Inside his home, officers found a bayonet and a diary outlining the man’s manifesto.
“His plans were to target either a mall or a mosque and kill men. He intended this to be a suicide mission,” police said in a summary of facts obtained by the Herald.
Just a month before police received the “critical and imminent” tip from the FBI, the man’s home was raided by police over allegations he was linked to the online sexual exploitation of children.
Evidence of horrific, illegal content was discovered on the defendant’s electronic devices.
Investigators from the Department of Internal Affairs (DIA) digital violent extremism team had been monitoring the man’s online activity for two years, according to the summary.
During that time, the defendant, who has name suppression, told a US woman of his desire to carry out a mass attack to gain notoriety.
However, it was the raid over the child sex abuse material that prompted the man to accelerate his plans for the attack and choose a date for when he’d carry it out.
The summary said he disclosed the date of his planned attack to the US woman he’d been talking to online.
FBI investigators subsequently spoke to her.
“The defendant told the young woman that he planned to commit a mass stabbing attack. He planned on doing the attack on the day he was due to appear in court on other charges,” the summary states.
The summary said the man planned to “use a blade or bayonet” during the attack and had also acquired an airsoft tactical vest.
Police received the information from the FBI on September 28 and later that day they swooped on the defendant’s home again with police locating two bladed weapons, one of which was a bayonet.
The defendant described himself as a “soldier of Christ, his country, people and religion,” according to a note in his diary that was photographed by investigators.
The man stated in the diary he was radicalised at the age of 19.
Police also found a Sony PlayStation 5 which was logged into a YouTube channel which had a video containing anti-Islam narratives. A Quran was also found in the man’s wardrobe.
“The defendant’s extremist ideology and activities along with his threat to conduct a mass stabbing event is of significant concern to the New Zealand public and as a national security threat,” the summary states.
He was charged with threatening to kill and cause grievous bodily harm, and the court has confirmed to the Herald he’s pleaded guilty to the charge.
Defendant part of extremist group 764
During a forensic examination of the man’s devices seized during the initial raid, vast quantities of disturbing and illegal content were discovered – most of which is too graphic to publish.
The first search of the man’s home was on August 20, 2024, according to another summary of facts obtained by the Herald.
The search was conducted after the DIA received 81 separate tips from the US-based National Centre for Missing and Exploited Children (NCMEC).
NCMEC works with law enforcement globally to combat child exploitation, and the 81 alerts linked to the man were generated in the 12 months to November 2023.
The summary of facts shows when investigators seized the man’s electronics, they found thousands of images and videos of child sex abuse material.
Investigators also found evidence he’d been communicating with a child on Snapchat.
The defendant encouraged the child, aged 13, to send him sexually explicit images, a police summary of facts said.
“He also tells her that he loves her and offers to provide her with gaming tokens,” the summary states.
The man gave investigators access to his MEGA.NZ account while claiming he couldn’t remember what was in it. MEGA is an online file sharing platform.
A forensic analysis by a DIA investigator identified that 2309 files within the MEGA account promoted the sexual abuse and exploitation of children.
The files were publicly accessible to anyone with the relevant link, the summary said.
As well as the child abuse material, bestiality content and a video of a man having sex with a corpse in a “morgue setting” was discovered.
The summary shows the man used 24 different emails to create different accounts on the social media platforms Discord and Instagram which he then used to distribute child sex abuse material.
He’s pleaded guilty to charges of possessing and distributing child exploitation material.
The man’s cell phone was also seized, although he refused to give police his pin code.
However, investigators managed to extract data from the phone anyway and found five video clips taken from the livestream of the 2019 Christchurch terror attack.
One of the videos was overlaid with a blue star of David and mixed with dance music.
The five videos of the terror attack were among 20 files on the cell phone that were categorised as violent extremist content.
The man also admitted to being part of a sadistic online exploitation group known as 764.
Members of 764, which are part of a wider network known as The Comm or The Community, try to exploit and radicalise others and promote violence.
The Herald has previously revealed the DIA’s growing concerns about such groups.
In May, the FBI arrested the ringleaders of 764 with US Attorney General Pamela Bondi describing the group as “one of the most heinous online child exploitation enterprises” investigators have ever seen.
Extremist ‘red flags’
The manager of the DIA’s digital violent extremism team Glenn Williams told the Herald groups like 764 are part of a nihilistic extremist network whose members use blackmail to extort and choreograph the sharing of illegal content, including acts of self-harm.
He said there were multiple reasons young people could be drawn to such groups.
“The appeal is a manufactured sense of belonging, power and transgression,” he told the Herald.
The “clout chasing” by members of such groups was amplified by memes and in jokes, he said.
Speaking generally, he said teenagers were vulnerable because they were particularly susceptible to “edgy content” like violence or gore and to online communities that normalise it.
Williams encouraged parents and caregivers to talk openly with young people about their online activity.
“Trust your instincts and start a calm, non-judgmental discussion,” he said.
He said there were multiple red flags to watch for, including sudden withdrawal or mood changes, unexplained secrecy about device use, and shifts in sleep patterns.
“Most concerning are signs are self-harm or talk about not being wanted or needed. These indicators should be considered together, not in isolation,” he said.
He urged parents to monitor online activity and familiarise themselves with the apps being used.
Williams said, if possible, those concerned about a young person’s online or real-world behaviour should gather evidence like screenshots of usernames and links and seek help from authorities.
Michael Morrah is a senior investigative reporter/team leader at the Herald. He won News Journalist of the Year at the 2025 Voyager Media Awards and has twice been named reporter of the year at the NZ Television Awards. He has been a broadcast journalist for 20 years and joined the Herald’s video team in July 2024.