In photos posted on his Facebook page, the Abu Sayyaf Group militant believed to have beheaded two Canadians in 2016 wears a big self-satisfied smile, like he has nothing to worry about.
His name is Behn Tatuh.
An investigation by the intelligence research group iBrabo has uncovered not only Tatuh’s Facebook page, but also a troubling possible explanation for his longevity: he may have been trained by the Philippine police.
WATCH: Trudeau reacts to report of Facebook presence of militant who beheaded Canadians
“You see him on his Facebook profile and he’s smiling,” said Jeff Weyers, senior analyst at Waterloo, Ont.-based iBrabo, which was to release a report on its investigation on Tuesday. “It’s infuriating because you think to yourself, he shouldn’t be allowed to smile. He’s a killer, right? But there he is.”
The executions of Ridsdel and Hall, who were kidnapped from a resort in the southern Philippines in 2015, prompted Prime Minister Justin Trudeau to vow to bring those responsible to justice, “however long it takes.”
But Weyers said Tatuh was still posting updates on Facebook as recently as early November, when his page was taken down, possibly because he had been increasingly posing with the ISIS flag.
iBrabo’s most significant discovery was a photo, posted on Tatuh’s Facebook page, that appears to show him in a Philippine National Police uniform consistent with that worn by the Special Counter Insurgency Operation Unit, or SCOUT.
SCOUTs are trained in jungle survival, improvised explosive devices, team operations, leadership, mission planning, patrols, amphibious assault and firearms — all skills that would make Tatuh more difficult to catch.
Whether Tatuh served in the police before turning to militancy or infiltrated to benefit from training is unknown. He looks younger in the photo allegedly showing him in uniform. His name can be seen written on the base of his ammunition, which iBrabo said “would be typical of officers being responsible for their issued kit.”
While it’s also possible he was playing dress-up, Weyers doesn’t think so.
“With that congruence of factors going on we have strong reason to believe that he was at some point a police officer within the PNP. And we’ve got nothing to refute that at this time,” Weyers said.
“The question becomes, if we take on the face what he’s trying to tell us, that he is a police officer or was a police officer, when did that transition happen? When did he defect?”
SCOUT training “would put him in an ideal position for a leadership role within Abu Sayyaf,” he added. “Everything that you would need to know to attack Abu Sayyaf, now you have this member within Abu Sayyaf that can counter all of those different things that are happening to them.”
“So it’s a really significant finding in terms of our investigation and it also points to the difficulty that the Philippine army is having in trying to stop, get rid of, remove Abu Sayyaf,” he said.
The RCMP said it was investigating the killings but would not answer any further questions.
“The RCMP is aware of the independent report,” Sgt. Marie Damian said. “We continue to work with our international partners regarding the ongoing criminal investigation into the deaths of Canadians John Ridsdel and Robert Hall in the Philippines.”
WATCH: Alleged executioner of two Canadians seen in photo wearing uniform of Philippine police counter-insurgency unit.
The iBrabo report is a key development in the cases of Hall and Ridsdel, who were abducted by gunmen on Samal island on Sept. 21, 2015, along with a Norwegian man and a Filipino woman.
Weeks after the kidnapping, Abu Sayyaf began releasing a series of videos demanding millions for the release of the hostages. Trudeau responded that the government of Canada did not pay ransoms.
Following the kidnappings, iBrabo began monitoring the online activities of Abu Sayyaf as well as its affiliate, the Islamic State in Southeast Asia, and found that many of the fighters were active on Facebook. The analysts, Weyers and Prof. Camie Condon, did so on their own initiative rather than under contract with police.
WATCH: Ontario firm may have found terrorist who beheaded two Canadian men
“I think, like all Canadians, we were shocked by what was taking place,” Weyers said. “And having our skill set and knowing that Abu Sayyaf was very active on social media, we saw an opportunity to see if there was any way that we could provide input or gather intelligence on the group ourselves.”
“And so when the initial hostage videos, the ransom videos, came out, we started to monitor Abu Sayyaf on primarily Facebook.”
When the deadline for payment expired, Abu Sayyaf released a video showing an unmasked militant beheading Ridsdel with a sword. Two months later, another video showed the killer doing the same to Hall.
The other hostages were released.
The Philippine military said in April 2017 it had killed the Abu Sayyaf commander responsible for the Canadians’ kidnapping and deaths, but his face does not match the executioner seen in the videos.
Who is Tatuh?
When iBrabo analysts came across Tatuh’s Facebook page, they immediately noticed his striking resemblance to the executioner. Using facial-recognition software, they compared the Facebook photos with the execution video, and they were a close match.
They were also able to find Tatuh in the background of Abu Sayyaf kidnapping videos as far back as 2014.
Philippine army reports have described Tatuh — who also goes by Boy Tattoo, Abu Ben Tattoo, Bhen Quirino and Ben Yadah — as a sub-leader within Abu Sayyaf Group, which Canada calls a militant Islamist group that “uses terrorism for profit.”
But Tatuh appears to be an ambitious figure in the group. On Facebook, an associate called him the “Big Boss,” and fighters often pose for pictures with him. Posting the police photo and showing his face while killing the Canadians may be signs of his leadership aspirations.
“The fact that he stepped forward to be the executioner in both John Risdel and Robert Hall’s murders, there’s a reason for that. He’s looking to take on a broader role,” Weyers said. “And having that skill set, that SCOUT training, would also accelerate him up the ladder.”
Where is Tatuh?
Tatuh’s cell operates in the Patikul mountain area of Sulu, iBrabo said. But despite initial enthusiasm to get him, there is little evidence of an ongoing manhunt, the report said.
Immediately after the Hall and Ridsdel killings, Tatuh went off the radar, but he resurfaced this year. According to Philippine military reports, “Ben Quirino” was injured in a May 14 battle near the village of Maligay.
On June 20, “Ben Tattoo” helped kidnap relatives of the mayor of Sulu, and on Aug. 23, the 41st Infantry Battalion engaged an Abu Sayyaf contingent under his command, according to the military reports.
Tatuh’s Sulu cell may now be hiding the regional ISIS leader, Malaysian Amin Baco. Tatuh’s increasing use of ISIS imagery on his Facebook page suggests “a strong possibility Tatuh may now be acting directly under Baco’s command,” the iBrabo report said.
WATCH: Family of Canadian beheaded by terrorists demanding policy changes