Summary of Every Step Cole Tomas Allen Took to Plan His Attack

Overview of The Watch Floor

In this episode, Sarah Adams analyzes the early warning signs that may have appeared before the White House Correspondents’ Dinner attacker carried out his plan. The focus is less on the immediate security failure and more on the pre-attack indicators—the behavioral, logistical, and ideological clues that can show intent well before violence happens. Adams argues that prevention depends on connecting small, scattered signals into a bigger threat picture before an attacker reaches the target.

Main Points

• The episode centers on how attackers often reveal their intent through a buildup of actions long before an attack.
• Adams emphasizes that single clues rarely mean much on their own; the danger comes when multiple indicators stack together.
• She repeatedly stresses that the best prevention happens well before the doors of an event, not at the final security checkpoint.
• The investigation was described as very early, so some details may change, but the episode highlights what investigators and the public should be looking for.

Pre-Attack Indicators Discussed

1. Travel to the target area

• The suspect reportedly traveled from California to Washington, D.C. before the event.
• Adams notes that movement alone may not mean much, but it becomes important when it lines up with an upcoming opportunity.
• She compares this to other attacks where suspects moved into place before striking.

2. Online research and reconnaissance

• Adams says the suspect likely did online planning, including:
  • Looking up event logistics
  • Researching the venue and surrounding area
  • Checking hotels, maps, and access points
  • Possibly reviewing previous attacks for inspiration or tactics
• She describes online behavior as a place where intent can be rehearsed without consequences.

3. Physical surveillance on site

• A major escalation marker was the suspect’s reported physical observation of the hotel and security layout.
• He allegedly paid attention to:
  • Entry and exit points
  • Law enforcement positioning
  • Crowd flow and timing
  • A side room used during the event
• Adams says this kind of surveillance is especially dangerous because it shows the suspect is testing assumptions and preparing to act.

4. Capability shift: weapon acquisition and training

• Another major indicator was the suspect reportedly buying a handgun and shotgun and then training with them.
• Adams frames this as a shift from ideation to capability:
  • He no longer just had thoughts
  • He now had the means to act on them
• She notes that sudden interest in firearms, especially when it is new behavior, can be a significant red flag for people close to the person or for sellers who notice unusual purchases.

5. Ideological hardening and the manifesto

• The suspect allegedly left behind a manifesto, which Adams treats as evidence of ideological hardening.
• She explains that manifestos often:
  • Reframe grievance as justification
  • Attempt to shape how the attacker wants to be viewed
  • Give the attacker a sense of narrative control over the act
• She compares this to other mass-violence cases where written statements were used to explain or legitimize the attacker's worldview.

6. Behavioral changes noticed by family and close contacts

• Adams says the human angle is one of the strongest opportunities for prevention.
• Family members and close friends are often the first to notice:
  • Sudden travel or secrecy
  • New extremist or black-and-white thinking
  • Withdrawal from normal relationships
  • Unusual statements or “crazy things,” as early reporting suggested one family member observed
• She argues that loved ones often see the changes but may not realize they point toward violence.

Broader Lessons

Threats are usually built, not sudden

• Adams pushes back against the idea that attacks come out of nowhere.
• In her view, violence usually follows a pattern of escalation:
  1. Grievance or ideation
  2. Online research
  3. Physical surveillance
  4. Capability acquisition
  5. Ideological justification
  6. Final execution

One indicator is not enough

• The key lesson is pattern recognition.
• None of these signs alone proves intent, but together they create a clearer threat picture.
• She repeatedly compares this to a puzzle: investigators and protectors have to assemble the fragments in time.

Background does not rule out violence

• Adams strongly rejects the idea that an educational or professional background makes someone unlikely to become violent.
• She specifically argues that engineering, intelligence, or elite academic backgrounds do not prevent radicalization.
• Her point: extremist groups often recruit educated people because they can be influential and useful.

Notable Takeaways

• Prevention should happen long before a security checkpoint.
• Travel, research, surveillance, weapon purchases, and manifesto writing can all be warning signs when seen together.
• Family, coworkers, and friends are often the first line of detection because they see behavioral changes early.
• Investigators should look for the whole pattern, not isolated events.
• Adams frames the episode as a call to be more proactive about behavioral threat assessment and early reporting.

Context Note

• The episode includes a mid-roll sponsor segment for Fabric by Gerber Life, a term life insurance product, before returning to the threat-analysis discussion.