Dispelling The Fog: Photo of Zehab-Bibeau NOT from ISIS

BibeauNumerous press outlets are reporting that the only publicly known photo of Michael Zehaf-Bibeau was first posted by “ISIS” or an “ISIS-affiliated” Twitter account. This includes major Canadian news outlets like the Canadian Broadcasting Corporation (see here, others here and here).

Because the account in question was suspended soon after it posted the photo, most press accounts are now citing “Twitter” generically, with little or no attribution to the original source.

The implication underlying this attribution is that ISIS or ISIS-affiliated individuals may have had some prior knowledge of the assailant. This single piece of information has in turn led to rampant speculation about the assailant’s associations with ISIS.

All of this speculation, however, is based on fundamentally incorrect source attribution. The photo was originally posted by an anonymous user to a law enforcement social media account in an effort to assist, rather than terrorize or intimidate. Only hours later was the photo posted by ISIS-related accounts, who were only recirculating Western, and indeed local, press reports.

The most complete account of the photos’ provenance comes from journalist William Reymond, who should be credited with first posting the photo at 4:16 pm EDT. Reymond provided a detailed account of the photo’s provenance and his acquisition of it here. According to Reymond:

• He received a link to the photo on a police twitter account at approximately 2 pm.

“a tweet asking the witnesses of the attack to share with the police any information allowing to identify the shooter. And there, among the first responses, is the photo of a man holding a rifle.”

• Reymond took a screenshot of the photo as soon as he saw it, before the photo was deleted moments later.

• While Reymond does not provide a link to the tweet, the time and content he describes suggest it was the tweet below, from the Ottawa Police, posted at 2:00 pm.


• Reymond may have taken the screenshot with another device, which would help to account for the vertical flare/reflection on the photo being circulated

• To his considerable credit, Reymond took more than two hours to verify the authenticity of the photo, and only posted it at 4:16 pm



• Reymond indicates that law enforcement is in possession of another photo of the suspect, likely a driver’s license, which he used to verify the accuracy of the original photo

• 20 minutes after Reymond posted the photo, ISIS-related Twitter V_IMS posted the photo


Technical data from V_IMS’s twitter page (now suspended, but data captured prior to suspension) shows that V_IMS sourced the photo from William Reymond:

Text in blue is information showing source of photo on Twitter. Note the URL from Breaking3zero, Reymond’s account Text at lower left indicates address of reposted photo on V_IMS’s account (now suspended)

Text in blue is information showing source of photo on Twitter. Note the URL from Breaking3zero, Reymond’s account. Text below blue box indicates address of reposted photo on V_IMS’s account (now suspended)

Reymond also provides visual confirmation that V_IMS sourced the photo from his account:


So, in short, claims that the photo of Zehaf-Bibeau originated with an ISIS account are categorically false. The ISIS account that circulated the photo acquired it hours after the attack, and from a Canadian journalistic source.

This essentially confirms ISIS social media behavior observed by SecDev, which was exclusively reactionary—at most, non-official ISIS accounts tweeted out photos of the events after they had unfolded, often with highly inaccurate information. The account below, for example, claims that “three brothers” had stormed the Canadian parliament, a rumor that was circulating widely on news coverage at around 1 pm EDT, the time of the tweet:


At most, ISIS accounts were reacting to the events in Ottawa at the same time that Ottawans and Canadians were. There is no indication in social media that they had prior knowledge, nor that they were in any way directly affiliated with Zehaf-Bibeau.

The most likely source of the above photo was an eyewitness who saw the attack take place. The photo was likely shot at the Canadian War Memorial during the attack, then posted to the Ottawa Police Twitter account shortly after. The granite stone in the background of the photo is identical to that found on the War Memorial itself, which is the only large piece of granite in the parliamentary district (the parliament buildings are sandstone and limestone, see here).

Speculation about connections between the shooter and ISIS are based on poor source attribution.

This poor attribution is a symptom of evolving standards and practices for digital journalism, and an example of the confusion that sometimes reigns in incident response situations.

Complex attributions like this are the new normal for modern journalism.

Correction: an earlier version of this document indicated that Ottawa Police requested pictures or video of the suspect through their Twitter account at 11 am.  The Ottawa Police in fact tweeted this request at 2 pm.  The document has been updated accordingly.