Advertisement

London attack suspect may have accessed ‘Dark Web’, documents show

Click to play video: 'Docs show alleged London, ON attacker may have accessed ‘dark web’'
Docs show alleged London, ON attacker may have accessed ‘dark web’
WATCH: There's new information outlining the police investigation into the deaths of a Muslim family in London, Ontario. Four members of the Afzaal family died after being run over by the driver of a pickup truck in June 2021. As Mike Drolet reports, new court documents reveal the alleged attacker may have been radicalized on the dark web – Mar 15, 2022

Days after a Muslim family was killed on June 6, digital forensic investigators with London police sought access to a laptop, cellphones, USB devices and an external hard drive belonging to the alleged attacker, Nathaniel Veltman.

In newly-unsealed court documents, police said they were seeking to search the devices for internet browsing data, communications, documents, videos, and pictures in a bid to learn more about the motivations of the alleged attacker and evidence of advanced planning.

London police detectives were also searching for one key piece of information, “evidence of the installation and use of” an internet browser which can access the so-called Dark Web.

“[The Dark Web] is a series of encrypted websites on the Internet that are only accessible by using The Onion Router (TOR) and specialized software, most often the TOR Browser,” Det. Const. Stephen Robertson said in a sworn affidavit.
Story continues below advertisement

“The most prevalent types of content on the Dark Web are child pornography, illicit markets for drugs, weapons, and other illegal items, hacking, fraud, and terrorism and extremist websites.”

The new information outlining the London police investigation into the murders of the Afzaal-Salman family is revealed in a 271-page document prepared by police to get approval to search the alleged attacker’s apartment and to obtain the vehicle from an impound lot.

The documents also indicate police were searching the accused’s home and vehicle for a “machete in an orange and black sheath,” a “camouflage pocket knife,” a “large serrated knife,” and an axe.

While the search warrant documents provide a detailed account of the aftermath of the attack, interviews with several witnesses and an interview the accused gave to police, almost all the information is covered under a publication ban and cannot be broadcast.

They were released as part of a court motion by a group of media organizations, including Global News.

Police have called the killings “hate motivated,” and several sources familiar with the investigation have previously told Global News that the accused was influenced by the gunman who took 51 lives at two New Zealand mosques in 2019.

Story continues below advertisement

Salman Afzaal, 46, his 44-year-old wife, Madiha Salman, their 15-year-old daughter, Yumna, and her 74-year-old grandmother, Talat Afzaal, were all killed the evening of June 6 while the family was out for a walk. The couple’s son, nine years old at the time, survived but was seriously injured.

Veltman, 21, of London, faces four counts of first-degree murder, one count of attempted murder and has also been charged with “murder-terrorist activity.”

‘Hate related material’

London police said they were interested in searching his apartment and vehicle for: black spray paint, purchase and ownership papers of a black Dodge Ram, three cellphones, two USB drives, an external hard drive and an Acer laptop, according to the newly unsealed documents.

“The Lexar USB and the Kingston USB were both connected on June 6, 2021, mere hours before the murders,” Det. Const. Robertson said in the documents.

“The Kingston USB was removed minutes before Veltman left his residence prior to committing the listed offences.

“Expanded examination of the computer systems and data storage devices for ‘documents’ was appropriate given that there are documents on the device and some appeared to be hate related material and relevant to the listed offences.”

Click to play video: 'National Council of Canadian Muslims releases recommendations to combat racism, hate'
National Council of Canadian Muslims releases recommendations to combat racism, hate

London police declined to comment on the investigation as the case is currently before the courts.

Story continues below advertisement

In the aftermath of June 6, the accused left little in terms of an online footprint through traditional social media networks, including three possible Facebook accounts and Twitter which went unused, police said.

“Limited information was available for passive collection on these accounts, possibly due to high privacy settings,” said an RCMP report quoted in the search warrant documents.

Also included in the police search warrant documents was a reference to the Canadian Firearms Registry Online, a gun and licence registry managed by the RCMP for all restricted and prohibited firearms in Canada.

“[The CFRO] is an investigative tool that police can use to determine the current status of a licence holder to possess and acquire firearms,” investigators said in the search warrant documents.

Speaking generally, Stephanie Carvin, a former national security analyst, said the use of the dark web could be evidence an individual is aware what they are viewing is “hate speech or illegal.”

Story continues below advertisement
“It suggests [an accused] understood what he was doing would have been problematic from a law enforcement or national security perspective,” said Carvin, who now teaches at Carleton University

This could also be indicative of “rudimentary” operational planning, she said.

“There are many more extremists than there are violent extremists,” Carvin said. “One indicator that someone may be moving to violence is this kind of basic operational security.

“This is an indication of mindset.”

The accused’s lawyer, Christopher Hicks, said the dark web is a “vague and highly ambiguous term”

“Its actual existence, and any possible access to it, are highly controversial matters,” Hicks said in an email. “Investigators may have searched for evidence that Mr. Veltman had shown an interest in the ‘Dark Web’ – as many in the Republican party apparently have – but there is no evidence of actual successful contact by Mr. Veltman.”

Veltman’s next court appearance is scheduled for April 12 and he’s currently being held at London’s Elgin-Middlesex Detention Centre.

Advertisement

Sponsored content

AdChoices