15. Evaluation of the counter-terrorism effort

15.1 Overview

1

Three of the questions on which we were required by our Terms of Reference to make findings were applicable to the counter-terrorism effort:

2

Underlying these issues is a concern that the relevant Public sector agencies may have missed opportunities to disrupt the 15 March 2019 terrorist attack by, for instance, looking the wrong way. We interpreted these paragraphs as asking, primarily at least, whether the relevant Public sector agencies were at fault in relation to the terrorist attack. 

3

We were required to make recommendations about how the counter-terrorism effort could be improved. These recommendations did not need to be tied to (or based on) findings under our Terms of Reference. On the other hand, we would not recommend improvements unless we had concluded that there is scope for improvement. In the case of the counter-terrorism effort, these conclusions are closely related to, and follow on from, our findings. It is logical therefore to examine in this chapter whether there are elements of the counter-terrorism effort that need improvement.

4

In this chapter we:

1. assess whether relevant Public sector agencies failed to anticipate or plan for the terrorist attack due to an inappropriate concentration of counter-terrorism resources or priorities on other terrorism threats;
2. assess whether any relevant Public sector agency failed to meet required standards or was otherwise at fault, whether in whole or in part;
3. consider whether any other findings are necessary to provide a complete report on other matters relevant to the purpose of the inquiry; and
4. describe the elements of the counter-terrorism effort that we consider warrant improvement.

15.2 Did relevant Public sector agencies fail to anticipate or plan for the terrorist attack due to an inappropriate concentration of counter-terrorism resources or priorities on other terrorism threats?

The issue on which a finding is required

5

In some respects, the question we must answer is narrow:

1. We were not asked to address whether the resources allocated to the counter-terrorism effort were sufficient. We have not looked at allocations between agency work programmes (such as New Zealand Police’s counter-terrorism and, say, family violence prevention efforts). We have focused on the counter-terrorism resources of relevant Public sector agencies as they were at the relevant time.
2. The expression “plan for or anticipate the attack” specifically refers to the terrorist attack carried out on 15 March 2019. Had the relevant Public sector agencies planned for or anticipated that terrorist attack, they would have been able to disrupt it. So we see the question as directed at whether the concentration of counter-terrorism resources was material to the terrorist attack not being disrupted.

6

But although narrow in the respects just mentioned, the question requires assessment of the allocation of resources between competing priorities and necessitates consideration of multiple factors involving different choices across various domains and, for those reasons, is polycentric. To such a question, a simple “yes” or “no” answer may not be possible.

7

We have not treated the “resources” and “priorities” as raising separate issues. Instead, we see them as expressing a single idea. In this chapter we use the terminology of concentration of counter-terrorism resources.

8

We focus primarily, although not exclusively, on the period between 2016 and 15 March 2019. 2016 is a sensible starting point for the following reasons:

1. Up until late 2014 there had been New Zealand Police assessments of the extreme right-wing. Although these assessments primarily focused on threats to public order and offending, they did cover national security concerns. The last of these assessments, in late 2014, noted that the far right in New Zealand was characterised by “discord and discoordination” and that experienced far right activists were unlikely to pose a risk to national security over the next three years.
2. In 2015–2016 there was a sharp increase in far right activity internationally, which we see as relevant to whether the Public sector agencies involved in the counter-terrorism effort should have turned their attention towards the threat of extreme right-wing terrorism.
3. 2016 is when the Strategic Capability and Resourcing Review funding was approved (see Part 8, chapter 2). Before that funding becoming available, the New Zealand Security Intelligence Service’s capabilities and capacity had degraded so severely that it would be a pointless exercise for us to review its resource allocation decisions.

9

We address the discussion that follows under the following headings:

1. The available counter-terrorism resources.
2. The concentration of counter-terrorism resources on the threat of Islamist extremist terrorism.
3. The reasons for the concentration of resources on the threat of Islamist extremist terrorism.
4. The risk of right-wing extremist terrorism as discernible before 15 March 2019.
5. What the counter-terrorism effort did about the risk of right-wing extremist terrorism.
6. Did the concentration of resources on the threat of Islamist extremist terrorism materially increase the overall risk of terrorism?
7. Was the concentration of resources on the threat of Islamist terrorism a considered decision following an appropriate process?
8. Would any plausible alternative allocation of counter-terrorism resources have resulted in anticipation or planning for the terrorist attack?
9. Our conclusions.

The available counter-terrorism resources

10

As discussed in this Part, a number of Public sector agencies contribute to the counter-terrorism effort.

11

For the purposes of this exercise, we leave the following to one side:

1. The Government Communications Security Bureau. It had only four staff in 2016, two in 2017 and seven in 2018 who were assigned to domestic counter-terrorism. It engaged in counter-terrorism only when specifically tasked by another agency to do so, and had not received any tasking relevant to the issue. It therefore had comparatively little to do with the allocation of counter-terrorism resources.
2. The counter-terrorism unit in New Zealand Customs Service and Immigration New Zealand. The individual did not present as a threat at the border and there is no reason to think that any different focus of counter-terrorism resources at the border would have resulted in disruption of his planning.
3. The Specialist Coordinator and other staff in the National Security Group of the Department of the Prime Minister and Cabinet.

12

Recognising, as we do, that precise delineation of relevant counter-terrorism resources is a little artificial, we think that what is most relevant for the purposes of our finding are the counter-terrorism investigative resources within the New Zealand Security Intelligence Service’s Counter-Terrorism Unit and New Zealand Police’s National Security Investigation Team. These resources were scarce. As of 2016, the resources of the New Zealand Security Intelligence Service were insufficient to provide for more than partial monitoring of its investigative prioritisation (watch) list targets (see Part 8, chapter 5). The specialist counter-terrorism staff of New Zealand Police were also under pressure. A 2016 budget bid for an increase in New Zealand Police’s counter-terrorism funding had been rejected.

13

The numbers of specialised counter-terrorism staff in the New Zealand Security Intelligence Service and New Zealand Police were supplemented by their supervisors. As well, the Counter-Terrorism Unit in the New Zealand Security Intelligence Service could call on the assistance of other staff (for instance collections staff). New Zealand Police’s National Security Investigation Team could call on the broader resources of New Zealand Police, including the Security Intelligence and Threats Group, as and when required (and as the priorities of those other staff allowed) although members of that Team were also sometimes called upon for other New Zealand Police purposes.

14

Also relevant, but in a different way, are the National Assessments Bureau and the Combined Threat Assessment Group. The way these assessment agencies viewed their respective roles, and the focus of their efforts, influenced the allocation of domestic counter-terrorism resources within the counter-terrorism agencies.

The concentration of counter-terrorism resources on the threat of Islamist extremist terrorism

15

Counter-terrorism resources were primarily concentrated on the threat of Islamist extremist terrorism. This can be demonstrated by the New Zealand Security Intelligence Service’s priority investigation (watch) list. As at 11 March 2019, it included 25 counter-terrorism investigations involving 32 subjects of investigation. All these subjects were under investigation due to their assessed affiliation with Islamist extremism, primarily inspired by Dā’ish.

The reasons for the concentration of resources on the threat of Islamist terrorism

16

There are several interconnected reasons why counter-terrorism resources were concentrated on the threat of Islamist extremist terrorism:

1. Assessments of the Combined Threat Assessment Group and the National Assessments Bureau primarily focused on Islamist extremist terrorism threats.
2. Before 2015, New Zealand Police had produced assessments on far right individuals and groups in New Zealand but from 2015 the New Zealand Police intelligence function had degraded to the point that it was not producing assessments on the far right.
3. International partner reporting and leads were overwhelmingly focused on Islamist extremism.
4. Islamist extremist terrorism was seen as the presenting threat.
5. There was limited availability of counter-terrorism resources.

We discuss each of these in turn.

17

From 2010–2019 the intelligence assessments of the National Assessments Bureau and the Combined Threat Assessment Group considered the terrorist threat to New Zealand and New Zealanders as coming largely from Islamist extremism. For example, in July 2015 the Combined Threat Assessment Group assessed that the primary domestic terrorism threat was from “individuals and groups, based in New Zealand but with inspiration from abroad, who subscribe to extreme Islamist ideologies”. It did not explicitly mention the threat of terrorism from the extreme right-wing.

18

From 2016 onwards, assessments continued to evaluate Islamist extremism as the primary terrorist threat to New Zealand and New Zealanders. For example:

1. In 2016, a New Zealand Police intelligence report, New Zealand’s Islamist Extremist Landscape, stated that more New Zealanders are vulnerable to extremist messaging due to the pervasive nature of Dā’ish’s propaganda, which had proven more effective at attracting disaffected young males than other extremist groups.
2. The Combined Threat Assessment Group’s 2018 assessment of the New Zealand terrorism environment stated that “in spite of ongoing losses in Syria and Iraq, [Dā’ish] will continue to exert itself as a terrorist and insurgent group with international influence and reach … the overall level of support for [Dā’ish] among New Zealand-based Islamist extremists does not seem to have changed markedly … though the manifestation of support for radical Islam continues to evolve”.
3. The New Zealand Security Intelligence Service similarly concluded in 2018 that “[Dā’ish’s] territorial decline has not had any marked impact on the New Zealand extremist environment”.
4. Two papers produced by the National Assessments Bureau in 2018 discussed the “persistent threat from Jihadist terrorism”.

19

As of 2016, New Zealand Police’s national intelligence function had degraded and no longer produced strategic assessments on the domestic threatscape (see Part 8, chapter 6).

20

International partner reporting was overwhelmingly focused on Islamist extremism. The Government Communications Security Bureau informed us that in the second quarter of the 2018-2019 financial year, it received 7,526 intelligence reports from international partners about terrorism and violent extremism. None of those reports related to right-wing extremism. While international partners do not direct or dictate that New Zealand agencies pursue particular leads or ideologies, partner reporting and partner-supplied leads necessarily informed the development of New Zealand threat assessments and affected the allocation of resources, certainly by the counter-terrorism agencies.

21

Leads received from within New Zealand by counter-terrorism agencies were predominantly about possible Islamist extremist terrorism. A New Zealand Security Intelligence Service report of 5 September 2018 noted an absence of indications of terrorist threats from non-Islamist extremist sources. In part this may have resulted from the leads-based investigative model employed by New Zealand Security Intelligence Service which, because of its focus on Islamist extremism, was not calibrated so as to generate leads associated with other ideologies (see Part 8, chapter 10).

22

There were many tangible leads and a substantial number of persons of interest with an Islamist extremist outlook. As well, there were numerous active domestic investigations and operations focused on Islamist extremist activity that posed real threats to public safety in New Zealand. We have seen evidence that New Zealand Police and the New Zealand Security Intelligence Service achieved some success in mitigating such threats. For example, between August 2015 and January 2018, eight passports were cancelled, and New Zealand Police arrested 17 individuals of national security interest for a variety of offences and issued 40–50 warnings for extremism-related objectionable material.

23

The primary explanation given by the counter-terrorism agencies for not making earlier efforts to understand the threat of extreme right-wing terrorism is that their limited resources were substantially tied up dealing with the presenting threat of Islamist extremist terrorism.

24

From at least early 2016, it was appreciated by the New Zealand Security Intelligence Service there was a potential for terrorism from non-Islamist extremist sources and that it was largely unsighted to the nature and extent of such threats. This is referred to in a February 2016 Strategic Capability and Resourcing Review Cabinet paper, which identified the expected capacity increase in relation to countering violent extremism:

The capability increases from a current state where partial monitoring of watch-list targets is possible and there is minimal coverage outside Auckland, to a future where there is a New Zealand-wide baseline threat picture.

25

Baselining emerging terrorist threats was ranked as the third goal in the New Zealand Security Intelligence Service's 2016 10-Year Operational Strategy,²²⁹ but its ranking meant that work on it was deferred. As events turned out, the New Zealand Security Intelligence Service did not have enough counter-terrorism staff to start its baselining project until May 2018.

The threat of right-wing extremist terrorism as discernible before 15 March 2019

26

What has become apparent after the terrorist attack is that, before 15 March 2019, there were national security threats from right-wing extremists, at least some of which would have been likely to have come to light if the concentration of counter-terrorism resources had been different. We know this because some of the new extreme right-wing leads that were opened after 15 March 2019 (as a result of the counter-terrorism agencies reviewing their existing holdings and through public or partner reporting) met the threshold for investigation. This deserves a brief explanation.

27

On 10 June 2019, the New Zealand Security Intelligence Service’s watch list included 28 counter-terrorism investigations involving 46 subjects of interest. Twenty-four of the investigations (involving 30 subjects of interest) related to Islamist extremism. The remaining four investigations (involving 16 subjects of interest) involved right-wing extremism. On 31 January 2020 the watch list included 34 counter-terrorism investigations, comprising 47 subjects of investigation. Of these, 20 investigations (involving 31 subjects of interest) related to Islamist extremism, while 14 investigations (involving 16 subjects of interest) involved right-wing extremism. These can be compared to the corresponding figures at 11 March 2019, discussed above and shown in the figure below.

28

What all this means is that, before 15 March 2019, there was activity in New Zealand involving individuals with extreme right-wing ideologies who were of national security interest. This is not surprising.

29

Before 15 March 2019, there had been many extreme right-wing terrorist attacks in Canada, the United Kingdom and the United States of America, which showed that ideological thinking along the lines of the Great Replacement had the capacity to motivate some people to extreme violence. Right-wing extremist terrorism was exemplified by the Oslo terrorist’s attack in 2011, several mass shootings at places of worship in Europe and North America between 2012–2018 and a planned extreme right-wing attack in Australia that was disrupted in 2016 (see Part 8, chapter 2). In short, global events showed that right-wing extremism was a known phenomenon, with substantial potential lethality, was not confined to a single jurisdiction, had been around for a number of years and fed off a number of drivers to which New Zealand could not claim to be immune (including racism, Islamophobia, poverty, growing inequality, the radicalising role of the internet and immigration).

30

The Australian Security Intelligence Organisation recently confirmed that right-wing violence now occupies 30 to 40 percent of its counter-terrorism cases, up from 10 to 15 percent in 2016.²³⁰

31

Right-wing groups have been active in New Zealand for many decades. Associated with this have been at least three hate crime murders (committed by members of the Fourth Reich, a right-wing gang). And while other right-wing groups have been seen primarily as posing threats to public order, the underlying thinking of their supporters meant that they would be receptive to the ethno-nationalist ideas (see Part 2, chapter 5), that were starting to achieve considerable global currency by 2015–2016.

32

Although cultural controversies involving immigration have not been as acute in New Zealand as in some other Western countries, there were several issues in New Zealand that had the potential to galvanise those on the extreme right-wing. These included provocative statements made by some in public life about race relations, Te Tiriti o Waitangi and the nature of Islam. As well, as survey data shows, New Zealanders generally feel “less warmth” towards Muslim communities than other groups.²³¹

33

Members of Muslim communities were concerned about risks of right-wing extremist terrorism. We have discussed the detail of this in Part 3: What communities told us and Part 9: Social cohesion and embracing diversity. As expressed, these concerns tended to be closely associated with worries about discrimination, Islamophobia, hate speech and hate crime and often did not clearly relate to national security. Nonetheless they reflected community concerns that warranted attention and reassurance from counter-terrorism agencies, or other relevant Public sector agencies, if that could be provided legitimately.

34

The easy availability of firearms of high lethality was recognised in the 1997 Thorp Report.²³² In 2011 the Combined Threat Assessment Group concluded that a terrorist could legally acquire firearms for use in an attack (see Part 8, chapter 4). In 2014, a New Zealand Police assessment commented on the propensity of the extreme right-wing to acquire and use firearms.

The counter-terrorism effort and right-wing extremist terrorism

35

The threat posed by the extreme right-wing in New Zealand was briefly mentioned in some assessments (see Part 8, chapter 4).

36

Before 2015, New Zealand Police had produced assessments on far right individuals and groups in New Zealand. Although these were primarily about threats these individuals posed to public order or general offending, national security concerns were addressed in two assessments in 2014. One of these assessments noted that right-wing extremists were unlikely to pose a risk to national security over the next three years.

37

In January 2018 the Combined Threat Assessment Group's New Zealand Terrorism Threatscape noted that:

Open source reporting indicates the popularity of far right ideology has risen in the West since the early 2000s. Since 2014, the ‘new’ right-wing movements have been strengthened by opposition to refugee settlements and Islamist extremist attacks in the West, especially in Europe and Scandinavia.

[The Combined Threat Assessment Group] has not sighted any reporting to indicate [established New Zealand far right groups have] the intent or capability to promote their ideology by an act of terrorism. As has been evidenced in similar jurisdictions to New Zealand, an extreme right-wing lone actor attack remains a possibility, albeit a remote one.

...

We also note that Islamist extremist attacks in other Western countries have provoked retaliatory attacks from individuals with other ideologies, such as extreme right-wing groups. [The Combined Threat Assessment Group] assesses that this could occur in New Zealand following any terrorism incident.

38

During the first half of 2018 (before the New Zealand Security Intelligence Service started its project to establish a baseline picture of emerging domestic terrorism threats), there were several Combined Threat Assessment Group briefing notes that referred to the threat of extreme right-wing terrorism in similar but more limited terms.

39

The National Assessments Bureau’s first comment on the terrorist threat from the extreme right-wing in New Zealand was in September 2018 in its Global Terrorism Update. In an annex to the main assessment is a small section on “extreme right terrorism” in which the National Assessments Bureau observed that “between 12 September 2001 and 31 December 2016 in the United States of America, there were more extreme-right incidents than Islamist terrorist incidents resulting in fatalities”. It concluded that there had been an emerging global threat from extreme right-wing terrorism for some time, but groups were fragmented with limited international coordination. The assessment went on to note that:

Extreme-right-wing groups are present in New Zealand and have an online presence, but have not been active. Extreme-right groups differ from far right groups in the fact that the extreme-right is willing to use terrorism to further their aims. There has been no evidence to suggest New Zealand-based far right groups have the intent or capability to promote their ideology by an act of terrorism.

40

We have seen a few reports and assessments prepared by Public sector agencies including the Department of Corrections and New Zealand Customs Service that refer to the extreme right-wing as a possible (but unsighted) domestic threat, with the potential for violence. A New Zealand Police national security situation update in May 2018 specifically noted that Muslim communities in New Zealand could be the target of such threats.

41

Leads on the extreme right-wing were received occasionally and, when received, were pursued. These include the IP address lead, which we have discussed in some detail in Part 6, chapter 3.

42

New Zealand Customs Service and New Zealand Police had developed some limited training material for front-line staff that was focused on the extreme right-wing (see chapter 17 of this Part).

43

The New Zealand Security Intelligence Service produced one report in 2011 that referred to the national security threat from the extreme right-wing. It produced several more such reports in 2018. No reports were published in the intervening period (2012–2017).

44

New Zealand Police and the New Zealand Security Intelligence Service held a tabletop exercise in October 2018 to increase understanding of their respective processes and procedures in Response to a counter-terrorism incident. One of the scenarios drew on the Finsbury Park Mosque terrorist attack. The scenario played out the Response that Public sector agencies would take to a report of a lone actor vehicle terrorist attack on worshippers leaving the Masjid an-Nur in Christchurch (see Part 8, chapter 4).

45

Although we have recorded what may appear to be a good deal of activity, the reality is that counter-terrorism resources were primarily concentrated on the threat of Islamist extremist terrorism.

46

The 2019 Arotake Review noted:

[The New Zealand Security Intelligence Service’s] work on the extreme-right-wing in New Zealand remained at its early stages at the time of the 15 March 2019 attacks. After a long period without focus on this complex area, [the New Zealand Security Intelligence Service] was seeking to develop an understanding of the key ideologies, groups, individuals involved, their propensity to violence, and operational techniques, despite being only able to devote limited resources committed to the task.

47

We agree with this judgement. As far as the New Zealand Security Intelligence Service was concerned, there was a developing but still limited understanding of the threat of right-wing extremism in New Zealand as at 15 March 2019. Broadly similar considerations apply to New Zealand Police, whose work on right-wing extremism had only just started by 15 March 2019.

Did the concentration of resources on the threat of Islamist extremist terrorism materially increase the overall risk of terrorism?

48

An increased concentration of counter-terrorism resources on the extreme right-wing was not likely to have materially increased the likelihood of the individual’s preparation being disrupted. We explain why later in this chapter.

49

If the counter-terrorism agencies’ scarce counter-terrorism resources had, earlier than May 2018, been diverted away from the presenting threat of Islamist extremist terrorism towards, say, developing a better understanding of emerging threats from other ideologies, there are a range of possible outcomes. It may have led to an increase in the risks associated with Islamist extremist terrorism, due to a reduction in the effort to mitigate those risks. It may also have led to a decrease in the risks of extreme right-wing terrorism, due to a better understanding and mitigation of the threat. Neither side of that equation can be precisely assessed.

50

It is not possible to determine with confidence whether the overall risk of domestic terrorism would have been increased or decreased had counter-terrorism resources been allocated earlier to the threat of right-wing extremist terrorism. An attempt at such determination would have required detailed consideration of each of the investigation prioritisation (watch) list targets and the threats they presented and the extent to which diversion of effort would have increased the risk they posed. Also required would have been a comparable assessment of the extent to which the risk of extreme right-wing might have been mitigated by an earlier diversion of effort.

51

This exercise would at best produce a very speculative conclusion, though this is not to say a risk management framework is not required for prospective allocation of scarce resources, a point which we will come back to shortly. But more significantly the exercise would have turned the focus of our inquiry away from the actions of Public sector agencies to one which includes surveillance targets within our communities. We do not see this as consistent with our Terms of Reference.

Was the concentration of resources a considered decision following an appropriate process?

52

Another way to assess the appropriateness of the concentration of counter-terrorism resources is to consider the process undertaken in relation to the allocation of counter-terrorism resources. In this approach, the concentration of counter-terrorism resources on threats of Islamist extremist terrorism to the substantial exclusion of other threats could be justified only on the basis of either:

1. an informed assessment of the threats of terrorism associated with other ideologies; or
2. a system-wide decision that, despite the absence of such an assessment, counter-terrorism resources should continue to be allocated almost exclusively to the threat of Islamist extremist terrorism.

53

In the period between 2016 and May 2018 there was not an informed assessment of the threats of terrorism associated with ideologies other than Islamist extremism. The only relevant assessments are the Combined Threat Assessment Group assessments of July 2015 and January 2018, the relevant parts of which we have set out above.

54

The Combined Threat Assessment Group’s July 2015 New Zealand Terrorism Threatscape assessment that Islamist extremist terrorism was the primary terrorist threat could be taken to imply that other threats had been assessed. As far as we can tell, this was not the case. And the January 2018 assessment, while accurate as far as it went (in its reference to not having sighted reporting), could be taken to imply more in the way of an evidence-based assessment than had actually been carried out. This is particularly so in relation to the comment that the possibility of an attack by an extreme right-wing lone actor was “remote”.

55

The National Assessments Bureau’s Global Terrorism Update of September 2018 stated, “[t]here has been no evidence to suggest New Zealand-based far right groups have the intent or capability to promote their ideology by an act of terrorism”. This was literally true as there was, at the time, no such evidence. The statement, however, could be taken to imply that there had been more effort to look for such evidence than had been the case.

56

It is of interest to compare these assessments with the December 2018 New Zealand Terrorism Update issued by the New Zealand Security Intelligence Service (see Part 8, chapter 4). We reproduce the key passage of the report here for ease of reference:

Non-Islamist terrorist threats from extreme political, religious and issues-motivated groups are plausible in New Zealand, especially given heightened political partisanship internationally and the spread of disinformation online. Various radical groups are present in New Zealand, some of which have extreme elements that could plausibly turn violent; however, terrorist acts by them are currently not expected.

…

The spread of highly partisan political content online, especially over social media, has almost certainly contributed to acts of non-Islamist extremist violence in Western countries. Several attempted and realised attacks in the United States in 2018 were linked to extreme right-wing, conspiratorial, or racist agitation in social and other media, judging from press reporting.

57

The more general problem, as we see it, is that the two key assessment agencies were not well situated to provide assessments of emerging threats. In the case of the National Assessments Bureau, this was a result of its customer focus and its limited resources. In the case of the Combined Threat Assessment Group this was due to both its short term and tactical focus and also the negative reaction from other agencies to its reporting on the 2011 Oslo terrorist’s attack and its firearms assessment of 2011 (based on a perception it was stepping outside of its mandate). This firearms assessment had judged that a terrorist could legally acquire firearms (including military style semi-automatic firearms) for an attack and that the firearms licence vetting process would be unlikely to reliably identify a terrorist posing as a legitimate firearms applicant (see Part 8, chapter 4).

58

The concentration of counter-terrorism resources on the threat of Islamist extremist terrorism was not therefore based on an informed assessment of the threats of terrorism from other ideologies. We now turn to consider whether there was a system-wide decision that, despite the absence of such an assessment, counter-terrorism resources should continue to be allocated almost exclusively to the threat of Islamist extremist terrorism.

59

The position of the New Zealand Security Intelligence Service is that before May 2018, a combination of the presenting threat of Islamist extremist terrorism and its limited capacity meant that it did not have the resources to devote to developing an understanding of other threats. It also pointed out that Islamist extremism and right-wing extremism are not the only ideologies that can, and have, led to acts of terrorism. The New Zealand Security Intelligence Service suggests that a requirement to assess all possible sources of terrorism before allocating counter-terrorism resources would be impractical. Furthermore, and importantly, the way in which the New Zealand Security Intelligence Service allocated its resources was considered. It was foreshadowed in the February 2016 Strategic Capability and Resourcing Review Cabinet paper in a way that indicates government acceptance of the appropriateness of deferring baselining. It was also consistent with the priorities identified in the New Zealand Security Intelligence Service’s 2016 10-Year Operational Strategy. And when it had the capacity to do so in May 2018, the New Zealand Security Intelligence Service commenced its baselining project.

60

There is some substance in these arguments. But:

1. An informed assessment of the threat might have been based on an exercise less substantial than the baselining project that the New Zealand Security Intelligence Service commenced in May 2018 (itself a deliberate allocation of counter-terrorism resources) and permitted an informed decision as to the relative priorities of those threats. As it happens there was no such assessment and indeed no continuing or dynamic review of the threats or the priorities identified in the 2016 10-Year Operational Strategy.
2. Our appreciation of the situation in, say, 2017 is that the threat of extreme right-wing terrorism and risk associated with the recognised ease with which a potential terrorist could obtain weapons of high lethality were more than theoretical and at least warranted some attention.
3. Most importantly, we consider that a deliberate decision on the part of the New Zealand Security Intelligence Service to devote its counter-terrorism resources almost exclusively to the threat of Islamist extremist terrorism despite the absence of an assessment of other threats is not a substitute for a system-wide decision.

61

In the minutes of the Security and Intelligence Board and the Counter-Terrorism Coordination Committee, the inter-agency groups primarily responsible for coordinating New Zealand’s counter-terrorism efforts, there is a striking absence of specific discussion about the threat of right-wing extremist terrorism. There is no record that these groups explicitly recognised that there was a domestic terrorist threat from the extreme right-wing and that this threat was not well understood.

62

There is a reasonable case to be made for the view that, despite the absence of explicit discussion, members of the Security and Intelligence Board either did know, or should have known, that there was a threat of right-wing extremist terrorism that the counter-terrorism agencies did not understand:

1. The Strategic Capability and Resourcing Review set out capacity and capability constraints affecting the New Zealand Security Intelligence Service, and the implementation programme that followed broadly indicated how these capacity and capability constraints would be addressed over time. That there were threats that were not understood, and that no systematic effort to understand them would start until resources allowed, followed logically from a close reading of the associated documents.
2. Reporting of right-wing extremist activity in other Western countries was widely distributed amongst the agencies represented on the Security and Intelligence Board. As well, its members’ knowledge of global events would likely have included the right-wing extremist terrorist activity that was occurring in other Western countries.
3. It was implicit in what was said (and not said) at meetings of the Security and Intelligence Board and the Counter-Terrorism Coordination Committee that the focus of the counter-terrorism effort was on Islamist extremist terrorism and that there was no reference to work being carried out on any other terrorist threats.

63

It may well have been stating the obvious if the New Zealand Security Intelligence Service or New Zealand Police had explicitly told the Security and Intelligence Board or Counter-Terrorism Coordination Committee that their understanding of the non-Islamist extremist domestic terrorist threat was very limited. As well:

1. There were financial constraints. The Cabinet papers associated with the Strategic Capability and Resourcing Review programme indicated a clear government expectation that, in the absence of a significant change of circumstances, the agencies were not expected to seek further funding before 2019. A New Zealand Police budget bid in 2016 for additional counter-terrorism resources had been rejected.
2. The options for the counter-terrorism effort were limited. As we have explained, it was not obvious that reallocating scarce counter-terrorism resources away from the presenting threat to start the baselining project earlier would have resulted in an overall reduction in risk. Bringing additional counter-terrorism staff into the system was already underway and increasing the pace of this would have presented challenges, even if additional funding became available (see Part 8, chapter 5).

64

All of that said, we are of the view that there was a systemic failure to recognise that there was a threat of extreme right-wing domestic terrorism that was not understood. It follows that the allocation of counter-terrorism resources almost completely to Islamist extremist terrorism was not the result of a considered system-wide decision.

65

New Zealand, as a small country, cannot achieve capacity and capability to operate across the full spectrum of risks and threats it faces. This means that assessment (and continual reassessment) of risks and threats to national security, and allocation of resources to match those risks and threats, are critical to a well-functioning national security system. One of the mechanisms that underpins the “all hazards, all risks” framework is that resources across the system will be allocated to the highest priority risks and threats. If there are capacity or capability limitations that prevent particular risks or threats being understood, the core organising principle of New Zealand’s national security system – the “all hazards, all risks” approach – requires those limitations to be identified.

66

In 2010, Barry Charles Ezell and others in Probabilistic Risk Analysis and Terrorism Risk wrote that:

… considerable efforts have been made to estimate the risks of terrorism and the cost effectiveness of security policies to reduce these risks. [The Department of Homeland Security], industry, and the academic risk analysis communities have all invested heavily in the development of tools and approaches that can assist decisionmakers in effectively allocating limited resources across the vast array of potential investments that could mitigate risks from terrorism and other threats.²³³

This is relevant to New Zealand’s counter-terrorism effort. Although we have not been prepared to engage in a retrospective risk analysis of the concentration of resources on Islamist extremist terrorism, such analysis is required for effective resource allocation decisions in the future. Identification of capability and capacity limitations that may be preventing risks and threats being understood should be explicit.

67

The members of the Security and Intelligence Board and the Counter-Terrorism Coordination Committee could not be expected to have had the Cabinet papers relating to the Strategic Capability and Resourcing Review in the forefront of their minds. And despite what may have been implicit in what was said (and not said), explicit recognition at meetings of the fact that there was a threat that was not understood would presumably have prompted discussion.

68

Given the known capacity and capability constraints of the New Zealand Security Intelligence Service and its plan to remedy its poor understanding of emerging threats, such discussions may have led nowhere. It would, however, have been possible to ask for more money. Additional resources from within the New Zealand Security Intelligence Service or New Zealand Police might have been allocated to counter-terrorism. And the focus of the National Assessments Bureau and the Combined Threat Assessment Group may have been reconsidered.

69

Across the counter-terrorism effort there remains a lack of clarity as to who holds the responsibility for looking across the collective effort to identify risks and gaps. As a result, we found it difficult to understand how the collective responsibility to detect and mitigate future terrorist threats could be fully exercised.

70

Finally, despite what should or may have been apparent to members of the Security and Intelligence Board and the Counter-Terrorism Coordination Committee, ministers could not be expected to infer from the material they received that there was a threat of extreme right-wing terrorism that was not understood by the counter-terrorism agencies. And this was something that they were entitled to be told.

71

Had they been advised of this, and of the unmitigated risk to New Zealand’s national security that the system was carrying, ministers would have been able to decide whether that was a risk they were willing to accept. Because they were not informed of this risk, they were not given the opportunity to act.

72

The following factors contributed to this systemic failure of the counter-terrorism effort:

1. The limited resources in the overall counter-terrorism effort.
2. The focus of the National Assessments Bureau and the Combined Threat Assessment Group.
3. The New Zealand Security Intelligence Service not highlighting with the Security and Intelligence Board and Counter-Terrorism Coordination Committee the risk implications of its operational strategy (in particular, the timing of the growth of capability and capacity, and deferral of the baselining project until sufficient resources were available).
4. The members of the Security and Intelligence Board and Counter-Terrorism Coordination Committee not exploring what was implicit in what they had been told (and not told) – that the right-wing extremist threat was not well understood.
5. New Zealand Police not highlighting with the Security and Intelligence Board and Counter-Terrorism Coordination Committee that their intelligence function had been run down, they were no longer producing assessments on the extreme right-wing and strategic assessments on domestic extremism, and the residual risk this carried.
6. The reality that the system did not force or at least encourage Public sector agencies to discuss their individual strategies and any residual risk they were carrying and thus identify gaps in the system.

Would any plausible allocation of counter-terrorism resources have resulted in anticipation or planning for the terrorist attack?

73

We have reviewed at length the individual’s background and his planning and preparation for the terrorist attack (see Part 4: The terrorist). The indicators of his planning and preparation that might have been noticed by the public or by the counter-terrorism agencies were limited. The strongest indicator was his flying a drone over Masjid an-Nur. As well, his internet activity using the Barry Harry Tarry username, his Trade Me username “Kiwi14words” and his shooting style at the Bruce Rifle Club could be seen, individually, as indicators, though not particularly strong ones. Further, if there had been different health reporting arrangements that had enabled his steroid and testosterone use and firearms injury to be linked to his status as the holder of a firearms licence, his fitness to hold that licence might, conceivably, have come into question. As it turns out, however, none of these indicators came to the notice of counter-terrorism agencies.

74

Had there been a threat agnostic public-facing counter-terrorism strategy that incorporated a “see something, say something” policy, there would have been an increased chance of such signals being reported, perhaps the drone flying incident and possibly his shooting style or his use of the “Kiwi14words” username. The absence of such a public-facing counter-terrorism strategy, however, is unrelated to the general concentration of counter-terrorism resources on Islamist extremist terrorism.

75

Based on the counter-terrorism effort operating as it did before 15 March 2019, the individual’s detection by the counter-terrorism agencies depended on chance – that is, the individual deviating from his attempts at operational security, and this coming to the attention of relevant Public sector agencies such as New Zealand Police. We are of the view that detecting the individual would have depended on chance even if there had been a very substantial focus on right-wing extremism by the counter-terrorism agencies.

76

In the absence of a “see something, say something” policy, such increased focus on right-wing extremism by the New Zealand counter-terrorism agencies would not have increased the likelihood of public reporting. It is unlikely that the counter-terrorism agencies would have monitored what was discussed in a private Facebook group associated with an Australian group. Similarly, the counter-terrorism agencies did not have the capability or probably the legal authority to monitor social media activity on the scale necessary to pick up possibly significant usernames such as “Kiwi14words”. Even if they had they done so, it is not easy to see how discovering that someone was using that username would have justified collecting the additional information that would have been needed to identify the individual as a national security threat. We have in mind the restrictions created by section 19 of the Intelligence and Security Act 2017 and the necessary and proportionate test (see Part 8, chapter 14).

77

Therefore, we do not see the substantial concentration of counter-terrorism resources on Islamist extremist terrorism in the years leading up to 15 March 2019 as having contributed to the individual’s planning and preparation for the terrorist attack going undetected.

Conclusion

78

We conclude that the concentration of counter-terrorism resources on the threat of Islamist extremist terrorism before the New Zealand Security Intelligence Service’s baselining project began in May 2018 was:

1. not based on an informed assessment of the threats of terrorism associated with other ideologies; and
2. did not result from a system-wide decision that, despite the absence of such an assessment, counter-terrorism resources should continue to be allocated almost exclusively to the threat of Islamist extremist terrorism.

It was therefore inappropriate. But we also conclude the concentration of resources on the threat of Islamist extremist terrorism did not contribute to the individual’s planning and preparation not being detected.

15.3 Did any relevant Public sector agency fail to meet required standards or was otherwise at fault?

79

Other than in the systemic sense just identified, we see no failure to meet required standards in respect of the counter-terrorism effort.

80

The systemic failure to recognise that there was a threat of extreme right-wing domestic terrorism which was not understood did not contribute to the fact that the individual’s planning and preparation was not detected. This is for essentially the same reasons as discussed above. For this reason, we do not make a finding of failure or fault against any of the relevant Public sector agencies in respect of the counter-terrorism effort.

15.4 Whether other findings are necessary to provide a complete report on other matters relevant to the purpose of the inquiry?

81

As we have observed, we interpreted the questions in our Terms of Reference on which findings were required as primarily directed to whether the relevant Public sector agencies were at fault in relation to the terrorist attack. Recommendations that we make must be based on factual assessments but these assessments do not need to be premised on formal findings. There is thus no requirement for further formal findings.

15.5 Elements of the counter-terrorism effort that need improvement

A preliminary comment

82

The counter-terrorism effort in New Zealand has achieved successes, as we have described. In doing so, the counter-terrorism agencies have shown considerable flexibility, looking to achieve good outcomes in ways that do not necessarily involve prosecution. This success has been achieved despite the limited counter-terrorism resources available and the absence of precursor terrorism offences in the Terrorism Suppression Act 2002 (see Part 8, chapter 13), which in some instances may have enabled investigations to be closed earlier than they were.

83

The people engaged in the counter-terrorism effort are professional and dedicated. They deal with unpredictable people and are required to make decisions based on incomplete information. And if they get those decisions wrong, the consequences may be catastrophic.

84

The concerns we have about the counter-terrorism effort are not about the professionalism of those working in the operational agencies. They are, rather, systemic in character. In this section, we set out our principal conclusions on the parts of the counter-terrorism effort that need improvement, on which we base our recommendations (see Part 10: Recommendations).

85

We approach the discussion that follows under the following headings:

1. Political and public engagement.
2. Leadership and coordination.
3. Strategic intelligence assessments.
4. Role of the Government Communications Security Bureau.
5. Information sharing.
6. Interagency cooperation.
7. Online capability.
8. Legislative stewardship.

86

These conclusions reflect the environment after 15 March 2019. In this environment lessons learned from the 15 March 2019 terrorist attack and subsequent appraisals of the counter-terrorism effort, including this report, can be applied. As well, constraints that previously limited the lines of activity that could be pursued are less significant than they were previously.

Political and public engagement

87

The current Directors-General of the intelligence and security agencies have been more proactive with the public than their predecessors. The New Zealand Security Intelligence Service has an active community engagement programme, which, for example, resulted in more than 100 interactions between New Zealand Security Intelligence Service staff and community representatives in 2018 and 2019.

88

All of that said, and recognising the hard work that has been carried out, there has been little informed public debate about the counter-terrorism effort beyond that stimulated by identification of errors or embarrassment for the intelligence and security agencies or New Zealand Police or controversies involving proposed legislative changes. There are few public-facing documents explaining to New Zealanders what is done on their behalf by those involved in the counter-terrorism effort. Stories of counter-terrorism successes have not been told publicly. More generally, there has been little or no recognition of the need for, and efforts of, the agencies that contribute to New Zealand’s counter-terrorism effort and keeping New Zealanders safe.

89

The events and controversies to which we referred in Part 8, chapter 2 led to an environment surrounding the intelligence and security agencies that was sufficiently toxic as to leave limited scope for useful political engagement. As well, in the situation as it was before 15 March 2019, politically-led discussion and debate about counter-terrorism was likely to result in further stigmatisation of Muslim communities, along the lines of what had occurred following the “Jihadi brides” controversy. There was also a political desire not to be alarmist about the terrorism threat.

90

The ability of the counter-terrorism agencies to talk about their successes has been severely constrained. In the absence of terrorist attacks, the lack of precursor terrorism offences meant that there were no terrorism prosecutions. This is despite the possibility that there may have been some prosecutions if New Zealand had legislation in place similar to that of the United Kingdom and Australia. The successful resolution of some investigations may have been jeopardised by publicity. Further, pervasive secrecy requirements are in themselves a serious limit on what can be said publicly. All of this has meant that there is at best limited public understanding of the threat of terrorism and the work that the counter-terrorism agencies carry out.

91

The lack of informed public debate has had consequences:

1. The social licence for the Public sector agencies involved in the counter-terrorism effort is limited.
2. The public, local government, private sector and civil society do not know what contribution they can make to the counter-terrorism effort.
3. Successive governments’ budget decisions have not been informed by a deep political or public appreciation of counter-terrorism threats and risks and the value that the relevant Public sector agencies do, and could, provide to public safety and national security.

92

These consequences are not theoretical. Two examples will suffice:

1. Despite the individual’s attempts at operational security, there were a few occasions when he acted in ways that were noticed by the public. Primarily relevant are the individual flying a drone over Masjid an-Nur, and his shooting style, which was noted as odd by some members of the Bruce Rifle Club. If the public was more aware of the risk and they knew how they could contribute to the counter-terrorism effort, people might have reported the individual’s actions to the counter-terrorism agencies. We cannot know what difference such reports might have made, but the chance of the individual’s activities being detected would have increased.
2. A public facing counter-terrorism strategy would include risk mitigation measures relating to target-hardening and managing crowded spaces. If implemented before 15 March 2019 such measures may well have reduced the loss of life resulting from the terrorist attack.

93

In the post-15 March 2019 environment, there should be substantially increased scope for informed public debate.

94

The terrorist attack of 15 March 2019 changed the public perception of terrorism in New Zealand. It also reinforced the reality that the terrorist threat comes from a number of groups and ideologies. This is clear from not only the terrorist attack of 15 March 2019 but also what has come to light since. In this environment, a threat agnostic counter-terrorism strategy should be able to be presented in a way that does not stigmatise particular communities or unduly alarm the public.

95

As we have already noted, a high-level Countering terrorism and violent extremism national strategy overview was published on the website of the Department of the Prime Minister and Cabinet in February 2020.²³⁴ This mode of publication meant that it attracted little public attention and it has not been promoted as an opportunity to stimulate debate. We have been told that the Government has been awaiting our report before implementing more activities in the national strategy overview’s proposed Public information action plan, including public messaging on how to stay safe during a terrorist attack and media engagement. We note that part of this, a crowded places strategy, was made public with a press release by New Zealand Police in September 2020 (and included on the websites of New Zealand Police, the Department of the Prime Minister and Cabinet, the New Zealand Security Intelligence Service and other Public sector agencies).²³⁵

96

We consider that the development of a countering violent extremism and terrorism strategy should prompt public debate, as we hope will be the case with this report.

Leadership and coordination

97

As part of the national security system, the counter-terrorism effort is organised on a decentralised coordinated model (see Part 8, chapter 3). It is decentralised in that no single agency has overall responsibility for policy and operational effort and the counter-terrorism effort is spread across multiple agencies. It is coordinated, in that the agencies within the system proactively work together under the coordinating leadership of the Department of the Prime Minister and Cabinet. That leadership is not directive. The chief executives of the intelligence and security and law enforcement agencies have statutory responsibility for the performance of their individual agencies and are not under the direction or control of the Department of the Prime Minister and Cabinet. There is, however, a collective responsibility regarding national security through the Security and Intelligence Board.

98

There are significant disadvantages or risks associated with this decentralised model, including lack of engagement, miscommunication, slow or incomplete information exchange, duplication of effort and the absence of a single point of accountability. There are also potential advantages, including absence of capture by a single agency, flexibility to innovate, nimbleness of individual agencies, different perspectives able to be brought to the table and competing ideas exposed for debate.

99

Maximising the advantages and minimising the disadvantages requires leadership that:

1. ensures that the individual agencies are interacting effectively with each other (sharing information, coordinating efforts, undertaking joint operations and collaborating on strategy) and not operating individually and in parallel; and
2. sets an agenda that identifies and addresses gaps in the system that individual agencies might not see from the vantage points of their own positions within the system.

100

This is a demanding leadership role, particularly for an agency such as the Department of the Prime Minister and Cabinet, which has little operational experience and limited resources.

101

Where a work programme involves contributions from multiple agencies, it is usual Public sector management practice in New Zealand for a strategy document to be put in place to guide and coordinate each agency’s contribution. A good strategy document enables role and terminology clarification, identifies common purpose, allocates accountability and enables proper resource allocation. However, no such strategy was in place to guide the counter-terrorism effort.

102

Between 2014 and March 2019, the counter-terrorism effort had made some progress:

1. A new ministerial portfolio for national security and intelligence was created in 2014.
2. The Specialist Coordinator for the counter-terrorism effort was appointed in 2016.
3. The Intelligence and Security Act was passed in 2017, which reformed the intelligence and security agencies’ authorising environment.
4. A National Risk Register was developed in 2018. While the Register has not yet been approved and published by the Government, the risk profiles are being used by officials to support a more strategic and proactive approach to risk management.
5. a more clearly defined interagency counter-terrorism work programme was progressed by the Security and Intelligence Board in 2018 (largely driven by the Specialist Coordinator).
6. The Security and Intelligence Board approved the Counter-Terrorism Strategic Framework and the High-Level Framework for the Prevention of Violent Extremism in 2018.

103

Some work streams that did not produce tangible public outcomes were affected by political considerations, most particularly the proposed public-facing counter-terrorism strategy and the National Risk Report, which would have had a terrorism component. In the post-15 March 2019 environment, the constraints that influenced these political considerations may have less relevance.

104

There was little progress in areas that needed coordination. This is illustrated by:

1. the absence of a mature risk management framework or mechanism that would have resulted in system-wide recognition of potential threats to New Zealand and what actions would be taken to mitigate them;
2. a lack of common understanding about leadership of the counter-terrorism effort;
3. the delay in New Zealand Police and the New Zealand Security Intelligence Service cooperating on understanding the threat posed by right-wing extremism leading to confusion between the counter-terrorism agencies of their respective individual and collective roles as to right-wing extremism;
4. the limited coordination of building online capability and capacity; and
5. the absence of system performance standards and accepted best practice in the New Zealand context against which to monitor performance and measure the effectiveness of the system.

105

The overarching benefit of a functioning system is the development of whole–of-system insights on which to implement joint effort. This appears lacking. Our impression of the material we have seen is that the agencies represented on the Security and Intelligence Board were not working together to understand and provide advice on the collective insights from assessments or to identify and respond to gaps in the system.

106

It is apparent that the counter-terrorism effort was not functioning as a national security system should. It was functioning as a collection of agencies, operating largely in parallel, with some elements of coordination but little shared direction.

Strategic intelligence assessments

107

Strategic assessments enable the counter-terrorism effort to scan the horizon to look for new and emerging threats. They lift the focus from today’s presenting threat and remind operational agencies of the need to anticipate future threats. It is an important tool for the effective allocation of resources, particularly where capacity or capability are limited. In New Zealand the Combined Threat Assessment Group and the National Assessments Bureau are the two agencies with responsibility for strategic assessments that support the counter-terrorism effort (see Part 8, chapter 4).

108

As is apparent, we are of the view that the orientations of these two assessment agencies meant that they did not focus on emerging threats of domestic terrorism. This was contributed to by resource constraints. As well, there was no national assessments programme to coordinate the strategic assessment activities of those two agencies.

109

Despite recognition since at least 2003, when the Auditor-General reported that an “over the horizon” function was critical to New Zealand’s national security system,²³⁶ such a capability has not been developed. The counter-terrorism effort would be strengthened if the assessment agencies had a dedicated horizon scanning function.

Role of the Government Communications Security Bureau

110

As we have explained, the domestic counter-terrorism role of the Government Communications Security Bureau was very limited (see Part 8, chapter 7). Leaving aside its cyber security role, it operates primarily as a foreign intelligence agency and it engages in domestic counter-terrorism activity only when tasked by another agency. There are a number of reasons for this, including legacy effects of the legislative settings before the Intelligence and Security Act, its capabilities and its assessment as to where those capabilities are best directed.

111

The domestic counter-terrorism effort would be strengthened if the Government Communications Security Bureau took a more proactive role.

Information sharing

112

In New Zealand’s decentralised counter-terrorism effort, sharing of information between Public sector agencies is critical to the effectiveness of the system (see Part 8, chapter 9). Well-functioning information sharing practices are particularly critical to enabling Public sector agencies to detect lone actor threats because, on the whole, it is less likely that lone actors will give detectable signals than terrorists operating within a cell or network.

113

Information sharing issues are not confined to highly classified information. Public sector agencies are not using current legislation to the fullest extent possible to provide for the sharing of information that is not subject to secrecy constraints. The Intelligence and Security Act permits direct access agreements to be established between the intelligence and security agencies and other specified Public sector agencies, but few have been entered into. While we accept that some effort and resource is required to conclude these agreements, our sense is that not all agencies are prioritising this work. The Department of the Prime Minister and Cabinet, as sector leader, should drive this area of effort.

114

There are also issues relating to highly classified information:

1. Sharing highly classified information between intelligence and security agencies (such as the New Zealand Security Intelligence Service) and law enforcement agencies (such as New Zealand Police) is a problem in many international jurisdictions. While New Zealand Police and the New Zealand Security Intelligence Service have improved their information sharing practices over the last five years by, for example, developing an information sharing protocol and co-locating teams in Auckland, there are continuing concerns amongst operational staff, particularly in New Zealand Police.
2. We have seen many examples of documents being over-classified. The more highly classified a document, the fewer people can see it. As we have noted, the volume of highly classified information produced by the New Zealand Security Intelligence Service and the Government Communications Security Bureau on domestic terrorism threats is relatively small. This small scale makes it possible for agencies to spend more time than we think they currently do on classification decisions or tearline reports. Tearlines are portions of an intelligence report or product that provide the substance of a more highly classified or controlled report without identifying sensitive sources, methods or other operational information. Tearlines release classified intelligence information with less restrictive dissemination controls, and, when possible, at a lower classification.²³⁷
3. The “need to know” principle could be used as an opportunity for Public sector agencies to think through who would benefit from receiving information, rather than as a reason for not sharing information.
4. Strategic intelligence assessments about terrorism threats in New Zealand are the culmination of a great deal of investment. They should present the most authoritative and complete picture of the threatscape possible. Ideally they should be classified at a level that permits sufficiently wide distribution to enable them to inform government decisions and activity.

115

Other than developing practical enablers, such as improved secure information technology, we have not seen a coordinated effort led by the Department of the Prime Minister and Cabinet and the Security and Intelligence Board to focus attention on information sharing and to overcome barriers to sharing highly classified information with all the Public sector agencies whose work would benefit from receiving it.

Interagency cooperation

116

The decentralised, coordinated model that the counter-terrorism effort employs relies for its effectiveness on the quality of interagency cooperation.

117

In the course of our inquiries we have been able to observe the level of cooperation between the Public sector agencies involved in the counter-terrorism effort. Our primary focus was the relationship between New Zealand Police and the New Zealand Security Intelligence Service (see Part 8, chapter 12).

118

Since 2015 there has been a significant improvement in the level of cooperation between the counter-terrorism agencies. The two agencies have created formal interagency groups and committees designed to facilitate cooperation at different levels of their organisations. Some co-location has been piloted and found to be of value to the working relationship.

119

The general philosophy has been to allow cooperation to develop organically. This involves relying on individuals to cooperate. Although we acknowledge significant improvement, this approach means that much depends on the informal understandings and arrangements between individuals. The system benefits could be lost with changes in personnel or a shift in focus. This is not a recipe for enduring success.

120

We have earlier identified some issues where cooperation has not been ideal and where the counter-terrorism agencies have operated in parallel. We are left with the view that, for the future, a more structured approach to cooperation would produce better results.

Online capability

121

A significant element of New Zealand’s counter-terrorism effort needs to be online, because the internet is widely recognised as having become a key platform for terrorist radicalisation and recruitment. Our report shows that it was on the internet that the individual developed and shared his extreme right-wing views, received inspiration and probably obtained operational information, researched firearms capability and undertook some of his reconnaissance. It was also the internet that enabled him to reach a worldwide audience with his GoPro livestream and manifesto (see Part 4: The terrorist).

122

Before 15 March 2019 the online capability of New Zealand’s counter-terrorism effort was limited (see Part 8, chapter 11). In the aftermath of the terrorist attack, the New Zealand Security Intelligence Service’s online capability was assessed as “fragile”. The same was true of the capability of New Zealand Police. The Government Communications Security Bureau was not substantially involved in the counter terrorism effort.

123

In mid-2018 the Specialist Coordinator commissioned a stocktake of agencies’ online activity to counter extremism. This found that although there were some relevant work streams underway, there was not a common approach and the level of coordination between agencies was questionable. The stocktake was provided to the Counter-Terrorism Coordination Committee but no further progress had been made by 15 March 2019.

124

Given the commonalities of effort between New Zealand Police and the New Zealand Security Intelligence Service and the complementary or additional roles and capabilities of the Government Communications Security Bureau and Department of Internal Affairs (in relation to objectionable material), coordination of the development of online capability is plainly sensible. Such coordination was not evident in relation to new funding approved for one agency to develop online capability in the 2019 Budget.

Legislative stewardship

125

Legislation is an important tool in any counter-terrorism effort. In our enquiries we focused on two principal statutes, the Terrorism Suppression Act (see Part 8, chapter 13) and the Intelligence and Security Act (see Part 8, chapter 14).

126

The Terrorism Suppression Act, among other things, sets the framework for criminalising various types of terrorist activity. It therefore sets the point at which New Zealand Police can disrupt terrorist activity by arrest and prosecution. The Intelligence and Security Act regulates intelligence gathering by the New Zealand Security Intelligence Service and the Government Communications Security Bureau. For the counter-terrorism effort to be effective, both pieces of legislation need to keep up to date with evolving patterns of terrorist activity, emerging technologies, operational challenges and public expectations about the balance between public safety and human rights.

127

The Terrorism Suppression Act does not provide the counter-terrorism agencies with assistance in dealing with potential terrorists who are operating in what we have called the pre-criminal space – that is, they are planning and preparing for a terrorist attack but have not committed any. This issue has been addressed in the United Kingdom and Australia by the creation of precursor terrorist offences, which include but are not confined to planning and preparation for acts of terrorism. The lack of such offences in New Zealand has limited the ability of New Zealand Police to disrupt terrorist planning and preparation by arrest. As well, it imposes at least potential limitations on the ability of New Zealand Police to exercise powers under the Search and Surveillance Act 2012. The lack of precursor terrorist offences also contributed to the New Zealand Security Intelligence Service’s focus on monitoring known terrorist threats. Rebecca Kitteridge, Director-General of Security, told us that this was unsatisfactory, as it tied up resources that should be actively seeking out unknown threats.

128

More generally, the effectiveness of the Terrorism Suppression Act has been affected by the lack of a review of whether it is fit for purpose. A holistic assessment of the nature of the risk presented by potential terrorists in the pre-criminal space is required. That assessment should consider the best way the risk can be mitigated with the resources that New Zealand is prepared to allocate to the counter-terrorism effort.

129

The Intelligence and Security Act has been useful in modernising and unifying the legal framework within which the New Zealand Security Intelligence Service and the Government Communications Security Bureau operate. It will be the subject of a mandatory review in 2022.

130

We consider that some of the difficulties with the operation of the Intelligence and Security Act may be able to be resolved by a different style of engagement between the intelligence and security agencies and the Inspector-General of Intelligence and Security (see Part 8, chapter 14). We have in mind here issues associated with the threshold for intelligence warrants on the risk of terrorism. This is particularly relevant to target discovery (Part 8, chapter 10).

131

There are other difficulties that warrant attention in the 2022 review of the Intelligence and Security Act as we set out in chapter 14. We are, however, of the view that urgent attention should be given to section 19.

_{229. New Zealand Security Intelligence Service, footnote 55 above.}

_{230. Maani Truu “Threats from far-right extremists take up between 30 per cent and 40 per cent of ASIO’s resources, up from only 15 per cent half a decade ago” SBS News (Australia 22 September 2020)}

_{231. Chris G Sibley, M Usman Afzali, Nicole Satherley, Anastasia Ejova, Samantha Stronge, Kumar Yogeeswaran, Michael Grimshaw, Diala Hawi, Zahra Mirnajafi, Fiona Kate Barlow, Petar Milojev, Lara M Greaves, Sarah Kapeli, Elena Zubielevitch, Logan Hamley, Maria C Basabas, Marvin H Wu, Chloe Howard, Carol HJ Lee, Yanshu Huang, Christopher Lockhart, Joaquín Bahamondes, Sam Manuela, Taciano L Milfont, Ryan Perry, Nikhil K Sengupta, Nickola C Overall, John H Shaver, Geoffrey Troughton, Danny Osborne and Joseph Bulbulia Prejudice toward Muslims in New Zealand: Insights from the New Zealand Attitudes and Values Study (July 2020).}

_{232. Sir Thomas Thorp KNZM Review of Firearms Control in New Zealand: Report of an Independent Inquiry Commissioned by the Minister of Police (Thorp Report)(Government Printer, June 1997).}

_{233. BC Ezell, SP Bennett, D von Winterfeldt, J Sokolowski and AJ Collins “Probabilistic Risk Analysis and Terrorism Risk” (2010) 30(4) Risk Analysis https://www.dhs.gov/xlibrary/assets/rma-risk-assessment-technical-publication.pdf.}

_{234. Department of the Prime Minister and Cabinet, footnote 48 above.}

_{235. New Zealand Police press release Working together to keep crowded places safe (17 September 2020) https://www.police.govt.nz/news/release/working-together-keep-crowded-places-safe; New Zealand Police website Crowded places strategy https://www.police.govt.nz/advice-services/protecting-crowded-places-attack/crowded-places-strategy; Department of the Prime Minister and Cabinet website Counter-terrorism https://dpmc.govt.nz/our-programmes/national-security-and-intelligence/counter-terrorism; New Zealand Security Intelligence Service website Protecting our Crowded places (18 September 2020) https://www.nzsis.govt.nz/news/protecting-our-crowded-places/.}

_{236. Office of the Controller and Auditor-General, footnote 8 at pages 39-40.}

_{237. Office of the Director of National Intelligence Intelligence Community Directive 209: Tearline Production and Dissemination (6 September 2012) https://fas.org/irp/dni/icd/icd-209.pdf.}