Newly released FBI files provided to the Senate show that Thomas Matthew Crooks maintained accounts on Snapchat, Gmail, Amazon and Mailfence. A Snapchat account linked to Crooks may contain recoverable evidence despite the platform’s disappearing-message design, according to a retired FBI agent. Crooks attempted to assassinate Donald Trump at a campaign rally in Butler, Pennsylvania, on July 13, 2024, killing one person and seriously injuring two others before he was shot and killed by Secret Service agents. FBI Director Kash Patel told senators that investigators found no evidence Crooks was connected to anyone else.
The documents identify a Snapchat username associated with Crooks as “tom_crooks19.” They also show that he used an encrypted Mailfence email account multiple times between April 15 and July 8, 2024, in addition to a Gmail account and an Amazon account.
| 1) | The digital accounts identified in FBI files |
|---|---|
| 2) | Why Snapchat data may still be recoverable |
| 3) | Crooks’ efforts to conceal parts of his digital footprint |
| 4) | What investigators have said about possible associates |
| 5) | The continuing significance of the Butler investigation |
The digital accounts identified in FBI files
The FBI files turned over to the Senate identify multiple online services used by Thomas Matthew Crooks, a 20-year-old from Bethel Park, Pennsylvania. Investigators located a Snapchat account with the username “tom_crooks19,” along with accounts on Amazon, Gmail and Mailfence. The records do not, in the material described, establish what specific messages, purchases or communications each account contained.
The Mailfence account is notable because the documents say it was accessed repeatedly between April 15, 2024, and July 8, 2024, days before the Butler rally. The accounts form part of the digital evidence investigators examined while seeking to understand Crooks’ actions and planning.
Why Snapchat data may still be recoverable
Retired FBI Supervisory Special Agent Jason Pack said the Snapchat account could contain substantial investigative material. Although Snapchat is widely associated with disappearing images and messages, Pack said data can sometimes remain available through account records, device evidence or information returned in response to a search warrant.
“When you snap and that picture goes away that everything is gone, and that’s not true. When I’ve served search warrants, there’s been a treasure trove of information that has come back.”
Pack cautioned that some elements may not be recoverable, but he said investigators could still find a significant amount of information. The potential evidence could help establish account activity, contacts or timing, although the released material does not specify what investigators ultimately recovered.
Crooks’ efforts to conceal parts of his digital footprint
Pack said the account information should be considered alongside indications that Crooks may have taken steps to avoid public scrutiny. He pointed to reported efforts involving aliases and attempts not to be seen collecting deliveries, suggesting that Crooks may also have been deliberate about his online activity.
According to Pack, Snapchat is not fully encrypted, meaning investigators may have had several avenues for examining the account. The use of multiple services, including an encrypted email provider, may give investigators different sources for reconstructing activity, even if individual messages or files were deleted.
What investigators have said about possible associates
At a Senate Oversight Committee hearing, FBI Director Kash Patel testified that investigators found no evidence that Crooks was linked to another person in connection with the attack. Patel said investigators found no evidence Crooks was speaking with anyone other than his parents, with whom he lived.
That testimony addresses the question of whether Crooks had outside assistance or a broader network. The existence of online accounts does not by itself show that he communicated with accomplices. Any recovered Snapchat, email or account records would have to be evaluated against the FBI’s broader investigation.
The continuing significance of the Butler investigation
The July 13, 2024, attack occurred during a campaign rally in Butler, Pennsylvania. Donald Trump was grazed by a bullet and was rushed from the stage by Secret Service agents. One attendee was killed and two others were seriously injured, while Crooks was shot and killed by agents.
The newly disclosed account information keeps attention focused on how investigators reconstructed the attacker’s activities before the shooting. Digital records may help clarify chronology and intent, but the documents described publicly so far do not provide a new finding that Crooks was directed by another person.
| 1 | FBI files identify a Snapchat account linked to Thomas Matthew Crooks. |
|---|---|
| 2 | Crooks also had Gmail, Amazon and Mailfence accounts. |
| 3 | A retired FBI agent said Snapchat data may remain recoverable after messages disappear. |
| 4 | The FBI director testified that investigators found no evidence of an associate. |
Summary
The FBI files provide additional detail about the online accounts connected to Thomas Matthew Crooks, but they do not establish that he acted with assistance from another person. Investigators may still be able to recover useful information from Snapchat and other services. The findings remain part of the continuing effort to document the 2024 Butler attack and Crooks’ activities before it.
Frequently Asked Questions
What Snapchat account was linked to Thomas Matthew Crooks?
The FBI files identify a Snapchat account using the username “tom_crooks19.”
Can Snapchat messages be recovered after they disappear?
According to retired FBI agent Jason Pack, some information may remain available through search warrants, account records or digital evidence, although not every message or file can necessarily be recovered.
Did the FBI find evidence that Crooks had an accomplice?
FBI Director Kash Patel testified that investigators found no evidence Crooks was connected to anyone else and said he appeared to have communicated only with his parents.
