For two days, the FBI would not say if the shooting at the Inland Regional Center was terrorism or an unusually elaborate case of workplace violence. One pivotal shift in the investigation appeared to be the discovery of a Facebook post attributed to Tashfeen Malik, 27, who police say carried out the killing spree alongside her husband, Syed Rizwan Farook, 28.
Just after the shooting began, Malik went on Facebook and pledged her allegiance to Abu Bakr al-Baghdadi, the emir of the self-proclaimed Islamic State, the militant group that says it has established a caliphate in Syria and Iraq, according to law enforcement officials. A Facebook official confirmed the posting, speaking on the condition of anonymity due to the ongoing investigation.
The company official said Facebook identified and removed the post a day after the attack, saying that any content praising an Islamic State leader violated its community standards. The company said that content remained available for a period of time after deletion and that it was cooperating with law enforcement.
Comey declined to discuss the Facebook posting.
“We are aware of it,” he said during a briefing with reporters. “We have a lot of evidence beyond that we are looking at but it is too early for me to put it in context or comment on it.”
Farook had maintained a Facebook page that was deleted before the shooting, according to Rita Katz, executive director of the SITE Intelligence Group, which tracks online communications of extremists.
A post on an Islamic State-linked blog on Friday claimed that the attack was carried out by Islamic State supporters, the SITE group reported. The post on the Amaq News Agency site cited the recent attacks in Paris, which killed 130 people.
Malik and Farook killed 14 people, most of them county workers, and wounded 21 others in the Wednesday morning attack. The shooters were killed in a frenzied gun battle with police later in the day.
“This is now a federal terrorism investigation led by the FBI,” Comey said.
The Islamic State has quickly asserted responsibility for last month’s massacre in Paris and other attacks, but the group does not appear so far to have done the same for the San Bernardino massacre. It was unclear if the attack — which would be the deadliest terrorist attack in the United States since Sept. 11, 2001 — was inspired by the group or specifically directed in some way.
Even as the focus of the investigation pivoted fully to terrorism, cable news networks on Friday showed journalists inside their home. Footage broadcast on MSNBC beamed out images of a baby’s crib, personal photographs, children’s toys and shredded paper.
Police said the two attackers in San Bernardino had assembled a massive arsenal of explosives and ammunition in their home, which officials say suggested a degree of planning and raised the possibility of further bloodshed.
The shooters also sought to cover their tracks by damaging some of their personal electronic devices, as authorities found two crushed cell phones and other “evidence that [the shooters] attempted to destroy their digital fingerprints,” said David Bowdich, assistant director in charge of the FBI’s Los Angeles office.
Investigators said the couple had managed to stay off the FBI radar and apparently didn’t take any overt steps to make contact with Islamic State operatives living overseas.
“This is not Jihad 101,” the senior law enforcement said, saying that the attackers had not taken the usual steps commonly seen in previous terrorist attacks. Other attackers or people accused of trying to travel overseas seeking training have made contact with terrorists through social media. In some cases, supporters of the Islamic State have shared the group’s propaganda.
The Islamic State uses sophisticated propaganda to recruit adherents and has called for lone-wolf attacks in the United States and other countries, something U.S. officials have called an immediate danger.
Saudi intelligence is investigating Malik’s time in that country, and the government there has not confirmed when she lived there or whether she left with Farook when he visited for nine days in the early summer of 2014.
But a Saudi official said that Malik’s name does not appear on any watch list there, and that they have uncovered no evidence of contacts between her and any radical individual or group during her time there. The official said that Malik had lived with her father “off and on” in Saudi Arabia over the years, apparently traveling back and forth an undetermined number of times to Pakistan.
Since the massacre Wednesday — which also wounded 21 people — officials had been scrambling to determine whether they were looking at a terrorist attack or an extremely unusual and lethal case of workplace violence.
Farook was a county health worker born in Chicago, while Malik had originally entered the United States on a visa. In the days after the attack, investigators found no outward sign of Islamist radicalization, psychological distress or a desire for mayhem.
Two criminal defense attorneys representing Farook’s mother and three siblings held a news conference Friday and offered insight into the slain shooters, describing the husband as a loner and the wife as extremely conservative religiously, to the point that she would not be in the same room as her male in-laws. Malik’s brother-in-law had never seen her face.
“She did maintain certain traditions in terms of prayer and fasting. She chose not to drive voluntarily. She was a very, very private person. She kept herself pretty well isolated,” family attorney David Chesley said.
“Syed didn’t want any fathers or brothers or brothers-in-law in the same room when she would also be there,” said another family attorney, Mohammad Abuershaid. He added: “The family was not that close to him. He was kind of like the lone wolf.”
But the attorneys emphasized that there is no established link between Farook, Malik and terror organizations, and Chesley said it is inappropriate to assign culpability to Muslims broadly when someone who is Muslim is involved in a shooting.
Farook and Malik had a six-month-old daughter. The baby is in child protective services,the attorneys said. They said they think they won’t be able to get the baby back to family members – the child may be adopted by an aunt – until at least Monday, when there is a court hearing.
A senior law enforcement official said Friday that the attack in San Bernardino evoked the mass shooting in Chattanooga, Tenn., earlier this year, when 24-year-old Mohammad Youssef Abdulazeez opened fire at an armed forces recruiting center and a Navy Reserve center, killing five people. In that case, the official pointed out, it took days for the FBI to sort out what had happened, and some questions remain unanswered.
Some evidence collected in California was flown across the country on Thursday so that the FBI could examine it in its lab, Bowdich said at an earlier news conference. “We’re hoping some of that digital media … will help us,” he said.
The FBI’s Operational Technology Division in Quantico, Va., has units that can try to retrieve data from smashed, burned and damaged devices, including cellphones, hard drives and flash drives.
A computer analysis team there can look to pull call records, pictures, GPS location data, address book information and other data from the devices, while a forensic analysis unit tries to restore and enhance audio and visual data. Any data that is pulled would go to analysts in the various units investigating the shooting.
Farook, who had a college degree in environmental health and a steady job as a health inspector, traveled to Saudi Arabia and Pakistan last year and returned with Malik, whom he had met online.
Authorities have said the two were not on any watch lists. A senior U.S. law enforcement official said that Farook was in contact with persons of interest with possible ties to terrorism but that these were not “substantial” contacts.
Farook had been with his colleagues at the party earlier in the morning before the attack, police said. Authorities could not say conclusively whether there had been a dispute that led Farook to leave the party. But police said a survivor of the shooting told them that Farook slipped away before the massacre.
Farook’s supervisor, Amanda Adair, who also went to college with him at California State University at San Bernardino, said he “got along with everybody, but he kept his distance.” She said that she “can’t imagine [the shooting] was about work” and that she had no inkling that Farook had the capacity for such violence.
Without a firmly established motive, authorities had previously said that they could not determine whether they were dealing with terrorists, a disgruntled worker who had enlisted his wife in his cause, or some kind of hybrid of those two scenarios.
Police said Farook and Malik were dressed in tactical gear and armed with rifles, handguns and multiple ammunition magazines when, at about 11 a.m., they strode into a conference room where about 80 people were gathered for a staff training session that was transitioning into a holiday party.
They opened fire, spraying 65 to 75 rounds and hitting more than a third of the people. A bullet struck a sprinkler head, and the sprinklers began soaking the room as the fire alarms went off. The shooters fled in a rented black Ford Expedition, leaving behind a bag with three pipe bombs designed to be triggered with a remote-control device from the SUV. The device malfunctioned.
San Bernardino police Lt. Mike Madden, the first law enforcement officer to arrive at the center, described the fresh scent of gunpowder and a horrifying scene for which years of training had not fully prepared him.
“The situation was surreal,” Madden said Thursday. “It was unspeakable, the carnage we were seeing.”
That tip led police to check Farook’s name, which led to the discovery that he had rented an SUV that matched the description of the getaway car.
Soon, authorities were staking out the couple’s home in Redlands, a suburb 15 minutes to the east. Several hours after the shooting, the SUV rolled by and then sped away, and police chased it.
The SUV stopped on San Bernardino Avenue, a few miles from the massacre. Cellphone videos captured the furious gun battle that followed. Police said the couple fired 76 rifle rounds; police fired 380.
Farook and Malik died at the scene. Two officers were injured, but the wounds were not life-threatening. A third person detained after the shootout was determined to have no involvement in the case.
The SUV, so riddled with bullets that it looked as if it had been hit with a bomb, was due back at the rental agency that day, police said.
Police found more than 1,600 rounds of ammunition on or near the couple, suggesting that they were prepared for a long siege. Police recovered two assault rifles and two 9mm pistols, all legally purchased, according to the Bureau of Alcohol, Tobacco, Firearms and Explosives.
Comey said Friday that investigators had located the individual who purchased the two rifles and cleared them of any involvement. The other two weapons were traced to one of the assailants, according to Dannette Seward, an ATF spokeswoman.
Freelance writers Martha Groves and William Dauber in San Bernardino; staff writers Missy Ryan, Eli Saslow, Abby Phillips and Thomas Gibbons-Neff in San Bernardino; and staff writers Karen DeYoung, Ellen Nakashima, Greg Miller, Brian Murphy, Lindsey Bever, Niraj Chokshi, Ann Gerhart, Sari Horwitz, Elahe Izadi, Wesley Lowery, Eli Saslow, Kevin Sullivan, Julie Tate, Justin Wm. Moyer, Yanan Wang, Sarah Kaplan and Alice Crites in Washington contributed to this report.
[This story has been updated. First published: 9:42 a.m.]