Last year, I reviewed terrorism metrics in Canada and found some surprising trends, namely that we have more terrorism incidents in Canada than ever before. This includes terrorism peace bonds, charges, and attacks, and the numbers have been climbing. Peace bonds are being used more often as a preventative tool, though there’s debate about how effective they really are.

Historically, most charges have targeted religiously motivated actors—those inspired by groups like ISIL or al-Qaeda. But in recent years, there’s been a noticeable shift: more and more cases involve ideologically motivated individuals. What’s interesting is that while religiously motivated actors are charged more often, most actual attacks in Canada have been carried out by ideologically motivated ones. That suggests authorities may be better equipped to detect and stop religiously motivated plots, possibly because of long-standing international intelligence partnerships and entrenched ideas of what counts as “terrorism.”

That article generated a lot of interest and some controversy. Stewart Bell covered it in his Global News article on terrorism in Canada. The Integrated Threat Assessment Center also had some thoughts on the data and analysis, which they declined to share with me directly, but that I got to read all about in an access to information request. It was actually sweet how much time they spent on this little blog.1 Keep reading to learn what it all means for measuring terrorist activity in Canada:

Share

Read more

To do that, this Insight Monitor will examine the attack’s elements, estimate the financing, identify areas for detection (and, if possible, disruption), and compare it with other similar attacks in recent history. Subscribe to read more:

Read more

While both men were acquitted in August 2024 of conspiring to kill RCMP officers, they were convicted on other charges, including mischief and possession of weapons for a dangerous purpose. Olienick was also convicted of possessing a pipe bomb. The trial included evidence of messages expressing distrust of government, raising broader concerns about the influence of anti-government sentiment and conspiracy theories in Canada.

Read more

This article breaks down the costs of the attack and how it was financed.

Subscribe now

Attack Details

In the early hours of July 7, 2005, four suicide bombers, Mohammad Sidique Khan, Shehzad Tanweer, Hasib Hussain, and Jermaine Lindsay, prepared for the terrorist attack. Around 4 a.m., Tanweer, Khan, and Hussain traveled in a Nissan Micra from Leeds to Luton, stopping to refuel and buy supplies, while Lindsay arrived separately in a Fiat Brava. At Luton station, they transferred items between cars, each carrying large backpacks with explosives. After passing through ticket barriers, the bombers split up. At about 8:50 a.m., Khan, Tanweer, and Lindsay detonated bombs on three London Underground trains near Aldgate, Edgware Road, and Russell Square stations. Hussain was later seen buying a 9V battery at King’s Cross station, possibly to power his device if it initially failed. At 9:47 a.m., Hussain set off a fourth bomb on a double-decker bus in Tavistock Square.

Read more

Subscribe now

Attack Details

Six of the bombings happened at approximately 8:45 to 9:05 AM local time during Easter Mass and hotel breakfast service. The first explosions hit three churches—St. Anthony’s Shrine in Colombo’s Kochchikade district, St. Sebastian’s Church in Negombo, and Zion Church in Batticaloa—then the Shangri-La, Kingsbury, and Cinnamon Grand hotels in Colombo. Hours later, two additional explosions occurred as police were attempting to apprehend the perpetrators: one at a guesthouse in Dehiwala, a southern suburb of Colombo, and another during a police raid on a housing complex in Dematagoda.

Among the attackers were two sons of a wealthy spice trader, Mohammad Yusuf Ibrahim. Ilham Ibrahim blew himself up at the Shangri-La hotel, alongside Zahran Hashim, the suspected mastermind behind the plot and a radical preacher. Ilham’s older brother, Inshaf Ibrahim, detonated his device at the Cinnamon Grand hotel. Investigators suspect that the family’s wealth could have funded parts of the operation.

One of the later bombers, Abdul Lathief Jameel Mohamed, initially intended to strike the Taj Samudra hotel but failed to detonate his device. He later triggered the bomb at a guesthouse in Dehiwala, killing two others. In the final explosion in Dematagoda, Fatima Ibrahim—Inshaf’s wife—detonated explosives during a Special Task Force raid, killing herself, her three children, and three officers.

Following the bombings, authorities discovered and defused a bomb near Colombo’s main airport. They also recovered 87 low-explosive detonators from a bus station. The following day, additional explosives in a vehicle used by the attackers accidentally detonated during an attempted police defusal on a street near a church.

Read more

This article outlines the various costs of the attack and Jabbar’s financial profile.

Subscribe now

Attack Details

Based in Houston, Texas, Jabbar drove to New Orleans on December 31, 2024, and arrived at the Airbnb he rented at around 10 pm. In an effort to destroy evidence, he set fire to the Airbnb at 12:17 am and then began driving toward Bourbon Street. At 1:53 am and 2:20 am, Jabbar placed two coolers containing IEDs in the New Orleans French Quarter neighbourhood. At 3:15 am, his truck bypassed police barricades and began striking individuals for three street blocks before the truck crashed into a crane. Jabbar then got out of the car and began shooting at police, injuring two officers before he was shot and killed.

Read more

Thanks for caring about illicit financing and global security,

~Jess

Researchers, policy analysts, and experts struggle to conceptualize terrorist financing. Many measures of terrorist financing are bandied about: for instance, in a recent opinion piece, the authors cited a 2006 Fraser Institute report that estimated “terror financing in Canada at $180 million annually” (as of 2004), information from FINTRAC, Canada’s financial intelligence unit.1 This is a highly flawed estimate that should not be used to describe anything about terrorist financing in Canada. Let me explain.

What the Fraser Institute fails to mention in their report is that this category is for both terrorist financing and threats to the security of Canada, such as foreign interference and espionage. They also fail to note that these disclosures might include multiple counts of the same transaction. For instance, the same transaction can be included in multiple terrorist financing disclosures to different recipients like CSIS or the RCMP. When this happens, the transaction amount will be counted twice. FINTRAC actually stopped providing value estimates for disclosures in later reports because they were too imprecise. Further, these transactions are not necessarily terrorist financing. They are disclosed because they could be relevant to a terrorist financing investigation. There is a lot of daylight between “is terrorist financing” and “could be relevant to an investigation”. You can read more about the FINTRAC thresholds and disclosures in these articles:2

We know that FINTRAC disclosures are not a good estimate of the level of terrorist financing in Canada, so what is? This is where things get tricky. Figuring out how much terrorist financing is happening (and the value of that financing) in a country at any given time is complicated. First, we have to outline the “universe” of terrorist financing or all the activities that have a financial component. This includes operational financing for attacks and organizational financing to support groups. It also includes the financing of disrupted attacks (plots), money raised for terrorist travel and propaganda, and funds that might transit the jurisdiction as part of obfuscation techniques.

Ultimately, I don’t know what the universe of terrorist financing in Canada is. No one does. But that does not mean that it’s unknowable! Some of these categories are tough to estimate (such as transit funds, for instance), but other categories can be quantified.

Today, we will do just that, and I will explain and explore operational attack financing in Canada. This can help us better understand the terrorist threat landscape in an empirically-sound way.

Read more

Subscribe now

On 8 August 2024, Austrian authorities cancelled three Taylor Swift concerts, saying that they had disrupted a terrorist attack planned for the Vienna leg of the tour. Three people have been arrested in connection with the plot, and two of these individuals had recently pledged allegiance to ISIL.

Share

There have been plenty of terrorism arrests in Europe this summer, and this appears to be one of the more developed terrorist plots. Explosive devices and detonators were found at the home of one of the suspects, as well as ISIL propaganda, €21,000 in counterfeit money, machetes, knives, and more. Some of the cell members also demonstrated indicators of mobilization to violence, like quitting a job and changing their appearance. The plot is attributed to ISIL-Khorosan Province, although it is unclear what role the group had (inspiration, coordination, direction, etc).

Austrian authorities claim to have neutralized the threat but still cancelled the concert series without explaining further. (If all of the individuals in the cell had all been arrested, it’s unclear why the concerts couldn’t proceed.) UK concerts planned for this week are going ahead.

As a dedicated Swiftie (albeit one that cannot handle large crowds and will not be attending the concert, given my career in counterterrorism…), this plot caught my immediate attention, and not just because it was a potentially high-casualty attack. Plenty has been written and said about terrorists targeting concerts and the threat from ISIL-KP. Some good analysis can be found here, here, and here, as well as our own insights into the recent Crocus City Hall attack.

This particular incident caught my eye because I’m very interested in Swiftonomics, the economic phenomenon that occurs when Taylor Swift comes to town. Her concerts bring millions to local economies. For instance, the Eras Tour was estimated to increase Los Angeles County GDP by $320 million, and another analysis estimated that the tour could generate $5 billion for the US economy.

In Japan (a more representative country than the US, particularly in comparison with Austria), Swift’s Tokyo shows brought in between $50 and $60 million per night. These estimates include everything from hotels to restaurants to taxis and airfare. It’s no question: Taylor Swift is an economic force.

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing and analyze suspicious patterns and activities more effectively. Sign up today!

When terrorism succeeds

So what happens when those concerts get cancelled?

In the case of Vienna, the economic damage caused by the cancelled concerts was mitigated because they were cancelled so close to the planned date. Many fans had already travelled to Vienna, and instead of going to the concert, they spent money in restaurants, on souvenirs, and other experiences to make up for not seeing the concert.

However, plenty of concertgoers didn’t bother coming to Vienna, cancelling travel plans, hotels, and restaurant reservations. As a result, Vienna likely lost millions of dollars in revenue—possibly as much as $100 million.

Despite the fact that the terrorist plot was disrupted, the terrorists still managed to inflict serious damage on Vienna and Austria’s economy. This is interesting because most of the literature on the economics of terrorism considers the economic impacts of terrorist campaigns (multiple terrorism incidents) or the impact of a single (successful) terrorist incident. We have little knowledge of the economic impacts of disrupted plots. Most of the time, insufficient details are released to understand what terrorists are targeting (and how), and disrupted plots are rarely covered extensively in the media, which mitigates potential economic losses from these plots.

However, this case is quite different. Given its high profile and impact, this is clearly a subset of the economics of terrorism worth studying. I struggle to think of another disrupted plot that could have cost a local economy more than a few million dollars, let alone the tens or hundreds of millions we are talking about in this case.

Understanding these economic impacts might also help us make better choices about counterterrorism, like how much we allocate to prevention and disruption. It’s impossible to say why the Austrian authorities cancelled the concerts (if there was an ongoing threat, for instance). Still, surely, these economic losses will make the case for more investments in counterterrorism that would make the country and Vienna more resilient against terrorist threats.

Share

© 2024 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Subscribe now

Perpetrator and Attack Details

Veltman moved to London, Ontario about six months prior to the attack to attend Fanshawe College. He was employed part-time at the Gray Ridge Egg Farms and rented an apartment in downtown London. Veltman did not have any known ties to hate groups or a criminal record. His family, however, was aware of Veltman’s history of considering attacks against abortion providers.

In March of 2021, he began planning an attack against Muslims. In the months leading up to the attack, Veltman wrote a manifesto entitled “A White Awakening” that borrowed language written by the perpetrator of the Christchurch mass shooting.

A few months later at around 8:40 pm on June 6^th, 2021 Nathaniel Veltman drove his pickup truck into five members of a Muslim Pakistani-Canadian family at an intersection while they were waiting to cross. After striking the family, Veltman drove off and approached a cab parked at a mall about 7 kilometres away from the site. He told the driver he had just killed someone and asked him to call the police. Veltman was arrested upon their arrival.

Read more

Subscribe now

Is Terrorism Cheap?

First of all, “cheapness” is a relative and subjective term. In North America, we might think that a $1,000 for a terrorist attack is inexpensive. But in other parts of the world, $1,000 goes much further and is more out-of-reach for people (and terrorists), making it subjectively more expensive.

Currently, the average cost of a terrorist attack is $56,000.1 However, the cheapest terrorist attack cost less than $10, while the most expensive attack cost $1.1 million. There is huge variation in what attacks cost depending on the target, the attack method, the equipment used, and the planning and preparation. My dataset on terrorist attacks contains 55 fully-costed attacks between 1985 and 2023. I have further categorized these attacks as no cost ($0), very low-cost (<$1,000), low-cost ($1,000-$5,000), medium-cost ($5,000-$10,000), high-cost ($10,000-$50,000), or very high-cost (>$50,000). The graph below shows the distribution of data according to these groupings:

Read more

Executive Summary

In recent years, there has been a rise in violent far-right extremist groups, movements, and inspired individuals (also commonly referred to as ideologically-motivated violent extremists) conducting attacks, causing disruption and disorder, and in some cases, seeking to undermine or overthrow democratically elected governments. Some of the individuals associated with these movements have perpetrated attacks, like the Quebec mosque attack in Canada, while others have perpetrated violence under the guise of protest, counter-protest, and marches. On January 6^th, 2021, this culminated in an attempted insurrection at the US Capitol building in Washington, D.C. Questions have rightly been raised about how this attack was organized and financed.

This report seeks to answer the question of financing. Using a combination of open-source materials, news reporting, and some primary documents, this report draws together disparate information about how the individuals, influencers, political operatives, and groups and movements financed their activities leading up to and on January 6^th. This report uses an analytic framework first developed to explore terrorist financing to illustrate how the insurrection was financed. This framework explores how funds were raised, used, moved, stored, managed, and obscured for the attack. By extending the analysis beyond simple fundraising, this report seeks to identify the other mechanisms and methods involved in financing January 6^th, with an eye towards identifying disruption or intervention strategies for this evolving issue.

The January 6th insurrection was financed through various methods, including individual donors, crowdfunding campaigns, and self-funding. The insurrectionists used these funds to travel to Washington D.C., purchase weapons and gear, and hold events. Following the events of January 6th, they also used funds to cover legal fees.

While the attack on the Capitol was significant, the costs were distributed among many participants and donors. This report explores how the insurrection was financed and provides recommendations on how to counter the financing of future events.

Fundraising Methods

The insurrectionists primarily relied on three methods of fundraising:

• Individual donors, such as Alex Jones, who donated over $146,000 and arranged for an additional $300,000 donation.

• Crowdfunding campaigns on platforms like GiveSendGo and GoFundMe. While many of these campaigns were shut down, they raised tens of thousands of dollars.

• Self-funding, where individuals covered their own travel and related expenses.

Groups Involved

Three main groups were involved in the insurrection:

Oath Keepers: This group has a more established structure with chapters across the United States. They raise funds through membership dues, charitable giving programs, and crowdfunding campaigns. They used funds to support their organization, travel to the Capitol, and purchase weapons and equipment.

Proud Boys: This loosely organized right-wing group relies heavily on self-financing. They utilize crowdfunding to finance large events and legal fees. They also operated a website that sold merchandise and accepted donations.

Three Percenters: This group is characterized by a shared anti-government belief system rather than a formal organization. They primarily rely on self-funding but may receive support from associated charitable organizations.

Use of Funds

The insurrectionists used their funds for a variety of purposes:

• Travel to the US Capitol

• Purchase weapons and gear

• Holding events, such as the Ellipse rally, which cost an estimated $500,000.

• Legal fees following the insurrection.

• Organizational support, including recruitment, propaganda, and maintaining membership for groups like the Oath Keepers.

Movement and Management of Funds

The insurrectionists primarily utilized the US financial system to move and store money. They relied on banks, financial technologies, and cash.

Oath Keepers: They used payment processors like PayPal, Stripe, and the US postal service. Funds are stored in bank accounts and potentially weapons. Financial control is centralized within the group's leadership.

Proud Boys: They have used various payment processors, though many have discontinued their services. Financial management likely occurs at the chapter or individual level.

Three Percenters: Due to their decentralized nature, they likely use personal methods like bank accounts, credit cards, and cash.

Countering Insurrection Financing

The report outlines several recommendations to prevent the financing of future insurrections and violent far-right extremism:

• Revoke tax-exempt status for organizations advocating for the overthrow of the government.

• Prohibit the use of payment processors, website hosting companies, and crowdfunding platforms for activities aimed at overthrowing the government.

• Hold payment processors, banks, and other companies accountable for providing services to individuals and organizations involved in violent extremism.

• Consider creating a domestic terrorist proscription process to enable financial sanctions against these groups.

• Enforce existing terrorist listings and prevent the provision of financial services to listed entities.

• Consider internationally listing the Proud Boys, Oath Keepers, and Three Percenters as terrorist entities.

The financing of the January 6th attack highlights the challenges posed by extremist financing. Addressing this issue requires a multifaceted approach involving government action, corporate responsibility, and international cooperation.

Timeline of Events

This timeline focuses on the financial activities of the Oath Keepers, Proud Boys, and Three Percenters leading up to and following the January 6th insurrection.

Pre-2021:

• 2009: Stuart Rhodes founds the Oath Keepers. The group begins raising funds through membership dues, merchandise sales, and charitable giving programs.

• 2016: A Three Percenter leader in Idaho is accused of misusing funds.

• 2017:

  • The Portland Branch of the Republican Party allows Oath Keepers and Three Percenters to provide security at public events.

  • A Colorado County GOP member hires militia groups, including possibly the Oath Keepers and/or the Three Percenters, for security.

  • The Oath Keepers provide disaster relief following hurricanes in Texas, Florida, and Puerto Rico.

• 2019:

  • The Oath Keepers' Indiana chapter is enrolled in Kroger's Community Rewards Program and Amazon's "AmazonSmile" program.

  • Three Percenter affiliated "charitable" organizations allegedly sponsor rallies.

2020:

• Analysis reveals that Nick Fuentes, a white nationalist figure, received a large Bitcoin donation worth approximately $522,000 a month before the Capitol riot.

2021:

• January 5th: Alex Jones arranges for Julie Jenkins Fancelli to donate $300,000 to cover the majority of the $500,000 cost for the Ellipse rally.

• January 6th:

  • The Ellipse rally takes place, costing approximately $500,000.

  • The Oath Keepers, Proud Boys, and Three Percenters participate in the insurrection at the US Capitol.

  • Proud Boys leader Enrique Tarrio, arrested before the attack, establishes a defense fund on GiveSendGo and raises over $113,000 in one week.

• Post-January 6th:

  • The Oath Keepers and Proud Boys solicit donations for legal defense funds via crowdfunding platforms.

  • The Oath Keepers continue fundraising, raising approximately $15,000 in May 2021 through a crowdfunding campaign.

  • Many payment processors, including PayPal and Stripe, discontinue service to the Oath Keepers and Proud Boys.

  • The Oath Keepers resort to receiving membership dues through the mail system.

2022:

• May: The Oath Keepers Educational Foundation and Oath Keepers United have their tax-exempt status revoked.

• July: The Proud Boys' fundraising website is suspended, presumably by the hosting provider.

Ongoing:

• The Oath Keepers, Proud Boys, and Three Percenters continue to operate in the US.

• They continue to raise funds through various means, including merchandise sales and crowdfunding campaigns.

• Funds are used for legal defenses, organizational activities, and further events.

We’re back tomorrow with more news and analysis you won’t find anywhere else, so stay tuned!

Share

Kidnapping Plot

The plot to kidnap Gretchen Whitmer developed from June to October 2020. The militia members intended to kidnap the governor from her vacation cottage in Michigan and use explosives to harm any responding law enforcement officers. After grabbing Whitmer, the men planned to escape on a boat and hold her hostage. They would have likely taken pictures of her tied up and announced her ‘arrest’ online before releasing her. The men met dozens of times to discuss the plot, train with firearms and tactical gear, experiment with explosives, and even surveil Whitmer’s home. The plan was ultimately foiled on October 7, 2020, when the plotters were arrested en-route to conduct the attack

Read more

Subscribe now

Attack Summary

On the morning of March 15^th, 2019, Tarrant drove 360km from his city of Dunedin to Christchurch. Upon arriving to Christchurch at approximately 1:30 pm, he turned on the GoPro attached to his helmet and began live-streaming to Facebook. He then drove up to Al Noor Mosque and exited his vehicle.

At 1:40 pm he approached the front door of the building, armed with a shotgun and semi-automatic rifle, and opened fire at worshippers. Six minutes later, he drove to Linwood Mosque and continued his attack. Tarrant left IEDs in the vicinity of both mosques, although the devices did not end up detonating.

In these two attacks, he killed over 50 worshippers and injured an additional 40 between the two locations. Tarrant then got back in his car and attempted to drive to another mosque in Ashburton approximately 90km southwest of Christchurch. Police vehicles pursued him, and a few minutes later they apprehended him.

In the lead up to the attack, Tarrant generating a significant financial trail that, had law enforcement or security services been paying attention, would have provided strong indications as to his plans and intentions.

All costs are provided in NZD

Weapons and Ammunition Costs

In terms of weaponry, Tarrant used a Mossberg 930 semiautomatic shotgun and AR-15-style rifle during the attack. However, he also had three other firearms in his vehicle. He modified the firearms in several ways, such as adding sights to improve accuracy as well as attaching strobe lights to disorient his targets. He also purchased magazine couplers to allow him to reload quicker and had a bayonet knife and scabbard on him. Finally, as Tarrant originally planned to burn down the mosques, he also had four gas containers in his vehicle that had gun oil spray duct-taped onto them to work as an accelerant. All of his weapons were purchased legally from New Zealand-based stores.

The full list of firearms that Tarrant purchased while living in New Zealand is outlined in the following table:

Table 1: Firearms purchased by Tarrant

Tarrant also purchased significant amounts of ammunition. As New Zealand does not require gun stores to keep records of ammunition purchases, the total cost is unknown. However, there are financial records of Tarrant purchasing NZD$1,358 worth of 2,000 rounds of .223 calibre Remington 55Gr SP. He made an additional 11 purchases online between December 5, 2017, and July 12, 2018, as outlined in the table below.

Table 2: Ammunition purchased by Tarrant

Tarrant also purchased several magazines to store the ammunition in the firearm, as listed below:

Table 3: Magazines Purchased by Tarrant

The total cost of weapons used in the Christchurch shootings is categorized in the following table. Since the exact quantity of ammunition and magazines used throughout Tarrant’s shooting practice and during the attack itself is unknown, the total costs for those items are included.

Table 4: Cost of Weapons/Components Used in Attack

Travel Costs

The Royal Commission found that Tarrant had plans to conduct the terrorist attack by January 2017; therefore the flight to Auckland and subsequent travel to Dunedin were some of the first expenses associated with the attack. A ticket from Brisbane to Dunedin averages around NZD$400, with a one-way ticket from Auckland to Dunedin averaging around NZD$80. As the attack was in Christchurch, he also paid approximately NZD$78.25 for the one-way trip from Dunedin.

In the year and a half between arriving in New Zealand and conducting the attack, Tarrant also traveled to Japan, Australia, Pakistan, Bulgaria, Romania, Austria, Estonia, Latvia, Lithuania, and Poland. Tarrant’s Poland trip was a part of his planning efforts. In December 2018, Tarrant traveled to Poland in an attempt to create a trail of evidence that he received a “blessing” from Anders Breivik as well as Breivik’s organization – the Knight’s Templar. Tarrant was in the country for approximately 10 days and likely spent between $1000-$1500 for transportation, food, and accommodations. Ultimately, Tarrant admitted that he did not actually receive the blessing, but he still took elaborate steps to travel to Poland and make it seem believable. The Commission found that, other than Tarrant’s trip to Poland, the rest of his travel was not necessarily relevant to the inquiry and is therefore not included in this cost analysis.

Table 5: Cost of Tarrant’s Travel

Operational Security Costs

Tarrant had several expenses associated with maintaining his operational security. According to his manifesto, he began planning the attack at least two years in advance. He initially considered attacking another Western country or conducting the attack in the city of Dunedin where he was located. Tarrant even visited the Dunedin Islamic Centre on January 11, 2019, although he ultimately decided against targeting the mosque. After visiting the Al Noor and Linwood Mosques in Christchurch, he decided to target these mosques because they had been converted from churches to mosques. Those mosques held large crowds of mostly adult worshippers, and were in strategic locations due to their easy access and escape potential.

Tarrant likely made several reconnaissance trips to Christchurch to prepare for the attack, although only one is specified in the Commission report. About two months before the attack on January 8, 2019, he drove to Christchurch via Ashburton. Upon arriving at the mosques, he used his drone to reconnoiter the sites and plan both attack and escape routes.

Tarrant also took considerable effort to socially isolate himself and worked methodologically to avoid attracting suspicion. This included taking significant precautions when browsing and interacting online. He used VPNs to communicate on forums, encrypted emails to communicate with himself, and the dark web to make purchases.

Table 6: Tarrant’s Operational Security Costs

Other Equipment Costs

Tarrant drove a silver 2005 Subaru Outback that he purchased in Dunedin in August 2017 to the attack. While used car sales vary considerably, we estimate a mid-value model to be $7000.

He also wore tactical attire to the attack. The Commission report outlines that he purchased a military-style tactical vest, tactical gloves, two ballistic vests, body armour inserted into the ballistic vests, and a helmet used for airsoft sports. He also attached a GoPro to his helmet in order to live stream the attack. Most of the attire was bought online in 2017 and throughout 2018.

The Buffalo Shooting perpetrator also spent considerable funds on his tactical attire:

https://newsletter.insightthreatintel.com/p/buffalo-shooting-financing-terrorism

Table 7: Tarrant’s Other Equipment Costs

Training Costs

Tarrant trained for the attack by developing firearms expertise, improving his physical fitness at a gym, and taking steroids to bulk up. In terms of firearms training. Tarrant applied for a New Zealand firearms license in 2017 and was granted the license about three months after his arrival. The application fee for a standard New Zealand firearms license is $123.75, and is valid for ten years. He was also a member of two-gun clubs where he would go to practice. The annual subscription for the Bruce Rifle Club that Tarrant frequented is $70.

Tarrant also spent time and money to improve his physical fitness. He went to a local gym several days a week, which cost him $80 each month. He also used steroids, thus requiring him to purchase drugs as well as the required equipment. Although an accurate estimate of drug prices cannot be calculated without knowing the steroid type and dosage that Tarrant was using, we estimate the cost to be between $1000-$2000, given that New Zealand is geographically isolated and has a small population, factors which impacted the availability and cost of drugs.

While details on Tarrant’s drug supply are unknown, there is information concerning the equipment he purchased to ingest the drugs. On February 8, 2018, Tarrant bought 500 hypodermic needles, 300 syringes, and 200 alcohol swabs from a New Zealand-based medical supplies company, all documented by his Alipay transaction history. He had previously purchased smaller quantities from another New Zealand-based company in September 2017.

Table 8: Tarrant’s Training Expenses

Donations

Although Tarrant stated that the attack was not mounted by any organization and that he acted on his own, he did spend considerable time on online forums and even donated money to various extreme right-wing groups. He made several donations, outlined in the table below. Of note are his donations to several right-wing media channels, including an $152.50 donation to Freedomain Radio, a podcast and Youtube channel by Canadian Stefan Molyneaux.

According to the Commission report, while in New Zealand, Tarrant made at least another 11 donations to far-right groups and individuals through PayPal and Bitcoin. He also allegedly made other donations not listed in the report, such as a $50 donation to Australia’s United Patriots Front. Lastly, Tarrant supported far-right groups by purchasing books, ebooks, publications, and accessories to send to his family, although the exact costs of these items are unknown.

https://newsletter.insightthreatintel.com/p/financing-hate-patriot-front

Table 9: Tarrant’s Donations to Far-Right Groups and Individuals

Funding the Attack

The Christchurch attack was completely self-funded. Although Tarrant worked as a personal trainer in his hometown and received income from 2009-2011, he quit the position after being injured. The vast majority of Tarrant’s funds came from an inheritance of approximately $565,000 that he received after his father committed suicide in 2010. He also purchased a rental property with his sister in Australia and received payments from that. Finally, Tarrant received minor profits from cryptocurrency investments, although his banking records show that the transactions were limited and totaled less than $6500.

Upon arriving in New Zealand, Tarrant opened two bank accounts with ANZ Bank where he stored the money to pay for his expenses while in the country. The total amount in his account between August 23, 2017, and March 15, 2019, was approximately NZD $61,792 .

In an email to himself, Tarrant outlined his assets and expenses in preparation for the attack:

Although he planned out his finances to conduct the attack in August 2019, he ended up running out of money by early 2019, expediting his timeline.

With Tarrant’s outlined budget, we can calculate his approximate living expenses. As Tarrant moved to New Zealand in order to conduct the attack, they are included in the attack cost analysis.

Table 10: Tarrant’s Approximate Living Expenses

Ultimately, the Christchurch Attack was an expensive operation, costing upwards of NZD$77,000. This estimate is slightly higher than the analysis done by New Zealand Police which found the attack to cost NZD$60,000. The variance is likely due to the New Zealand Police estimate only taking into consideration the weapons and cost of living expenses.

Table 11: Total Cost Breakdown

Comparing the Christchurch Attack to Other Lone-Actor Attacks

The Christchurch attack was more deadly - and significantly more expensive - than many other lone-actor attacks. With the shooting costing over $50,000 USD, it was almost 5 times costlier than the 2022 Buffalo Shooting where Payton Gendron spent approximately $10,500 and murdered 10 people. When Alexandre Bissonnette killed 6 worshippers in his attack on a Quebec Mosque, he spent approximately $3000 to plan and carry out the shooting. Justin Bourque similarly spent $2500 to conduct his attack against RCMP officers during the 2014 Moncton Shootings. Tarrant’s costly preparation efforts resulted in an operation with a higher number of casualties than each of the other attacks combined, and is more comparable to the Oslo and Utoya attacks in Norway in 2011. There was an extensive money trail associated with Tarrant’s attack, but little law enforcement scrutiny of him in the lead-up, meaning that there was no one in a position to review and analyze the context and meaning behind this financial intelligence.

Learn more about lone actor financing by checking out the following article:

https://newsletter.insightthreatintel.com/p/financing-lone-actor-or-self-activating

Did you find this post insightful? Share it with a colleague:

Share

The perpetrator’s connections to the incel ideology led to the RCMP also pursuing terrorism charges against the man. Although the legislation has been in place for decades, terrorism is a crime rarely prosecuted in Canada. For the most part, only individuals tied to religiously motivated violent extremism have been charged with terrorism. This case thus marks the first-time terrorism charges have been laid in connection to an act of misogynistic violence.

Although there is limited information due to the publication bans associated with this case, in the following article we’ll outline the facts of the attack as well as highlight the financial elements.

Subscribe now

The Attack

In February 2020, a 17-year old man in a long, dark trench coat and sword attached to his belt walked approximately 2 kilometers from his home to Crown Spa in Toronto’s North York neighbourhood. Upon entering the spa, the man immediately began stabbing the Spa’s receptionist, 24-year old Ashley Noell Arzag. The nearly half-metre-long sword used in the attack was inscribed with the words “thot slayer” - “thot” being a derogatory term used against women, implying sexual promiscuity.

After hearing screaming, the spa’s owner came to investigate and was stabbed by the perpetrator. The owner managed to disarm the man after significant struggle and eventually stabbed him in the back, ending the rampage. The woman then managed to call the police from a neighboring business. The perpetrator was arrested with a note in his pocket reading “Long live the rebellion of the incels”. When asked why he carried the note, he told police "I wanted everyone to find it. I wanted the world to know that people like us exist and it's not really fair." The perpetrator’s clear connections to an ideological motive is what caused the RCMP to tie the murder and attempted murder charges to terrorism.

The Cost of the Attack

As is frequently the case with other incel-inspired attacks, such as the Toronto Van Attack we covered last week, the cost of such terrorism is relatively low. With the massage parlour attack, the only real expense was the procurement and inscription of the weapon. Swords can range from $100 to upwards of $3000, based on online sales in the region. As the perpetrator was a teenager and unlikely spent significant sums of money on the sword, we estimate that the weapon cost between $100 to $300. There is no evidence to suggest that he got the sword professionally inscribed, although doing so would likely increased the cost. Some reports describe the weapon to be a machete instead of a sword, which has the potential to cost a bit less, anywhere from $50 to a few hundred.

Unlike Alek Minassian, the perpetrator did not have any vehicle costs as he walked to the attack site. The attacker also wore plain clothes, not armored gear, or any other special attire. At this time, we cannot assess whether there were any additional equipment or operational security costs. If the man is sentenced as an adult instead of a youth, the publication ban will be lifted, and further details of the attack will be released. For now, we can approximate the cost to be simply the price of the sword.

Insight Intelligence

Financing Incel-Motivated Terrorism

The global terrorism ecosphere has a host of different groups, ideologies, movements, and associated individuals today. Many defy easy categorization, and one of those ‘movements’ is the Incel movement. It is more precisely described as a loose network of individuals who consider themselves involuntarily celibate. They cluster together in online forums…

Read more

5 years ago · 1 like · Jessica Davis

What’s Next?

In the following weeks, the murderer will undergo a psychiatric evaluation and a pre-sentencing report will be complete. Sentencing will be set in 2023. The outcome of the terrorism charges as well as the sentencing verdict will create an important precedent for the prosecution of future ideologically motivated acts of violence.

As we have known for some time, incel-motivated terrorism is cheap to conduct, and often has little to no financial transactions associated with it, which makes it challenging to detect and disrupt. However, the low cost of this attack is quite unusual — even other simple, lone actor attacks tend to have higher costs. This might be the rare example of “no cost” terrorism (or such low cost as to be meaningless).

Traditional counter-terrorist financing approaches used for terrorist groups, such as sanctions, designations, and financial exclusion, are difficult to implement and have limited utility against this type of terrorism. Nonetheless, continuing to examine, analyze, and assess these attacks helps demonstrate the scope of financial activities associated with terrorist financing. As demonstrated by the Indicators of Mobilization to Violence Project, bystander education and intervention, including about potential financial indicators, will also be important in detecting and disrupting incel-motivated terrorism.

Share

Subscribe now

June 23, 1985, marks one of the deadliest acts of aviation terrorism. 329 people on board Air India Flight 182, most of whom were Canadian, were murdered in a terrorist act. The bombing was part of a larger transnational terrorist conspiracy by Canada-based Sikh militants, primarily members of the Babbar Khalsa International group (BKI). Another bomb connected to the plot was meant to explode aboard Air India Flight 301. However, it mistakenly detonated while being transferred at the Narita Airport in Japan, killing two baggage handlers and injuring four others.

Members of BKI, the International Sikh Youth Federation, and other radical groups within the Sikh community wanted to send a message to the Indian government through the attacks. They demanded the creation of an independent Sikh state, to be called Khalistan, in the Northern province of Punjab in India. Talwinder Singh Parmar founded the first unit of BKI in Canada in 1981. It was members and associates of this unit that planned and conducted the bombing. Devotees of Parmar, including Ripudaman Singh Malik, have “admitted to financing some of Parmar’s ‘religious’ activities and admiring him as a preacher.” While concrete details on how the attack was financed are sparse, it seems as though resources for the bombing came from contributors in the Sikh community and from the personal funds of the plotters.  

In the months leading up to the attack, the newly established Canadian Security Intelligence Service was keeping tabs on Parmar. They followed him on a ferry from the mainland of British Columbia to Vancouver Island in early June 1985, where he met a local mechanic, Inderjit Singh Reyat, along with another unnamed individual. Reyat bought two Micronta seven-day timers from Radio Shack, batteries, an FM tuner casing to house the bomb, a VCR, several sticks of dynamite, and a blasting manual in preparation for the attack. The three men tested bomb materials which would later be used on the Air India flight. On June 19th, 1985, one of Parmar’s associates (suspected to be Hardial Singh Johal) then used $3,005 in cash to buy two Canadian Pacific Airlines tickets that connected with Air India flights.

Financial Resources

The plotters had enough capital in advance of the attack to attempt to bribe co-conspirators. One witness involved in the investigative inquiry that followed the event stated “that Sikh separatists in Vancouver had offered him $180,000 to help them get a bomb on an aircraft.” A briefcase full of cash was shown in attempts to entice the individual’s involvement. The money was planned to have been put into a lawyer’s trust fund, if accepted. Overall, BKI and other Sikh-militants raised, stored, and used significant resources to plan and conduct the bombing

Estimates vary on the cost of the attack - one researcher estimated that the operational costs of the Air India bombings were approximately $3,000. However, an exact costing of the event is impossible given the changes in price of equipment and goods over time, and the lack of detail that was included in official documentation. It is important to note that the costs involved in the attack likely exceeded the items outlined in official reports, and likely included other elements such as operational security measures, incidental expenses, and more. As such, the cost of the attacks likely exceeded this estimate (particularly as the airline tickets alone cost more than $3,000).

Adjusted to 2018 US dollars, the attack would have cost the equivalent of at least $7,000 today. This makes it a relatively expensive attack (the median cost of attacks over time is closer to $1,000), and in the lowest 20% in terms of cost per victim.

Government Response

In the decades that followed the attack, Canadian authorities attempted to investigate and hold those involved accountable. Out of three individuals accused of involvement, only one, Inderjit Singh Reyat, was convicted of manslaughter for his role in building the bombs. The attempted prosecutions were deemed to be one of the longest and most expensive trials in Canadian history. A high security courtroom was even built in Vancouver’s downtown, at a cost of more than $7 million, to hold the accused involved in the bombing. In addition, one witness was paid $460,000 to cooperate and testify against one of the defendants in the trial. The failure of Canadian agencies to prevent the attack, alongside issues in the subsequent investigation of the bombing, led to a public inquiry into the events of Air India Flight 182.

In 2010, Canada released a commission of inquiry into the incident which concluded that a “cascading series of errors" by the Government of Canada, the Royal Canadian Mounted Police, and the Canadian Security Intelligence Service failed to prevent the disaster. Issues with information sharing and the destruction of intelligence plagued the initial investigation. Supreme Court of Canada Justice John Major called for a series of changes to the Canadian security and intelligence apparatus – including strengthening the counter-terrorism financing regime. The entire fifth volume of Major’s inquiry was dedicated to terrorist financing. One area of particular interest was enhancing investigation of the charitable sector. BKI was granted charitable status in Canada, and various reports suggest that funds collected to support Sikh temples in Canada may have been diverted to support Sikh militancy.

Lessons Learned

Ultimately, the Air India Flight 182 attack resulted in several lessons learned for the Government of Canada – one of which being the importance of investigating the financial activities of suspected extremists. However, the results of efforts to improve this aspect of investigations (and to prosecute terrorist financiers) have, to date, been very limited. In Canada, there have only been two successful terrorist financing convictions, and as the Cullen Commission illustrated, financial intelligence in Canada is poorly understood.

Insight Intelligence

A missed opportunity: Canada's Cullen Commission

Welcome to a special (Friday!) edition of Insight Intelligence, brought to you by my annoyance with Canada’s anti-money laundering regime. This week, the Cullen Commission released its much-anticipated report on money laundering in British Columbia. The mandate of the commission was to look at a variety of different aspects of money laundering in the pr…

Read more

4 years ago · 4 likes · Jessica Davis

While the national terrorist financing regime has changed immensely since 1985, we can still learn from this case. All attacks require financing – and connecting those transactions with other information can be crucial for understanding the intent and capabilities of potential attackers. Further, understanding the financing of attacks (operational financing) can help to identify opportunities to disrupt terrorist activity before it occurs – if we are paying attention and dedicating the appropriate investigative resources.

Share

Read more

Subscribe now

In early May, media reports circulated stating that the Sri Lankan terrorist attacks in April 2019 had been “funded by Bitcoin” and that the transaction had been processed through a Canadian company. These reports are highly misleading, so let’s have a look at what actually happened and what it means for the Canadian financial sector and national security writ large.

What really happened

In early May, an Israeli private intelligence firm (Whitestream) announced that it had traced Islamic State Bitcoin transactions, saw many interesting transactions, and loosely connected those transactions to the terrorist attacks in Sri Lanka. Media reporting subsequently announced that the terrorist attacks had been “funded by Bitcoin.”  According to the researchers at Whitestream, the Islamic State used a Canada-based company called Coinpayments to convert bitcoin to fiat currency. The researchers had apparently identified an Islamic State Bitcoin wallet through social media posts / calls for donations and monitored transactions associated with it. The information linking the transaction to the Easter attack was the timing of the transaction: according to Whitestream, “On the day before the Sri Lanka terror attacks, we identified two relatively big transactions at this address with bitcoins worth about $9,800.”

The media reporting (and to a lesser extent, statements by Whitestream) are misleading, so let’s walk through it:

1)       First of all, it is highly inaccurate (in most cases) to say that a terrorist organization or operational cell was funded by Bitcoin. Bitcoin is a method of moving funds from one location to another. Those funds are donated by individuals who purchase Bitcoin and send it to the Islamic State-linked wallet. In some (rare) cases, terrorists may invest in Bitcoin (or any other commodity or currency) in the hopes that its price may increase, and then sell it for a profit. Terrorist fundraising schemes involving commodity or currency speculation rarely succeed.

2)       While the timing of the transaction is interesting in terms of the attack, it is highly unlikely that this transaction would have funded it - terrorists raise and use funds for weeks, months, and sometimes even years in advance of their terrorist attack.

3)       The amount of money involved in the transaction would also have likely been insufficient to fund the attack in its entirety. The operational expenses of such a coordinated terrorist attack (the chemicals and other components for the device, safe houses, transportation costs, possibly salaries or payments to families, travel and training, operational security measures such as phones, etc) will likely add up to significantly more than $9,800.

Fundamentally, we don’t know much about this transaction. It does appear to be linked to the Islamic State which is a concern even though it is unlikely to have funded the terrorist attacks in Sri Lanka.

What is interesting is the amount of the transaction - $9800 (in either Canadian or US dollars - reporting is unclear). This amount is just below reporting thresholds for various transactions in both the United States and Canada to be reported to Canadian or American financial intelligence units (responsible for preventing and detecting terrorist financing and money laundering). And this brings us to the Canadian connection:

Implications for Canada

Generally speaking, entities involved in moving money are considered to be money services businesses in Canada. At the moment, this is not the case for much of the cryptocurrency landscape. Coinpayments (and other payments processors and cryptocurrency exchanges) will soon be considered MSBs under regulations that were drafted in 2018 and will be coming into force in the fall of 2019.

Under the new regulations, Coinpayments would not have to report this transaction to FINTRAC (Canada’s financial intelligence unit) given that it was below the reporting threshold of $10,000. But the company would have to confirm the identity of individuals and entities related to this transaction. Under the regulations, they would need a “full compliance program,” be registered with FINTRAC, and would have record-keeping and reporting obligations (as per other money services businesses). Based on my understanding of cryptocurrencies, this seems unlikely to succeed, and how it would work in practice, and if it will be enforceable, remains a mystery.

Canada’s financial technology sector has been hugely innovative, but there have been significant concerns about the exploitation of financial technology by threat actors, not least of which includes terrorists.

While much of this concern has been overblown, there are clear cases of terrorists using financial technology, including Bitcoin, to finance their activities (particularly in the movement of funds). As such, Canada’s financial sector may be particularly vulnerable to terrorist financial tradecraft adaptation, given the dominance of our fintech sector. This will place the integrity of Canada’s financial sector in the crosshairs of groups like FATF (the Financial Action Task Force, an international body established to set regulations and norms to combat money laundering and terrorist financing), but could also make Canada’s financial sector appealing to those that want to finance illicit activity.