by and for citizen investigative journalists

How We Found One of the Paris Suicide Bombers on Facebook

November 23, 2015

By Bellingcat

On 16 November, three days after the Paris Attacks, the Bellingcat Investigation Team identified the Facebook profile of one of the assailants, Bilal Hadfi. Here is how we did it.

In the evening of 13 November, six simultaneous terrorist attacks happened in France’s capital city of Paris. One of these happened in the vicinity of the Stade de France during a friendly France-Germany football game. Three suicide bombers detonated themselves outside of the Stadium: one of them is yet to be identified, the second one has been associated with a forged Syrian passport, and the third attacker is Bilal Hadfi.

Bilal Hadfi was a 20-year-old French citizen residing in Belgium. Mr. Hadfi is not reported to have travelled to Syria before early this year (according to his mother, his departure to Syria happened on 15 February 2015). Hadfi detonated his vest at 9:53 p.m. on Rue de la Cokerie, just outside of a McDonald’s restaurant about 300 meters from the Stade de France. The explosion did not cause other casualties than Hadfi himself.

Three days later, the Bellingcat Investigation Team uncovered the Facebook profile of Bilal Hadfi.

Searching for the attackers’ online presence

In the wake of the unprecedented attack and amidst diverse and oft-contradictory reports about the attackers, the Bellingcat Investigation Team started looking for existing social media accounts belonging to the assailants. A Facebook search for the name ‘Bilal Hadfi’ listed five accounts with this name. The first such one had a clearly labelled URL: ‘facebook.com/bilal.hadfi.1’. Each of the five Facebook profiles was carefully examined and archived for pictures, bios and statuses.

One of the ‘bilal.hadfi.1’ connections came out to be ‘Billy du Hood’. His Facebook account looked intriguing: a young male was proudly posting images of an AKMS and of other handguns. ‘Billy du Hood’ thus posted a picture of weapons exhibited on what looks like a table, timestamped 9 December 2013. The origin of this image is unclear, it had already appeared in press in 2010 and September 2013.

‘Billy du Hood’ profile pictures were publicly visible before the Facebook account was shut down; amongst them, we saw this one of an AKMS automatic rifle in what appears as an unidentified indoors location:

hood1

This image is timestamped 1 July 2015. Contrary to the aforementioned press image, this one appears grainy as shot with a mobile phone. Thus, ‘Billy du Hood’ profile shows a growing number of features indicating he is no ordinary youth, along with similarities with what is known about Bilal Hadfi’s area of residence.

At first, we were not sure whether ‘bilal.hadfi.1’ and ‘Billy du Hood’ are friends or are the same person. There were no publicly visible images for the profile ‘bilal.hadfi.1’. Thus, the only image we had from Bilal Hadfi is the one published by Belgian media on 16 November:

bilal1

In an image posted by ‘Billy du Hood’, he captions “With the family” (timestamp: 9 June 2014, original caption “Avec la famille”):

bilal_group

There is clearly a striking resemblance between Bilal Hadfi and ‘Billy du Hood’, so the question was: is really ‘Billy du Hood’ a friend of ‘bilal.hadfi.1’ who is visible together with him on the photograph?

Who is who?

To assess whether ‘bilal.hadfi.1’ and ‘Billy du Hood’ are the same person, we compared the publicly visible pictures of the two young men:

bilal_compare

The faces of the man on the far left (picture from ‘Billy du Hood’ profile images) and the youth on the right image (Bilal Hadfi as identified by media) were strikingly resemblant. Another interesting coincidence is the shirts: both men seem to wear a very similar, striped t-shirt. The quality of the image from ‘Billy du Hood’ Facebook page (on the left) is quite low, yet we proceeded to comparing the shirts:

bilal_shirt

On Bilal Hadfi’s picture published by other media, the t-shirt has three thick dark blue stripes separated by two thinner white stripes. ‘Billy du Hood’ appears to be wearing a t-shirt with an identical pattern. As the image quality is low, we preferred, however, to be cautious about this detail and chose not highlight it as identifying.

Another distinctive sign which is shared by the two individuals is what looks like a birthmark between the two eyebrows, at the top of the nose:

bilal_mark

The dark mark clearly looks like a skin-brown mark, a colour distinct from the black of his facial hair. Thus, the dark mark on top of the nose of these two individuals indicates the same distinctive sign (and not a single thick eyebrow).

Taken together, these elements strongly suggest that ‘Billy du Hood’ and Bilal Hadfi are the same person. Prior to publishing the identification on the Bellingcat Facebook page, the team informed the French police about all the details of the investigation.

 

Writing: Alexandra Raine

Initial research and discovery: Timmi Allen

Research, verification, and editing: Rest of Bellingcat team

Bellingcat

13 Comments

  1. Sean Lamb

    Good to see the Turks are doing their bit in the international fight against ISIS.

    Congratulations to Bellingcat on successful typing a name into the facebook search box!

    Reply
  2. Randy Dread

    But surely the French intelligence services also did this research and came up with the same information.

    So what exactly is the point?

    Reply
  3. Randy Dread

    “In the wake of the unprecedented attack and amidst diverse and oft-contradictory reports about the attackers, the Bellingcat Investigation Team started looking for existing social media accounts belonging to the assailants”

    Let me take a wild guess about the Bellingcat Investigation Team here.

    None of them are based in Paris, or France. None of them speak French, or Arabic. None of them are experts on topics like terrorism,

    Reply
    • Aric Toler

      You are wrong on every one of your “wild guesses.” Thank you for your ongoing insightful commentary.

      Reply
  4. Andersen

    What exactly did you do to the other four persons’ facebook accounts that you ‘carefully examined and archived for pictures, bios and statuses.’?

    Reply
  5. Daniel Romein

    Finding a profile on Facebook of course is no rocket science, but our research goes much further than that. We have investigated many of his connections and found links to IS terrorists in Raqqa, Syria.

    Reply
  6. John Zenwirt

    The diameter of the bomb was thirty centimeters

    and the diameter of its effective range about seven meters,

    with four dead and eleven wounded.

    And around these, in a larger circle

    of pain and time, two hospitals are scattered

    and one graveyard. But the young woman

    who was buried in the city she came from,

    at a distance of more than a hundred kilometers,

    enlarges the circle considerably,

    and the solitary man mourning her death

    at the distant shores of a country far across the sea

    includes the entire world in the circle.

    And I won’t even mention the crying of orphans

    that reaches up to the throne of God and

    beyond, making a circle with no end and no God.

    Yehuda Amichai

    Reply
  7. Notjohannes

    Yehuda Amichai – To justify the deaths of those in Paris, by saying others have been murdered abroad is to take a morally incoherent position. If murder is wrong, it doesn’t matter who does it, it doesn’t matter where it’s done, it only matters that it was done, and that it was wrong to do it. If a bomb destroyed my loved ones, would I be justified by god if I then randomly murdered others who were vaguely associated with the bombers by reason of nationality? If one of the main functions of a religion is to promote moral behaviour, the entailment is clear: not matter how hurt, no matter how tempted, no matter what others urge you to do, then do not allow tragedy to push you to immoral actions. To murder is to deprive someone of all that he or she has, all they have had, all they will ever have, and as well to deprive all their friends and relations of those very same things. Nothing justifies it.

    Reply
    • Idiot Savant

      I would not even argue with anyone seemingly sympathizing with terrorists.
      Just remove the dirt and block them.

      Reply
    • Reader

      “Notjohannes ” and “Idiot Savant” – try and put an emphasis on reading and understanding the text before you share your “wisdom” with us. Yehuda Amichai is an Israel poet (world renowned, https://en.wikipedia.org/wiki/Yehuda_Amichai). His poem is clearly about how much suffering brings an act of hate, and how it propagates around the world no matter where it was committed.
      Your comments are both hateful and irrelevant.
      Peace.

      Reply
  8. Karl-Reiner Riedlinger

    Good evening! I am deeply impressed by that impressive research you do. Really impressive. Thank you! Kind regards Karl-Reiner Riedlinger

    Reply

Leave a Reply

  • (will not be published)