Astate of unpreparedness
The royal commission report into the Christchurch massacre is an unusually close and unflattering view of our intelligence and security agencies. Martin van Beynen reports.
On October 2018, staff from the NZ Security Intelligence Service (SIS) and the NZ Police gathered to test two hypothetical counter-terrorism scenarios. One scenario involved a vehicle hitting pedestrians leaving the Masjid an-nur in Deans Ave, Christchurch. The hypothetical attacker shouted Islamophobic slurs as he fled.
The planning session, as outlined in the report of the Royal Commission of Inquiry into the Terrorist Attack on Christchurch Mosques on March 15, 2019, suggests both agencies had identified a Right-wing threat and wereworking on a response.
Unfortunately that was far from the case. The commission’s report depicts the counter-terrorism effort across government agencies – SIS, Government Communications Security Bureau (GCSB), and police – as lacking clear leadership and illequipped and under-resourced to gather intelligence and identify new threats. The picture presented of the agencies as they operated before the terrorist attack is one of blinkered organisations, focused almost entirely on Islamic extremism, and acting without co-ordination or urgency to address non-islamic terrorism threats, even when somewere highlighted.
Some successes
The commission noted the focus on Islamic terrorism threats detected persons of interest. ‘‘Therewere numerous active domestic investigations and operations focused on Islamic extremist activity that posed real threats to public safety.’’
Between August 2015 and January 2018, eight passports were cancelled and 17 individuals arrested.
Over the decade before the Christchurch attack, the agencies were not oblivious to the gathering threat from far Right.
In September 2011, two months after Anders Breivik’s attacks in Norway, the Combined Threat Assessment Group (part of SIS) issued a threat assessment warning that a violent extremist could legally acquire semi-automatic firearms.
The assessment said the firearms licence vetting process could not identify an extremist or disaffected person posing as a legitimate applicant. But the Department of the Primeminister and Cabinet concluded an urgent review of firearms controls was not needed.
In 2014, two police assessments concluded an extremist could purchase firearms or the components of an improvised explosive device with minimal risk of discovery and assessed there was a 25 per cent to 50 per cent chance of an extremist act.
In a terrorism update published 10 days before the shooting, SIS said extremism existed in the fringes and could plausibly result in violence.
In May 2018, the service had started a 12-month project focusing on Rightwing extremist activity. A few months later it remarked the service was ‘‘currently unsighted to any individuals or groups who espouse an extreme Right-wing ideology and promote the use of violence to achieve their objectives’’.
Avenues of detection
The commission found there were threeways themosque gunman could have been detected. The first was comments he made on a private Facebook page under the name ‘‘Barry Harry Tarry’’. The comments mentioned an Islamic school across the road from his Dunedin gym that he used ‘‘as a source of rage for his lifts’’ and suggested such schools should be supported because ‘‘it makes them gather in one place’’.
The second was a tip-off from the public, such as from gun club members who noted his unusual style of shooting. Amember of the public also saw a drone flying over masjid an-nur in Deans Ave about eight weeks before the shooting but did not tell police. ‘‘As many muslim individuals have observed to us, an identifiably Muslim person who acted in the same way as the individual would likely be reported.’’ the commission says.
The third avenue was through data. That might have captured enough information to trigger an investigation. ‘‘If the individual had been identified as the author of the Facebook comments, a check of the NZ Police National Intelligence Application would have revealed he held a firearms licence… Whether such investigation would have resulted in the disruption of the terrorist attack is necessarily speculative. It is, however, distinctly possible,’’ the commission says.
A report to police that the gunman had injured himself in the accidental discharge of a firearm in his flat (which had a common wall with his neighbours) would not have triggered suspicions of terrorism, the commission says. But it might have led to an inquiry into whether the shooter was a fit and proper person to have a gun. The commission does not suggest the gunman’s gaming friend, who knew about his beliefs and acted as a reference for his firearms licence, or the gunman’s mother, who knew of his sympathies and that he had firearms, should have notified authorities.
Not well situated
While themosque shooter went about his preparations over 18 months, the country’s ability to detect him had serious gaps. Not all of it was the fault of the agencies, the commission says.
Due to a limited social licence from the public and little buy-in from politicians, the agencies could not snoop where they needed to.
‘‘The idea that intelligence and security agencies engage in mass surveillance ofnew Zealanders is a myth,’’ the commission says.
The focus on Islamist extremists as the most pressing threat meant most resources were directed to that area and, as a result, ‘‘very limited’’ resources were dedicated to understanding other terrorist threats.
As an example, the commission mentions the regular intelligence briefs provided by thenational Assessments Bureau to the prime minister. From 2010 to March 15, 2019, these briefs contained fewer than 20 references to domestic extremism.
The commission’s main concern with the focus on Islamic terrorism was the decision to devote the resources to that area was not made by analysing the various risks and deciding which took priority. ‘‘So therewas not an informed and systemwide decision to proceed on this basis, which we see as inappropriate.’’
Limited resources
The two key agencies in charge of providing assessments of emerging terrorism threats in New Zealand were the National Assessments Bureau (part of the Department of the Primeminister and Cabinet) and the Combined Threat Assessment Group (SIS). Both agencies had few resources and neither had a dedicated capability to look for coming threats. The Combined Threat Assessment Group spent most of its time on tactical reports about security for visiting international dignitaries.
The police had anational Security Group charged with leading its counter-terrorism effort but it had few staff. A national security investigations team had four units thatwere too stretched. A budget bid in 2016 to beef up police counter-terrorism failed.
Up to the shootings in March 2019, the police intelligence function had lost staff and use of intelligence across districts was variable. From 2015 to the shootings, the police did not produce strategic intelligence on far-Right individuals and groups.
The SIS and Gcsb were rebuilding after a damning review in 2014. The first tranche of a $178.7 million funding injection started in 2016.
New staff were coming on board at the SIS but by the time the shooter attacked most were still regarded as ‘‘apprentices’’. A high staff turnover also did not help.
About half of the agency’s resources were dedicated to espionage and hostile foreign intelligence with slightly less to counter-terrorism.
Up until 2018 all the counterterrorism resources had been devoted to investigating New Zealand supporters of Da’ish, also known as Isis. As at march 11, 2019, the SIS had 32 individuals on its investigation watch list, all of them because of their affiliation with Islamic extremism.
Online capability and capacity
Before March 15, 2019, the agencies involved in the counter-terrorism effort had limited online capabilities.
In mid-2018, a stocktake of the agencies’ online activity to counter extremism found a number of relevant work streams but no common approach existed. The stocktake did not lead to any concerted action.
The SIS’S development of covert online capability and strengthening of its open-source collection capability on March 15, 2019, was ‘‘fragile’’.
One fulltime analyst was working on research and monitoring and, in early 2018, the covert online team consisted of two part-timers who left in mid-2018. The police also collected online intelligence but had few tools to exploit social media.
Did it matter?
In the end, the commission says, the less than optimal performance of the intelligence and security agencies did not cause the determined and intelligent gunman to go undetected.
‘‘We are of the view that detecting the individual would have depended on chance even if there had been a substantial focus on Right-wing extremism by the counter-terrorism agencies.’’