Knives

Attempted purchase from Hunting and Knives

165. As addressed in the previous section, in October 2023 AR had obtained a machete with no age verified delivery from Hunting and Knives.

166. When in the summer of 2024 AR wanted to buy a chef’s knife as an offensive weapon, it was (perhaps unsurprisingly given their lax standards) to Hunting and Knives that he first turned.

225

167. As such, on 21 June 2024 AR made an online order from Hunting and Knives for an ‘Arcos Niza Series 200mm (c.8 inch) chef’s knife’.522 First Witness Statement of Mr Martinez HKAW000032/§§16-17, §37. He gave the same details of Olakunle / Samuel as the purchaser, the email address a.megalania7@yahoo.com and the billing and shipping address of 10 Old School Close, Banks PR9 8SB.

168. For reasons that remain unclear, AR did not complete the payment page for this purchase. As such, the age verification stage was not reached, and this knife was never in fact dispatched to him.

169. On 11 July 2024, in the apparent belief that the purchase had gone through AR emailed Hunting and Knives, from his a.megalania7@yahoo.com address, in the following terms: “It has been 20 days since I ordered a product from HK and I still haven’t received it even though the confirmation email said it would take 20 business days. When will my order be delivered?”523 HKAW000009.

170. On 12 July 2024, Hunting and Knives sent an email reply to AR at as follows “can you please tell me your order number?”524 HKAW000010. To which AR replied “#100005276”.525 HKAW000011.

171. On 15 July 2024 Hunting and Knives then emailed AR in reply stating, “I am sorry to tell you that your order is pending because you haven’t paid yet… Sorry. Have a good day”.526 HKAW000012. AR does not appear to have replied to this, which may have been because, as below, on 13 July 2024, he had turned to Amazon instead to source knives.

Purchase of the knives used in the attack: online order

172. On 13 July 2024 at 20:16, AR placed an online order for an ‘Apollo Chef Knife 20cm Cerbera’ from Amazon (order number 205-1823547-6705969) with his Amazon account.527 AMA000056, row 97.

173. The product page for this knife, and for bladed articles on Amazon in general, included the following warning:

“Age Verification Required: This product is not for sale to people under the age of 18 and will require an online age verification check. To confirm the recipient is over 18, valid photographic ID with a date of birth may also be required upon delivery. The driver will input your year of birth into their device and may then require an ID check to complete the age verification process. The driver will not be able to access your information once the delivery is complete. See Details”.528 First Witness Statement of Mr Boumphrey AMA000081/§16.3

226

174. The IP address used for this purchase was 2.98.141.79 which was associated with 10 Old School Close.529 MERP000323/14. Shortly after the purchase was made, Amazon <(order-update@amazon.co.uk> sent an email to AR stating “We’re writing to let you know that your order has been successfully cancelled…. Customer Cancelled APOLLO Chef Knife 20cm CERBERA Qty: 1”.530 AMA000096, row 98; First Witness Statement of DCI Pye MERP007551/§63.

175. Less than a minute later, AR placed an online order for two ‘Apollo Chef Knife 20cm Cerbera’ from Amazon (order number 205-7351162-4218749). He used the same account but the IP address was 104.243.213.232, which was associated with a Virtual Private Network (VPN).531 MERP000323/15. AR, therefore, had cancelled his first order for the Apollo knife and shortly thereafter placed a new order for two of the same Apollo knives using a VPN. Presumably, AR felt that the use of a VPN would avoid scrutiny.

176. Once a customer clicks ‘proceed to checkout’ on Amazon, they are taken through a process of age verification. The purchaser provides their date of birth, their ‘legal’ name and their place of residence. These details are sent by Amazon to Experian, an age verification provider, and checked against various databases including government, voter and credit records. If this process verifies that the individual is 18 or over, the customer proceeds to the checkout. Otherwise, the purchase is not completed.

177. At the age verification stage, AR provided his father’s details (namely, Alphonse R’s name, address and date of birth) for the first of these two orders, which were accepted. He was not required to repeat this process for the second order, using the VPN, because in July 2024 the online age verification check was only required to be undertaken once for an account.

178. Alphonse R’s details were accepted, notwithstanding they did not match the information provided as regards the purchaser. There was no requirement for the online age verification details to match the details of the order: Alphonse R’s details were accepted even though the shipping and billing name given was “Ax Rud” and the credit card name was AR’s full name. Mr Boumphrey agreed that any child would have been able to circumvent the age verification requirements by providing the name and date of birth of an adult with whom he or she lived. He accepted that the lack of a link between the online age verification and the purchaser or the recipient on delivery was a fundamental flaw in Amazon’s systems, as in force in July 2024. He conceded that, in relation to online age verification, the company had “got the balance wrong” between the practicalities of buying articles online as set against the need to ensure there were effective controls to prevent the supply of prohibited items to those under 18. He did not contest the suggestion that what occurred to circumvent the age verification was “child’s play”.532 T/S: 17/83/5-10.

227

179. By way of an additional weakness at the relevant time, if a customer was unsuccessful in using the age verification process and sought assistance, Amazon’s internal guidance suggested that the customer was advised to “try and submit the details of someone else in their household”.533 AMA000008/4. Mr Boumphrey agreed that this was not an acceptable direction to give to a minor because they were potentially being directed to a way of avoiding the age verification measures.534 T/S: 17/87/1-88/18.

180. Although, as set out below, these processes have now been changed and improved, I nonetheless express my profound concern that it took an incident of this magnitude to prompt Amazon into instituting new processes which have rendered it less easy for lethal weapons to be delivered to those under 18. For a major e-commerce platform which buys and sells a vast range of products online, these deficiencies should have been appreciated and rectified long before the tragic events at the Hart Space on 29 July 2024. Amazon was founded on 5 July 1994, it was launched on 16 July 1995 and it rapidly expanded over the succeeding 10 years. It is a highly experienced retailer. Since 16 April 2022 there have been minimum steps a seller is obliged to take when a knife is sold to someone under 18 through a remote sale (where the seller is not physically present with the buyer), including an effective age verification system. The consequences of these lax and inadequate safeguards contributed significantly to the profound and tragic consequences in this case: one of these knives was used by AR when he carried out his attack, during which he killed three young girls and inflicted serious wounds and profound trauma on many others. The other knife was found wrapped in a duvet on a sofa in the living room where AR had been sleeping.

Purchase of the knives used in the attack: delivery

181. Given knives were an age verified purchase, a label was automatically applied to the packaging. The shipping label indicated “18+” in the top right-hand corner and the lower part of the label stated “Bladed Article”.535 AMA000059.

182. The delivery was made by Condor Carriers, a Delivery Service Partner (DSP) of Amazon. DSPs are independent third-party delivery companies who contract self-employed drivers to make deliveries using Amazon branded vans.

183. The delivery driver for Condor Carriers was Mr Hamza Ali. Mr Ali had initially worked for Amazon as a self-employed independent contractor (a programme known as Amazon Flex) for around a year and a half. He then started work with Condor Carriers from April 2024. He estimated that, throughout this period, he would be making a couple of age verified deliveries a day.536 T/S: 17/3/4-6/24.

228

184. In terms of training, Mr Ali had been required to view a series of videos to deliver for Amazon Flex, one of which related to age verified deliveries. Mr Ali did not feel that this was sufficient training and he had been informally trained by a relative, but this was not organised by Amazon.537 T/S: 17/7/5-8/21. When Mr Ali joined Condor Carriers, he received two days of classroom training, which included training on age verified deliveries, and spent two days riding along with another delivery driver.538 T/S: 17/9/3-17. He felt that he had received appropriate training to carry out age verified delivery, was able to speak to colleagues and was constantly given reminders about the importance of age verified deliveries.539 T/S: 17/9/18-10/9.

185. When delivering for Amazon, Mr Ali used an app which asked a series of questions in order to complete the delivery. For age verified deliveries, drivers were required to ask the recipient for their year of birth and enter it into the app. If the year of birth rendered the person over 25 years old, then the app asked whether the recipient appeared over the age of 25. If the recipient gave a year of birth that rendered them over 25 and they also looked over the age of 25 then the item could be delivered. If the recipient gave a year of birth that rendered them under 25, or if they appeared to be under 25, then the driver was required to check the recipient’s ID to confirm that they were 18 or older. The recipient’s name was recorded on the app. Consistent with the legal requirements, only the recipient had to be over 18 to accept the parcel and no checks were required at the point of delivery of the person who made the order or the person named on the parcel.540 AMA000065.

186. On 15 July 2024 at 12:06, Amazon <(shipment-tracking@amazon.co.uk> emailed AR <(a.megalania7@yahoo.com> as follows: “Your package with 2 APOLLO Chef Knife 20cm… will be delivered today. Order # 205-7351162-4218749 Track your package APOLLO Chef Knife 20cm CERBERA, Mult… Qty: 2. As your delivery includes an age-restricted item, someone over the age of 18 with a valid ID must be present to receive this package”.541 MERP000980/2; Witness Statement of DCI Pye MERP007551/§67.

187. The two Cerebra knives were delivered by Mr Ali to 10 Old School Close on 15 July 2024 at 17:40. A message of confirmation of delivery was sent to AR at 17:41. Mr Ali is recorded before and after the delivery by the doorbell camera of AR’s neighbour. However, the delivery itself is not captured on video and forensic enhancement of the audio did not assist in identifying who received the delivery.542 MERP008150; T/S: 17/27/1-15.

188. Mr Ali recorded on the app that the recipient’s year of birth was 1978 and the recipient appeared to be over 25. As a result, the recipient was not required to provide identification. Mr Ali testified that his personal practice was always to ask for proof of age with age verified deliveries unless “they’ve got white hair and they obviously look very old”.543 T/S: 17/16/13-17/5. Mr Ali stated that there was no way that he could have seen AR, who was 17 at the time, and yet entered a date of birth of 1978 into the app and delivered the parcel.

229

189. In his witness statement, Alphonse R accepted that only he and AR were home at the time of the delivery. However, he doubted whether he had received the delivery because the date of birth was wrong: his year of birth is 1975. He also stated that he would have intercepted and diverted a parcel if he had seen the warnings on the Amazon label. He noted that the delivery took place quickly.544 Witness Statement of Alphonse R IWS000058/§224.

190. However, in his oral evidence, Alphonse R accepted that it was highly likely that he had taken delivery of this parcel.545 T/S: 34/44/25-45/3. Indeed, there is no other credible possibility given the evidence of Mr Ali and the appearance of AR, who did not remotely look as though he had been born in 1978. Moreover, Alphonse R accepted that he might have deliberately given a year of birth that was close to his own, but did not match, either by mistake or because the question seemed intrusive.546 T/S: 34/44/7-24.

191. After the Inquiry heard evidence from Mr Ali, it emerged that the name entered on the app when the delivery was made was “Ax”. This detail was disclosed through a further statement from Mr Boumphrey.547 Fourth Witness Statement of Mr Boumphrey AMA000113/§4. This was not the only occasion on which Amazon was required to make further disclosure or correct previous evidence. Mr Ali gave a further statement in which he stated that he always asked the name of the recipient but noted that it was possible that there was a typing error, the name was given very quickly or that he misheard the name.548 HMA000004. “Ax” was the name displayed on the app and also on the parcel itself. I note the addendum to the fourth statement of Mr Boumphrey which states that Mr Ali entered a name into the app which was either an exact or close match to the name on the parcel on many but not all occasions.549 81%. See further the Addendum to Fourth Witness Statement of Mr Boumphrey AMA000117/§2. In my opinion, none of this evidence undermines the fundamental point that the date of birth entered was very close to that of Alphonse R and could not credibly have been given by AR. It is far more likely that Mr Ali, who I found to be a frank witness, misheard the name given by Alphonse R and entered the name associated with the delivery and the parcel label. I find, as a fact, that Alphonse R did accept the delivery.

In fact, this occurred on a number of occasions. Furthermore, Mr Boumphrey accepted that when Amazon was approached by Merseyside Police in relation to the attack on 29 July 2024, the company should have provided more complete information, going beyond the delivery details, and that it ought to have supplied the relevant online age verification information and the name of the delivery driver. While these issues did not engender confidence in Amazon’s systems, the errors were explained and promptly corrected so I do not doubt Amazon’s good intent or co-operation with the Inquiry.

230

Purchase of the knives used in the attack: analysis

192. The tragedy in this case, for which Alphonse R bears incalculable responsibility, is that he then left the parcel “behind the (front) door” without troubling, on his account, to read the label which stated 18+ and bladed article, or to demonstrate any curiosity as to what it contained.550 T/S: 34/45/4-49/1. This is despite the fact that he was asked for his year of birth at the point of delivery, demonstrating that the parcel required age verification. I have addressed this failing, which Alphonse R accepted was “terrible”, in Chapter 12: AR’s family.

193. Although the 18+ and bladed article warnings were clearly visible on the outside label, Mr Boumphrey agreed that some other retailers used more “noticeable” and prominent warnings on their labels. He indicated that there is internal consideration taking place as to the labelling used by Amazon. I note that Mr Ali suggested that he was unaware of the bladed article warning on Amazon packaging, although he was aware of the 18+ labelling.551 T/S: 17/20/4-22/12. Mr Boumphrey also considered that the suggestion advanced by Counsel to the Inquiry that delivery drivers could be instructed to tell the recipient that they were receiving a bladed item was an interesting proposal which he intended to raise internally. While Alphonse R had more than sufficient information to cause him to check the parcel, these measures would have further reinforced the contents of the parcel.

194. During the COVID-19 pandemic, Amazon stopped requiring a signature from the recipient. At present Amazon is not considering reinstituting the requirement for a signature for items which are subject to age verification. Although it does not cause me to doubt that Alphonse R received the parcel, I am troubled that the date of birth and name associated with the delivery do not match and that these issues could hamper other investigations wishing to establish who received a knife later used for a crime. I appreciate that there are downsides to signatures, which may be illegible, and photographs, which may raise data protection issues, but I consider that further work could be done on this issue.

195. Given the evidence of Mr Ali, in relation to the training he received for Amazon Flex and his understanding of the labelling, I have concerns about the training delivered to Amazon Flex drivers. The company has harmonised the penalties which are imposed on drivers working for Amazon Flex and drivers from DSPs when they fail to carry out appropriate age verification checks. The penalties were previously more lenient on Flex drivers, partially due to the less rigorous training that delivered to Amazon Flex drivers. Mr Boumphrey accepted that the appropriate solution was instead to improve the training delivered to Amazon Flex drivers. He stated that training for Amazon Flex drivers has been enhanced and updated.552 T/S: 17/99/25-100/11.

231

196. Amazon undertakes audits of age verified deliveries. In 2023 there was full compliance with the required procedures in 81% of cases, and 83% in 2024. The short-term goal is to reach 90%, rising to 100% in due course. In the future, drivers who do not achieve full compliance will no longer be used by Amazon. Of particular concern in this context, as agreed by Mr Boumphrey, is that in 2024 six of Amazon’s competitors had pass, or compliance, rates of only around 50%. This undoubtedly raises fundamental questions about the utility of age verified delivery systems, and whether they have sufficiently improved.

197. In relation to changes made to online age verification, in September 2025, Amazon instituted a system by which the cardholder must complete an online verification procedure for each age verified purchase. Once the cardholder is verified, the bank provides a passcode to a mobile device to ensure they are the individual making the purchase. If this improved process had been in place in 2024, it would have prevented AR from purchasing the murder weapon. The justification for having not implemented this procedure until recently was unconvincing, namely that AR was the first person whose activities alerted the company to this risk. This is unpersuasive for two reasons: first, the covert nature of such avoidance would by its very nature not come to the attention of the company and, second, the company should have been considering proactively whether their systems were fallible.

The location of certain suspect items

198. An important consideration is the location within the family home of the potentially lethal items bought by AR. This is relevant, not least, to the knowledge on the part of AR’s parents and brother as to the risk that he posed. While I have endeavoured to set out above where each purchase was found in the house, I summarise the findings here.

199. The following were either under or by the bed in AR’s bedroom: the bow and arrows and the machete (inside a black holdall); laboratory equipment used in the production of ricin (inside a box); the bottle of Isopropyol Alcohol (in a cardboard box); and other equipment used in the production of ricin, including the Tupperware box, and the bag of seeds. The industrial strength sledgehammer was in a box behind the door in his bedroom.553 First Witness Statement of DCI Pye MERP007551/§76e.

200. In other parts of the house, one set of Cerbera knife packaging was found in a carrier bag on the first floor landing.554 First Witness Statement of DCI Pye MERP007551/§76f. Another set of Cerbera knife packaging was found in a bin in the garden.555 MERP000049. The second Cerbera knife, matching the knife used in the attack, was found wrapped in a duvet on the sofa in the living room (where AR had been sleeping).556 First Witness Statement of DCI Pye MERP007551/§76g. A 14cm kitchen knife was discovered in the bathroom.557 First Witness Statement of DCI Pye MERP007551/§76h.

232

201. Items that could have been used to make a petrol bomb or Molotov cocktails were found in the lounge (namely, bottles, matches, duct tape).

202. A further machete and a sharpening stone were on top of the wardrobe in AR’s parents’ bedroom (in sealed packaging with a delivery label which read “Alice H […] 10 Old School Close, Banks”). I have addressed the possible location of the third machete above, but its location was not identified by the police investigation.