Alias use is not a footnote in modern political violence cases; it is operational tradecraft that shapes what investigators can reconstruct about intent, preparation, and capability—and in the Butler rally shooting, investigators say Thomas Crooks adopted the pseudonym “Bob Dole” among other names to quietly acquire the gear he needed.
At a Glance
- Investigators say Crooks used multiple aliases—explicitly including “Bob Dole”—to make online purchases tied to the Butler rally attack.
- The FBI describes at least two dozen firearms-related online purchases beginning in 2023, plus chemical buys associated with improvised explosive devices.
- The bureau is treating the July 13 Butler shooting that wounded President Trump and killed a spectator as an assassination attempt and potential domestic terrorism.
- Alias use matters because it complicates transaction tracing, delays detection, and reveals conscious concealment—a window into planning and intent.
What investigators say Crooks did—and why it matters
The FBI’s public posture is direct: Crooks engaged in sustained pre-attack procurement online, using more than one false name to do it. In a bureau summary circulated publicly, investigators identify “Bob Dole” and “Bill Cook” among the aliases, and tie those identities to tactical gear and weapons components leading up to the Butler rally. The stated assessment is that the aliases were a deliberate “online security” measure—concealment to keep his activity from easy attribution before the attempt on President Trump’s life. Set that against the case posture itself: the bureau has classified the shooting as an assassination attempt and a potential act of domestic terrorism, anchoring the gravity of the alias evidence in a broader criminal frame.
Alias behavior is not mere eccentricity; in the forensic sense it is a signal. While many criminals try to “minimalize” their footprint—buying in cash, keeping to in-person swaps—Crooks is alleged to have embraced a pattern of online transactions, then layered basic identity obfuscation on top. That combination tells you something about tradecraft and risk tolerance. It also dictates the investigative method: build a chain that links pseudonymous accounts and parcels back to the subject through payment instruments, delivery addresses, devices, and network metadata. The FBI’s public-facing documents stop short of publishing that chain, as is typical mid-investigation, but the naming of specific aliases in an official summary implies they believe the linkage meets internal evidentiary thresholds.
The procurement trail: cadence, content, and capability
According to federal reporting and local coverage citing investigators, the buying campaign did not spike in a single late-stage burst; it began in spring 2023 and stretched forward, amounting to roughly two dozen or more firearms-related purchases. In parallel, Crooks allegedly acquired chemical precursors associated with improvised explosive devices in the first half of the following year. The FBI has separately released photographs of two IEDs recovered from his vehicle, which matters for one reason: it connects the abstract claim of chemical purchases to actual devices recovered in proximity to the offense, closing the loop between intent, capability, and physical evidence.
That procurement arc answers two practical questions. First, was the subject just opportunistic, or did he model and build capability over time? A multi-season purchase footprint suggests the latter. Second, was the explosive component aspirational, or did it reach assembly? The bureau’s photos of recovered devices place it firmly in the second category. For a risk assessor, these are not academic distinctions; they map to threat maturity and the likelihood of rehearsal, testing, and logistics planning—each a point where alias use can blunt early detection by retailers, payment processors, or background-screening systems.
How alias use works in practice—and how investigators pierce it
Aliases in online procurement are only as effective as the controls of the platforms and vendors they touch. On bare-minimum e-commerce sites, a name field is not a gate; payment rails and delivery addresses are. A purchaser who uses a false name but a true residence creates an investigative foothold. More sophisticated obfuscation layers prepaid instruments, reshipper addresses, and borrowed or compromised accounts. Even then, consistency betrays the user: usernames mutate but rarely disappear, delivery patterns repeat, and the same device fingerprints and IP blocks show up across accounts. Modern investigations lean on exactly those regularities to collapse a handful of pseudonyms into a single operator.
The FBI’s summary description—that Crooks used aliases to buy tactical gear and parts—signals that such a collapse occurred. Agencies typically arrive there through a matrix of order records, parcel scans, payment metadata, browser telemetry, and device forensics from seized hardware. That mosaic takes time to declassify for public release; the absence of line-item invoices is normal while cases are still active. What matters for the public understanding is the structure: aliases do not prevent linkage once the subject is identified—they only delay it. In cases of targeted political violence, that delay can be decisive, allowing a subject to mature capability outside the perimeter of informal tripwires like cashier suspicion or anomalous-volume flags at a vendor.
Butler in context: from rooftop gunfire to terrorism frame
The Butler attack itself is stark. Gunfire from an elevated position grazed the President’s ear, killed one attendee, and injured others. The FBI publicly identified Crooks within hours and stated from the outset that it was investigating an assassination attempt, later adding the potential domestic terrorism lens. That posture guides everything downstream: motive analysis, procurement tracing, and the decision to surface select findings like alias use. While the bureau has also said Crooks appeared to act alone, the terrorism frame is about conduct—the use or threatened use of violence to influence political outcomes—not about organizational affiliation.
This classification also aligns with what investigators later displayed: a rifle recovered at the scene and photographed for public release, and the two improvised devices recovered from his car. Put together with the procurement narrative, these artifacts sketch a subject who layered long-run capability building with last-mile operational choices. Alias use is a thread through both phases—preparation and approach—because it is the single cheapest way to lower the probability of pre-incident interdiction in an era when most components can be bought online.
Exclusive | Would-be Trump assassin Thomas Crooks used 'Bob Dole' pseudonym to prep for Butler shooting https://t.co/fvTyE99pYE
— The Booker Method (@Booker10038) September 15, 2026
Why “Bob Dole” as an alias is probative, not just peculiar
The specific choice of “Bob Dole” will draw notice for its macabre incongruity, but from an investigative standpoint the label’s content is mostly noise; its value is that it is shared across transactions, which allows correlation. Reuse is the Achilles’ heel of self-administered anonymity. The moment a user repeats a handle, pairs it with a consistent shipping vector, or authenticates from the same device, each new event strengthens the attribution. That is why even a playful or implausible pseudonym can become probative when it appears in a sequence of relevant orders. The FBI’s summary does exactly this—names the specific pseudonym as one of several, and ties it to pre-attack acquisitions—thereby recasting a curiosity as a behavioral indicator embedded in the evidence record.
The enduring takeaway for threat prevention
Alias use in politically motivated violence tells us two things about prevention. First, retail and platform controls that only key off the customer name field are blind to the tactic; the signal lives in velocity, product mix, payment provenance, delivery routing, and device analytics. Second, the most effective community-level tripwires remain offline: suspicious volume purchasing, rehearsals at local ranges, or visible reconnaissance around venues. The Butler case, as investigators have outlined it, illustrates both limits and opportunities. A subject can cloak himself in thin online camouflage for months, but once the mask drops, the procurement trail becomes an evidentiary spine that helps reconstruct planning, capability, and intent—and, if surfaced promptly, teaches the next set of retailers and platforms what to watch for.
Sources:
nypost.com, wpxi.com, the-sun.com, fbi.gov, inquirer.com
