Investigators looking into the series of bombs sent to prominent Democrats, Trump critics and to CNN will use clues from the construction of the devices and the packages as they put together a picture of the perpetrator, experts say.
Among other things, they are trying to figure out how much the person knew about making bombs, whether they wanted to get caught, and whether the perpetrator made mistakes to give away their intent.
They also want to know who, if anyone, helped the person.
At least one expert isn't convinced the bombmaker was trying to hurt someone with the 10 devices that have been found so far.
"Whoever is doing this is just trying to elicit a fear or disrupt something," said Ryan Morris, founder of Tripwire Operations Group. "There are a multitude of more sophisticated methodologies that would have worked if they really wanted this to work."
The design was so basic, it seems like the person or persons might want to be caught, said James Gagliano, a CNN law enforcement analyst and a retired FBI supervisory special agent. The excessive tape and stamps are a telltale sign of a suspicious package, he said.
"It just doesn't look like the signature of an experienced bombmaker, somebody that knew what they were doing," he said of the device found at CNN.
The packages, including the ones addressed to former Secretary of State Hillary Clinton, former CIA Director John Brennan and former President Barack Obama, had a return address of "DEBBIE WASSERMAN SHULTZ" in Florida. The Democratic congresswoman's last name was spelled incorrectly, the FBI said. Some packages also misspelled "Florida."
Former senior FBI profiler Mary Ellen O'Toole said she would be careful about characterizing misspellings or mistakes as carelessness by the perpetrator, who appears well-versed in politics.
"It may be very intentional because it does look like he's planned this out very well," she said.
She said investigators will look to see whether the person's disdain for the people they sent packages to manifested in social media posts or letters about their politics sent by mail.
Excess postage, tape or binding, and poorly written and misspelled words are some of the signs the US Postal Service and government agencies use to detect suspicious packages.
"There are too many ways in which it could get detected prior to getting to its destination. If you're a bombmaker, you want to take it there, drop it off and leave, like in the Boston bombing," Morris said, referring to the deadly 2013 Boston Marathon blasts.
Images of two devices -- one found Monday at the home of Soros and one sent Wednesday to CNN's New York office -- appear to show a real device that could cause serious bodily injury or death, he said
The device discovered at the Bedford, New York, home of Soros, a Democratic donor who is the subject of right-wing conspiracy theories, was placed in the mailbox rather than sent through the mail, according to a separate law enforcement source.
The packages mailed Wednesday were in manila envelopes with bubble-wrap lining, the FBI said. They bore computer-printed address labels and six stamps.
The Secret Service intercepted packages intended for Obama's Washington office and Clinton's home in Chappaqua, north of New York City.
The package sent to CNN's office in the Time Warner Center was delivered by courier, law enforcement sources said. It was addressed to Brennan.
In addition, authorities also intercepted or retrieved two packages intended for US Rep. Maxine Waters, a California Democrat, and two for former Vice President Joe Biden. Other packages were sent to actor Robert De Niro and former Attorney General Eric Holder.
Devices were rudimentary but functional
The FBI's counterterrorism investigators are leading the investigation into the devices and are operating under the assumption that the packages represent a domestic terror matter, according to a law enforcement official.
The packages could have prematurely detonated in the mail or with the courier, said Morris, a former bomb squad commander for the Penn State University police who is not involved in the investigation into the packages.
Morris said he was able to create a device similar to the one sent to CNN in about 10 minutes. He used a similar timer that could be bought on Amazon for about $9. The device had red and black wires, and the bombmaker didn't go to great lengths to disguise it, Morris said.
"A bombmaker is going to fashion a container for the bomb to disguise it in such a way that it's not readily found," he said.
One of investigators' first orders of business, according to former FBI agent Raymond Lopez, will be to determine the similarities between the packages and devices and to nail down who manufactures and sells the various components, then begin generating leads based on that information.
It's unlikely a perpetrator pulled this off without any help, said Juliette Kayyem, a CNN national security analyst and a former assistant secretary at the Department of Homeland Security.
"Someone knows. There is no question in my mind, as we see with most of these cases, that there is an enterprise, a community around this person or people, who have some inkling, who sold something, who heard him say something, who may actually know of the plan and now feel guilty about it," Kayyem told CNN.