The button on his pants. Is it a suspender button?
If so, is it common to have suspender buttons on the outside with also belt loops?
It's might just be a waistband button from an extended tab closure (not sure what the proper tailoring terminology is) peeking out above the belt?
It's sloppiness like that that should have alerted security services to him...