Nearly five months after 84-year-old Nancy Guthrie was taken from her Tucson-area home in the dead of night, the ransom notes sent in her name remain one of the few threads investigators can pull. Now two retired FBI officials say the language in those notes amounts to a kind of fingerprint, one that may separate the real abductor from opportunists who piled on after the case made international headlines.
Guthrie, the mother of NBC "Today" show anchor Savannah Guthrie, was believed abducted in the early hours of February 1, 2026. Her pacemaker app stopped communicating with her phone that night, giving investigators an approximate window for when she was removed from her residence. She was reported missing the following day. No arrest has been announced. No body has been recovered. The search, as of the most recent reporting, remains active.
What investigators do have is a stack of ransom notes, at least some sent to media outlets rather than to law enforcement, and a growing body of forensic evidence that has yet to produce a named suspect. The notes vary in tone and content, and that variation is where former FBI officials see an opening.
Retired FBI agent Jason Pack, speaking to Page Six, drew a sharp line between the first two ransom notes and everything that followed. As NewsNation reported, Pack said the early notes contained operational details that had not yet been made public, a fact that, if confirmed, would strongly suggest the author had direct knowledge of the crime.
"The first note apparently contained specific operational details that weren't public at the time. Based on what's been reported, the language and tone of those first two notes compared to everything that came after is where the real analytical work is happening right now."
Pack's point is straightforward: once a missing-persons case draws global attention, hoaxers and attention-seekers send their own notes. The task force's job is to sort signal from noise. If the first two notes read like one person and everything after reads differently, that tells investigators who they are actually dealing with, and who inserted themselves into the story after it blew up.
One of the notes stated that Guthrie was dead and "buried with nature," and that her death was "unintentional." Those words caught the attention of former FBI profiler Ray Carr, who spoke to NewsNation's Brian Entin about the deliberate phrasing.
"The wording is deliberate. I think it is emotionally controlled and I think it focuses on minimizing culpability."
Carr added a pointed observation: if the note was written by the actual offender, then its language is entirely self-serving. It is not about Nancy Guthrie. It is about deflecting blame.
"If this is written by the offender, then this is all about them, and has nothing to do with Nancy."
That qualifier, "if this is written by the offender", matters. Law enforcement has not publicly confirmed the authenticity of any individual note. Carr's analysis, and Pack's, rests on reported details rather than official verification from the task force.
The ransom notes do not exist in a vacuum. The physical evidence and timeline paint a picture of a crime that was planned, not improvised. NBC correspondent Tom Winter proposed that the abductor disconnected Guthrie's doorbell camera at 1:47 a.m. as a calculated test, a way to see whether police would respond before returning to carry out the kidnapping.
Motion was detected outside the home at 2:12 a.m., roughly twenty minutes after the camera went dark. By 2:28 a.m., Guthrie's pacemaker app disconnected from her phone, suggesting she had been removed from the residence. That sequence, disable the camera, wait, then act, suggests planning and patience, not a crime of opportunity.
Blood was found on Guthrie's porch. The FBI released footage of a masked stranger outside her front door. The suspect was described as a male, approximately five feet nine to five feet ten, average build, wearing a black 25-liter Ozark Trail Hiker Pack backpack sold at Walmart. As a former FBI agent previously assessed, the motive appeared to be ransom from the start, a targeted abduction of a high-profile anchor's elderly mother.
Pima County investigators recovered unidentified DNA from Guthrie's property, DNA belonging to someone not known to be in close contact with her, the New York Post reported. Gloves were found approximately one mile from the crime scene. Both pieces of evidence were sent to a Florida lab for analysis.
The handling of that evidence became its own controversy. Pima County Sheriff Chris Nanos pushed back against reports that he had blocked the FBI from accessing key evidence. The Washington Examiner reported that Nanos said the two agencies mutually agreed to send all collected evidence, not just items found closest to the scene, to the Florida lab for DNA profiling.
Nanos framed the decision as common sense: send everything to one lab where all the DNA profiles and markers already exist, rather than splitting evidence between facilities. But the jurisdictional back-and-forth between local and federal investigators has drawn scrutiny throughout the case. FBI Director Kash Patel accused the Pima County sheriff of blocking the bureau from the case for four critical days early in the investigation.
Those early days matter enormously in an abduction. Every hour of delay narrows the window for recovery. The friction between local and federal authorities has raised legitimate questions about whether evidence was processed as quickly as it should have been.
The FBI doubled its reward for information leading to Guthrie's recovery to $100,000, a sign of both the case's seriousness and the bureau's difficulty in generating actionable leads. Meanwhile, the sheriff has pointed to labs and process as the reason the search has dragged past four months without resolution.
A third ransom email, sent to TMZ, claimed that the "main individual" behind the abduction had fled the United States. The sender told the outlet, "Be prepared to go international," and explained that they contacted TMZ rather than law enforcement because "You don't trust me, and I don't trust you."
That note, if genuine, suggests multiple individuals were involved. It also raises the possibility that the person who planned the crime is no longer within reach of American law enforcement, a scenario that would complicate an already stalled investigation.
Two ransom notes were also received by Tucson television station KOLD. Newsmax reported that one demanded millions in Bitcoin and another stated Guthrie had died. The FBI has declined to comment on the specific content of the notes.
Savannah Guthrie made an emotional on-air plea for anyone with information to come forward. "We are in agony, and we cannot be at peace," she said. "We love our mom. We'll never stop looking for her." She added a direct appeal: "Somebody knows something."
The FBI has obtained DNA results from a hair sample collected at the Tucson home, and a cybersecurity firm flagged the abduction as a possible crypto-linked "wrench attack", a physical crime motivated by cryptocurrency holdings. Whether those threads connect to the ransom notes remains an open question.
Pack and Carr are both careful to frame their analysis as informed interpretation, not case-breaking revelation. Neither man is part of the active investigation. Their value lies in explaining what trained analysts look for: word choice, emotional register, the presence or absence of details only the perpetrator would know, and shifts in tone that separate an authentic communication from a copycat.
The core insight is simple. The first two notes may carry a linguistic fingerprint, patterns of syntax, vocabulary, and knowledge that point toward a specific author. Everything that came after the case went international may be noise. The task force's challenge is distinguishing one from the other.
That challenge is made harder by the public nature of the case. Media coverage of high-profile abductions creates a perverse incentive for hoaxers and thrill-seekers to inject themselves into the story. Every false note wastes investigative resources. Every authentic note ignored could cost a life, or, if the notes are to be believed, delay the recovery of remains.
Five months in, an 84-year-old woman is still missing. The people who took her have not been identified. The people who claim to speak for them may or may not be the same individuals. And the agencies tasked with solving the case spent critical early days arguing over jurisdiction and lab protocols.
Somewhere in those ransom notes is a fingerprint. The question is whether anyone in charge moved fast enough to match it.