Before Thanksgiving 2023, Thomas Crooks' online life was fairly routine for a 20-year-old. He'd scroll through social media, listen to music on Spotify, visit news sites and peruse Reddit.

But a plan for mass violence was brewing, and in order for it to succeed, Crooks had to compartmentalize his life. It was something he was already comfortable doing from a childhood in which he let few people get close.

Friends knew little about his home and tight-knit family. They were rarely invited over to the Crooks home to play or, as they got older, hang out. In late 2023, he pivoted to keeping a new set of secrets -- building homemade improvised explosive devices in his bedroom and planning an assassination, while pursuing a career in engineering.

On July 13, 2024, Crooks would take aim at a rally for President Trump in the small town of Butler, Pennsylvania, firing from a rooftop eight shots that came within inches of dramatically altering the course of American history. He left no manifesto, no explanation for why he tried to kill the former and future president. In the year since the shooting, investigators and those who knew him have been trying to piece together what led him to climb that roof in Butler, with frustratingly few answers.

This CBS News investigation provides the most comprehensive portrait yet published of the insular young student. It draws from interviews with more than two dozen friends, professors, law enforcement officials and others, as well as open records requests to half a dozen agencies and a review of thousands of documents.

The young man who died in the assassination attempt crafted a furtive double life in the months leading up to the attack, unbeknownst to the people closest to him.

he "nice" boy who "kept to himself"
Crooks was born in 2003 and lived his entire life in a suburban home purchased by his parents before he and his older sister came along, tucked along a leafy street in Bethel Park, Pennsylvania, just outside Pittsburgh. Growing up, Crooks loved Legos, his cat, building and creating model airplanes, watching the Pittsburgh Steelers and cooking with family.

His parents were both social workers, and took pride in their work and family. In 2008, his father, Matthew, filled out an online registry for a family coat of arms, writing that he hoped to pass down to his young children a sense of family unity and instill in them the virtues of generosity, sincerity, hope, joy and service to the country.

Crooks and his mother, who is visually impaired, often prepared dinner together. During holidays, everyone helped out. "For Thanksgiving, me and my dad will cook turkey and mashed potatoes together. At Christmas, me and my mom will bake dozens of cookies together, and on New Year's Eve, my mom and I will bake the pork and the sauerkraut together," Crooks said in a video he recorded for a college class.

In kindergarten, Crooks met Tristan Radcliffe. They ate lunch together frequently throughout most of elementary, middle and high school, and kept in touch after they both enrolled at the same college.

"I've known Tom, like, all of my life," Radcliffe said. "He was cool. You know, he was kind of just Tom to me."

There were many things about Crooks that stayed familiar and consistent through the years: his tight jeans, his tidy shirts and his bespectacled smooth face beneath neatly parted hair. But there was plenty, Radcliffe said, that he never knew about his friend, even though they saw each other nearly every day.

He was never invited to Crooks' home, and Crooks rarely talked about his family. Radcliffe said Crooks was a "nice" boy who "kept to himself." Crooks' neighbors said the family didn't interact much with folks on their block, and the children rarely had visitors.

Radcliffe wasn't bothered by it. To him, Crooks seemed like he had more on his mind.

"He always seemed like he focused on his work more, you know, like he came off smart," Radcliffe said.

Crooks' grades and test scores supported that. Crooks scored 1530 on his SAT exam, putting him in the 99th percentile nationally. He enrolled in the Community College of Allegheny County in 2022, and told an adviser he was saving money before pursuing a four-year engineering program.

As the tight quarters and crowded classrooms of high school gave way to the sprawl and remote coursework of commuter college, Crooks' social connections largely evaporated, allowing his secret life to go largely unnoticed.

A star student walking two paths
A diligent college student, Crooks routinely contacted professors to make sure his grades remained high.

His teachers were impressed with his work, often lauding his effort and dedication. One emailed to compliment Crooks for "getting such an early start" on a project. Another wrote to thank him for his contributions to class all semester.

Crooks stood out among his peers, according to former engineering professor Patricia Thompson.

"I thought he was a star student. He had his head on straight and he was on a path [to] success," Thompson said.

She recalled showing other professors in her department one of Crooks' projects which exceeded her expectations. He designed and 3D-printed a unique chessboard, engineered for players with visual impairments.

For many others contacted by CBS News, Crooks did not leave a lasting impression. Several former students said they did not realize he had been in the same class. Even some who had emailed and worked on projects with Crooks said they couldn't recall interacting with him.

For one assignment, Crooks was called upon to record a speech in front of an audience of five adults. He emailed his professor seeking to be excused from that requirement.

"I currently only live with my Mom and Dad. There are no other adults in my house and I have one sister who lives nearby that could potentially come over to be part of this audience," Crooks wrote. "I do not have access to any other adults."

In the summer of 2023, Crooks bought a rifle from his dad for $500 and signed up for a membership at a local shooting range. He became a regular at Clairton Sportsmen's Club, about nine miles from his home, signing in to use the rifle range more than 40 times in the last 11 months of his life, records show. Around that time, records obtained by CBS News show he started using encryption services that masked some of his internet use, mixing those with more typical visits to sites like Facebook, Instagram, TikTok and X.

His habits started to rapidly shift that fall. To his professors, he still appeared focused on getting straight A's and preparing to apply to the engineering programs at the University of Pittsburgh and Robert Morris University. But his online activity suggests his attention was elsewhere. He began to more frequently use an encrypted email service called Mailfence and a virtual private network called Mullvad. Both would shield his online life from anyone who might pry.

An analysis by CBS News of Crooks' internet routines shows he developed an increasing interest in news, explosives and ammo, and secrecy. The records include nearly a year of Crooks' activity on his college's wireless internet network. They show hundreds of visits to websites ranging from his academic email account and discussion boards, to his bank, news sites, gaming platforms, social media, weapons blogs and Steelers fan sites.

Logs of Crooks' on-campus internet activity, which CBS News obtained through a public records request, indicate that in the last months of his life, he became increasingly rigid about secrecy, shrouding his activities through encrypted services.

Two particular days -- Dec. 6, 2023, and Jan. 24, 2024 -- stand out. On Dec. 6, 2023, Crooks checked various news sites and the White House website's archives from Mr. Trump's first administration, followed by visits to firearms websites. The following month, on Jan. 24, Crooks showed the single largest number of internet requests in the logs, at 1,364. He started to consistently use the VPN after that day.

On some days, he left little trace of his activity, choosing instead to first turn on Mullvad. Virtual private networks, known as VPNs, route a user's web traffic through encrypted tunnels, hiding their activity from prying eyes, such as a college's web tracking security software. While Crooks was using Mullvad, his browsing history was effectively sealed off.

Mullvad CEO Jan Jonsson told CBS News that the VPN service used by Crooks was designed to "provide anonymity, censorship circumvention and surveillance protection."

"This sadly also means that if somebody abuses the service for nefarious purposes, we cannot block that individual user and unfortunately can't provide any additional information about them," Jonsson said.

In December 2023, a month before Crooks' final semester started, his life began to split in two. He was focused on his college applications, and at the same time fixated on mass violence. One day, he emailed himself to review his personal statement for his application; on another, he emailed customer service to complain that the explosive fuel he ordered had not yet shipped. Investigators later concluded he would have been able to engineer bombs in his bedroom without his parents knowing.

Around this time, some in Crooks' life did notice erratic behavior.

Crooks' father told investigators that, in retrospect, he spotted signs of his son's declining mental health, according to excerpts of a Pennsylvania State Police report. Those excerpts were first made public in December by a House of Representatives task force on the attempted assassination.

"Crooks' father explained that within the last year he observed several instances of his son dancing in his bedroom throughout the night," a Pennsylvania investigator wrote. "He would occasionally see Crooks talking to himself with his hands moving, which he expressed as uncommon and had become more prevalent after he had finished his last semester."

Radcliffe noticed similar changes when he bumped into Crooks on campus.

"He would always move his legs around a lot, and he would kind of talk pretty fast," Radcliffe recalled.

Crooks graduated from community college in May 2024. On June 14, less than a month before the assassination attempt, he sent one last email from his community college account.

It was to the registrar. Crooks wanted to know when he'd receive his diploma.