By: J. Lawrence Cunningham, Senior Fellow

The country and the rest of the world are still incredulous—how could a 20-year-old lone gunman manage to defeat the nation’s elite protectors and fire 8 rounds from an AK that nearly inflicted a fatal skull injury on a Presidential nominee? By divine intervention and the momentary distraction of the shooter by a Butler, PA police officer, Former President Trump escaped an assassination at a rally in Butler, PA on Saturday, July 13th. Now, more than three weeks later, despite two Congressional Oversight hearings with now former Director Cheatle and Acting Director Rowe there are still many unanswered questions and very troubling facts continue to emerge. Former Director Cheatle’s vacuous responses to the Oversight Committee’s questions and Acting Director Rowe’s equally indirect answers and misinformed statements on July 30th (including the FBI’s limited statements) have allowed serious questions to linger. Numerous theories, some supported with facts and other less credible, have been developing. Numerous articles have been published. Senator Grassley, as reported by Real Clear Politics, RCP on July 22nd, has received agency whistleblowers’ information, audio and texts from Butler law enforcement officers. These have exposed many disturbing, negligent lapses and security omissions contradicting many claims made by Cheadle and Rowe.

As of this writing, the Secret Service has been guarded with their responses to the Oversight Committee’s inquiry and to the public. Rowe’s limited statements seem to contradict evidence from Butler law enforcement authorities and video evidence obtained from the public.

In an effort to set the record straight and in the spirit of urging critical reforms, the following factual information supported by video evidence and statements from Butler Police officers and SWAT officers assigned to the rally on July 13th with direct operational knowledge, is set forth. It is critically important to bring clarity to the information being reported.

This review will highlight key omissions of protective advance procedures during the security planning of the July 13, 2024 rally. . Many recommendations set forth by the 435-page U.S. Secret Service Protective Mission Panel’s report from December 2014 (after serious security failures prompted this inquiry) were not fully implemented. Conspicuously absent among them was and remains—the failure of protective detail agents to complete consistent training—“at least 12% of work hours by fiscal year 2025.” According to Jason Chaffetz, the agency has woefully failed to achieve this training target. He says the Secret Service has been on notice since 2015 to implement effective changes, namely training and accountability to prevent the failures like those seen in Butler, PA.

The intent is to fact check the numerous statements and theories put forth by self-proclaimed experts and balance those with some credible authorities. In the spirit of separating facts from theory—context, background and explanations of the facts as we know them are sorely needed. Effective, tested protective strategies and advance procedures will be presented as a basis of comparison.

Normally I would not comment with this amount of detail on related matters. However, this assassination attempt has exposed systemic operational failures of the Secret Service’s protective arm and the advance team’s preparations. For example Real Clear Politics, RCP on July 30 referenced CNN reports and admissions by Rowe that expose the fact that security resources were denied for the Trump detail despite repeated requests by the detail agents. This has been an on-going complaint by detail agents and whistleblowers for at least two years. Denied resources for Trump rallies include counter sniper teams, drones, canine teams, metal detection equipment and other matériel. Further, documents show where Rowe decided unilaterally to restrict counter sniper teams to any Trump event beyond driving distance outside of D.C. While Cheatle, Rowe and the Secret Service spokesman initially denied this, whistleblower reports has forced them to confront their denials. RCP further reports the Butler rally was not allocated any counter sniper teams but Secret Service management reversed the decision and sent two teams to Butler with one day to conduct a survey that normally takes two to three days to complete.

This is appalling given the thousands of on-going death threats directed at Trump and the Iranian assassination plot discovered before the Butler rally.

All of us need to avoid feeding into conspiracies. Fair-minded folks want the forensics experts to complete their investigation and analysis based on facts. Hopefully this will minimize theories that are gaining attention. Additionally, when unsupported theories are not checked, there is a risk of feeding into them and they seemingly become more credible. The other risk is people tend to lose their objectivity and unintentionally get drawn into these conspiracies. With the cascade of information bombarding us, we have difficulty discriminating credible facts from fiction and “exciting” and “dramatic” theories. Everyone needs to be reminded to take a deep breath, pause and consider verified facts. To do this effectively, it is important to understand context and known factors.

The following is set forth based on what has been reported by credible, law enforcement agencies and other official sources on the ground at the Butler rally site, information from a closed-door Oversight Hearing, others familiar with the facts (as best that can be determined) and video evidence leading up to, during and after the assassination attempt. The FBI is continuing their investigation.

Tragedies as serious as a nearly successful assassination resulting in injuring a Presidential nominee, the death of one spectator and serious injuries of two other supporters is not an isolated event. There were and are a host of diverse factors at play at the Butler rally before and during that impacted the attack. Contributing factors are multi-factored and complex. Agency mission, leadership, federal statutes, intelligence information, agency policies, training, security resources, physics, human factors, political tension and others play a role.

Isolating these elements and assigning a predictive value of each poses a near impossible challenge.

Suffice it to say the collective circumstances (as we now know) at play leading up to, during and immediately following the attack are very disturbing and are indicative of the Secret Service’s negligent execution of their protective plan. Before we can move forward, key omissions and departures from established protective procedures need to be identified. This will give insights on factors that contributed to the security vulnerabilities and failings at the rally. Hopefully, this will help guide our understanding and conclusions based on fact and verified evidence. Most important, the ultimate goal is to learn how we can collectively, from our respective vantage points, do everything possible to prevent attacks like this from happening in the future.

While rare (the last assassination attempt of a president occurred 43 years ago), none of us are naïve enough to think a breakdown in security would never occur again. However, ensuring that effective, scalable security procedures are consistently implemented will minimize the possibility of a repeat (as much as humanly possible), is the goal moving forward. Hopefully this review will ensure a more diligent focus on preventive security measures. If a response is needed, it will be immediate and effective.

What we do know now is the earlier blame shifting of security responsibility, communications breakdowns and serious omissions of basic security advance operating procedures are worse than originally reported. The security missteps point to profound negligence in the execution of the security plan. Key to understanding the egregious breakdown in security is answering how the shooter slipped through the cracks after being observed by local counter snipers at a picnic table on July 13th at 4:26 PM. A Beaver County counter sniper’s text message released by Beaver County officials reported initial sightings of a suspicious individual about 100 minutes before the shooting. He was observed by a Pennsylvania State Police Officer with a range finder exhibiting suspicious behavior. His photo was reportedly sent to the Police Command Post. Apparently this information was not passed to the Secret Service Security Room at this first sighting. A video taken more than an hour before the shooting, at about 5:06 PM, shows Crooks in front of the AGR building. This sighting of a suspicious person was reported to police by spectators. Police on the ground were looking for him up to the time of the shooting.

On July 23, 2024, the New York Times reported the FBI determined a local SWAT team spotted Crooks on the roof of a warehouse about 18 minutes before Trump took the stage (about 5:44 PM) and 27 minutes before the assassination attempt (6:11:33 PM). Why was this report of a man on a roof lost and/or not reported to the Secret Service and the other officers at the rally?

On July 19, 2024, CBS News reported information from three sources that closed door meetings between Secret Service/FBI officials and law makers the Secret Service was aware of a suspicious person 20 minutes before the shooting began. At 5:51 PM State Police alerted the U.S. Secret Service about a suspicious person within a minute of this sighting.

Why were the Trump protective detail agents not immediately notified? Why was Trump not informed? Trump took the stage at 6:02 PM, a full 17 minutes after multiple reports of a suspicious person with a range finder were received and passed to law enforcement radio channels? The Secret Service treated this as a generic suspicious-person-notice until minutes before the shooting.

The delayed, ineffective response to these warnings violates the Secret Service’s core protective responsibility to notify the protective detail and the post agents of potential threats when the behaviors fit the lone shooter profile. Crooks’ behavior was not “merely suspicious.” The first sightings of Crooks alarmed police officers. To deem Crooks’ behavior as merely suspicious is irresponsible. Further, in the context of the thousands of documented threats received by the Trump detail, the Secret Service Intelligence Division and the Iranian assassination plot received before the rally, an urgent and heightened alert and response to the reported behaviors were clearly in order. The Secret Service’s own threat assessment center provides guidance to employees and law enforcement agencies to assist in the detection of would be attackers (See Planning-page 12-18). Why were these lone shooter profile behaviors, that fit those being exhibited by Crooks, not considered when these reports were received?

Crooks exhibited many of the predictive behaviors identified by the Secret Service and other numerous post shooting attack studies associated with lone shooters. The investigation to date shows Crooks visited the rally site at least twice before the rally and once (leaving and returning) the same day before the attack. Crooks evaluated the rally site two hours before the rally with his own drone, probed security at various locations, brought a range finder and paced nervously before leaving, apparently eluding officers trying to locate him. All of these behaviors, sightings and notifications by local police officers and spectators, were not prioritized as a threat by the Secret Service until Crooks was seen with a rifle on the AGR building. Why didn’t the Secret Service agents and the Secret Service counter sniper teams link these behaviors to the behavioral profile known to be typical of lone shooters? Cheatle lamely claimed to the Oversight Committee the suspicious behavior was only “suspicious” and not deemed a threat until Crooks was seen with a gun on the roof of the AGR building. Not prioritizing this as a threat and alerting the Trump detail immediately about Crook’s’ early behaviors, known to be linked to the behavioral profile of known shooters, is nothing short of negligent. On July 30, 2024, at the Oversight Committee hearing, Rowe gave an equally evasive answer to Senator’s Lee’s question as to why Trump was allowed on the stage with the behaviors cited above. Rowe stated (0-:27) a threat needs a weapon “it comes to weapon, a potential threat, is he carrying an IED…? To be characterized as a threat, Rowe’s statement that Crooks needed to have been seen with a gun or IED before decisive intervention should be taken is naïve. This exposes his lack of understanding and failure to link Crooks’ behavior as more than suspicious despite sightings of Crooks with a gun well before the shooting.. Assessments like this chill decisive decision making. Similar indecision allowed Omar Gonzalez to scale the White House fence on September 19, 2014, overpower a Uniformed Division Officer and enter the Diplomatic Entrance of the White House.

The behavioral profiles cited in the Secret Service Threat Assessment Centers Mass Attacks in Public Places Guidance recommendations, published in January 2023, define behaviors displayed by Crooks’ as threatening. Similar pre-attack behaviors are clearly linked to shootings and have been validated in published metadata summarizing the conclusions of studies of mass shootings in the past 40+ years. Crooks’ behavior should have been linked to the lone shooter behavioral profiles. Crooks exhibited many of these behaviors before Trump took the stage. To attempt to ”dilute” these disturbing behaviors that exceed the baseline of normal spectator behaviors, is negligent. If the Detail Leader and shift agents protecting Trump were notified after the first sightings (they were not), Trump would have been held in the limo or holding room or taken off the stage until the suspicious person was located.

Not informing the Detail Leader, Trump and the rally security agents about the suspicious person from the early sightings, especially his nervous movements, possessing a range finder and evading police is among the most egregious failures at the Butler rally. The Police Command Post and the Secret Service Security Room should have informed the Secret Service detail protecting Trump—immediately.

The FBI investigation has now confirmed Crooks exhibited many other pre-attack behaviors, i.e. using aliases to purchase precursor bombmaking materials and researching the DNC schedule in Chicago and historical assassination details.

The most important protective tool required to effectively protect people and assets are competent security team members, a thorough security advance and a diligent review of the security measures before the visit of the protectee. The security advance elements, resources and physical response protocols need to be rigorously applied and continually refined to match evolving threats and be scalable to adapt to changing circumstances.

Any effective dignitary security advance requires teamwork by developing a cohesive team with ALL partners in the city and jurisdiction being visited, especially the public safety responders.

Presidential advances and Presidential campaign advances with heightened political tension with thousands of protectee death threats require diligent attention to every facet of the security preparations. Commensurate manpower, resources, a scalable security plan and oversight that match threat levels is required! This is a tall order but needs to be done.

Information gleaned from the Butler County law enforcement agencies assigned to the rally site, whistleblowers and members of the public to include videos taken, before, during and after the shooting are detailed below. All point to the fact many immutable tenets of protection were not followed, not implemented and/or ignored.

U. S. Secret Service Legal Authority

Before the deviations from and omissions of well-established Secret Service advance procedures are identified and explained, the legal protective authority needs to be referenced. Very few media outlets are reporting this.

The jurisdictional investigative and protective authority of the Secret Service is defined in the United States Code, Title 18 Section 3056. As it relates to Presidential and Vice-Presidential candidates, the following section of the Code specifically applies.

Title 18 U.S.C.' 3056(a)(7) authorizes the U.S. Secret Service to provide protection for major Presidential and Vice-Presidential candidates.

This authority cannot be abdicated to local law enforcement. Former Director Cheatle and Acting Director Rowe erroneously stated it could be. Cheatle claimed local law enforcement were responsible for the security of the AGR Building in Butler, PA. Crooks fired eight (8) AR rounds from the roof in the direction of the stage hitting Trump and three others. Cheatle specifically stated the AGR building was outside the security perimeter and the building was not swept. Cheatle essentially blamed local law enforcement for the security failure.

On July 30, 2024, Acting Director Rowe testified: “We made an assumption that there was going to be uniformed presence out there, that there would be sufficient eyes to cover that, that there was going to be the local counter sniper teams.”

These claims fly in the face of the statements of the local police officers assigned to support the sectors and posts at the Butler rally. Cheatle and Rowe attempted to shift blame and responsibility to local law enforcement. This is not supported by law nor precedent. It is simply not tenable.

The USSS is always responsible for identifying and preventing any threat regardless of its origin; inside or outside established “secure” perimeters during an official event. This has never been proffered as a defense for absolution of protective responsibility in the history of the Secret Service. The Secret Service is the overall lead agency responsible for all Presidential candidate security arrangements. This is not delegable.

On July 20, 2024,The New York Times reported that several local officers, including Butler County Sheriff Michael Slupe, stated:

None of the law enforcement agencies that assisted the Secret Service that day — the Pennsylvania State Police, the Butler Township Police Department, the Butler County Sheriff, Pittsburgh Bureau of Police or the multicounty tactical teams—say they were given responsibility for watching the zone outside the Secret Service’s fenced security perimeter…More specifically, the local law enforcement officials stated that none of them were assigned to safeguard the complex of warehouses just north of the farm show grounds including the AGR building.

Alarmingly, statements made by the local agencies indicate the majority of their assignments were to provide security inside or along the perimeter fencing leaving the outside perimeter beyond the fencing exposed. The only outer perimeter police presence were officers assigned to direct traffic. There were however, three local counter snipers assigned to use the 2nd floor window from inside of a building adjacent to the AGR building. They were instructed to monitor the inner perimeter crowd only.

Butler Township Commissioner Edward Natali stated unequivocally:

“There were seven officers all assigned to traffic detail. Period!! The BTPD was NOT responsible for securing AGR or any other location…“Anyone who says so, reports on it, implies it, etc… is uninformed, lying, or covering their own backsides.”

The seven Butler Township police officers were assigned traffic posts but once there was a suspicious person notification, four of the seven officers left their posts to look for him.

Anyone familiar with basic security understands that limiting exposure requires creating strong, integrated and functional perimeters. Limiting your focus on the inner perimeter is just plain myopic, especially in an environment with upswept and unposted buildings in the outer perimeters less than 150 yards away from the protectee. It appears the Secret Service advance team forgot one of the most basic security perimeter concepts—all rings of security need to be fortified and integrated into the overall security plan. It needs to be one team, one fight. An absence of security or weakness in the outer security perimeters reduces the time needed to respond to a threat and shortens the distance between the attacker and the protectee—all factors favorable to the attacker.

Security Advance Omissions Leading to Critical Failures

Normally a Presidential and/or Presidential candidate security advance, especially one conducted for a candidate nominee of Trump’s stature and threat level, should include tested advance protection procedures that have been implemented consistently by the Secret Service for decades. These are well documented in Candidate Nominee Operations directives and manuals. Terminology of these may vary but their security function is clear. Omissions of these could lead to catastrophic consequences. In Butler there were key omissions and an assassination nearly occurred as a result.

Credible sources, whistleblower reports, local police agency statements and Oversight Committee hearing testimony identified negligent deviations and omissions of standard Secret Service protective operation procedures.

It is noted many of the security omissions have been acknowledged by Cheatle and Rowe. Other missteps have been denied despite local police officer statements/texts, whistleblower reports, Secret Service emails and media reporting.

Security Advance Omissions/Oversights:

· Assigning an inexperienced agent to lead the advance in Butler, PA.

· Middle perimeter security manpower included 1-2 Secret Service agents, far fewer than comparable size rallies.

· The security plan was inner perimeter focused with less emphasis on the outer perimeters.

· Local police officers were too siloed and not integrated with the overall security plan.

· Unclear radio communications reporting procedures.

· No officers were assigned to monitor the perimeter beyond the rally perimeter fence to include the AGR building and other warehouses.

· Secret Service did not attend a police meeting with local police counterparts. This prevented functional pairing of Secret Service agents and police officers.

· No helicopter surveillance was provided.

· The Secret Service did not deploy a drone and declined one offered by local law enforcement.

· No Counter Surveillance Unit or Intelligence Unit were available.

· The Secret Service counter sniper team was deployed one day before the rally.

· Four local counter sniper units were located inside the rally perimeter fence; three others inside an adjacent building (next to the AGR building) to monitor the rally

· Secret Service agents did not monitor the AGR building.

· The Secret Service counter sniper teams were not operationally integrated with the local sniper teams.

· No supervisor site review or walk-thru was conducted before the rally.

Resulting Operational Failures:

There were numerous failures resulting from not following established security advance procedures. On July 19, 2024, Breitbart reported nine critical, interconnected planning failures. These are all the result of a negligent failure to follow established advance procedures. These are valid but deserve more context. The following failures are identified to date.

Collectively these oversights led to critical operational failures, the most egregious of which was not communicating Crooks’ threatening behavior to the entire security team when it was first noted by the police at least an hour before the shooting. There were several opportunities after the first sighting of Crooks that should have been communicated to all the police officers and the agents assigned to the rally and critically, to the Trump detail agents.

Given the number of police agencies assigned, the potential for disjointed communications, coordinated through two separate communications hubs, should have been anticipated. A dedicated emergency reporting channel should have been set up and tested. These communications and related technology updates to include drones have been acquired but the Secret Service has been slow to adapt and implement them.

The Secret Service advance agent should have requested the local snipers to take positions outside the AGR building.

The Secret Service drone was not utilized in Butler. Inexplicably, the Secret Service turned down a drone offered by the local police.

A counter-surveillance agent or roving intelligence team should have been available to respond to reports of a suspicious person.

The advance agent should have met with the Secret Service counter sniper teams and local sniper teams to establish a joint workable operations plan. The Secret Service counter sniper survey should have been jointly reviewed with the local sniper teams. This would have identified vulnerable areas and clarified the rules of engagement and statutory authorities. This would have provided would have provided for better sector surveillance and a more cohesive operational team. This would have made life and death split-second decision making more accurate. The fact the Secret Service counter sniper teams did not have communications with the local sniper teams. Collectively, these factors and others contributed to delays.

Secret Service emails reported by Real Clear Politics obtained by Senator Grassley determined 1 – 3 Secret Service agents were assigned to support the Butler rally. Whereas 12 Secret Service agents were assigned to First Lady Dr. Jill Biden for a function in Pittsburgh the same day. The majority of security posts were assigned and held by Homeland Security agents. Current and former Secret Service personnel expressed concern over this and similar disparate resource allocations, i.e. giving Biden more resources than Trump. Trump detail agents have reported this disparity for at least two years prior to the Butler assassination attempt. At the July 30th Oversight hearing Senator Cruz asked Rowe about these and other documented discrepancies, Rowe’s stated rationale was “the sitting president holds national command authority to launch a nuclear strike, sir.” Rowe’s answer (4:30-7:34) did not address threat levels against Trump and how that would affect security resource allocations and the actual numbers disparity.

Senator Grassley, Real Clear Politics and whistleblower reports exposed that Cheatle and Rowe were directly involved in denying requests for needed crowd screening equipment, additional agency manpower, counter sniper teams and other resources for Trump rallies.

It is noted that Rowe was evasive and did not answer the question: “Did you directly approve withholding security resource allocations for Former President Trump vis à vis President Biden events?” This disparate resource allocation exposes more vulnerability to Trump. Notably, no Secret Service counter sniper teams were given to support Trump’s rallies prior to the Butler, PA rally. To rely on local sniper team(s) as the sole sniper resource, with admitted radio interoperability problems between the local police and the Secret Service, poses numerous operational risks.

Two Secret Service counter sniper teams were assigned to the Butler rally a day before the event. Normally, counter sniper teams are deployed 2 – 3 days prior to an event for the current sitting president. At the Butler rally two Secret Service counter sniper teams and local sniper resources were used. At the July 30th Oversight Hearing, Senator Lindsey Graham asked Rowe if the Iranian assassination plot factored into the security footprint. Rowe replied: “Secret Service does a threat based protective model.” Whistleblower reports, Real Clear Politics and Representative Mike Waltz dispute this since the Trump detail agents claim additional security resources have been historically denied. denied and prior to the Butler rally by Secret Service managers, (i.e. Cheatle and Rowe). Secret Service spokesman Anthony Guglielmi and Rowe claim otherwise. In fact Rowe testified these assertions are false.

Nowhere in the U.S. Code, Title 3056(a)(7) is there a caveat for less effective or fewer security resources when there is a clear, on-going death threat level which Trump clearly had and continues to have. The mission of the Secret Service requires it to deploy resources commensurate with the protectee’s threat level as much as possible. Every Secret Service protectee deserves this. To do otherwise invites an attack as we saw in Butler. It is well documented, supported by decades of metadata, that many would-be attackers, especially lone attackers study their targets, note and exploit vulnerabilities.

Approximately a week after the assassination attempt, several local law enforcement officers from Butler, PA appeared on ABC News and asserted the Secret Service advance team did not coordinate or meet with them before the rally. Jason Woods, the lead sniper stated: "We were supposed to get a face-to-face briefing with the Secret Service members whenever they arrived, and that never happened.” Further, Woods stated: "So I think that was probably a pivotal point, where I started thinking things were wrong because it never happened," Woods said. "We had no communication."

Investigations have determined the Secret Service detail agents protecting Trump were not notified of this suspicious person at any time from the first sighting up to the time he was sighted on the roof. It is noted other Secret Service agents were informed at least 20 minutes before the first bullets were fired. The detail agents should have been notified immediately as soon as a suspicious person was spotted on the roof of the AGR building, at the very least at 5:53 PM. At this point, the suspicious person was no longer “suspicious” by any definition.

There is no way this can be excused. This was now an imminent threat! This notice should have given the detail at least during the 17 minutes and 30 seconds (when Crooks was seen on the roof of the AGR building) to inform the Detail Leader to make the decision to remain in the limo or in the holding room until the threat had been resolved.

There are many hundreds of examples in Secret Service history when a protectee has been moved to or held in a holding room or removed from a site when threats and vulnerabilities are identified.

During the hearings, Rowe acknowledged some radio transmissions were and lost and not relayed. He attributed the miscommunications and delays to the Secret Service’s encryption algorithms. He stated integrating the encrypted system would take many weeks. Certainly that is not a reasonable solution during an emergency and cumbersome since each jurisdiction has their own radio technology. Radio interoperability has long been a problem for responders. It was cited in the 9/11 Commission Report following the Al Qaeda terrorist attacks on September 11, 2001. Since then, significant government resources have been provided to law enforcement agencies to achieve better radio interoperability technology among agencies. Notably, following the Oversight Committee Report - U.S Secret Service: An Agency in Crisis, infrastructure investments were made starting in 2017 to facilitate the integration of radio communications between Secret Service and local police. This technology was available but not implemented at the Butler rally.

To blame secure radio encryptions for the delay in getting immediate messages from police officers to the Police Command Post and the Secret Service Security Room is not an excuse.

Creative and imaginative thinking including using common sense solutions like cell phones, jointly staffing Command Posts and or Security Rooms with local police radios would have minimized urgent threat notification delays. Simply having someone physically dispatch to the Command Post to personally deliver urgent messages during the approximately 20-minutes Crooks was sighted on the roof might have saved the day.

The Secret Service Presidential candidate advance teams are normally staffed by agents assigned to the field offices within the jurisdictional, geographic boundaries of the closest field office. Agents are also detailed from other offices as manpower needs and availability dictate. The security advance procedures for a Presidential and a Presidential nominee should have equivalently experienced personnel, resources and technology vis-à -vis for a sitting president’s advance. There should be no qualitative difference—the same protective standards should remain consistent. Whistleblower reports indicate the site advance agent assigned to the Butler rally was not experienced with large-scale advances.

For example, the middle perimeter was staffed with Homeland Security Investigative Agents reportedly with little to no experience with Secret Service protection assignments.

Strategic Failures

Among numerous burning questions: How could a lone 20-year-old with relatively cheap equipment, i.e., a drone, range finder and his father’s AR rifle defeat the Secret Service with 22 agents and approximately 80 additional law enforcement officers assigned to secure the Buller, PA rally site?

Obviously money and supposedly years of sophisticated dignitary protection training, state-of-the-art security surveillance technology, access to classified threat intelligence, an expensive array of assault weapons, encrypted communications systems—all failed. What was missing? Was it leadership? Was it a flawed security strategy? Was it incompetence? Was it an inability to assess risk? Was it an inability to communicate? Was it an inability to craft an effective protective security plan? Was it a combination of all of these?

Or…was it a lack of imagination? The experience and millions of dollars’ worth of equipment available to the Secret Service appeared to be no match for understanding and effectively implementing these tools to counter a lone 20-year-old shooter. Was the Butler, PA attack a one-off or does this expose profound weaknesses of the protective arm of the Secret Service?

Matthew Crooks clearly defeated the Secret Service at its own game. How is this possible? Are the Secret Service advance procedures too canned, too predictable? Strategic planning organizations in the public and private sector, especially in high threat environments, employ Red Team teaming. At a basic level this means considering the adversary’s perspective and goals. Simulate an attack as an adversary would and fortify against it with your security planning. In other words, wear two hats—your good guy hat and the bad guy hat. This will be fairly obvious to seasoned military planners and strategists, However, since this strategy appears to be absent from the security planning at Butler, it deserves to be mentioned. In simple terms…advance planners need to ask themselves: if I were a shooter or bomber, where are the vulnerabilities in this plan? What weakness would I exploit? Then as a security planner I need to ask what am I doing to fix them? This needs to be an evolving, on-going process. These are basic strategic security planning questions. The Army does this on a continuing basis.

There is no evidence the Secret Service conducts any substantive Red Team exercises. The irony here is Crooks did it for them by exposing the security plan’s egregious weaknesses. This is a jolting and tragic wake-up call. Crooks’ budget was probably less than $500. The Secret Service Presidential Campaigns and National Special Security Events budget is reported to be ~$73.3 million from the Office and management and Data. Clearly the security failures are not due to a lack of money.

It is as though Crooks had the Candidate Nominee Operations advance manual and observed the security advance planning. Crooks visited the site, researched Trump’s schedule, surveyed the site and stage with a drone and probed and tested security.

Leadership should have given the security advance team the training and tools needed to at least be on par with Crooks. Clearly the planning should have expanded the security footprint well beyond the security perimeter defined by the fence. Assuming the outer perimeters were covered by local law enforcement without the requisite police meetings was negligent.

What if the attack had been planned by well-trained terrorists using multiple, simultaneous attack methods as witnessed in the series of coordinated Islamist terrorist attacks on Friday, 13 November 2015 in Paris, France?

Homeland Security published planning guidance to prevent Complex Coordinated Terrorist Attacks (2018). Other salient examples include Mumbai (2009), Brussels (2016) and Barcelona (2017).

Would the Secret Service be able to detect an attack plan like these let alone respond to them?

Since the 9/11 attacks billions of dollars of government resources have been invested in defense strategy revisions, police, military and emergency responder training, communications upgrades and field exercises to better equip all concerned to address evolving threats. The National Response Framework (2019) defines five core capacities to guide the training of the response community: prevent, protect mitigate, respond, recover. The purpose is to “better integrate government and local response efforts.” Simply stated, all security partners need to focus more on prevention and work as a cohesive team.

This guidance needs to be incorporated and operationally reinforced into all joint security efforts.

Goals Moving Forward

To learn the Secret Service systematically failed to protect one of the nation’s Presidential candidate nominees is extremely troubling. The implications are staggering. Given the assassination attempt of Trump at Butler, PA and the security vulnerabilities this has exposed, restoring the pre-eminence of the Secret Service is critical. The highest priority needs to be given to finding long-term solutions. This has national security implications.

Solutions moving forward are challenging since the security failures are a multi-factored problem. Among the most important—stronger leadership, better recruiting, balanced funding allocation, refining intelligence sharing, consistent training, accountability and continuing oversight. The implementation of key protective training initiatives and procedures require review. These include simulated attack exercises, 4th Shift Training field scenarios and practicing advance agent procedures and protocols. It appears many were omitted and/or not followed during the security planning of the July 13th rally.

Immediate recommendations should include committing to a thorough review and implementation of existing protective security policies and procedures. The budget allocations should be balanced more equally for investigations vis à vis protection. The current Secret Service allocations are approximately 70% for the investigative arm and 30% for the protection arm respectively.

Importantly, manpower supplementation for protective details from Homeland Security, should require protective training on par with the protective training metrics required of Secret Service agents. The required training hours for all protective agents should be increased as outlined in the GAO January 2022 Human Capital Strategic Plan.

The Secret Service needs to bring clarity to the remaining questions surrounding the assassination attempt more than three weeks later. Their protectees, the American public, and government legislators deserve it.

The world of team sports provides a compelling metaphor for how games are won. Team members are assigned positions based on ability and experience. They rehearse their plays incessantly until they get it right.

If the Secret Service team expects to win their zero-fail mission, they will need to rebuild a foundation of trust—first. Leadership deficits, disparate experience levels, inconsistent training, dated technology, and other security advance omissions are fixable. Restoring trust with the brothers and sisters in blue and with your prized asset—your protectee poses your biggest challenge. Winning is impossible without trust.

J. Lawrence Cunningham is a Senior Law Enforcement Fellow at the Gold Institute for International Strategy, a Washington, DC-based, foreign policy and national security think tank. Prior to joining the Gold Institute he served as special agent-in-charge in the U.S. Secret Service.