10.1 Overview

1

The terrorist attack on 15 March 2019 was carried out by an individual whose violent intentions were previously unknown to New Zealand’s Public sector agencies (see Part 6: What Public sector agencies knew about the terrorist). He was motivated by an ideology (right-wing extremism) that had not been the subject of deliberate intelligence collection or analysis by the Public sector agencies involved in the counter-terrorism effort until mid-2018. So, at the time of the terrorist attack, these agencies had a limited understanding of right-wing extremism and the terrorism threat and risk it presented to New Zealand

2

In this chapter we:

  1. explain what target discovery is;
  2. discuss how strategic intelligence assessments can guide target discovery;
  3. assess the New Zealand Security Intelligence Service’s target discovery efforts;
  4. assess the Government Communications Security Bureau’s target discovery efforts; and
  5. discuss whether the authorising environment enables the intelligence and security agencies to undertake target discovery.

 

10.2 What is target discovery?

3

When we talk about target discovery, we mean both:

  1. identifying previously unknown terrorism threats (people, groups or networks) motivated by a well-understood, known ideology; and
  2. identifying previously unknown terrorism threats (people, groups or networks) motivated by an unknown ideology – one that is not well understood. This process necessarily includes strategic intelligence assessment (including horizon scanning) to identify and better understand the new ideology.

4

Target discovery is a proactive, exploratory effort to generate and investigate leads. Investigation of these leads can help to identify previously unknown, specific subjects of interest. This helps to gain a deeper understanding of not only the threat, but also the risk. The objective is to enable Reduction and Readiness activities for that threat before it crystallises.

5

Target discovery may involve analysing data and information already collected and stored by Public sector agencies (or international partners). It may also entail sourcing new data and information. This could be through intelligence gathering online, collection of large data sets or observation of public events. The data collected can then be used to test hypotheses about existing or emerging trends.

6

A useful contrast to target discovery is the "classical model" of investigation (see Part 8, chapter 5). The classical model begins with lead information, which can come from a range of domestic or international sources. The classical model “is not well configured for discovery of new leads and, where it does, these tend to be within the same [ideological] area”. In this sense it is geared towards responding to known threats.146

 

10.3 Strategic intelligence assessments

7

Strategic intelligence assessments scan the global terrorism environment for emerging threats and assess these for potential impact. International intelligence and security agencies use strategic intelligence assessments to guide decisions on where to focus their target discovery resources.

8

In the years before 15 March 2019, the National Assessments Bureau and the Combined Threat Assessment Group produced limited numbers of strategic intelligence assessments on the domestic terrorism threatscape (see Part 8, chapter 4).

 

10.4 The New Zealand Security Intelligence Service’s target discovery efforts

9

In July 2018, the Counter-Terrorism Unit produced a Counter-Terrorism Discovery Strategy “to establish a baseline picture of emerging terrorism threats to New Zealand … with the objective of understanding the New Zealand baseline picture based on our current holdings, the development of information requirements and outreach opportunities”.

10

Part of this work was the baselining project on right-wing extremism in New Zealand, which we have discussed in Part 8, chapter 5. In the course of this project, the New Zealand Security Intelligence Service’s online operations team also began to look at right-wing forums.147 The project generated ten leads relevant to right-wing extremism, some of which remained open at 15 March 2019.

11

The 2019 Arotake Review described the Counter-Terrorism Discovery Strategy as “basic but sufficient”, noting that it provided a framework for proposing, authorising and recording discovery projects.148

12

Since 15 March 2019, the New Zealand Security Intelligence Service has refreshed its Counter-Terrorism Discovery Strategy. It has also dedicated specific resources to a counter-terrorism discovery team. Staff are seconded into that team from other teams on a rotating basis.

13

In addition, the New Zealand Security Intelligence Service has established a discovery collaboration group that meets monthly. That group includes discovery investigators and managers, as well as information exploitation analysts, telecommunications experts, strategic analysts and targeting and other relevant officers from within the New Zealand Security Intelligence Service. Counter-terrorism analysts from the Government Communications Security Bureau regularly participate in the discovery collaboration group, and intend to continue to do so.

 

10.5 The Government Communications Security Bureau’s target discovery efforts

14

The Government Communications Security Bureau acts when tasked by the New Zealand Security Intelligence Service – its primary customer – and only when given a lead (see Part 8, chapter 7). The result of this position has been that, at least since 2016, the organisation has carried out limited domestic counter-terrorism target discovery. It has largely been involved in collecting intelligence on known terrorism risks motivated by a known ideology rather than discovering previously unknown terrorism risks motivated by an unknown ideology. The Government Communications Security Bureau’s activities in relation to the domestic counter-terrorism effort have been shaped – inevitably – by the focus of the New Zealand Security Intelligence Service on known Islamist extremist risks.

15

In June 2019 the Government Communications Security Bureau staff participated in a target discovery week with the New Zealand Security Intelligence Service to “identify a framework to better inform joint discovery projects”. The team proposed the establishment of a shared database combining lists of known behaviours and indicators of violent extremism and identifiers of those behaviours. The aim was to assist in identifying previously unknown terrorism risks motivated by an unknown ideology.

 

10.6 Does the authorising environment enable target discovery?

16

Target discovery activities that do not require a warrant can include:

  1. collecting publicly available information;
  2. analysis of some internal holdings;
  3. some information requests to domestic or international partner agencies;
  4. observing public events;
  5. engaging with groups of interest; or
  6. directly accessing other agencies’ datasets under agreement.

17

Under section 58 of the Intelligence and Security Act 2017 an intelligence warrant may be sought on the basis that it will enable an intelligence and security agency to carry out an activity that “identifies, enables the assessment of, or protects against any” of a number of harms which include terrorism. This contemplates target discovery.

18

There are aspects of target discovery that may be problematic under the Intelligence and Security Act as it is likely to:

  1. involve activity directed towards groups of people of whom, individually, comparatively few (and perhaps none) will prove to be of national security interest and may involve the collection of large amounts of information of which comparatively little (and perhaps none) will turn out to be of intelligence value. This means that there may be issues whether such activity can be justified as necessary and proportionate; and
  2. include activity directed towards groups of people whose thinking is on the same ideological spectrum as those of terrorists but who, at the time the activity commences, are not known to have expressed support for violence. Such activity is at risk of being seen to contravene section 19 of the Intelligence and Security Act, which provides that the exercise of the right to freedom of expression does not justify activity by an intelligence and security agency.

19

In Part 8, chapter 14, we discuss in more detail how these issues may be addressed under Intelligence and Security Act and do so under the following headings:

  1. Bulk collection and acquisition of data.
  2. Specificity requirements for warrants.
  3. The application of the necessary and proportionate test to actions that do not require a warrant.
  4. The relationships between the Inspector-General of Intelligence and Security and the intelligence and security agencies.
  5. The possible impact of section 19 of the Intelligence and Security Act in limiting target discovery.

20

Since 15 March 2019, the agencies are increasingly pursuing intelligence warrants for the purposes of target discovery. An example is an application to renew a class-based intelligence warrant in October 2019 that picks up on the language of discovery in the Intelligence and Security Act (section 58). It would allow the agency to gather intelligence about New Zealanders who engage in terrorist acts or with links to those who are, or entities whose behaviour indicates they may be of intelligence interest about terrorism or violent extremism. The proposed warrant would authorise the agency to conduct various collection activities to assess whether those covered by the warrant engage in terrorist acts or otherwise have information about threats of terrorism or violent extremism.

21

As we discuss in Part 8, chapter 14 there remain uncertainties as to the extent to which target discovery is appropriate under the Intelligence and Security Act.

 

10.7 Concluding comments

22

Before 15 March 2019, the intelligence and security agencies were engaging in only limited target discovery activity. In part, this was due to resource constraints. The New Zealand Security Intelligence Service was focused on the presenting threat of Islamist extremist terrorism. The classical model of investigation used by the New Zealand Security Intelligence Service was better suited to identifying new individuals and groups with Islamist extremist ideology than identifying new threats outside that well-understood ideology.

23

The New Zealand Security Intelligence Service had identified understanding emerging threats as a priority in its 2016 10-Year Operational Strategy. The baselining project on domestic right-wing extremism in New Zealand, which began in 2018, generated several new leads.

24

After 15 March 2019, the intelligence and security agencies appear to have significantly increased their target discovery activity, and dedicated resources to support this work. We discuss the legal constraints in Part 8, chapter 14.

 

146. New Zealand Security Intelligence Service, footnote 57 above at page 88.

147. New Zealand Security Intelligence Service, footnote 57 above at page 96.

148. New Zealand Security Intelligence Service, footnote 57 above at page 90.