Secret Service spotted Trump rally shooter on roof 20 minutes before gunfire erupted

Law enforcement officials investigating the assassination attempt on Donald Trump told lawmakers Wednesday that 20 minutes passed between the time U.S. Secret Service snipers first spotted the gunman on a rooftop and the time shots were fired at the former president, according to several law enforcement officials and lawmakers briefed on the matter.

Officials said the snipers spotted the suspect, 20-year-old Thomas Matthew Crooks, on the roof of a building outside the security zone at the rally Saturday in Butler, Pennsylvania, at 5:52 p.m. ET. The shooting happened at 6:12 p.m. ET, 20 minutes later, the sources said.

In the days since the shooting, the Secret Service has come under scrutiny for its response to the assassination attempt and the agency's director, Kimberly Cheatle, has been subpoenaed to testify before Congress. A Department of Homeland Security spokesperson said she "welcomes the opportunity to testify."

The revelation of the timeline came as sources told ABC News that Crooks searched on his phone for images of President Joe Biden and former President Trump and searched for the dates of Trump’s rally in Butler and for dates of the Democratic National Convention in Chicago.

The phone search history revealed no indication of Crooks’ political views and investigators were trying to determine his motive.

The FBI director, his deputy director and the head of the Secret Service told lawmakers Crooks was identified as a person of interest a full 62 minutes before the shooting took place, according to the law enforcement officials and lawmakers briefed.

According to the sources, the timeline presented in the briefing was as follows:

From the time Crooks fired his first shot to the gunman being killed was just 26 seconds, according to law enforcement officials. Eleven seconds after the first shot, Secret Service counter snipers acquired their target -- and 15 seconds after that, Crooks was shot dead.

Briefers told lawmakers that Crooks purchased an ammunition box at a Walmart on July 5, two days after the rally was announced. On July 13, he went to the rally site in the morning, was there for an hour and then left. He came back sometime in the early 5 p.m. hour and tried to enter the security perimeter.

New analysis by ABC News' visual verification team reveals that one of two sniper teams posted atop buildings to the north and south behind the rally stage repositioned before the first gunshots were fired. At 6:09 p.m., three minutes before the first gunshots rang out, the sniper team on the roof of the building south of the stage, the furthest away from the shooter’s location, repositioned, turning from the south to the north in the direction of the shooter’s location.

The motive for the assassination attempt remains a mystery, according to the briefers, and they have not identified any ideological nexus to Trump and/or Biden.

Based on interviews with the shooter's parents, law enforcement told members they believe that neither has strong political leanings.

The FBI told lawmakers they've conducted 200 interviews as part of the investigation, a source said.

Timeline comes into focus

Though law enforcement sources said Crooks is believed to have purchased a 5-foot ladder at a Home Depot before the shooting, it does not appear to have been used to climb on the roof and was not found at the scene.

Crooks was able to get a clear shot at the former president by scaling an air conditioning unit accessible from the ground and pulling himself up to the top of a building outside the security perimeter, sources told ABC News. From there he gained access to the top of the neighboring American Glass Research (AGR) building, sources said.

Witnesses told ABC News they saw him shimmying up the slope of the AGR building's roof to the area where he got off up to eight shots at Trump who was speaking at a podium about 400 feet away.

Trump said he suffered a bullet wound to his right ear. Three rallygoers were shot in the incident, including 50-year-old volunteer firefighter Corey Comperatore, who was killed shielding his family from the gunshots, officials said. The two other rallygoers were listed in stable condition.

Minutes before pulling off the brazen assassination attempt, Crooks was seen walking around near the magnetometers where rallygoers were being scanned for weapons before entering the outdoor venue, according to law enforcement sources.

New bystander video obtained exclusively by Pittsburgh ABC affiliate WTAE appears to show Crooks pacing just beyond the boundaries of the Trump rally at 5:06 p.m. Saturday -- about 1 hour and 5 minutes before shots were first fired. Law enforcement sources said they believe this video shows Crooks.

Crooks' presence in the area of the metal detectors in the minutes before the shooting caught the eye of someone in law enforcement who became suspicious and started to approach him, multiple sources told ABC News. At that point, the would-be assassin backed up and faded into the crowd, according to sources. It was not clear how long before the shooting this happened.

Between the time he was spotted near the magnetometers and when Crooks allegedly fired at Trump, there were two sets of radio transmissions, one reporting that police were looking for a suspicious person and another more generic warning that officers were following up on something suspicious, sources said.

As officers began searching for the suspicious person, Crooks made his way to the area of the AGR building, the sources said. At the time, the building was being used as a staging area for local police, who were inside the structure, the Secret Service director, Cheatle, told ABC News in an exclusive interview this week.

More specifically, sources told ABC News that there were local police personnel and counter-sniper units in the AGR building where Crooks eventually took up a position to fire at Trump, sources said. Investigators believe that could have led to confusion as Secret Service snipers were trying to determine whether there was a threat to Trump and where it might be coming from, according to the sources.

Secret Service counter snipers positioned on buildings close to the rally stage were aware the AGR building was being used as a staging area by law enforcement, sources said. Investigators believe that could have led to a delay in the Secret Service sharpshooters' reactions because they had to first figure out whether the suspect was a threat, sources said.

But once shots were fired at the former president, the Secret Service snipers could not wait any longer and took out the gunman, sources said.

"Seeking that person out, finding them, identifying them, and eventually neutralizing them took place in a very short period of time, and it makes it very difficult," Cheatle said during the interview with ABC News.

Meanwhile, two sources familiar with the situation told ABC News Wednesday that before the rally, the Secret Service requested a local police cruiser to be positioned at the AGR building, but local police officials were not able to provide one. The detail was first reported by the Washington Post.

As the FBI investigation continued Wednesday, questions swirled about how the gunman was able to ascend unimpeded to the roof, gain a direct line of sight and fire a barrage of shot at the former president.

While Crooks was making his way to his shooting position, Secret Service agents were listening to radio traffic about a suspicious person police were looking for and heard local law enforcement talking about some sort of confrontation involving police, the sources said.

Butler County Sheriff Michael T. Slupe told ABC News that he was informed by other law enforcement officials that a Butler Township police officer searching for the suspicious person was vaulted onto the AGR building's roof and briefly confronted the gunman, who turned his weapon to the officer, causing him to retreat back down. Shots rang out moments later.

Suspicious devices

Investigators said Tuesday they found a remote transmitter in the suspect's pocket that may have been intended to set off two suspicious devices found in the suspect's car and one in his home, according to law enforcement sources. Devices at both locations were similarly constructed in ammunition containers using components including receivers that appear to have been paired with the remote control found in the suspect's pocket, sources said.

The receivers in each device were connected to a series of components that investigators say met the "eye test" -- having parts present that could have made viable explosives, although the functionality of the devices is still being determined. The purpose of the devices is also unknown. Whether they were intended to cause a significant blast to hurt people or if they were designed to create smoke, fire and a low-grade blast for a diversion is unclear.

Investigators also found a tactical vest in the suspect's car, though it is unclear why he did not wear it during the assault on the former president's rally. Some investigators are wondering whether he anticipated dying in the attack.

The shooter also asked his employer if he could take a day off on Saturday but said he would return to work perhaps as soon as Sunday, the day after this attack, according to law enforcement sources. But thus far, investigators have turned up nothing to suggest that he had any accomplices or other support to carry out his deadly objective.

'Bullied' in the past

An examination of Crooks' phone has not turned up any significant information about the suspect's motives -- only what sources described as "routine" information for a 20-year-old male.

Investigators have found, so far, that Crooks was a loner without friends. He was “odd,” according to preliminary findings in the probe, multiple sources briefed on the investigation told ABC News. FBI analysts are trying to assess whether Crooks was hard to get close to or was shut off because he was hiding something, sources said.

Crooks had been “bullied” a little in the past, but the acts against him were “not over the top,” one source said.

Investigators are actively looking to see if perhaps Crooks covered his tracks by using “burners” or other communication devices.

The Pennsylvania State Police said in a statement that it provided "all resources" to the Secret Service -- including 30 to 40 troopers to assist with securing the inside perimeter of the campaign rally venue -- but "was not responsible for securing the building or property" outside the security perimeter where the would-be assassin opened fire.

In an exclusive interview with ABC News, Cheatle, confirmed that local police were present inside the building at the same time the shooter was on the roof firing at Trump. Cheatle also said that local authorities were tasked with securing that building.

"In this particular instance, we did share support for that particular site and that the Secret Service was responsible for the inner perimeter," Cheatle said. "And then we sought assistance from our local counterparts for the outer perimeter."

ABC News' Bill Hutchinson contributed to this report.