Assessment of the terrorism threatscape

Distressing content:
This section of the report contains material that may be confronting, particularly to those affected by the 15 March 2019 terrorist attack.

4.1 Overview

Our Terms of Reference required us to make findings as to whether relevant Public sector agencies failed to anticipate or plan for the terrorist attack due to an inappropriate concentration of counter-terrorism resources or priorities on other terrorism threats

Making informed decisions about where to concentrate counter-terrorism resources requires a comprehensive understanding of the threatscape. Critical to this is strategic intelligence assessment on the threat of terrorism. Such assessment enables the counter-terrorism effort to scan the horizon to look for new and emerging threats. It lifts the focus from today’s presenting threat and reminds operational agencies of the need to anticipate future threats.

In this chapter we:

review the role and expectations of the two agencies whose primary function is to produce intelligence assessments – the National Assessments Bureau and the Combined Threat Assessment Group;
discuss the development of a national assessments programme and the focus and capacity of the National Assessments Bureau and the Combined Threat Assessment Group;
sc rutinise the gaps we observed in the assessment system;
examine the perception of the terrorism threatscape before 15 March 2019;
examine the perception of the threat of right-wing extremist terrorism before 15 March 2019; and
describe the terrorism threat level assessments.

Other agencies also have assessment functions. The New Zealand Security Intelligence Service’s Strategic Intelligence Analysis team, established in 2016, is discussed briefly in this chapter, but in more depth in Part 8, chapter 5. New Zealand Police’s assessment function is discussed in Part 8, chapter 6. In Part 8, chapter 9, we discuss practices related to the sharing of strategic intelligence assessments across Public sector agencies.

4.2 Roles of the National Assessments Bureau and the Combined Threat Assessment Group

The National Assessments Bureau and Combined Threat Assessment Group combine multiple pieces of intelligence from various sources (for example, intelligence from other Public sector agencies and international partners) to produce assessments.

The National Assessments Bureau is part of the Department of the Prime Minister and Cabinet (see Part 8, chapter 3). The National Assessments Bureau provides medium to long-term assessments on a broad range of issues. These include, but are not confined to, terrorism. Its products are generally designed to inform policy formation and decision-making. The National Assessments Bureau does not make recommendations or offer advice in relation to its assessments. This is done by policy agencies responsible for the specific policy issue (such as the Ministry of Business, Innovation and Employment, the Ministry of Foreign Affairs and Trade and the Ministry of Justice).

The Combined Threat Assessment Group is an inter-agency group hosted by the New Zealand Security Intelligence Service. The Combined Threat Assessment Group’s mandate is to assess threats from terrorists likely to result in harm to New Zealand, its citizens or interests, both domestically and internationally.⁶⁵ As is the case with the National Assessments Bureau, it does not make recommendations or offer advice in relation to its assessments. The Combined Threat Assessment Group supports agencies such as New Zealand Police and the Ministry of Foreign Affairs and Trade to make tactical or operational decisions. That said, the Combined Threat Assessment Group sometimes provides broader strategic assessments, such as its New Zealand Terrorism Threatscape assessment.

The Combined Threat Assessment Group’s terrorism mandate is more focused than that of the National Assessments Bureau. We were told that the National Assessments Bureau was not focused on the domestic terrorism threatscape because of an agreed division of effort with the Combined Threat Assessment Group. There is however, no written memorandum of understanding or other formal agreement to this effect. In 2012, 2016 and 2018 the National Assessments Bureau produced strategic intelligence assessments used to inform the development of the National Security and Intelligence Priorities, including the terrorism priority (see Part 8, chapter 3).

Figure 43: How intelligence assessments are prepared

4.3 Expectations of the National Assessments Bureau and the Combined Threat Assessment Group

Expectations of the National Assessments Bureau have been established through Cabinet decisions and legislation.

In 2010, Cabinet amended the mandate of the National Assessments Bureau to enable its Director to “deliver assessment products that call on resources of all [New Zealand Intelligence Community] agencies and are relevant to all aspects of Cabinet-agreed national security agenda and priorities”. Cabinet also made the Director of the National Assessments Bureau responsible for the “development of a national assessment programme that includes domestic and external intelligence” and for “leading the [New Zealand Intelligence Community] in delivering the national assessments programme as mandated by Cabinet and ensuring effective integration of agency contributions to it”.

The Intelligence and Security Act 2017 provides for the chief executive of the Department of the Prime Minister and Cabinet to designate an employee to undertake “intelligence assessments on events and developments of significance to New Zealand’s national security, international relations and well-being and economic well-being to Ministers, departments and any other persons considered appropriate and advising departments on best practice in relation to the assessment of intelligence”.⁶⁶ In practice, this is delegated to the Director of the National Assessments Bureau.

A 2012 review of the Combined Threat Assessment Group noted its core function should be to enable intelligence and security agencies to recognise and address threats arising from terrorism that are likely to require a multi-agency operational response.⁶⁷ A follow up review in 2018 stated that “evidence about possible attacks in New Zealand” has “brought a greater focus to the homeland security risk environment”, such that there is “a need to expand our own indigenous threat intelligence effort”.⁶⁸

In addition, the terrorism National Security and Intelligence Priority as agreed through Cabinet decisions of 2012, 2015, 2016, and 2018 set broad parameters for the assessment of intelligence with respect to terrorism threats. The parameters of the 2018 terrorism Priority provide for:

The assessment of intelligence to identify and understand domestic terrorism threats … [for] domestic terrorism scope includes emerging trends and characteristics associated with overseas terrorist networks’ links to New Zealand. Beyond domestic threats, the narrower international scope of this Priority focuses on the use of intelligence and assessment to identify and understand terrorist threats against New Zealand’s interests overseas … and the trends and characteristics of emerging regional and global terrorism threats, which may impact New Zealand, New Zealand’s interest and New Zealanders.

Effective identification of emerging threats requires capability and capacity to look five to ten years ahead (horizon scanning). In 2003, the then Auditor-General reported that an “over the horizon” function was critical to New Zealand’s national security system.⁶⁹

4.4 A national assessments programme?

As noted, in 2010 Cabinet mandated the development of a national assessments programme led by the National Assessments Bureau with functions extending to the assessment of intelligence on domestic as well as international issues. Between 2011 and 2012, some progress was made in fulfilling the Cabinet mandate. The separate but associated National Assessments Committee, chaired by the Director of the National Assessments Bureau and comprised of eleven members,⁷⁰ coordinated the production of ten national security assessments on threats to New Zealand’s security, including terrorism.

In May 2013, the National Assessments Bureau presented a paper to the Officials’ Committee for Domestic and External Security Coordination. The paper proposed that the National Assessments Bureau would implement its changed mandate, and progress a shared national assessments programme, by reshaping the National Assessments Committee so that it had greater emphasis on tasking, oversight and quality assurance for assessment reporting.

Several high quality assessments focused on New Zealand’s domestic terrorism environment were produced during this time (2013–2014) through the National Assessments Committee. These included a report by the New Zealand Security Intelligence Service and two reports from New Zealand Police, which discussed the terrorist threat posed by the extreme right‑wing.

In 2014, the National Assessments Committee was replaced by the National Intelligence Coordination Committee. Our review of the National Intelligence Coordination Committee’s meeting minutes since 2016 show that it was predominantly focused on the coordination and implementation of the National Security and Intelligence Priorities, with little attention devoted to a coordinated national assessments work programme. We have seen no evidence of a coordinated national assessments programme since 2014, despite it being the responsibility of the National Assessments Bureau – as directed by Cabinet – to ensure there was such a programme.

4.5 Focus of the National Assessments Bureau

The threat of domestic terrorism was not a priority for the National Assessments Bureau and it did not provide any assessments solely focused on domestic terrorism.

The National Assessments Bureau’s focus was geopolitics and security dynamics within different countries and regions and what they meant for New Zealand’s national security interests. It tended to concentrate more on the foreign policy and trade aspects of national security, rather than the domestic aspects (though there is overlap between the two).

In response to feedback from the agencies using their intelligence products, the National Assessments Bureau became increasingly customer focused after February 2013. We were told that assessments are of no value unless they are supporting decision-making and that if someone “is not really interested in reading [an assessment], then you have to ask yourself, what is the value, what is the point [of the assessment]”.

This meant the National Assessments Bureau primarily addressed topics or themes on which its customers – usually the Ministry of Foreign Affairs and Trade – had asked for assessments. This explains its focus on foreign policy, security and trade issues, as highlighted by the 2014 Performance Improvement Framework review of the New Zealand Intelligence Community. That review observed that the National Assessments Bureau’s customers were reluctant to accept a reduction in foreign policy assessments in favour of a greater attention to national security issues.⁷¹ We heard from Howard Broad, former Deputy Chief Executive of the Department of the Prime Minister and Cabinet, that:

[When] you start to press [the National Assessments Bureau] on domestic issues and the relationship between foreign and domestic ones, they run out of legs a bit. We didn’t have the capability.

4.6 Focus of the Combined Threat Assessment Group

We were told that, before 15 March 2019 “the vast numerical majority of [the Combined Threat Assessments Group’s] product [was] focused internationally”. Of the products that did focus substantively on the New Zealand terrorism threatscape, most were tactical reports about security arrangements for visiting international dignitaries. Increased demand for these tactically-focused threat assessments meant the Combined Threat Assessment Group lacked the capacity to produce in-depth strategic assessments on the domestic terrorism environment. The New Zealand Security Intelligence Service told us that in response, from late 2017, its Strategic Intelligence Analysis team assumed the function of strategic assessment for counter-terrorism. Even so, the primary focus of the Strategic Intelligence Analysis team was guiding the operational activity of the New Zealand Security Intelligence Service. This meant it performed a different function to the Combined Threat Assessment Group, whose assessments are intended to inform the approach to counter-terrorism at a whole-of-system level. We discuss the Strategic Intelligence Analysis team below and in Part 8, chapter 5. The New Zealand Security Intelligence Service told us that in June 2020 the strategic assessment function was transferred to the Combined Threat Assessment Group.

Of the Combined Threat Assessment Group’s regular domestic products, the National Terrorism Threat Assessment has the most significant implications for the counter-terrorism effort. It informs the approach to counter-terrorism at a whole-of-system level. The National Terrorism Threat Assessment is comprised of two components – the threat narrative, which describes the terrorist threatscape in New Zealand and internationally, and the threat level, which assesses the likelihood of a terrorist attack in New Zealand.

In the second half of 2018, the Counter-Terrorism Coordination Committee chaired by the Specialist Coordinator (see Part 8, chapter 3) reviewed the terrorism risk management system, including the relationship between threat assessment, risk assessment and risk mitigation. One weakness they identified was the lack of an annual national terrorism threat assessment. A subsequent draft Cabinet paper said that:

… moving to an annual assessment would support a more deliberate and systematic approach to counter-terrorism. If done well it will have the potential to better inform counter-terrorism system gaps and priorities.

In December 2018, a paper to the Security and Intelligence Board proposed the “production by [the Combined Threat Assessment Group] of an annual New Zealand terrorism threat assessment to inform security posture and as a key input to support determination of counter-terrorism priorities”. This was seen as the “key starting point” for the terrorism risk assessment cycle and was proposed to be a “strategic assessment document that provides a comprehensive picture of the New Zealand terrorism threatscape”. The Security and Intelligence Board then confirmed that the Combined Threat Assessment Group would produce an annual New Zealand terrorism threat assessment and “[a]greed that a regular terrorism threat statement/update would be published”. It is unclear from the meeting minutes whether this meant published for officials only or for the public.

4.7 Capacity of the National Assessments Bureau and the Combined Threat Assessment Group

National Assessments Bureau

For much of its existence, the National Assessments Bureau has had a full-time equivalent staff of 30, including 21 analysts split across three teams, each with a manager and overseen by a director. The National Assessments Bureau seldom reached full analytical capacity, partly because of the significant time lag in bringing staff on board, which was contributed to by the lengthy security clearance process. We were told that in 2015 staffing was so low as to be below a credible minimum.

The 2016 Strategic Capability and Resourcing Review had envisaged growing the strategic assessments function from 21 analysts to 34 over four years. But reprioritisation over the past five years saw the increased resourcing shift to other areas. In July 2019, there were only three more analysts (and a further four recruitments in progress) at the National Assessments Bureau than there were before the Strategic Capability and Resourcing Review.

Combined Threat Assessment Group

For much of its existence, the Combined Threat Assessment Group has had a full-time equivalent staff of five to seven analysts plus a manager, usually seconded from the wider New Zealand Intelligence Community or international partner agencies. A 2012 review of the Combined Threat Assessment Group commented on its capacity issues.⁷² At that time it had an acting manager, plus five seconded staff.

We were told that the secondee model for the Combined Threat Assessment Group has its strengths, contributing to agency diversity, experience, access to systems and relationships. However, it also creates vulnerabilities as the workforce can be subject to staff turnover and associated lack of institutional memory. Some agencies have not replaced secondees or there have been gaps between secondments.

To mitigate these vulnerabilities, the New Zealand Security Intelligence Service has increased its contribution to the Combined Threat Assessment Group staffing, management and governance since the 2012 review. It now contributes six staff to the Combined Threat Assessment Group (only two of whom are funded by a cost-sharing arrangement between contributing agencies). More recently the Combined Threat Assessment Group has hosted secondees from New Zealand’s Five Eyes partners. Despite the New Zealand Security Intelligence Service’s increased contribution, the Combined Threat Assessment Group’s overall capacity had not improved since the 2012 review.

We were told that nine months after 15 March 2019, the Combined Threat Assessment Group still had the same number of staff (six analysts) as before the terrorist attack and that having six to eight analysts split across the domestic and global environments presented “real capacity challenges”. It was suggested to us that a modest expansion of three to four analysts would improve the Combined Threat Assessment Group’s capacity to assess threats to New Zealand, domestic and international.

4.8 Gaps in the assessment system

Lack of a national assessments programme

The National Assessments Committee offered a promising vehicle for the coordination of a national assessments programme, but it was disbanded in 2014. Its replacement, the National Intelligence Coordination Committee, was predominantly focused on coordinating the implementation of the National Security and Intelligence Priorities. As a result, there is no coordinated national assessments programme.

Greater coordination and integration of the assessment function is required. One way of achieving this would be to co-locate or combine the National Assessments Bureau and the Combined Threat Assessment Group. Both agencies have an independent assessment mandate, while operating within other agencies. They use similar methods and in some areas their products overlap. To encourage more integration of the assessment function, the 2016 Cullen-Reddy Report recommended that the government review the current placement of the Combined Threat Assessment Group within the New Zealand Security Intelligence Service and consider whether it might be more appropriately situated within the National Assessments Bureau.⁷³ This review does not appear to have been done. We return to this question in Part 10: Recommendations.

Lack of regular strategic assessment of the threatscape

The lack of a regular system-wide strategic assessment of the threatscape was identified by the Department of the Prime Minister and Cabinet in a 2014 paper to the Security and Intelligence Board. This paper reported that there was a “lack of understanding of the potential changes and future developments in the New Zealand security environment”. The paper also:

noted that the Combined Threat Assessment Group assessments “tell us what the threat level is now” and that “planning and investment for the medium-to-long term could be hampered by a lack of ongoing assessment of terrorism trends and activity in New Zealand, including trends relating to terrorist tactics, weapons and methods”; and
recommended that the National Assessments Committee produce an assessment of the New Zealand terrorism threatscape at least annually, with a focus on Islamist extremist terrorism and violent extremism, including assessing trends over the coming three to five years.

An assessment of the domestic threat from Islamist extremist and other sources of terrorism was produced in 2014, including trends over the coming three to five years, but this assessment was not repeated.

In July 2015 the Combined Threat Assessment Group produced the New Zealand Terrorism Threatscape. An updated version of this assessment, although scheduled for July 2017, was not produced until January 2018 (due to a lengthy review and consultation process). During this period, the National Assessments Bureau produced no strategic intelligence assessments of New Zealand’s terrorism threatscape.

The New Zealand Security Intelligence Service’s Strategic Intelligence Analysis team began producing its quarterly New Zealand Terrorism Updates in December 2017.

We were told that the New Zealand Security Intelligence Service’s baselining project (see further below and Part 8, chapters 5 and 10) was initiated, in part, to compensate for the lack of strategic intelligence assessments on the evolving terrorism threatscape produced elsewhere in the system.

Limited horizon scanning capability

Seventeen years after the 2003 Auditor-General review had reported that an “over the horizon” capability was critical to New Zealand’s national security system (see 4.3 Roles of the National Assessments Bureau and the Combined Threat Assessment), the intelligence assessment agencies (and indeed the entire national security system) are still lacking capability in this area.

We heard from several senior officials about their concern with the lack of horizon scanning capability and capacity in New Zealand’s national security system. We were told that the National Assessments Bureau’s “focus and resourcing did not prepare it particularly well for that longer-term work”. That same person reflected:

What I don’t see across [the National Assessments Bureau and the Combined Threat Assessment Group] is a foresight function designed to look beyond the tactical and say, five to ten years out. … I don’t see the teams who are using data analytics tools or good quantitative data; a lot of it is judgement and pulling pieces of covert data together.

Andrew Kibblewhite, former Chief Executive of the Department of the Prime Minister and Cabinet, agreed that the national security system’s capability to regularly scan the horizon in the medium to long term for emerging threats and matters of strategic importance was not well developed. He said it was done “in bits and pieces in the system at the moment”. Howard Broad, former Deputy Chief Executive of the Department of the Prime Minister and Cabinet, said that the Security and Intelligence Board sometimes engaged in horizon scanning, but it “was not systematic”. He noted that, “to some extent”, dedicated horizon scanning was “an expectation placed on the National Assessments Bureau”.

We were told that Singapore, the United Kingdom and the United States of America have dedicated horizon scanning units that look five to ten years ahead, but that this is not the case in New Zealand because of the National Assessments Bureau’s limited resources and customer focus.

Rebecca Kitteridge, the Director-General of Security, also commented on this gap:

I always thought it would be tremendous … if you had periodically, at the centre, a strategic look forward into what is the environment and what does that mean for us and what does it mean for our capability and resourcing and priorities, that gives you a natural forward look. You don’t have that at the moment.

Lack of assessment of the online world

There was limited analysis by the National Assessments Bureau and the Combined Threat Assessment Group of the formative role of the internet in the radicalisation, mobilisation and preparation activities of terrorists. We have seen only one shared report in the past decade, published by the Combined Threat Assessment Group and the New Zealand Security Intelligence Service, that substantively assessed online extremist activity in New Zealand.

Lack of focus on non-Islamist extremist threats

As we will illustrate in the next section, in the years before 15 March 2019 the primary focus of intelligence assessment was on the presenting threat of Islamist extremist terrorism. Before 2018, assessments by the National Assessments Bureau and the Combined Threat Assessment Group did not feature the threat of non-Islamist extremist terrorism.

When we asked Andrew Kibblewhite, former Chief Executive of the Department of the Prime Minister and Cabinet, about whether the system was looking beyond the risk of Islamist extremist terrorism, he told us:

I would have expected the [New Zealand Security Intelligence] Service and [the Combined Threat Assessment Group] to be looking at the whole violent extremism terrorism type risk.

…

If you’d said “is there a terrorist risk out of right-wing extremism?” I would have said “yes”, but… I probably would have used the precise words “I don’t think we are that concerned about it [in New Zealand]”.

…

I would have thought [right-wing extremism] would have been within what [the New Zealand Security Intelligence Service and the Combined Threat Assessment Group] would have scanned. It would have been within their scanning space. I wouldn’t have known how intensively they had scanned it.

Andrew Kibblewhite noted further to us that:

(a) [the Security and Intelligence Board] tended to be guided by experts (in this case mainly by [the New Zealand Security Intelligence Service and Combined Threat Assessment Group]) on matters of the terrorism threat;

(b) in this case those experts were not identifying right-wing extremism as a particular risk; and

(c) this contributed to [the Security and Intelligence Board] itself not emphasising the importance of right-wing extremism as a risk.

Andrew Kibblewhite’s comments are understandable. For instance, the Combined Threat Assessment Group’s July 2015 New Zealand’s Terrorism Threatscape assessment was that Islamist extremist terrorism was the primary threat could be taken to imply that other threats had been assessed. As far as we can tell, this was not the case.

4.9 Perceptions of the terrorism threatscape before 15 March 2019

A focus on international terrorism…

In examining the terrorism threatscape as perceived before 15 March 2019, we have considered the assessments issued by the National Assessments Bureau, the Combined Threat Assessment Group, intelligence products from other agencies, and what we were told in interviews and by community members, including Muslim individuals and communities.

The primary focus of terrorism intelligence assessments by the National Assessments Bureau and the Combined Threat Assessment Group was international terrorism. These assessments rarely discussed the domestic terrorism threat.

Between 2010 and 2018 the National Assessments Bureau published just under 400 formal assessments on terrorism and/or violent extremism. None of these was solely focused on the threat of domestic terrorism.

We were told that the National Assessments Bureau focused more on the international terrorism environment and less on the domestic terrorism environment because that was the agreed division of effort with the Combined Threat Assessment Group.

The Combined Threat Assessment Group receives significant numbers of international partner intelligence assessments. Unsurprisingly, the vast majority of assessments distributed by the Combined Threat Assessment Group were internationally focused. Such assessments can be produced and distributed quickly. We were told that:

at least half of the effort of two senior staff in the Combined Threat Assessment Group (who were presumably supported by analysts within the Combined Threat Assessment Group) was on domestic terrorism;
domestic reporting takes more time and requires more analysis and coordination (primarily with other Public sector agencies) than reporting on international terrorism; and
therefore, the ratio of domestically-focused to internationally-focused assessments produced by the Combined Threat Assessment Group in a given year does not provide the full picture of its effort.

Most of the Combined Threat Assessment Group assessments that focused substantively on the domestic terrorism threat were reports about security arrangements for events and therefore were operational in character. There were few strategic assessments of the domestic terrorism environment.

Threat assessments dealing with terrorism indicated that the terrorist threat to New Zealanders was greater when they were outside New Zealand. For example, in 2016, the National Assessments Bureau stated that “international terrorism is almost certain to remain a serious threat to New Zealanders, mostly abroad”. And in January 2018, the Combined Threat Assessment Group assessed that there was a higher general likelihood of a New Zealander being harmed in an international terrorist incident than one occurring in New Zealand.

Andrew Kibblewhite, former Chief Executive of the Department of the Prime Minister and Cabinet and Andrew Hampton, Director-General of the Government Communications Security Bureau both confirmed the dominant focus for intelligence assessments about terrorism had been on international rather than domestic terrorism.

… primarily on the threat of Islamist extremist terrorism

From 2010–2019 the intelligence assessments of the National Assessments Bureau and the Combined Threat Assessment Group considered the terrorist threat to New Zealand and New Zealanders as coming largely from Islamist extremism. So too did assessments from the New Zealand Security Intelligence Service and New Zealand Police.

Such assessments reflected the rise of the new “main terrorist threat”, Dā’ish, in the Middle East. As described in Part 8, chapter 2, the prevalence of lone actor terrorists inspired by Dā’ish presented serious challenges for intelligence and security agencies around the world.

There were numerous Dā’ish and Al Qaeda-inspired attacks in Western countries, including in Denmark, France, the United Kingdom and Australia. Dā’ish-inspired terrorism was a real threat in New Zealand, requiring at times the full focus of the resources available to the counter-terrorism agencies.

From 2016 onwards, assessments continued to evaluate Islamist extremism as the primary terrorist threat to New Zealand and New Zealanders. For example:

In 2016, a New Zealand Police intelligence report, New Zealand’s Islamist Extremist Landscape, stated that more New Zealanders were vulnerable to extremist messaging due to the pervasive nature of Dā’ish’s propaganda, which had proven more effective at attracting disaffected young males than other extremist groups.
The Combined Threat Assessment Group’s 2018 assessment of the New Zealand terrorism environment stated that “in spite of ongoing losses in Syria and Iraq, [Dā’ish] will continue to exert itself as a terrorist and insurgent group with international influence and reach … the overall level of support for [Dā’ish] among New Zealand-based Islamist extremists does not seem to have changed markedly … though the manifestation of support for radical Islam continues to evolve”.
The New Zealand Security Intelligence Service similarly concluded in 2018 that “[Dā’ish’s] territorial decline has not had any marked impact on the New Zealand extremist environment”.
Two papers produced by the National Assessments Bureau in 2018 discussed the “persistent threat from Jihadist terrorism”.

During this period, there was also significant focus on the threat to New Zealand’s national security posed by the return of New Zealand citizens who had travelled to Syria or Iraq to engage with terrorist entities in both combat and non-combat roles (called “foreign terrorist fighters”).

4.10 Perceptions of the threat of right-wing extremist terrorism

Assessments in the wake of the 22 July 2011 Oslo terrorist’s attack

In August 2011, one month after the Oslo terrorist’s attack, the Combined Threat Assessment Group shared an assessment from an international partner that assessed the potential – in terms of the availability of firearms – of a “Norwegian-style attack” occurring in that country.

One month later, in September 2011, the Combined Threat Assessment Group issued a threat assessment titled Availability of Firearms in New Zealand to Terrorists, Violent Extremists and Acutely Disaffected Persons. The assessment judged that a terrorist or violent extremist could legally acquire firearms, including military style semi-automatic firearms, for use in an attack. It looked at New Zealand’s firearms licence vetting process and considered that it was beyond the scope of, and it would be unrealistic to expect, the vetting regime to reliably identify a terrorist, extremist or acutely disaffected person posing as a legitimate firearms applicant. The Combined Threat Assessment Group considered the assessment was timely in regard to assessing the potential for terrorists or violent extremists planning to threaten New Zealand’s hosting of the Rugby World Cup 2011.

This assessment was not well received by some Public sector agencies. There were questions about whether the Combined Threat Assessment Group was stepping outside of its mandate in issuing an assessment that identified a vulnerability in the New Zealand system that was not tied to specific warnings or indicators. There was a strong suggestion that the Combined Threat Assessment Group was not the right agency “to be ‘auditing’ at this level – as distinct from making an input into a risk register which the agency with the main legal and financial/regulatory accountabilities has to maintain”.⁷⁴

In October 2011, the Department of the Prime Minister and Cabinet wrote to Mike Bush, then Deputy Commissioner of New Zealand Police, seeking New Zealand Police’s view on whether further firearms control measures were needed. A second letter is believed to have been sent to New Zealand Police in April 2012. New Zealand Police responded by providing statistics that highlighted that firearms crimes make up a small portion of total crimes and there had been a slight decrease in firearms crimes over the decade. After discussing the Combined Threat Assessment Group assessment with the Deputy Commissioner of New Zealand Police, and reviewing information provided by New Zealand Police, the Department of the Prime Minister and Cabinet concluded that the information did not indicate an immediate problem or reveal an urgent need for a review of firearms controls. As a result, no changes were made to fix the vulnerability that had been identified in the Combined Threat Assessment Group’s report. The Department of the Prime Minister and Cabinet did, however, encourage New Zealand Police to inform the Officials’ Committee for Domestic and External Security Coordination if the situation changed or New Zealand Police were of the view that firearms control needed to be re-examined.

National Assessments Bureau assessments

In 2013, the National Assessments Bureau produced an assessment titled Far Right Rising: A Dangerous Myth, which observed that during the European debt crisis, far right movements across Europe stepped up their anti-immigrant and anti-Muslim rhetoric. However, this assessment did not cover terrorism and/or violent extremism implications. Rather, it focused on the changing political landscape in Europe and what this might mean for New Zealand’s interests in trade, investment and immigration to the European Union.

The National Assessments Bureau’s first comment on the terrorist threat of the extreme right-wing in New Zealand was in September 2018 in its Global Terrorism Update. In an annex to the main assessment was a small section on “extreme right terrorism”, in which it observed that “between 12 September 2001 and 31 December 2016 in the United States of America, there were more extreme-right incidents than Islamist terrorist incidents resulting in fatalities”. It concluded that there had been an emerging threat from extreme right-wing terrorism for some time, but groups were fragmented with limited international coordination. The assessment went on to note that “[e]xtreme-right-wing groups are present in New Zealand and have an online presence, but have not been active”.

Combined Threat Assessment Group assessments

In 2018 the Combined Threat Assessment Group noted the “limited intelligence coverage of extremist left-wing and right-wing groups internationally”. One of the reasons for that limited coverage was explained in an earlier Combined Threat Assessment Group paper from September 2017. It noted that it “rarely sights intelligence regarding right-wing extremist groups and this is likely due to Western jurisdictions defining this more as a law enforcement matter”. This was a reference to extreme right-wing attacks not necessarily being considered matters of national security in some countries. Rather, they were seen as matters for law enforcement authorities. So some of New Zealand’s international partners did not have a mandate to collect or assess intelligence on the extreme right-wing.

In its January 2018 assessment of the New Zealand terrorism threatscape, the Combined Threat Assessment Group noted that:

Open source reporting indicates the popularity of far right ideology has risen in the West since the early 2000s. Since 2014, the “new” right-wing movements have been strengthened by opposition to refugee settlements and Islamist extremist attacks in the West, especially in Europe and Scandinavia.

[The Combined Threat Assessment Group] has not sighted any reporting to indicate [established New Zealand far right groups have] the intent or capability to promote their ideology by an act of terrorism. As has been evidenced in similar jurisdictions to New Zealand, an extreme right-wing lone actor attack remains a possibility, albeit a remote one.

Leaving aside the assessments to which we have just referred, the Combined Threat Assessment Group reported on the threat of extreme right-wing terrorism only in the context of intelligence products it had received from international partners between 2011 and 15 March 2019. These were generally in connection with events, including international terrorist attacks motivated by extreme right-wing ideology (such as the murder of British Member of Parliament Jo Cox and the Finsbury Park Mosque and Quebec City Mosque terrorist attacks) and the designation of extreme right-wing groups (including National Action in the United Kingdom) as terrorist organisations.

We were informed by the New Zealand Security Intelligence Service that the domestic and international partner agency information available to the Combined Threat Assessment Group on extreme right-wing threats before 15 March 2019 was “very limited compared to the amount of information related to Islamist extremism threats”.

New Zealand Police assessments

New Zealand Police were the first agency in New Zealand’s counter-terrorism effort to produce regular intelligence assessments on the extreme right-wing. Since the 1990s, New Zealand Police had been examining and reporting on individuals and groups that were assessed to be white supremacists. New Zealand Police increased their focus on and broadened their awareness of the extreme right-wing around 2009.

From 2010 to 2014, New Zealand Police produced intelligence assessments on the criminal activities (including assault, theft and drug offending) of several extreme right-wing groups in New Zealand. The potential for members of these groups to commit acts of terrorism was not assessed. By 2013, New Zealand Police had identified more than 100 individuals of interest to New Zealand Police due to their links to extreme right-wing groups.

Although New Zealand Police secondees to the Combined Threat Assessment Group would have had access to these New Zealand Police assessments, they do not appear to have formed the basis of the Combined Threat Assessment Group’s assessments. We have not seen evidence that they were brought to the notice of the National Assessments Bureau or the New Zealand Security Intelligence Service. The New Zealand Security Intelligence Service suggested to us that the reason why New Zealand Police assessments were not shared may have been that they were not seen as having a clear connection to national security. New Zealand Police told us that, at the time, they understood that the New Zealand Security Intelligence Service had no interest in or mandate to examine the extreme right-wing and thus they saw no reason to share the assessments.

In 2014, a New Zealand Police assessment titled The Right-wing in New Zealand: Myth vs Reality was published by the National Assessments Committee. The paper assessed that while the actions of established extreme right-wing groups in New Zealand were confronting to wider society, there was no evidence to suggest they posed a national security threat.

Later in 2014, another New Zealand Police assessment titled Domestic Extremism: Unlikely but not out of the question was published by the National Assessments Committee. This assessed the risk to New Zealand from forms of extremism other than Islamist extremism. It reiterated that the far right was characterised by “discord and discoordination” and that experienced activists were unlikely to pose a risk to national security in the next three years. It noted that the growth of the internet allowed people to connect and reinforce their ideas and that it was hard to identify individuals of security concern outside the domestic activist environment because many of their characteristics and behaviours were found in the general population. It concluded that an extremist could purchase firearms or the components of an improvised explosive device with minimal risk of discovery and assessed there was 25 to 50 percent chance of an extremist act.

In both of these 2014 assessments, New Zealand Police addressed the possibility of firearms being used in a terrorist attack, specifically by the extreme right-wing. The first assessment noted a “propensity for [extreme right-wing] members to acquire and use firearms”. New Zealand Police concluded that the relative ease of access to semi-automatic firearms in New Zealand meant that a lone actor terrorist attack remained a possibility. In the second, New Zealand Police assessed “if someone has the intent, the relatively permissive environment for purchasing firearms and/or [improvised explosive device] components will allow them to develop actionable capability with minimal risk of discovery” (see Part 8, chapter 6 for more discussion on what New Zealand Police were doing about the extreme right-wing before 15 March 2019).

New Zealand Police had given some thought to the possibility that Muslim communities in New Zealand could be the target of threats. In May 2018, an internal New Zealand Police report, National Security Situation Update, noted calls from Dā’ish for attacks during Ramadan and observed:

Internationally, Ramadan is also a time of increased risk for the Muslim community, due to either the backlash following terrorist events, the increased profile of the Muslim community during this period, or a combination of the two. In addition to vandalism, verbal altercations, and online harassment, this has also led to violence. During Ramadan in 2017, verbal harassment of Muslims escalated into a stabbing incident where two men were killed in Portland, USA, and a vehicle ramming attack on worshippers exiting the Finsbury Park Mosque in London, UK.

NZ Context

The national terrorist threat level in New Zealand is currently assessed as LOW – an attack is possible, but is not expected. There is no intelligence as to any specific threat.

However, this intelligence could be incomplete or the situation could change at short notice. Internationally, attacks have taken place with little warning.

The Muslim community in New Zealand has experienced sporadic incidents of vandalism and abuse. While not frequent, incidents do create widespread concern among the community when they do occur, as well as attention from the media.

New Zealand Police’s last intelligence assessment related to extreme right-wing groups and activities was in 2015 but focused on an annual event and did not address national security issues. It was primarily a New Zealand Police document, but the Combined Threat Assessment Group was on the distribution list. New Zealand Police’s strategic intelligence capability declined after 2015, which we were told meant limited focus on counter-terrorism from its intelligence system.

As we will discuss shortly, in late 2018 the New Zealand Security Intelligence Service sought the support of New Zealand Police with their project to establish a baseline picture of emerging domestic threats. This included a discussion to understand the interaction between each agency’s mandate on non-Islamist extremism (see Part 8, chapter 12). We were told that New Zealand Police took preliminary steps to undertake their own national assessment of the extreme right-wing environment but that effort on this work was still in its initial stages at the time of the 15 March 2019 terrorist attack.

New Zealand Security Intelligence Service assessments before 2018

In December 2011, the New Zealand Security Intelligence Service observed the “notable increase in groups across Europe espousing hard-line nationalist and anti-immigration rhetoric” and the resurgence of neo-Nazi groups in the United States of America and Europe. It assessed that the Global Financial Crisis and New Zealand’s economic and immigration policies could “stir up extreme right-wing and/or nationalist groups [in New Zealand] to protest against perceived increasing inequalities and lead to the adoption of more violent methods to effect political change”. In 2014, the New Zealand Security Intelligence Service assessed non-Islamist extremist domestic terrorism as a threat, “although comparatively minor”. The threat of right-wing extremist terrorism was not further addressed until 2018, just ahead of the New Zealand Security Intelligence Service baselining project.

Reports received from the Government Communications Security Bureau

Before 15 March 2019, the Government Security Communications Bureau had no specific intelligence about a heightened risk to New Zealand’s national security from the extreme right-wing or requests from other Public sector agencies to investigate the matter. The Government Communications Security Bureau has emphasised to us (see Part 8, chapter 7) that:

[The Government Communications Security Bureau] is not a lead agency nor an assessment agency for counter-terrorism, [so] it is not [its] role to assess the prevalence of right-wing extremism in New Zealand. [The Government Communications Security Bureau] carries out intelligence collection and analysis activities at the request of the other New Zealand government agencies which have the lead on the counter-terrorism priority.

The Government Communications Security Bureau informed us that in the second quarter of the 2018-2019 financial year, it received 7,526 intelligence reports from international partners about terrorism and violent extremism. None of those reports related to right-wing extremism.

New Zealand Security Intelligence Service baselining project

The New Zealand Security Intelligence Service started a project to develop a baseline picture of emerging terrorism threats in May 2018. We describe this exercise baselining project in greater detail in Part 8, chapters 5 and 10.

The extreme right-wing was identified as requiring further attention due primarily to global terrorist incidents and trends. The New Zealand Security Intelligence Service sought to identify any similar potential threats in New Zealand. This involved a 12 month project focusing on right-wing extremist activity in New Zealand, which started in May 2018. In July 2018, the New Zealand Security Intelligence Service produced its Information & Intelligence Requirements Extreme Right-wing (XRW) Activity in New Zealand. This set out the state of the New Zealand Security Intelligence Service’s knowledge and the intelligence gaps and questions to be addressed. We discuss this further in Part 8, chapter 5.

New Zealand Security Intelligence Service assessments in 2018

From December 2017, the Strategic Intelligence Analysis team within the New Zealand Security Intelligence Service started producing quarterly New Zealand Terrorism Updates. Three of these reports were produced before 15 March 2019. They are relatively short and focus almost exclusively on the threat of Islamist extremist terrorism in New Zealand and overseas. Two of these reports produced in the second half of 2018, and one produced in the first quarter of 2019, referred to the threat of extreme right-wing terrorism. The New Zealand Terrorism Update dated 5 September 2018 noted that “[the New Zealand Security Intelligence Service] is not aware of any credible indications of terrorist threats from supporters of non-Islamist terrorist groups or other extreme ideologies”. The next New Zealand Terrorism Update in this series was dated 4 December 2018 and was more cautious:

Non-Islamist terrorist threats from extreme political, religious and issues-motivated groups are plausible in New Zealand, especially given heightened political partisanship internationally and the spread of disinformation online. Various radical groups are present in New Zealand, some of which have extreme elements that could plausibly turn violent; however, terrorist acts by them are currently not expected.

…

The spread of highly partisan political content online, especially over social media, has almost certainly contributed to acts of non-Islamist extremist violence in Western countries. Several attempted and realised attacks in the United States in 2018 were linked to extreme right-wing, conspiratorial, or racist agitation in social and other media, judging from press reporting.

The final New Zealand Terrorism Update published before 15 March 2019, which was dated 5 March 2019, stated that:

[The New Zealand Security Intelligence Service] and [Combined Threat Assessment Group] analysts note that extremism exists in the fringes of non-Islamist New Zealand political, religious and issues-motivated groups and could plausibly result in violence. However, [the New Zealand Security Intelligence Service] is not aware of any credible threats from such groups.

These assessments reflect the New Zealand Security Intelligence Service’s developing but still limited understanding of the threat of right-wing extremism in New Zealand as at 15 March 2019.

A training exercise

A counter-terrorism tabletop training Response exercise was carried out by the New Zealand Security Intelligence Service and New Zealand Police in October 2018. Two hypothetical counter-terrorism scenarios were presented and discussed. One of the scenarios tested was an extreme right-wing attack outside a masjid in Christchurch. This scenario assumed a Finsbury Park Mosque-style terrorist attack, with a vehicle hitting pedestrians leaving what was described in the scenario as the “an-Nur Mosque adjacent to Hagley Park in Christchurch”. The hypothetical attacker in the scenario shouted anti-immigration and Islamophobic slurs as he fled the scene.

The locations of the assumed attack and the first phase of the 15 March 2019 terrorist attack are the same. We must emphasise that this is a coincidence, albeit a striking one. The design of the exercise was not informed by intelligence suggesting that Masjid an-Nur was at risk as there was no such intelligence.

The objectives for the exercise were focused on increasing the understanding of agencies’ processes and procedures during the Response to a terrorism scenario. Importantly, for present purposes, what the exercise demonstrated was an awareness of the possibility of the threat from the extreme right-wing – and that such an attack could potentially occur in New Zealand.

A system view – looking back

Andrew Kibblewhite, former Chief Executive of the Department of the Prime Minister and Cabinet, told us “we weren’t unaware of a white supremacist threat but it wasn’t where our focus was”. He used the metaphor of an iceberg. The system knew about the threat of the extreme right-wing but saw it as a “small iceberg”, so there would be the “occasional paragraph” about the extreme right-wing in intelligence products. But there was no deeper investigation beneath the surface. Andrew Kibblewhite said that it had become apparent after the 15 March 2019 terrorist attack, in light of the leads received on possible extreme right-wing activities, that the “iceberg was bigger than we realised and it was our job, as a system, to know the size of that iceberg”.

Community concerns

In the two or three years before 15 March 2019, members of Muslim communities in New Zealand raised many issues with Public sector agencies including Islamophobia, discrimination and harassment. Minutes tended not to be taken at the meetings at which these concerns were raised and, if notes were taken, they were not shared with community members. This, along with the effect of the passage of time on the memories of the officials involved in the meeting, means that it is hard to be sure as to the extent to which the concerns raised at particular meetings extended to the risk of right-wing terrorism.

Despite these doubts and difficulties, we are confident that concerns relating to the rise of the alt-right, right wing extremist terrorist attacks overseas and the safety of Muslim communities were shared with Public sector agencies on some occasions. For example:

The speech notes of a Muslim speaker at a meeting on 23 March 2017, at which a senior New Zealand Police representative was present, raised concerns about the “alt-right (neo-Nazis)” and “fear of an attack”. The notes included a question to Public sector agencies about whether they had a strategy in place to deal with these issues.
An email to a government official in August 2017 from Muslim individuals records how they had raised concerns with a minister about events overseas, an increase in Islamophobia experienced by Muslim women in New Zealand and the rise of the alt-right in New Zealand.
Three separate meetings were held in 2018 between the New Zealand Security Intelligence Service and different Muslim individuals. The New Zealand Security Intelligence Service’s notes from these meetings show concerns were raised about Islamophobia and discrimination experienced by Muslim individuals and communities. We were told by the individuals that concerns were also raised by about the alt-right and right-wing extremism. Such concerns were recorded in some but not all of the New Zealand Security Intelligence Service’s notes from the meetings. For instance, an email exchange between Muslim individuals following the November 2018 meeting recorded that they had raised concerns about hate groups and an offensive pamphlet being placed in the letterbox of a Muslim whānau. The New Zealand Security Intelligence Service’s record of the same meeting records that concerns were raised about anti-Muslim activity and right-wing extremism and includes a reference to the pamphlet.
An email sent to New Zealand Police shortly before the 15 March 2019 terrorist attack from a member of the Muslim community about their previous report of an abusive phone call, their wider concerns about the rise of Islamophobia in New Zealand and the need for New Zealand Police to develop a strategy to counter this before it escalated.

4.11 Terrorism threat level assessments

From 2010 to 2018, the New Zealand terrorism threat level set by the Combined Threat Assessment Group was mostly at “low” (terrorist attack is assessed as possible but is not expected) or “very low” (a terrorist attack is assessed as very unlikely). It set these levels on the basis that “New Zealand has not experienced a completed Islamist extremist terrorist attack and [the Combined Threat Assessment Group] is not aware of any current and/or advanced plan to conduct one”. It emphasised, however, that the low threat level meant that the threat of terrorism in New Zealand was real, even at “low”.

4.12 Concluding comments

The assessments outlined above generally judged that the terrorism threat to New Zealanders was greater offshore and the primary threat was Islamist extremist terrorism. There were few strategic intelligence assessments about terrorism threats in New Zealand and hardly any on emerging threats such as right-wing extremism.

In part this was because the two key assessment agencies were not well-situated to provide assessments of emerging terrorism threats in New Zealand. The National Assessments Bureau saw terrorism as primarily the responsibility of the Combined Threat Assessment Group. Its focus was largely international and customer directed. The Combined Threat Assessment Group’s assessments were short-term and tactical in nature rather than long-term and strategic. Both agencies had limited resources and neither had a dedicated horizon scanning capability. The lack of a coordinated national assessments programme meant that the gaps in strategic assessment were less likely to be identified and addressed.

We see the way these agencies viewed their respective roles, and the focus of their efforts as a function of the way the counter-terrorism effort operated as a whole and thus not within the control of a single agency. We address this further in our evaluation in Part 8, chapter 15.

_{65. The Combined Threat Assessment Group also has a mandate for assessments relating to violent protest in New Zealand and abroad, but this forms a minimal part of its work.}

_{66. Intelligence and Security Act 2017, section 233.}

_{67. Simon Murdoch Review of CTAG (April 2012) at page 4.}

_{68. Simon Murdoch CTAG 2018: Its placement in New Zealand’s counter-terrorism system architecture and its location; an independent view (27 July 2018).}

_{69. Office of the Controller and Auditor-General, footnote 8 above at pages 39–40.}

_{70. The National Assessments Committee comprised the Combined Threat Assessment Group, the Department of the Prime Minister and Cabinet, the Government Communications Security Bureau, Immigration New Zealand, the Ministry of Defence, the Ministry of Foreign Affairs and Trade, New Zealand Customs Service, the National Assessments Bureau, the New Zealand Defence Force, New Zealand Police and the New Zealand Security Intelligence Service.}

_{71. Performance Improvement Framework, footnote 42 above at page 23.}

_{72. Simon Murdoch, footnote 68 above at page 13.}

_{73. Hon Sir Michael Cullen KNZM and Dame Patsy Reddy DNZM, footnote 38 above at page 60.}

_{74. Simon Murdoch, footnote 68 above at page 9.}

4. Assessment of the terrorism threatscape

Distressing content: This section of the report contains material that may be confronting, particularly to those affected by the 15 March 2019 terrorist attack.