1

In this chapter we evaluate what Public sector agencies did with the information they held about the individual, under the following headings:

  1. The email to the Parliamentary Service just before the terrorist attack.
  2. Information held by border agencies about the individual’s travel in and out of New Zealand.
  3. The individual’s importation of ballistic ceramic plates and plastic boards, and possible importation of a helmet.
  4. The individual’s use of unprescribed steroids and testosterone, and his firearms injury.
  5. Other information held by Public sector agencies related to the individual’s planning and preparation.

 

7.1 The email to the Parliamentary Service just before the terrorist attack

2

Immediately before the terrorist attack on 15 March 2019 the individual sent an email to several recipients, including the Parliamentary Service. This email is reproduced in chapter 6.

3

A draft Standard Operating Procedure, prepared by the Security Enablement Team of the Parliamentary Service in January 2019, outlines the assessment and escalation procedures for responding to threatening calls and emails to the New Zealand Parliament. Once alerted to the individual’s email, the Parliamentary Service responded in accordance with this operating procedure by alerting the correct authorities.

4

The Parliamentary Service alerted New Zealand Police at 1.40 pm. This was eight minutes after the individual sent the email, and approximately the same time that the individual entered Masjid an-Nur (see Part 1, chapter 1). In that eight minutes, the Parliamentary Service had to:

  1. notice that the email had arrived;
  2. open the email and read it;
  3. conduct an initial assessment to determine whether the email was a genuine threat or was a hoax;
  4. determine that the email was a legitimate threat and follow the Standard Operating Procedure for response to a security incident;
  5. open the individual’s manifesto and scan through its 74 pages to page eight, where the potential targets of the terrorist attack were identified; and
  6. contact New Zealand Police via 111 and provide the information collected about the threat.

5

We consider that the Parliamentary Service acted appropriately in relation to the email within a period of time that was reasonable in the circumstances.

 

7.2 Information held by border agencies about the individual’s travel in and out of New Zealand

6

Between them, the border agencies (Immigration New Zealand and New Zealand Customs Service) held:

  1. the individual’s passport information (full legal name, date of birth, place of birth, citizenship, etc);
  2. the dates, times, arrival and destination locations of flights he took in and out of New Zealand from 1999 onwards;
  3. information indicating that he travelled with gaming friend from New Zealand to Japan and back in 2018;
  4. information that he otherwise travelled alone on flights in and out of New Zealand from August 2017 onwards;
  5. his arrival and departure cards for the last two international flights he took in 2018; and
  6. Advanced Passenger Processing and Passenger Name Record data in relation to the individual about his arrivals into New Zealand from March 2013 onwards and departures from New Zealand from 28 September 2017.

7

Not all the information on the individual’s arrival and departure cards was accurate. It is not possible to determine whether the errors were intentional or not. When the individual filled out his departure card on 17 October 2018, he said he had not been living in New Zealand for more than 12 months – this was untrue, as he had been living in New Zealand since August 2017. On his arrival card of 28 December 2018, he entered “student” as his occupation (which was not true) and did not include Austria among the list of countries he had visited in the previous 30 days (see Part 4, chapter 4). These errors were not known by Immigration New Zealand.

8

The border agencies did not hold information about the individual’s full travel history (see Part 8, chapter 8). Both border agencies ran the information they did have about the individual through their automated screening systems, and these processes did not identify any risks or issues about him. No agencies raised a border alert on the individual. The individual was never subject to secondary processing at the border and all his interactions at the border with the agencies were routine.

9

Accordingly, we see no issue with the actions taken by the border agencies in relation to the information they knew about the individual.

 

7.3 The individual’s importation of ballistic ceramic plates and plastic boards, and possible importation of a helmet

10

The individual imported two ballistic ceramic plates and two plastic boards on 28 December 2017 and 17 January 2019 respectively. The sender in each case was the same. These items, as identified on the New Zealand Customs Service declaration, were neither prohibited nor restricted goods. There was nothing about the declared origins of the goods or the ways in which they were packaged, described or valued to attract suspicion. The individual had not been flagged as a person of interest. The two items were not randomly selected for inspection by New Zealand Customs Service. In 2019, New Zealand Customs Service dealt with 16.7 million import and export transactions. In this context, it is unsurprising that the ballistic ceramic plates and plastic boards were not physically inspected.

11

As a result of inquiries made after 15 March 2019 by New Zealand Customs Service, it appeared likely that the ballistic ceramic plates were suitable for use in body armour and possible that the plastic boards were body armour parts. When we spoke to the individual, he acknowledged that these items were indeed body armour parts. There are legitimate uses for body armour, including for off-road motorcycling, and paintball and airsoft sports. For this reason, body armour is not subject to import restrictions.

12

When we spoke to the individual, we asked him about the tactical helmet he wore during the terrorist attack. He said that he had imported it from the supplier of the body armour parts and that it had come into New Zealand labelled as a bicycle helmet. New Zealand Customs Service told us that none of the imports made by the individual were described as a bicycle helmet. He imported products described as bicycle fittings or sports goods on 27 February 2018, 11 March 2018, 13 March 2018 and 27 March 2018. New Zealand Customs Service did not open and inspect any of these imported products, which is unsurprising given their descriptions. Inquiries carried out by New Zealand Customs Service since 15 March 2019 have not been able to confirm whether any of these products was the tactical helmet the individual says he imported. We have examined the helmet. It is of a kind used for airsoft sports and is easily obtained in New Zealand.

13

We see no issue with what New Zealand Customs Service did in relation to these items.

 

7.4 The individual’s use of unprescribed steroids and testosterone, and his firearms injury

Use of unprescribed steroids and testosterone

14

On 18 December 2017, a doctor from Dunedin South Medical Centre treated the individual for abdominal pain. The doctor referred the individual to the Endocrinology Service of Dunedin Hospital (a Southern District Health Board hospital), advising by letter that the individual had been taking oral steroids and injecting testosterone, and had hallmarks of steroid overuse. On 20 December 2017, the Endocrinology Service responded to the doctor by letter and offered various treatment options for the individual. The Southern District Health Board did not refer this information about the individual to New Zealand Police.

15

The individual told us that the doctor had misunderstood what he had said during the consultation. He told us that he had not been taking steroids and testosterone, but rather drugs that had similar performance-enhancing effects that were manufactured in China. New Zealand Police have not been able to establish the source of these drugs (Part 4, chapter 5). Our inquiries indicate that the individual may have acquired steroids or similar drugs online. Based on the information held by New Zealand Customs Service, none of his imports can be identified as the drugs he says he purchased.

16

Whether he was taking steroids or testosterone or drugs that had similar effects is not relevant to whether this information should have been reported by the Southern District Health Board. For ease of discussion, we will put to one side the possibility that he was using substances that had similar effects and simply refer to “steroids and testosterone”.

17

As we have explained, we see the individual’s use of steroids and testosterone as relevant to his preparation for the terrorist attack in terms of assisting him in bulking up and possibly also as imitating the preparation undertaken by the Oslo terrorist.

18

The information provided by the individual to his doctor and referred to the Endocrinology Service was “personal information” as defined by the Privacy Act 1993. It was subject to the Health Information Privacy Code 1994 issued by the Privacy Commissioner.5 This Code sets out Health Information Privacy Rules that limit the collection, use and disclosure of information held by health agencies6 – this includes not only agencies that provide “health or disability services”, but also others that are part of the health sector (such as the Accident Compensation Corporation and the Ministry of Health).7

19

Under Rule 11 of the Health Information Privacy Rules, a health agency can disclose health information if it believes it must do so to prevent a serious threat to public health, public safety or someone’s life.8 Whether the threat can be considered serious relates to how likely it would be to occur, how severe the consequences would be and when it would occur.9 A health agency can also disclose health information under Rule 11 if the information could relate to criminal offending.10

20

Rule 11 of the Health Information Privacy Rules reflects the “conditions of strict secrecy and confidentiality” that exist between medical practitioners and their patients.11 This duty of confidentiality is set out in the Code of Ethics for the Medical Profession produced by the New Zealand Medical Association.12 This means that, unless one of the narrow exceptions in Rule 11 applies, a medical practitioner cannot disclose a patient’s private information derived from a consultation or examination.

21

The possession and use of unprescribed testosterone and anabolic steroids are offences under section 43 of the Medicines Act 1981. Rule 11 of the Health Information Privacy Rules permits disclosure to avoid prejudice to the maintenance of the law by public sector agencies. But this rule does not impose a duty on medical practitioners to disclose information to New Zealand Police about all offending they become aware of.

22

We have taken advice from Dr Elaine Barrington-Ward, a Senior Medical Officer and Clinical Leader in the Endocrinology and Diabetes Department at Wellington Hospital, an expert in steroid and testosterone use. She told us that, in the absence of concerns about other criminal activity, she would be unlikely to refer the use of steroids and/or testosterone to New Zealand Police.

23

Based on that advice, we are satisfied that the information supplied by the individual to the doctor and forwarded to the Endocrinology Service was properly seen as not warranting disclosure to New Zealand Police. Accordingly, we consider that there was no reason for the Southern District Health Board to refer the information they held about the individual to New Zealand Police.

 

Firearms injury

24

The individual’s right eye and thigh were injured in a firearm accident on 13 July 2018 (see Part 4, chapter 5). He was treated at the Emergency Department of Dunedin Hospital (a Southern District Health Board hospital). The individual told the Emergency Department Registrar that the injury was caused by a round of ammunition exploding while he was cleaning a rifle barrel. The Southern District Health Board did not refer this incident to New Zealand Police.

25

The Southern District Health Board does not have an explicit policy or protocol that outlines what to do in the event of firearms-related injuries. But, as we have explained, health authorities must abide by the Health Information Privacy Code.

26

The Registrar who treated the individual’s firearms injury told us that they considered the accident to have been careless and a little unusual, but also said the individual was unremarkable and had not acted in an agitated manner. Considering the individual’s behaviour and the explanation he gave for how the injury was sustained, the Registrar believed the injury was an accident (in other words, was self-inflicted but not a suicide attempt). The Registrar could not recall if they were aware of the referral that had been made to the Endocrinology Service about the individual’s steroid and testosterone use. The Registrar told us that, even if they had been aware of the individual’s steroid and testosterone use, they would not have seen it as appropriate to disclose the firearms injury to New Zealand Police. This is because the individual did not display outwardly aggressive or unusual behaviour and gave what the Registrar saw as a credible explanation for how the injury occurred.

27

The explanation the individual gave to the Registrar, as recorded in the clinical notes, is that the accident occurred while the individual was cleaning the rifle. He gave more detailed explanations to members of the Bruce Rifle Club and discussed what may have been this incident with gaming friend. Although their recollections of his explanations are not precisely the same, there were enough similarities (in terms of where the bullet went and what injury was incurred) to provide a reasonable basis for understanding what happened.

28

A round of ammunition was jammed in the partially open breech of the rifle. The bullet was lodged in the barrel but some or all of the cartridge case was exposed. The individual’s efforts to free the round caused the primer on the cartridge to come into contact with the firing pin of the rifle. The charge was ignited, which resulted in the bullet being fired through the barrel of the rifle and into the roof and the exposed cartridge case exploding in the breech. Fragments of the cartridge case caused the individual’s injury.

29

This explanation invites a question as to what the individual was doing at his home with a rifle that had a round jammed in the breech. A possible answer to this question is that he may have been practising at home with his large capacity magazines (something he could not easily do at the Bruce Rifle Club, at least if others were present, because he was not legally allowed to do so). We put this possibility to the individual. He said that he had, indeed, practised at home with large capacity magazines but that they were always empty. He said that he had been trying to resolve a problem associated with what he thought was a burr in the barrel by chambering a round. The round had jammed. His attempts to free the round were based on the erroneous assumption that the rifle had an operational "drop safe" safety feature and resulted in contact between the firing pin and the primer. We consider that the individual’s explanation is reasonably plausible, a conclusion that was also reached by the New Zealand Police Armourer, but we do not discount the possibility that he had been practising with full large capacity magazines.

30

The individual told us he had been worried about the incident coming to the attention of New Zealand Police but the significance of the injury to his eye meant that he had no practical alternative but to go to the hospital.

31

Under the Arms Act 1983 (section 58), there is an obligation on “every person who causes bodily injury to or the death of any person by the use of a firearm” to report the incident in person to New Zealand Police “as soon as reasonably practicable”. It is doubtful whether this applies to a self-inflicted accidental injury.13 But, even if it does, the individual was entitled to seek immediate medical treatment before reporting the injury. This means that at the time the Registrar engaged with him, the individual would not have been in breach of the reporting obligation, even if he was subject to it.

32

In causing the firearm to discharge, the individual may well have committed offences under the Arms Act, such as discharging a firearm in a dwelling house without reasonable cause so as to endanger property and himself (section 48), and careless use of a firearm causing bodily injury (section 53). It is not clear whether the Registrar was aware that the incident occurred in the individual’s home.

33

For reasons very similar to those expressed in relation to the individual’s steroid and testosterone use, we do not consider that the Southern District Health Board was remiss in not reporting the accident to New Zealand Police. As one doctor told New Zealand Police in an interview, “it is not uncommon to treat a person with a minor injury from an accidental discharge” from a firearm. More generally, we consider that, as a clinician treating a patient for an injury, the Registrar was not obliged to turn their mind to the details of the Arms Act. Even if they had done so, we do not consider that the circumstances the Registrar was aware of would have dictated disclosure to New Zealand Police under the current rules.

34

Information regarding the incident was referred by the Southern District Health Board to the Accident Compensation Corporation. All the Accident Compensation Corporation knew about the individual’s injury was that he received it from “Rifle maintenance – exploding cartridge *** Leisure/hobby or play *** Impact with a sharp object”.

35

The Accident Compensation Corporation does not have a policy requiring notification to New Zealand Police if a claim is received relating to a firearm injury. Its information sharing is governed by the Privacy Act and the Health Information Privacy Code. For reasons that substantially overlap those already given in relation to the Southern District Health Board, but that are even more compelling given the limited nature of the information, we are satisfied that there was no reason for the Accident Compensation Corporation to report the incident to New Zealand Police.

36

Although we see no fault in the way in which this information was dealt with by the Southern District Health Board and the Accident Compensation Corporation, consideration should be given to requiring automatic reporting of firearms injuries. Such an injury may say something about the fitness of a person to hold a firearms licence and this is particularly so if there is a history of similar incidents. In the absence of a reporting requirement or practice, such information will often not come to the attention of New Zealand Police, who remain responsible for administering firearms licensing.

 

7.5 Other information held by Public sector agencies related to the individual’s planning and preparation

37

The only other information held by Public sector agencies that was clearly relevant to the individual’s planning and preparation for the terrorist attack was:

  1. the documentation relevant to his application for a firearms licence held by New Zealand Police;
  2. mail order forms held by New Zealand Police that confirmed his status as a licence holder and thus authorised online purchases of firearms and ammunition; and
  3. courier records relating to deliveries held by New Zealand Post.

38

Part 5: The firearms licence sets out our review of the process that resulted in the individual’s application for a firearms licence being granted and our findings about New Zealand Police’s actions in response to his firearms licence application. We see no issue with New Zealand Police’s actions in response to the mail order forms for firearms and ammunition. As the individual’s firearms licence had already been granted, he was legally entitled to purchase firearms and ammunition.

39

We see no issue with New Zealand Post’s actions in delivering the individual’s couriered items.

40

None of the other information held by Public sector agencies about the individual was material to his preparation for, and planning of, the terrorist. 

 

7.6 Concluding comments

41

The email to the Parliamentary Service was received too late to enable disruption of the terrorist attack. None of the other information held by Public sector agencies could or should have alerted them to the terrorist attack.

 

 

5. Privacy Act 1993, section 2.

6. Health Information Privacy Code 1994, clause 5.

7. Health Information Privacy Code 1994, clause 4(2).

8. Health Information Privacy Code 1994, clause 5, rule 11(2)(d).

9. This definition is for the purposes of corresponding principles provided for in the Privacy Act but we see it as applicable to the Health Information Privacy Principles.

10. Health Information Privacy Code 1994, clause 5, rule 11(2)(i)(i).

11. Law Commission Evidence Law: Privilege (NZLC PP23, 1994) at page 293.

12. New Zealand Medical Association Code of Ethics for the New Zealand Medical Profession (2014) at pages 4 and 6.

13. Academic commentary on the offence suggests that it does not “require the reporting of the accidental shooting of oneself”. See Adams on Criminal Law – Offences and Defences (online ed, Thomson Reuters) at AA58.01.