Computer

Arrest, computer use of defendant in deadly attack on Muslim family in London, Ontario detailed in new documents

Arrest, computer use of defendant in deadly attack on Muslim family in London, Ontario detailed in new documents

The man accused of a fatal vehicle attack on a Muslim family last year in London, Ont., was kneeling and wearing a military-style green helmet when police found him in the parking lot of a center commercial minutes after the incident, recently released court documents reveal.

The 271 pages unsealed by the Ontario Superior Court of Justice also show what police were looking for in Nathaniel Veltman’s truck and apartment, what electronic devices were found, and what searches were done using dark web.

Veltman, 21, was voluntarily arrested in the parking lot of Cherryhill Mall, about seven kilometers east of where the attack happened on June 6, 2021, according to court documents, which detail several reports of witnesses and police collected immediately after the attack.

Four members of the Afzaal family were killed while standing on the pavement at the intersection of Hyde Park Road and South Carriage Road.

Prosecutors allege the defendant intentionally drove his truck into the family when the five were out for an evening drive.

Salman Afzaal, 46, his 44-year-old wife, Madiha Salman, their 15-year-old daughter, Yumna, and his 74-year-old grandmother, Talat Afzaal, have died. The couple’s nine-year-old son, Fayez, was seriously injured but survived.

Veltman was charged with four counts of first degree murder and one count of attempted murder, with associated terrorism charges.

The truck suffered extensive damage, documents show.

According to the documents, an officer arrived at the mall and found a Dodge Ram truck, which had extensive front end damage and smoke coming from its engine block.

The documents indicate that the police wanted to search Veltman’s truck for a machete in an orange and black scabbard. Their wanted list also included a serrated knife, an airsoft gun, and an axe.

Last November, CBC News and other outlets went to court to lift the sealing order for two search warrants from June 12 and June 30.

Lawyers for the defendant in Toronto had objected, saying it could compromise Veltman’s right to a fair trial. The Crown argued that the disclosure of some of the information related to the sealing orders attached to the search warrants can occur without significant risk to Veltman.

Large parts of the 271 pages of documents remain covered by a publication ban.

Laptop used to access the dark web

A significant portion of the information accessed by the media includes information on digital devices and software, including three cell phones and a laptop with the ability to use the dark web.

The documents indicate that The Onion Router (TOR) was installed on the laptop, allowing the user to anonymously access dark web content that is not indexed by search engines and requires software special or access authorization.

At the intersection where four members of the Afzaal family were killed on June 6, 2021, people continue to lay flowers, signs and condolence notes as seen in this photo taken on Monday. (Andrew Lupton/CBC)

A detective involved in examining the devices said documents were found and “some appeared to be hate-related material and relevant to the listed offences”.

Another detective said the search for Veltman’s electronic devices was relevant to understanding his “motives and mental state”.

Police found 68 different passwords and accounts on Veltman’s apartment laptop. They also discovered a piece of lined paper on the kitchen table that detailed speeds and percentages.

Technical experts give their opinion

Cybersecurity and technology analyst Ritesh Kotak said in a CBC interview that access to the dark web is important because it can be a place where illegal activity and extremist views can thrive.

“Because of its anonymity, there are forums and chat rooms of extremist groups conversing there,” the Toronto-based analyst said. “It is very difficult to obtain an IP address to identify an individual at a location.”

Kotak stressed that use of the dark web is not in itself an indicator of illegal or harmful behavior – activists sometimes use it to avoid censorship in countries where access to the web is controlled.

Stephanie Carvin, a professor at Carleton University in Ottawa whose research focuses on terrorism, law and technology, was also interviewed by CBC.

An earlier memorial at the crash site at the intersection of Hyde Park Road and South Carriage Road. (Greg Bruce/CBC)

Carvin said places where extremist views can be seen and shared already exist on the “surface web.” However, in the context of a murder investigation, use of the dark web could indicate an attempt to conceal shared and accessed information about methods of carrying out an attack, she said.

“If this person was using something like the Onion Browser, it’s much more likely to me that it was because they believed they needed to engage in some sort of operational security or, alternatively, some rudimentary business craft. .”

Next appearance of the accused on April 12

The documents also show that London police requested assistance from the Ontario branch of INSET, the RCMP’s Integrated Security Enforcement Team, which focuses on terrorism.

In their request for search warrants, police also said they intended to use Cellebrite, an Israel-based digital intelligence firm often hired by law enforcement to retrieve data from cellphones.

Media reports indicate that Veltman was homeschooled until 10th grade and had few friends.

CBC has confirmed that Veltman is scheduled to appear in court on April 12 to set a trial date.