London attack suspect may have accessed ‘Dark Web’, documents show

Days after a Muslim family was killed on June 6, digital forensic investigators with London police sought access to a laptop, cellphones, USB devices and an external hard drive belonging to the alleged attacker, Nathaniel Veltman.

In newly-unsealed court documents, police said they were seeking to search the devices for internet browsing data, communications, documents, videos, and pictures in a bid to learn more about the motivations of the alleged attacker and evidence of advanced planning.

London police detectives were also searching for one key piece of information, “evidence of the installation and use of” an internet browser which can access the so-called Dark Web. “[The Dark Web] is a series of encrypted websites on the Internet that are only accessible by using The Onion Router (TOR) and specialized software, most often the TOR Browser,” Det. Const. Stephen Robertson said in a sworn affidavit.

“The most prevalent types of content on the Dark Web are child pornography, illicit markets for drugs, weapons, and other illegal items, hacking, fraud, and terrorism and extremist websites.”

The new information outlining the London police investigation into the murders of the Afzaal-Salman family is revealed in a 271-page document prepared by police to get approval to search the alleged attacker’s apartment and to obtain the vehicle from an impound lot.

The documents also indicate police were searching the accused’s home and vehicle for a “machete in an orange and black sheath,” a “camouflage pocket knife,” a “large serrated knife,” and an axe.

While the search warrant documents provide a detailed account of the aftermath of the attack, interviews with several witnesses and an interview the accused gave to police, almost all the information is covered under a publication ban and cannot be broadcast.

They were released as part of a court motion by a group of media organizations, including Global News.

Police have called the killings “hate motivated,” and several sources familiar with the investigation have previously told Global News that the accused was influenced by the gunman who took 51 lives at two New Zealand mosques in 2019.

Salman Afzaal, 46, his 44-year-old wife, Madiha Salman, their 15-year-old daughter, Yumna, and her 74-year-old grandmother, Talat Afzaal, were all killed the evening of June 6 while the family was out for a walk. The couple’s son, nine years old at the time, survived but was seriously injured.

Veltman, 21, of London, faces four counts of first-degree murder, one count of attempted murder and has also been charged with “murder-terrorist activity.”

‘Hate related material’

In the newly-released search warrant documents, London police said they were interested in searching his apartment and vehicle for: black spray paint, purchase and ownership papers of a black Dodge Ram, three cellphones, two USB drives, an external hard drive and an Acer laptop.

“The Lexar USB and the Kingston USB were both connected on June 6, 2021, mere hours before the murders,” Det. Const. Robertson said in the documents.

“The Kingston USB was removed minutes before Veltman left his residence prior to committing the listed offences.

“Expanded examination of the computer systems and data storage devices for ‘documents’ was appropriate given that there are documents on the device and some appeared to be hate related material and relevant to the listed offences.”

London police declined to comment on the investigation as the case is currently before the courts.

In the aftermath of June 6, the accused left little in terms of an online footprint through traditional social media networks, including three possible Facebook accounts and Twitter which went unused, police said.

“Limited information was available for passive collection on these accounts, possibly due to high privacy settings,” said an RCMP report quoted in the search warrant documents.

Also included in the police search warrant documents was a reference to the Canadian Firearms Registry Online, a gun and licence registry managed by the RCMP for all restricted and prohibited firearms in Canada.“[The CFRO] is an investigative tool that police can use to determine the current status of a licence holder to possess and acquire firearms,” investigators said in the search warrant documents.

Speaking generally, Stephanie Carvin, a former national security analyst, said the use of the dark web could be evidence an individual is aware what they are viewing is “hate speech or illegal.” “It suggests [an accused] understood what he was doing would have been problematic from a law enforcement or national security perspective,” said Carvin, who now teaches at Carleton University

This could also be indicative of “rudimentary” operational planning, she said.

“There are many more extremists than there are violent extremists,” Carvin said. “One indicator that someone may be moving to violence is this kind of basic operational security.

“This is an indication of mindset.”

The accused’s lawyer, Christopher Hicks, said the dark web is a “vague and highly ambiguous term”

“Its actual existence, and any possible access to it, are highly controversial matters,” Hicks said in an email. “Investigators may have searched for evidence that Mr. Veltman had shown an interest in the ‘Dark Web’ – as many in the Republican party apparently have – but there is no evidence of actual successful contact by Mr. Veltman.”

Veltman’s next court appearance is scheduled for April 12 and he’s currently being held at London’s Elgin-Middlesex Detention Centre.

Found this interesting? Then check our main news page where you can find all articles related to Crypto, Crime, Darknet, Security and much more!