It’s all hands on deck across U.S. intelligence agencies, as investigators scramble to chase leads, find clues, and establish a character profile for the serial bomber who sent explosive devices to at least eight high-ranking officials and celebrities in the space of 72 hours. But experts say the bomber, so far elusive, left a number of key clues behind.

So far nobody has been hurt by the explosive devices, but intelligence experts say the devices are still dangerous and that serial bombers tend to be, by nature, calculated, attention-seeking, and very unpredictable.

Authorities have intercepted 10 bombs so far, targeting eight people, all of whom are outspoken critics of Donald Trump’s presidency or frequent targets of right-wing conspiracy theories: billionaire philanthropist George Soros, the Clintons, Barack Obama, former Attorney General Eric Holder, former CIA Director John Brennan (sent via CNN), and actor Robert De Niro. Rep. Maxine Waters and former Vice President Joe Biden were each sent two bombs.

According to the FBI, the packages were all delivered in manila envelopes with a bubble-wrap interior and had computer-printed address labels. They also featured the misspelled return address of Democratic Congresswoman Debbie Wasserman Schultz, who formerly headed the Democratic National Committee. All of the envelopes had six American flag stamps, though not all were sent by mail, and at least one, dropped off at CNN's New York headquarters, contained a separate package of white powder, which was later cleared as an inert substance.

Authorities say some of the packages appeared to have gone though the mail system at some point. But the packages that arrived in CNN’s mailroom and De Niro's restaurant Tribeca Grill were reportedly dropped off by a courier; another was placed directly in Soros’ mailbox. This pattern is helpful to investigators, said former FBI assistant director Ron Hosko, who said that if he were investigating the case, he might start with the package left in Soros’ mailbox.

“In Soros’ neighborhood, which I’m assuming is wealthy, there are probably security cameras,” Hosko said. “Perhaps there are also cameras or sensors at other locations that could be exploited to take the delivery back to the point of origin, whether that’s FedEx, or the post office.”

Many of the bombs were dropped around the New York area, though Reuters reports law enforcement sources are currently focusing on leads in Florida.

Based on a photo of the device sent to the CNN offices, experts say that the bombs are crude but probably functional, and appear to be the handiwork of an amateur. The devices were all pipe bombs, about six-inches long, containing some combination of powder, wires, a battery — and in the case of CNN, glass shrapnel. But despite containing all the right ingredients, none have detonated.

Some of the devices also featured a sticker of a parody ISIS flag with the catchphrase “Git-R-Dun,” a meme created by stand-up comedian “Larry the Cable Guy.”

“They clearly wanted the stickers to be seen,” said Scott Stewart, a former U.S. State Department special agent who now supervises terrorism and security issues for Stratfor, a global intelligence firm. “It does seem to me this is about creating panic and terror, not necessarily hurting or killing someone.”

Stewart added that it’s not unusual for a serial bomber to add a personal embellishment like a sticker. For example, the Unabomber, who bombed 16 targets over a 17-year period, stamped his devices with “FC,” which stood for “Freedom Club.”

Experts say it is unusual, however, that a package bomb would use a timer as a detonation device. Package bombs tend to use a booby-trap detonation technique, meaning the act of opening the envelope can serve as the trigger for the device to explode.

“These seem like they want to be discovered,” Stewart said. “It’s not clear what date and time, if any, those timers were set for.”

As multiple government agencies focus in on the packages, investigators will be working quickly to collect evidence, do forensics, and establish a character profile of the perpetrator.

Jeff Danik, former FBI special agent, said that his priority lead would be DNA matching.

“The chance of DNA being found is high,” said Danik. “There are too many device components and envelopes to have zero DNA.”

If investigators can find a DNA sample, they’ll run it against their existing database of DNA samples, known as the “CODIS”, the Combined DNA Index System, which is a national database maintained by the FBI that allows state, local, and federal law enforcement agencies to share DNA information. Investigators can also access databases kept by companies like AncestryDNA, which people use to determine their genealogy (which was how authorities finally caught the Golden State serial killer.

The FBI also has behavioral scientists who take information like the devices’ construction and when they were delivered to establish a suspect’s profile. Joseph Campbell, a former FBI agent who previously investigated package bombing cases, says that these types of events tend to be all-hands-on-deck across agencies.

“There’s a message sent out to law enforcement saying check all your sources and contacts,” said Campbell, who now is a director of global investigations and compliance at Navigant Consulting. “To see if anyone has seen anything or knows of someone who could know something. That could mean everything from confidential informants in hate groups, gangs, or terrorist networks, to local police officers, in the U.S. and abroad.

“It’s a full court press to try to find this person,” Campbell said. “It’s about trying to tap every possible source of intelligence.”

Experts caution, however, that while having a sense of the suspect’s motivation is helpful, it’s not the bottom line.

“I’m thinking it’s probably an angry sender, likely from the political far right. These recipients are left of center, depending on how you view John Brennan,” said Hosko. “That much is obvious. But from a law enforcement perspective, I’m not identifying based on the obvious. I need details, facts.”

Hosko said that being able to draw a line from point A to point B may lead an investigator to potential witnesses along the way. “You might have a guy who suddenly thinks ‘gee, I sold a bunch of black piping and electrical tape to a guy who was acting kind of strange’,” Hosko said. “Or, you go to Home Depot, which has a recording of transactions. You could get the credit card details of a guy who came in and bought eight foot of black tape and piping.”

The biggest concern is that the bomber could adjust or escalate tactics to catch law enforcement off-guard, which was the case during the string of bombings that rattled Austin earlier this year that left two dead and five injured.

The bomber, Mark Anthony Conditt, started by leaving package bombs on people’s doorsteps, and then switched up tactics to send his packages through Fed-Ex facilities. He also set a tripwire bomb.

“There are probably other devices out there in the wild,” said Stewart. “It’s possible that the bomb maker could revamp and go in for a second batch that could use a different design and style.”

Campbell said that for the investigators on the case, the worst thing they can do right now is become complacent.

“In this case we have ten devices. As far as we know, none of them have functioned. Maybe they were never intended to function, or they might have failed due to the incompetence of the perpetrator,” said Campbell. “But that doesn’t mean that he or she not might escalate this at some point and send a device that could function, which could hurt someone or worse. You have to assume the worst can happen.”