The Butler PA Trump Assassination Attempt: What We Still Don't Know.

The near-miss at Butler Farm Show grounds is not a mystery in the conventional sense. The shooter is identified. The autopsy is complete. The motive, as far as the FBI has been willing to publicly commit to, is an answer in the shape of a non-answer — "unclear." What has instead produced the enduring questions is the physical record: a rooftop that should have been covered and was not, a 62-minute warning window that was not acted on, a counter-sniper who saw the threat and did not engage, a phone with encryption unusual for the age profile, and an institutional response that produced the resignation of the Secret Service director within ten days. Researchers argue what happened in Butler is less an open-and-shut case than a file left half-read.

Where it started — and what actually happened at 6:11 PM

Donald Trump arrived at the Butler Farm Show rally grounds in Butler County, Pennsylvania on the afternoon of Saturday, July 13, 2024. He was by then the presumptive Republican nominee; the Republican National Convention was scheduled to begin two days later in Milwaukee. Attendance at the Butler rally is estimated at approximately 15,000. Weather was clear. Trump's remarks began at 6:02 PM EDT.

At 6:11 PM EDT, nine minutes into his speech, as Trump was gesturing to a chart showing US border-crossing data, a series of rapid rifle reports began. Eight rounds in all. One grazed the upper cartilage of Trump's right ear, producing a visible blood streak captured in the photograph that would become the defining image of the 2024 campaign. Trump dropped to the stage behind the lectern. Secret Service agents piled on top of him. Within seconds, a Secret Service counter-sniper on the American Glass Research building — identified in subsequent testimony as Special Agent Jonathan Willis — fired a single round that ended the threat. When Trump was pulled to his feet forty-eight seconds later, blood visibly streaming from his ear, he raised his fist to the crowd and mouthed, three times, "Fight."

Behind the rope line in the bleacher area, Corey Comperatore, 50 — a volunteer firefighter with the Buffalo Township Volunteer Fire Company, an insurance agent at Sarnelli Insurance, and a father of two — was dead. He had dived to shield his wife and daughters when the shots began; a round struck him in the head. Two other rally attendees, David Dutch, 57, and James Copenhaver, 74, were seriously wounded. Both subsequently recovered.

The shooter, Thomas Matthew Crooks, lay dead on the roof of the AGR Industries manufacturing building approximately 130 to 150 yards from the rally stage. He was 20 years old. His rifle — a DPMS-pattern AR-15 — was beside him. His body was identified by DNA within twenty-four hours.

The 62 minutes before the shot

The thread that has made Butler the case it became — rather than a tragic but sealed one — is the timeline of what the Secret Service, the Pennsylvania State Police, and the Butler Township Police had collectively been told, and when. The Senate Permanent Subcommittee on Investigations' interim report of September 25, 2024, compiled from radio logs, body-camera footage, interviews, and internal communications, established the following:

At approximately 5:10 PM — roughly sixty-two minutes before the shooting — local law enforcement first flagged an individual later identified as Crooks as "suspicious." He had been seen near the magnetometers with a rangefinder. He did not attempt to enter the rally. He withdrew toward the AGR Industries complex. Over the next hour, rally attendees repeatedly pointed him out to local police and, in some cases, to Secret Service personnel. He was photographed by at least one attendee on a mobile phone. At approximately 5:51 PM, a Butler Township police officer photographed Crooks from below as he stood on the AGR roof. The officer radioed the observation. The radio network the officer used was not the same as the one the Secret Service was operating on.

At approximately 6:09 PM — two minutes before Trump began firing — a Butler Township officer boosted himself up the ladder to the AGR roof to investigate. Crooks rotated and pointed the rifle at the officer, who dropped back down. A radio call reporting "man with a gun on the roof" was made. By the time the alert reached the Secret Service counter-sniper team, at approximately 6:10 PM, Crooks was in firing position.

A Secret Service counter-sniper on Trump's detail — not Willis; the counter-sniper on the adjacent barn rooftop — later testified that he had observed Crooks through his scope prior to the shots and had identified him as a threat, but was unable to engage because he had not yet received authorization from his operational chain of command. Willis's eventual shot came after Crooks had fired all eight rounds.

What the theory actually argues

The umbrella "Butler conspiracy" is not one claim. It is a cluster, and the framings vary considerably in how far from the official record they depart. The minimum-version claim — shared by a wide range of researchers, political commentators across the spectrum, and the bipartisan House Task Force itself — is that the shooting was operationally preventable and that the Secret Service's institutional response was a serial failure rather than a single-point failure. The House Task Force used the word preventable in its December 17, 2024 final report. That is not, in the technical sense, a conspiracy; it is an admission.

The institutional-negligence framing holds that Butler is primarily a story about agency dysfunction: split radio networks, confused assignment of the AGR rooftop between Secret Service and local police, an agency under-resourced for Trump's detail specifically, a director (Cheatle) who had reportedly denied earlier requests for additional assets, and counter-sniper engagement authority that was not pre-delegated to the units on scene. This framing does not require a coordinated plot. It requires only that the layers of American protective infrastructure had eroded to a point where a 20-year-old with a legally purchased rifle and an unsecured rooftop could come within a millimeter of killing a former president.

The deliberate-standdown framing is the stronger version. It holds that the operational failures were too numerous and too fundamental to be negligence, and that at some point in the chain of command a decision was made — whether by commission or deliberate omission — to leave the AGR rooftop uncovered. The specific claims advanced in this framing: that requests for additional counter-sniper assets for Trump's detail had been denied in the weeks before Butler; that the agent assignments for July 13 included a higher-than-usual proportion of personnel from Jill Biden's detail rather than trained counter-assault operators; and that the authorization latency for the counter-sniper who saw Crooks was not accidental but reflective of an operational posture. The framing points to the six senior leaders removed or reassigned in the months after Butler as indicative that internal review did not find simple human error.

The coordination framing is the furthest version, and the one with the least direct evidentiary support but the most enduring public traction. It argues that Crooks — a 20-year-old with unusually strong operational security on his communications (Signal, WhatsApp, encrypted devices), no prior behavioral flags, and no coherent ideological profile — is inconsistent with a purely self-directed actor, and that the degree of sophistication required to pair a physical approach with the AGR rooftop overwatch with the specific timing of the counter-sniper delay suggests coordination with parties who have not been publicly identified. This framing does not name those parties. Its structural argument is that the gap between what 20-year-old lone gunmen typically produce (manifestos, forum activity, ideological artifacts) and what Crooks produced (encrypted phones, almost no digital trail, a methodical reconnaissance) is anomalous and unexplained.

The variations

Within those three framings, a number of specific sub-claims recur. The bullet-path question: the trajectory of the round that grazed Trump's ear, per ballistic reconstruction, exited along a vector that — had Trump not turned his head at the instant he did to look at the border-crossing chart — would have entered his skull. Trump's head movement, shown in video to have begun approximately 0.2 seconds before the first shot, has been described by some commentators as providentially timed. The AR-15's nominal muzzle velocity produces flight time at 130 yards of roughly 0.15 seconds; the overlap between Trump's head turn and the round's arrival is tight. Believers in a targeting-assistance framing point to this as an almost-hit that required everything to go right for the shooter's weapon and wrong for the shooter's aim.

The counter-sniper delay: the agent on the barn rooftop who observed Crooks but did not fire has not been publicly named. His testimony to congressional committees (in closed session) has not been fully released. The operational rule governing counter-sniper engagement — specifically, whether it required voice authorization from a particular supervisor, or whether it was pre-delegated — became a focus of the Senate Permanent Subcommittee investigation. The subcommittee's finding was that authorization had not been pre-delegated. That is, in the protective-operations world, an unusual choice.

The AGR rooftop coverage: whether AGR Industries was inside the rally's "inner perimeter" or "outer perimeter" — the technical distinction between Secret Service and local police responsibility — was itself disputed in the investigation. Local police testified their understanding was that Secret Service was covering the roof. Secret Service testimony indicated the opposite. The GAO report of September 2024 noted that no joint operations order had formally assigned the coverage. A rooftop with the best line of sight to the stage was, by the official record, not formally assigned to anyone.

The Crooks digital profile: his phones used Signal and WhatsApp. He had searched, per the FBI, for the dates of both the Butler rally and the Democratic National Convention — suggesting target selection by proximity and opportunity. But the digital minimalism of a 20-year-old former high school classmate described as "quiet" and "kept to himself" — and the absence of the online forum activity, gaming-platform presence, or social-media footprint that nearly every other American 20-year-old produces — is what independent researchers have repeatedly flagged. The FBI described what it found on the unlocked device as "limited ideological content." It has not described the absence of the ordinary content.

The evidence

The public evidentiary record on Butler is unusual for a high-profile case in its completeness on some dimensions and its opacity on others. What is public: the rally audio and video from multiple angles; the ballistic analysis in the Senate PSI report; the radio logs (partially redacted); the body-camera footage from Butler Township and Pennsylvania State Police officers (substantially released); the FBI's affidavit summaries; Kimberly Cheatle's July 22 congressional testimony transcript; FBI Director Christopher Wray's July 24 testimony transcript; Ronald Rowe's subsequent testimony; the GAO report of September 2024; the Senate Permanent Subcommittee's interim report (September 25, 2024) and final report (December 2024); the House Homeland Security Committee report; and the bipartisan House Task Force's final report (December 17, 2024).

What has not been fully released: the closed-session testimony of the Secret Service counter-sniper on the barn rooftop; the FBI's complete forensic report on Crooks's phones; the contents of his personal laptop (per public statements, the FBI's review found limited ideological content but full disclosure has not been made); the internal Secret Service after-action report; and, of material importance to the coordination framing, whatever correspondence between agents and supervisors passed in the 62 minutes before the shooting on Secret Service channels (as distinct from the local police channels that have been released).

The Comperatore family civil litigation, filed against the United States in the Western District of Pennsylvania in 2025, is the most substantial mechanism through which additional material may be produced. Civil discovery can reach materials that the FBI's closed-case disposition would otherwise keep out of public view. As of early 2026, that discovery is ongoing, and a number of depositions of Secret Service and local police personnel have been scheduled.

The connections people make

Butler does not sit in isolation. The independent-research conversation around it connects the event, with varying degrees of rigor, to a cluster of adjacent framings. How tightly to treat the connections is the interpretive question. Here is what the conversation actually contains.

The pattern-of-political-violence framing holds that the period 2024–2025 produced an anomalous concentration of attempted or completed attacks on American political figures: Butler itself (July 13, 2024); the Routh attempt at West Palm Beach (September 15, 2024); the September 2025 attack on Charlie Kirk that ended in his death; and a cluster of earlier incidents at lower profile. Researchers argue this density is not statistically consistent with the preceding decades and is worth examining as a phenomenon rather than treating each case separately. Skeptics of the framing note that causal chains at that level of abstraction are difficult to establish.

The Crooks-as-unusual-profile framing compares Crooks to the canonical lone-gunman profiles from earlier cases — Lee Harvey Oswald in Dallas (defector background, intelligence-adjacent biography, complex backstory), Sirhan Sirhan in Los Angeles (ideological framing, hypnosis-adjacent claims around his memory), James Earl Ray in Memphis (organized logistics and travel), Mark David Chapman in New York (deep ideological-textual backstory) — and argues that Crooks does not fit the profile of a self-directed 20-year-old shooter. A self-directed 20-year-old produces artifacts. Crooks produced almost none. See our coverage of the JFK assassination and the MLK assassination for the historical-pattern comparisons.

The Secret Service institutional-decline framing connects Butler to a decade of prior Secret Service incidents: the 2011 gunfire against the White House (shots fired into the residence that were not detected as gunfire for four days); the 2014 fence-jumping incident in which Omar Gonzalez entered the White House East Room; the 2014 elevator incident in which an armed contractor rode an elevator with the President; the prostitution and staffing scandals; and the ongoing recruitment and retention challenges. Butler, in this framing, is the culmination of an agency that had been warning for a decade that it was stretched beyond capacity.

The Cheatle-DEI framing — advanced primarily by right-of-center commentators — argues that Cheatle's public emphasis on diversity, equity, and inclusion hiring targets during her tenure, combined with the deployment of a higher-than-usual proportion of female agents on Trump's detail that day, indicates that the Secret Service had been reorganized around hiring criteria that were not operationally optimal. The framing's empirical claims about the composition of Trump's detail on July 13 are contested; the argument at its core is about agency prioritization rather than any individual agent's performance.

Key voices

• Sen. Ron Johnson — chair, Senate Permanent Subcommittee on Investigations; produced the most operationally detailed congressional report on Butler, including the radio-log and body-camera reconstruction.
• Sen. Richard Blumenthal — ranking member on the subcommittee; his bipartisan posture with Johnson produced one of the few genuinely cross-party investigative products of the 118th Congress.
• Rep. Mike Kelly — chair, bipartisan House Task Force; the district adjacent to Butler County; his December 17, 2024 final report used the word "preventable."
• Kimberly Cheatle — former Secret Service Director; resigned July 23, 2024; her July 22 House Oversight testimony is the widely-cited record of the institutional failure.
• Ronald Rowe — Acting Director succeeding Cheatle; testified in closed and open sessions through 2024.
• Christopher Wray — FBI Director at the time; testified July 24, 2024; departed the Bureau in 2025.
• Paul Abbate — former FBI Deputy Director; subject-matter witness at multiple hearings.
• Dan Bongino — former Secret Service agent, current FBI Deputy Director; sustained public critic of the agency's July 13 performance before joining the incoming administration.
• Rep. Byron Donalds — House Oversight member; prominent post-hearing public commentator.
• Gov. Josh Shapiro — Governor of Pennsylvania; at the scene in the hours after; his public statements documented the Comperatore family's response.
• Helen Comperatore — Corey Comperatore's widow; lead plaintiff in the civil litigation against the Secret Service and the United States.

For connected material on the political-violence pattern, see our coverage of the Charlie Kirk assassination, the JFK assassination, and the Seth Rich murder — cases in which the relationship between the official ruling and the investigative record has remained disputed.

The official position

The FBI's position, as of the closure of its investigation in the first quarter of 2025, is that Thomas Matthew Crooks acted alone, that his motive remains unclear, that he used a legally purchased weapon, and that no coordination with other parties has been established. The Secret Service's position, through Acting Director Rowe and subsequently Director Sean Curran, is that Butler represented a "failure at multiple levels" for which institutional accountability has been taken — through Cheatle's resignation and the removal or reassignment of six additional senior leaders. The bipartisan House Task Force's December 2024 final report described the attack as preventable and produced a set of structural recommendations (pre-delegated counter-sniper engagement authority; unified radio networks for protective operations; explicit perimeter-assignment protocols) that have been partially adopted. The Department of Homeland Security's inspector general review is ongoing as of early 2026.

Where it is now

As of April 2026, the Butler case occupies a contested institutional status. The criminal investigation is closed. The congressional investigations have published their final reports. The Comperatore civil litigation is in active discovery. The Secret Service has restructured elements of its counter-sniper and protective-operations doctrine. Kimberly Cheatle has returned to the private sector. The AGR Industries building remains where it stood on July 13, 2024. The Butler Farm Show grounds have resumed normal operations.

Trump, having won the November 2024 election, returned to the White House in January 2025. The Butler ear injury has become a recurring motif in his public remarks. In the second attempt, at West Palm Beach on September 15, 2024 — two months after Butler — Ryan Wesley Routh was identified with an SKS-pattern rifle positioned in shrubbery along the sixth hole of Trump International Golf Club. Secret Service agents engaged him; he fled and was apprehended in Martin County. His trial is scheduled for 2026. The two cases are operationally unrelated but have been connected in the independent-research conversation as the pattern of 2024–2025.

The underlying question — whether Butler was a serial negligence failure or something more — has not been resolved by any existing American institution to the satisfaction of most of the public that follows it. Polling conducted in late 2024 and 2025 consistently showed a majority of Americans across the political spectrum expressing skepticism that they had been told everything. The civil discovery process is the remaining mechanism through which additional material may emerge. What it produces, or does not, is likely to shape the durable historical record.

Go deeper

Frequently asked questions

What happened in Butler, Pennsylvania on July 13, 2024?

At 6:11 PM EDT, Thomas Matthew Crooks, 20, fired eight rounds from an AR-15-style rifle from the rooftop of AGR Industries, approximately 130–150 yards from the stage where Donald Trump was speaking to a crowd of roughly 15,000. One round grazed Trump's upper right ear. Corey Comperatore, 50, was killed shielding his family. David Dutch and James Copenhaver were wounded. Crooks was killed seconds later by Secret Service counter-sniper Jonathan Willis.

Who was Thomas Matthew Crooks?

A 20-year-old from Bethel Park, PA. 2022 graduate of Bethel Park High School. Student at Community College of Allegheny County. Worked at Bethel Park Skilled Nursing and Rehabilitation. Registered Republican voter; a $15 donation to the Progressive Turnout Project at age 17. Described by classmates and coworkers as quiet. The FBI describes his motive as "unclear."

What weapon did Crooks use?

A DPMS-pattern AR-15-style rifle, legally purchased by his father Matthew Crooks. Crooks fired eight rounds. Rudimentary explosive devices and a remote detonator were recovered from his vehicle.

How was Crooks able to reach the rooftop?

The AGR Industries roof was within the outer perimeter, offered the best line of sight to the stage, and was not clearly assigned to either the Secret Service or local police. Crooks was flagged as suspicious by local police approximately 62 minutes before the shooting and was photographed on the roof by a Butler Township officer at 5:51 PM. The Senate PSI report documented split radio networks, confused perimeter assignment, and a counter-sniper who had identified him but could not engage.

Who was Corey Comperatore?

A 50-year-old volunteer firefighter with Buffalo Township VFD and an insurance agent at Sarnelli Insurance. He dove to shield his wife and daughters when the shots began and was struck in the head. He was pronounced dead at the scene. He is the only fatality other than the shooter.

Why did Secret Service Director Kimberly Cheatle resign?

She resigned July 23, 2024, one day after her House Oversight Committee testimony. The hearing was widely regarded as a disaster; members of both parties called for her resignation during the hearing. Ronald Rowe succeeded her on an acting basis. Six other senior Secret Service officials were subsequently removed or reassigned.

What did the congressional investigations find?

The Senate Permanent Subcommittee (interim September 25, 2024; final December 2024), the House Homeland Security Committee, and the bipartisan House Task Force (December 17, 2024) produced overlapping findings: split radio networks, unassigned AGR rooftop coverage, a counter-sniper who could not engage without authorization, incomplete counter-UAS coverage, and denied resource requests from Trump's detail. The Task Force used the word "preventable."

What was the second assassination attempt at West Palm Beach?

On September 15, 2024, Secret Service agents at Trump International Golf Club in West Palm Beach spotted Ryan Wesley Routh, 58, with an SKS-pattern rifle in shrubbery along the sixth hole while Trump was playing. Agents fired; Routh fled and was apprehended. His trial is scheduled for 2026. The two cases are operationally unrelated but are frequently discussed together.

What was Crooks's motive?

Officially: "unclear." No manifesto. Encrypted Signal/WhatsApp phones unlocked July 15, 2024 revealed "limited ideological content." He had searched the dates of both the Butler rally and the DNC, suggesting target selection by opportunity. He had visited the rally site earlier on July 13 for reconnaissance. No coherent ideological profile has been produced in the public record.

What questions do researchers argue remain unanswered?

Why the AGR rooftop was not secured; how Crooks climbed a ladder with a rifle while being photographed and reported; why the counter-sniper who identified him did not engage; why his digital profile was unusual for a self-directed 20-year-old; whether any contact with other parties preceded the act. The FBI case is closed; the Comperatore civil discovery is ongoing.