New details are emerging about incendiary devices placed in ballot boxes early Monday in Portland and Vancouver, Washington.

At a news conference Wednesday, Portland police released their first description of a suspect. Agency spokesperson Mike Benner said the person is believed to be white male, between 30 and 40 years old, with short hair or balding, a thin-to-medium build, a thin face and wearing a dark shirt.

A ballot drop box in at the Fishers Landing Transit Center in Vancouver was set ablaze early Monday morning, destroying hundreds of ballots.

A ballot drop box in at the Fishers Landing Transit Center in Vancouver was set ablaze early Monday morning, destroying hundreds of ballots.

Erik Neumann / OPB

“We believe this suspect has a wealth of experience in metal fabrication and welding,” Benner said. “It’s very possible the suspect continues targeted attacks across the area.”

Benner said law enforcement believes the same person is connected to both incidents Monday, as well as a third incident that took place on Oct. 8 in Vancouver where the incendiary device did not go off.

Police are searching for a black or dark-colored 2001-2004 Volvo S-60 seen at the site of the Portland fire. The car did not have a front license plate, making it difficult to identify.

The incidents — just days before the 2024 election — have raised concerns about security. Law enforcement, along with businesses and local officials, are preparing for the possibility of unrest, but also urging calm regardless of the outcome.

In September, officials in the U.S. Department of Homeland Security sent an intelligence brief to states warning that during the past six months posts on social media were promoting the destruction of ballot boxes during the 2024 election cycle.

“Election infrastructure remains an attractive target for some domestic violent extremists and other threat actors with election-related grievances who seek to disrupt the democratic process and election operations,” the brief states.

Methods included using road flares, white phosphorus and farm machinery to damage ballot boxes, which the bulletin described as “soft targets” because they’re widely accessible.

“Some social media users recommended masquerading as an ideological opponent and wearing clothes and masks associated with ‘antifa,’” the intelligence bulletin states. It also noted that similar threats occurred during elections in 2020 and 2022, and that “states with more ballot drop boxes may be more at risk.”

Related: Ballot boxes still safe for voting despite arson attacks in Portland and Vancouver, election officials say

Oregon and Washington are primarily vote-by-mail states where voters return their ballots through the mail or drop off locations.

Elections officials in Vancouver have stepped up security of ballot boxes, stressing they’re safe and that ballots dropped off will be picked up earlier in the day.

The damaged ballot boxes in both states were equipped with fire suppression systems that respond to spikes in temperature.

In Portland, those canisters worked. Only three ballots were damaged out of hundreds.

In Vancouver, that system didn’t appear to function, and 488 ballots were damaged. Clark County elections officials said in a release Wednesday that 345 voters have already contacted the elections office to request a replacement ballot. Six ballots were unidentifiable, officials said, and others “may have been completely burned to ash, and therefore, unidentifiable.”

The FBI said in a statement this week it was working with local, state and other federal law enforcement agencies “to actively investigate” the incidents and “determine who is responsible.”

“It’s an extremist act,” said Renn Cannon, former special agent in charge of the FBI in Oregon. “There’s a host of different extremist groups, extremist ideologies under which I can see this fitting where somebody who has bought into that ideology could see this as a logical action.”

During Wednesday’s news conference in Portland, police declined to provide any details about a possible motive for the attacks.

Cannon said investigators will be looking at everything from social media posts, to tips and security footage. The devices themselves are also a key piece of evidence.

“Devices that get built by people sometimes have signatures, and so there’s a database of electronic devices that could be analyzed,” Cannon said, “to see if that matches particular techniques that are known to tie back to a specific person or group.”