 They saw the shooter acting suspiciously. They took a picture of him. They watched him pull out a range finder and take measurements and then disappear. Wouldn't the correct protocol to make sure that the president doesn't go on stage at that point until you find that guy?