How we found the terrorist online

Saturday, 6 June 2026

Researchers Chris Wilson and Michal Dziwulski have found hundreds of online posts made by the mosque terrorist before his deadly 2019 attack. In an extract from their new book He Told Us, they explain how they uncovered his ‘anonymous’ online activity.

Over the 1970s and ’80s, a series of homemade bombs were delivered to targets across the United States. These included Northwestern, Yale and Berkeley universities, and the offices of several airlines. As the explosions, deaths and injuries mounted, the unknown perpetrator became referred to as the Unabomber, so called because he was primarily targeting universities and airlines.

Authorities scrambled to identify the perpetrator. An FBI task force assigned to the bombings had 150 full-time investigators and cost more than US$50 million. Despite these resources, the investigation dragged on. No evidence was found that could lead them to the bomber, who seemed to make no mistakes. No hair or DNA could be salvaged from the bombs, and none of the materials used had telltale characteristics that might connect them to the person making them. It was clear the perpetrator was thorough and had thought carefully about how to evade detection.

But the Unabomber did end up making one mistake: a major one.

The man behind the bombings, Ted Kaczynski, wrote a manifesto, and demanded that the media print it in full. The FBI encouraged major newspapers The New York Times and The Washington Post to print the manifesto, hoping someone would come forward.

The media printed it, and someone did come forward: Kaczynski’s brother, David. Ted Kaczynski had written several letters to him, outlining many of the same themes as the manifesto. And the FBI found that the similarities didn’t end there. The sentence structure, or syntax, was the same, and the documents even contained identical phrases.

Agreeing with David Kaczynski that the manifesto and letters were written by the same author — his brother — the FBI arrested Ted.

In his small cabin in the mountains of Montana, investigators found thousands of bomb-making components and a folder of 40,000 handwritten letters.

From that time on, linguistic evidence became a key tool in high-profile investigations.

Developing a method

It was very likely that the man who attacked and murdered so many innocent people in Christchurch had been a user of 4chan, 8chan or a similar site.

Many with extreme far-right views use those sites, and he had made it very clear in his manifesto that he was one of them. The problem was that posting on 4chan is completely anonymous. To use the site, people are not required to register or log in and so have no username. Instead, some boards like /pol/ assign users a random ‘Unique ID’, which appears beside any post they make in a particular thread. When they post in a different thread, they are assigned a new ID.

On a site on which mockery, abuse and trolling are rife, having your identity known means running the risk of having your address or other details publicly released, and this deters almost all users from identifying themselves. Almost everyone simply uses the name ‘Anonymous’, and the community refers to its members as ‘anons’.

To find the terrorist’s previous online activity, therefore, we had to develop a way of identifying his writing from among millions of anonymous posts.

Beginning in late 2023, we developed a method for doing so. In this task we had the benefit of hindsight: we were able to use information about him and his travel that had been gathered by journalists and investigators and released by the Royal Commission. We could also analyse the particular ways he wrote by examining his manifesto, as well as posts he had written online under his own name long before his attack.

These gave us insights into not just his opinions, but also — crucially for the task of identifying him online — his language and style of writing.

Typographical quirks

Just as Ted Kaczynski’s letters to his brother allowed him to be identified, the terrorist left a clear digital footprint: pieces of writing that we know he authored, including his manifesto and older online posts. In these documents, we noticed several striking oddities in the grammar and punctuation he uses when typing, particularly in hurried or less self-aware moments.

The most noticeable of these is his habit of omitting a space after a full stop, comma or bracket. He often places the first word of the next sentence directly after the punctuation, with no space in between.

Why he does this is unclear, but the idiosyncrasy is rare. We used randomly generated datasets of online posts to check the frequency with which the omission of a space occurs and found that it happens in only one out of every 500 posts.

The terrorist frequently made several other distinctive errors. He combined words into odd and incorrect contractions, for example ‘atleast’. He used capitals incorrectly and seemingly randomly, as in ‘United states’.

We identified this style in things that we know he wrote and could then locate it in the online posts that he wrote anonymously.

Travel

The next piece of information we could use to find his posting was location. For much of the period between 2014 and 2018, the terrorist used the inheritance he had received from his father to travel the world. He left Australia on April 15, 2014, telling people online that his travel might last for up to 20 years.

He travelled through Asia, the Middle East, Latin America and Africa, returning to Australia for brief visits before moving to New Zealand in August 2017. Even while based in New Zealand he continued to travel overseas. Overall, he visited between 60 and 70 countries.

He often sought to visit out-of-the-way locations that do not feature on most Western backpackers’ itineraries. He visited Georgia, Russia, North Korea, China, Myanmar and Kyrgyzstan, along with more common destinations such as India, Thailand and France. He visited Kenya for five days, Tanzania for eight days, Zambia for two days, Botswana for one day, Zimbabwe for three days, Botswana again for five days, Namibia for 10 days and South Africa for six days.

As a result, he spent time in many locations that are unusual for an English-speaking poster on 4chan. We have his itinerary, provided in the Royal Commission’s report, including entry and exit dates for all countries (except his entry date into Iran, which is stated as unknown). We therefore know with near certainty where he was — at least which country he was in — on any particular date between 2014 and 2019. This information has been crucial in identifying his anonymous online posting.

Posts on 4chan display the time and date they were posted, and (at least since December 2014) the /pol/ board shows where the poster is located by placing a country flag beside every post, based on their IP address. Some posters claim to use a VPN — a service that disguises their location — but studies of 4chan show that this is rare, perhaps even blocked by the site. And, while the terrorist may have used a VPN for some of his online activities, it quickly became apparent to us that he did not use one when posting on 4chan. In fact, he proudly stated on the site that he did not.

Because we had these two sets of information — where the terrorist was on any particular date, and the country location of the writer of every post on 4chan’s /pol/ — we knew how we might find him.

Self-identification

Further helping our search, the terrorist often provided personal information about himself in his ‘anonymous’ posts. He stated that he was Australian on numerous occasions, even that he was from Grafton, NSW, and that he owned a rental property in Australia (just days after he bought it).

He listed countries he had already visited, when and for how long he had stayed there, as well as places he was planning on visiting — when and for how long. These posts matched his real itinerary almost exactly, containing information that only he could have known. In fact, these disclosures made it possible to find him on 4chan boards such as /trv/ (Travel) that do not display a country flag.

As he drew closer to his atrocity, his self-identifying statements took on a more confronting tone. Combined with revealing his location, they provided opportunities for his detection.

Once in Dunedin and preparing for his attack, for example, he told other posters he was based in that city, even mentioning the gym he used and how he was enraged by an Islamic school across the road from it.

He sometimes made statements that, after his atrocity on 15 March, identify him. In one thread in 2018 he angrily discussed mosques in Christchurch and Ashburton.

Replication of comments in known and anonymous forums

In some cases, the terrorist wrote the same things under his own name (or a known username) and in his anonymous posting on 4chan. This would often occur around the same time.

In 2018 he made posts with near-identical content on both an Australian far-right group’s Facebook page (the Lads Society) and an anonymous 4chan /pol/ thread. It was in these posts (see page 158 for the version quoted in the Royal Commission’s report) that he talked about his Dunedin gym and expressed anger about an Islamic school across the road. In both posts, he named the same specific individuals from the local Muslim community (the names he wrote are redacted to protect the privacy and safety of the individuals). The Royal Commission reported that when interviewed, he said ‘these were the worst of the comments he had posted’. Like much of what he told the Commission, this was far from true.

The terrorist also replicated stories and phrases on various anonymous boards on 4chan. For example, on three different occasions over three years, he told a story on /trv/ and /pol/ about being questioned in North Korea when carrying a marine EPIRB (a small electronic device used to send a distress signal). Finding him discussing uncommon topics like this in multiple locations allowed us to add extra words, phrases and errors to our list of search terms.

The terrorist’s posts often contained several of these indicators simultaneously. And because he often posted numerous times in a thread — in some cases 20 times — there was a lot of opportunity for him to give himself away. Across multiple posts in a single thread, it was frequently possible to see missing spaces, incorrect contractions, mention of his travel or Australian identity or other self-identification, and distinctive words and terms he used elsewhere. Multiple indicators can be seen in the example posts in the insert.

We maintained a high threshold for including posts in our study. Often we had a strong sense that particular posts were authored by him, but if several indicators were not present we excluded them from our analysis.

Five years of posting on extreme right-wing websites

Just as the FBI task force was able to use the Unabomber’s writing to identify him, we used the indicators we had developed to find the terrorist’s anonymous posting. We compiled a dataset of 416 of his 4chan posts, the majority made between 2014 and 2018.

The final post we found was made on March 14, 2019, the day before his attack.

We combined these 416 previously unknown posts with the approximately 300 posts (written under his name or a known username) that were already known to investigators. These newly discovered posts tell us a great deal about his opinions, his motivations for his attack and his preparation. We can see his thinking change over time, becoming more radical and more focused on violence, as we discuss in the next chapter.

With this new information, his offline behaviour begins to make more sense and we gain a much clearer picture of his path to violence. Importantly, we can see how his engagement with the /pol/ community contributed to his offline progression towards violence. We can also see how his posting on 4chan became increasingly militant the more he engaged with a high-profile Australian far-right movement.

The posts also undermine many of the claims he made in his manifesto. They show that he was not the reluctant warrior for the white race that he portrayed himself to be, but instead a pathetic fantasist, desperate for respect.

A man who travelled the world on his father’s inheritance but was too nervous to engage with people face to face, choosing instead to sit in physical isolation and interact with strangers online, imagining them to be his friends.

HE TOLD US: How an Australian committed far-right terrorism in Christchurch, New Zealand by Chris Wilson and Michal Dziwulski. Published by Allen & Unwin Aotearoa NZ. RRP$$37.99. In bookstores nationwide from Monday 8 June.