Standing in his bedroom, wearing a mask and boilersuit, a teenage boy is posing with a 9mm semiautomatic Glock handgun pointed at the camera, acting out in his mind a plan to massacre students at his former college in less than 24 hours’ time.
The self-portraits (above) were taken on Sunday 2 November 2014 in the same bedroom where Liam Lyburd, then aged 18, had bought an arsenal of weapons, including homemade pipe bombs, CS gas canisters, and 94 expanding bullets, through shadowy online cryptomarkets. He had written “BITCH KILL” on the wall.
But this was not in America, where school shootings have become tragically commonplace. This was Newcastle upon Tyne.
A message on his laptop that was deleted that night but later recovered by police read: “It’s funny to think as I’m writing this that people who will die are walking around as if everything is normal, not knowing they’re going to die today, it’s a beautiful thought.”
But Lyburd’s plot to indiscriminately kill students at Newcastle College came to nothing. Police raided his home at 11:30am on Monday 3 November, hours before he was planning to carry out the attack, after someone who had seen his increasingly erratic and threatening posts on Facebook raised the alarm.
As an army bomb squad searched the house, near Newcastle United's St James' Park stadium, around 50 neighbours were evacuated.
As they led him away, he told officers they’d just averted a massacre.
Liam Lyburd, arriving at North Tyneside magistrates' court in November 2014.
Lyburd was arrested and charged with nine counts of buying or making weapons, which he later admitted to in court, and eight counts of making or buying those weapons with intent to cause harm, which he denied. He never intended to use them, he argued. The social media posts were just “trolling”.
The jury disagreed and found him guilty at a four-day trial in July, and he was sentenced to life in prison, of which he must serve a minimum of eight years, on Friday. The judge had adjourned sentencing for a psychiatric report to be filed. The report found that while Lyburd has personality disorders, he does not suffer from "acute mental illness" and never has.
So how did a reclusive teenager with no previous criminal convictions come close to carrying out a mass murder? And should this case act as a warning about how easy it is to access guns in the UK through illicit digital markets?
BuzzFeed News followed the trail of Lyburd’s activity online to build a picture of how a talented teenage hacker, high on valium, scammed people out of cash and spent it on weapons on the digital black market.
BuzzFeed News has also obtained internal communications from Newcastle College that raise questions over the measures UK schools and colleges have in place to deal with a potential firearms attack.
In many respects, Lyburd was typical for someone of his generation. He spent his days on social networks, posting links to films and songs he liked.
However, under the name Felix Burns, one of several aliases, he also wrote a tribute to Jaylen Fryberg, the US teenager who shot five students, four fatally, at a high school in Washington state in October 2014 before killing himself.
Lyburd would also post links to guides on how to load guns, footage of famous police shootouts from the US, and quotes from American Psycho. In a Skype conversation with a woman in Iceland he praised Anders Breivik, who carried out a massacre on the Norwegian island of Utøya in 2011.
But as well as regular social media social networks, Lyburd was also spending time on dark net markets (DNMs) – anonymous sites only accessible from anonymised internet browsers such as Tor, where users mainly trade illegal drugs, but also counterfeit money, pornography, and lethal weapons.
DNM users hide their real identities with pseudonyms and use bitcoin, the decentralised online cryptocurrency, to make their transactions harder to trace. Transactions take place via escrow accounts – temporary accounts where the buyer places funds to be withdrawn by the seller.
Just as with eBay and Amazon, buyers leave reviews and feedback of recent transactions for other would-be buyers. Most markets have their own system of conflict resolution in an attempt to reduce fraud and theft between users, which is common.
Lyburd was active on a DNM called Evolution, a successor to the infamous Silk Road 1 and Silk Road 2 markets, which were both shut down after international police action.
Commonly known as Evo, the market shut down in March 2015 after an “exit scam” in which its founders reportedly stole around $12 million worth of users’ bitcoin, which was held in escrow accounts.
While it was running, Evolution had its own official PR representative, who did not respond to BuzzFeed News’ request for comment.
Using copies of posts from Evolution that have been preserved in a vast archive compiled by an independent DNM researcher who goes by the name Gwern Branwen, BuzzFeed News was able to follow Lyburd's activity online and build up a picture of how he managed to buy the weapons he planned to use to kill.
Lyburd joined Evolution on 27 June 2014 under the username “DonaldTrump” and became a regular poster, contributing to messageboard threads on the best places to spend counterfeit money (his advice: chip shops) and the death of Robin Williams (“I understand that this is random but I really like him and the movies that this awesome guy was in”).
He left a glowing review after buying some drugs – “Fast shipping. very nice MDMA. Strong and clean high” – and admitted elsewhere that he was on “crazy amounts of valium”. He would later say in court he was taking six and a half valium pills a day.
Before long, Lyburd was posting messages about how he wanted a gun.
Under a thread started by seller “Lenin_Cat” on 2 August, Lyburd said he was interested in getting a gun and asked why he couldn’t buy the whole gun at once. DNM gun sellers typically ship different parts, such as the barrel and frame, separately to different “drop” addresses to avoid the suspicions of customs, Royal Mail staff, and border police.
“I just wanna buy the whole gun,” he wrote. “Complicating things selling separately, reserving parts for people so you can’t completely assemble it, 750-800GBP for a BARREL. Just sell the whole gun and ship it in pieces, for one price. 4BTC [4 bitcoin, about £1,500 at the time] for the whole gun is reasonable.”
He was warned repeatedly that getting multiple items sent to the same address would alert the authorities (it would, however, be Lyburd’s Facebook and Skype messages, not his activity on the Dark Web, that actually sparked the police interest in him).
Lyburd comes across in his Evolution messages as paranoid, petulant, impulsive, and quick to anger. He often accused others of being LE (DNM slang for law enforcement) and was convinced undercover police were watching his messages. Lyburd himself was on several occasions accused of being a cop.
BuzzFeed News asked Northumbria police if the investigation did involve officers posing as regular users on dark net sites, but we received no response.
On 12 August Lyburd said in an Evolution forum post that he had spent the equivalent of £2,000 in bitcoin on a Glock handgun from seller “Guns_Ammo”, despite warnings from others on the thread that this was a known scammer.
Frustrated by the lack of progress as the order failed to arrive, he wrote: “I JUST WANT MY GUN SO BADDDDDDDDD!!!!!”
When asked whether he’d considered that getting a gun sent to the UK was a highly risky thing to do, he said: “I order all the fuckin time on here, i don't give a fuck about going to prison my life's shit.”
A week later he said he’d received a customs tracking number for the gun and that it would be delivered soon, but he later admitted on the forum that this was a lie to fool the watching authorities. The following week he revealed he had been the victim of a scam.
Eventually Lyburd got his gun. The frame came from Austria and other parts from the US and Turkey. As Newcastle's Metro Radio reported, a seller using the name Vintorez said in a forum post that he supplied the bullets and the gun frame:
“I'm saled [I have sold] to this guy. JHP [jacketed hollow point] 9mm ammo, and one G19g3 Frame....he has complete Glock 19.”
Lyburd was ecstatic at the news: “oh happy days.... I got my ammo from Vintorez today !!! I'm so fucking happy. if you need ammo buy from Vintorez he's amazing…”
At one point, as one of the parts was being held by UK customs, Lyburd posted that if he didn’t post on the forum within an hour people should assume he had been raided by the police.
Lyburd attracted ridicule on the Evolution forum when he wrote of how he would test the firearm: “I'm going to shoot 1 round in my house with some 'Nine Inch Nails - Copy Of A' blasting in the back ground at a 3A bullet proof vest.”
How did the unemployed Lyburd get the money to spend upwards of £2,000 on a semiautomatic handgun, as well as drugs and pizzas?
During the trial Lyburd claimed he posed as a teenage girl on chat rooms in order to attract the attention of paedophiles whom he would then persuade to click a link to download malware that would render their computers useless unless they paid him a ransom.
On Facebook he said he had bought the Black Hole Exploit Pack, which attacks vulnerabilities in Javascript code.
In a forum post on Evolution, he said: “I'm infecting people like crazy with infected leaked pictures of Selena Gomez & Ariana Grande & Jennifer Lawrence on the Clearweb [DNM slang for the normal internet].”
He also claimed to have used this technique to counter-scam other scammers, including some from Nigeria who sent bogus emails with offers of “unmissable” financial opportunities.
The trial heard that Lyburd would spend entire days online in his bedroom and would order takeaway pizzas using PayPal account details he’d stolen.
Lyburd argued that his weapons were merely for show and that he had never intended to use them on 3 November at the college.
But the jury agreed with the prosecution’s argument that he had a burning vendetta against the college. Lyburd attended for only five weeks in 2012 on a general studies course and was expelled because he was “disruptive in class and had a very poor attendance record”, according to documents read out in court – but there is no doubt of his simmering resentment towards the college and its students.
In a note dated 30 October that was deleted but later recovered by police investigators, Lyburd wrote: “I’ll see you in Newcastle College today. It's my first day back since 2012, the year in which my life became miserable after being kicked out for nothing.”
A separate handwritten note found by police said: “You people ruined my whole life don't expect me to show mercy today. No one disrespects me and gets away with it,” the trial heard.
On 3 November he tweeted the college, using an account (now deleted) under the name of Felix Burns, to ask if it would still be open during some construction works. The college’s response the following morning is still online:
Lyburd's case raises serious questions about the security measures in place at UK schools and colleges when it comes to extreme acts of violence.
BuzzFeed News obtained 390 pages of internal emails using the Freedom of Information Act that show the college may have overstated the level of its security as it reassured the public in the wake of Lyburd’s arrest.
The emails reveal that the director of public affairs for the college’s parent company, NCG, drafted a statement later to be released by the police that said staff and student "safety has been paramount to us and the college remains a safe place to study".
The college added a third paragraph to the police statement before releasing it to the public, saying that "people should attend the college as usual” and highlighting that "our security staff are on duty 24 hours a day”.
The college suggested that staff taking part in promotional roadshows targeting prospective students could, when asked about the security situation, respond by saying: "...Obviously we have our own 24-hour security." The claim was repeated in a briefing to local MPs and in emails to staff.
However, the all-day security claim appears to be contradicted by internal emails.
One email chain containing messages from multiple staff members, sent the day after the statement was released to the press and three days after Lyburd was arrested, said that "security at Sandyford [campus] don't start until the afternoon".
The message was forwarded to the principal, Carole Kitching, by a senior member of staff who said she had "walked around RH [Rye Hill] campus this morning and haven't seen any security staff or police".
A college spokesperson told BuzzFeed News: “We have a team of security staff on the main college campus 24 hours a day along with a network of CCTV cameras monitoring key areas inside buildings and across the campus.
“There are nominated, trained members of staff at all college sites who would contact security and police should an incident occur. We also receive regular updates from Northumbria police regarding any incidents that may impact on our business, staff, and students."
Other staff members were concerned about lax enforcement of security. Liam Carr, branch secretary of the UCU union at the college, said in an email to senior staff on 6 November: "If there was a serious incident staff members would have no clue about what action to take."
Carr asked the college's HR department for its serious incident policy. He was told the college had an emergency manual, but that it was "not for general circulation”.
A college spokesperson told BuzzFeed News that since the foiled attack, security risk assessments have been reviewed, a new emergency plan formulated, and a command-and-control centre identified. A booklet giving guidance on how to deal with potential threats has also been developed for staff, alongside training.
The college said in a statement: “The safety of our staff and students is our absolute priority and we are committed to ensuring the college is and remains to be a safe place to work and study. In a recent student survey, 94% of students stated they knew who to ask for help and felt safe at college.” The college insisted that its procedures were “robust”.
Could an attack like the one planned by Lyburd with weapons bought from the Dark Web happen for real in the UK?
Arrests of people who have bought weapons from DNMs are not rare. Earlier this month, a 38-year-old man from Milton Keynes pleaded guilty to conspiracy to import what he thought was a firearm and ammunition, but was really a plastic replica hidden in a DAB radio sent by officers from the National Crime Agency.
This week the Metropolitan police blamed the Dark Web for a rise in knife crime and warned that foot-long blades had appeared in London after being purchased on DNMs.
During the trial, Lyburd said buying a gun was as easy as “buying a bar of chocolate”.
But Gwern Branwen, the DNM researcher, estimated to BuzzFeed News that weapons sales account for about 1% of global trade on DNMs and said many markets have banned weapons sales. Drugs remain by far the most popular and lucrative item, he said.
How easy is it to get a gun into the UK via the Dark Web? “Not easy,” he said. “Customs is reasonably good at catching firearms, even disassembled.” Whereas there may have have been something like one arrest for every 2,000 purchases on Silk Road 1, Branwen said, the “failure rate” for guns or poison was “10% or 20% or higher”.
However, Branwen added, despite some of the main markets shutting down in the past two years, there was no sign that dark net commerce was going to disappear: “The death of DNMs has been predicted many times, but I see no reason to expect them to go away anytime soon. Markets come and go; thus it has ever been since SR1[Silk Road 1] closed.”
Although Lyburd admitted to owning the weapons, he argued in court that his Facebook messages about carrying out an attack were just fantasy, or an example of trolling. He said he’d bought the gun and the outfit because it was Halloween.
But in fact the evidence suggests he was hours away from carrying out what would have been the UK’s first school shooting since the Dunblane massacre in 1996, and the first to be carried out by a current or former pupil.
A talented loner, obsessed with death, was thwarted just before his murderous fantasy became reality.
Carole Kitching, the principal of Newcastle College, summed up the thoughts of parents in Newcastle and across the country when she wrote in an email on 7 November: “It’s been an awful week. Can’t get my head out of ‘what if……’”
