CourtNews
Historic Investigations

Unabomber: The Family Tip Behind the FBI's 17-Year Hunt

Follow the Unabomber investigation from its first attacks to the family tip, writing analysis and Montana evidence that led to Ted Kaczynski's guilty plea.

FBI evidence photograph of Ted Kaczynski's fenced-off Montana cabin after his April 1996 arrest
Kaczynski's cabin near Lincoln, Montana, after his April 1996 arrest. The fence was erected to protect the site. FBI evidence photograph / Wikimedia Commons. Public domain (U.S.).

For years, investigators could describe the Unabomber's crimes more easily than they could identify the man behind them. Packages and devices had injured strangers across the country. Three people were dead. The decisive lead eventually came from a family willing to ask whether the writer of a public manifesto was someone they knew. [1][3]

This reconstruction follows the investigation from the first parcel to the Montana search and the federal prosecution. It draws on archival accounts and case records; it does not claim new interviews or previously undisclosed evidence.

A package that did not belong

The first lead was a parcel with a misleading return address. Found at the University of Illinois Chicago campus on May 25, 1978, it was taken to Northwestern University because it appeared to have come from a professor there. The professor had not sent it. A campus security officer was injured when the package was opened. The distinction matters: the parcel was discovered at one university and exploded at another. [1][4]

A second Northwestern attack injured a graduate student in May 1979. That November, American Airlines Flight 444 filled with smoke after a device in its luggage compartment activated. The aircraft landed safely. An apparently local campus mystery had become a threat to people who had no reason to think they were part of anyone's grievance. [1][4]

The investigation eventually carried the identifier UNABOM, associated with university and airline bombing targets. But a case name was not an identity. Investigators still had to work out whether events separated by months, locations and victims belonged to a single campaign. [1]

A national task force, but no name

The FBI-led task force brought together the Bureau of Alcohol, Tobacco and Firearms and the U.S. Postal Inspection Service in 1979. Over time, more than 150 investigators, analysts and other personnel worked on the case full time. They examined fragments, traced victims' backgrounds and tried to reconstruct the bomber's movements. [1]

That work repeatedly ran into the same obstacle: evidence of a crime was not necessarily evidence of its author's identity. Components assembled from commonly available materials offered few straightforward purchase trails. Studying the victims also failed to reveal the kind of shared personal relationship that might point to a known enemy. [1]

The task force was not simply waiting for a breakthrough. Records described by the National Archives show separate squads pursuing suspects and revisiting earlier attacks. New facts could send investigators back through an old incident, testing a theory against records rather than treating a profile as a settled answer. [5]

The people behind the case numbers

The campaign became fatal in December 1985, when a bomb killed Sacramento computer-store owner Hugh Scrutton. Advertising executive Thomas Mosser was killed at his New Jersey home on December 10, 1994. On April 24, 1995, California Forestry Association president Gilbert Murray died after a package exploded at the organization's Sacramento office. The parcel had been addressed to his predecessor. [4]

The attacks injured people as well as killing them. University staff, researchers, an airline executive and others were caught in a campaign whose logic was imposed on them by the attacker. The FBI's shrapnel history records three deaths and 24 injuries. Those figures describe the reported toll; they cannot capture the lasting cost to survivors and families. [3]

These were not simply steps in a puzzle that ended neatly with an arrest. Each new attack meant another person or family had paid for the bomber's ability to remain unidentified. Any account of the investigation needs to keep that human cost alongside the story of how it was solved.

An eyewitness and the limits of a likeness

A February 1987 bombing at a Salt Lake City computer business produced an unusual opening: someone had seen a man leaving the device. The resulting description helped produce the familiar sketch of a man wearing a hood and sunglasses. Shrapnel preserved by the FBI from that attack also carried the letters FC, an identifying mark associated with the bomber. [3]

A witness description gave investigators something to circulate, but it did not supply a name. The distinction between a useful lead and proof remained central throughout the case. A person could resemble the drawing, share an interest or have lived in a relevant city without being responsible for the attacks.

After a long gap, bombings resumed in 1993. The pause had not resolved the case, and the return of violence showed why an absence of attacks could not be treated as proof that the threat had ended. [4]

1995: publication becomes an investigative gamble

The bomber's demand for publication changed the kind of evidence available. His approximately 35,000-word essay, Industrial Society and Its Future, set out his hostility to industrial and technological society. He offered to stop killing if a major newspaper printed it. [4]

For authorities and editors, publication posed a difficult choice. It would distribute the words of someone using violence to obtain attention. It could also expose his language to a reader who knew him. FBI Director Louis Freeh and Attorney General Janet Reno supported the task force's recommendation to publish. The Washington Post printed the text on September 19, 1995. [1][4]

Investigators had already been studying the bomber's correspondence. In the FBI's later account, agent Kathleen Puckett described letters as clues to his reading, beliefs and background. A public text offered a much larger opportunity: people outside law enforcement might recognize what a stranger's forensic examination could not. [2]

The family tip that investigators could test

Linda Patrik, the wife of David Kaczynski, recognized ideas in the writings and urged her husband to consider whether his brother Ted could be responsible. David then supplied letters and other material to investigators. The FBI's account gives Patrik a significant role; reducing the breakthrough to a lone brother's sudden realization leaves her out. [3]

Through a lawyer, David provided a 23-page essay Ted had written in 1971. Investigators compared its language with the published manifesto. Repeated expressions, spelling choices and ways of arguing became points of comparison. The earlier document gave the task force something more useful than an impression: writing linked to a named person, produced years before publication of the manifesto. [2]

Turning suspicion toward a relative is a different act from recognizing a stranger in a public notice. The family provided evidence that could expose Ted to prosecution. The significance of their decision is clear without inventing conversations, private thoughts or scenes that the records do not establish.

From a linguistic lead to a search warrant

The writing comparison did not work in isolation. Investigators checked Kaczynski's history against the case, including his ties to Chicago and Berkeley and his time in Salt Lake City. Language similarities and biographical facts together helped establish the basis for a warrant to search his Montana cabin. [1][2]

The National Archives' account of lead prosecutor Robert Cleary's files adds a useful corrective to the familiar breakthrough narrative. Cleary emphasized the painstaking work required to develop probable cause. The family essay entered a case already crowded with tips; investigators had to determine why this lead held up when others did not. [5]

That sequence matters. Recognition suggested a suspect. Comparison and corroboration supported a search. What agents recovered then gave prosecutors additional evidence. Treating all three stages as one flash of insight understates the work and overstates what linguistic evidence alone could prove.

April 3, 1996: the search near Lincoln

Government exhibit drawing showing the exterior and estimated dimensions of Kaczynski's cabin
A cabin drawing from the case records, reproduced by the National Archives Foundation. This is an archival exhibit, not a photograph. Source: National Archives Foundation

Federal agents arrested Kaczynski at his cabin near Lincoln, Montana, on April 3, 1996. The small building contained a much larger evidentiary record than its dimensions suggested: materials associated with the devices, extensive personal writings and a completed bomb. [1][6]

The FBI reports approximately 40,000 handwritten journal pages, including accounts of the attacks. These records connected the person under investigation with knowledge of the crimes. They offered a different kind of support from a resemblance between two pieces of writing. [1]

The search itself required care. The FBI's cabin history says agents stopped their work after about 24 hours when they discovered a wrapped bomb under a bed. The threat was therefore not only a historical question. A live device remained inside the place investigators were examining. [6]

The guilty plea and the sentence were separate events

On January 22, 1998, Kaczynski pleaded guilty under an agreement in which federal prosecutors would not seek the death penalty. Cornell's contemporaneous legal update records that agreement and its provision for life imprisonment without parole. The resolution came through a guilty plea, not a jury's verdict after a completed trial. [7]

Sentencing followed on May 4, 1998. The National Archives records four consecutive life terms plus 30 years. Separating the plea date from the sentencing date avoids a common compression of the case into a single January event. [5]

Kaczynski later challenged the conviction; the Ninth Circuit rejected his bid for a new trial in February 2001. He died in federal custody on June 10, 2023. The sentence is part of the historical record, rather than a description of someone still serving time today. [5][8]

What actually brought the investigation to an end

The familiar ending is a family tip. The fuller account is a chain of work: investigators preserved and compared evidence, publication made the bomber's language recognizable, relatives provided authentic writings, and agents tested the lead before searching the cabin. The physical and documentary evidence recovered there strengthened the case that followed. [1][2][5]

The case illustrates both the value and the limits of specialist techniques. A profile can guide attention without identifying a person. Shared language can be persuasive without standing alone. An informant can transform an investigation without replacing the need for corroboration. These are lessons drawn from the sequence of events, not claims that any one method guarantees a solution.

For the families who lost someone and the survivors whose lives were changed, identifying the bomber did not erase the damage. It ended the uncertainty about who had carried out the attacks and made a prosecution possible. That is the achievement to examine, without turning the perpetrator into the hero of the story.

The evidence and what it established

EvidenceInvestigative significance
Fragments and the 1987 witness accountHelped investigators compare attacks and circulate a description, but did not by themselves identify the bomber. [3]
The manifesto and the 1971 essayProvided texts for comparison after the family supplied material linked to Ted Kaczynski. [2]
Residence and employment historyGave investigators facts to check alongside the writing similarities when developing the warrant application. [1]
Cabin records and physical evidenceAdded writings about the crimes and a live device to the evidence available after the search. [1][6]

Editorial note: Historic Investigations is part of CourtNews Investigations. This article reconstructs a historical criminal case from the linked records. It uses the FBI's published injury count of 24. The Mosser bombing date follows Cornell's chronology (December 10, 1994); the FBI overview currently lists a conflicting date. Plea and sentencing dates are presented separately. No dialogue or private thoughts have been invented.

Sources & records

10 sources
  1. 1FBI — Unabomber case historyTask force, search warrant and evidence recovered in April 1996.fbi.gov (opens in a new tab)
  2. 2FBI — The Words of a Killer (2021)Retrospective interviews with investigators; the 1971 essay and linguistic comparisons.fbi.gov (opens in a new tab)
  3. 3FBI — Unabomber Bomb ShrapnelThe FBI's count of three deaths and 24 injuries; the 1987 eyewitness and Linda Patrik's role.fbi.gov (opens in a new tab)
  4. 4Cornell Legal Information Institute — UNABOM chronologyContemporaneous chronology, including the December 10, 1994 Mosser bombing and September 19, 1995 publication.law.cornell.edu (opens in a new tab)
  5. 5National Archives — Files of lead prosecutor Robert J. ClearyTask-force organization, May 4, 1998 sentencing, and the 2001 appeal.text-message.blogs.archives.gov (opens in a new tab)
  6. 6FBI — Unabomber CabinThe search and the discovery of a live device under a bed.fbi.gov (opens in a new tab)
  7. 7Cornell Legal Information Institute — January 1998 plea updateJanuary 22, 1998 guilty plea and agreement that prosecutors would not pursue the death penalty.law.cornell.edu (opens in a new tab)
  8. 8FBI — Kaczynski arrest image recordArrest record, guilty plea and death on June 10, 2023.multimedia.fbi.gov (opens in a new tab)
  9. 9National Archives Foundation — The UNABOMBER: archival documentsScans of cabin drawings, writings, warrants and case records. Used here for the reproduced cabin exhibit.archivesfoundation.org (opens in a new tab)
  10. 10Wikimedia Commons — FBI evidence photograph of the cabinApril 1996 photograph by FBI agents; public domain in the United States.commons.wikimedia.org (opens in a new tab)
TagsUnabomberFBITed KaczynskiHistoric InvestigationsLinguistic Evidence
Michael Grant
Michael Grant

Investigation news Author

Michael Grant is an investigative journalist focusing on corruption, government accountability, corporate misconduct, and data-driven reporting.