IS Media Comments on San Bernardino Show Confusion

Two days after the attack in San Bernardino, a statement from an Islamic State (IS)-linked media group broke what had been a relatively quiet response from the jihadist community. The message, released on December 4, 2015 by the ‘Amaq News Agency, stated of the attackers, Syed Farouk and Tashfeen Malik:

The two attackers shot inside the center, causing the killing of 14 people and the wounding of 17 others, and fled, before being killed later after a gunfire exchange with American police, who chased them for several hours.

After the ‘Amaq statement, one of IS’ main Twitter accounts likewise posted a picture of Farook and Malik along with the message:

The two monotheist supporters, the executioners of California attack, Tashfeen Malik and her husband Syed Farooq, who killed 18 American foreigners

Note: IS members are not allowed to show women’s' faces, hence the blurring of Maliks face in this image tweeted by the user.

These statements, along with others to follow, beg the questions: If this attack was indeed planned by IS, why did the group wait so long to comment? Could it be that the couple was not working under the direct advisory of IS leadership?

Breaking down the Statements

A hint toward an answer might come from the aforementioned statement by ‘Amaq News Agency. First, contrary to such IS claims as those pertaining to Paris and Tunisia, wherein IS released the claim through official channels, it used a prominent but unofficial media group under its media umbrella to comment on the attack. And, to that point, it was released two days later, as opposed to other attack statements by the group, which are usually released hours after their respective attacks.

Second, the statement did not refer to the San Bernardino shooters as “soldiers of the Caliphate” as past lone wolf and terror cell attackers have been referred to. For instance, in IS’ claim for the November 12, 2015 attacks in Beirut, the group stated of the attack and the attackers, “In a unique security operation for which Allah the Almighty gave facilitation, soldiers of the Caliphate were able to park a booby-trapped motorcycle and detonate it..” Similarly, the groups claim for the November 13 Paris attacks stated:

...a faithful group of the soldiers of the Caliphate, may Allah dignify it and make it victorious, launched out, targeting the capital of prostitution and obscenity, the carrier of the banner of the Cross in Europe, Paris...

Instead, the statement referred to Farook and Malik as “supporters of the Islamic State” instead of “soldiers.” This could very well be an indication that IS leadership did not work with the couple and was not aware of their planned attack.

IS fighters and supporters began to flood the internet with celebratory and threatening statements and artwork after the release of the ‘Amaq statement. IS accounts even began disseminating a graphic stating that IS supporters “must participate” in using an Arabic hashtag translating to “#California” to celebrate the attack:

Important and urgent

22 Safar [Corresponding to December 4 at the time of release]

Campaign on Hashtag


all supporters of the State of the Caliphate must participate

Other statements and threats touted IS as a borderless entity, and that the group had “warned the US of consequences of their actions against Muslims in Syria/Iraq.” One picture showed the IS-affiliated black flag atop a city flooded in blood, stating, “Rivers of Blood Await America.”

More Statements and More Confusion

The next day, Saturday, IS would officially comment on the attacks in the various language editions of its al-Bayan Radio news bulletin for December 5, 2015. Throughout these various editions, it was most interesting to see that IS was not consistent in describing its connection to the San Bernardino attackers. The Arabic edition mentioned them only as “supporters”:

Where two of the supporters of the Islamic State attacked a few days ago a center in the city of San Bernardino in the American State of California, opening fire inside the center, which resulted in the elimination of fourteen people and the injury of more than twenty others, and unto Allah is all praise and gratitude. There was then an exchange of fire with the American police, who chased them for hours, causing their deaths. We ask Allah to accept them among the martyrs.

The English edition called them “soldiers” of IS, while the Russian edition called them “mujahideen.” Furthermore, the French news bulletin, which came about three hours after the aforementioned Russian edition, mentioned them only as “sympathizers.”

...based on the ‘Amaq statement and corresponding ones...we can conclude at this stage that IS is not claiming involvement in the San Bernardino attack.

Indeed, based on the ‘Amaq statement and corresponding ones (along with a lack of any formal official communique), we can conclude at this stage that IS is not claiming involvement in the San Bernardino attack. When IS claims an attack, it issues dedicated communiques in various languages. For example, IS claimed the Paris attack on November 14, just hours after the attack, in nearly half a dozen languages—not only in text, but also in audio.

What the ‘Amaq and Bayan statements appear to do, though, is embrace the attack as a part of IS' movement. Doing so would, naturally, be beneficial to the group in that it gets to reap attribution to the attack without actually helping to plan or finance it.

Still Little Known about Attackers’ Online Presences

Officials have speculated that Farook and Malik, like many other cells in recent years, were indeed “self-radicalized.” If so, it will only speak further volumes to the power of jihadi propaganda. In the age of the IS and al-Qaeda (AQ) online movements, one does not necessarily need connections to those on the inside to perform an attack on behalf of a group. Such a confirmation would be a chilling reminder that we are not only fighting terrorists with internet connections, but an idea—something much harder to combat.

A crucial piece of answering further questions will lie in what investigators can recover of Farouk’s social media presence. In our investigations at SITE, we found that Syed had a Facebook page which he deleted at some point before the attack, though it is not clear exactly when he did this.

Regardless, it is abundantly clear that the two were planning an attack for some time.

Syed’s account deletion is notably similar to that of Chattanooga shooter Mohammad Abdulazeez. Prior to his attack on two military installations, Abdulazeez deleted much of his social media presence, just as Farook had. Additionally, many questions remained regarding his trip to Jordan prior to the attack—similar to others pertaining to Syed’s reported travels to Saudi Arabia and Pakistan.

Regardless, it is abundantly clear that the two were planning an attack for some time. The tactical gear, hordes of ammunition, and constructed pipe bombs held by the couple strongly indicate that they planned to strike some sort of target—whether it was Syed’s work party or some other high-profile event/location.

Simply put, the internet is the modern-day training camp for jihadis, and may be what enabled Farook and Malik to make pipe bombs with remote detonators, a weapon jihadist regularly encourage the use of with various manuals. Perhaps the most prominent of these disseminated manuals are those provided in Inspire, the English-language magazine of al-Qaeda in the Arabian Peninsula (AQAP). Various issues of the magazine have given detailed manuals for creating pipe bombs (among other types of IEDS), and has informed many off-shoot manuals also distributed by jihadis.

Various manuals from Inspire have even been compiled into a publication called the “Lone Mujahid Pocketbook,” which was released by AQAP on March 1, 2013. The compilation contains, among other weapons types and components, guides for remote control detonation and pipe bombs.

Malik’s reported pledge to IS’ leader also speaks to the second issue of IS’ Dabiq Magazine. The issue, released on July 27, 2014, called on supporters who “cannot perform hijrah [migration] for whatever extraordinary reason” to “publicize” their pledges to IS online.


We shouldn’t take IS’ statements as case-closing information. We still do not know which group Farook and Malik may have been in contact with. Noting IS’ likely ignorance of the attackers’ plans, it could very well be that they were in contact with leaders from AQ-aligned groups as well. It’s simply too soon to say.

Regardless, this case shows once more the critical role that social media plays in radicalization—whether it be by direct communication with recruiters, or the disturbing wealth of jihadi propaganda and attack manuals easily available online. As long as jihadists continue to exploit the internet in these ways, the violence abroad will—in many ways—continue to creep into other lands as it did in San Bernardino.

2015 Retrospective: How the Fall of the IMU Reveal...
IS Shifts Propaganda Archive to the Dark Web