Intelligence agencies are warning that radicalised teenage boys and young men prepared to commit violence are an emerging security threat. Ric Stevens delves into the case of one young man who was drawn into violent and sexual extremism on the internet, to the point of planning a mass murder.
This article contains descriptions of extremist violent and sexual material, including the abuse of children, and may be upsetting for some readers.
A 15-second clip of the Christchurch mosque shooter’s rampage was the admission ticket for teenager Ronndog Keefe to enter the twisted world of violent and sexual extremist material online.
Socially isolated, playing video games for much of his time, he got drawn into the nastiest and most corrupting reaches of the internet because, there, he found a status and notoriety he couldn’t get in real life.
He did not even own a mobile phone until he was 18.
Yet, once online, he quickly amassed tens of thousands of digital images and 93 hours of video showing the most disgusting and depraved sexual abuse of very young children.
Real children suffering the worst forms of abuse at the hands of adults who filmed or photographed it all and shared it online.
Keefe collected such material and placed it on a file-sharing server where anyone with the link could access it.
At 19, Keefe also became a radicalised self-proclaimed “soldier of Christ” posting anti-Islam material and fantasising about taking a bladed weapon into a mosque or a mall to kill Muslim men.
Authorities raided his suburban Flaxmere, Hastings, home at least twice.
First, in an investigation led by the Department of Internal Affairs (DIA), it was because of the child sexual exploitation material he had been collecting and sharing on the web.
DIA officers and police seized an iPhone 12 and a PlayStation 5 gaming console from the house in August 2024 as they acted on multiple tips from overseas agencies, which had been notified of Keefe’s online activities.
The following month, police came calling again because of conversations Keefe had been having with a young woman in the United States.
Keefe indicated to her that he had advanced his plans for a mass attack, and even selected a date. She tipped off the FBI.
The date Keefe had nominated to carry out his plan was the day he was due back in court on charges of possessing and distributing offensive material.
Police by then were taking the matter seriously enough to consider that Keefe had developed “extremist ideology” and was of enough concern to be labelled a “national security threat”.
When they raided his home again, police found a bayonet, a machete and a copy of the Quran in Keefe’s room, along with another PlayStation console.
The console was logged on to a YouTube channel, on which a video had been posted from one of Keefe’s known email addresses. It contained “anti-Islam narratives”, according to a police summary of facts.
Crown counsel Megan Mitchell, who led Keefe’s prosecution in the Napier District Court, later said that he intended to target Muslim men in particular.
Police said Keefe intended his attack to be a “suicide mission”.
Keefe’s case came before the courts just as security services started to warn about the potential for acts of violence committed by young people who are being radicalised online.
The latest threat assessment from the Security Intelligence Service (SIS) warned of scenarios that match the police description of Keefe’s planned attack placed before the court.
The SIS described the most plausible extremist attack to come from a “lone actor who has radicalised online and prepares for violence without any intelligence forewarning”, using weapons such as knives or vehicles.
“Young and vulnerable people in New Zealand are particularly at risk of radicalisation, especially while online,” the threat assessment said.
Keefe is said to be the product of a good home, but a troubled school background.
His family have gang connections, but these do not appear to have played a large part in his upbringing.
Evidence presented to the court suggests he was bullied at school, and also expelled.
His mother described him as “a bright kid but very young-minded”.
Keefe has said that at the time of his offending, he was drinking heavily and using cannabis.
At his sentencing, Judge Richard Earwaker said that much of his life seemed to have been taken up with gaming and “it seems that this preoccupation with gaming has led you down this offending path”.
Keefe is now a registered child sex offender, sentenced at the age of 22 to five years and four months in prison.
In all, he pleaded guilty to 13 charges, including distributing child sexual exploitation material, exposing a young person to indecent material, and threatening to kill.
Keefe’s sentencing took place in December last year but his case came back to court as his lawyer tried to gain permanent name suppression for him. This was finally denied in the Napier District Court on February 27.
The material Keefe was collecting and posting included the worst sexual abuse of young children imaginable.
Some of it strayed into other extreme, adult activity such as bestiality and even one of a man having sex with a dead woman “in a morgue setting”, according to court documents.
The videos and images are described in fuller, sometimes harrowing, detail in the police summaries of facts and Judge Earwaker’s sentencing notes.
These documents describe real children of various ages from babies and toddlers upwards, but typically girls between 3 and 8, sometimes with the trappings of their destroyed childhood innocence – pink blankets and stuffed toys – still around them.
Other objects in the images and videos speak to the depravity they are subjected to – age-inappropriate lingerie, eye masks, bondage gear.
The videos sometimes show partial images of the adult men abusing them. They show children forced into sexual activity with each other.
A question which obviously arises is, how did a teenager from a relatively unremarkable background in provincial New Zealand get drawn into all this?
Keefe’s account of himself is inconsistent. He told different stories to different people as he was interviewed by investigators, psychologists and report-writers through the court process.
Testimony he gave in court on the one time he took the witness stand – in a disputed facts hearing last year – was also rejected in part by Judge Earwaker.
The judge said he did not believe Keefe’s claims that he had no personal interest in the sexual material he was sharing, and that he did it because he was scared of being “doxed” or publicly exposed by other members of an extremist group online called “764”.
But Keefe’s general account of how he got drawn into his offending is not wholly implausible. It is hard to imagine that he made all of it up.
In a sworn affidavit, Keefe said he first learned about the sadistic 764 group – declared a terrorist entity by the US Department of Justice – while playing the video game Call of Duty: Modern Warfare, which uses the group chat platform Discord.
Keefe had found a 15-second clip of the Christchurch mosque shooter’s livestream video, which is illegal to possess or distribute, and he said it reminded him of the game he had been playing.
On November 22, 2022, he uploaded the clip to a Call of Duty server “without thinking too much about it”, or whether what he was doing was legal.
Shortly after he uploaded the video, he was contacted by another gamer who turned out to be a member of 764 and who invited him to join the group.
Keefe accepted.
A day or two later, he received a request from a member of the group to distribute a degrading image of a young person. Exactly what was in it has not been disclosed.
Keefe said he replied, “F*** no, I’m not doing that”, and that he was then threatened with exposure online if he did not comply. He reluctantly created a new username and uploaded the image to the server.
Looking back, Keefe said the activity was “a bit like a war” where groups online compete to bring down game servers by posting objectionable images. Bots check content being uploaded and shut down the servers that carry such material.
He claimed that he did not open what he was posting or distributing and had no personal interest in it – people would send him files and he would just see the thumbnail images.
Judge Earwaker did not believe this part of his testimony.
Over the following two years, Keefe created more than 20 accounts and usernames. As each one got banned or suspended on the servers he was interacting with, he made another one.
He said he dealt with a number of identities at 764, including someone he knew as Neo.
He said that 764 had pages where they posted details of people who had crossed them. He said he posted videos on behalf of Neo reluctantly, so his personal information, including his driver’s licence information, would not be posted online.
Judge Earwaker did not believe this either, saying Keefe’s explanation of why he distributed the images was “simply not credible”.
“In my view, the fact that he continued to do so [distribute the images] for almost two years, creating and using 24 unique email addresses, indicates that he had an interest in this material rather than a fear of having his driver’s licence and IP address published,” the judge said.
“In addition, despite wanting this court to accept he was the victim of doxing, in a four-hour video [interview] with the DIA, he did not tell the interviewer about doxing or threats of exposure.”
Another explanation for Keefe’s offending is that he wanted to be seen as an “edge lord” – a phrase he used in the witness box at his disputed facts hearing; someone who posts shocking or extreme material on the internet.
This is supported by psychological reports, which have not been released publicly but which have been referred to in court.
They suggest that both the sexual and the violent content offending was driven by the prestige Keefe gained online in a community that had an extremely warped sense of what was worth distributing.
He got involved in it because it helped him feel powerful.
In the words of his defence counsel, Matt Dixon, Keefe’s involvement in 764 gave him a purpose and a level of kudos he was unable to achieve in real life.
Also undermining Keefe’s claim that he had no interest in the sexualised material involving children was the fact that he directly groomed a 13-year-old girl, while pretending to be a boy around her own age.
She is not the young woman who reported him to the FBI.
Keefe talked to her on Snapchat between July 5 and 16, 2024, using the name Ezikel Spounder.
He made sexual comments to her and persuaded her to send him explicit images of herself, promising in return to send her digital tokens to play games online.
“The nature of this exchange clearly demonstrates that the requests the defendant made for her to send him child sexual exploitation material highlights it was for his own sexual gratification and not due to fear of doxing,” Judge Earwaker said.
“It is clear the defendant is fully engaged on a very personal level by the nature of his comments and the requests he made to the victim.”
Keefe did not delete the images of the girl from his phone.
The online network Keefe was involved with spans the globe.
Its members are involved in a wide range of criminal activities, summed up in background material presented to the court by the DIA.
The DIA said the network, also referred to as “the Com”, or community, is engaged in hacking, fraud, doxing, extortion (including sexual extortion, or “sextortion”), the creation and distribution of child sexual exploitation material, violence and even murder.
The most notorious group to emerge from the Com is 764, created in 2021 by a 15-year-old boy based in Texas, Bradley Chance Cadenhead, who named it after the first three digits of his home town’s zip code.
The young Texan, who like Keefe, was a bullied and socially isolated teen fascinated by graphic material online, drew his inspiration from an earlier network called CVLT (or “Cult”).
He is also now in prison for his online offending.
CVLT coerced children into performing sex acts on camera, then used the images to further extort them — 764 expanded its method to include other forms of abuse, including making children harm themselves or commit acts of animal cruelty.
The users gathered child sexual material to create digital “lore” books, which are used as currency, traded, archived and promoted to increase a user’s status or to recruit members.
The 764 group operates on platforms which include those that are popular with New Zealand children and teens – Discord, Roblox and Snapchat.
A study reported on the British Psychological Society website also included Minecraft in the list – another gaming platform popular with young New Zealanders.
That article, drawing on open source Reddit data, examined children and young people’s experiences of 764.
“The harm posed has been labelled as sadistic, involving blackmail and stalking,” the study said.
“The comments revealed that perpetrators specifically target vulnerable minors, who are witnesses to and forced to engage in animal torture, self-harm, and child sexual abuse material, to name a few.”
The FBI in the United States has posted public warnings saying that 764 typically exploits minors ranging from the ages of 10 to 17.
“Members of 764 exist throughout the United States as well as around the world,” Ryan Maxwell, of the FBI Chicago Field Office, posted online.
“They’d build trust with their victims and later coerce them into sharing personal information and explicit pictures and videos.
“The 764 members then use these photos and videos to blackmail their victims into a cycle of escalating manipulation.”
According to a report, Networks of Harm, from the London-based advocacy group Institute for Strategic Dialogue, gaming platforms are seen by 764 as “the most productive hunting grounds” for finding potential victims.
“The main draw for 764 to these platforms is their young user base,” the report said.
“Children are seen as prime targets due to their inexperience [of] recognising manipulative behaviour, and their lack of operational security, which can expose them to doxing and extortion.
“Moreover, within 764, victimising young children functions as a perverse means of obtaining status, with younger victims generating more clout for the abuser.”
In the nearly two years that Keefe was offending on the internet, he amassed a vast library of digital files showing exploitation of children, not just in the 10 to 17 age group, but much younger and down to pre-school age.
Investigators accessed an account operated by Keefe on the New Zealand-based online sharing platform MEGA.NZ.
They found 3432 media files. Some of them appeared duplicated but 2052 were “binary unique”.
Using a forensic image analysis tool, they categorised the imagery and identified 2309 files (1346 binary unique) that were objectionable in that they involved the sexual abuse of children.
The videos showing children being abused and exploited totalled 93 hours.
Twenty of the files contained violent extremist content, including five of the Christchurch mosque shooter killing worshippers.
All of the files were made available via a public URL created by Keefe in May 2023, allowing anyone with the link to access the contents.
Keefe kept a vast amount of other material on his phone.
He has refused to provide the PIN number for it, but investigators have been able to extract information from it anyway.
At the time of Keefe’s sentencing in December last year, analysis of this material had still not been done.
There were another 54,000 media files still to be examined.
On the judge’s order, when the investigators have finished with them, Keefe’s devices will be destroyed.
“Soldier of Christ” is still the motto on Keefe’s otherwise empty and neglected Facebook page.
Because of the amount of time Keefe spent in custody on remand, before he was sentenced, he will be eligible to be considered for parole this year.
After Keefe was sentenced, Detective Inspector James Keene, of Eastern District Police, said the case showed a commitment by New Zealand and overseas agencies to work together effectively.
“This individual preyed on the innocence of children by distributing horrific child abuse and exploitation images online, including personally requesting explicit images from a teenager.
“Any threats of mass harm, such as in this case, are always of concern to Police, which is why we moved quickly to arrest this man, and sought to detain him in custody.”
The Department of Internal Affairs, meanwhile, encouraged parents to talk to children about their online activities.
Ric Stevens spent many years working for the former New Zealand Press Association news agency, including as a political reporter at Parliament, before holding senior positions at various daily newspapers. He joined NZME’s Open Justice team in 2022 and is based in Hawke’s Bay. His writing in the crime and justice sphere is informed by four years of frontline experience as a probation officer.