Shell casings found at the scene where the UnitedHealthcare CEO was shot dead by a masked gunman in front of a busy New York City hotel had “deny,” “defend” and “depose” written on them, a senior New York City law enforcement official briefed on the investigation confirmed to NBC News on Thursday.
Brian Thompson, 50, was killed in a “premeditated, preplanned targeted attack” outside the New York Hilton Midtown in the heart of Manhattan, police said.
Police say they don’t yet know the motive of the gunman, who remains still at large.
Thompson’s family said in a statement they are "shattered to hear about the senseless killing of our beloved Brian."
"Brian was an incredibly loving, generous, talented man who truly lived life to the fullest and touched so many lives," the family said in a statement obtained by NBC affiliate KARE of Minneapolis.
The family requested "complete privacy."
Investigators believe the shooter may have traveled to New York City from Atlanta last month by bus, three senior law enforcement officials familiar with the case told NBC News.
Officials are working to see whether they can find a name from the tickets purchased for a Nov. 24 Greyhound trip that might help identify the gunman. Greyhound said it is cooperating with authorities on the investigation.
Police are also looking into whether the gunman paid in cash and used a fake ID to rent a room at a hostel on the Upper West Side of Manhattan, according to two law enforcement officials briefed on the investigation.
ABC News was the first to report the words written on the bullet casings.
Thompson did not travel with any personal security detail despite known threats against him.
“There had been some threats,” Thompson’s wife, Paulette Thompson, told NBC News on Wednesday. “Basically, I don’t know, a lack of coverage? I don’t know details. I just know that he said there were some people that had been threatening him.”
Security video showed Thompson, dressed in a blue suit, walking down the street. The gunman approached him from behind and opened fire, it showed. Thompson stumbled forward as a witness ran to safety. The gunman continued to fire as Thompson fell to the ground, the video showed.
Thompson was pronounced dead at Mount Sinai West.
“The motive for this murder is currently unknown, but based on the evidence we have so far, it does appear the victim was specifically targeted,” Chief of Detectives Joseph Kenny said Wednesday. “But at this point, we do not know why.”
Before the shooting, the gunman bought a water bottle and two protein bars from a nearby Starbucks and discarded the items, according to a senior New York City law enforcement official briefed on the investigation.
Investigators recovered a video showing where the man discarded the items, and police collected them as evidence, hoping it could aid in the investigation, the official said.
Former FBI supervisor Rob D’Amico said Wednesday that Thompson’s slaying has all the makings of a personal vendetta tied to the victim’s company.
Anyone would have been able to find the whereabouts of the high-ranking business figure with a few quick Google searches, according to D’Amico. UnitedHealthcare’s website listed an investor conference set for Wednesday, but it did not mention a location.
“Even a layman can find there’s so much on the internet now and people put so much out there,” said D’Amico, now a security consultant.
No current or former executives of UnitedHealth Group receive regular company-funded personal security service, according to the insurance giant’s two most recent proxy statements. Companies have to report security expenses for directors or corporate officers if the value exceeds $10,000 per year.
Two of UnitedHealthcare’s peers, Humana and Cigna, both said in their most recent proxy statements that they provide personal security to executives. SEC records, though, did not disclose which executives received this protection or how much was being spent.
CVS Health, another major player in health insurance, requires its CEO to use corporate aircraft and a corporate driver as part of a disclosed “executive security program,” according to regulatory filings.