11.1 Overview

1

The terrorist attack on 15 March 2019 highlighted the importance of the online capabilities and activities of the Public sector agencies with counter-terrorism operational responsibilities.

2

A significant element of New Zealand’s counter-terrorism effort needs to be online because the internet is widely recognised as a key platform for terrorist radicalisation and recruitment. Our report shows that it was on the internet that the individual developed, at least in part, his extreme right-wing views and, to some extent, shared them. He also used the internet to obtain operational guidance, research firearms capability and undertake some of his reconnaissance. It was also the internet that enabled him to reach a worldwide audience with his GoPro livestream and manifesto (see Part 4: The terrorist).

3

This chapter:

  1. describes the two types of online intelligence collection;
  2. explains the challenges that online intelligence collection presents;
  3. outlines developments since 15 March 2019; and
  4. assesses the extent to which there is there is a whole-of-system approach to online capabilities in the counter-terrorism effort.

 

11.2 Two types of online intelligence collection

4

There are two distinct types of online intelligence collection.149

5

First, collection through open-source research and monitoring. This involves searching areas on the internet that do not require difficult-to-obtain privileges to gain access. It may involve access to platforms by subscription.

6

Second, collection through covert operations. These may involve the use of automated tools to “scrape” or extract data from websites or the development of an assumed identity (in accordance with Part 3 of the Intelligence and Security Act 2017). An assumed identity can be used to support an online persona and gain access to closed online forums.

7

A key distinction between these two types of online intelligence collection lies in the intention of the originator of the information.150 Generally speaking, open-source research and monitoring seeks to collect information that the originator was not concerned to keep hidden. In contrast, covert operations collect information that the originator did not wish to be available to people other than an intended audience, especially not to intelligence and security and law enforcement agencies.

8

More people are spending significant proportions of their lives online, more activities and interactions are being conducted online and news and views are being disseminated and accessed online. The counter-terrorism effort needs online capabilities. This is particularly so because:

  1. the internet enables and facilitates contact between, and funding of, extremists globally;
  2. radicalisation can be driven by both physical world and online influences, and there can be significant cross-over between groups and individuals operating in the real world and online;
  3. online material can reveal the capabilities that might be utilised by someone mobilising to violence;
  4. the volume of extremist material online and the ease with which it can be accessed and shared means that extremists are increasingly operating online. Their activities inspire and radicalise others with whom they could not otherwise as easily have contact; and
  5. online intelligence collection capability may somewhat offset the collection (and consequential intelligence) losses resulting from encryption.

 

10.3 The challenges that online intelligence collection presents

9

There are several challenges for intelligence and security and law enforcement agencies in monitoring and countering extremism online. These include:

  1. the size and complexity of the internet;
  2. encryption;
  3. anonymisation and the use of false names;
  4. the rapid rate of change in the online world; and
  5. the difficulty of identifying the boundary between free speech and harmful extremism.

10

The diversity of data is another challenge as data may need to be “cleaned” before it can be used. Cleaning is the process of removing or updating data that is incomplete, incorrect, improperly formatted, duplicated or irrelevant. There are also challenges in storing, managing and interrogating what may be large volumes of data in order to produce usable intelligence.

 

Online capabilities stocktake

11

Before 15 March 2019 the Public sector agencies involved in the counter-terrorism effort had limited online capabilities and capacity for counter-terrorism purposes.

12

In mid-2018 the Specialist Coordinator (see Part 8, chapter 3) directed a National Assessments Bureau analyst to conduct a stocktake of Public sector agencies’ online activity to counter extremism. Initially, the stocktake was intended to support the Counter-Terrorism Coordination Committee to consider whether a more detailed gap analysis and consideration of potential additional measures was required.

13

The stocktake reviewed the Public sector agencies’ activity in relation to online extremist activity. It found that while there were a number of relevant work streams underway, there was no common approach. The extent to which coordination was occurring was questioned. The stocktake was provided to the Counter-Terrorism Coordination Committee. It was asked to consider whether:

  1. additional operational or strategic coordination was needed;
  2. there was merit in clarifying the approach to online extremism; and
  3. additional investment was needed.

14

The Counter-Terrorism Coordination Committee decided that the Specialist Coordinator and the National Assessments Bureau analyst would meet with agencies individually to discuss their views directly. We are not aware of any of the matters proposed for consideration by the Counter-Terrorism Coordination Committee being progressed further before 15 March 2019. Nor was the stocktake considered by the Security and Intelligence Board.

 

New Zealand Security Intelligence Service

15

The New Zealand Security Intelligence Service’s development of covert online capability and strengthening of its open-source collection capability were two of six areas for growth identified in its 2018 Performance Improvement Framework self-review. This self-review followed up on the 2014 Performance Improvement Framework review of the New Zealand Intelligence Community.151

16

The 2019 Arotake Review described these capabilities, as at 15 March 2019, as “fragile”.152 There was one full-time analyst working on open source research and monitoring, with a further officer available to bolster capacity when necessary. Security constraints meant that other officers had limited suitable internet access, which was described in the review as “inadequate to replicate the techniques of the open-source team”.153

17

In early 2018, the covert team consisted of one full-time equivalent made up of two part-time officers. Both officers left in mid-2018. While new staff were recruited, they required training and on-the-job experience before they could confidently undertake their role as required.154

18

The 2019 Arotake Review recommended that consideration be given to increasing resources to achieve the capacity and capability required to maintain ongoing operations and expand into additional thematic areas. It noted that the nature of online operations often requires high levels of staff availability (for example, staff may need to be interacting online outside of normal working hours), along with judgement and a high level of understanding of the digital environment.155 The 2019 Arotake Review concluded that the New Zealand Security Intelligence Service lacked capacity to fulfil many of its open-source requirements, but did not consider a substantial increase in the team was required. Rather, a better solution was for more suitable equipment to be made available to other teams (including investigators). This would enable more inquiries to be carried out elsewhere in the organisation and free up the specialists to undertake more complex inquiries.156

19

The New Zealand Security Intelligence Service now has a similar proportion of resources dedicated to online human intelligence activity as its international partners. But a senior manager at the New Zealand Security Intelligence Service accepted this had not happened early enough. Online capability and capacity were not included in the funding from the Strategic Capability and Resourcing Review. To build them has required the diversion of resources from elsewhere.

 

Government Communications Security Bureau

20

The Government Communications Security Bureau also has a relatively small internet operations team with capabilities, which it describes as “a small focus area but a growing one”. The team uses specialised tools and tradecraft and has been careful to ensure their work complements that of the New Zealand Security Intelligence Service. It provides technical tradecraft advice to other agencies. For example, it provides technical support and advice to the New Zealand Security Intelligence Service’s online operations team. Its standing work programme does not include counter-terrorism activities.

 

New Zealand Police

21

While New Zealand Police undertook online collection of intelligence, we were told by former and current officials that there had been very little in the way of training. There were few tools to assist New Zealand Police intelligence analysts to exploit social media. They considered that there are significant opportunities to improve New Zealand Police’s intelligence collection through these means.

 

Department of Internal Affairs

22

The Department of Internal Affairs’ Digital Safety Directorate is the lead agency in combatting objectionable material under the Films, Videos, Publications Classification Act. See Part 9: Social cohesion and embracing diversity for more on the Department of Internal Affairs’ role.

 

10.4 Developments since 15 March 2019

23

We have seen Public sector agencies moving to increase online capability and capacity since 15 March 2019.

24

We understand that work is underway that will eventually provide adequate and more broadly available internet access across the New Zealand Security Intelligence Service. Some of the additional funding received in Budget 2019 was allocated to this.157

25

The New Zealand Security Intelligence Service told us that its online operations capability is growing. The Online Operations team is to recruit some additional people. As noted the New Zealand Security Intelligence Service now has a similar proportion of resources dedicated to online human intelligence activity as its international partners.

26

New Zealand Police have now established a dedicated team. They have purchased a specialised tool that enables rapid extraction of information from the internet, including the dark web. The tool identifies connections between people, events and locations online. There has recently been a secondment of an experienced officer to the New Zealand Police to assist with the establishment of its team.

27

New Zealand Police are also trying to build capability within the National Security Investigation Team to undertake online operations, including by sending investigators to training courses run by the Australia New Zealand Counter-Terrorism Committee. They are seeking additional funding to build their capability and capacity to respond to national security concerns, including their online scanning capability and online operations.

28

In October 2019, the Prime Minister, Rt Hon Jacinda Ardern, and the Minister of Internal Affairs, Hon Tracey Martin, announced that the Department of Internal Affairs would receive an additional $17 million over four years. This funding was in response to the 15 March 2019 terrorist attack and subsequent developments on the Christchurch Call. The new funding will boost the Department of Internal Affairs’ investigative, forensic, intelligence and prevention work in relation to violent extremist and terrorist content online.

29

On 2 June 2020, Cabinet agreed in principle to New Zealand’s accession to the Council of Europe Convention on Cybercrime (the Budapest Convention) and to consult publicly to inform a further Cabinet decision. The Convention is the first, and currently only, treaty specifically seeking to address internet and computer crime. Accession to the Budapest Convention would assist New Zealand to initiate or strengthen relationships with member countries by signalling New Zealand’s commitment to multilateral efforts to combat cybercrime. By providing a standardised framework for cooperation through aligned national cybercrime laws, the Convention facilitates cooperation on criminal investigations of cybercrime and wider crimes involving electronic evidence, for example private social media communications relating to a crime and stored in the cloud by companies such as Facebook.158

 

11.5 A whole-of-system perspective

30

There are now at least four different Public sector agencies (that is the Department of Internal Affairs, the Government Communications Security Bureau, New Zealand Police and the New Zealand Security Intelligence Service) undertaking online activities in relation to extremist activity online. Each has a different mandate. Different mandates might translate to differing objectives at an operational level. For example, Public sector agencies with an enforcement function in relation to offensive material online may seek to promptly shut down offending online accounts. On the other hand, intelligence and security agencies may seek to prolong online engagement with those expressing extremist and violent views in order to collect information on their intent and capability. While it is important to recognise the different mandates, this should not prevent the coordination of building capability to undertake online activities. There is a need to coordinate across these mandates to avoid duplication of effort, ensure efficient use of resources and to remain alert to any potential conflict of objectives.

31

While we have been largely concerned with coordination of capability and capacity building across Public sector agencies in this chapter, coordination of operational activity will be equally important in the future.

32

The recent expansion of capability and capacity to operate online in relation to terrorism and violent extremism has occurred without centralised coordination or consideration of the issues from a whole-of-system perspective.

33

To the extent there is leadership and coordination in this area, it is not being driven by the Department of the Prime Minister and Cabinet as lead agency and coordinator of the national security system. New Zealand Police and the New Zealand Security Intelligence Service have both expressed a desire for agencies to work collaboratively on how extremism is tackled online and in the development of shared complementary capabilities. Both have proposed models for multi-agency collaboration, including co-location. As well, the Government Communications Security Bureau has made efforts to work with other agencies to avoid duplication of effort. This is a good example of agencies within a small system working together to get the best return for New Zealand from limited resources.

34

Greater central oversight and coordination of resourcing and work across the different agencies is critical. Any further developments or growth should be supported by policy work. This will provide clarity on the roles and objectives of agencies and the legal parameters within which they operate. Operational protocols will be required to prevent conflicts.

 

11.6 Concluding comments

35

Our review of the online capabilities in the counter-terrorism effort has shown that the significance of online activity has been apparent for some time. Before 15 March 2019, limited resource was dedicated to developing adequate online capability across the relevant Public sector agencies. This was in part a consequence of the absence of a horizon scanning function (see Part 8, chapter 4).

36

There are commonalities of effort between New Zealand Police and the New Zealand Security Intelligence Service. The Department of Internal Affairs (in relation to objectionable material) and the Government Communications Security Bureau have complementary roles and capabilities. Coordination of the development of online capability is therefore sensible. Such coordination was not evident in relation to new funding approved for the Department of Internal Affairs to develop online capability in Budget 2019.

37

Since 15 March 2019, there has been little system-wide leadership and cross-agency coordination in developing policy and building and harnessing capability. Coordinated development and deployment of online capability are critical. When that capability is developed, leadership and coordination of operational activity will remain a key issue. In addition, it will be important not only to accede to the Budapest Convention but also develop a clear and shared understanding between Public sector agencies of the legal and policy settings, and the social licence for online intelligence collection.

 

 

149. Government Communications Security Bureau, footnote 102 above.

150. Government Communications Security Bureau, footnote 102 above.

151. New Zealand Security Intelligence Service Performance Improvement Framework: Follow-up Self Review of the New Zealand Security Intelligence Service Te Pa Whakamarumaru (March 2018) at page 24; Performance Improvement Framework, footnote 42 above.

152. New Zealand Security Intelligence Service, footnote 57 above at page 127.

153. New Zealand Security Intelligence Service, footnote 57 above at page 62.

154. New Zealand Security Intelligence Service, footnote 57 above at page 63.

155. New Zealand Security Intelligence Service, footnote 57 above at page 127.

156. New Zealand Security Intelligence Service, footnote 57 above at page 61.

157. New Zealand Security Intelligence Service, footnote 57 above at page 127.

158. Department of the Prime Minister and Cabinet and Ministry of Justice Budapest Convention on Cybercrime: Approval to Initiate the First Stage Towards Accession (2020) https://dpmc.govt.nz/sites/default/files/2020-09/SWC-20-SUB-0053-budapest-convention-on-cybercrime.pdf.