How was SOCMINT used to investigate the identity of Bilal Hadfi, one of the Paris 2015 attackers?
Investigators used his Facebook profile ("Billy du Hood") to link his online alias to his real identity, reconstruct his radicalization timeline, and identify his network of associates.
* How investigators reconstructed Hadfi's identity and radicalization from public posts. *
The case: Bilal Hadfi (born January 22, 1995, Jette, Belgium) was one of the suicide bombers at the Stade de France during the November 13, 2015 Paris attacks.
SOCMINT investigation process:
- Profile discovery — His Facebook account under the alias "Billy du Hood" (facebook.com/bilal.hadfi.1) was identified
- Identity confirmation — Profile photos and biographical details on the account were matched against known images of Hadfi, linking the "Billy du Hood" alias to the real person
- Network analysis — His friends list, interactions, and connections revealed associates and potential co-conspirators
- Timeline reconstruction — Dated, publicly visible posts (spanning February, June and August 2015) let investigators place his activity on a timeline in the months before the November 2015 attack, tracing a progression from ordinary social content toward radicalization
This case, documented by Bellingcat, demonstrates how social media creates an involuntary "digital diary" that investigators can use to reconstruct someone's path to radicalization.
Go deeper:
Bellingcat resources & guides — methodology for profile/network/timeline reconstruction.
Open-source intelligence (Wikipedia) — the discipline framing this investigation.- November 2015 Paris attacks (Wikipedia) — the Stade de France bombing Hadfi took part in.