The Christchurch mosque attacks were live-streamed on the internet by a man posting online under the name Brenton Tarrant. He said he was Australian.
Distressing footage shows him firing indiscriminately at men, women and children at close range inside the Al Noor mosque on Friday.
The individual had previously posted a rambling and expletive-filled document, espousing violent right-wing ideology.
A day later, the 28 year old appeared in court in Christchurch, charged with murder.
Prime Minister Jacinda Ardern said the suspect had "travelled around the world with sporadic periods of time spent in New Zealand" and that he was currently living in Dunedin, south of Christchurch.
"I would not describe him as a long-term resident," she said
"The offender was in possession of a gun licence. I'm advised that this was acquired in November of 2017."
She said New Zealand intelligence services had been stepping up investigations into far-right extremists, but added: "The individual charged with murder had not come to the attention of the intelligence community nor the police for extremism."
Brenton Tarrant appeared in court in Christchurch in a white prison uniform. He was remanded in custody, with no bail application made.
State-appointed lawyer Richard Peters says the defendant fired him and wanted to represent himself.
"The way he presented was rational and someone who was not suffering any mental disability," Mr Peters said. "He seemed to understand what was going on."
Attack streamed live
The man in the footage equipped himself with what appears to be a head-mounted camera to live-stream the attack in central Christchurch.
The streams were broadcast online, including briefly on Facebook, showing the violence in graphic detail.
A song which played in the suspect's car is known as a marching anthem for Serbian nationalist paramilitary units known as Chetniks during the 1992-95 Bosnian war.
It praises Bosnian Serb leader Radovan Karadzic, who was convicted of genocide and war crimes.
The names of men convicted of killing Muslims and migrants are written on the suspect's weaponry.
One item has the words "For Rotherham" written on it, a reference to a child abuse scandal in the UK, while other wording references historical battles between European countries and the Ottoman Empire.
Australian media reported that Brenton Tarrant was originally from Grafton, a town 600km (370 miles) north of Sydney, and had previously worked at a fitness facility.
"He never showed any extremist views or any crazy behaviour," his former boss, Tracey Gray, told Seven News.
The 16,500-word document he posted is entitled The Great Replacement - a phrase that originated in France and has become a rallying cry for European anti-immigration extremists.
In it, the man says he began planning an attack after visiting Europe in 2017 and being angered by events there.
Specifically, he references a lorry attack carried out by an Islamic State sympathiser in Sweden, France's decision to elect the moderate Emmanuel Macron as president, and ethnic diversity in France.
Despite insisting that he is not motivated by fame, he acknowledges that he intends to survive the attack, and hopes it will spread fear.
He chose the Al Noor mosque as his target three months ago, the document says.
The central tenet of the conspiracy is that "European peoples" are dying out and being "replaced" by immigrants with a different, inferior and dangerous culture, says the BBC's Dominic Casciani.
This is basically a code for hatred or fear of Muslims - part of the theory is that states and corporations are encouraging "white genocide" by pushing up immigration rates to keep global capitalism going, says our correspondent.
Brenton Tarrant has travelled frequently, venturing to North Korea, Europe, Turkey and Pakistan.
Bulgarian prosecutor general Sotir Tsatsarov said he visited Bosnia-Herzegovina, Croatia, Montenegro and Serbia in 2016, stopping at historic battle sites in the area.
He returned to Eastern Europe in November 2018 where he saw more historic sites in Bulgaria, Hungary and Romania. Mr Tsatsarov said Bulgaria is now investigating whether he had ties with people in the country.
Turkish officials have confirmed he visited Turkey several times, and reportedly said an investigation was under way into his "movements and contacts within the country".
A hotel owner in the far-north of Pakistan told the BBC that Brenton Tarrant had spent two nights in the area in October 2018.
Syed Israr Hussain, who runs the Osho Thang hotel, said Tarrant expressed no visible hostility to Muslims or Islam.
He said he was travelling alone and "walked around the local area" taking pictures like any other tourist. The area is popular with trekkers.
A now deleted post on Mr Hussain's social media account from last October is attributed to Brenton Tarrant and reads: "Pakistan is an incredible place filled with the most earnest kind hearted and hospitable people in the world."
Mr Hussain said Brenton Tarrant left those comments "for the world to see". He added he was "shocked" by the attack in Christchurch.
There are also reports that Tarrant visited Afghanistan and China's Xinjiang region.
What about the others in custody?
Four people were arrested in the aftermath of the attack - three men and a woman, who was subsequently released without charge.
Police say they do not believe they were connected to the attack.
Of those, two remain in custody:
- a man who apparently went to help carrying a rifle, who has been charged with a firearms offence
- an 18-year-old, who appeared in court on Monday, charged with distributing the live-stream
Prime Minister Ardern said none of those in custody had been on active security watch lists in New Zealand or Australia.
"I have asked our agencies this morning to work swiftly on assessing whether there was any activity on social media or otherwise, that should have triggered a response," the prime minister said.