The Islamic State group's rushed claim of responsibility for Thursday's Paris shooting suggests it wanted to heighten the attack's impact, but in its haste may have mixed up the attacker's identity.
IS's initial claims of responsibility are usually released by their self-styled news agency Amaq on the social media application Telegram.
But Thursday's claim, which came briefly after the attack, was unusual both in its alacrity and also in identifying the attacker by his epithet: Abu Yussef al-Belgiki, or the Father of Yussef the Belgian.
In previous attacks in the West, claims on Amaq often came up to a day later. For example, IS claimed an October Hamburg stabbing almost two weeks later.
"The claim was much faster than it has ever been for this kind of attack," said Charlie Winter, a senior research fellow with the International Centre for the Study of Radicalisation and Political Violence at King's College, London.
"The sooner the claim comes after the attack, the more easy it is for the organisation to amplify it," he added.
For their more spectacular attacks, the Amaq bulletin -- often a terse sentence saying the attacker belonged to IS -- is often followed by a longer statement with details on the attack and assailant.
This second statement, published on IS's "Nasher" Telegram accounts, may be followed by a picture of the attacker or a video of him pledging allegiance to IS, again sometimes days later.
But in the case of the latest Paris attack, in which the shooter killed a policeman, no further statement was forthcoming.
The identification of the attacker by Amaq, and naming him as a Belgian rather than the French assailant who was shot dead as he fled, also raised questions.
The 39-year-old assailant, Karim Cheurfi, had a long criminal record and had been briefly arrested on suspicion of wanting to attack police.
- Direct communication? -
He may have identified himself as Belgian in communications with IS handlers, but that is unlikely. French IS members are usually identified as such, with the epithet al-Faransi, or "the Frenchman".
"The unusual willingness of IS to provide an alleged kunya (epithet) after the commission of yesterday's shooting in Paris suggests there may be more here than meets the eye," Jade Parker, an expert on IS, said on Friday.
"Whether IS had foresight of the event, mistook yesterday's attacker for someone else or simply made an imbecilic error remains to be seen," said Parker, Senior Research Associate on Terrorist Use of the Internet at TAPSTRI, a private counterterrorism firm.
Another expert on the jihadists, Amarnath Amarasingam, said Amaq's identification of the attacker and his description as an Islamic State "fighter" meant "they likely thought someone they knew had carried out the attack".
"It's probably why they were confident enough to name him," said Amarasingam, a senior research fellow with the Institute for Strategic Dialogue think tank.
The mystery grew after police found a handwritten note praising IS near the slain attacker.
It suggested that he had wanted the group to be aware of his loyalties, possibly through media reports.
In its propaganda, IS had called on attackers in the West to leave behind such notes to enable the group to claim responsibility.
But the speed of the claim also suggested that IS had advance knowledge of the attack, and the presumed identity of the assailant.
"Let's say the ID of the guy was correct. What that claim demonstrates undeniably was the attacker was in direct communication with someone who has a line straight to Amaq," said Winter.
"It could be they thought one guy was carrying out the attack and it turned out to be another. It could just be they were plain wrong."