Podcast Summary: The Watch Floor with Sarah Adams

Episode: "Every Step Cole Tomas Allen Took to Plan His Attack"
Date: April 28, 2026
Host: Sarah Adams

Brief Overview

In this episode, former CIA Targeter Sarah Adams breaks down the planning and pre-attack indicators in the recent attempted attack at the White House Correspondents' Dinner by Cole Tomas Allen. Rather than focus on security failures during the event, Adams shifts the discussion to how key signs and behaviors may have signaled this attack in advance. She emphasizes the importance of connecting various behavioral and logistical clues—travel movements, weapon acquisition, manifesto writings, and changes in personal behavior—before they escalate into violence. Her central message: “Our jobs, if we’re protecting the US Homeland, is to constantly be moving around those pieces and, and trying to put the puzzle together so we can save lives.” (01:01)

Key Discussion Points and Insights

1. Post-Event Analysis vs. Prevention

Traditional reactions focus on what failed during the attempted attack. Adams argues that stopping threats at the door is already too late.
Theme: The emphasis must be on detecting pre-attack indicators and changing the “puzzle pieces” approach to prevention.

“If you’re stopping a threat outside of the doors, you are way too late in preventing this from occurring.” (00:32)

2. Travel and Logistical Planning

Allen’s travel from California to DC, timed to arrive before the event, was his first visible pre-attack behavior.
Other relevant questions for investigators:
- Was his travel last minute?
- Did he cancel existing commitments (e.g., teaching)?
Patterns: Unusual or unexplained travel to major event sites, especially without reason, raises red flags.

“When someone goes to a location they don’t normally go to, it doesn’t make sense. And all we’re looking for is patterns, pieces of information that are off so we can start putting that puzzle into place.” (02:39)

3. Online Pre-Attack Research

Adams notes Allen likely performed online research on event logistics, venue maps, security, and potentially past similar attacks.
Many attackers model or are inspired by previous events; online searches often serve as early intent indicators.

“A lot of these attackers will look at successful, you know, terrorist events to try to mimic them or take lessons from them.” (03:24)

4. Physical Surveillance and Escalation

Online planning can only go so far; eventually, offenders move to physical surveillance, checking security setups, crowd flows, and entry/exit points.
Allen reportedly commented on weak security in his manifesto, implying deliberate reconnaissance.

“If you have an individual focusing on entry and exit points at a hotel, like a little fixated on the positioning of law enforcement…it’s again why awareness is so important. If someone would have caught any of this pre attack surveillance, we could be having a much different conversation right now.” (07:18–07:58)
The act of being on location and performing tests (e.g., trying different elevators) marks a critical escalation.

“You’re doing a little bit of real world testing of the security posture…You just start seeing how far you can push without really raising any red flags.” (09:04)

5. Capability Shift: Weapon Purchase and Training

Allen bought weapons and trained with them despite no prior interest in firearms—major escalation.
Behavioral change (joining new groups, adopting radical views) is often first noticed by close contacts.

“If you’re in a relationship, this is your family member, this is a close friend or somebody you went to school with... and you start seeing kind of new patterns, different ways they say things, different ways they view the world. It’s an interesting time to be paying attention.” (11:20)
Store clerks themselves sometimes notice first-time buyers or unusual purchasing behavior.

6. Ideological Hardening and the Manifesto Phase

Manifestos allow attackers to justify and explain their reasoning, marking internal alignment and commitment to action.
Adams draws attention to the frequency of this pattern in past attacks (Tennessee, Christchurch, Buffalo).

“[Attackers] want you to not view him as the bad guy…It’s almost this Robin Hood thing. Oh, I’m here to deal with the bad guys for you. Right.” (14:52)
“Their grievance is now becoming a narrative. The narrative then shifts to a justification, and then to them, that justification becomes some sort of closure for their act.” (16:37)
She compares these attempts at justification to historical terror messaging.
The manifestation stage often follows behavioral warning signs noticed by families.

7. Human Angle and Family Awareness

Early shifts in behavior are most visible to family and friends—the “human angle.”

“It is the loved ones or the coworkers who see this change in behavior first, and they’re who we rely on to notice it and hopefully report it.” (12:58)
Many families rationalize away warning signs, attributing them to stress or personality changes, rather than potential escalation to violence.
The perpetrator left his manifesto for his family to find; their reporting to authorities was a critical intervention.

8. On Patterns and Education Stereotypes

Countering public misconceptions, Adams debunks the idea that high education or “genius” status is a safeguard against radicalization or violent plots.

“This is not an atypical background at all. Osama bin Laden started in engineering school…Ramzi Yousef…was an engineer…College Sheikh Mohammed who planned 9/11 was an engineer…” (22:10)
Many extremist groups deliberately recruit educated individuals for their influence and networks.

9. The Importance of Pattern Recognition Over Singular Clues

Single indicators rarely mean much—real risk requires stacking multiple signs: travel, surveillance, acquisition of weapons, ideological shifts, behavioral changes, etc.
“Most failures when it comes to attacks isn’t like missing signals that are out there. It’s not connecting all the signals in time.” (24:18)
The solution is qualitative, trained analysis—not luck.

10. Final Takeaway: The Need for Early Prevention

The real defense isn’t hardening event security at the last minute, but proactively identifying pre-attack behaviors.

“We need to be preventing these things and not at the magnetometer, right. Weeks in advance.” (26:17)
Many attack planning patterns are not unique to one ideology or background—“the signal is out there” (27:43).

Notable Quotes & Memorable Moments

On connecting the dots:

“We always have signs, we just have to look for them.” (05:51)
On manifestos as psychological milestones:

“It’s like journaling or doing your vision boards. Once you write it down, right, that helps you get to the next stage of going through with something.” (15:51)
On the fallacy of the “model citizen” attacker:

“This idea that engineers don’t have pathways to violence is just in no way accurate. Anyone saying that to you does not understand history.” (23:11)
On family and friend detection:

“A family doesn’t always assume that’s going to lead to bad...We lots of times discount these activities instead of take a step back and say, hey, hey, hey, there’s a lot of changes in behavior here, right?” (18:44)

Timestamps for Important Segments

Introduction & Theme – 00:18–01:39
Key Pre-Attack Indicators: Movement, Online Activity – 01:39–05:51
Physical Surveillance & Security Testing – 07:18–10:30
Weapon Acquisition, Behavioral Shifts – 11:00–13:30
Manifesto Phase & Ideological Escalation – 14:52–17:30
Family/Community Role in Early Detection – 17:30–21:40
Debunking Education Stereotypes – 21:40–24:20
The Importance of Stacking Clues (Pattern Recognition) – 24:20–26:00
Final Takeaway & Summary – 26:00–28:02

Flow and Tone

Adams’ tone is analytical yet urgent, weaving together detailed intelligence insights with a motivating call for greater awareness. She blends real-world case examples with practical advice, directly addressing listeners and underscoring the collective responsibility to be vigilant. Her style is both accessible and authoritative, using storytelling and clear analogies to break down complex behaviors—making the episode compelling and understandable for any audience.

This summary encapsulates the episode’s structure and key messages, enabling those who haven’t listened to gain deep insight into pre-attack detection and why every “off” puzzle piece matters.

Transcript

A (0:01)

Some follow the noise. Bloomberg follows the money. Whether it's the funds fueling AI or crypto's trillion dollar swings, there's a money side to every story. Get the money side of the story. Subscribe now@bloomberg.com

B (0:18)

welcome to the Watch floor. I'm Sarah Adams. Right now everybody is talking about the aftermath of what happened at the White House correspondence dinner. The response, all these MOUN security questions and then of course, what all failed in that moment. But this episode is different because I think we all understand that if you're stopping a threat outside of the doors, you are way too late in preventing this from occurring. This was a great situation. We got very lucky. This attacker didn't kill anyone, thankfully. But you're not always going to get lucky. And the best way to get ahead of this is to of course focus on the pre attack indicators. And that's what we're going to jump into today. We're going to talk about what may have been visible prior to the attack. You know, what does kind of early reporting suggest and how cases like this give us warning signs before the event even occurs. And it's just the fact that sometimes people don't put the different fragments and pieces together because that's what it is. All of this is a puzzle. Our jobs, if we're protecting the US Homeland, is to constantly be moving around those pieces and, and trying to put the puzzle together so we can save lives. Of course right now we are so early into the investigation and like any investigation, details evolve. So today we're just talking about pieces we know or at least information we believe should be out there for investigators to dig into. But again it's early on and things change. Obviously one of the most in your face indicators is of course this pre attack behavior. He travel what sounds like via train from California to D.C. to arrive prior to this event. Right. The White House Correspondent's dinner. So at this stage of course just a one off piece of information like travel alone might not be pertinent. But when it comes to threat analysis, timing is everything. We do have a situation here where he's moving to a location he doesn't usually go to ahead of an event. Now other things would be really interesting to find out is you know, how last minute did he book this travel, did he have to cancel other things? Right. He worked part time as a teacher. Well, we're still in session. So did he plan to not go in, not fulfill his duties? All that are interesting signs. If you're a reliable person, you show up every Day for work and now you're not there. That's another piece you put into the picture. If we look at past events, of course, the Boston Marathon bombers were in place prior to the event. And then in multiple European plots, we had similar situations where the individuals moved from one area, be it Brussels and into Paris, et cetera. So movement becomes an interesting thing when it aligns with an opportunity. Right. A big event like the super bowl, but they don't have super bowl tickets, those type of things. You always have to kind of have your radar up because when someone goes to a location they don't normally go to, it doesn't make sense. And all we're looking for is patterns, pieces of information that are off so we can start putting that puzzle into place. Now, of course, there's other things he would have done prior to travel. First off, he had to book his train ticket. And of course he would have looked at hotels. And so we know there is at least some sort of pre attack research, even if it's just to do with the travel online. Well, in this research we might see, you know, searching around the event logistics for this dinner, anything to do with venue related information. He might have been viewing any kind of maps or the surrounding areas and then looking at any other prior attack reporting like he could be inspired by something else. A lot of these attackers will look at successful, you know, terrorist events to try to mimic them or take lessons from them. So it's definitely a piece of information that we know federal investigators are digging into. Again, you know, it'd be a great thing to get ahead of. They weren't, but at least that paper trail is there. Let me take a second and talk about something a lot of people put off. And trust me, I understand why it's life insurance. For me, this hits close to home. I've lost a number of friends overseas. And what stays with me after the fact is what their families have to go through. It's not just the loss, but the stress, the uncertainty, the questions about what do I do next? Remember, life insurance isn't about you. It's helping your family be able to put together all the pieces during the worst moments of their lives. Fabric by Gerber Life is term life insurance that you can get done today. It's made for busy parents like you. It's all online on your schedule. You can do it right from your couch. You can be covered in under 10 minutes, often with no health exam required. Fabric by Gerber Life is term life insurance that you can get done today. Made for Busy parents like you all online on your schedule. You can do it right from your couch. You can be covered in under 10 minutes, often with no health exam required. Fabric by Gerber Life is term life insurance that you can get done today. Made for busy parents right online on your schedule. You can do it from your couch. You can be covered in under 10 minutes often with no health exam required. If you've got kids, especially if you're young and healthy, the time to lock good rates in is now. This is when it's most affordable and provides you the most long term protection. Fabric also keeps it flexible. You can get high quality coverage that fits your family and your budget and there's no real risk to try. There's a 30 day money back guarantee and you can cancel anytime. And they've added useful features like free digital wills and tools to invest in your kids future. I've seen the difference between having a plan and not having one. Join the thousands of parents who trust fabric to help protect their future family. Apply today in just minutes@meetfabric.com watch meetfabric.com watch and use my link so they know I sent you. That's M e e t fabric.com watch policies are issued by Western Southern Life Assurance Company not available in certain areas. Prices are subject to underwriting and health questions. So we've seen this in prior cases. In the Pulse nightclub attack, Omar Mateen spent a lot of time doing online research. It was a little more focused actually around the Disney Downtown Springs area at the time and then the Manchester arena bombing. That there is a lot of kind of online planning and preparations that occurred. Again, none of this occurs in a vacuum. We always have signs, we just have to look for them. There's this idea out there that online behavior is where intent starts rehearsing without consequences. Right. Cause you can start thinking through or having your ideations of what you want to do and it's easy to do online. There's a lot of stuff, stuff there that can help you. Like I said, you can review past attacks, especially when things are overseas. There's so much footage out there and then there's just other materials that can help motivate you and inspire you. Even just previous attackers manifestos actually sometimes inspire some of these individuals. That's why we have to be careful sometimes putting out these materials because we're always fearful of copycats. Obviously in any sort of planning for an event you can only do online surveillance to a point and then you have to do something physically. So in this case the attacker of course, got to D.C. prior to the event and he does basically put out some information in his manifesto, like how weak the security is. So he did spend some time observing it. So this is really interesting, right? If you have an individual focusing on entry and exit points at a hotel, like a little fixated on the positioning of law enforcement, you know, paying attention to crowd flow and timing. Remember, he ended up using a side room, so he spent time looking at where he was going to later go. Well, that is a time during that surveillance where someone could have noticed and they could have thought, hey, this is strange. This is not an event goer, right? It's just a random person at the hotel. Why are they so interested and fixated on how we have security set up, especially in a part of the hotel that they are not even going to enter. So it's again why awareness is so important. If someone would have caught any of this pre attack surveillance, we could be having a much different conversation right now. Another important thing with pre attack surveillance is, is it's a critical escalation marker. Once someone's at the point where their eyes are on target, of course their attack is happening very soon because they're putting themselves in that place right at a given time. They're now a known entity there. Especially in his case when he's staying in the hotel, right. His name is on record. So it's almost like this timeline starts ticking down. It's very, very important. This is something such a key kind of phase when we're talking about the entire attack planning cycle. Now when you're an attacker, the things you're really doing at this moment is you're validating assumptions you made, usually from online research you did. You're doing a little bit of real world testing of the security posture. Like you might go a little farther than you should go. You might take the elevator down to the bottom floor, the one above it, to see if you can get off, right? You just start seeing how far you can push without really raising any red flags. Another thing is you start mentally transitioning from having the ideation of doing an attack to being in this environment, like feeling it, kind of understanding its cadence and mentally placing yourself in a position where you're ready to do this. Like there's one thing saying you want to shoot up a location, it's a whole nother thing getting to that location and still deciding to go forward with it. One of the clearest escalations when we're talking about pre attack indicators is this behavior that happens well, before the event, right? There is some sort of capability change in a person. In this case, we had an individual who went out and bought a handgun and a shotgun. And then it sounds like he went and, like, trained on them. Now, this sounds like a shift in his behavior. It doesn't sound like any time prior he showed much interest in guns. So it's a fascinating thing. If you're in a relationship, this is your family member, this is a close friend or somebody you went to school with, or this is your teacher. And they're changing a lot from their prior behaviors, and you start seeing kind of new patterns, different ways they say things, different ways they view the world. It's an interesting time to be paying attention. This also could have come about when he joined different groups on campus. Once you get into certain kind of advocacy groups or movements, there are sometimes kind of radicalization trajectories in them, right? There's a history of some of these organizations, you know, putting people along that pathway. And it is something to look at, especially when, again, this is someone you're close to. It is the loved ones or the coworkers who see this change in behavior first, and they're who we rely on to notice it and hopefully report it. We've seen this across other cases also in the past in Parkland, there is behavioral escalation paired with this acquisition phase that we're talking about. And then in numerous disrupted plots, those individuals, it was the first time they ever went and bought that type of weapon. Even in some cases, the people who owned the store said, yeah, it was very strange. They had limited knowledge, or they were fixating on only having one sort of weapon. They weren't interested in learning about the others. Like, it goes both ways. But obviously, people who sell these items do know and see things that others don't because they have customers come in all the time. You know, these are very natural occurrences. And it's another key area to where, hey, was there any red flags that came up, you know, during these purchases? So capability doesn't, like, create intent, but it now kind of completes your pathway to it, right? You had an idea. Now you have a tool or a weapon that can make your idea into reality. So we're at a much more dangerous stage than we were with someone just thinking that they might want to cause harm. Obviously, then you get to a piece where there's some sort of ideological hardening. In this case, we don't know exactly when it occurred. But of course, this individual wrote a manifesto. So in the manifesto, he Explains how he feels about certain things. He left it behind to make sure it was found. He wanted to, and a lot of them do. This is they want you to not view him as the bad guy. Right. It's almost this Robin Hood thing. Oh, I'm here to deal with the bad guys for you. Right. Like I'm a saint. I'm not here to harm any innocent people if I don't have to, but I will if I have to. I'm not here to harm who works at the hotel or hotel security or anything like that. If someone doesn't come at me, I'm not going after them. I'm just going after these senior administration officials. Pretty much all were on the table except FBI Director Kash Patel for some reason. But it was now to where he put it on paper. It's like they say, right? It's like journaling or doing your vision boards. Once you write it down, right, that helps you get to the next stage of going through with something. Of course, in most cases we want you to, like, put down. You want to lose weight or do well with your budget or be a better partner, not shoot up, you know, the correspondence dinner. But here we are. So, of course, there's been many similar cases. You know, the Tennessee shooter, she left a manifesto. Christchurch, we had a manifesto. In Buffalo, we had a manifesto. These are really a point where the individual makes some sort of internal alignment within themselves and decides they are going to come in an act. And it's just for some reason. And then they need to explain to you the reasons behind it being just because it's going to be a horrible event and they want you to have a. A little bit of their worldview when it happened. So it's a very interesting thing. It's actually manipulation. It's kind of how Osama bin Laden's letter to America was written. Again, he didn't write it. Adam Gaddin wrote it an American, and he wrote it to influence the thinking of Americans. Luckily, when it came out, it influenced nobody. But a few years back, it went viral because people, I think, want to be influenced at times. Unfortunately, that's the world we live in now with this kind of information overload. If we want to be a little textbook with these manifestos, they do something where, like, their grievance is now becoming a narrative. The narrative then shifts to a justification, and then to them, that justification becomes some sort of closure for their act and they hope you view it the same way. Now, in my opinion, the best way to stop any sort of Violence or an attack is of course, course the human angle. We all put out signals and I discussed this briefly, right? The people closest to him would of course see signals first. So early reporting suggests some family might have seen a shift. You know, one of his, I think it was sister said, ah, he said a few crazy things, you know, a few statements. You know, another thing that was interesting is he made these first shooter games, right? He was a game developer on the side. Now we'd have to go in and see if he put any of this ideation into his game, right? If he was using it to kind of live through this fantasy in some way. But it is an interesting angle, you know, that should be explored. You know, what do the graphics and the content and how those events unfold, you know, happen in the game and then how did he plan it in real life? You know, another thing is he did leave the manifesto behind, of course for his family to find. And then they found it and reported this to authorities. But also it would have been the family who should have been one of the first people to be like, hey, why is he taking this cross country trip? You know, last minute, very strange to do. So there's all these type of things that could have bubbled up to the surface that a family would have seen that a lot of other people wouldn't have noticed unless you're very close to the individual. Now it's very significant, you know, that a family is attuned, especially when they started seeing some of these changes in behavior because they see that escalation, right? As someone goes up this kind of trajectory of radicalization, they are the first to notice when things are off. And lots of times during that trajectory, the person tries to cut the family out, right? I mean, that's a huge sign. Another thing is a family doesn't always assume that's going to lead to bad. And this is a problem with, you know, training. It's not like we go around and train families on threat indicators or you know, this could be something really bad if it keeps going down this pathway. They don't really think that way. Lots of times you think, oh, you know, he's just having a hard time right now, or oh, his career isn't aligning the way he thinks it is, or oh, he's just following a few conspiracies online. And we lots of times discount these activities instead of take a step back and say, hey, hey, hey, there's a lot of changes in behavior here, right? This person seems to be coming to have extreme views When I talk to them, they don't even want to hear my opinion. Everything is black and white to them. They're starting to use terminology like they're a savior or they have to be the one to fix that. This or the world or someone in the government is doing things bad against us and it is on us to do something bad. Right? All these things start changing. And you have a person who never spoke that way and now they're going down this pathway. So it's super important to pay attention to. And we've seen this repeatedly. In most cases, you have a family that says, and we had the same thing happen with Charlie Kirk's assassin. He was one individual and then he got into different habits and activities and sounds like relationships, and he became a different individual. That doesn't happen overnight. Right? That was a progression and the family saw it, but didn't think it would lead to violence. Well, we have to pay attention because it can. Now we're going to talk about stacking some of this because one indicator is nothing, right? You have to have multiple things occurring to say, oh, there might be intent here. So we have obviously in this case, movement towards a target environment. Right, left, California, came to D.C. made sure he was in the vicinity of where this dinner was. We had some sort of online reconnaissance behavior. It's not clear how detailed it was yet, but it happened. We had definitely some sort of physical observation of security on the objective prior to this occurring. We had this capability shift right where he went and at least procured weapons. We can't always have in our head this idea that someone needs to go out and get some sort of automatic rifle. And that's, you know, this gateway to committing an attack. I mean, you can go kill people with knives. So we do have to not just focus on it. It's just the fact that, hey, he really wasn't into weapons. Now he is. It's a very interesting thing. Another thing is we have this ideological hardening now. We visually see it with the manifesto, but there is definitely probably signs of it prior that co workers, friends, family saw well before a written manifesto is put together. And then lastly, we do have kind of a human level concern. It seems like, right, he has a family, they're decently a close unit. So something should trigger there. Now I noticed this thing and the families do this as well, and friends do this as well. I've noticed this idea online. It's like, well, he got into Caltech, right? He's a genius. He was a NASA intern. He was an Engineer. This is an atypical background for someone who would commit this kind of violence. And I don't know where that idea came from, but this is not an atypical background at all. Osama bin Laden started in engineering school, he just didn't finish. Ramzi Yousef, who did the first hit on our World Trade center towers and planned bojinka, which I tell everyone, we better go research bojinka, it's coming back. He was an engineer. College. Sheikh Mohammed, who planned 911 was an engineer. The Abbey Gate suicide bomber, Sangari, he was an engineer. His boss who runs Islamic State Khorasan province was an engineer. And heck, even the terrorists we locked up as a scapegoat for the attack, he's an engineer. This idea that engineers don't have pathways to violence is just in no way accurate. Anyone saying that to you does not understand history. I mean, groups literally go into engineering schools to recruit students. Besides the fact all extremist groups, no matter if you're political extremism, environmental extremism, normal terrorism, go into universities to recruit people because they like actually having educated followers. They like people who might be from families with some money, right? Because they can do influence so quickly. They have these vast networks. They're going to be taken seriously because they're educated. So don't ever just think, oh, that doesn't make any sense. He's got an engineering degree. No, no, no, no, no. Makes me more nervous when you have an engineering degree. We're lucky someone with his mind didn't plan this attack better. So much luck happened in this situation, right? For the people who were there. We talked through all of this today and I want you to understand that most failures when it comes to attacks isn't like missing signals that are out there. It's not connecting all the signals in time, right? We had plenty of information in the lead up to 9 11, for example, but no one put the pieces together. They did not form that puzzle. And I hope today, now you actually start seeing this larger puzzle because the way we can get ahead of this is these indicators, be it behavioral or weapons purchases, et cetera, it is there for us. We just have to pay attention. Like we need to be preventing these things and not at the magnetometer, right. Weeks in advance. Now we walk through plenty of things that can be pre attack indicators. In this case, we discuss the pattern, the fact that the pattern can touch a lot of different cases, be it similar to the Pulse nightclub, the Boston bombers, et cetera. Patterns are not unique, right? In one case they're consistent across all type of attacks. It doesn't have to be as an Islamist terrorist attack. It can be one of these other domestic terrorist incidents. The signal is out there. I mean, there's so much noise. I know even just on this topic, there's so much noise. But these individuals kind of like leave these data wakes out there. And the important thing is we need to make sure we have qualified people taking those pieces of data and putting them together to prevent incidents like this. Because we cannot just hope. We're always lucky on the objective. We need to stop this from occurring well before they get outside the doors. Thanks for being here today on the watch floor.