4.1 How the issue arose
1
After 15 March 2019, the New Zealand Security Intelligence Service commissioned a review by an external assessor of its processes and decision-making in the lead up to 15 March 2019 (the Arotake Review).2
2
An employee involved in the immediate post-attack investigation became aware that the individual had used the username Barry Harry Tarry (see Part 4: The terrorist). They recalled that, sometime in 2018, while they were on secondment to the Combined Threat Assessment Group, they had seen a report containing images of social media posts made by Barry Harry Tarry. The employee reported their recollection to the external assessor carrying out the Arotake Review.
3
The New Zealand Security Intelligence Service undertook a comprehensive search of its records, but neither it nor the external assessor was able to validate the memory. We have received full cooperation from both the employee and the New Zealand Security Intelligence Service in our inquiries into this matter.
4
The employee said that the posts comprised a limited amount of “social media-type material, including broadly right-wing views and memes”. The employee said that the posts “did not appear inherently threatening or violent” and that the material was similar to the online rhetoric used by those who hold extreme right-wing views (see Part 2, chapter 5).
5
The employee’s recollection is that the material did not warrant escalation due to lack of intent, capability or imminence. The employee said that if the material had been seen as warranting escalation, they would have submitted it to the New Zealand Security Intelligence Service’s Counter-Terrorism Unit for leads triage. In the normal course of their job, the employee is “regularly exposed to threat-related information” and the New Zealand Security Intelligence Service considers the employee “well qualified to judge … information and whether it warranted escalation”.
6
The employee recalled discussing the posts with a colleague (or colleagues) at the time. However, no one else could recall the conversation or the Barry Harry Tarry username.
7
The material was not referred on.3 As a result, the Barry Harry Tarry posts were never the subject of a lead investigation and thus we have avoided using that term in this context.
4.2 What did the employee see?
8
This is an elusive issue.
9
The employee’s memory is that the social media posts from Barry Harry Tarry were in a finished intelligence report, which was in a system accessible to the Combined Threat Assessment Group.4 The Combined Threat Assessment Group is responsible for preparing threat assessments that inform decision-makers of the threat posed to New Zealand and New Zealanders by terrorism (see Part 8, chapter 4). Its role, therefore, is distinct from the New Zealand Security Intelligence Service’s Counter-Terrorism Unit, which is responsible for investigating leads. While the Combined Threat Assessment Group may conduct its own online research, it typically receives and evaluates information in reports produced by other agencies and organisations, that is, processed intelligence reporting and assessment. It does not collect or access raw social media posts or other online material.
10
After 15 March 2019, the employee made authorised inquiries to try to substantiate (or otherwise) their recollection. The employee was unable to find any report or communication in the New Zealand Security Intelligence Service’s records referencing Barry Harry Tarry that pre-dated 15 March 2019.
11
In addition to the employee’s inquiries, the New Zealand Security Intelligence Service also conducted a thorough search of the New Zealand Intelligence Community’s records, including its own records. The search included speaking with the employee’s colleagues. There was nothing found that referenced Barry Harry Tarry dated before 15 March 2019. The search did not, however, include a search of images that were not in a machine-readable format. That said, no collection activity has been identified that could have resulted in reporting containing images such as those the employee recalled seeing.
12
We also asked New Zealand Police and the Government Communications Security Bureau (which contribute funding and seconded staff to the Combined Threat Assessment Group) to search their records for material referencing Barry Harry Tarry dated before 15 March 2019. Neither agency had any information on Barry Harry Tarry.
13
We know that on 12 February 2018, the individual made several posts to The Lads Society Season Two Facebook page under the username Barry Harry Tarry (see Part 4, chapter 4). These posts correspond generally to what the employee said they saw, because:
- they are social media posts by Barry Harry Tarry;
- the posts use Islamophobic language and indicate a right-wing extremist ideology; and
- the tone of comments would likely have attracted the interest of an intelligence officer who saw them.
14
We inquired into whether the The Lads Society Season Two Facebook page posts made by Barry Harry Tarry may have been what the employee remembers viewing. However, the employee did not recognise the posts when we showed them to the employee. We have also found no plausible mechanism by which the posts could have been provided to the Combined Threat Assessment Group. As well, the Australian Security Intelligence Organisation told us:
Before 15 March 2019, the individual … had not been identified by [the Australian Security Intelligence Organisation], nor was he the subject of an [Australian Security Intelligence Organisation] investigation. Consequently, [the Australian Security Intelligence Organisation] had not shared any information on the individual with [the New Zealand Security Intelligence Service] or any other New Zealand agency before the [terrorist] attacks.
15
We therefore think it is possible that the employee’s memory may be awry.
4.3 Concluding comments
16
The only posts associated with the username Barry Harry Tarry that we are aware of, and that may have warranted investigation, are those set out in Part 4, chapter 4. As explained, we are satisfied that the employee could not have seen these posts before 15 March 2019.
17
If the employee saw some posts of which we are not aware, we are in no position to second-guess their assessment that they did not justify further action.
2. New Zealand Security Intelligence Service The 2019 Terrorist Attacks in Christchurch: A review into NZSIS processes and decision making in the lead up to the 15 March attacks (Arotake Review) (June 2019).
3. New Zealand Security Intelligence Service, footnote 2 above at paragraph 46.
4. New Zealand Security Intelligence Service, footnote 2 above.