Truth Frequency Radio
Jan 16, 2015

By OpenDNS Security Research

You may have noticed that a few media outlets have been reporting that a fake BBC website was setup to spread disinformation regarding the recent Charlie Hebdo attacks in Paris, France.On January 12, 2015 our advanced threat protection flagged the bbc-news[.]co[.]uk domain as a suspicious site. While we can’t say definitively what the motives are of the operators are, it is apparent that they are untrustworthy and potentially nefarious. The predictive classification that we used to identify and flag the site is showing the attack is very similar to former incidents that malicious actors have used in the past like the Boston Marathon malware incidents.

This post will highlight the OpenDNS Security Labs analysis of the campaign and its indicators.

Key Insights

  • Fake BBC themed website launch using bbc-news[.]co[.]uk domain
  • Social media enlisted to spread disinformation to draw visitors
  • A 16.5x spike in normal DNS queries to the website
  • Website had external links to State-sponsored (Iranian) media outlet
  • Prominent American economist and columnist enlisted to lend credibility to disinformation

The Domain

A news site getting a surge in traffic is not that uncommon. For example, a breaking story may have been released. However, in this case the circumstances were a bit more interesting. The website in question had no traffic prior to December 28, 2014 and was not affiliated with the main BBC website.


Some further investigation on the IP hosting the website and the domain registration info (via WHOIS) made it apparent it had no relation to the actual BBC website. What had caught our attention was the jump from around 250 requests per hour to suddenly 3500 requests (16.5x increase). We speculated that the jump in traffic was probably caused by a popular webpage hosting a link to the fake website.

The website, bbc-news[.]co[.]uk, was registered on December 28, 2014 with 1 & 1 Internet AG by “Michael Jones”. The domain has changed hands at least once, having previously been owned by an individual using the name “Keith Szlamp” until its expiration on June 9, 2012. The following table shows the historical DNS record types associated with the bbc-news[.]co[.]uk domain.


First Seen

Last Seen


9/22/10 00:06:51

3/13/12 16:50:27


9/22/10 00:06:51

3/13/12 16:50:27


2/10/11 00:00:50

6/13/11 18:10:47


8/30/11 01:37:59

9/12/11 17:08:32


12/28/14 12:22:20

12/28/14 12:22:20


12/28/14 12:22:20

12/28/14 12:22:20


12/28/14 12:38:05

12/28/14 12:38:05


12/28/14 16:22:52

1/12/15 15:09:38


12/29/14 00:55:46

1/9/15 21:33:18

A 1419768683 10800 3600 604800 3600

12/31/14 23:54:09

1/8/15 18:16:25


1/3/15 07:22:16

1/6/15 18:58:59


1/3/15 07:22:16

1/6/15 18:58:59

NS 2015010801 10800 3600 1209600 7200

1/8/15 11:23:07

1/10/15 14:44:54

SOA 2017246806 10000 2400 604800 3600

1/9/15 11:46:55

1/9/15 20:50:56


1/9/15 11:46:55

1/12/15 20:27:02


1/9/15 11:46:55

1/12/15 20:27:02



1/11/15 05:38:25

1/12/15 22:12:51



1/11/15 05:38:25

1/12/15 22:12:51


1/12/15 15:07:02

1/12/15 15:07:02


1/12/15 15:07:02

1/12/15 15:07:02


1/12/15 22:51:24

1/12/15 22:51:24

A 2017276962 10000 2400 604800 3600

1/12/15 22:51:24

1/12/15 22:51:24


Using the freely available tools we were able to decipher the real IP address of the server. The IP address is associated with AS198047 and belongs to UK Webhosting Ltd. (t/a Tsohost) of 113-114 Buckingham Avenue, Slough, Berkshire, England – a brand owned by Paragon Internet Group.


The domain registrant’s name, Michael Jones, could also be a misdirect. Jones remains the most popular surname in Wales, borne by 5.75% of the population. The registrant’s given name, Michael, is also a very common name throughout the world. A quick search for michael jones” uk OR wales OR scotland OR england on Google shows around 440,000 results.

Based on available information the website doesn’t appear to be malicious but the intent to deceive and perhaps harm visitors via unscrupulous file downloads or through click-fraud is a logical conclusion to draw.

Three observations reinforce said conclusion.

News of U.K. Citizen Apprehended in the Middle East on “Terror Charges”

A quick search on Twitter for bbc-new[.]co[.]uk showed us that the first mention of the domain was in relation to two Tweets on December 31, 2014 claiming that a “U.K. YouTuber” was apprehended in the Middle East on Terror Charges.


We were unable to corroborate this story and found no reference to the event in question. As there was no favoriting or retweeting of the stories, this might indicate a “trial run” of the campaign.

The Promise of a Cicada 3301 Clue

Between January 2 and January 10, 2015, we began to see Tweets stating that a Cicada 3301 clue would be announced:


Some even speculated that the clue was located in the comments section of the post:


The Cicada 3301 puzzle has been called “the most elaborate and mysterious puzzle of the internet age” by Metro, and is listed as one of the “Top 5 eeriest, unsolved mysteries of the Internet” by The Washington Post. The first Internet puzzle started on January 5, 2012, and ran for approximately one month. A second round began one year later on January 5, 2013, and a third round is ongoing following confirmation of a fresh clue posted on Twitter on January 5, 2014. The stated intent was to recruit “intelligent individuals” by presenting a series of puzzles which were to be solved, each in order, to find the next.

Given the date that these Tweets began, the owner of the bbc-news[.]co[.]uk site likely counted on a flood of puzzle-playing people just waiting for another clue.

News Regarding The Authenticity of Charlie Hebdo Footage

Examining the co-occurrences with bbc-news[.]co[.]uk gave us additional direction. had a high co-occurrence score with the domain. The most recent post was to a provocative headline regarding the Charlie Hebdo case.


At the time of this writing the submitter of all 3 posts have been deleted.

As the site is now offline, only the cached version remains ( When the site was live it looked indistinguishable from the legitimate website but the Google cached version has removed the stolen look and feel (as seen below).


The article on the website read as follows:

Doubts raised over authenticity of Charlie Hebdo footage.

According to analysts, it appears that the footage was recorded over two takes, evidenced by a placement marker that appears by the front left wheel of the vehicle as the gunmen return from apparently gunning down a wounded Gendarme.

The killing of the french policeman is also being called into question, due to the ‘lack of blood spatter consistent with that of a close range shooting’.

As shown in the freeze frame below [no longer available], smoke is shown to emit from the weapon, with no impact or trauma appearing to register on the body of the victim. The decision of many news outlets to blur out the victim is being debated as evidence of complicity in what many are now calling a hoax.

Forensic and ballistics expert David Mayhew commented; “If the video shows events as they actually occurred, then in my opinion it is most likely that the firearm shown is discharging blanks rather than conventional ammunition”.

Whilst numerous theories have sprung up concerning this and other details, the general consensus among not just sceptics, but some major news agencies, is that the entire event was a ‘False Flag’ attack perpetrated by the CIA and/or Mossad in a “psy-ops” exercise to rouse hatred against Islam and support for what has been so far, a failing campaign in Iraq, Syria and the Middle East.

The article also links to an Islamic Republic of Iran Broadcasting (IRIB) operated Press TV interview with Dr. Paul Craig Roberts, former Assistant Secretary of the Treasury in the Reagan Administration and associate editor of the Wall Street Journal. In the article, Dr. Roberts states that the attack in Paris was a false flag operation “designed to shore up France’s vassal status to Washington.

Interesting factoid, in 1987 the French government recognized Dr. Roberts as “the artisan of a renewal in economic science and policy after half a century of state interventionism”; it inducted him into the Legion of Honor on March 20, 1987. The French Minister of Economics and Finance, Edouard Balladur, even came to the US from France to present the medal to Roberts. We find ourselves wondering if the French government will be requesting its return in the near future.

Who Connected To The Website?

Analyzing a 60 minute window between 15:00 UTC and 16:00 UTC on January 12, 2015 showed 1,491 unique client IP addresses that accessed the website via the OpenDNS infrastructure. The client IPs represent a massively distributed query base with an unsurprisingly high number of queries from clients in and around France.


Utilizing OpenGraphiti (, OpenDNS Investigate, and a depth circle layout, we can see a defined circle representing the client IP addresses. We can also see the connections between the IP addresses and ASNs (showing a high connection rate from ISPs in France and the United States).


How Did They Find The Site?

As a result of placing the bbc-news[.]co[.]uk domain into our sinkhole, we were able to analyze the referrers that directed the clients to the domain. The list of 58 referrers observed between January 12, 2015 20:39:55 and January 13, 2015 04:28:14 UTC can be found at the end of this document.

During that time period we observed 2,300 distinct queries for the bbc-news[.]co[.]uk as depicted in the following Kibana dashboard:


The Charlie Hebdo events in France, however, likely represented the most successful way to bait information seeking Internet users. Based on the HTTP referrers it wasn’t long before blogs and popular social media sites (like Facebook) began linking to the fake site, as seen below.

image11, as indicated previously, also provided a number of referrers and was mentioned across multiple posts.


It should be noted that the timing of the postings preceded the spike in query traffic by roughly 20hrs.

The OpenDNS Investigate co-occurrences shows a number of Jihadi and ISIS-related websites referring to the bbc-news[.]co[.]uk site.



While we can’t say definitively what the motives are of the operators are, it is apparent that they are untrustworthy and potentially nefarious. The predictive classification that we used to identify and flag the site is showing the attack is very similar to former incidents that malicious actors have used in the past like the Boston Marathon malware incidents.

Though we cannot conclude that the threat actor’s intent was malicious, it was almost certainly employed to plant “false flags” and drive traffic to the bbc-news[.]co[.]uk website. In a corporate environment, had one or two queries to the domain been noticed, the majority of individuals would likely have thought nothing of it. The domain name did not read as malicious and it aligned with the BBC look and feel. Only after the traffic is compared to a larger population, like the 50m+ customers using the OpenDNS infrastructure, could it be noticed that the site traffic trended higher than usual – a potential indicator of compromise (IOC).

So who is/was the threat actor and what is/was their goal?

The use of social media (namely Twitter and Reddit) to spread the 3 distinct enticements – the “Youtuber terror threat” false flag, the release of a Cicada 3301 clue, and the Charlie Hebdo false flag – indicates a reasonable knowledge of the Internet, SEO-like traffic generation techniques, and current events.

The Cicada 3301 clues have typically been released on January 5 in years past so that part of the campaign was, if anything, timely. Could this have been an elaborate ploy to provide a valid clue to the game? Unlikely. Why would the “Cicada 3301 organization” utilize a fake news site to communicate the clue? The risk for brand pollution and subsequent legal action are far too great, in our opinion, to warrant such tactics. Also, the Cicada organization would probably not wish to align itself with such controversial disinformation or political polarization.

As mentioned however, the Charlie Hebdo events in France likely represented the most successful way to bait information seeking Internet users. Based on the HTTP referrers it wasn’t long before blogs and popular social media sites (like Facebook and Reddit) began linking to the fake site.

The campaign also does not appear to target any individual, group, or geopolitical region. The use of relevant news indicates that a broad net was cast in an effort to draw as many individuals from social media and other sources to the site.

One might conclude that, given the recent events surrounding Charlie Hebdo in Paris, the posting of disinformation on the bbc-news[.]co[.]uk site, and links to an Iranian state-sponsored news agency corroborating the same disinformation, that this was a State-executed, State-ordered, State-integrated, or State-rogue-conducted activity backed by Iran. Given all available information, however, this conclusion might be as inflammatory and misinformed as the campaign itself.

It’s also possible that Dr. Paul Craig Roberts, the former Assistant Secretary of the Treasury in the Reagan Administration and associate editor of the Wall Street Journal, had some ties to the campaign in an effort to garner attention for his views and political stance. Again, however, all available information cannot conclusively attribute this to Dr. Roberts in any way.

What can be discerned from this campaign is how staggeringly malicious it could have been. The campaign presented similar indicators as witnessed in spam email runs and rapidly constructed websites surrounding the Boston Marathon bombing. As the bbc-news[.]co[.]uk domain appeared (without deep investigation) to be associated with BBC and its brand, it is reasonable to assume that many more individuals could have been driven to the site. Once at the site, individuals could have been served malicious content, redirected to other more dangerous fraudulent sites, or unknowingly enlisted for click fraud purposes, to name but a few.

This very well could have been a campaign of “test runs” to see what type of SEO-like keywords, stories, and links generated the most traffic to a seemingly reputable domain. Based on the success or failure of the test runs, the attacker could refactor or move forward, respectively, with a more malicious campaign. OpenDNS Security Labs will continue to monitor the domain to see if the campaign evolves or if the threat actor changes tactics entirely.

Appendix: List of the 58 referrers

  • http://bbc-news[.]co[.]uk/cicada-3301-set-to-deliver-new-clues-on-january-5th-2015/
  • http://bbc-news[.]co[.]uk/doubts-raised-over-authenticity-of-charlie-hebdo-footage/
  • http://cgi[.]webbox[.]com/wbwc/webbox[.]asp?sec=0&r=6563&act=rd&ms=416915022&cf=861503&ses=12534786&p=360628
  • http://forums[.]somethingawful[.]com/showthread[.]php?threadid=3569772&userid=0&perpage=40&pagenumber=106
  • http://gfy[.]com/fucking-around-and-program-discussion/1158787-suspicions-growing-french-shootings-false-flag-operation[.]html
  • http://hommaforum[.]org/index[.]php/topic,98014[.]2610[.]html
  • http://joemonster[.]org/filmy/66340/I_am_NOT_Charlie_Hebdo_Max_Kolonko_Mowi_Jak_Jest
  • http://l[.]facebook[.]com/l[.]php?u=http%3A%2F%2Fbbc-news[.]co[.]uk%2Fdoubts-raised-over-authenticity-of-charlie-hebdo-footage%2F&h=gAQHsqFlo&enc=AZOgdpWwQ-18pFpuLvMZr-vqwnGg203ywHZn8PAsOTgHJZD3x9Hqf8e5QLTxu8W1cl_IrxQb6eKgRnOo9gFa6liR-_SSe_niMp8bG0rvpcl6V11bAe_GO6VtES2YY20zjBBj1xkCq4dhj5qKMQhMpJrstiUzXHLPpoPnk3YW1gGMLw&s=1
  • http://l[.]facebook[.]com/l[.]php?u=http%3A%2F%2Fbbc-news[.]co[.]uk%2Fdoubts-raised-over-authenticity-of-charlie-hebdo-footage%2F&h=lAQEcMVsPAQEWcg7aRZNWHQFhPcCE2ppo5iEEzuLIRMdmQg&enc=AZMzFs_jZ-sANKBjyUU-FHqkswOdOOVuPzF8JR4ouG1dAB2YO7mDRyKBGv8N3-R6KAnNQGBoON2GadI94g6qcBdaScR2ZJVmR2MSAseIaOpuqaXx6BSuaqhRxcnsmx9wseabbtslJIg3eqGP09jKU-lf9AgAD8sfz-Q-FScq7QEHfw&s=1
  • http://l[.]facebook[.]com/l[.]php?u=http%3A%2F%2Fbbc-news[.]co[.]uk%2Fdoubts-raised-over-authenticity-of-charlie-hebdo-footage%2F&h=nAQFdN26J&enc=AZOyK7yuimhhgnacntBN0uGoT-mLXeBdgTlDRBqfWf63Q5EOrFfb4HpOnJW_bi5-KkEDN47DmozxZtLLTKZhImimddXOVcZDKVaMq9Q3bKvH2sUTiyGHpXWMdWo-VUZhnhGYXju1kiy7omQ321qIHOha&s=1
  • http://l[.]facebook[.]com/l[.]php?u=http%3A%2F%2Fbbc-news[.]co[.]uk%2Fdoubts-raised-over-authenticity-of-charlie-hebdo-footage&h=LAQFW4gN4&enc=AZMgNEm0JECnE0tWtCsSL8ZlQDH-y5nHSHi9JCwyqrZTKFUKQnJerTrkMdIZqXF_n-AfAHAPJE3-aE31pAv1FcMzA76lrskHZKrQmgdfhyqujenAM70iY0dgKPOmX5pcKwPGyHZ2_kioQ53krIeTNvSP&s=1
  • http://l[.]facebook[.]com/lsr[.]php?u=http%3A%2F%2Fbbc-news[.]co[.]uk%2F&ext=1421096817&hash=AcnXQcbjvxd6azFguwv3pU951XmW3MvMVRXF1FX3Nz8i6A
  • http://l[.]facebook[.]com/lsr[.]php?u=http%3A%2F%2Fbbc-news[.]co[.]uk%2Fdoubts-raised-over-authenticity-of-charlie-hebdo-footage%2F&ext=1421098908&hash=Acn3QcXquQVwedUQfdCnOs4ttCZu5nX9c3LmrpRbHgakpA
  • http://muckrack[.]com/link/ypx4o/
  • http://plus[.]url[.]google[.]com/url?sa=z&n=1421096109533&url=http%3A%2F%2Fbbc-news[.]co[.]uk%2Fdoubts-raised-over-authenticity-of-charlie-hebdo-footage%2F&usg=ZYcJs9rk9glioLUEkTWOfdzgAZM[.]
  • http://plus[.]url[.]google[.]com/url?sa=z&n=1421100283728&url=http%3A%2F%2Fbbc-news[.]co[.]uk%2Fdoubts-raised-over-authenticity-of-charlie-hebdo-footage%2F&usg=evpz4vi4HXuMeYUGnnjZYCaqa2w[.]
  • http://plus[.]url[.]google[.]com/url?sa=z&n=1421101229815&url=http%3A%2F%2Fbbc-news[.]co[.]uk%2Fdoubts-raised-over-authenticity-of-charlie-hebdo-footage%2F&usg=IXeoYEZiApBpJeChEHRX9deWuAg[.]
  • http://plus[.]url[.]google[.]com/url?sa=z&n=1421105776174&url=http%3A%2F%2Fbbc-news[.]co[.]uk%2Fdoubts-raised-over-authenticity-of-charlie-hebdo-footage%2F&usg=I40Bc7kbx9_sdrhutqyA9XvQK1U[.]
  • http://plus[.]url[.]google[.]com/url?sa=z&n=1421105833487&url=http%3A%2F%2Fbbc-news[.]co[.]uk%2Fdoubts-raised-over-authenticity-of-charlie-hebdo-footage%2F&usg=YLVakB3Jtt6Ws7FmXzMZ60rPEgU[.]
  • http://projectavalon[.]net/forum4/showthread[.]php?78924-BBC-Doubts-raised-over-authenticity-of-Charlie-Hebdo-footage[.]
  • http://removingtheshackles[.]blogspot[.]ca/
  • http://removingtheshackles[.]blogspot[.]co[.]uk/2015/01/the-bbc-did-not-admit-france-was-false[.]html
  • http://removingtheshackles[.]blogspot[.]com[.]au/
  • http://removingtheshackles[.]blogspot[.]com[.]au/2015/01/the-bbc-did-not-admit-france-was-false[.]html?m=1
  • http://removingtheshackles[.]blogspot[.]com[.]es/2015/01/the-bbc-did-not-admit-france-was-false[.]html
  • http://removingtheshackles[.]blogspot[.]com/
  • http://removingtheshackles[.]blogspot[.]com/2015/01/the-bbc-did-not-admit-france-was-false[.]html
  • http://removingtheshackles[.]blogspot[.]dk/2015/01/the-bbc-did-not-admit-france-was-false[.]html
  • http://t[.]co/bKzMDEOigv
  • http://uncovering-cicada[.]wikia[.]com/wiki/Fake_bbc_2015
  • http://webcache[.]googleusercontent[.]com/search?q=cache:9VzKB8vdlmcJ:bbc-news[.]co[.]uk/+&cd=1&hl=de&ct=clnk&client=safari
  • http://webcache[.]googleusercontent[.]com/search?q=cache:WfWMrmqES58J:bbc-news[.]co[.]uk/doubts-raised-over-authenticity-of-charlie-hebdo-footage/+&cd=1&hl=en&ct=clnk&gl=ca&client=firefox-a
  • http://webcache[.]googleusercontent[.]com/search?q=cache:WfWMrmqES58J:bbc-news[.]co[.]uk/doubts-raised-over-authenticity-of-charlie-hebdo-footage/+&cd=1&hl=en&ct=clnk&gl=uk&client=firefox-a
  • http://webcache[.]googleusercontent[.]com/search?q=cache:WfWMrmqES58J:bbc-news[.]co[.]uk/doubts-raised-over-authenticity-of-charlie-hebdo-footage/+&cd=1&hl=en&ct=clnk&gl=us
  • http://whatreallyhappened[.]com/
  • http://www[.]boards[.]ie/vbulletin/showthread[.]php?t=2057359580
  • http://www[.]coveritlive[.]com/index2[.]php/option=com_altcaster/task=viewaltcast/template=/altcast_code=c75389334d/width=534/height=700
  • http://www[.]facebook[.]com/l[.]php?u=http%3A%2F%2Fbbc-news[.]co[.]uk%2Fdoubts-raised-over-authenticity-of-charlie-hebdo-footage%2F&h=eAQHnbbPq
  • http://www[.]godlikeproductions[.]com/forum1/message2767345/pg1
  • http://www[.]google[.]ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=3&ved=0CC0QFjAC&url=http%3A%2F%2Fbbc-news[.]co[.]uk%2Fdoubts-raised-over-authenticity-of-charlie-hebdo-footage%2F&ei=X3q0VMf5Loz7sASdmYDoBw&usg=AFQjCNFXTI_YlW7ay2z6ku6Bm9y_oEsSBA
  • http://www[.]google[.]ca/url?sa=t&rct=j&q=&esrc=s&source=web&cd=3&ved=0CC0QFjAC&url=http%3A%2F%2Fbbc-news[.]co[.]uk%2Fdoubts-raised-over-authenticity-of-charlie-hebdo-footage%2F&ei=X3q0VMf5Loz7sASdmYDoBw&usg=AFQjCNFXTI_YlW7ay2z6ku6Bm9y_oEsSBA&bvm=bv[.]83339334,d[.]d24
  • http://www[.]google[.]com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=4&ved=0CC8QFjAD&url=http%3A%2F%2Fbbc-news[.]co[.]uk%2Ftag%2Fcicada-3301-2015%2F&ei=Jlm0VNrEGcS_ggS82oPQCg&usg=AFQjCNExoKS8_kY9tYmjnnSu6Vqu3u1hlg&sig2=owJM6jFARhCCCL_QKJ-oJw&bvm=bv[.]83339334,d[.]eXY
  • http://www[.]google[.]de/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0CCMQFjAA&url=http%3A%2F%2Fbbc-news[.]co[.]uk%2Fdoubts-raised-over-authenticity-of-charlie-hebdo-footage%2F&ei=jDi0VKzEJYHgywOhxIKIDg&usg=AFQjCNFXTI_YlW7ay2z6ku6Bm9y_oEsSBA
  • http://www[.]google[.]ie/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0CCIQFjAA&url=http%3A%2F%2Fbbc-news[.]co[.]uk%2Fdoubts-raised-over-authenticity-of-charlie-hebdo-footage%2F&ei=0lm0VO38EYLC7gb9woGQAQ&usg=AFQjCNFXTI_YlW7ay2z6ku6Bm9y_oEsSBA&bvm=bv[.]83339334,d[.]ZGU
  • http://www[.]politics[.]ie/forum/northern-ireland/233813-belfast-muslim-s-praise-islamic-state-s-rule-mosul-6[.]html
  • http://www[.]reddit[.]com/
  • http://www[.]reddit[.]com/r/conspiracy/comments/2s3qbd/doubts_raised_over_authenticity_of_charlie_hebdo/
  • http://www[.]reddit[.]com/r/skeptic/comments/2s696v/charlie_hebdo_false_flag_nonsense_need_some_help/
  • http://www[.]removingtheshackles[.]blogspot[.]ca/
  • http://www[.]thejournal[.]ie/mobile-apps/
  • http://www[.]theoccidentalobserver[.]net/2015/01/alain-de-benoist-on-charlie-hebdo/
  • http://www[.]veteranstoday[.]com/2015/01/12/bbcpresident-of-france-false-flag-terrorism-in-paris/
  • http://www[.]zerohedge[.]com/news/2015-01-12/slain-paris-terrorist-claims-he-was-working-isis-posthumous-video-explains-reasons-a?page=1
  • https://www[.]facebook[.]com/
  • https://www[.]google[.]ca/
  • https://www[.]google[.]co[.]uk/
  • https://www[.]google[.]com/
  • https://www[.]google[.]it/


Disputed Claims Over Qaeda Role in Paris Attacks

WASHINGTON — The younger of the two brothers who killed 12 people in Paris last week most likely used his older brother’s passport in 2011 to travel to Yemen, where he received training and $20,000 from Al Qaeda’s affiliate there, presumably to finance attacks when he returned home to France.

American counterterrorism officials said on Wednesday that they now believed that Chérif Kouachi, the younger brother, was the aggressor in the attacks — not Saïd Kouachi, the older brother, as they first thought — but that Saïd may also have traveled to Yemen, as American and French authorities have said.

The fuller portrait of the brothers has emerged as an international effort is focused on determining who may have been behind the attack on the French newspaper Charlie Hebdo, and what direct role, if any, Al Qaeda, its affiliates or their bitter rival, the Islamic State, had in planning and ordering the assault. In a video and written statement, the Qaeda branch in Yemen on Wednesday formally claimed responsibility for the deadly assault. It said the target had been chosen by the Qaeda leadership but did not specify which leaders.

If the claim of direct responsibility holds up, it would make the attacks in France the deadliest planned and financed by Al Qaeda on Western soil since the transit bombings in London in 2005 that killed 52 people. And it would serve as a reminder of the continued danger from the group at a time when much of the attention of Europe and the United States has shifted to the Islamic State, the militant organization that controls large swaths of Syria and Iraq and has become notorious for beheading hostages.

The new information about the Kouachi brothers could help explain what Chérif Kouachi told a French television station before his death last week: that he had gone to Yemen in 2011, probably through Oman, and was financed by Anwar al-Awlaki, the American-born cleric who oversaw attacks against the West by Al Qaeda in the Arabian Peninsula, also known as AQAP. The American authorities now believe Chérif most likely had contact with Mr. Awlaki in Yemen, possibly in person. But it is still unclear what specific guidance the Qaeda branch gave to the Kouachis about carrying out an attack, though it is believed that the satirical magazine was one of the targets discussed, an American counterterrorism official said.

The United States still has little concrete evidence about any travels by the brothers after 2011 or possible further contact with terrorist groups, officials said.

“I suspect that Chérif Kouachi did engage AQAP members in Yemen, but that he was not fully brought into the organization,” said Brian Fishman, a counterterrorism researcher at the New America Foundation in Washington. “Perhaps concerned about infiltration by Western agents, AQAP may have offered minimal training, directed the group toward publicly announced target lists, and sent him on his way.” He said if that happened, “AQAP did not exactly direct the attack, but it had some knowledge of the Kouachis and could plausibly try to claim credit.”

The statement by the Qaeda branch in Yemen called the Kouachi brothers, who were fatally shot by the police on Friday, “two heroes of Islam.” But it referred to the actions of Amedy Coulibaly, who attacked a police officer the day of the assault on Charlie Hebdo and was fatally shot by the police after holding hostages in a kosher supermarket, as a coincidence and did not take responsibility for them. In a video released after his death, Mr. Coulibaly said he was a supporter of the Islamic State, a rival of Al Qaeda’s.

A member of Al Qaeda in the Arabian Peninsula, who spoke to The New York Times on the condition of anonymity, said the joint timing of the two operations was a result of the friendship between Mr. Coulibaly and the Kouachi brothers, not of common planning between the Qaeda group and the Islamic State.

The attacks appear to illustrate what analysts have described as an evolution in Qaeda tactics and logistics. Because of heightened surveillance, operatives are trained and assigned general targets, but details on how to carry out the operation are no longer micromanaged by the organization. The looser command structure reduces communication, and thus reduces the chance of intercepts by intelligence and law enforcement agencies.

In repeated statements before they were killed by the police, the Kouachi brothers said they had carried out the attack on behalf of the Qaeda branch in Yemen, saying it was in part to avenge the death of Mr. Awlaki. Chérif Kouachi told French television before his death that Mr. Awlaki had given him financial assistance.

The Qaeda statement indicated that the attack on Charlie Hebdo was in response to the publication’s frequent caricatures lampooning the Prophet Muhammad. It said that “the one who chose the target, laid the plan and financed the operation is the leadership of the organization.” But the statement did not identify which leaders.

The statement and the video both said that Mr. Awlaki had made the “arrangement” with those who carried out the attack in Paris. It said that Mr. Awlaki, who joined the Qaeda branch in Yemen before being killed by an American drone strike in September 2011, “threatens the West both in his life and after his martyrdom,” a reference to the continuing influence on the Internet of his calls for violent jihad.

The Office of the Director of National Intelligence in the United States said that it had determined the video clip claiming responsibility was genuine, but had not reached a conclusion “on whether or not the claims being made in the video are valid.”

The Qaeda statement also claimed the attack had been ordered by the group’s overall leader in Pakistan, Ayman al-Zawahri, in keeping with the wishes of his predecessor, Osama bin Laden. American officials were skeptical that Mr. Zawahri had personally ordered the attack.

There was no explanation of why the group had waited a week to claim responsibility for an attack that terrorized and galvanized all of France and much of the world. But scholars studying the Yemeni branch of Al Qaeda said the time that had elapsed between the carnage in Paris a week ago and the claim of responsibility on Wednesday was quick in terms of the normal turnaround after previous attacks, since communication is believed to be via couriers. “Issuing a claim of responsibility for an operation is not something that is done lightly or spur of the moment,” said J. M. Berger, a fellow at the Brookings Institution.

“But the big question that investigators need to look at is: How much of a role did AQAP play in the actual planning in the final stages of this process?” Mr. Berger said. “They could have given these guys money and training three or four years ago, but when they executed it, it could have been done with money” from other sources.


Eric Schmitt and Mark Mazzetti reported from Washington, and Rukmini Callimachi from Paris. Scott Shane contributed reporting from Washington, and Alan Cowell and Maïa de la Baume from Paris.

Actor’s Finger Points To Charlie Hebdo in Paris Film 44 Days Before It Happened! As Above, So Below


(Before It’s News)




You are probably looking at the screen shots above and wondering why the actress’ hand keeps pointing to Charlie Hebdo on the map. You would probably be even more shocked to realize that this is a screenshot from a movie that released on August 29, 2014, the 241st day of the year [7] with 124 days left [7] until the end of the year. The Charlie Hebdo massacre happened on 1-7! The precise time stamp of when this map sequence takes place is at the 17 minute mark as well!

As Above, So Below released its first trailer on the 114th day of the year, April 24th. The trailer was 2:44 seconds long. We released the last in a series of “As Above, So Below” videos exactly 44 days before Charlie Hebdo would happen!

See the video below for a detailed analysis of this map and the events that led up to the Charlie Hebdo shooting: