The suspected UnitedHealthcare CEO killer planned his attack well – but made crucial mistakes, experts say

At first glance, the assassin seemed too meticulous to be an amateur and too careless to be a professional.

But the man suspected of killing UnitedHealthcare CEO Brian Thompson on a New York City sidewalk managed to evade capture for days – puzzling even law enforcement experts.

• Download the CTV News App for breaking news alerts and video on all the top stories

“What surprises me is how well planned the actual attack was, and at the same time how sloppy the killer was in his movements – in his showing his face, in leaving behind items,” said Steve Moore, a retired FBI supervisory special agent.

“There’s kind of a dichotomy. It’s almost as if he read a book on how to do one of these attacks and didn’t read it carefully. He just made serious mistakes as he went along.”

The suspect’s evasion ended Monday at a McDonald’s in Pennsylvania – where police arrested Luigi Mangione in connection with the killing.

Here’s a look at what police say are the suspect’s key moves, the evidence he left behind, and what experts say about his strategy:

Before the killing

He took a bus to New York and paid cash: The suspect cleverly avoided air travel – and the intense scrutiny that comes with it, experts said.

Had he taken a plane to New York, the suspect probably would have had to use a credit card, show his ID and reveal his entire face under security cameras. If he had a gun at the time, it probably would have been detected during luggage screening.

Instead, the suspect took a Greyhound bus to New York, law enforcement sources told CNN.

By travelling on Greyhound, the suspect “is paying cash, no ID,” former NYPD Deputy Commissioner Richard Esposito said.

“It’s one of the reasons people ride Greyhound buses. (There) is a great deal of freedom and anonymity to come and go as you please.”

Almost a week after the killing, it’s still not clear where the suspect got on the bus. The bus started its route in Atlanta, but authorities didn’t know whether the suspect boarded in Atlanta or elsewhere.

Detectives from the New York Police Department traveled to Georgia and reviewed surveillance footage from the Greyhound station in Atlanta – but saw no sign of the suspect, law enforcement officials told CNN. The detectives returned to New York.

Investigators are still trying to determine where the suspect boarded, said John Miller, CNN’s chief law enforcement and intelligence analyst.

Luigi Mangione is seen in a photo posted in 2019. (Obtained by CNN)

He arrived early and stayed in a hostel – again, paying cash: The suspect arrived at the Port Authority bus terminal in Manhattan on November 24 – 10 days before the killing, authorities said.

He checked into a hostel on Manhattan’s Upper West Side using a fake New Jersey driver’s license, a law enforcement official told CNN.

While hotels typically require a credit card to hold a room, some hostels do not. The suspect paid cash for his stay, a law enforcement official told Miller.

By paying with cash, the suspect was able to avoid a digital trail linked to any credit cards or online accounts.

It appears the suspect used cash throughout his 10 days in New York, during which he finalized plans for the killing and his escape.

He diligently wore a mask … and then lowered it: The suspect was seen on numerous public surveillance cameras with his jacket hood over his head and a mask over his face.

But a rare image of the suspect’s unmasked face was captured on surveillance video when a hostel employee flirted with him and asked him to lower his face mask, a law enforcement official told CNN.

“He lowers the mask, and gives that big smile,” Miller said. “That little flirtation between the two of them, in some good-humored way, actually yielded what is so far the most significant clue to identifying him.”

The decision to reveal his face may have been strategic, Miller said.

“He may have just calculated, ‘I’m going to stand out as more suspicious if I don’t do this,’” Miller said.

But lowering his mask to reveal his face was “one of his biggest mistakes,” retired FBI special agent Daniel Brunner said.

Police later released a photo taken from a security camera inside a taxicab, which gave a clear image of the suspect’s eyes.

On Monday, a McDonald’s employee in Altoona, Pennsylvania, noticed a man eating at the restaurant looked like the suspect. Altoona police officers rushed to the scene, and took Luigi Mangione into custody to hold for the New York City detectives.

He used a ghost gun that’s not traceable: The gun seen on surveillance video looked so unusual, even police veterans were puzzled by it.

“I wasn’t familiar with that gun at all,” said CNN senior law enforcement analyst Charles Ramsey, the former top officer in Philadelphia and Washington, DC.

The man arrested in Pennsylvania had a “ghost gun” when he was searched by local police at a McDonald’s, NYPD Chief of Detectives Joseph Kenny said Monday.

“He was in possession of a ghost gun that had the capability of firing a 9mm round and a suppressor,” he said. A suppressor, also known as a silencer, muffles the sound of gunshot.

Ghost guns are untraceable, self-assembled firearms, often put together with parts sold online – sometimes in as little as 30 minutes. The weapons don’t have serial numbers, making them more difficult to track and regulate.

Background checks aren’t required to buy kits to build ghost guns online. So buyers can sidestep the requirements that typically come with buying a firearm.

The gun found on the suspect may have been 3D printed, Kenny said. He said police will learn more details after ballistics testing.

A still image from a video shows NYPD in New York's Central Park, where a backpack, possibly belonging to the suspect in the shooting of UnitedHealthcare CEO Brian Thompson, was found December 6. (WABC via CNN Newsource)

After the killing

He kept shedding evidence (and apparently didn’t mind leaving DNA): Shortly after the pre-dawn killing, the suspect seemingly left a trail of evidence behind.

A discarded Starbucks water bottle, an energy bar wrapper and a burner phone gave authorities DNA material and a partial fingerprint to work with. Later, a distinctive backpack resembling the one worn by the gunman was found in Central Park.

Dropping the backpack in Central Park might seem like “a crucial mistake,” criminologist Casey Jordan said after police found the bag Friday.

“But I’m not underestimating the intelligence of this particular suspect,” she said. “So much planning went into this. … We cannot rule out that he planned on us finding the backpack, that he left contra-indicators in there, things that would throw the investigation off.”

After police moved the backpack to a lab and carefully opened it, they found no murder weapon – just a jacket and Monopoly play money.

Leaving the backpack behind may have been a smart move on the suspect’s part, law enforcement experts said. It’d be easier to link the suspect to the crime if he was still wearing the same distinctive backpack.

Authorities hoped DNA samples from the wrapper and water bottle – plus a partial fingerprint from the phone – would help them identify the suspect. But testing yielded no DNA or fingerprint matches in law enforcement databases.

The suspect might have intentionally dropped some evidence to throw investigators off, Jordan said.

“The water bottle they found that they believe that he dropped, he could have pulled that out of the garbage at the Starbucks before he left there. It might have somebody else’s DNA on it,” she said.

“You just don’t know the level of planning and sophistication he put into this.”

But now that the suspect has been arrested, “they’re going to take DNA swabs from him – even if they need a search warrant to get that – and then compare that to DNA recovered,” Miller said.

He planned a complex path out of New York: It’s still not clear how the gunman knew Thompson would be walking past him in front of a hotel around 6:44 a.m. A UnitedHealthcare investors’ conference wasn’t supposed to start at the hotel until 8 a.m. But the gunman positioned himself behind a car minutes before Thompson walked by. He then walked toward the CEO and shot him from behind.

Immediately after the shooting, the suspect ran from the scene, hopped on an electric bike, rode into Central Park, ditched the bike, hailed a taxi and went to a bus terminal with interstate buses headed to a variety of destinations, police said.

The suspect’s complicated exit strategy might indicate he practiced each step in advance – from the site of the shooting at the hotel to his apparent departure out of New York, former FBI Special Agent Ken Gray told CNN.

“The fact that he was able to get to that location, be there in time, shoot Thompson and then get to his bike and get out of there and be on a bus out of the area, out of New York City as quickly as he did – that shows that he practiced this, that he knew what he was doing as far as his exit route from the area,” Gray said.

He apparently forgot to ditch his fake IDs: While the suspect scrapped his backpack, water bottle, energy bar wrapper and burner phone, he kept some evidence with him, police say.

After Mangione was spotted at the McDonald’s, investigators discovered he had numerous fake IDs – including one police believe was used by the suspect in New York City, multiple law enforcement officials told Miller.

Police also found a gun with a suppressor like the one used in Thompson’s killing, the officials said.

• Follow the CTV News channel on WhatsApp

Such findings might not have emerged without the synergy between police, the media and the public.

“For just over five days, our NYPD investigators combed through thousands of hours of video, followed up on hundreds of tips and processed every bit of forensic evidence — DNA, fingerprints, IP addresses and so much more — to tighten the net,” NYPD Commissioner Jessica Tisch said.

She credited the media for publicizing the case and lauded members of the public who came forward with tips.

“We should never underestimate the power of the public to be our eyes and our ears in these investigations,” Tisch said.

CNN’s Mark Morales, Ryan Young, Elise Hammond, Dakin Andone, Dalia Faheid and Elizabeth Wolfe contributed to this report.