Laptop in Veltman apartment had what appeared to be ‘hate-related material’: docs

A laptop found in the apartment of an Ontario man facing terror-related murder charges in the deaths of four members of a Muslim family contained what appeared to be “hate-related material” and a browser that can be used to access the dark web, according to newly released court documents.

Police performed a preliminary search of a laptop and cellphone found in Nathaniel Veltman’s apartment after obtaining a warrant following the deadly June 6, 2021 incident in London, Ont., the documents say.

The detective who examined a digital copy of the laptop indicated that a more in-depth search would be appropriate “given that there are documents on the device and some appeared to be hate-related material and relevant to the listed offences,” they read.

The officer also found what’s known as the TOR browser, which can be used to access the dark web as well as legitimate websites, installed on the laptop, with shortcuts to launch it on the desktop, the documents say.

The dark web is a term that refers to a series of encrypted websites that can only be viewed through specialized software, they note. The “most prevalent” types of content on the dark web include child pornography, illegal markets for drugs and weapons, and terrorism or extremist websites, they say.

The laptop also contained 68 online account names and passwords, according to the documents.

Three data storage devices were also found in the apartment but not examined at that time, given the limits of the warrant, the documents say. However, police found two of the devices had been connected to the laptop “mere hours” before the incident, with one disconnected only minutes before Veltman left his home, they say.

Veltman is accused of deliberately hitting the family with his truck as they were out for a walk that evening.

Salman Afzaal, 46, his 44-year-old wife Madiha Salman, their 15-year-old daughter Yumna and her 74-year-old grandmother, Talat Afzaal, were killed. The couple’s nine-year-old son, Fayez, was seriously hurt.

Veltman, who was 20 at the time of his arrest, faces four counts of first-degree murder and one count of attempted murder in what prosecutors allege was an act of terrorism. His case will be heading straight to trial without a preliminary inquiry.

The preliminary police search of the laptop is laid out in documents investigators filed with the court in seeking a broader warrant that would allow them to log in to Veltman’s numerous online accounts using his passwords and collect any potential evidence stored there.

That application is part of hundreds of pages of court documents, portions of which have been made public. Many pages remain under publication ban or redacted in order to preserve Veltman’s right to a fair trial.

The documents also include police information submitted to obtain an initial warrant allowing them to search Veltman’s home, the laptop and phone, and his truck, which was taken to a secure storage unit after his arrest.

The information submitted for that warrant includes accounts from officers who responded to the incident. Among them is an officer who witnessed part of Veltman’s arrest and described him as wearing a green helmet.

At the time of his arrest, Veltman did not have a phone with him, and he told police he didn’t have one when he was given his right to counsel, the documents say.

Police sought to search Veltman’s home and vehicle for electronic devices, among other items, they say. Investigators requested to examine the laptop and cellphone for “motive evidence,” as well as evidence that could indicate who had access to the devices, they say.

Data to be examined included web searches, communications, images and evidence that the TOR browser was installed, between Dec. 14, 2019 and June 6, 2021, the documents say. Data related to the devices’ location was limited to June 6, while password information wasn’t subject to any time constraints.

In total, police obtained three warrants in connection with the case, though one was never carried out, the documents show.

The application to access Veltman’s online accounts was initially rejected by the court, but a modified version was granted two weeks later on June 30, 2021.

That warrant permitted investigators to use the passwords they found to log in to Veltman’s accounts and, if necessary, use the devices to clear two-factor authentication, the documents show. Investigators were also given the green light to change the usernames, passwords and any account recovery information “so that the evidence contained within can be preserved.”

The warrant granted permission to examine data as far back as Dec. 20, 2015, except for location data, which was limited to June 5 and 6, 2021. Passwords were again exempt from time limits.

It also increased the number of devices to include two other cellphones, one of them with a cracked screen, as well as the data storage devices found in Veltman’s apartment.

In their application, police argued logging in to Veltman’s accounts was necessary in part because data production orders may not be honoured by companies outside Canada.

And while Canada has treaties with other countries that could allow it to seek assistance in gathering data, that process can take up to two years in some cases, which “could present problems with the required disclosure timelines,” they argued in the documents.

“Furthermore, one of the goals of this investigation is to protect Canada’s national security and identify any entities that may have directed, assisted with, or benefitted from the attack that is the subject of this application,” so that approach would not be viable, they wrote.