On 16 November, three days after the Paris Attacks, the Bellingcat Investigation Team identified the Facebook profile of one of the assailants, Bilal Hadfi. Here is how we did it.
In the evening of 13 November, six simultaneous terrorist attacks happened in France’s capital city of Paris. One of these happened in the vicinity of the Stade de France during a friendly France-Germany football game. Three suicide bombers detonated themselves outside of the Stadium: one of them is yet to be identified, the second one has been associated with a forged Syrian passport, and the third attacker is Bilal Hadfi.
Bilal Hadfi was a 20-year-old French citizen residing in Belgium. Mr. Hadfi is not reported to have travelled to Syria before early this year (according to his mother, his departure to Syria happened on 15 February 2015). Hadfi detonated his vest at 9:53 p.m. on Rue de la Cokerie, just outside of a McDonald’s restaurant about 300 meters from the Stade de France. The explosion did not cause other casualties than Hadfi himself.
Three days later, the Bellingcat Investigation Team uncovered the Facebook profile of Bilal Hadfi.
Searching for the attackers’ online presence
In the wake of the unprecedented attack and amidst diverse and oft-contradictory reports about the attackers, the Bellingcat Investigation Team started looking for existing social media accounts belonging to the assailants.
A Facebook search for the name ‘Bilal Hadfi’ listed five accounts with this name. The first such one had a clearly labelled URL: ‘facebook.com/bilal.hadfi.1’. Each of the five Facebook profiles was carefully examined and archived for pictures, bios and statuses.
One of the ‘bilal.hadfi.1’ connections came out to be ‘Billy du Hood’. His Facebook account looked intriguing: a young male was proudly posting images of an AKM and of other handguns. ‘Billy du Hood’ thus posted a picture of weapons exhibited on what looks like a table, timestamped 9 December 2013. The origin of this image is unclear, it had already appeared in press in 2010 and September 2013.
‘Billy du Hood’ profile pictures were publicly visible before the Facebook account was shut down; amongst them, we saw this one of an AKM automatic rifle in what appears as an unidentified indoors location:
This image is timestamped 1 July 2015. Contrary to the aforementioned press image, this one appears grainy as shot with a mobile phone. Thus, ‘Billy du Hood’ profile shows a growing number of features indicating he is no ordinary youth, along with similarities with what is known about Bilal Hadfi’s area of residence.
At first, we were not sure whether ‘bilal.hadfi.1’ and ‘Billy du Hood’ are friends or are the same person. There were no publicly visible images for the profile ‘bilal.hadfi.1’. Thus, the only image we had from him is the one published by Belgian media on 16 November:
In an image posted by ‘Billy du Hood’, he captions “With the family” (timestamp: 9 June 2014, original caption “Avec la famille”):
There is clearly a striking resemblance between ‘bilal.hadfi.1’ and ‘Billy du Hood’, so the question was: is really ‘Billy du Hood’ a friend of ‘bilal.hadfi.1’ who is visible together with him on the photograph?
Who is who?
To assess whether ‘bilal.hadfi.1’ and ‘Billy du Hood’ are the same person, we compared the publicly visible pictures of the two young men:
The faces of the man on the far left (picture from ‘Billy du Hood’ profile images) and the youth on the right image (Bilal Hadfi as identified by media) were strikingly resemblant.
Another interesting coincidence is the shirts: both men seem to wear a very similar, striped t-shirt.
The quality of the image from ‘Billy du Hood’ Facebook page (on the left) is quite low, yet we proceeded to comparing the shirts:
On Bilal Hadfi’s picture published by other media, the t-shirt has three thick dark blue stripes separated by two thinner white stripes.
‘Billy du Hood’ appears to be wearing a t-shirt with an identical pattern. As the image quality is low, we preferred, however, to be cautious about this detail and chose not highlight it as identifying.
Another distinctive sign which is shared by the two individuals is what looks like a birthmark between the two eyebrows, at the top of the nose:
The dark mark clearly looks like a skin-brown mark, a colour distinct from the black of his facial hair. Thus, the dark mark on top of the nose of these two individuals indicates the same distinctive sign (and not a single thick eyebrow).
Taken together, these elements strongly suggest that ‘Billy du Hood’ and Bilal Hadfi are the same person. Prior to publishing the identification on the Bellingcat Facebook page, the team informed the French police about all the details of the investigation.
SEE ALSO: The Pentagon is expanding its investigation into the ISIS intelligence scandal