Thomas Crooks used the alias “Bob Dole” to order rifle parts and tools online before his assassination attempt on Donald Trump last July, according to newly released FBI records.
The 20-year-old gunman’s father, Matthew Crooks, 50, disclosed the pseudonym to FBI investigators during an interview on July 15, 2024, two days after his son opened fire at the Butler Farm Show Grounds in Pennsylvania. The elder Crooks told agents that packages addressed to the fake name were delivered to the family’s home and contained components to expand his weapon’s capacity — the same rifle Matthew had handed his son that morning.
The choice of moniker puzzled investigators. The late Kansas senator and 1996 Republican presidential nominee had no known connection to the young man, whose parents insisted he showed little interest in politics. Thomas Crooks instead appeared motivated by operational security concerns rather than partisan alignment.
Matthew Crooks explained that his son adopted false identities after the father’s bank account was compromised. The younger Crooks then schooled his dad in digital privacy tools, specifically recommending Cyber Ghost VPN and BraveNet Browser as platforms that would resist hacking attempts.
“Thomas mentioned that Cyber Ghost VPN and a BraveNet Browser were just two platforms that wouldn’t be targeted by hackers and were ‘less likely to be compromised by outside actors,'” his dad recalled to agents.
The father attempted to correct his son’s reasoning, noting that pseudonymous purchases still linked back to real financial accounts. Thomas dismissed the point and continued ordering under fake names.
Senate Judiciary Committee Chairman Chuck Grassley, 91, obtained the FBI documents through his ongoing probe of the Secret Service failures at the rally. The files emerged as FBI Director Kash Patel prepares to testify before Grassley’s panel.
The records sketch a portrait of a young man systematically obscuring his tracks. Bureau officials had previously disclosed that Crooks maintained roughly 35 digital accounts, including foreign-based email services registered in Germany and Belgium. Agents accessed all of them. Patel and other officials have repeatedly found no foreign nexus to the attack.
The “Bob Dole” alias stood apart from Crooks’ other online presence. His profile on a fan art website used the handle “epicmicrowave,” suggesting the political name served a specific purpose rather than reflecting any ideological identity.
An unidentified ATF interviewee offered a contrasting view of Crooks’ political engagement, describing him as a “big history buff” who was “interested in politics” and frequently discussed Trump and Biden dating back to Trump’s first election. This account clashed with the father’s insistence that his son held no clear political allegiances.
The FBI’s digital forensics found Crooks had been methodical in minimizing his footprint. His father’s testimony about the pseudonym purchases added a concrete example of that behavior, showing how operational security measures extended to physical components for the attack.
Matthew Crooks’ cooperation with investigators provided rare insight into his son’s preparations. The father’s bank account hacking appeared to have triggered a broader pattern of defensive digital behavior that Thomas weaponized for his plot.
Crooks fired multiple rounds from a rooftop overlooking the Butler venue on July 13, 2024, striking Trump in the right ear, critically wounding two rally attendees, and killing firefighter Corey Comperatore as he shielded his family. Secret Service counter-snipers killed Crooks seconds later. The shooting prompted the resignation of Secret Service Director Kimberly Cheatle and multiple congressional investigations into security lapses that allowed a gunman to occupy an unguarded elevated position within rifle range of the stage.
Patel is scheduled to testify before the Senate Judiciary Committee on Tuesday.