Distressing content
This section of the report contains material that may be confronting, particularly to those affected by the 15 March 2019 terrorist attack.

6.1 Evidence on which we rely


Evidence of the individual’s preparation for the terrorist attack comes from a variety of sources including what he told us directly, his interview with New Zealand Police on 15 March 2019, a series of emails he sent to himself, mobile phone location data, electronic information on the SD card of his drone and an external hard drive (both of which he had sent to his sister). We also reviewed social media activity shortly before the terrorist attack and the individual’s manifesto. Some of these sources warrant brief discussion.


The individual used his email account to send notes to himself for future reference. Although he deleted his emails before the terrorist attack, a few were recovered. Some of the recovered emails record elements of his planning and preparation.


Before the terrorist attack the individual sent the drone and an external hard drive to Lauren Tarrant. The SD card located inside the drone and the external hard drive contained files relating to his planning and preparation. New Zealand Police were able to recover some text documents from the SD card and external hard drive that he had deleted. It is not entirely clear to us how and why some files came to be on the SD card, but the file structure suggests the card had been used in another device that may have been the source of the files. That he deleted the documents indicates he did not want them to be discovered after the terrorist attack. When we interviewed him, he confirmed that this was so.


6.2 Planning documents created in 2018


The first document we have seen that is indicative of a particular plan is a budget created on 9 February 2018. This was recovered from the SD card:

As of 07/02/2018 have 57395AUD minus 7500 for travel to Pakistan and Europe meaning there is 49895 available for the 550 days.

90 dollars per day to live

635 dollars per week to live

2540 dollars per month to live

rent=1120 per month

Phone and internet is 149.96 per month

food is 480 per month

power is 80 per month

Fuel is 150 per month

Ammo is 380 per month

80 dollars per month for gym membership

Total=0 dollars left over for various


It is unclear whether the 550 days referred to in the budget was to run from 7 February 2018 or from 9 February 2018 (when the file was created). Either way, his money would run out in August 2019. We read the document as being consistent with an intention to carry out a terrorist attack around that time. This would have coincided with Eid al-Adha, the Muslim festival marking the end of the annual pilgrimage to Makkah (Mecca), which in 2019 was celebrated in early to mid‑August. When we asked the individual about this, he confirmed that he had it in mind to launch an attack in Dunedin during this period because of the significance of the date in the Islamic calendar. This plan for a terrorist attack in August 2019 was abandoned for several reasons, one of which was that by at least early 2019 he was running out of money.


A file titled “to DO LIST” created on 18 July 2018 recovered from the SD card, held the following list:

After christmas

More shooting

Test equipment+gear+buy steel capped boots that match gear

Cardio/agility/power training to be added to workouts

Possibly join mma or jiu-jutsu+boxing class

Look into finances and how much I have left, maybe contact lauren for loan

Maybe do a last visit to Aus and/or a trip overseas depending on time/money/inclination

Go through vids/pics/hardrives and house to make sure all is clean and good optics

Do research on other mosques, entry/exits/blocks etc

Replace anything in that house that is broken,too shitty to be left for owners

Fine tune the go plan


This indicates that a plan was in place in general terms, but the reference to “other mosques” suggests that he had not yet finalised the locations of his terrorist attack. The “go plan” was not yet finalised. He told us that he had undertaken internet research on masajid in Australia, Europe and New Zealand, which included obtaining layout details. He ruled out a terrorist attack on a masjid in the United States of America. For practical and tactical reasons, he settled on the South Island as the appropriate location for his terrorist attack.


The individual did not ask for a loan but did ask her to increase the frequency of her payment of his share of rent from their joint rental property.


On 20 December 2018, the individual sent the following email to himself: 

This seems to be a note to himself for a line of argument that is developed in his manifesto.


6.3 Laying a false trail – December 2018


As we have noted, the individual claimed in his manifesto to have received a “blessing” from the Oslo terrorist (to whom he referred as “Knight Justiciar”) through his “brother knights” for his terrorist attack. And when interviewed by New Zealand Police, he referred to the “reborn Knights Templar”. Although the individual acknowledged to us that this claim was untrue, he had taken elaborate steps to make it seem believable.


After the terrorist attack, Sharon Tarrant told Australian Federal Police that the individual told her that he changed his travel plans to attend a rally in Poland in December 2018.


An organisation that calls itself the “Knights Templar Order International” (or sometimes Knights Templar International) had advertised a “Knighting Ceremony” to take place in Wrocław in Poland on 15 December 2018. This is an unusual organisation. The material it has placed online suggests that it is a marketing operation selling Knights Templar‑themed products and conferring on those who buy sufficient products the title “Sir Knight”. Knights Templar Order International is plainly not the “reborn Knights Templar” promoted by the Oslo terrorist. But those who run the organisation have far right political views and in 2019 the organisation and one of its leaders were banned from Facebook for spreading hate.18


The individual was in Poland on 15 December. He spent the night of 14 December 2018 at Bolesławiec. On 15 December 2018 he drove from Bolesławiec to Nysa. It is possible to partially reconstruct his day by reference to credit card transactions. The places and times of these transactions are as follows:


Figure 10: Known locations the individual visited in Poland on 15 December 2018
Part 4 Chapter 6 Figure 10

Kobierzyce is a village in the Wrocław county and is outside the city of Wrocław where the “Knighting Ceremony” was to take place.


There are a number of possible routes the individual could have taken and driving times would have been affected by traffic conditions. Based on the timing of the credit card transactions, the maximum amount of time he could have spent in Wrocław was between 44 minutes to one hour and 21 minutes. The period of time would be less if, for example, weather affected the driving conditions. This leaves very little time for him to have engaged with those at the Knights Templar International Order meeting and to receive a “blessing” for a prospective act of terrorism.


We were provided with information from Agencja Bezpieczeństw Wewnętrznego (ABW), Poland’s domestic counter-intelligence agency, that supports our view that the individual did not attend the Knights Templar International meeting on 15 December 2018:

ABW confirm they have no evidence that the individual attended the Knights Templar International meeting on 15 December 2018 and they found no evidence to suggest links between the individual and extremist “circles” in Poland.
ABW advised [the Royal Commission] that they have no confirmation [the individual] participated in the meeting of Knights Templar International (KTI), which took place on 15 December 2018 near the city of Wroclaw.
ABW confirmed that they had not obtained information that would suggest [the individual] contacted members of KTI while staying in Poland.


The Australian Security Intelligence Organisation also told us that it does not hold any information that the individual attended the Knights Templar International meeting:

[The Australian Security Intelligence Organisation] does not hold any information to suggest that the individual … was ever in contact with the Knights Templar International (KTI). [The Australian Security Intelligence Organisation] noted that the individual’s reference in his manifesto to “Reborn Knights Templar” was possibly as a homage to [the Oslo terrorist].


When we asked the individual about the meeting at which he claimed to have received a “blessing” he said that, as we would know, it had not happened. He also said his references to it were just a “red herring” we "were supposed to follow" but not "eat the damn thing". Which he had intended counter-terrorism agencies would “follow”, not “swallow”. We accept that aspect of what he told us and are satisfied that he did not attend the meeting.


The individual’s conduct in relation to all of this is strange to say the least. Three months in advance of his terrorist attack, he went out of his way to create a trail of evidence in Poland. That trail of evidence provided support for what he later told his mother, put in his manifesto and told New Zealand Police. The purpose was to add apparent credibility to his otherwise not very plausible narrative that he had received international support for his planned attack and, consequently, prompt unnecessary official inquiry. That he went to such trouble to support what in the end was just an elaborate trolling exercise illustrates the extent of his preparation.


6.4 Hostile reconnaissance


On 8 January 2019 the individual drove to Christchurch via Ashburton. He sent an email to himself at 4.06pm on 8 January 2019 noting an address on the other side of the road from the Ashburton Masjid. He confirmed to us that this was a reconnaissance exercise. Although there has been reporting after the terrorist attack of a drone having been flown in the vicinity of the Ashburton Masjid in early 2019, we have no evidence to link this with the individual.


Later that afternoon, the individual conducted surveillance of Masjid an-Nur in Deans Avenue, Christchurch. This included flying a drone over the building and recording an aerial view of the masjid grounds and buildings. The individual then flew the drone back over Masjid an-Nur focusing on the entry and exit doors, as well as the alleyway where he parked his car on 15 March 2019. This took place between 5.39 pm and 5.44 pm. In May 2019, a member of the public reported that they saw a small drone flying over the length of Masjid an-Nur in Deans Ave at approximately 5.45 pm on 8 January 2019. This person was not able to see who was flying it.


We asked the individual about his flying of the drone over Masjid an-Nur. The flight path of the drone shows that he had operated it from Hagley Park. He told us he had parked his car beside Hagley Park and used a remote control to fly the drone while he stood in the park. He played down the significance of the person who saw and remembered the flight. He also played down the likelihood of someone seeing what he was doing and recording the registration of his car, noting that drones are commonplace now and it was unlikely to be noticed. We saw this as another aspect of his reluctance to acknowledge lapses in his operational security.


The individual sent an email to himself at 5.58 pm. The email read:


At 6.16 pm that evening, the individual sent a further email to himself noting that he should “gear up behind belgotex building”, which is on Leslie Hills Drive. This is where the individual intended to stop and carry out some aspects of his preparation on 15 March 2019. On 15 March 2019, the individual drove to the Belgotex building but because of the activity that was going on in the carpark at the time he went elsewhere to prepare.


The individual told us that on 8 January 2019, he also drove past the Linwood Islamic Centre and that this was also for reconnaissance. A combination of the mobile phone polling data and the timing of the drone flight leave him time to have carried out such reconnaissance. We are not able to electronically identify his locations at the times of the 5.58 pm and 6.16 pm emails. The opening comments “13 roughly 11mins” in the 5.58 pm email may refer to the drive time from Masjid an-Nur to the Linwood Islamic Centre, which is approximately 12 minutes. The timing and contents of the email are consistent with the individual having driven to the Linwood Islamic Centre after the drone flight. He would also have had time to be at Leslie Hills Drive at 6.16 pm when he sent himself a further email and from there to be at West Melton where his mobile phone polled at 6.50 pm.


We have set out below a map depicting the individual’s travel on 8–9 January 2019 to conduct reconnaissance on Ashburton Masjid, Masjid an-Nur and the Linwood Islamic Centre and return to Dunedin.


Figure 11: A map depicting the individual’s travel on 8-9 January 2019
Part 4 Chapter 6 Figure 11

(Source: Mobile phone polling data)



On 11 January 2019, the individual went to the Masjid Al-Huda, Dunedin Islamic Centre. He told us it was his only visit. Following that visit, he sent emails to himself at 1.59 pm and 2.01 pm in these terms:


The individual told us that he decided against a terrorist attack at the Masjid Al‑Huda, Dunedin Islamic Centre. This was for three reasons.  First, the building did not look like a masjid and therefore would not have the same symbolic significance, second, he did not wish to harm Muslim university students who would be likely to return to their home countries after finishing their studies (whom he therefore did not regard as being “invaders”) and third there was more than one masjid in Christchurch.


6.5 Planning documents created in 2019


On 20 January 2019, the individual sent himself a further email:

The email included aiming advice which we see no need to repeat.


The last planning document we have seen is an electronic file created on 30 January 2019. It was recovered from the external hard drive the individual sent to his sister along with the drone. The file was another “to do” list and was expressed as follows:

write on mags

perfect pushup $10, weight vest $30,After last range day write on gun bags and cases

Go through vids/pics/hardrives and house to make sure all is clean and good optics

prepare package for sending to lauren , drone etc.

Clean house fully.

Week before the go plan Print out 5 copies of manifesto

two weeks before the go plan, replace batteries in weapons sights

Write ebba akkerlund on one rifle, refugees welcome on another, Turkofagos on another,

kebab removal device on one weapon and dues vult on another, kebab remover on ar15, Alexandre Bissonette

Sinine Äratus mark(google it) on stock of gun, HERES YOUR MIGRATION COMPACT, FOR Rotherham, Jean Parisot de Valette, psalm 144:1, Otoya Yamaguchi, seven lives for my country, Anton Lundin Pettersson, Trollhättan, Werwolf symbol, TO ENGLAND TO EUROPE TO BRITAIN THEY WERE TRUE, symbols in this video

https://www.youtube.com/watch [video no longer available]

27/28th clean out house completely and change passwords on all accounts and give steam, origin and starcitizen19 passwords to [gaming friend] 20

29th Wipe clean comp

Tape power packs to fuel can, chuck in remaining acetone

Send lauren package on 31th January(wednesday)

Convert manifesto to pdf, make non editable, then prepare for release.

Day before, change profile pic, and background as well as change name

Dunedin to Christchurch takes 5hrs avg leave 8am to be at gear up area at 1:15pm, wake up 7am

Post email to yourself containing the things you need to say to people on the go day, and a picture to use on 4chan/8chan.Schedule the SMS to send at 2pm using the phones message app(SMS message not facebook)


One like and I will burn down a mosque

like it yourself

Say no more

Gear up behind belgotex building

Ashurton mosque 140 melcombe street

Make facebook album week before with photos pre uploaded, as well as vids. On the day early morning link vids and photos to facebook, minutes before do the 1 like and burn down mosque posts and upload manifesto to facebook, 4chan and 8ch.

Week before clean car

Day before set up car with gear for assault

15th march is go do rain or shine


There are a few points that arise out of this and what the individual told us about it that warrant comment and explanation:

  1. The individual told us that he did not complete all the activities on the list, for instance in relation to accounts and passwords. As noted above, a list of his accounts and passwords was recovered from his SD card from the drone.
  2. A package was sent to Lauren Tarrant that contained the drone and external hard drive on 13 March 2019.
  3. According to what he told New Zealand Police on the afternoon of 15 March 2019, the individual prepared a lengthy manifesto which he later deleted before writing the shorter version on a Word file, that he created on 22 January 2019, and published on the internet on 15 March 2019. The first manifesto has not been recovered. He would not tell us and New Zealand Police why he deleted it. Before the individual was sentenced he told a psychiatrist that his claims to having written an earlier manifesto were untrue. He said he had fabricated this story to give the impression the final manifesto was written in haste. This was intended to explain spelling and grammar errors in the final manifesto, which he thought may have been interpreted as an indication of a lack of intelligence.
  4. The passage that begins “One like” and ends “Say no more” is a variant on a meme and internet in-joke.
  5. The plan was to attack Masjid an-Nur, followed by the Linwood Islamic Centre. The Ashburton Masjid was a potential third target but one that he did not anticipate being able to reach.
  6. Leaving aside the fact that 15 March 2019 was a Friday (the day of congregation), the individual was not prepared to tell us what the significance of the day was.
  7. The individual told us that he uploaded his manifesto to both 4chan and 8chan. We have not seen any evidence that the manifesto was uploaded to 4chan.


6.6 In the lead up to the terrorist attack


The individual remained in or around Dunedin from 9 January 2019 to the morning of 15 March 2019.


Table 8: Data and activity confirming the individual’s presence in Dunedin in the lead up to the terrorist attack


Mobile call and data records

Banking transactions

Bruce Rifle Club attendance

Social media activity


10 January 2019



Sold item via Facebook.

Purchaser visited the individual’s home address.

11 January 2019



Sold item via Facebook.

Purchaser visited the individual’s home address.

Reconnaissance of Masjid al-Huda, Dunedin Islamic Centre.

12 January 2019





13 January 2019





14 January 2019




15 January 2019



Sold item via Facebook.

Individual dropped off item to purchaser.

16 January 2019





17 January 2019




Plastic boards imported.

18 January 2019




The individual sold a firearm back to Elio’s Gun Shop.

19 January 2019




20 January 2019



The individual emailed notes to himself about aiming.

21 January 2019





22 January 2019



Manifesto created.

23 January 2019





24 January 2019



Sold item via Facebook.

Purchaser visited the individual’s home address.

25 January 2019





26 January 2019





27 January 2019



Sold item via Facebook.

Purchaser visited the individual’s home address.

28January 2019





29 January 2019





30 January 2019



The individual created his final planning document.

31 January 2019





1 February 2019





2 February 2019




3 February 2019





4 February 2019





5 February 2019





6 February 2019





7 February 2019




The individual’s vehicle linked to Z Energy in Andersons Bay, Dunedin.

8 February 2019





9 February 2019





10 February 2019




11 February 2019





12 February 2019





13 February 2019




14 February 2019





15 February 2019





16 February 2019




17 February 2019





18 February 2019





19 February 2019


Sold two items via Facebook.


One of the purchasers visited the individual’s home address.

20 February 2019





21 February 2019





22 February 2019




23 February 2019





24 February 2019





25 February 2019




26 February 2019





27 February 2019





28 February 2019





1 March 2019





2 March 2019



3 March 2019





4 March 2019




5 March 2019





6 March 2019



The individual emailed the manifesto to himself.

7 March 2019



The individual’s vehicle linked to Z Energy in Andersons Bay, Dunedin.

8 March 2019




9 March 2019





10 March 2019





11 March 2019


The individual updated his Facebook profile photo using Spark fibre IP address in Dunedin.

The individual downloaded a walk‑through video of Masjid an-Nur.

12 March 2019



Facebook activity using IP address in Dunedin.


13 March 2019


Facebook and Twitter activity using IP address in Dunedin.


14 March 2019


Manifesto uploaded.



In the days and weeks before the terrorist attack the individual took the following steps:

  1. He installed several applications on his phone, including GoPro, LIVE GoPro, Skype, Twitter and Discord.
  2. He obtained walk-through video footage of the Masjid an-Nur from a public Facebook page, which he saved to his phone on 11 March 2019. We are satisfied that the person who posted the video was neither affiliated with the individual nor the far right. We have reviewed the video. It was posted by a Muslim individual visiting New Zealand from overseas and who shared the video of Masjid an-Nur on Facebook as part of their family's travel photos and videos.
  3. He posted links to extreme right-wing material on his Facebook page and Twitter on 13 March 2019. At this time, he had three Facebook friends (none of whom had any relevance or link to the terrorist attack) and no followers on Twitter.
  4. He tweeted photographs of the firearms and equipment that were later used in the terrorist attack. The firearms had been marked up with text referencing extreme right-wing ideology and previous terrorist attacks (see figure 12 below).
  5. He created an album on Facebook called “Open in case of Saracens” on 13 March 2019, which contained 155 images (including a digitally altered image of Masjid an-Nur in flames) and two videos in which extreme right-wing views are expressed and violence is advocated.
  6. He removed the hard drive from his computer (which has not been recovered).
  7. He uploaded his manifesto to Mediafire21 on 14 March 2019 at 7.20 pm. There was no public access to the manifesto on this site until he posted links to it immediately before the terrorist attack.
  8. On the night of 14 March 2019, he spoke to his mother by phone for 28 minutes and to his sister for an hour and 16 minutes. His mother told the Australian police that during this call he seemed relaxed and happy and made a point of telling her that he loved her, which was out of character. His sister told the Australian police that the individual said that he loved her – in fact he said this twice – which was unusual. Although the individual did sometimes tell her that he loved her, he usually only said this when about to leave on a long trip.
  9. He accessed “infinite looper” which loops videos/music to be played on YouTube with no user interaction.
  10. He uploaded “docx” and “pdf” versions of his manifesto to Zippyshare22 at 12.20 am and 12.21 am on 15 March 2019 respectively. Again there was no public access to the manifesto on this site until he posted links to it immediately before the terrorist attack.
  11. He sent a number of emails to himself on 15 March 2019 at 12.25 am, 12.31 am and 12.32 am. These emails contained the text he would later use in the emails he sent and posts he made on social media immediately before the terrorist attack. It is likely that he sent these emails to himself so that he could quickly copy and paste the text into the emails and social media posts.
  12. At 6.26 am on 15 March 2019, he posted a Tweet containing links to the file sharing sites where his manifesto could be found. He had no Twitter followers at this time and as we explain below, it is likely that these were protected Tweets until immediately before the terrorist attack.

Figure 12: One of the photographs uploaded to Twitter by the individual

Part 4 Chapter 6 Figure 12

(Source: New Zealand Police)


There are some issues that we should emphasise about his online posts, because if those posts were visible when they were made, they may have alerted people to the terrorist attack.


The privacy settings of the individual’s Facebook page prior to 15 March 2019 cannot be determined. However, we know that at 12.19 pm on 15 March 2019, the individual searched via the Google Chrome browser on his mobile phone for his own Facebook account. This was likely to check his profile was publicly viewable so that the livestream could be viewed by an audience. This suggests that his Facebook page was previously private. If that is the case, his Facebook page would likely have been visible to the public only in the hours immediately preceding the terrorist attack on 15 March 2019.


Tweets are publicly visible by default. However, Twitter users can restrict their Tweets so that they can only be viewed by their followers (these are called “protected Tweets”). It cannot be determined whether the posts made by the individual to his Twitter account on 13 March 2019 were public or were protected Tweets. We know that, at the time of the terrorist attack, these posts were not protected Tweets. Consistently with what we have said in relation to the individual’s Facebook settings and his attempts at operational security, it is reasonable to assume that the Tweets on 13 March 2019 were initially “protected Tweets”, with the individual later (probably on 15 March 2019) changing his settings to ensure they were publicly visible by the time of the terrorist attack.


The manifesto was not able to be seen until the individual posted links to the online platforms where it was uploaded. 


6.7 Financing the terrorist attack


Analysis by New Zealand Police shows that the individual’s terrorist attack was entirely self-funded, at a total estimated cost of NZ$60,000. This included travel to New Zealand, the individual's living expenses while he was planning the terrorist attack, and the acquisition of the items used to facilitate the terrorist attack. Around half of this amount (approximately NZ$30,000) was spent on firearms and firearms-related items. There is no evidence to suggest that any other parties provided any money to fund the terrorist attack.


Our conclusion on this point is based on a review of the individual’s financial activities from 1 January 2010 to 15 March 2019, which reveal no material inflow of money other than that received from his father and income derived from investments he made using that money. As we set out earlier, when we interviewed the individual, he said that he primarily used Bitcoin as currency and that any investments in Bitcoin were limited.



18. Martyn Landi “Facebook ban for Dowson in crackdown on hate speech” (Belfast Telegraph (United Kingdom, 19 April 2019) www.belfasttelegraph.co.uk.

19. Video game digital distribution services and platforms.

20. Gaming friend said that the individual did not, in fact, send any passwords to them.

21. A file hosting, file synchronization and cloud storage service.

22. A free cloud-based file hosting storage service.