6. Planning the terrorist attack

6.1 Evidence on which we rely

1

Evidence of the individual’s preparation for the terrorist attack comes from a variety of sources including what he told us directly, his interview with New Zealand Police on 15 March 2019, a series of emails he sent to himself, mobile phone location data, electronic information on the SD card of his drone and an external hard drive (both of which he had sent to his sister). We also reviewed social media activity shortly before the terrorist attack and the individual’s manifesto. Some of these sources warrant brief discussion.

2

The individual used his email account to send notes to himself for future reference. Although he deleted his emails before the terrorist attack, a few were recovered. Some of the recovered emails record elements of his planning and preparation.

3

Before the terrorist attack the individual sent the drone and an external hard drive to Lauren Tarrant. The SD card located inside the drone and the external hard drive contained files relating to his planning and preparation. New Zealand Police were able to recover some text documents from the SD card and external hard drive that he had deleted. It is not entirely clear to us how and why some files came to be on the SD card, but the file structure suggests the card had been used in another device that may have been the source of the files. That he deleted the documents indicates he did not want them to be discovered after the terrorist attack. When we interviewed him, he confirmed that this was so.

6.2 Planning documents created in 2018

4

The first document we have seen that is indicative of a particular plan is a budget created on 9 February 2018. This was recovered from the SD card:

5

It is unclear whether the 550 days referred to in the budget was to run from 7 February 2018 or from 9 February 2018 (when the file was created). Either way, his money would run out in August 2019. We read the document as being consistent with an intention to carry out a terrorist attack around that time. This would have coincided with Eid al-Adha, the Muslim festival marking the end of the annual pilgrimage to Makkah (Mecca), which in 2019 was celebrated in early to mid‑August. When we asked the individual about this, he confirmed that he had it in mind to launch an attack in Dunedin during this period because of the significance of the date in the Islamic calendar. This plan for a terrorist attack in August 2019 was abandoned for several reasons, one of which was that by at least early 2019 he was running out of money.

6

A file titled “to DO LIST” created on 18 July 2018 recovered from the SD card, held the following list:

7

This indicates that a plan was in place in general terms, but the reference to “other mosques” suggests that he had not yet finalised the locations of his terrorist attack. The “go plan” was not yet finalised. He told us that he had undertaken internet research on masajid in Australia, Europe and New Zealand, which included obtaining layout details. He ruled out a terrorist attack on a masjid in the United States of America. For practical and tactical reasons, he settled on the South Island as the appropriate location for his terrorist attack.

8

The individual did not ask for a loan but did ask her to increase the frequency of her payment of his share of rent from their joint rental property.

9

On 20 December 2018, the individual sent the following email to himself: 

This seems to be a note to himself for a line of argument that is developed in his manifesto.

6.3 Laying a false trail – December 2018

10

As we have noted, the individual claimed in his manifesto to have received a “blessing” from the Oslo terrorist (to whom he referred as “Knight Justiciar”) through his “brother knights” for his terrorist attack. And when interviewed by New Zealand Police, he referred to the “reborn Knights Templar”. Although the individual acknowledged to us that this claim was untrue, he had taken elaborate steps to make it seem believable.

11

After the terrorist attack, Sharon Tarrant told Australian Federal Police that the individual told her that he changed his travel plans to attend a rally in Poland in December 2018.

12

An organisation that calls itself the “Knights Templar Order International” (or sometimes Knights Templar International) had advertised a “Knighting Ceremony” to take place in Wrocław in Poland on 15 December 2018. This is an unusual organisation. The material it has placed online suggests that it is a marketing operation selling Knights Templar‑themed products and conferring on those who buy sufficient products the title “Sir Knight”. Knights Templar Order International is plainly not the “reborn Knights Templar” promoted by the Oslo terrorist. But those who run the organisation have far right political views and in 2019 the organisation and one of its leaders were banned from Facebook for spreading hate.¹⁸

13

The individual was in Poland on 15 December. He spent the night of 14 December 2018 at Bolesławiec. On 15 December 2018 he drove from Bolesławiec to Nysa. It is possible to partially reconstruct his day by reference to credit card transactions. The places and times of these transactions are as follows:

Figure 10: Known locations the individual visited in Poland on 15 December 2018

Kobierzyce is a village in the Wrocław county and is outside the city of Wrocław where the “Knighting Ceremony” was to take place.

14

There are a number of possible routes the individual could have taken and driving times would have been affected by traffic conditions. Based on the timing of the credit card transactions, the maximum amount of time he could have spent in Wrocław was between 44 minutes to one hour and 21 minutes. The period of time would be less if, for example, weather affected the driving conditions. This leaves very little time for him to have engaged with those at the Knights Templar International Order meeting and to receive a “blessing” for a prospective act of terrorism.

15

We were provided with information from Agencja Bezpieczeństw Wewnętrznego (ABW), Poland’s domestic counter-intelligence agency, that supports our view that the individual did not attend the Knights Templar International meeting on 15 December 2018:

ABW confirm they have no evidence that the individual attended the Knights Templar International meeting on 15 December 2018 and they found no evidence to suggest links between the individual and extremist “circles” in Poland.

ABW advised [the Royal Commission] that they have no confirmation [the individual] participated in the meeting of Knights Templar International (KTI), which took place on 15 December 2018 near the city of Wroclaw.

ABW confirmed that they had not obtained information that would suggest [the individual] contacted members of KTI while staying in Poland.

16

The Australian Security Intelligence Organisation also told us that it does not hold any information that the individual attended the Knights Templar International meeting:

[The Australian Security Intelligence Organisation] does not hold any information to suggest that the individual … was ever in contact with the Knights Templar International (KTI). [The Australian Security Intelligence Organisation] noted that the individual’s reference in his manifesto to “Reborn Knights Templar” was possibly as a homage to [the Oslo terrorist].

17

When we asked the individual about the meeting at which he claimed to have received a “blessing” he said that, as we would know, it had not happened. He also said his references to it were just a “red herring” we "were supposed to follow" but not "eat the damn thing". Which he had intended counter-terrorism agencies would “follow”, not “swallow”. We accept that aspect of what he told us and are satisfied that he did not attend the meeting.

18

The individual’s conduct in relation to all of this is strange to say the least. Three months in advance of his terrorist attack, he went out of his way to create a trail of evidence in Poland. That trail of evidence provided support for what he later told his mother, put in his manifesto and told New Zealand Police. The purpose was to add apparent credibility to his otherwise not very plausible narrative that he had received international support for his planned attack and, consequently, prompt unnecessary official inquiry. That he went to such trouble to support what in the end was just an elaborate trolling exercise illustrates the extent of his preparation.

6.4 Hostile reconnaissance

19

On 8 January 2019 the individual drove to Christchurch via Ashburton. He sent an email to himself at 4.06pm on 8 January 2019 noting an address on the other side of the road from the Ashburton Masjid. He confirmed to us that this was a reconnaissance exercise. Although there has been reporting after the terrorist attack of a drone having been flown in the vicinity of the Ashburton Masjid in early 2019, we have no evidence to link this with the individual.

20

Later that afternoon, the individual conducted surveillance of Masjid an-Nur in Deans Avenue, Christchurch. This included flying a drone over the building and recording an aerial view of the masjid grounds and buildings. The individual then flew the drone back over Masjid an-Nur focusing on the entry and exit doors, as well as the alleyway where he parked his car on 15 March 2019. This took place between 5.39 pm and 5.44 pm. In May 2019, a member of the public reported that they saw a small drone flying over the length of Masjid an-Nur in Deans Ave at approximately 5.45 pm on 8 January 2019. This person was not able to see who was flying it.

21

We asked the individual about his flying of the drone over Masjid an-Nur. The flight path of the drone shows that he had operated it from Hagley Park. He told us he had parked his car beside Hagley Park and used a remote control to fly the drone while he stood in the park. He played down the significance of the person who saw and remembered the flight. He also played down the likelihood of someone seeing what he was doing and recording the registration of his car, noting that drones are commonplace now and it was unlikely to be noticed. We saw this as another aspect of his reluctance to acknowledge lapses in his operational security.

22

The individual sent an email to himself at 5.58 pm. The email read:

23

At 6.16 pm that evening, the individual sent a further email to himself noting that he should “gear up behind belgotex building”, which is on Leslie Hills Drive. This is where the individual intended to stop and carry out some aspects of his preparation on 15 March 2019. On 15 March 2019, the individual drove to the Belgotex building but because of the activity that was going on in the carpark at the time he went elsewhere to prepare.

24

The individual told us that on 8 January 2019, he also drove past the Linwood Islamic Centre and that this was also for reconnaissance. A combination of the mobile phone polling data and the timing of the drone flight leave him time to have carried out such reconnaissance. We are not able to electronically identify his locations at the times of the 5.58 pm and 6.16 pm emails. The opening comments “13 roughly 11mins” in the 5.58 pm email may refer to the drive time from Masjid an-Nur to the Linwood Islamic Centre, which is approximately 12 minutes. The timing and contents of the email are consistent with the individual having driven to the Linwood Islamic Centre after the drone flight. He would also have had time to be at Leslie Hills Drive at 6.16 pm when he sent himself a further email and from there to be at West Melton where his mobile phone polled at 6.50 pm.

25

We have set out below a map depicting the individual’s travel on 8–9 January 2019 to conduct reconnaissance on Ashburton Masjid, Masjid an-Nur and the Linwood Islamic Centre and return to Dunedin.

Figure 11: A map depicting the individual’s travel on 8-9 January 2019

^{(Source: Mobile phone polling data)}

26

On 11 January 2019, the individual went to the Masjid Al-Huda, Dunedin Islamic Centre. He told us it was his only visit. Following that visit, he sent emails to himself at 1.59 pm and 2.01 pm in these terms:

27

The individual told us that he decided against a terrorist attack at the Masjid Al‑Huda, Dunedin Islamic Centre. This was for three reasons.  First, the building did not look like a masjid and therefore would not have the same symbolic significance, second, he did not wish to harm Muslim university students who would be likely to return to their home countries after finishing their studies (whom he therefore did not regard as being “invaders”) and third there was more than one masjid in Christchurch.

6.5 Planning documents created in 2019

28

On 20 January 2019, the individual sent himself a further email:

The email included aiming advice which we see no need to repeat.

29

The last planning document we have seen is an electronic file created on 30 January 2019. It was recovered from the external hard drive the individual sent to his sister along with the drone. The file was another “to do” list and was expressed as follows:

30

There are a few points that arise out of this and what the individual told us about it that warrant comment and explanation:

1. The individual told us that he did not complete all the activities on the list, for instance in relation to accounts and passwords. As noted above, a list of his accounts and passwords was recovered from his SD card from the drone.
2. A package was sent to Lauren Tarrant that contained the drone and external hard drive on 13 March 2019.
3. According to what he told New Zealand Police on the afternoon of 15 March 2019, the individual prepared a lengthy manifesto which he later deleted before writing the shorter version on a Word file, that he created on 22 January 2019, and published on the internet on 15 March 2019. The first manifesto has not been recovered. He would not tell us and New Zealand Police why he deleted it. Before the individual was sentenced he told a psychiatrist that his claims to having written an earlier manifesto were untrue. He said he had fabricated this story to give the impression the final manifesto was written in haste. This was intended to explain spelling and grammar errors in the final manifesto, which he thought may have been interpreted as an indication of a lack of intelligence.
4. The passage that begins “One like” and ends “Say no more” is a variant on a meme and internet in-joke.
5. The plan was to attack Masjid an-Nur, followed by the Linwood Islamic Centre. The Ashburton Masjid was a potential third target but one that he did not anticipate being able to reach.
6. Leaving aside the fact that 15 March 2019 was a Friday (the day of congregation), the individual was not prepared to tell us what the significance of the day was.
7. The individual told us that he uploaded his manifesto to both 4chan and 8chan. We have not seen any evidence that the manifesto was uploaded to 4chan.

6.6 In the lead up to the terrorist attack

31

The individual remained in or around Dunedin from 9 January 2019 to the morning of 15 March 2019.

Table 8: Data and activity confirming the individual’s presence in Dunedin in the lead up to the terrorist attack

32

In the days and weeks before the terrorist attack the individual took the following steps:

1. He installed several applications on his phone, including GoPro, LIVE GoPro, Skype, Twitter and Discord.
2. He obtained walk-through video footage of the Masjid an-Nur from a public Facebook page, which he saved to his phone on 11 March 2019. We are satisfied that the person who posted the video was neither affiliated with the individual nor the far right. We have reviewed the video. It was posted by a Muslim individual visiting New Zealand from overseas and who shared the video of Masjid an-Nur on Facebook as part of their family's travel photos and videos.
3. He posted links to extreme right-wing material on his Facebook page and Twitter on 13 March 2019. At this time, he had three Facebook friends (none of whom had any relevance or link to the terrorist attack) and no followers on Twitter.
4. He tweeted photographs of the firearms and equipment that were later used in the terrorist attack. The firearms had been marked up with text referencing extreme right-wing ideology and previous terrorist attacks (see figure 12 below).
5. He created an album on Facebook called “Open in case of Saracens” on 13 March 2019, which contained 155 images (including a digitally altered image of Masjid an-Nur in flames) and two videos in which extreme right-wing views are expressed and violence is advocated.
6. He removed the hard drive from his computer (which has not been recovered).
7. He uploaded his manifesto to Mediafire²¹ on 14 March 2019 at 7.20 pm. There was no public access to the manifesto on this site until he posted links to it immediately before the terrorist attack.
8. On the night of 14 March 2019, he spoke to his mother by phone for 28 minutes and to his sister for an hour and 16 minutes. His mother told the Australian police that during this call he seemed relaxed and happy and made a point of telling her that he loved her, which was out of character. His sister told the Australian police that the individual said that he loved her – in fact he said this twice – which was unusual. Although the individual did sometimes tell her that he loved her, he usually only said this when about to leave on a long trip.
9. He accessed “infinite looper” which loops videos/music to be played on YouTube with no user interaction.
10. He uploaded “docx” and “pdf” versions of his manifesto to Zippyshare²² at 12.20 am and 12.21 am on 15 March 2019 respectively. Again there was no public access to the manifesto on this site until he posted links to it immediately before the terrorist attack.
11. He sent a number of emails to himself on 15 March 2019 at 12.25 am, 12.31 am and 12.32 am. These emails contained the text he would later use in the emails he sent and posts he made on social media immediately before the terrorist attack. It is likely that he sent these emails to himself so that he could quickly copy and paste the text into the emails and social media posts.
12. At 6.26 am on 15 March 2019, he posted a Tweet containing links to the file sharing sites where his manifesto could be found. He had no Twitter followers at this time and as we explain below, it is likely that these were protected Tweets until immediately before the terrorist attack.

^{(Source: New Zealand Police)}

33

There are some issues that we should emphasise about his online posts, because if those posts were visible when they were made, they may have alerted people to the terrorist attack.

34

The privacy settings of the individual’s Facebook page prior to 15 March 2019 cannot be determined. However, we know that at 12.19 pm on 15 March 2019, the individual searched via the Google Chrome browser on his mobile phone for his own Facebook account. This was likely to check his profile was publicly viewable so that the livestream could be viewed by an audience. This suggests that his Facebook page was previously private. If that is the case, his Facebook page would likely have been visible to the public only in the hours immediately preceding the terrorist attack on 15 March 2019.

35

Tweets are publicly visible by default. However, Twitter users can restrict their Tweets so that they can only be viewed by their followers (these are called “protected Tweets”). It cannot be determined whether the posts made by the individual to his Twitter account on 13 March 2019 were public or were protected Tweets. We know that, at the time of the terrorist attack, these posts were not protected Tweets. Consistently with what we have said in relation to the individual’s Facebook settings and his attempts at operational security, it is reasonable to assume that the Tweets on 13 March 2019 were initially “protected Tweets”, with the individual later (probably on 15 March 2019) changing his settings to ensure they were publicly visible by the time of the terrorist attack.

36

The manifesto was not able to be seen until the individual posted links to the online platforms where it was uploaded. 

6.7 Financing the terrorist attack

37

Analysis by New Zealand Police shows that the individual’s terrorist attack was entirely self-funded, at a total estimated cost of NZ$60,000. This included travel to New Zealand, the individual's living expenses while he was planning the terrorist attack, and the acquisition of the items used to facilitate the terrorist attack. Around half of this amount (approximately NZ$30,000) was spent on firearms and firearms-related items. There is no evidence to suggest that any other parties provided any money to fund the terrorist attack.

38

Our conclusion on this point is based on a review of the individual’s financial activities from 1 January 2010 to 15 March 2019, which reveal no material inflow of money other than that received from his father and income derived from investments he made using that money. As we set out earlier, when we interviewed the individual, he said that he primarily used Bitcoin as currency and that any investments in Bitcoin were limited.

_{18. Martyn Landi “Facebook ban for Dowson in crackdown on hate speech” (Belfast Telegraph (United Kingdom, 19 April 2019) www.belfasttelegraph.co.uk.}

_{19. Video game digital distribution services and platforms.}

_{20. Gaming friend said that the individual did not, in fact, send any passwords to them.}

_{21. A file hosting, file synchronization and cloud storage service.}

_{22. A free cloud-based file hosting storage service.}