Although authorities have witnesses, ample street footage and even DNA evidence, the nationwide manhunt for the gunman who fatally shot UnitedHealthcare CEO Brian Thompson is fraught with challenges for law enforcement as it stretches into its fourth day.
Since the attack at 6:46 a.m. Wednesday, details have come more clearly into focus. The assailant arrived in New York City on a bus from Atlanta Nov. 24, stayed at an AYH Hostel on the Upper West Side and likely fled the city via the Port Authority bus station.
The FBI has joined local police in the hunt, and a relatively clear photo of the suspect has been distributed so the public can do the same. Here are the breadcrumbs of evidence investigators are following.
WHO WAS UNITEDHEALTHCARE CEO SHOOTING SUSPECT ON THE PHONE WITH MOMENTS BEFORE SHOOTING?
1. A backpack discarded in Central Park
NYPD investigators found a backpack in Central Park West on Friday that they believe belonged to the suspect who killed Thompson. A law enforcement source told Fox News Digital it will be taken to a lab in Queens for forensic testing.
Retired FBI agent Scott Duffey explained the backpack will undergo "trace evidence processing."
REWARD MONEY FOR INFO ON UNITEDHEALTHCARE CEO'S KILLER NOW UP TO $60K BETWEEN FBI, NYPD
"[It's] a process for hair, fibers [and] DNA," Duffey said Saturday. "If he holds his hand against the strap and tightens the buckle like most of us do, that is where DNA most likely can be found. And zippers."
2. A water bottle dropped at the scene
After ambushing Thompson outside the Hilton Midtown at 57th Street and 6th Avenue, the gunman took off down an alleyway. Investigators are now testing a water bottle they believe he dropped there for DNA evidence.
Still, Duffey said DNA will only be immediately useful if the killer has already been arrested within the United States and is in the national Combined DNA Index System (CODIS).
"If CODIS is not a match, then that DNA means nothing until you have someone in custody [to compare it against]," Duffey said.
A genealogical DNA profile could be set up to run against existing DNA profiles submitted to ancestry websites, but the time-consuming process could take too long to catch a killer at large.
"If there's a genetic match, it's going to give you a family profile, but an investigator will [then] need drivers' licenses, photos, criminal backgrounds," Duffey said.
A genealogical profile, Duffey said, likely won't come into play unless the other leads go cold.
"But let's just say that the family match that comes up is in Atlanta. That could be a start because we believe the bus arrived from Atlanta," Duffey said.
3. A discarded cellphone
A cellphone, believed to belong to the gunman, was also found in the alleyway he used to escape.
Video has also emerged of the unidentified man with a cellphone to his ear less than 15 minutes before he opened fire.
"If indeed he was on a phone call right then — his phone was live — you can [collect data from] the cell tower. You are going to need the search warrant for that, and it’s a ton of data," former NYPD inspector and Fox News contributor Paul Mauro previously told Fox News Digital.
"You've got the video. You have a pretty good place and time. So, what that does [is] it places that phone inside a particular cell grid, and you look in the data around when the call appears to have been made. And you look at the phone calls that were made there, and, by process of elimination, you are going to get not only the phone number that was assigned to that phone. You are going to get who he called," Mauro added. "And now you got a real data point."
But cracking into a cellphone can take anywhere from seconds to weeks, Duffey said.
Some devices can be unlocked quickly using technology like Cellebrite, which plugs into a phone and "allows everything in that phone to be downloaded in a fantastic, readable, usable product," Duffey said.
But in other cases, like when biometric security is difficult to bypass, law enforcement needs to contact the service provider, which lengthens the process. Duffey said certain companies are more receptive to law enforcement than others because some prioritize their reputation for security and the integrity of their security measures over investigations.
4. Shell casings with a message
Three shell casings with the words "deny," "depose" and "delay," similar to a popular phrase within the health care industry — "delay, deny, defend" — were left behind at the scene.
These casings could be scoured for DNA evidence, and the message left on them could point to a motive.
An NYPD detective told Fox News Digital Thursday the words were "clearly intentionally left to make a statement."
"This will help identify a motive and eventually the suspect," the detective said.
Alternatively, former Washington, D.C., homicide detective Ted Williams told Fox News Digital the message could have been left behind to "throw investigators off."
5. A flirtatious exchange caught on camera
A clear image of the suspect was captured at the AYH Hostel where he stayed Nov. 24-27. Although others in the hostel said the man wore his mask at all times, only pulling it aside to eat, he allegedly pulled it aside and smiled while chatting with a receptionist.
Although facial recognition software has come a long way in the past two decades, Duffey said, the image is likely not clear enough to get a reasonably small pool of matches.
"Still shots are easily distorted from what that person really looks like," Duffey, who used earlier versions of facial recognition a decade ago in bank robbery cases, told Fox News Digital. "There could be if there's the slightest bit of a distortion because that's not a good video shot."
Duffey said there are certain "points" needed to match a photo to an existing driver's license or passport photo. He said that is why travelers can no longer smile in their passport photos.
"If you took a high school yearbook photo and submitted it, no glasses on, no covering, I guarantee that will hit off if that person has a driver's license or a passport photo in a state that allows law enforcement to use facial recognition technology," he said. "Now you're taking a grainy photo. It's just not enough."
However, he said, the image is likely good enough that a member of the public who recognizes the gunman could come forward.
6. Surveillance footage
The NYPD has access to more than 18,000 security cameras through its Domain Awareness System. But combing through that footage — in addition to pulling additional surveillance from businesses on the killer's path — could be a Herculean task.
"Digital video recovery teams [are] detectives that train, go out, collect all the surveillance video from doorbells, cameras, all the cameras by the city [to gather evidence] with whatever equipment they have. They're able to download it quickly, put it onto their forensic thumb drive, bring it back to a police department and have a quick and easy upload," Duffey said.
"That is tedious," he said. "I've been a part of that, [and] you have to dedicate a full team that's watching [footage] probably 24/7."
Duffey said investigators are likely searching for footage of the assailant when he first arrived in the city about ten days before the shooting in case there is a clearer image of his face.
