ALTOONA, Pa. (AP) — After UnitedHealthcare’s CEO was gunned down on a New York sidewalk, police searched for the masked gunman with dogs, drones and scuba divers. Officers used the city’s muscular surveillance system. Investigators analyzed DNA samples, fingerprints and internet addresses. Police went door-to-door looking for witnesses.

When an arrest came five days later, those sprawling investigative efforts shared credit with an alert civilian’s instincts. A Pennsylvania McDonald’s customer noticed another patron who resembled the man in the oblique security-camera photos that New York police had publicized.

Luigi Nicholas Mangione, a 26-year-old Ivy League graduate from a prominent Maryland real estate family, was arrested Monday in the killing of Brian Thompson, who headed one of the United States’ largest medical insurance companies.

He remained jailed in Pennsylvania, where he was initially charged with possession of an unlicensed firearm, forgery and providing false identification to police. By late evening, prosecutors in Manhattan had added a charge of murder, according to an online court docket. He’s expected to be extradited to New York eventually.

It’s unclear whether Mangione has an attorney who can comment on the allegations. Asked at Monday’s arraignment whether he needed a public defender, Mangione asked whether he could “answer that at a future date.”

Mangione was arrested in Altoona, Pennsylvania, after the McDonald’s customer recognized him and notified an employee, authorities said. Police in Altoona, about 233 miles (375 kilometers) west of New York City, were soon summoned.

They arrived to find Mangione sitting at a table in the back of the restaurant, wearing a blue medical mask and looking at a laptop, according to a Pennsylvania police criminal complaint.

He initially gave them a fake ID, but when an officer asked Mangione whether he’d been to New York recently, he “became quiet and started to shake,” the complaint says.

When he pulled his mask down at officers’ request, “we knew that was our guy,” rookie Officer Tyler Frye said at a news conference in Hollidaysburg.

New York Police Commissioner Jessica Tisch said at a Manhattan news conference that Mangione was carrying a gun like the one used to kill Thompson and the same fake ID the shooter had used to check into a New York hostel, along with a passport and other fraudulent IDs.

NYPD Chief of Detectives Joseph Kenny said Mangione also had a three-page, handwritten document that shows “some ill will toward corporate America.”

A law enforcement official who wasn’t authorized to discuss the investigation publicly and spoke with The Associated Press on condition of anonymity said the document included a line in which Mangione claimed to have acted alone.

“To the Feds, I’ll keep this short, because I do respect what you do for our country. To save you a lengthy investigation, I state plainly that I wasn’t working with anyone,” the document said, according to the official.

It also had a line that said, “I do apologize for any strife or traumas but it had to be done. Frankly, these parasites simply had it coming.”

Pennsylvania prosecutor Peter Weeks said in court that Mangione was found with a passport and $10,000 in cash — $2,000 of it in foreign currency. Mangione disputed the amount.

Thompson, 50, was killed last Wednesday as he walked alone to a midtown Manhattan hotel for an investor conference. Police quickly came to see the shooting as a targeted attack by a gunman who appeared to wait for Thompson, came up behind him and fired a 9 mm pistol.

Investigators have said “delay,” “deny” and “depose” were written on ammunition found near Thompson’s body. The words mimic a phrase used to criticize the insurance industry.

From surveillance video, New York investigators gathered that the shooter fled by bike into Central Park, emerged, then took a taxi to a northern Manhattan bus terminal.

Once in Pennsylvania, he went from Philadelphia to Pittsburgh, “trying to stay low-profile” by avoiding cameras, Pennsylvania State Police Lt. Col. George Bivens said.

A grandson of a wealthy, self-made real estate developer and philanthropist, Mangione is a cousin of a current Maryland state legislator. Mangione was valedictorian at his elite Baltimore prep school, where his 2016 graduation speech lauded his classmates’ “incredible courage to explore the unknown and try new things.”

He went on to earn undergraduate and graduate degrees in computer science in 2020 from the University of Pennsylvania, a spokesperson said.

“Our family is shocked and devastated by Luigi’s arrest,” Mangione’s family said in a statement posted on social media late Monday by his cousin, Maryland lawmaker Nino Mangione. “We offer our prayers to the family of Brian Thompson and we ask people to pray for all involved.”

Luigi Nicholas Mangione worked for a time for the car-buying website TrueCar and left in 2023, CEO Jantoon Reigersman said by email.

From January to June 2022, Mangione lived at Surfbreak, a “co-living” space at the edge of Honolulu tourist mecca Waikiki.

Like other residents of the shared penthouse catering to remote workers, Mangione underwent a background check, said Josiah Ryan, a spokesperson for owner and founder R.J. Martin.

“Luigi was just widely considered to be a great guy. There were no complaints,” Ryan said. “There was no sign that might point to these alleged crimes they’re saying he committed.”

At Surfbreak, Martin learned Mangione had severe back pain from childhood that interfered with many aspects of his life, from surfing to romance, Ryan said.

“He went surfing with R.J. once but it didn’t work out because of his back,” Ryan said, but noted that Mangione and Martin often went together to a rock-climbing gym.

Mangione left Surfbreak to get surgery on the mainland, Ryan said, then later returned to Honolulu and rented an apartment.

Martin stopped hearing from Mangione six months to a year ago.

Although the gunman obscured his face during the shooting, he left a trail of evidence in New York, including a backpack he ditched in Central Park, a cellphone found in a pedestrian plaza, a water bottle and a protein bar wrapper.

In the days after the shooting, the NYPD collected hundreds of hours of surveillance video and released multiple clips and still images in hopes of enlisting the public’s eyes to help find a suspect.

“This combination of old-school detective work and new-age technology is what led to this result today,” Tisch said at the New York news conference.

___

Scolforo reported from Altoona and Hollidaysburg, Pennsylvania. Contributing were Associated Press writers Cedar Attanasio and Jennifer Peltz in New York; Michael Rubinkam and Maryclaire Dale in Pennsylvania; Lea Skene in Baltimore and Jennifer Sinco Kelleher in Honolulu.