From some of the comments on TV about this, and descriptions of what the FBI had to show, I gather that they had the white cap guy first (seen on Lord & Taylor camera) and it was later when they found images of the two walking through the crowds on the sidewalk together is when they put him together with the guy in the black cap. Just my take on it.I agree, white cap looks extremely at ease to a point where it may bring them both down.
Folks need to also remember they also have white cap on video leaving the area after the explosion, we just didn't see it. That probably nailed it for them.
I wonder what they have on the black cap guy that solidifies for them that he is involved.