Thomas Matthew Crooks used the alias 'Bob Dole' for online purchases in the months before he opened fire at Donald Trump's July 2024 rally in Butler, Pennsylvania, according to federal records reviewed by US news organisations, with packages sent to his parents' home under the pseudonym.
The documents add detail to Crooks' online activity before the attempted assassination, but do not establish why he chose the name or whether every purchase was linked to the attack. They also do not provide a definitive motive for the shooting.
Crooks, 20, was killed by a Secret Service counter‑sniper after firing at Trump from a rooftop near the rally. The shooting killed Corey Comperatore, wounded Trump in the ear and seriously injured David Dutch and James Copenhaver.
The records were supplied to Senate Judiciary Committee Chairman Chuck Grassley as part of his inquiry into the Butler attack. They include FBI interviews with Crooks' parents conducted after the shooting.
'Bob Dole' Alias Used Before Butler Attack
Crooks made online purchases using the 'Bob Dole' pseudonym and had shipments delivered to his family home, the documents state. They describe packages containing components, tools and supplies intended to increase the capacity of his rifle.
Matthew Crooks told FBI agents that his son began using the assumed name after the family bank account was hacked and fraudulent gambling charges appeared.
He said Thomas Crooks believed using a pseudonym could reduce the risk of further hacking, despite his father's view that payments could still be traced through the buyer's financial account.
The documents do not explain why Crooks selected 'Bob Dole', the late Kansas senator and 1996 Republican presidential nominee. They also do not show that every purchase made under the name was intended for the Butler attack.
Newly disclosed federal records, described in contemporaneous reporting, indicate that Crooks maintained numerous online accounts and sought to limit his digital footprint. The underlying material has not been independently reviewed by this publication.
Family Account Adds Context
Matthew Crooks told investigators that his son 'never identified anyone as a friend throughout middle school and high school'.
He said Crooks spoke with classmates but did not consider them friends.
The father's account adds background to Crooks' life before the shooting, but does not explain why he targeted Trump. The publicly available material does not support a conclusion that social isolation caused the attack.
Crooks advised his father to use CyberGhost VPN and the Brave browser, which he believed were less vulnerable to hacking. The interview material also said Crooks thought aliases could protect online purchasers from account fraud, a belief his father disputed.
Those accounts indicate a concern about online privacy. They do not prove an intention to evade law enforcement or conceal a plan to commit violence.
Anonymous Cremation Payment Revealed
Newly disclosed FBI interview material is said to include a note that an anonymous donor paid for Thomas Crooks' cremation after he was killed. The information was attributed to a lawyer representing the Crooks family.
The donor has not been identified, and no public explanation has been given for the payment or any connection to Crooks' relatives. Available accounts do not suggest the donor had a role in the Butler shooting or the decision to cremate him.
Taken together, the material provides further detail on Crooks' online purchases, use of aliases and family background. It does not offer a full account of his preparations or establish a motive for the attack.
