12.1 Overview

1

In this chapter we look at the relationship between the counter-terrorism agencies – New Zealand Police (see Part 8, chapter 6) and the New Zealand Security Intelligence Service (see Part 8, chapter 5). The quality of the counter-terrorism agencies’ relationship is fundamental to New Zealand’s counter-terrorism efforts.

2

We heard from international experts that an effective relationship between New Zealand Police and the New Zealand Security Intelligence Service is critical to a successful counter-terrorism effort. They advised us to look closely at it.

3

In this chapter we:

  1. describe the different functions, resources and powers of the counter-terrorism agencies;
  2. examine the state of the relationship between the counter-terrorism agencies;
  3. discuss positive aspects of the relationship before 15 March 2019; and
  4. describe the challenges that remain.

 

12.2 The different functions, resources and powers of the counter-terrorism agencies

4

The counter-terrorism agencies have complementary functions, powers and capabilities. Broadly, in the counter-terrorism effort, the New Zealand Security Intelligence Service’s role is to identify potential terrorists and then collect and report intelligence on them. Its functions specifically do not include law enforcement. New Zealand Police have national security intelligence functions but their primary counter-terrorism role is to prevent terrorist activities, and – where they have occurred – to respond, investigate and prosecute the offenders.

5

Reflecting their different functions, the two agencies must meet different thresholds to seek warrants to gather further information on potential terrorists. For a New Zealand Police search warrant to be issued, there must be reasonable grounds to suspect a criminal offence punishable by imprisonment and to believe that the search will find evidential material related to the offence.159 Similar grounds must be made out for a surveillance device warrant.160 For the New Zealand Security Intelligence Service to obtain an intelligence warrant, it must show that that the activity it wishes to carry out (for instance search or surveillance) would contribute to the protection of national security by identifying, enabling the assessment of or protecting against terrorism or violent extremism.161 It must also show that the proposed activity is necessary and proportionate for the purposes for which the warrant is sought.162 Intelligence warrants can therefore be more forward looking and directed at understanding amorphous and often unknown targets, compared to New Zealand Police warrants, which are used for known targets, and past and current offending.

6

It makes sense for the counter-terrorism agencies to work closely together to pool their limited capacity and capability. Because the intelligence and security agencies in New Zealand do not have law enforcement powers, they need an enforcement agency like New Zealand Police to take action against potential terrorist threats. The intelligence and security agencies also benefit from the broad networks New Zealand Police have and the information they obtain from this. Conversely, the intelligence and security agencies can undertake activities that New Zealand Police cannot, and New Zealand Police often need the intelligence collected through these activities to fully understand the risks posed by subjects of interest.

7

Both New Zealand Police and the New Zealand Security Intelligence Service can and do collect information and produce intelligence on terrorism threats in New Zealand. New Zealand Police’s presence throughout New Zealand and broad range of activities and connections in communities provide them with an enormous amount of information. Both have international relationships that provide them with valuable additional sources of information.

8

It is not an easy relationship, as tensions between the functions and organisational cultures of the two types of agency require constant management. International practitioners advised us that a great deal of effort is required to ensure collaboration and communications between counter-terrorism agencies. They described that as a difficult, often uncomfortable, process. They offered some consistent advice about practices that can support these efforts:

  1. Co-location, which builds trust and assists staff within each agency to understand and appreciate both agencies’ respective roles and responsibilities, and how to best use their respective skills and experience.
  2. A joint leads process, which provides for the agencies to jointly assess the risk associated with lead information and then determine what level and type of resources each allocates to assess and manage that risk. It also supports better information sharing by ensuring agencies’ respective information sources are brought together. For example, an international expert told us that in the United Kingdom, over half of the Security Service’s leads come from the police and having a joint leads process ensures this information is promptly shared.
  3. A joint operations protocol, which provides a clear framework for decision-making during an investigation, including which agency leads. It ensures that respective roles and responsibilities are clear and that each agency can contribute its specialist skills and information (for example, in intelligence and security agency-led investigations, police are involved early so intelligence collected can be used evidentially). It can also provide guidance on whether to extend an operation or bring it to a close, which can mitigate tensions between the agencies.
  4. Joint training and secondments, which help the agencies to understand each other’s capabilities and constraints.

9

International practitioners also told us that the importance of the relationship means that agencies leading the counter-terrorism effort should monitor the progress of the relationship and support the intelligence and law enforcement agencies to work in a more integrated way.

 

12.3 The state of the relationship between the counter-terrorism agencies

10

A clear message we received during our inquiry was that, as recently as 2015, the relationship between the two counter-terrorism agencies was not functioning effectively. Internal New Zealand Police reviews conducted in 2011 and 2015 found that the varying expectations, attitudes and organisational cultures between the two agencies inhibited collaboration.163 There was no formal framework to guide and facilitate cooperation and coordination between the two agencies, which “resulted in restricted access to crucial intelligence and placed operation[al] relationships and effectiveness under strain”.164

11

We were advised that, around 2015, there were high levels of mutual mistrust between the agencies. There were indications that the New Zealand Security Intelligence Service would not share information at that time with New Zealand Police staff, whom they perceived could not be trusted to securely hold highly classified information. Equally, we heard from some New Zealand Police staff that there had been a high level of resistance from New Zealand Security Intelligence Service staff to sharing information with them, and that they were not receiving information they needed to know.

12

The relationship has improved since then. Rebecca Kitteridge, the Director-General of Security, and Mike Bush, former New Zealand Police Commissioner, both described building the relationship between the two agencies over the last five years as a priority for them. This viewpoint was consistent with what we heard from staff in both agencies. While acknowledging that the relationship was not perfect or necessarily where they would want it to be, all of these individuals told us about the effort they and others had made to strengthen the relationship and how important it was for them to work together. The 2019 Arotake Review confirmed that the relationship between the two agencies had improved in recent years and was much more productive. However, it also acknowledged that the two agencies continued to experience technical and cultural barriers that prevented them from operating in “a truly joint fashion”.165

 

12.4 Positive aspects of the relationship before 15 March 2019

13

New Zealand Police and the New Zealand Security Intelligence Service noted a number of positive developments had occurred that helped improve the relationship between the two agencies.

 

Joint governance

14

The two agencies have created a three-tiered joint governance framework to drive cooperation:

  1. External Relationship Group – the executive level group that manages the relationship between the agencies and is intended to identify capability gaps that will impact on both agencies managing counter-terrorism risk. The two agencies created a Relationship Strategy in 2016, which is managed by this group. The External Relationship Group is attended by a New Zealand Police Deputy Commissioner and the Director-General of Security.166
  2. Joint Management Committee – maintains strategic oversight of cooperation between the two agencies on counter-terrorism operations and investigations. It includes the heads of counter-terrorism from New Zealand Police and the New Zealand Security Intelligence Service.
  3. Operation Coordination Groups – these manage tactical operations and provide the key mechanism for coordinating decision-making and effort.

 

Joint mechanisms and formal processes

15

New Zealand Police and the New Zealand Security Intelligence Service have created joint mechanisms to coordinate management of leads and investigations167 to enhance agency interoperability:

  1. Joint leads process – the New Zealand Security Intelligence Service hosts a fortnightly Combined Counter-Terrorism Investigations and Leads Meeting (the Joint Leads Meeting) attended by the Department of Corrections, Immigration New Zealand, New Zealand Customs Service, New Zealand Police and (since September 2019) the Government Communications Security Bureau. Agencies bring leads they have, and the other agencies can look across their own data holdings to provide further intelligence on the lead. We heard a range of conflicting views from individuals in the counter-terrorism agencies about whether decisions on which agency leads an operation occur at this meeting or outside it.
  2. Joint operations protocol – this governs the counter-terrorism agencies’ joint investigative and operational activity and sets out the process for establishing a joint operation.

 

Co-location

16

Since 2018, New Zealand Police and the New Zealand Security Intelligence Service have worked in the same secure facility in Auckland. Co-location is acknowledged within both agencies as a positive step that is helping to break down organisational culture barriers, build trust and enhance information sharing. Both agencies spoke about co-location as providing the opportunity for free and frank conversations needed to cooperate successfully. They were hopeful that co-location of the counter-terrorism agencies would progressively increase nationally.

 

Joint training and secondments

17

Some joint training has occurred between the counter-terrorism agencies in New Zealand. According to a senior official from New Zealand Police this assists in breaking down organisational culture barriers and provides both agencies with insights into how the other operates.

 

12.5 The challenges that remain

A shared vision and plan to meet the challenges

18

We heard from international practitioners that formal mechanisms and milestones are required to drive cooperation. With deliberate planning in place, the inevitable points of contention can be diagnosed and resolved early and purposefully.

19

The counter-terrorism agencies have a high-level vision of what the relationship could be – one in which they would not just share information but also work together cohesively as a team. But currently there is not a joint strategy (and associated planning) to ensure the relationship progresses in a purposeful way and at an acceptable pace towards agreed outcomes.

20

The counter-terrorism agencies have had a Relationship Strategy in place since 2016. This contains a high-level rationale and description of work streams, but lacks specific detail of how its aims will be achieved, by when, and how they will be measured. It is discussed regularly at the External Relationship Group. Although there was a high level of goodwill evident in these discussions, we did not see discussion of timeframes or follow-up on how the agencies were tracking against their work. There was also no evidence of discussions about the risks a more integrated way of working could present and how these would be mitigated.

21

We were told that the plan for developing the relationship was to let it grow “organically”. What we heard and saw is that the good relationship between New Zealand Police and the New Zealand Security Intelligence was heavily reliant on personal relationships.168 This dependency on personalities creates a risk.169

22

The Auckland co-location is a specific example of the lack of detailed planning within the relationship. While there was a Heads of Agreement governing the co-location, this did not constitute a robust project plan with agreed outcomes or a monitoring and evaluation plan. We heard that senior decision makers reviewed the outcomes of the co-location, but the lessons from the process were not captured and assessed (at least in written format) for a wider national roll-out, despite there being a significant potential benefit that could be derived if it proves successful and a corresponding cost to national security if it fails.

23

The Department of the Prime Minister and Cabinet does not see its leadership role of the national security system as extending to the relationship between New Zealand Police and the New Zealand Security Intelligence Service or helping if roadblocks arise. We discuss the role of the Department of the Prime Minister and Cabinet in the counter-terrorism effort in Part 8, chapter 3.

 

Understanding of each other’s functions

24

The 9/11 Commission Report described counter-terrorism agencies working jointly as involving a step beyond cooperation, where agencies do not just seek assistance from the other, but rather jointly define problems and options for action.170

25

Before 15 March 2019, New Zealand Police and the New Zealand Security Intelligence Service did not have shared definitions of either what constituted right-wing extremism or what would meet the threshold to be prioritised for investigation. As explained in Part 8, chapter 6, New Zealand Police had been monitoring extreme right-wing groups up until 2015. They told us that they did not provide reporting to the New Zealand Security Intelligence Service until the New Zealand Security Intelligence Service initiated a meeting on right-wing extremism in December 2018. This was because they did not think that the New Zealand Security Intelligence Service had an interest in, or mandate to, examine the extreme right-wing. The fact that New Zealand Police did not create a list of extreme right-wing individuals of concern until after 15 March 2019 (see Part 8, chapter 6) meant that this information had not been shared with the New Zealand Security Intelligence Service, and thus did not inform its baselining project on the extreme right-wing in New Zealand which commenced in May 2018 (see Part 8, chapter 5).

26

Because the counter-terrorism agencies did not discuss the threat posed by the extreme right-wing until late 2018, they had not by 15 March 2019 developed a joint understanding of the extreme right-wing in New Zealand and were still developing a shared understanding of each other’s functions relating to it. Since 15 March 2019, the two agencies have developed a shared definition of what constitutes right-wing extremism.

27

We observed that the New Zealand Security Intelligence Service had a comparatively narrow view of New Zealand Police’s functions and capability. This can be illustrated by reference to the individual and the Barry Harry Tarry comments.

28

We asked the New Zealand Security Intelligence Service what it would have done if the individual’s posts on The Lads Society Season Two Facebook page using the Barry Harry Tarry username (see Part 4: The terrorist and Part 6, chapter 4) had come to its attention. The New Zealand Security Intelligence Service told us that it would have:

  1. assessed the posts as not threatening violence and with a marginal connection to national security;
  2. seen the posts as relevant to its baselining project on domestic right-wing extremism (see Part 8, chapter 5) and opened a low priority lead; and
  3. regarded a lead of this nature as primarily a security intelligence discovery effort, which would fall within its function and mandate.

29

While the New Zealand Security Intelligence Service noted that it would have shared the lead in the Joint Leads Meeting, it considered this was not the type of lead New Zealand Police would be interested in because there were no indicators of a crime having been committed or a stated intent to undertake violence.

30

We asked a senior New Zealand Police counter-terrorism officer the same question – what they would have done if the individual’s posts on The Lads Society Season Two Facebook page using the Barry Harry Tarry username had come to their attention. They said they would have seen the posts as posing limited risk due to the absence of an explicit threat. However, they highlighted concerns about the language used in the posts (including some that we have not reproduced in this report), which they said demonstrated deeply entrenched views and ideological links with the global extreme right-wing movement. New Zealand Police would have recorded this information in the National Intelligence Application, so that if further information about Barry Harry Tarry came to hand, they would be able to build a better intelligence picture. New Zealand Police would thus have been interested in this lead for their own intelligence gathering activities and to stay alert to signs indicating violent extremism.

31

The senior New Zealand Police counter-terrorism officer also noted that while the New Zealand Security Intelligence Service leads in intelligence collection and New Zealand Police lead in evidence collection, this division of roles does not necessarily dictate which agency has primacy in acting on lead information received. Rather, whoever receives the information usually takes the lead. We were told that if New Zealand Police had received the Barry Harry Tarry posts, they would likely have taken the lead in collecting information even though there were no crime indicators or imminent threat present.

32

As this discussion illustrates, New Zealand Police and the New Zealand Security Intelligence Service have different views of the former’s counter-terrorism intelligence role.

33

As discussed in Part 7: Detecting a potential terrorist, the general tenor of what we were told by the counter-terrorism agencies is that they would probably not have made inquiries at the gym to identify Barry Harry Tarry. In the case of New Zealand Police, the decision whether to make such inquiries would have been influenced by how many of the individual’s other posts had also come to light.

 

Information sharing practices

34

Both New Zealand Police and the New Zealand Security Intelligence Service have extensive information holdings that are relevant to New Zealand’s counter-terrorism effort. Neither has access to the other’s holdings. The New Zealand Security Intelligence Service needs to protect its sources of information, including information from international partners. Conversely, if the New Zealand Security Intelligence Service had uncontrolled access to New Zealand Police’s databases, this would likely present a risk to New Zealand Police’s relationship with the public. This absence of direct access means that information is only shared where there is a conscious decision to do so.

35

The Intelligence and Security Act 2017 (see Part 8, chapter 14) allows the New Zealand Security Intelligence Service to create direct access agreements with New Zealand Police to access information related to financial intelligence and about people and locations that pose a physical threat to employees of the New Zealand Security Intelligence Service or the Government Communications Security Bureau. The New Zealand Security Intelligence Service and New Zealand Police have not yet established a direct access agreement.

36

We heard from the counter-terrorism agencies that information flows between them had improved following the creation of an information sharing protocol, but that frustrations continued in some areas, such as the declassification and sanitisation of information by the New Zealand Security Intelligence Service. Some New Zealand Police staff remained frustrated that the New Zealand Security Intelligence Service does not make enough of an effort to provide declassified or sanitised information. This means that New Zealand Police, who primarily operate in an unclassified environment, cannot share information around their organisation. The limited number of secure facilities available to New Zealand Police and limited number of cleared New Zealand Police staff also act as barriers to information sharing (see Part 8, chapter 9).

37

A key challenge for New Zealand Police is that there is no established legal or practice framework that allows the effective use of classified information in the legal process.171 Individuals from the counter-terrorism agencies worked with the courts to create a workaround which allowed for classified information to be used in support of an application for a search or surveillance warrant.

38

New Zealand Security Intelligence Service staff interviewed considered that they shared all relevant and necessary information even where they had to seek permission from an international partner agency first. While New Zealand Police staff understood that the New Zealand Security Intelligence Service was not able to share all information, some still perceived that relevant and necessary information was held back or unduly filtered.

39

It was evident to us during interviews that when it came to information sharing there was a disconnect in how New Zealand Police and New Zealand Security Intelligence Service staff view the current arrangements. There are still high levels of mistrust on the part of some New Zealand Police staff, of which the New Zealand Security Intelligence Service appeared to be largely unaware. Senior officials from both agencies told us that frank conversations were being held. However, the ongoing mistrust we have referred to suggests to us these conversations have not resolved these tensions.

 

Joint leads process

40

New Zealand Police and the New Zealand Security Intelligence Service have the frameworks in place to work jointly. But the evidence presented to us suggests that these may not be providing sufficient guidance for the two agencies to work in a truly joint way.

41

Before 15 March 2019, the two agencies did not have a shared approach to assessing risk. They did not have a standardised set of criteria for triaging, assessing and prioritising leads, and they may have been applying different approaches to risk assessment.

42

After 15 March 2019, the New Zealand Security Intelligence Service adopted the Australia Security Intelligence Organisation leads triage and assessment framework. The New Zealand Security Intelligence Service’s position is that the two agencies jointly decided to use this framework to ensure they have a consistent approach to assessing risk. However, we understand this was suggested by the New Zealand Security Intelligence Service after it had already made the decision to adopt the framework. New Zealand Police’s position is that they were not aware of being involved in any decision to jointly use the Australia Security Intelligence Organisation framework. New Zealand Police note they continue to use the Australia New Zealand Counter-Terrorism Committee framework, which is very similar.

43

Before 15 March 2019 the counter-terrorism agencies did not have a shared platform to enter and manage leads. Instead, they compared their respective lists at the fortnightly Joint Leads Meeting. It was not always made clear which agency had been assigned specific actions, and the progress was not always recorded or jointly visible. Most interviewees acknowledged that the absence of a centralised record of a joint list created a risk that information would be missed.

44

In February 2020 the two agencies rectified this by implementing technology that supports the joint leads process.

 

Roles in joint investigations and operations

45

From international experience, we have seen there needs to be clear division of labour and mechanisms to decide who is leading an investigation or operation if law enforcement and intelligence and security agencies are to work effectively together. The formal mechanisms New Zealand Police and the New Zealand Security Intelligence Service have in place to guide their joint decisions on investigations and operations are the joint leads process and joint operations protocol.

46

As far as we can tell, there have not been issues between New Zealand Police and the New Zealand Security Intelligence Service with making decisions on when to move from an intelligence operation to executive action (which is sometime an issue for similar agencies in other countries). Instead, both New Zealand Police and the New Zealand Security Intelligence Service expressed frustration about what they saw as New Zealand Police’s inability to take action due to the lack of precursor terrorism offences in the Terrorism Suppression Act 2002. We discuss this further in the next chapter.

47

There was not a clear and consistent understanding between New Zealand Police and the New Zealand Security Intelligence Service about how decisions are made about their joint activities, including when the decision is made about how investigations will be led and when joint activity will be pursued. We heard from some interviewees that this decision can occur in the Joint Leads Meeting. Others said that these decisions only happen in the Operational Coordination Groups. According to New Zealand Police staff, the decision to undertake a joint operation was “never that clean” and the joint operations protocol did not provide much guidance on this. The lack of clarity can result in some duplication of effort, for example where an agency may start collecting information on a lead without liaising with the other.

48

We were told that separate investigation plans and warrants may be necessary in relation to the same individual due to the different mandates and functions of the agencies. But it is important that there is a joint plan guiding these efforts. In theory, Operational Coordination Groups should ensure that investigations are coordinated and appropriate deconfliction occurs. However, from what we heard these groups seemed to be convened to provide coordination when operations were already underway and not to set a plan for joint activity at the outset of an operation. As an example, New Zealand Security Intelligence Service staff told us there had likely been at least one instance where more than one intelligence and security or law enforcement agency were surveilling an individual in the period after the 15 March 2019 terrorist attack. This was at a time when events were unfolding quickly and there were large numbers of new leads.

 

Community engagement practice and impact

49

Both agencies’ counter-terrorism efforts rely on seeking information from members of communities and engaging with communities more generally.

50

Public trust and confidence is critical to the operation of both agencies. In Part 8, chapter 6 we described how New Zealand Police did not always communicate what actions they had taken in ways that provided reassurance to Muslim communities. We observed similar issues in relation to the New Zealand Security Intelligence Service. In some cases, the New Zealand Security Intelligence Service staff and Muslim individuals or communities they engaged with had different understandings of the purpose and expected outcomes of their interactions. This was particularly the case where people had raised concerns about potential threats against them and their communities and expected that action would be taken. The New Zealand Security Intelligence Service staff seemed largely unaware of this expectation.

51

There appears to have been limited discussion on or coordination of how the counter-terrorism agencies undertake community engagement, and manage the impact of their activities as a whole on communities. In some cases New Zealand Police and the New Zealand Security Intelligence Service will be talking to the same individuals and groups in their efforts to build contacts in communities. We heard from individuals and groups that sometimes they are spoken to separately by New Zealand Police and the New Zealand Security Intelligence Service and are unsure as to whether the two agencies are aware of this. Muslim communities have continued to feel that New Zealand Police and the New Zealand Security Intelligence Service’s community engagement efforts are not joined up.

52

There was concern raised by New Zealand Police that in a situation where the two agencies work closely together, negative perceptions that community members may have of the New Zealand Security Intelligence Service could negatively impact on New Zealand Police’s relationships with communities.

53

There has been some discussion of all of this between the counter-terrorism agencies, but there has not yet been agreement to a high-level strategy, nor coordination, of how they undertake community engagement.

 

12.6 Concluding comments

54

The relationship between New Zealand Police and the New Zealand Security Intelligence Service is critical to a well-functioning counter-terrorism effort. The two agencies have made positive progress in developing their relationship. This has been aided by the development of formal mechanisms to better enable the sharing of information and cooperation on investigations.

55

Working jointly requires more than just cooperation. It requires the counter-terrorism agencies to jointly define problems and options for action. Before 15 March 2019 the two agencies were able to assist each other in developing leads and investigations. There was, however, still a tendency for them to work in parallel rather than jointly. For example, they had not developed a shared understanding of the threat of the extreme right-wing, nor developed clear and consistent approaches to joint management of leads and investigations. The future will require a deeper level of integration where both agencies have a shared understanding of the threatscape and what resources and capabilities they are each contributing to the counter-terrorism effort.

56

Despite good progress having been made, there remains a gap between what is considered international best practice, and what is happening in New Zealand. We did not observe sufficient structure and guidance to ensure the counter-terrorism agencies are compelled to push through difficulties. In letting the relationship develop organically the success of the relationship has relied on personal relationships, which risks positive developments being lost as personnel change.

 

 

159. Search and Surveillance Act 2012, section 6.

160. Search and Surveillance Act 2012, section 51.

161. Intelligence and Security Act 2017, section 58.

162. Intelligence and Security Act 2017, section 61.

163. New Zealand Police (2011), footnote 95 above; New Zealand Police (2015), footnote 95 above.

164. New Zealand Police (2015), footnote 95 above.

165. New Zealand Security Intelligence Service, footnote 57 above at page 20.

166. The Government Communications Security Bureau also attends.

167. New Zealand Security Intelligence Service, footnote 57 above at page 20.

168. New Zealand Security Intelligence Service, footnote 57 above at page 61.

169. New Zealand Security Intelligence Service, footnote 57 above at page 61.

170. The 9/11 Commission Report, footnote 81 above.

171. New Zealand Law Commission National Security Information in Proceedings (May 2015) at page 29.