ALEXANDRIA, Virginia - The moments after a violent attack like Wednesday's shooting at a Virginia baseball field left a community in shock.
“I can't believe that somebody from here can do something like that,” said Gary Aye, who lives in Belleville, Illinois where shooter James T. Hodgkinson is from.
Family and friends of attackers like Hodgkinson, are often stunned as well. But, sometimes, they look back and the pieces fall into place.
"I don't know his politics, but I can see how he's pretty well fed up with some of this stuff,” said Hodgkinson's friend Dale, who only gave a first name.
But Hodgkinson's Facebook friends did know his politics. In the hours after the shooting, thousands of people who flocked to his page and found a flurry of political posts - largely anti-Trump sentiments. His page has since been removed.
The Washington Post reported that Hodgkinson made multiple angry calls to the office of his local lawmaker, Illinois Rep. Mike Bost.
But, there were no specific or violent threats in his posts or those calls- just anger. That makes his words almost indistinguishable from the myriad of posts Facebook users see daily from friends or family frustrated with politicians or ideologies of all kinds.
The Department of Homeland Security asks citizens to say something, if they see something. But how do they know when they've seen something?
Sometimes, posts will be threatening or violent. The man who stabbed three people, killing two of them, on a Portland, Oregon commuter train just a few weeks ago had posted inflammatory and threatening remarks on his page. That page has also been removed.
But others, like Hodgkinson's, won't be- which is why DHS recommends keeping an eye out for other behaviors that could indicate an issue.
Hodgkinson's Facebook posts could be considered yellow flags. His actions leading up the the shooting.. Red flags.
The 66-year-old packed up and left his home in Belleville, Illinois abruptly in March, to move to Alexandria, Virginia. He was reportedly not working, living out of his car and a gym bag. A former mayor of Alexandria told ABC News that Hodgkinson frequented the YMCA near the baseball field where the shooting took place.
The DHS website points to those as being in line with their list of suspicious activities: Prolonged observation of a building or facility, consistent loitering, or a sudden change in behavior, like a move from Illinois to Virginia.
As major attacks usually do, the events in Alexandria on Wednesday morning has sparked discussions about political divisiveness and mental health.
It's important to note that investigators have not confirmed what Hodgkinson's motive or what his mental state was.
It's also important to note that the list provided by the DHS is not all-inclusive. There is no single profile for mass attackers. The list also includes some behaviors that are inherently innocent. DHS says that determination is up to authorities and ask that any suspicious behavior be called in to local law enforcement.