Arrest, computer use of accused in deadly attack on Muslim family in London, Ont., detailed in new documents

The man charged in a deadly vehicle attack on a Muslim family last year in London, Ont., was on his knees and wearing a green military-style helmet when police found him in a shopping mall's parking lot just minutes after the incident, newly released court documents reveal. 

The 271 pages unsealed by the Ontario Superior Court of Justice also show what police were looking for in Nathaniel Veltman's truck and apartment, on electronic devices that were found and searches done using the dark web.

Veltman, 21, was willingly arrested in the parking lot of Cherryhill Mall, about seven kilometres east of where the attack happened on June 6, 2021, according to the court documents, which detail multiple witness and police reports taken immediately following the attack.

Four members of the Afzaal family were killed while they stood on the sidewalk at the intersection of Hyde Park Road and South Carriage Road.

Prosecutors allege the accused intentionally drove his truck into the family while the five were out for an evening walk.

Salman Afzaal, 46, his 44-year-old wife, Madiha Salman, their 15-year-old daughter, Yumna, and her 74-year-old grandmother, Talat Afzaal, died. The couple's nine-year-old son, Fayez, was seriously hurt but survived.

Veltman has been charged with four counts of first-degree murder and one count of attempted murder, with associated terrorism charges.

Truck had extensive damage, docs show

According to the documents, an officer arrived at the mall and found a Dodge Ram truck, which had extensive damage to its front end and smoke coming from its engine block. 

The documents say police wanted to search Veltman's truck for a machete in an orange and black sheath. Their search list also included a serrated knife, an airsoft rifle and an axe.

Last November, CBC News and other media went to court to lift the sealing order on two search warrants from June 12 and June 30. 

The accused's Toronto lawyers had argued against it, saying it could compromise Veltman's right to a fair trial. The Crown argued releasing some of the information related to the sealing orders attached to the search warrants can occur without significant risk to Veltman.  

Large sections of the 271 pages of documents remain covered by a publication ban.

Laptop used to access dark web 

A significant part of the information that media gained access to includes information on digital devices and software, including three cellphones and one laptop with the ability to use the dark web.

The documents say the laptop had The Onion Router (TOR) installed, allowing the user to anonymously access dark web content that is not indexed by search engines, and requires special software or authorization to access.

One detective involved with examining the devices said documents were found, and "some appeared to be hate-related material and relevant to the listed offences."

A different detective said searching Veltman's electronic devices was pertinent to understanding his "motives and mental state."

Police found 68 different passwords and accounts on the laptop in Veltman's apartment. They also discovered a lined piece of paper on the kitchen table that detailed speeds and percentages.

Tech experts give their views

Cybersecurity and tech analyst Ritesh Kotak said in an interview with CBC that access to the dark web is important because it can be a place where illegal activity and extremist views can flourish. 

"Because of its anonymity, there's forums and chat rooms of extremist groups that are conversing there," the Toronto-based analyst said. "It's very difficult to actually get an IP address to pinpoint an individual in a location."

Kotak stressed that use of the dark web is not on its own an indicator of illegal or nefarious behaviour — activists sometimes use it to avoid censorship in countries where web access is controlled.

Stephanie Carvin, a professor at Ottawa's Carleton University whose research focuses on terrorism, the law and technology, also was interviewed by CBC.

Carvin said places where extremist views can be viewed and shared already exist on the "surface web." However, in the context of a murder investigation, use of the dark web could indicate an attempt to conceal information being shared and accessed about methods of carrying out an attack, she said.

"If this person was using something like the Onion browser, it's much more likely to me that it's for a perceived belief that he needed to engage in some kind of operational security or, alternatively, rudimentary trade craft." 

Accused's next court date April 12 

The documents also show London police enlisted the help of the Ontario division of INSET, the RCMP's integrated security enforcement team, which focuses on terrorism. 

In their application for search warrants, police also stated their intention to use Cellebrite, an Israeli-based digital intelligence company often contracted by law-enforcement agencies to retrieve data from mobile phones.  

The information released to the media says Veltman was homeschooled until Grade 10 and had few friends. 

CBC has confirmed Veltman is next due to appear in court on April 12 for the setting of a trial date.