Authorities scrutinizing Twitter account in Florida naval air station attack

Investigators are scrutinizing a Twitter account they suspect is linked to the Saudi air force officer who carried out a deadly attack at Naval Air Station Pensacola on Friday, a source familiar with the case tells CNN.

Just minutes before authorities were first alerted to the deadly shooting carried out by Mohammed Alshamrani at Naval Air Station Pensacola in Florida on Friday morning, a Twitter account aligning with his name posted a message that raises the possibility the attack was inspired by al Qaeda and its founder, Osama bin Laden.

The first call alerting law enforcement of an incident at the Florida base came about 6:51 a.m. (7:51 a.m. ET), according to the Escambia County Sheriff’s Office.

Twelve minutes earlier, at 6:39 a.m., a Twitter account with the handle @M7MD_SHAMRANI posted a message addressed to the American people, declaring hate for Americans because of their “crimes” against Muslims. The message also repurposed words used by bin Laden and the American al Qaeda terrorist cleric Anwar al-Awlaki.

Over the weekend, US officials stressed the investigation is in its early phases, and that they were working to determine the gunman’s motive. “We don’t know yet if he was acting alone. The FBI is investigating, and they’ve been interviewing, interrogating other Saudi students,” national security adviser Robert O’Brien said on CBS’ “Face the Nation” on Sunday morning.

“To me, it appears to be a terrorist attack,” O’Brien said.

Rachel Rojas, the FBI special agent leading the investigation, said at a news conference that to take advantage of certain “investigative techniques,” the FBI is working with “the presumption that this was an act of terrorism.” She added, “Members of the FBI’s Joint Terrorism Task Force and the FBI’s Counterterrorism Division are working tirelessly to discern if any possible ideology … may have been a factor in this attack.”

CNN has been unable to verify the source of the tweet containing the “hate” message to the American people, which was previously reported on by SITE Intelligence Group. But the source familiar with the case told CNN that investigators are aware of a Twitter account with a name similar to the shooter’s that posted anti-American writings shortly before the attack. The source could not confirm the account is connected to the shooter but investigators are viewing it as such, and consider it part of a picture of the shooter’s potential radicalization.

Monday afternoon, the FBI’s Jacksonville, Florida, field office, which is leading the investigation, tweeted: “We have received information that the shooter was active on social media, but we cannot yet release any specifics. A suspect’s digital footprint, to include use of social media, is pursued in these types of investigations.”

The Twitter message posted Friday morning made no reference to an impending attack.

The Twitter account is listed as being created in 2012. Before it was taken down on Friday afternoon, CNN was able to capture some of the tweet activity by the account.

When asked about the account, Twitter spokeswoman Aly Pavela confirmed the account was suspended and said, “That’s all we have to share.”

Given the shooter was training at a US naval air station, it was notable that the Twitter account @M7MD_SHAMRANI retweeted a Military Times post about last month’s fatal crash at Vance Air Force Base in Oklahoma.

More details about the Twitter account have now emerged. Friday, within hours of the attack, a Saudi activist who describes himself as documenting cases of religious radicalization posted a 28-minute video on YouTube scrolling through the @M7MD_SHAMRANI Twitter account. The footage provides more extensive information about the Twitter account than CNN was able to retrieve before it was suspended. In analyzing the footage over the weekend, CNN was not able to find any discrepancy between the information it retrieved from the Twitter account and the footage posted by the Saudi activist.

The activist told CNN he recorded the Twitter account because he expected Twitter to take it down. “Of course I care about the incident,” he said. “Because as a Saudi national, I understand the negative impacts that such incidents have on every religion and country.”

CNN’s analysis of the YouTube footage reveals several interesting details about the @M7MD_SHAMRANI account. The account followed 56 Twitter accounts. These included several official Saudi Twitter accounts including those of the Ministry of Defense and Ministry of Education. The account also followed several official US military Twitter accounts, including Secretary of Defense Mark Esper, US Central Command, US Air Forces Central Command, the chief of naval operations, and Naval Air Training at the Twitter handle @CNATRA.

Naval Air Training oversees the Naval Air Training Command and is based in Corpus Christi, Texas. It states on its website, “The Mission of Naval Air Training Command is to train the world’s finest combat quality aviation professionals.”

The mix of accounts @M7MD_SHAMRANI was following may be one of the reasons investigators view the account as being connected to the shooter.

Another reason may be some of the Twitter activity. In October, the account retweeted an episode of an Arabic-language podcast about F-15 fighter jets. The same month, it posted a tweet in English simply stating “#every20minutes Operation Check :)”

The Twitter hashtag #every20minutes was a popular hashtag circulating that month in which people tweeted often humorous examples of what they or others did every 20 minutes.

It is not clear what “Operation Check” referred to but “operational check” is a term used by aviators.