2. The three ways the individual may have been detected

1

The terrorist attack on 15 March 2019 was the result of careful planning and extensive preparation by the individual, carried out over a period of approximately 18 months. As a financially independent white male in his late 20s who was able to engage with others in unthreatening ways, the individual was not likely to be viewed with suspicion. And, as an Australian, he was able to fit into New Zealand reasonably well and did not draw much attention to himself. He was a lone actor who did not need to engage with others to prepare for his terrorist attack. He had no close associates to whom he was likely to talk about his plans. And, although there were occasional lapses, he generally attempted to maintain operational security.

2

Against this background and based on the information available to us, there are three ways in which the individual may have come to the attention of relevant Public sector agencies:

1. The Barry Harry Tarry comments on the private The Lads Society Season Two Facebook page (see Part 4: The terrorist) and possibly other comments of which we are not aware being identified through tip-offs or other mechanisms and linked to the individual.
2. A tip-off from a member of the public about the individual’s conduct (the likelihood of which would have been enhanced if New Zealand had adopted a public-facing “see something, say something” policy) may have resulted in inquiry by the counter-terrorism agencies.
3. A more extensive system of data aggregation, analysis and reporting might have captured pieces of information which, taken together, may have been sufficient to trigger an investigation (if only into whether the individual was a fit and proper person to hold a firearms licence).

We briefly discuss each of these in turn.

2.1 The Barry Harry Tarry comments

3

The Barry Harry Tarry comments were made on the private The Lads Society Season Two Facebook page. Although these comments did not come to the attention of New Zealand counter-terrorism agencies, there are a number of ways they could have (for example, a tip‑off from a member of the public). This being so, we have given some thought to what would have resulted if the counter-terrorism agencies had become aware of them.

4

The views expressed on the Facebook page by members were generally right-wing and many were Islamophobic in character. Some of the comments were premised on the view that Muslims pose an existential threat to Western societies, which perhaps can only be successfully resisted by violence. Views of this sort are commonly expressed on the internet, often anonymously (see Part 2, chapter 5). Although willing to engage in dehumanising and divisive rhetoric against “others”, those expressing such views are usually careful to avoid direct endorsement of violence. Such talk is harmful to an inclusive society whether the discussion is ironic, grandstanding or reflects a genuine intent to commit a violent act. But there are legal, logistical and technical difficulties in the way of counter-terrorism agencies conducting operations on far right internet sites on the scale necessary to pick up such comments and identify the people who make them. There are further practical difficulties in distinguishing between those who are just talkers and the potential doers (that is, those likely to mobilise to violence).

5

On the basis of the internet material we have seen, the individual’s comments were a lapse from his attempts to maintain operational security.

6

The comments in relation to the Islamic school, provided or implied a number of identifiers – membership of a particular gym in Dunedin, involvement with an Australian group suggesting a possible Australian connection and a username (Barry Harry Tarry) that bore some resemblance to the individual’s name. One of the gym members knew the individual as “Barry” and for a time was his Facebook friend. It follows that inquiries at the gym – not requiring any form of warrant – would, in all probability, have linked the individual to the comments.

7

The comments also gave indications of his thinking. Even without the benefit of hindsight, there is a chilling quality to his final remarks.

8

We spoke to counter-terrorism professionals as to whether the comments, if they had come to official attention, would have warranted inquiry at the gym. Given what is often said in internet discussions, the comments were described to us as not being remarkable.  Our assessment of the likelihood of such inquiry identifying Barry Harry Tarry is hindsight‑based (that is, based on what we now know). The likely success of such inquiry would not have been so apparent at that time. Concerns were expressed as to whether such inquiry would have been appropriate (or proportionate) given the privacy implications of disclosing private Facebook comments to those spoken to at the gym. A decision whether to make further inquiry may have been influenced by the extent to which other comments made by the individual on the Facebook page also came to the attention of the counter-terrorism agencies. This issue being hypothetical – as the comments did not come to official attention – there is no need for us to express a conclusion on it.  We touch on this point again in Part 8: Assessing the counter-terrorism effort. 

9

If the individual had been identified as the author of the Facebook comments, a check of the New Zealand Police National Intelligence Application would have revealed that he held a firearms licence. The combination of possible intent (as indicated by the comments) and capability (as revealed by his firearms licence) may have justified further investigation, perhaps initially as to his suitability to hold a firearms licence. Whether such investigation would have resulted in the disruption of the terrorist attack is necessarily speculative. It is, however, distinctly possible that this might have happened.

2.2 A tip-off from a member of the public

10

The individual’s shooting style at the Bruce Rifle Club was sufficiently unusual to be noted by some of the members. As well, there were other aspects of the individual’s conduct at the club that came to the attention of some members and may have led to a tip-off, including the injury he suffered and comments he had made in relation to large capacity magazines.

11

A tip-off in relation to the drone-flying incident was also possible. A member of the public who had seen the drone flying over Masjid an-Nur on 8 January 2019 took a note of it. When interviewed by a police officer on 22 May 2019 they were able to identify the correct date of the incident and give a time for it that was within minutes of when it happened. That witness saw only the drone and not the person who was flying it and thus had no opportunity to identify the individual as the drone operator or take the registration number of his car. The witness did not report the incident at the time.

12

The flight path of the drone shows that the individual had operated it from Hagley Park. He told us that he had parked his car beside Hagley Park and used a remote control to fly the drone while he stood in the park. It was a summer evening and there must have been many people walking in Hagley Park in the vicinity of the individual. Some may have observed what he was doing. A member of the public who was concerned by this might have reported the incident to the counter-terrorism agencies. If accompanied by the registration number of his car or perhaps a photograph of the individual, such a report would have been actionable.

13

As many Muslim individuals have observed to us, an identifiably Muslim person who acted in the same way as the individual would likely be reported to the counter-terrorism agencies. This is because of the general level of scrutiny Muslim communities are subjected to by society and the counter-terrorism agencies, and the associated widespread tendency to see Muslim individuals as potential terrorists.²

14

“See something, say something” policies identify for the public behaviours that have been known to be associated with preparation for terrorist acts and encourage the public to report such behaviours to counter-terrorism agencies. Such policies have been adopted in a number of countries. The United Kingdom has an Action Counters Terrorism (ACT) campaign, which encourages the public to report suspicious behaviour to the police. The campaign features a series of information films, helping the public to understand how to report, what happens when they report and what signs to look out for. In 2018, the campaign achieved 3.8 million views of its counter-terrorism awareness film and reached over 11.26 million people through police social media channels. Within the first week of the campaign, the average number of online public reports doubled.

15

Since 2015, the federal government of the United States of America has produced an annual, publicly available booklet titled Homegrown violent extremist mobilization indicators. It describes various observable behaviours (indicators) that “could help to determine whether individuals or groups are preparing to engage in violent extremist activities”.³ Indicators are grouped in terms of the extent to which the behaviour demonstrates an individual’s likelihood of engaging in terrorist activity.

16

Families and civil society can play an important role in relation to these types of policies and guidelines. That is because those closest to someone – partners, brothers, sisters, mothers, fathers, friends, teachers, doctors – may be the first to notice changes in behaviour that are indicative of radicalisation. Without the guidance a “see something, say something” policy provides, the significance of such changes may not be apparent to those who observe them.⁴ And even if it is apparent, people may not know where to turn for help, or may be reluctant to do so. Many people will understandably hesitate to report a family member to counter-terrorism agencies. So in some countries there are services independent of government that help people who know someone who may be heading towards violent extremism. One example is the Step Together organisation in New South Wales, Australia. It is an early intervention service that provides advice, information and referrals to services that can help before anything dangerous happens. Only in the event of a serious or imminent risk is the organisation obliged to report the situation to authorities.⁵

17

A public-facing, threat-agnostic “see something, say something” policy would have enhanced the likelihood of the individual’s conduct being reported, particularly if such a policy had identified behaviours consistent with terrorist training (for instance, unusual shooting styles). It is, of course, possible that had there been such a policy, the individual may have tailored his behaviour accordingly so as not to arouse suspicion, though this would have limited his ability to develop relevant firearms-handling experience. Or it might have made the individual less likely to see New Zealand as a suitable target for his terrorist attack. We will revert later in this report to the utility of a public-facing “see something, say something” policy. At this point we note that care would be required in identifying behaviours of the kind that warrant reporting. Even if expressed in threat agnostic terms, a New Zealand “see something, say something” policy would, at least before 15 March 2019, probably have had the practical effect of increasing public suspicion of Muslim individuals and communities.

2.3 A more extensive system of data aggregation, analysis and reporting

18

Public sector agencies had discrete pieces of information about the individual that related to his preparation. These were the importation of ballistic ceramic plates and plastic boards, steroid and testosterone use and the firearms injury. The individual pieces of information, if viewed in isolation, were of limited significance, at least in terms of likely terrorism activity. But the information illustrates the sort of data which, if aggregated with other information available (most particularly that the individual held a firearms licence), may have been seen as warranting inquiry. And the more information that could be brought into such an aggregation exercise (for instance a registry of firearms and ammunition purchases) the more effective it would be. It is worth pointing out that some large-scale data aggregation currently takes place between Public sector agencies, for example between some Public sector agencies to allow people to be detained at the border for unpaid fines or significant and outstanding student loan debts.

19

Many New Zealanders accept (at least implicitly) that their data is collected and analysed by private companies such as Facebook and Google. But large-scale data aggregation by the state is seen as a different matter altogether. The key feature of bulk data collection is that a large proportion of the data gathered relates to people who are not intelligence targets and is of no intelligence value. In other countries, where counter-terrorism agencies have access to bulk data, selectors are applied to the data to filter out what is irrelevant for national security purposes before human eyes review what is produced. Whether the New Zealand public would be prepared to accept data aggregation and analysis on the scale and basis just suggested is uncertain.

20

Public opinion changes over time. Informed public debate would allow Public sector agencies to share their work, capabilities and approach with New Zealand communities. It would also facilitate a discussion on the safeguards and oversight that would be required to strike the right balance between privacy and public safety. Such discussion would allow Public sector agencies to gauge their social licence to operate and build trust in their work, role and responsibilities over time.

21

More limited and less controversial changes associated with data reporting may be an easier place to start. A report to New Zealand Police that the individual had injured himself in the accidental discharge of a firearm in his flat (which had a common wall with his neighbours) would not have triggered suspicions of terrorism. But it might have raised an issue as to whether the individual was a fit and proper person to have a firearm. In the ordinary course of events, this would have been investigated by New Zealand Police. Where such an investigation would have led is, of course, unclear. Similar considerations might apply to his steroid and testosterone use, but in relation to this, privacy considerations might be thought to be the overriding consideration. To be more specific, it would be difficult to justify requiring a health professional to report a patient to New Zealand Police about steroid and testosterone use against the off-chance that the patient has a firearms licence.

_{2. See Diala Hawi, Danny Osborne, Joseph A Bulbulia and Chris G Sibley “Terrorism Anxiety and Attitudes toward Muslims” (2019) 48 New Zealand Journal of Psychology at page 86.}

_{3. The Department of Homeland Security, the Federal Bureau of Investigation and the National Counterterrorism Center Homegrown Violent Extremist Mobilization Indicators: 2019 edition (2019) at page 2.}

_{4. Michele Grossman “The role of families and civil society in detecting radicalisation and promoting disengagement from violent extremism” in C Echle, R Gunaratna, P Ruieppel and M Sarmah (eds) Combating violent extremism and terrorism in Asia and Europe: From cooperation to collaboration (Singapore, Konrad-Adenauer-Stiffung Ltd, 2018) at pages 158-162.}

_{5. Step Together website About Step Together https://steptogether.com.au/about-our-helpline-avoid-violent-extremism/.}