Why finding the suspected CEO killer is harder than you might think

He killed a high-profile CEO on a sidewalk in America’s largest city, where thousands of surveillance cameras monitor millions of people every day.

But the man who killed UnitedHealthcare CEO Brian Thompson outside a busy hotel keeps evading capture. Now, authorities say he might have slipped out of New York – meaning the elusive gunman could be anywhere.

It could take weeks to find and scrub through a massive array of video footage from all the places where the gunman may have traveled.

Police believe the suspect arrived in New York City ten days before the killing – on Nov. 24, a law enforcement official told CNN. Throughout his stay, the suspect appeared on camera numerous times – but always kept his hood over his head and wore a mask in public places.

“He knows he’s on camera – it’s New York,” said John Miller, CNN’s chief law enforcement and intelligence analyst.

Police are searching for and scouring countless hours of video footage in hopes of finding more clues, such as whether the suspect met with anyone while in the city.

“It will take them weeks. … They will build out every step of his trip that’s on video,” Miller said. “They will create a movie of his every move.”

While the gunman meticulously planned many parts of his crime and getaway, he might be surprised by “how far the NYPD is going to go in collecting video,” said former NYPD Chief of Department Kenneth Corey.

“And they’re not just going to take it from the crime scene to his escape route,” Corey said. “They’re actually going to rewind now, and they’re going to try to account for all 10 days that he spent in New York City. And I don’t think that he anticipates that.”

Minutes after Thompson was gunned down Wednesday, surveillance video captured the suspect riding an electric bike into colossal Central Park at 6:48 a.m.

Spanning 341 hectares, Central Park is larger than the country of Monaco. “It’s a big park, and it’s complicated terrain,” Miller said.

The suspect apparently left the park within minutes. After reviewing security footage, police believe he may have left the park through the West 77th Street exit – but without the “distinctive gray backpack” seen on the suspect during the shooting.

At 7 a.m., a man resembling the suspect was spotted riding a bicycle on West 85th Street, private surveillance footage shows. Law enforcement told CNN they have reviewed the video and believe it likely shows the gunman.

Some have portrayed the killer as a man enacting vigilante justice against a health care system they say values profits over patients’ lives, which could hinder some people’s motivation to report possible sightings of him.

The evidence suggests the gunman viewed himself as a “Batman-type figure that was seeking justice on behalf of people that he thinks he’s representing,” said Bryanna Fox, a professor of criminology at the University of South Florida.

The words “delay” and “depose” were written on a live round and a shell casing linked to the shooter, law enforcement sources told CNN. Police are investigating whether those words suggest a motive. The words are similar to a popular phrase about the insurance industry: “delay, deny, defend.”

Tens of thousands of social media users mocked the death of the health insurance CEO and showed little sympathy after the killing. A post by UnitedHealthcare’s parent company mourning Thompson’s death received more than 82,000 reactions as of Friday; 76,000 of them were laughing emojis.

An image of the suspect with his mask down – captured during a flirtatious moment with a hostel employee – is the best photo yet to help identify the suspect, authorities said.

But contrary to popular belief, facial recognition software doesn’t always link a suspect’s face and identity, said Donnie Scott, CEO of IDEMIA Group, which specializes in facial recognition technology.

“Most Americans may believe that law enforcement has images on everybody in the United States. That’s very much not true,” he said.

“If he happens to not be a resident of New York who happens to not have been arrested before, odds are he’s not going to be in their criminal database or their mugshot repository,” Scott said.

“So what’s likely happening across all law enforcement is they’re looking for this image in their local systems to see if this perpetrator exists in their galleries.”

Some believe police can just cross-check a suspect’s face with driver’s license photos from the Department of Motor Vehicles. But the reality is not that simple.

“It’s a legal permissioning process. The state of New York does not have access to the DMV database for law enforcement purposes by statute,” Scott said. “It requires cooperation and information sharing and a reason and willingness by the respective agencies to be allowed to share that by law.”

Facial recognition technology should not be used alone to identify a suspect, Scott said.

“Our job is really to make law enforcement’s job easier. If you think about the real basis and use of facial recognition technologies, it’s to sift through the millions and millions of images to get it down to a small, small subset that the expert can use to make the identification,” he said.

“Face is not a fingerprint. It’s not DNA. It’s not used for (an) affirmative match. It’s used to get to a small enough number where that expert can say, ‘Yes, I believe we have an investigative lead here. What other evidence may we have that can match this person to the crime?'”

Police are investigating a phone found in an alley the suspect ran through. But extracting data from a phone can be extremely difficult, depending on the model of the phone and the operating system.

“This is something that law enforcement at every level has been struggling with for the last 10 years … and that’s because of the ubiquity of end-to-end encryption and these incredibly secure kind of locking programs that we have on most phones,” said former FBI Deputy Director Andrew McCabe.

During his time in the FBI, he recalled, “When we would take in an iPhone on a significant case, whether or not we could get into it had to do not only with the model of phone that it was, but also the specific iOS version that it was running.”

For example, “you might be able to get into an iPhone 7 running iOS whatever, but you couldn’t get into one if it was running a different iOS,” McCabe said. “It’s a very complex matrix of hardware and software, and that’s kind of what determines whether or not law enforcement has the capability to get past that locking mechanism.”

Even if authorities can “open up the phone,” he said, the technical challenges might not be over.

“Once you get into the phone, then you’re dealing with the problem of encrypted content,” McCabe said. “Some users are not as disciplined, and they keep things like text messages and those sort of records on their phones, so you can read it off the device. But others are better at having messages expire and automatically deleted.”

Detectives have recovered possible DNA evidence from the abandoned cell phone and from a water bottle they believe the suspect may have sipped from. The potential DNA evidence was turned over to a lab for testing, a senior law enforcement official told Miller.

But the presence of DNA data might not be enough to identify the suspect.

If the suspect committed a crime previously and had his DNA entered into a law enforcement database, it may be easier to identify him. But if the suspect had a previously clean record, identifying him through DNA becomes harder.

“If they’re able to pull DNA … but there’s no match to those DNA (samples), it’s going to be very difficult,” said Callahan Walsh, co-host of “America’s Most Wanted.”

There’s a chance the suspect could be isolated using genetic genealogy, if one of his relatives entered their DNA data into a public database.

“They can bring in familial DNA, but that takes a little bit longer to process,” Walsh said. “There also has to be a match in a database somewhere from one of his family members.”

Even though the suspect may have left New York, the NYPD will keep searching for clues, Commissioner Jessica Tisch said.

“We are right now processing a tremendous amount of evidence in this case,” Tisch said Friday.

“We already have lots of forensic evidence, fingerprints, DNA evidence,” plus a “massive camera canvass” of the suspected shooter’s movements through the city, she said.

But despite the plethora of evidence, finding the suspect is an arduous task, McCabe said.

“It’s far more complicated than it seems from the outside.”

__

CNN’s Mark Morales, Shimon Prokupecz, Tami Luhby, Claire Duffy, Elise Hammond, Erin Burnett, Brynn Gingras and Courtney Fennell contributed to this report.