but one thing i'm ticked off more then anything else is
its a hotel, were are the camera's
The chlorine container was stashed in one of the stairwells of the hotel. While it wasn't unmaintained by any stretch, the stairwells at the hotel were primarily there as fire escape routes. They only saw a degree of use that weekend because of the high demand for elevators at the con; I imagine that for most of the hotel's year of service, the stairwells don't see as much use as they get during conventions. Since the stairwells are areas of the hotel where most criminal acts are unlikely to take place (and where most criminals are unlikely to flee), it doesn't surprise me that camera coverage in there was lacking.
It's possible that the hotel might change their policy on that in light of recent events.
why havent they found the culprit yet 
I'm also curious as to who the culprit is. Having said that, I can appreciate the mammoth scale of the ordeal that investigators have on their plates.
The convention had around 4,600 officially registered attendees; this number does not include those who might have been ghosting the con (or rather, attending the con without paying for registration). There was also an entire hotel's worth of staff there, and there were also several nearby hotels in which the perpetrator may have been housed. The perpetrator, from the standpoint of an investigator that had just begun their task, could have been
any one of these people. While they'd have the atypical luxury of having a list of registered attendees as a starting point, they wouldn't be able to rely entirely on it; again, it's entirely possible that the perpetrator never registered as an attendee. They'd have to sift through that entire population to figure out who they thought might have been motivated and able to release the chlorine, while adding on anybody that they come to discover was there through what they learn in their investigations. They'd then have to start narrowing down that list by getting and then verifying alibis.
Unfortunately, they only had Sunday to perform whatever investigation they wanted to do before the attendees left. I imagine that they had to perform an overnight cram session on furry culture in the handful of hours that they had before the next day's events in order to be able to blend in while asking people questions (if they were undercover) and be fluent in dialogue with conventiongoers (even if they weren't). Even during Sunday's programming, convention attendees were probably leaving over the course of the day, and by sometime after noon on Monday, the hotel would be entirely cleared of attendees. If they were to want to interview anybody after that, they'd have to hunt them down. While the hotel has the names of their guests and the con has the names of registered attendees, this would still be problematic; the con drew people from a wide variety of states as well as from overseas, and the individuals who were together at the con are now spread out once again around the world. Moreover, if the perpetrator was a ghoster who didn't stay at a con hotel, the investigators would need to figure out another way to locate them.
I don't know exactly how much evidence the investigation has (even presuming that there's been a statement on the subject, it wouldn't surprise me if they kept the forensics' awareness of specific evidence secret in order to trip up the perpetrator). If they have enough evidence to know that they can successfully attribute someone to the crime once they've been found (for instance, if they have a fingerprint or DNA), then they're probably good once they've honed in on the perpetrator with enough evidence for a warrant. If they don't have quite that amount of evidence, they'd have to seek out potential evidence of the crime as they continue to investigate their suspect pool. They'd have to sift through subpoenaed financial records and online communication logs in hopes of being able to find something that would successfully attribute someone with this crime. If they're not able to do that, then they wouldn't be able to arrest the perpetrator, even if they did manage to identify and find them.
The TL;DR of this is that the whole process is likely to take a
*LOOOT* of time. I suspect that it will probably take at least several months, and it's only been two weeks since the con so far. The wait is frustrating, but the investigation is by no means a small task. It's almost certainly going to be a while before we know more.
