the broader [U.S.] Intelligence Community and CISA [the Cybersecurity and Infrastructure Security Agency]—called out Iran for targeting and attempting to compromise former President [Donald] Trump’s campaign.

And we continue to keep a close eye on China’s efforts to denigrate down-ballot candidates it sees as a threat, and on their broader efforts to sow discord.

Whether it’s China, Iran, Russia, or some other country, attempts to meddle in our elections or destabilize our free and open society represent attacks on our democracy. And as long as foreign adversaries keep engaging in these hostile influence campaigns, they’re going to keep running into the FBI.

Today, we’re exposing two illegal Russian covert influence operations targeting the American public.

The first was run by RT, formerly known as “Russia Today.”

For years, the Russian government has used RT to seed and amplify their propaganda narratives around the world. And while RT America suspended its official operations in the U.S. in early 2022, our investigation revealed that, since at least last year, RT has used people living and working inside the U.S. to facilitate contracts with American media figures to create and disseminate Russian propaganda here.

The content was pitched as legitimate, independent news, when in fact, much of it was created in Russia by RT employees who work for the Russian government.

The second operation reveals even more malign activities by companies working under the direction and control of the Russian government—companies that created media websites to trick Americans into unwittingly consuming Russian propaganda.

Today’s announcement exposes those companies and their influence operations—operations that relied on AI [artificial-intelligence]-generated content, influencers, and paid social media advertisements to drive internet traffic to their sites and target Americans with disinformation.

As of noon today, we’ve seized those sites, rendered them inoperable, and made clear to the world what they are: Russian attempts to interfere in our elections and influence our society.

As the lead agency for investigating threats to U.S. elections, the FBI is focused on ensuring our laws are respected and enforced. And when we learn that adversaries overseas are trying to hide who they are and where their propaganda is coming from as part of campaigns to deliberately sow discord, we will continue do everything we can to expose their hidden hand and disrupt their efforts.

I’ll close by saying “thank you,” again, to everyone on the task force for the support you’re providing us, and for everything you’re doing to instill confidence in our elections and ensure they’re conducted in a way that’s safe, fair, and legitimate for the American people.

Thank you.

Posted on

FBI Pittsburgh Special Agent in Charge’s Remarks to Media on Updates to the Butler, Pennsylvania, Assassination Attempt Investigation

Source: Federal Bureau of Investigation FBI Crime News

Remarks as prepared for delivery

Opening Remarks

Thank you EAD [Executive Assistant Director Robert R.] Wells.

My name is Kevin Rojek. I’m the special agent in charge of the FBI Pittsburgh Field Office. 

The Pittsburgh office continues to lead the investigation into the attempted assassination of former President Donald Trump through the tireless efforts of our agents, intelligence analysts, and professional staff employees.  

We have also received invaluable assistance from countless personnel from several FBI field offices and FBI Headquarters divisions.  

Additionally, I want to acknowledge the incredible partnership with both the Pennsylvania State Police and the U.S. attorney’s office who have worked jointly with us on this investigation since day one.  

Motive and Co-Conspirators 

Since July 13, we have worked diligently towards two goals: 

  • identify the subject’s motive for the attempted assassination; and
  • determine whether he worked with any co-conspirators or conducted this attack alone.  

Regarding motive: Extensive analysis of the subject’s online search history, as well as his specific online activity, has provided us valuable insight into his mindset, but not a definitive motive.  

Regarding co-conspirators: To date, we have not uncovered any credible evidence indicating the subject conspired with anyone else. 

Outside Reviews 

During the last few weeks, the FBI has received numerous requests to support external investigations associated with the attempted assassination, including the independent review panel formed by DHS [Department of Homeland Security] Secretary [Alejandro] Mayorkas, DHS’ Office of Inspector General, as well as the bipartisan congressional task force.  

As EAD Wells stated, the FBI remains committed to transparency in sharing appropriate investigative results with each of these investigative teams and with the American people.  

Scope of Investigation

Regarding the scope of the investigation: First, I want to remind the public that the FBI is responsible for investigating the actions of the subject. 

It is not the FBI’s role to investigate the actions, the security posture, or the responsibilities of the Secret Service or local law enforcement related to the campaign rally. 

To date, we’ve conducted nearly 1,000 interviews, served numerous search warrants, issued dozens of subpoenas, and analyzed hundreds of hours of video footage. 

The Investigation

The FBI continues to follow up on all potential leads in order to refine the timeline of events leading up to the attempted assassination.  

We also remain in contact with the subject’s family members, who have been extremely cooperative with our investigation. 

Online Search Activity

Now, regarding the subject’s online activity, analysis of searches conducted between 2019 and 2024 provided extensive insight into the subject’s mindset and specific research he conducted in preparation for the attack. 

Searches for Campaign Events

In late September 2023, an account connected to the subject was used to search the former president’s campaign schedule and upcoming appearances in Pennsylvania. 

Next, from April of 2024 through July 12, the subject searched campaign events for both former President Trump and President [Joe] Biden, including events scheduled to take place in western Pennsylvania. 

Searches for Butler Event

Specifically on July 4, 2024, the subject searched for details of the former president’s campaign event in Butler. 

On July 6, the subject registered to attend the rally, and that same day, he specifically searched for:

  • “how far was Oswald from Kennedy,”
  • ”where will Trump speak from at Butler Farm Show,”
  • ”Butler Farm Show podium,” and
  • “Butler Farm Show photos.” 

On July 8, the subject searched “AGR International,” on July 9 he searched “ballistic calculator,” and on July 10 he searched “weather in Butler.” 
 
Searches for Biden and Trump:  

In the 30 days prior to the attack, the subject conducted more than 60 searches related to President Biden and former President Trump.  

Of particular note, our investigation identified specific searches conducted on July 5 to include “when is the DNC convention” and “when is the RNC in 2024.” 

Searches related to IEDs: 

Next, regarding the two improvised explosive devices located in the shooter’s vehicle as well as the device found in his bedroom, the subject conducted multiple searches pertaining to explosive devices as early as September 2019 continuing through this summer.  

These searches specifically included:

  • “detonating chord,”
  • “blasting cap,”
  • “how to make a bomb from fertilizer,” and
  • “how do remote detonators work.” 

The subject also searched for ammonium nitrate, nitromethane, and other materials consistent with the manufacturing of explosive devices.  

Explosives: 

Continuing on the topic of the explosive devices located in the subject’s vehicle, the FBI’s Lab determined the components used by the subject were legal to purchase and readily available online. 

Rifle Analysis 

Additionally, regarding the subject’s rifle, the FBI Laboratory Division successfully test fired the weapon, concluding it was—and remains—fully operational. 

They also positively matched all eight shell casings located on the roof with the subject’s rifle. 

Addressing Incorrect Reporting

I would like to take this opportunity to clarify some information.

Encrypted Email Accounts: 
First, regarding the subject’s use of overseas encrypted email accounts. 

We understand these accounts were encrypted. However, the level of encryption was no more sophisticated than any standard, widely used, internet-based email service.  

We successfully accessed the information from these accounts and appropriately analyzed their content. 

However, we continue to identify and exploit the subject’s accounts. 

Release of the Crime Scene 

Second, regarding the release of the crime scene, the FBI did release the crime scene at the Butler Farm grounds, as well as the AGR complex to the property owners in a timely fashion.   

In fact, we released these sites on a rolling basis—but only after completing a thorough processing of each location, exhausting all efforts to collect any items of evidentiary value. 

Prior to releasing each site, we followed all appropriate evidence-gathering procedures and completed the final release of the scene seven days after the attack. 

Cleaning of the Biological Evidence 

Third, regarding the cleaning of the AGR roof, the FBI followed established evidentiary policies and procedures for the return of crime scenes to the property owner. 

This included cleaning the biological material from the AGR roof, only after ensuring we collected all relevant evidence.  

Release Of Subject’s Body 

I would now like to clarify the process undertaken to release the subject’s body to his family. 

After rendering the scene safe and following our established evidence gathering procedures, the FBI contacted the Butler County Coroner’s Office.   

Subsequently, the coroner removed the body from the scene and conducted a death investigation. 

The Butler County Coroner’s Office then deferred to have the Allegheny County Office of the Medical Examiner conduct the autopsy . 

Once Allegheny County completed the autopsy, the Butler County Coroner’s Office consulted with the FBI asking if there were any additional necessary investigative steps with respect to the body.   

The FBI and Pennsylvania State Police then concurred with the Butler County Coroner’s Office decision to release the remains to the subject’s family. 

I want to stress that It is not standard procedure or practice for the FBI or any law enforcement agency to request that the coroner or medical examiner maintain indefinite custody of a deceased subject’s body once the investigative purposes of our agency and our partner agencies are completed. 

Autopsy and Toxicology Results

I would also like to mention that the FBI is now in possession of the subject’s autopsy and toxicology reports from the coroner’s office.  

The autopsy report indicated the subject was pronounced deceased at 6:25 p.m. on July 13, 2024, as a result of a single gunshot wound to the head.

All reviewable evidence collected from the AGR roof and from the subject’s body are consistent with the round fired by the Secret Service sniper.  

Additionally, the toxicology report revealed negative results quote “for alcohol and drugs of abuse.” 

Interviews of First Responders on Night of Incident 

Next, regarding questions surrounding the release of first responders from the shooting scene on the night of July 13. 

We had no reason or intention to hold or detain any first responder, as the law enforcement community assembled in Butler was actively responding to public safety risks and assisting with investigative activity throughout the night.  

The FBI appreciates the monumental local law enforcement response that lasted hours after the attack and continues to this day. 

Our priorities that night—as shared by local law enforcement—were to secure the scene, preserve evidence, and ensure public safety. 
 
Interview of Former President Trump  

As previously reported, the FBI and the Pennsylvania State Police conducted a standard victim interview of former President Trump. 

During this productive interview, agents took the time to provide the former president with an in-depth briefing on the investigation and answered his questions regarding the attempt on his life.  

We’re grateful to the former president for his cooperation and his time. 

Timeline

I will now provide an update to the timeline associated with the subject’s actions prior to the shooting. 

Prior witness interviews indicated the subject was in the area of the AGR building at 4:26 p.m. 

Subsequent digital evidence review shows the subject was in fact near the farm show air strip, walking past a row of vendors outside the secure perimeter approximately a half mile away from the AGR grounds at 4:26 p.m. 

Second, video obtained from a local business showed the subject climbed to the roof of the AGR complex at approximately 6:05 p.m.  

Video from local business, police dash-cam, and police body cameras confirmed the subject’s movement across multiple AGR building roofs between 6:05 and 6:08 p.m. 

Finally, at 6:11 p.m., the subject fired eight rounds before being neutralized.  

Our overall finding is the subject was only on the roof for approximately 6 minutes, prior to the shooting, between 6:05 and 6:11 p.m.  
 
Wrap-Up

The FBI continues to work diligently to determine the subject’s motive. 

We believe the subject engaged in detailed attack planning well in advance of the campaign rally. 

We continue to pursue all investigative leads to determine any possible links to co-conspirators. 

The American people deserve answers, and the FBI stands committed to providing them. 

Posted on

Opening Statement to Media on Updates to the Butler, Pennsylvania, Assassination Attempt Investigation

Source: Federal Bureau of Investigation FBI Crime News

Washington, D.C.

Good afternoon, everyone. My name is Robert Wells, and I am the executive assistant director of the FBI’s National Security Branch. I believe this is our third call with the media since the attack and, as you have heard me say before, the FBI remains steadfast in investigating the details surrounding the attempted assassination of former President Trump.

This extraordinarily tragic set of circumstances is of national importance, and we are determined to ensure the facts of the case are appropriately shared with Congress, the media, and the American people. Our goal throughout this process has been—and continues to be— transparency, which is why we have agreed to proactively share new information as it comes to light. We have also been cooperative with the bipartisan Congressional task force and the ongoing independent reviews of the attack, and we’re committed to working closely with each of these teams and being as transparent as possible.

Before we get into the details of the investigation, I would be remiss if I did not highlight the incredible work of the agents, analysts, and professional staff in the Pittsburgh Field Office—and around the organization—throughout this investigation. Whether it was covering down on a lead, analyzing countless points of data, or providing victim services to witnesses and victims alike, every member of the investigative team has worked around the clock to understand what transpired on and leading up to July 13. We continue to leverage the amazing cooperation with our state and local partners in the area to leave no stone unturned in this investigation.

At this time, the FBI has not identified a motive nor any co-conspirators or associates of Crooks with advance knowledge of the attack. And I want to be clear: We have not seen any indication to suggest Crooks was directed by a foreign entity to conduct the attack. As always, we will continue to follow all logical investigative steps in this ongoing investigation and have not ruled anything out at this time.

I will now turn it over to Pittsburgh Field Office’s Special Agent in Charge Kevin Rojek. He will provide the latest investigative update and the various steps the FBI has taken thus far to conduct a thorough and fulsome investigation into the attack on July 13.

Thank you, and I look forward to answering your questions.

Posted on

FBI Pittsburgh Special Agent in Charge’s Remarks from Media Briefing on Updates to Investigation into Butler, Pennsylvania, Assassination Attempt

Source: Federal Bureau of Investigation FBI Crime News

Remarks as prepared for delivery

Opening Remarks

Thank you EAD [Executive Assistant Director Robert R.] Wells.

My name is Kevin Rojek. I’m the special agent in charge of the FBI Pittsburgh Field Office. 

The Pittsburgh office continues to lead the investigation into the attempted assassination of former President Donald Trump through the tireless efforts of our agents, intelligence analysts, and professional staff employees.  

We have also received invaluable assistance from countless personnel from several FBI field offices and FBI Headquarters divisions.  

Additionally, I want to acknowledge the incredible partnership with both the Pennsylvania State Police and the U.S. attorney’s office who have worked jointly with us on this investigation since day one.  

Motive and Co-Conspirators 

Since July 13, we have worked diligently towards two goals: 

  • identify the subject’s motive for the attempted assassination; and
  • determine whether he worked with any co-conspirators or conducted this attack alone.  

Regarding motive: Extensive analysis of the subject’s online search history, as well as his specific online activity, has provided us valuable insight into his mindset, but not a definitive motive.  

Regarding co-conspirators: To date, we have not uncovered any credible evidence indicating the subject conspired with anyone else. 

Outside Reviews 

During the last few weeks, the FBI has received numerous requests to support external investigations associated with the attempted assassination, including the independent review panel formed by DHS [Department of Homeland Security] Secretary [Alejandro] Mayorkas, DHS’ Office of Inspector General, as well as the bipartisan congressional task force.  

As EAD Wells stated, the FBI remains committed to transparency in sharing appropriate investigative results with each of these investigative teams and with the American people.  

Scope of Investigation

Regarding the scope of the investigation: First, I want to remind the public that the FBI is responsible for investigating the actions of the subject. 

It is not the FBI’s role to investigate the actions, the security posture, or the responsibilities of the Secret Service or local law enforcement related to the campaign rally. 

To date, we’ve conducted nearly 1,000 interviews, served numerous search warrants, issued dozens of subpoenas, and analyzed hundreds of hours of video footage. 

The Investigation

The FBI continues to follow up on all potential leads in order to refine the timeline of events leading up to the attempted assassination.  

We also remain in contact with the subject’s family members, who have been extremely cooperative with our investigation. 

Online Search Activity

Now, regarding the subject’s online activity, analysis of searches conducted between 2019 and 2024 provided extensive insight into the subject’s mindset and specific research he conducted in preparation for the attack. 

Searches for Campaign Events

In late September 2023, an account connected to the subject was used to search the former president’s campaign schedule and upcoming appearances in Pennsylvania. 

Next, from April of 2024 through July 12, the subject searched campaign events for both former President Trump and President [Joe] Biden, including events scheduled to take place in western Pennsylvania. 

Searches for Butler Event

Specifically on July 4, 2024, the subject searched for details of the former president’s campaign event in Butler. 

On July 6, the subject registered to attend the rally, and that same day, he specifically searched for:

  • “how far was Oswald from Kennedy,”
  • ”where will Trump speak from at Butler Farm Show,”
  • ”Butler Farm Show podium,” and
  • “Butler Farm Show photos.” 

On July 8, the subject searched “AGR International,” on July 9 he searched “ballistic calculator,” and on July 10 he searched “weather in Butler.” 
 
Searches for Biden and Trump:  

In the 30 days prior to the attack, the subject conducted more than 60 searches related to President Biden and former President Trump.  

Of particular note, our investigation identified specific searches conducted on July 5 to include “when is the DNC convention” and “when is the RNC in 2024.” 

Searches related to IEDs: 

Next, regarding the two improvised explosive devices located in the shooter’s vehicle as well as the device found in his bedroom, the subject conducted multiple searches pertaining to explosive devices as early as September 2019 continuing through this summer.  

These searches specifically included:

  • “detonating chord,”
  • “blasting cap,”
  • “how to make a bomb from fertilizer,” and
  • “how do remote detonators work.” 

The subject also searched for ammonium nitrate, nitromethane, and other materials consistent with the manufacturing of explosive devices.  

Explosives: 

Continuing on the topic of the explosive devices located in the subject’s vehicle, the FBI’s Lab determined the components used by the subject were legal to purchase and readily available online. 

Rifle Analysis 

Additionally, regarding the subject’s rifle, the FBI Laboratory Division successfully test fired the weapon, concluding it was—and remains—fully operational. 

They also positively matched all eight shell casings located on the roof with the subject’s rifle. 

Addressing Incorrect Reporting

I would like to take this opportunity to clarify some information.

Encrypted Email Accounts: 
First, regarding the subject’s use of overseas encrypted email accounts. 

We understand these accounts were encrypted. However, the level of encryption was no more sophisticated than any standard, widely used, internet-based email service.  

We successfully accessed the information from these accounts and appropriately analyzed their content. 

However, we continue to identify and exploit the subject’s accounts. 

Release of the Crime Scene 

Second, regarding the release of the crime scene, the FBI did release the crime scene at the Butler Farm grounds, as well as the AGR complex to the property owners in a timely fashion.   

In fact, we released these sites on a rolling basis—but only after completing a thorough processing of each location, exhausting all efforts to collect any items of evidentiary value. 

Prior to releasing each site, we followed all appropriate evidence-gathering procedures and completed the final release of the scene seven days after the attack. 

Cleaning of the Biological Evidence 

Third, regarding the cleaning of the AGR roof, the FBI followed established evidentiary policies and procedures for the return of crime scenes to the property owner. 

This included cleaning the biological material from the AGR roof, only after ensuring we collected all relevant evidence.  

Release Of Subject’s Body 

I would now like to clarify the process undertaken to release the subject’s body to his family. 

After rendering the scene safe and following our established evidence gathering procedures, the FBI contacted the Butler County Coroner’s Office.   

Subsequently, the coroner removed the body from the scene and conducted a death investigation. 

The Butler County Coroner’s Office then deferred to have the Allegheny County Office of the Medical Examiner conduct the autopsy . 

Once Allegheny County completed the autopsy, the Butler County Coroner’s Office consulted with the FBI asking if there were any additional necessary investigative steps with respect to the body.   

The FBI and Pennsylvania State Police then concurred with the Butler County Coroner’s Office decision to release the remains to the subject’s family. 

I want to stress that It is not standard procedure or practice for the FBI or any law enforcement agency to request that the coroner or medical examiner maintain indefinite custody of a deceased subject’s body once the investigative purposes of our agency and our partner agencies are completed. 

Autopsy and Toxicology Results

I would also like to mention that the FBI is now in possession of the subject’s autopsy and toxicology reports from the coroner’s office.  

The autopsy report indicated the subject was pronounced deceased at 6:25 p.m. on July 13, 2024, as a result of a single gunshot wound to the head.

All reviewable evidence collected from the AGR roof and from the subject’s body are consistent with the round fired by the Secret Service sniper.  

Additionally, the toxicology report revealed negative results quote “for alcohol and drugs of abuse.” 

Interviews of First Responders on Night of Incident 

Next, regarding questions surrounding the release of first responders from the shooting scene on the night of July 13. 

We had no reason or intention to hold or detain any first responder, as the law enforcement community assembled in Butler was actively responding to public safety risks and assisting with investigative activity throughout the night.  

The FBI appreciates the monumental local law enforcement response that lasted hours after the attack and continues to this day. 

Our priorities that night—as shared by local law enforcement—were to secure the scene, preserve evidence, and ensure public safety. 
 
Interview of Former President Trump  

As previously reported, the FBI and the Pennsylvania State Police conducted a standard victim interview of former President Trump. 

During this productive interview, agents took the time to provide the former president with an in-depth briefing on the investigation and answered his questions regarding the attempt on his life.  

We’re grateful to the former president for his cooperation and his time. 

Timeline

I will now provide an update to the timeline associated with the subject’s actions prior to the shooting. 

Prior witness interviews indicated the subject was in the area of the AGR building at 4:26 p.m. 

Subsequent digital evidence review shows the subject was in fact near the farm show air strip, walking past a row of vendors outside the secure perimeter approximately a half mile away from the AGR grounds at 4:26 p.m. 

Second, video obtained from a local business showed the subject climbed to the roof of the AGR complex at approximately 6:05 p.m.  

Video from local business, police dash-cam, and police body cameras confirmed the subject’s movement across multiple AGR building roofs between 6:05 and 6:08 p.m. 

Finally, at 6:11 p.m., the subject fired eight rounds before being neutralized.  

Our overall finding is the subject was only on the roof for approximately 6 minutes, prior to the shooting, between 6:05 and 6:11 p.m.  
 
Wrap-Up

The FBI continues to work diligently to determine the subject’s motive. 

We believe the subject engaged in detailed attack planning well in advance of the campaign rally. 

We continue to pursue all investigative leads to determine any possible links to co-conspirators. 

The American people deserve answers, and the FBI stands committed to providing them. 

Posted on

Ensuring Safety at Sea

Source: Federal Bureau of Investigation FBI Crime News

In addition to reporting the incident to a cruise ship security officer as soon as possible, you can also report the incident to the FBI directly. Knowing your rights can help you speak up if something happens.

For investigators, a big challenge is delayed reporting.

Pagliarini stressed the importance of immediate reporting by victims and witnesses, especially considering the complexities of investigating crimes at sea.

Delays often occur because victims feel ashamed or uncertain and may only report the incident after discussing it with others once they return home, said Pagliarini.

“We get that a lot, or somebody has something stolen, and they don’t know until they got home and then report it,” said Pagliarini. “This delay complicates investigations, especially when victims are far from the location of the incident.”

Parker and Pagliarini suggest passengers avoid taking valuable jewelry—as it’s easy to lose or have stolen—be responsible when drinking, and go directly through the cruise line company when booking excursions.

They also explained that it is important to familiarize yourself with the guest services locations on the ship. And if you see an incident, do your best to be a helpful witness.

Behind every cruise ship crime incident is a human story of victims seeking justice and families grappling with loss. The FBI’s Victim Services Division offers support to those affected by crimes at sea.

“It’s very common if we have a juvenile involved, we make our best efforts to notify Victim Services ahead of time, and often they’ll accompany myself or whoever’s going out initially on the investigation,” said Pagliarini. From counseling referrals to support navigating the criminal justice process, their efforts extend to both victims and their families.

Additionally, the FBI conducts specialized training for industry partners, enhancing their ability to assist law enforcement with securing and documenting a crime scene at sea.

“We try to hold trainings with the cruise industry personnel, kind of a best practice as far as evidence preservation,” said Parker.

The collaborative approach to security at sea, along with passengers understanding how to mitigate risk, is vital to ensuring the FBI can work with partners at every level to investigate crimes on the high seas and keep Americans safe.

Posted on

Director Wray’s Remarks at the Women in Federal Law Enforcement Annual Leadership Training

Source: Federal Bureau of Investigation FBI Crime News

Women Serving as FBI Special Agents and FBI Police

For many years, far too many in the FBI’s early history, women did not have the opportunity to be special agents. And not for lack of interest. We know girls and women wrote the FBI back then to learn how they could become special agents.

One teenager, Nancy McRae, wrote Director J. Edgar Hoover such a letter in April 1971. And he sent a letter back to her, writing, in part—and I’m quoting here for historical accuracy—“Because of the nature of the duties our special agents are called upon to perform, we do not employ women in this position…We must have agents who are qualified to cope with any situation they may face.” 

I don’t think any speaker ever hopes to get booed by an audience, but I wouldn’t really mind it there.

What I know, what all of you know, and what Hoover either did not know or did not acknowledge, is that women are absolutely essential to effective law enforcement. And just a year later, Susan and Joanne proved not just that they could do the job, but that they could—and would—excel.

Fortunately, the numbers of women at the FBI who are special agents and FBI Police officers are steadily increasing. Ten years ago, women made up only 20 percent of our special agent ranks and only 16 percent of our FBI Police officers. These are officers who protect our employees and facilities and have to meet the same rigorous fitness and firearms standards as our special agents. Today, 22 percent of our FBI police officers are women, and women now make up 24 percent of our special agent cadre.

And we’re doing better every year. On average, women now comprise 37 percent of our new agent trainees. And at one of our agent graduations just a few months ago, women made up almost half the class. 

Now, of course, gun-toters aren’t the only women we have in the Bureau. More than 14 thousand women serve as intelligence analysts, professional staff, and more. From our newest employees at the line level to our career folks that serve on our executive team, women are an integral part of the FBI.

Take one of our newer special agents, who’s made high-caliber contributions to the Bureau as a new agent in our Shreveport Resident Agency. Special Agent Raquel Mobley investigated the kidnapping, rape, and brutal beatings of a Louisiana woman from two years earlier. The case hadn’t received much attention, and through her diligent work, Special Agent Mobley discovered seven others, including three children, who’d been victimized by the same subject.

Thanks to Special Agent Mobley’s determination, that monster ultimately received three life sentences. Now that’s a lot for any agent to accomplish right out of Quantico. But for Special Agent Mobley, that’s just the tip of the iceberg.

In her brief time in Louisiana so far, she’s also secured two civil rights indictments, including one that led to a guilty verdict in a particularly disturbing civil rights case. She’s headed up a sensitive public corruption investigation that sent two to prison for embezzling from the local police union. And she’s accomplished all of this while also working every single one of her office’s investigations into child exploitation and human trafficking.

Oh, and in her spare time, Special Agent Mobley’s become a crisis negotiator and earned her EMT certification.

We need women like Raquel because the threats we’re up against today are more complex than we’ve ever seen. To stay ahead of them, we need everybody’s experience, everybody’s knowledge, everybody’s specialized expertise. We’ve all got to bring our very best ideas to the table and have our best leaders in the room. The more diverse our teams are, the better the solutions we’ll come up with, and the greater impact we’ll make on the threats and the problems we’re all facing.

Diversity is important for so many reasons, not least of which because everything about who we are shapes the way we think. And in law enforcement, diversity of experience, background, and thought makes for stronger, smarter teams. And more women in law enforcement means better outcomes for us all—those we do the work with and those we do the work for.

30×30 Initiative

Those we do the work with include our partners at law enforcement agencies nationwide. And along with many of those partners, the FBI signed the 30×30 initiative pledge in March 2023—an important commitment to demonstrate our support to recruiting more outstanding women to law enforcement, including the Bureau.

Our goal is to keep building a world-class workforce. The best of the best. And to make that a reality, we need to keep expanding the pool, making sure people from all backgrounds know they have an opportunity to compete, and encouraging them to throw their hats in the ring. That’s how we’ll continue to bring the best of the best to the fight.

We’re proud of the progress we’ve made at the FBI on this front, but there’s always room for growth and improvement. That’s why we’re hosting events to recruit women at college campuses, career fairs, and athletic events across the country. 

And women are not just essential members of our teams today—women like Special Agent Mobley, for example, who are making a real impact in the communities they serve. Recruiting women now also pays dividends down the road, as women grow into leadership roles throughout the Bureau .

Today, women lead something like 17 of our 37 Headquarters divisions, including our Information and Technology Branch, our Weapons of Mass Destruction Directorate, the Directorate of Intelligence, and our Training Division, among others. And 12 women are special agents in charge of our 56 field offices.

But I’d like to see us do better, and I know we can. So we’re going to continue to examine how we can make our culture—our policies, our procedures, and our best practices—better than ever to support women in law enforcement.  

We know this kind of institutional improvement is more of a marathon than a sprint, and we’re in it for the long haul.

Conclusion

I’m optimistic about our progress and our future. And when I think about where we were 52 years ago—back when Director Hoover wrote his letter to Nancy McRae—and then I think about where we are today, I can’t help but be proud of how far we’ve come. At the Bureau and across law enforcement.

And that is due in no small part to all of you. So thank you for everything you do to support women in law enforcement. I look forward to seeing what we can achieve together in the future. 

Thanks. 

And now it’s my pleasure to introduce our next speaker—my friend, Deputy Attorney General Lisa Monaco. 

As the 39th Deputy Attorney General of the United States, Lisa has devoted her life to national security and public safety. An accomplished federal prosecutor, advisor, and leader, she’s held many positions throughout DOJ and the U.S. government over the years, including counsel to Attorney General Janet Reno; Assistant U.S. Attorney for the District of Columbia; Assistant Attorney General for National Security, as the first woman to hold that position; and Homeland Security and Counterterrorism Advisor to President Obama.

But I’d like to think some of her fondest professional memories might come from the years she spent at the FBI, where she served as special counsel and then chief of staff to Director Mueller. 

Throughout her career, Lisa has been a staunch advocate of safe communities for all Americans, and she has a long history of fighting for women’s rights. At the FBI, we’re fortunate to benefit from her partnership, and it’s great to see her here today.

Please join me in welcoming Deputy Attorney General Lisa Monaco.

Posted on

Investigative Updates on the Butler, Pennsylvania, Assassination Attempt

Source: Federal Bureau of Investigation FBI Crime News

Washington, D.C.

Media Call Transcript

FBI Assistant Director Cathy Milhoan: Good morning, everybody. This is Cathy, assistant director of the FBI’s Office of Public Affairs, and thank you all for joining us. This is a series of calls and briefings that we’ve had with you, members of Congress and others as part of our continuing efforts to deliver information to the public through you all.

This call is on the record, and you may record the call for audio. But that audio is embargoed until the call is over. So, again, you may record for audio but embargoed until the call is over. Joining me here today is FBI Deputy Director Paul Abbate; FBI Executive Assistant Director Robert “Bobby” Wells; and the FBI Pittsburgh Special Agent in Charge Kevin Rojek.

The Deputy is going to begin with comments, and then I’ll turn it over again to Special Agent in Charge Kevin Rojek, who is going to give an in-depth brief of our investigation thus far. Sir?

FBI Deputy Director Paul Abbate: Thank you, Cathy, and to our OPA colleagues for setting this up. Good morning, everyone, and welcome. Thanks to each of you for taking the time to join us today. As we’ve been doing in an effort to be fully transparent, given the national importance and the need to provide and ensure that the American people have all the information relative to this case. We, the FBI, are continuing to share all that we can about our investigation into the attempted assassination of former President Trump on July 13th in Butler, Pennsylvania.

We’re taking another opportunity today to do that to ensure that the most accurate, up-to-date information is provided publicly, in part, through each of you. So, thank you again. This investigation remains urgent and ongoing, and FBI personnel, agents, analysts, professional staff are working literally around the clock, 24/7, as we continue to uncover new and refined details and evidence regarding the attack.

Our teams, of course, are focused on building a timeline of events leading up to the attack, covering a number of different aspects. Our priorities within that, of course, are – to identify the shooter’s motive, which, as the SAC and the EAD will get into, is still not clear, and to determine whether any co-conspirators or associates were involved in or aware of the plot in advance.

To be clear, though we have ruled nothing out, and we’re leaving no stone unturned and continuing on that course, we have no information at this time that there are any co-conspirators.

While it is not typical for us, the FBI, to share details of an open investigation, we believe it is critical in this instance to provide the public and all of you with everything that we know about this heinous attack and to correct the record where inaccurate or false information is put out in the realm.

Again, as a result of all that, we’re doing everything in our power to fully share information and to be as transparent as possible with each of you. And we’re committed to ensuring that the most accurate information is reported, and we’re grateful again to each of you for helping us in that regard. We want to arm each of you and share with you real information, the truth, the cold hard facts that we’ve developed and continue to bring out in the course of our investigation.

In a moment, we’ll go over to Kevin Rojek, the Special Agent in Charge of our exceptional Pittsburgh Field Office. And Kevin will lay out further details regarding the investigation. We’re also joined by the Executive Assistant Director of our National Security Branch, Bobby Wells. But first, I wanted to take just a brief moment to thank, again, the hardworking FBI Special Agents, FBI Intelligence Analysts, and FBI professional staff who have been working nonstop since July 13th, literally moments after our personnel responded after receiving word from the Secret Service to the site and took over the lead in the investigation in the scene within mere hours of the incident occurring.

I had the opportunity to visit myself over the weekend the site in Butler, Pennsylvania, and also our field office there to meet with and hear from the people who are working on the front line on the case. And again, they’re doing an exceptional job. That includes also our extended investigative teams who have conducted literally hundreds of interviews and run down thousands of leads. It includes our evidence response teams, behavioral analysts, forensic scientists, operational technology personnel, victim specialists, and many, many others who are doing everything they can to advance and support this critical investigation.

We also seek to reassure the public that our teams are doing everything they can to support the after-action reviews. We know there are several that have already been announced or started through the DHS Inspector General, through Congress, through the independently named commission, and we plan to and are fully cooperating with each of those entities in pursuit of their mission in regard to this attack also.

I also want to highlight the cooperation with the U.S. Secret Service, with the Pennsylvania State Police, with Allegheny County and Butler County, and too many other to name state and local law enforcement partners, both in the investigation in terms of providing information to us in certain instances as witnesses. We’re grateful to each and every one of our partners in that regard as well.

To be clear, relative to that, relative to Secret Service, we’re not investigating from the FBI standpoint or evaluating what was done correctly or incorrectly by any protective service or other law enforcement agency, in regard to security planning, posture, or execution. We defer entirely to others, though we are collecting facts that is relative to that and that, again, we’re sharing cooperatively in order to assist those in conducting reviews focused on those elements. But again, the entirety of the FBI is committed to uncovering the real facts, the truth about this attack on former President Trump and the murder of Mr. Comperatore and the injury to others as well. 

And to keep the American people informed of those facts and the progress that we’re making and what we learn along the way. I’d now like to welcome, again, FBI Pittsburgh Special Agent in Charge, Kevin Rojek, to take it from here and to further discuss the investigation. We’ll follow that, as Cathy mentioned, with questions at the conclusion. Kevin? 

FBI Pittsburgh Special Agent in Charge Kevin Rojek: Thank you, Deputy Director Abbate. My name is Kevin Rojek, and I’m the special agent in charge of the FBI’s Pittsburgh Field Office. Our office is the lead investigative office since the incident occurred in the FBI Pittsburgh’s air responsibility. I want to begin by offering my condolences again to all the victims of this heinous act, to the family of heroic firefighter and father Corey Comperatore, who lost his life. To David Dutch and James Copenhaver, whose recoveries continue. And to former President Trump, who was also struck by a bullet, whether whole or fragmented into smaller pieces, fired from the subject’s weapon. I would also like to offer my support and gratitude to the seven local law enforcement officers injured either as a result of the shooting or from their actions during the initial response.

Regarding the scope of the FBI’s investigation, our mission is to attempt to identify a motive for the shooting and whether or not the subject acted alone or conspired with others to commit this act. The FBI’s role is not to investigate any failures in security or determine fault of any agency.

This investigation has involved a monumental effort by the FBI, along with our partners in the Pennsylvania State Police and the United States Attorney’s Office. I want to acknowledge the incredible team at FBI Pittsburgh, who have been working around the clock since the night of July 13th.

Additionally, more than 300 agents, intelligence professionals, and professional staff employees from across the FBI have contributed significantly to this investigation. Employees from approximately half of the FBI’s field offices, nearly all of our headquarters divisions, as well as several of our international offices, have lent their expertise and assistance in some capacity to this case.

To date, the FBI has conducted over 450 interviews with more likely to occur. We served legal process requests to 86 different companies related to accounts associated with the subject, meaning legal requests to these companies to provide the data and contents associated with these accounts.

As part of our normal investigative process, we regularly interview victims of crime to offer our support and learn more about their perspective regarding their experience. To that end, we have contacted former President Trump, and he has agreed to participate in a victim interview.

As part of our investigation, we examined over 2,100 tips from the public through our digital media tip line, including images, videos, documents, and audio recordings. This partnership and support from the public is absolutely critical after events like this, and I want to thank everyone who has sent in their tips thus far and encourage people to continue to contribute. Your information has proved to be invaluable.

Law enforcement and emergency personnel to include special agents and officers with the U.S. Secret Service and other state and local officers, as well as others who were attending the event on July 13th have all been extremely cooperative in the conduct of this investigation.

Our investigation quickly yielded a positive identification of the subject. Subsequent steps have been focused on better understanding what led this individual to execute this heinous attack. Investigators have interviewed dozens of people who knew or interacted with the subject. This included family members, co-workers, former teachers, classmates, and others.

We also consulted with specialists assigned to the FBI’s Behavioral Analysis Unit to offer their expertise as we worked to develop a profile of the subject. We have learned the subject was highly intelligent, attended college, and maintained steady employment. His primary social circle appears to be limited to his immediate family, as we believe he had few friends and acquaintances throughout his life.

We’ve identified our subject’s interest in shooting began as a hobby and progressed into formal firearms training courses, particularly since September of 2023. We continue to analyze his electronic devices and social media accounts for additional information and insight into his psyche. We have searched and continue to search multiple cell phones related to the subject, as well as other electronics, including laptop computers, a router, and memory cards.

The FBI is looking at the email accounts, gaming accounts, messaging platforms, social media accounts, as well as online search engines in an attempt to determine a possible motive and whether the subject acted alone or worked with co-conspirators.

From our subject’s Internet search history, we determined the subject specifically searched, and I quote, “how far away was Oswald from Kennedy”. Additionally, our investigation has revealed he also made searches related to power plants, mass shooting events, information on improvised explosive devices, and the attempted assassination of the Slovakian Prime Minister earlier this year.

Another point of clarification: the investigation has revealed searches of nationally elected officials, including our current and former presidents, and a detailed analysis of those searches is ongoing. All other images associated with searches of key American political figures appeared only as cached images, likely as a result of the subject reviewing news stories and media coverage online, and not specific searches associated with these individuals.

While the FBI’s investigation may not yet have determined a motive, we believe the subject made significant efforts to conceal his activities. Additionally, we believe his actions also show a careful planning ahead of the campaign rally.

We identified the model of the rifle the subject used; a DPMS AR-15 style firearm designed to shoot 5.56-millimeter ammunition. Thanks to our partners at the ATF, we know the weapon was purchased legally in 2013 by the subject’s father, and our investigation has shown it was legally transferred to our subject last year from his father. We continue to analyze the rifle and shell casings at the FBI Lab in Quantico, Virginia.

We know the weapon had a collapsible stock, and we know the subject carried a backpack with him as he made his way to the position on the roof. However, we are still working to determine how the subject was able to conceal the rifle until just minutes prior to the shooting.

Regarding explosive devices, we recovered two explosive devices from the trunk of the subject’s vehicle near the site of the rally, and one explosive device in the subject’s room at his residence. These devices consist of ammunition boxes filled with explosive material with wires, receivers, and ignition devices connected to them.

The FBI Laboratory has determined that both IEDs recovered from the subject’s vehicle did not explode adjacent to the site of the rally due to the receivers both being in the off position. Explosive experts in the FBI Lab assessed the devices from the subject’s vehicle were capable of exploding. However, the magnitude of the damage associated with an explosion is unclear.

As recovered, the IED from the subject’s residence was determined to be non-functional due to missing initiation system components. Our lab continues to analyze bullet and bullet fragments from the scene, the explosive devices located in the subject’s vehicle and home, the drone located in his car, and other physical evidence including fingerprints and foot impressions.

Regarding the subject’s use of a ladder, our investigation has revealed the subject did, in fact, purchase a ladder at a hardware store on the day of the attack. However, that ladder was not present with the subject at the farm showgrounds at the time of the shooting.

Our investigation has revealed the ladder was left at a location near his home, approximately 50 miles away from the site of the rally in Butler, Pennsylvania. And to clarify again, this ladder was not used during the course of the attack on July 13th. Through analysis by our Evidence Response Team, we believe the subject accessed the roof by scaling some HVAC equipment along with a pipe located outside of the business and the AGR compound.

Numerous media outlets have also reported a bicycle and a backpack attributed to the subject. However, our investigation has determined that neither of these items belong to the shooter. In fact, we have positively identified and interviewed the owner of both of those items. I know there are many questions surrounding the timeline of events.

Again, I want to be clear, the purpose of our investigation is not to identify security failures or the failures of any agency on that day. I want to provide some details about what we’ve gleaned about the subject’s movements and planning activities prior to the attack.

Starting in the spring of 2023, the subject made more than 25 different firearms-related purchases from online firearm’s vendor using an alias. Throughout the first half of 2024, the subject made six chemical precursor-related purchases online of materials used to create the explosive devices recovered in the subject’s vehicle and home. And again, for those purchases, he used aliases.

On July 3rd, the campaign announced its intention to hold a rally in Butler, Pennsylvania. And on July 6th, the subject registered to attend the event. That same day, the investigation revealed our subject used an Internet search browser to query how far away was Oswald from Kennedy.

On July 7th, the subject traveled from his home to the site of the rally, spent approximately 20 minutes in the area, including the area around the AGR buildings, in what we believe was an early surveillance of the site before heading back to his home.

On July 12th, the day before the rally, the subject visited a local shooting range and practiced with what we believe was the same weapon used in the day of the attack.

The following timeline I’m about to cover of events highlights confirmed significant sightings of the subject in and around the rally site that day, established through an exhaustive review of police dash camera video and from cameras of six local area businesses. This timeline does not take into account much of the information from known radio communications between law enforcement on the ground, as the FBI is still working to confirm the exact timeline based on that information. However, we have included some information here to help explain his movements.

We assessed the ammunition used the day the attack was purchased legally that day. The subject brought 50 rounds at a local gun store. The morning of July 13th, the subject traveled from his home to the site of the rally at approximately 11:00 am and spent over an hour in the area before traveling home again.

Then at approximately 1:30 pm, the subject obtained a rifle from his residence and informed his parents he was heading to a nearby shooting range. At approximately 3:45 pm, the investigation has confirmed the subject again arrived in Butler at the site of the rally. He parked his vehicle and began flying his drone in proximity to the rally site from about 3:50 pm to just after 4:00 pm, for approximately 11 minutes.

The investigation found this drone flight was conducted approximately 200 yards from site of the rally by reverse engineering the metadata associated with the subject’s drone. The ongoing analysis did not reveal any photos or video taken from the drone as there was no memory card recovered inside the device when it and the controller were discovered in the subject’s vehicle.

The FBI is still working to determine if the subject was viewing footage on the drone’s controller, and whether that may have revealed further insights that day into the security posture at the location from which he ultimately carried out his attack.

Just after approximately 4:00 pm, the subject left the scene in his vehicle and appeared to drive throughout the area in the vicinity of the shooting for a period of time. Shortly after approximately 5:00 pm, we assessed the shooter was identified by law enforcement as a suspicious person in the area of the AGR building and grounds.

A local officer took a photo of the subject and sent it to other SWAT Coordinators on scene as well as local command personnel. Approximately 30 minutes later, shortly after 5:30 pm, SWAT Coordinators observed the subject using a range finder and browsing news websites on his phone.

The next confirmed observation is at approximately 5:56 pm when the subject was seen walking in the vicinity of the AGR buildings carrying a backpack.

At approximately 6:08 pm, police dashcam video observed the subject traversing across the roof of the business in the direction where he ultimately fired his shots. Our assessment is that the subject climbed using HVAC equipment and piping outside of the AGR facility, made it onto the roof, and then traversed across multiple rooftops to get to his ultimate shooting position.

At approximately 6:11 pm, a local police officer was boosted onto the roof by another officer where he encountered the subject. The subject pointed the rifle at him, and the officer immediately dropped to the ground.

After approximately 25 to 30 seconds after this encounter, the subject fired eight rounds before being successfully neutralized by a United States Secret Service counter-sniper.

After the shooting, the FBI identified eight shell casings at the scene, and we assessed the subject fired eight rounds at the former president and into the crowd of attendees.

While the FBI’s investigation may not have yet determined a motive, we believe the subject made significant efforts to conceal his activities. Additionally, we believe his actions also show careful planning ahead of the campaign rally.

I want to again thank the public for their assistance as we continue to carry out our investigation.

I also want to thank the many law enforcement agents and officers, victims and witnesses who have cooperated with this investigation. We know there are still lingering questions, but be assured the FBI will continue this investigation for the foreseeable future. Thank you.

Milhoan: Thank you, Deputy. Thank you, Kevin. We will begin our first question.

Reporter Question: Hey, thanks a lot for the transparency here. We really appreciate it. About the drone, what have you determined about whether there was a temporary airspace restriction in place at the time he flew it? And was there any counter-drone capability on site when he flew it? And then can you share anything about what the Behavioral Analysis Unit has concluded about his mental state, his selection of victims, his sophistication level? You kind of alluded to some of it, but – and does he fit the profile of other people who have carried out mass shootings as opposed to politically motivated violence, or is there a difference there?

Rojek: Regarding the drone, we would defer to Secret Service regarding any actions they took regarding either a no-fly zone or counter-drone operations.

Regarding consultation with BAU, I invited them to be part of the investigation during the first week. They came in, did initial assessment, and then they continued to work with us regarding an overall assessment. We – they believe, as we do, that the subject was highly intelligent. We know he attended college and maintained steady employment. We do still believe that he was a loner. As far as his association or any other activities related to his mental state, we are still continuing to assess all items from his social media accounts, from different electronic devices, and it will be, like, a process as we continue to develop profile associated with them.

Abbate: Just to add, this is something, of course, you know, much like all of you were very focused on. As Kevin mentioned, we have reflections of this individual’s personality by virtue of the interviews we’ve done with the mother, father, co-workers, classmates, anyone and everyone we can, you know, make contact with. We’re gathering that information. I think other than sort of the broad outline that Kevin provided, you know, we’re relying on our behavioral analysis experts as they do in the course of their work to put all that together and, you know, render some of the assessments that you’ve referenced here.

I would also note, just as far as mental health, we are certainly looking into that. At this time, though, we’re not ruling anything out, we have no information or evidence of mental health treatment, institutionalization, medications, or anything like that.

Reporter Question: Good morning. I had a question on – have you determined or found any gaps in communication timelines between the Secret Service and local law enforcement snipers? For example, we’re hearing that Secret Service did not brief the local snipers the day before the rally.

Abbate: As we’ve already stated, we’re collecting facts and information, as you’ve referenced radio communications, video from all around, and in furtherance of our investigation focused on the shooter motive, about whether any co-conspirators that type of stuff. We’re certainly assembling and collecting evaluating all of that, but we’re going to defer to the commissions and other entities that I referenced earlier in terms of evaluating that from a security posture, perspective, preparation, and any failures within that.

We’re not undertaking to do that here. It is evolving. I will tell you, having just visited with our field office and at the site over the weekend, the collection of information and evidence is ongoing to include all that stuff. It’s a very painstaking and rigorous process to piece together, to verify and authenticate time stamps on video communications and all that. And we’re still in the process of doing that to help others assess and render some of the conclusions that we’re all interested in hearing just even beyond the FBI investigation.

Reporter Question: In a previous briefing, you guys mentioned a number of encrypted apps that the suspect had used. We also noticed the CEO of Gab said on social media this past week that they believe they found an account associated with the shooter and that he had been posting pro-Biden messages.

I wanted to see if you could clarify a little bit about or update a little bit about the encrypted apps that you were looking at. Have you been able to get into them? And also, whether there’s any truth to this Gab CEO’s comments.

FBI Executive Assistant Director Robert R. Wells: Hey, good morning. Bobby Wells here. I can take that question. So, encryption has been a challenge for us here in this investigation. I think initially, you know, we had a delay in getting in the phone, which we were able to overcome. As far as accounts that he used, there were a couple of foreign-based encrypted email accounts that he was using. And we have – again, we faced some delays, but we worked closely with our foreign partners and obtained as much information as we could about those accounts.

Obviously, the concern was to identify whether there were any potential co-conspirators or foreign involvement. Based on what we’ve seen in the review of those accounts, the subject appeared to be utilizing them primarily to purchase firearm components, chemicals, and other explosive components.

We also identified some additional accounts and identifying information, including aliases he was using on these encrypted platforms. As far as the Gab piece of your question, I don’t have any additional information to provide on that at this time.

Reporter Question: I was just wondering if you could sort of shed some light into what, if anything, the gunman’s parents knew or are sharing with you about this, you know, exhaustive planning which seems to be happening inside their house. I mean, were they aware of that, or have they explained to you why they were not?

Rojek: I will say, the parents have been extremely cooperative from the first night when we approached them and throughout the investigation.

So, I would caution against the word exhaustive when we talk about his planning. We know he did some prior pre-planning. We’re seeing additional activity associated with his planning, but anything he was doing was online. He wasn’t hoarding ammunition. He wasn’t doing anything that I would say would significantly raise the suspicion of his parents in his home.

Abbate: And I don’t know if we’ve said this before, but the parents have said in their interviews that they had no advanced knowledge of any of this. We do find that to be credible at this stage, but pending additional investigation, again, we’re not ruling any possibility out.

As far as what was in the home, the chemicals and explosives-related materials, it’s our understanding from the parents and others that the shooter had a long interest in science and things like this and had been doing experiments and things like this over a period of time. And for that reason, they weren’t concerned that it was focused on committing an attack of this nature or harming other people.

Reporter Question: You said earlier that 86 different companies were providing – could potentially provide data. There’s been reporting that he had really no social media presence. Was there any indication that he had any contacts, that he was participating in chat rooms, that he was communicating with anybody in an informal way to share technical information, even if it wasn’t conspiratorial. And if you can also just clarify this notion that his social circle was essentially his immediate family. Did he have any friends? Have you uncovered any sense that he might have communicated with someone outside of his house?

Wells: So, regarding his social circle, we know that – you are correct, the primary social circle is his family. We have identified only a couple people who we would call his friends and most of those contacts were in fact dated.

Regarding his activity in social media accounts and gaming platforms, even in his gaming platforms we see very little interaction with other individuals, which is, obviously, outside the norm with what you normally see, particularly in gamers.

So, again, we continue to analyze his accounts, and we continue to look for any other individuals that he may have been associated with. And then when we identify with even an ancillary connection with the subject, we go out and conduct interviews. But to date, we have not found anyone that is really close to him in any type of social circle.

Reporter Question: Hi. Thank you so much for doing this call. You mentioned that former President Trump has agreed to be interviewed. Can you walk us through some of the questions or information that you think he could provide that would be relevant? Thank you so much.

Wells: So, the interview of the former President will be consistent with any other victim interview that we do. Again, we provide victims with support from our victim services, and we want to get his perspective on what he observed. So, just like any other witness to the crime, as well as get his perspective on what occurred to him during that event. But it is a standard victim interview like we would do for any other victim of crime under any other circumstances.

Milhoan: This is going to conclude the briefing for today. We’ve given you a lot of information that we haven’t had an opportunity to say publicly thus far, so thank you for joining the call. Thank you to our briefers.