Distressing content:
This section of the report contains material that may be confronting, particularly to those affected by the 15 March 2019 terrorist attack.

2.1 Overview


In this chapter we provide background to the counter-terrorism effort as it has evolved over the last two decades.


In what follows, we:

  1. describe the changing threatscape since 2001 and the impact of these changes on New Zealand;
  2. discuss how the nature of terrorist attacks, and terrorists themselves, have changed and adapted over time;
  3. outline the controversies and other events that have affected Public sector agencies involved in the counter-terrorism effort;
  4. list the reviews of components of the national security system over the last twenty years; and
  5. describe the Strategic Capability and Resourcing Review, which resulted in significant investment to improve the capability and capacity of the New Zealand Intelligence Community over the last four years.


2.2 The changing threatscape

11 September 2001 and the global terrorist threat


The Al Qaeda terrorist attacks against the United States of America on 11 September 2001 transformed the perception of terrorism throughout the world. But terrorism is not a new phenomenon. While there is no universally agreed definition of terrorism,1 it has been part of history since ancient times. Some of the terrorism trends discussed in this and other chapters started well before 2001.2


There is no easy way to track terrorism globally. What is defined and reported as terrorism can vary significantly across countries. In states where there is some form of armed civil conflict it can be difficult to distinguish between terrorism and insurgency (civil wars in Syria and South Sudan are recent examples).3 Even so, there are several credible open-source databases that measure terrorism globally.4 Their data reveals a gradual increase in the frequency of terrorist attacks from 1970–1992, then decline until 2004. From 2014 there has been a dramatic rise in the number of terrorist attacks worldwide. The regions most affected by this sharp increase are South Asia, the Middle East, and North Africa. They collectively account for around 70 percent of terrorist attacks in the past ten years.


Terrorism in Western countries is much less common. In comparatively recent times it has included left-wing terrorism (for example, the Red Brigades in Italy in the 1970s), nationalist or separatist terrorism (for example, Northern Ireland in the 1970s and 1980s) and extreme right-wing terrorism (for example, the Oklahoma City bombing in 1995). And before 11 September 2001 there were examples of Islamist extremist terrorism against Western targets, such as the 1993 bombing of the World Trade Center.


The attacks on 11 September 2001 were a “watershed” terrorist event. The response to the terrorist attacks of that day significantly affected the global security environment.5 Considerable international attention and effort was focused on Islamist extremism and states that were thought to finance and harbour terrorists. Shortly after the attacks, the United States of America commenced its twenty year “War on Terror”, fought predominantly in Afghanistan and Iraq.


After 11 September 2001, countries around the world reallocated significant resources to counter-terrorism, both international and domestic. Terrorism became a conspicuous feature of the international security environment. The United Nations, which had previously engaged with terrorism only tentatively, acted swiftly. The United Nations Security Council adopted Resolution 1373, which imposed a number of binding obligations on states, including tighter border controls and called for enhanced international cooperation against terrorism. This Resolution underpins the global legal framework for the prevention and suppression of terrorism.6


The events of 11 September 2001 were followed by other terrorist attacks, some of which were not undertaken by Islamist extremists. The list below is not exhaustive, and focuses on terrorist attacks that would have been of particular interest to intelligence and security agencies in the West. We recognise that terrorist attacks have been far more numerous in Africa, the Middle East and South Asia. Relevant for our purposes, the terrorist attacks listed below were formative in shaping the security arrangements of Five Eyes countries, including New Zealand.


Table 9: Terrorist attacks since 11 September 2001 that shaped Five Eyes countries’ security arrangements

12 October 2002

Bombings in Bali, Indonesia

202 people killed, including 2 New Zealanders

11 March 2004

Bombings in Madrid, Spain

193 people killed

7 July 2005

Bombings on the London underground and bus transport network in London, United Kingdom

52 people killed, including 1 New Zealander

11 July 2006

Bombings of trains in Mumbai, India

209 people killed

27 July 2008

Bombing in Istanbul, Turkey

17 people killed

5 November 2009

Mass shooting at Fort Hood, Texas, United States of America

13 people killed

22 July 2011

Bombing in Oslo and mass shooting on Utøya Island, Norway  

77 people killed

11 March 2012

Mass shooting in Montauban and Toulouse, France

7 people killed

5 August 2012

Mass shooting at the Sikh Temple in Oak Creek, Wisconsin, United States of America

6 people killed

15 April 2013

Bombings at the Boston marathon, Massachusetts, United States of America

3 people killed

24 May 2014

Mass shooting at the Jewish Museum in Brussels, Belgium

4 people killed

15 December 2014

Hostage taking and shooting at the Lindt Café in Sydney, Australia

2 people killed

7–9 January 2015

Mass shootings in Île-de-France, Paris (including at the Charlie Hebdo office), France

17 people killed

14–15 February 2015

Mass shooting in Copenhagen, Denmark

3 people killed

26 June 2015

Mass shooting at a tourist resort in Sousse, Tunisia

38 people killed

17 July 2015

Mass shooting at the Emanuel African Methodist Episcopal Church in Charleston, South Carolina, United States of America

9 people killed

13–14 November 2015

Bombings and mass shooting in Paris, France

130 people killed

2 December 2015

Mass shooting in San Bernadino, California, United States of America

14 people killed

22 March 2016

Bombing at Brussels airport and subway, Belgium

32 people killed

16 June 2016

Knife attack in Birstall, United Kingdom

1 person killed, Jo Cox – British Member of Parliament

14 July 2016

Vehicle attack in Nice, France

86 people killed

19 December 2016

Vehicle attack at Berlin Christmas market, Germany

12 people killed

29 January 2017

Mass shooting at Quebec City Mosque, Canada

6 people killed

5 March 2017

Vehicle attack at Westminster Bridge, London, United Kingdom

5 people killed

7 April 2017

Vehicle attack in Stockholm, Sweden

4 people killed

3 June 2017

Vehicle and knife attacks at London Bridge and Borough Markets, London, United Kingdom

7 people killed

19 June 2017

Vehicle attack at Finsbury Park Mosque, United Kingdom

1 person killed

17 August 2017

Vehicle and knife attacks in Barcelona and Cambrils, Spain

16 people killed

22 May 2017

Bombing at the Manchester Arena, United Kingdom

22 people killed

23 April 2018

Vehicle attack in Toronto, Canada

10 people killed

27 October 2018

Mass shooting at the Pittsburgh Tree of Life Synagogue, Pennsylvania, United States of America

11 people killed

9 November 2018

Knife attack in Melbourne, Australia

1 person killed



Some of the terrorist attacks referred to above were mass shootings. In many countries – the United States of America in particular – there have been mass shootings that could conceivably have had political motivations but were not considered terrorist attacks as the motivation was not clear. Mass shootings without political motivations can include, for example, school shootings or familicide (the perpetrator killing their family).


In the last two decades, many planned terrorist attacks were disrupted by intelligence and security or law enforcement agencies. For example, between 2014 and 2019, there were 16 major terrorist plots reported as prevented in Australia. And in the two years after the March 2017 Westminster Bridge attack in London, authorities in the United Kingdom disrupted 22 terrorist plots. Not all attacks prevented by authorities are reported, so there are likely to be many more that the public are not aware of.


Table 10: Recent instances of disrupted terrorist attacks

August 2006

United Kingdom police uncovered a terrorist plot to detonate liquid explosives disguised as canned drinks carried on board planes travelling from the United Kingdom to the United States of America and Canada.

September 2009

Eight people affiliated with Al Qaeda were arrested for a plot to bomb the New York City subway system and other targets. 

March 2012

Indonesian police shot dead five people who were plotting to attack and bomb targets in Bali.

August 2016

Australian police arrested a right-wing extremist who had plotted terrorist attacks on Victorian Trades Halls and other “leftist” centres in Melbourne.


New Zealand has not been immune from terrorism or mass shootings in its recent history. In 1985, Greenpeace’s ship the Rainbow Warrior was bombed in a state-led terrorist attack while it was moored in Auckland harbour.


Table 11: Recent mass shootings in New Zealand

13–14 November 1990

Mass shooting in Aramoana, Otago

14 people killed

20 May 1992

Mass shooting in Paerata, Franklin District

7 people killed

20 June 1994

Mass shooting in Dunedin, Otago

5 people killed

8 February 1997

Mass shooting in Raurimu, King Country

6 people killed

Impact of the changing threatscape on New Zealand


The events set out in the tables above had effects on New Zealand. New Zealand recognised that there was a new security environment, to which it needed to respond. It did so in several ways. It contributed to international military operations (in Afghanistan, for example). It strengthened its intelligence and security links with international partner countries. It supported and implemented various United Nations resolutions and conventions related to counter-terrorism.


New Zealand expanded its counter-terrorism effort between 2001 and 2004. Public sector agencies received a total of almost $30 million for initiatives such as extra security at airports and increased intelligence capability for both the New Zealand Security Intelligence Service and New Zealand Police.8 The Terrorism Suppression Act 2002 was enacted quickly. It created specific new terrorist offences and created a terrorist entity designation regime to implement New Zealand’s international obligations. In 2005, the National Counter‑Terrorism Plan was finalised. For many years, that was New Zealand’s principal statement about counter-terrorism, but it was never made available to the public.9 It set out, among other things, the counter-terrorism risk management framework, the counter-terrorism coordination system, and the role of intelligence, threat assessment, strategic assessment and legislation in the counter-terrorism effort. Around the same time a strategic aim for New Zealand’s counter-terrorism effort first appeared in policy documents – that New Zealand is “neither the victim nor the source of an act of terrorism”.10


2.3 The changing nature of terrorist attacks


The international terrorist attacks perpetrated in the 1990s and early 2000s were primarily carried out by groups in terrorist cells. They were often sophisticated, carefully planned well in advance, involved multiple perpetrators and targets and used advanced attack methods, such as explosives. Groups such as Al Qaeda were concerned with “ever-bigger and more dramatic attacks”11 and were discerning about whom they recruited and what targets they chose to attack.12


In the years following 11 September 2001, terrorist methods evolved. For example, suicide terrorist attacks became more prevalent. Such attacks can have a much higher death and injury toll than conventional bombing attacks.13 They coincided with what some experts saw as a move to more indiscriminate terrorist violence against civilian targets. Some experts have drawn a distinction – although it is an oversimplification – between “old terrorism” and “new terrorism”.14 Before 1990, most terrorist groups were left-wing or nationalist or separatist. This “old terrorism” was seen to be more discriminate, with terrorist groups at least sometimes carefully selecting targets that represented the authority they opposed – for example, military or government buildings. The strategy was to limit civilian deaths and injuries, as this would diminish support for their cause.15 By contrast, Al Qaeda wanted maximum publicity through carnage from the 11 September 2001 attacks. Some argue that such widespread targeting of civilians is a feature of “new terrorism”.16


Following the loss of key leaders and safe havens, Al Qaeda’s power and influence fell considerably from its peak in the aftermath of 11 September 2001. Dā’ish emerged from the remains of Al Qaeda’s affiliate in Iraq in 2003–2004. While it faded into obscurity for a period, it re-emerged in 2011 and took advantage of wars in Iraq and Syria to carry out attacks and recruit more followers. Dā’ish achieved global recognition around 2014. At its height, Dā’ish held about a third of the territory in Syria and 40 percent in Iraq.17


As intelligence and security agencies and law enforcement became better at detecting and disrupting large-scale terrorist plots, terrorists turned to smaller-scale, less sophisticated attacks.18 Islamist extremist terrorist groups decentralised and became less discerning about whom to recruit. Groups such as Dā’ish have favoured an approach of “killing as many helpless victims as [they] can in low tech ways”,19 primarily by encouraging lone actors to commit terrorist attacks in their own countries. Such terrorist attacks killed civilians who were enjoying leisure time, perhaps at a concert, a Christmas market or a café. The aim was to instil widespread public fear.


As the list of attacks above demonstrates, Islamist extremist terrorism was not the only terrorist threat in the last two decades. Right-wing extremist terrorism was exemplified by the Oslo terrorist’s attack in 2011. This threat materialised again with the Charleston church shootings of 2015 and the Quebec City Mosque shootings of 2017. All of these attacks were committed by lone actors. The latter two terrorist attacks also demonstrate a tendency of those right-wing extremist terrorists who are hostile to adherents of particular religions or minorities to target their places of worship.


The methods used by the extreme right-wing have some similarities with those used by Islamist extremists. Some aspects of the rhetoric are also comparable, such as threats posed by “foreign” elements undermining a particular way of life and culture, the legitimacy of violence to combat the perceived threat and seeking support and mobilisation across national borders. But, for a long time, right-wing extremism was not seen (and in some countries is still not seen) to be a threat to national and international security in the way that Islamist extremism is. In part this is because people exhibiting right-wing extremism are often not ethnically, socially or culturally distinct from the majority of the population.


The influence of technology


The internet has become a key platform for terrorist radicalisation and recruitment. It has been described as providing a surrogate community where people’s beliefs are developed and reinforced and individuals can become radicalised without a need to establish direct face‑to-face contact. The internet can also act as a training tool and is a place where many potential terrorists can obtain practical information.20 The internet offers a global audience for extremists who wish to spread their views. These trends accelerated as the use of mobile technology proliferated after 2010.


Far right groups were some of the earliest to engage in politics online and to use the internet for political purposes (see Part 2, chapter 5). Recent events have underscored their increasingly pervasive use of the internet, including the upsurge of hateful content online in 2015 and 2016 associated with the 2016 United States of America presidential election, the Brexit referendum, a series of Islamist extremist terrorist attacks and the arrival of large numbers of refugees to Europe from Africa, the Middle East and Central Asia (fleeing war, famine, economic depression and political oppression in their home countries). The far right has exploited the fear and anger generated by Islamist extremist terrorist attacks and the refugee crisis to recruit new followers, usually via the internet.21


Islamist extremists have also been adept at exploiting digital technology. In the early 2000s Al Qaeda identified the “media war” as one of the strongest methods for promoting its organisation’s objectives and it allocated significant resources to this end. But an even more sophisticated use of digital media was pioneered by Dā’ish.22 In 2014, it launched “the most advanced, massive and probably the most efficient cyber jihad campaign ever”.23 Due in part to the effectiveness of its propaganda, Dā’ish has been far more successful than other terrorist groups, such as Al Qaeda, in recruiting individuals within Western nations to its cause – either as foreign terrorist fighters or domestic terrorists.24 At the peak of its media activity in 2014, some fifty thousand pro-Dā’ish accounts were estimated to be active on Twitter.25


Technology has made terrorists hard to detect


Terrorist groups’ use of the internet provides opportunities and challenges for intelligence and security agencies.


There are opportunities to access detailed information remotely about the lives, contacts and plans of potential terrorists. But technology is also creating challenges for intelligence and security and law enforcement agencies. Readily available communications platforms – such as Telegram, Signal and WhatsApp – employ end-to-end encryption to secure users’ messages. Apple iPhones are now encrypted by default and not even Apple can unlock a user’s encrypted phone. The availability of VPNs or Tor browsers, as well as the dark web, allows individuals to access and/or download online content without leaving easily traceable digital footprints.26 In these ways, technology is also making it harder to detect potential terrorists.


The rise of lone actor terrorist attacks


Lone actor terrorism has been defined as:

The threat or use of violence by a single perpetrator … not acting out of purely personal-material reasons, with the aim of influencing a wider audience, and who acts without any direct support in the planning, preparation and execution of the attack, and whose decision to act is not directed by any group or other individuals (although possibly inspired by others).27


Lone actor terrorists tend to attack targets perceived as easy, such as unprotected public spaces (shopping malls, parks, roads, bridges) and often use readily obtainable weapons, such as knives or vehicles. These attacks generally require limited planning and preparation and may result from very rapid radicalisation and mobilisation to violence. And because the perpetrators are lone actors, they do not need to communicate with anyone else about their plans and preparation. This makes them less detectable, and thus less vulnerable to counter-terrorism measures than group-based terrorists.


Dā’ish actively encouraged lone actor attacks. In October 2014, the group’s magazine Dabiq advised:

The smaller the numbers of those involved and the less the discussion beforehand, the more likely it will be carried out without problems … . One should not complicate the attacks by involving other parties, purchasing complex materials, or communicating with weak-hearted individuals.28


Lone actor terrorist attacks have not always resulted in fatalities, but have nonetheless instilled widespread public fear. The potential for an attack resulting in large numbers of people being injured or killed (illustrated by the terrorist attack on 15 March 2019, the Oslo terrorist’s attack and Dā’ish-inspired high casualty attacks in Europe) means a lone actor attack is a significant concern for intelligence and security agencies.29


A 2015 report from the Southern Poverty Law Center found that, between 2009 and 2015, 74 percent of domestic terrorist attacks in the United States of America – from right-wing and Islamist extremists – were carried out and planned by a single person operating alone.30


An enemy within?


Islamist extremism was and continues to be viewed as having a religious, cultural and ideological context and geographic locus distinct to and removed from, the West. In this way, even Islamist extremists living in Western countries have been perceived by intelligence and security agencies as “foreign”.


People who have far right views are not usually ethnically, socially or culturally distinct from the majority of the population. As well there are considerable overlaps between the views of the majority of the population and far right views, and radical right and extreme right-wing views. This means that it can be difficult for intelligence and security agencies to identify unique and reliable indicators of people, groups and networks with extreme right-wing ideology.


There have been examples in recent years of people with far right views being found embedded within the national security system in Western countries. For example, recent investigations in Germany indicate that the far right group Northern Cross had close links to the police and military. Some members were reportedly planning terrorist attacks against their political enemies. Using police computers, they collected some 25,000 names and addresses of pro-refugee local politicians. The members associated with the plan included two police officers, two army reservists and a police sniper.31 In the United States of America, a recent report from a former special agent of the Federal Bureau of Investigation concluded that white supremacist groups had infiltrated law enforcement agencies in every region of the country.32 In the United Kingdom in 2017, four serving members of the British Army were arrested on suspicion of being members of the banned extreme right-wing group National Action. One of them was subsequently sentenced to eight years in prison.33 And a former Canadian Armed Forces combat engineer was linked to a violent white supremacist group and arrested in the United States of America by the Federal Bureau of Investigation after going missing for five months.34


There is some evidence of the presence of far right individuals in New Zealand’s military. In December 2019 a soldier was arrested at Linton Military Camp in Palmerston North, amid suspicion they were part of a far right group.35 And in March 2020, the Australian activist group White Rose Society claimed that a (former) New Zealand Army soldier had posted on private online message boards about forming terrorist cells in New Zealand and purchasing firearms from the black market.36


The changing threatscape has increased the domestic threat in New Zealand


New Zealand has not been immune from these global terrorism and extremism developments. In 2015, the Department of the Prime Minister and Cabinet described a “worsening [terrorist] threatscape at home”. There were larger numbers of persons of interest to intelligence and security agencies. By 2017, there were usually between 30–40 individuals of counter-terrorism concern in New Zealand, most of whom were assessed as supporters of Dā’ish.


There were also potential threats of extreme right-wing terrorism. In January 2019 New Zealand Police executed a search warrant and discovered considerable evidence that a school student, assessed as likely holding extreme right-wing beliefs, was planning to undertake a school shooting in February 2019.


While the Public sector in New Zealand was adjusting to the new and shifting threatscape and developing its counter-terrorism capabilities, it had to navigate numerous events and controversies to which we now turn.


2.4 Controversies and other events affecting the agencies

Operation Eight controversy


On 15 October 2007, 17 people, including some Tūhoe activists, were arrested after an investigation (Operation Eight) by New Zealand Police discovered evidence of secret military-style training camps in Te Urewera.37 An attempt was made to charge them under the Terrorism Suppression Act 2002, but the then Solicitor-General found that the evidentiary threshold required under that Act had not been met and declined to give permission to lay terrorism charges. In 2013, the Independent Police Conduct Authority found that New Zealand Police had “unnecessarily frightened and intimidated” people during the raids, which included the coordinated execution of 41 search warrants throughout the country along with road blocks in the Tūhoe area. In 2014, the then Commissioner of New Zealand Police, Mike Bush, apologised for mistakes made during the raids.


The entire episode attracted widespread media attention in New Zealand, much of which was critical of New Zealand Police. The merits of New Zealand Police activity are not our concern. What is important is that it diminished public confidence in New Zealand Police.


Dotcom controversy


In 2012, the United States of America requested the extradition of Kim Dotcom, the developer of Megaupload.com, to face charges relating to conspiracy to infringe copyright. Kim Dotcom held a New Zealand resident visa and was living in Auckland with his wife and young family. A dramatic raid was conducted on his home by New Zealand Police. It turned out that the Government Communications Security Bureau, acting on a request from New Zealand Police, had intercepted Kim Dotcom’s communications. This interception was unlawful, because at the time, the Government Communications Security Bureau was prohibited from intercepting the private communications of New Zealand permanent residents, a status held by Kim Dotcom.


Then Prime Minister Rt Hon John Key apologised for the error, and the incident prompted a review of compliance at the Government Communications Security Bureau.38 That review, undertaken by Rebecca Kitteridge, was published in early 2013. It identified systemic problems with the Government Communications Security Bureau’s legal compliance systems, and suggested that at least 88 people might have been subject to unlawful surveillance over the previous decade.39


Again, there was substantial media scrutiny of what had occurred, much of it very critical of the Government Communications Security Bureau and New Zealand Police.


Snowden revelations


In 2013, The Guardian newspaper in the United Kingdom began to publish a series of articles containing leaked classified information about the United States of America’s surveillance programme, which came from Edward Snowden (a former contractor for the National Security Agency).


In New Zealand, the leaks were the basis for media reporting that the Government Communications Security Bureau conducted “full take” collection on Pacific Island states and trading partners. The leaks also led to reporting that New Zealand spied on countries for economic advantage and that the Government Communications Security Bureau used its capabilities to help the New Zealand Minister of Trade’s unsuccessful bid to become the Director-General of the World Trade Organization. While two subsequent Inspector-General of Intelligence and Security reports found that the Government Communications Security Bureau had acted appropriately (and made specific findings on the “full-take” allegations), the activities nonetheless led to questions from many New Zealanders about the appropriateness of the activities of the Government Communications Security Bureau and further undermined public confidence.40


Accusations against the New Zealand Security Intelligence Service by the Leader of the Opposition


In July 2011, the Southland Times newspaper published allegations that there had been Israeli intelligence activity in Christchurch at the time of the 22 February 2011 Canterbury earthquake. Then Leader of the Opposition, Hon Phil Goff, stated publicly that he had not been briefed on the issue. The New Zealand Security Intelligence Service advised the then Prime Minister, Rt Hon John Key, that the Leader of the Opposition had been briefed, and the Prime Minister said so publicly on 24 July 2011. As a result of the conflicting statements, journalist and blogger Cameron Slater requested information from the New Zealand Security Intelligence Service. It responded by giving him three redacted documents. These documents formed the basis of a public challenge to the credibility of Hon Phil Goff. In November 2014, the Inspector-General of Intelligence and Security found that the New Zealand Security Intelligence Service had supplied Cameron Slater with incomplete, inaccurate and misleading information.41


The consequence was a decrease in public and ministerial confidence in the intelligence and security agencies. Rightly or wrongly, this episode created a perception that the New Zealand Security Intelligence Service had become politicised.


“Jihadi brides”


In December 2015, Rebecca Kitteridge, Director-General of Security, told a public session of Parliament’s Intelligence and Security Committee that there was a developing trend of New Zealand women travelling to Dā’ish-controlled areas in the Middle East. She prefaced this statement with comments about the “threat to domestic security posed by foreign fighters and other extremists”. Then Prime Minister Rt Hon John Key, who chaired the Committee, asked if the women could be “jihadi brides”. He repeated the phrase in a media conference after the Committee hearing.


What Rebecca Kitteridge had said to the Committee was literally correct in that a few women with New Zealand citizenship had travelled to Dā’ish-controlled areas. However, the women in question had been living in Australia and had departed for the Middle East from there. The misconception that the women had been living in, and had departed from, New Zealand was not addressed for some time. This is because the New Zealand Security Intelligence Service needed the approval of international partner agencies before it could publicly state that the women had departed from Australia.


The “jihadi brides” remarks were picked up by the media and generated considerable controversy and ill-will towards members of New Zealand’s Muslim communities. Muslim communities reported that at that time they faced an increase in hostility, particularly Muslim women who were subjected to increased abuse and threatening behaviour. This was exacerbated by the delay in correcting the misconception.


2.5 Institutional reviews


Components of the New Zealand national security system and the Public sector agencies comprising it have been the subject of many reviews over the past two decades. By our count there have been at least 35. Not all of the reviews listed are publicly available.


Table 12: Reviews of components of the New Zealand national security system (2003–2019)




Officer of the Controller and the Auditor-General Managing Threats to Domestic Security (October 2003)


Michael Wintringham and Jane Jones A National Security & Intelligence Framework for New Zealand (September 2009)


Simon Murdoch Report to the State Services Commissioner: Intelligence Agencies Review (October 2009)


New Zealand Police National Security Capability Assessment (March 2011)


Department of the Prime Minister and Cabinet New Zealand’s National Security System (May 2011)


Simon Murdoch Review of CTAG (April 2012)


Rebecca Kitteridge Review of Compliance at the Government Communications Security Bureau (March 2013)


Simon Murdoch Counter-Terrorism: A review of the New Zealand CT landscape (Department of the Prime Minister and Cabinet, May 2013)


Performance Improvement Framework – Review of the Department of the Prime Minister and Cabinet (DPMC) (June 2013)


Jacki Couchman Review of Arrangements for Coordinating National Security and Intelligence Priorities (Department of the Prime Minister and Cabinet, July 2013)


Government Communications Security Bureau Government Communications Security Bureau Functional Review (March 2014)


Performance Improvement Framework – Review of the agencies in the core New Zealand Intelligence Community (NZIC) (March 2014)


Office of the Inspector-General of Intelligence and Security Report into the release of information by the NZSIS in July and August 2011 (November 2014)


Steve Long Independent Review of Current Activity and Development of a Counter-Terrorism Strategy (2015)


Performance Improvement Framework – Follow-up Review of the Department of the Prime Minister and Cabinet (DPMC) (February 2015)


New Zealand Police National Security and Counter-terrorism Capability Review (September 2015)


New Zealand Security Intelligence Service Strategic Capability and Resourcing Review (2015)


New Zealand Security Intelligence Service Review of the New Zealand Intelligence Community’s Security Intelligence Operating Model (Project Aguero) (2015)


New Zealand Law Commission The Crown in Court: A Review of the Crown Proceedings Act and National Security Information in Proceedings Report 135 (December 2015)


Hon Sir Michael Cullen KNZM and Dame Patsy Reddy DNZM Intelligence and Security in a Free Society: Report of the First Independent Review of Intelligence and Security in New Zealand (Cullen-Reddy Report) (February 2016)


New Zealand Security Intelligence Service The NZSIS 10-Year Operational Strategy (Project Sterling) (June 2016)


Office of the Controller and Auditor-General Governance of the National Security System (November 2016)


Simon Murdoch Review of the Integrated Targeting and Operations Centre (July 2016)


Office of the Inspector-General of Intelligence and Security Report into the Government Communications Security Bureau’s process for determining its foreign intelligence activity (2017)


Office of the Controller and Auditor-General Report on Border Security: Using information to process passengers (June 2017)


New Zealand Intelligence Community NZIC Follow-up Self Review (2018)


New Zealand Security Intelligence Service Performance Improvement Framework: Follow-up Self Review of the New Zealand Security Intelligence Service Te Pa Whakamarumaru (March 2018)


Simon Murdoch CTAG 2018: Its placement in New Zealand’s counter-terrorism system architecture and its location; an independent view (July 2018)


Office of the Inspector-General of Intelligence and Security Complaints arising from reports of the Government Communications Security Bureau intelligence activity in relation to the South Pacific, 2009–2015 (July 2018)


Performance Improvement Framework – Follow-up Review for the New Zealand Intelligence Community (NZIC) Te Rōpū Pārongo Tārehu o Aotearoa (August 2018)


Office of the Inspector-General of Intelligence and Security A review of the New Zealand Security Classification System (August 2018)


Office of the Inspector-General of Intelligence and Security 2016–17 Review of NZSIS requests made without warrants to financial service providers: Report (November 2018)


Office of the Inspector-General of Intelligence and Security Warrants Issued under the Intelligence and Security Act 2017: Report (December 2018)


New Zealand Security Intelligence Service The 2019 Terrorist Attacks in Christchurch: A review into NZSIS processes and decision-making in the lead up to the 15 March attacks (Arotake Review) (June 2019)


Office of the Inspector-General of Intelligence and Security Report on a review of the New Zealand Security Intelligence Service relationships at the border (6 September 2019)


Individually and collectively, these reviews provide snapshots of Public sector agencies’ performance. They also should have informed decision-making. While we have drawn on them as part of our inquiry, we have also seen that some of the deficiencies previously identified have yet to be fixed (see Part 8, chapter 3).


2.6 The Strategic Capability and Resourcing Review programme


In 2014, the New Zealand Intelligence Community received a very adverse Performance Improvement Framework42 review. Cabinet was subsequently advised that the New Zealand Intelligence Community was facing significant changes in the domestic and international operating environments and its ongoing funding was not sufficient. In response, the New Zealand Intelligence Community undertook the Strategic Capability and Resourcing Review. This addressed resourcing and resulted in the approval in 2016 of $178.7 million to be invested in the New Zealand Intelligence Community over four years.


The implementation of the recommendations that followed the Strategic Capability and Resourcing Review and the progressive enhancement of the capability and capacity of the New Zealand Security Intelligence Service form an important part of our assessment of its contributions to the counter-terrorism effort before 15 March 2019 (see Part 8, chapter 5).


1. One researcher found at least 212 definitions of terrorism in use throughout the world. See Jeffery D Simon The Terrorist Trap (Indiana University Press, Bloomington, 1994) at page 29.

2. Khusrav Gaibulloev, Todd Sandler and Charlinda Sanifort “Assessing the Evolving Threat of Terrorism” (May 2012) 3(2) Global Policy at page 16.

3. Anthony H Cordesman Global Trends in Terrorism 1970-2016 (Center for Strategic and International Studies, 2017) at pages 4-6.

4. The most comprehensive of which is the University of Maryland’s Global Terrorism Database.

5. Khusrav Gaibulloev and Todd Sandler “What We Have Learned about Terrorism since 9/11” (June 2019) 57(2) Journal of Economic Literature.

6. Walter Gehr “The Counter-Terrorism Committee and Security Council Resolution 1373” (December 2004) 4(1 and 2) United Nations Office on Drugs and Crime: Forum on Crime and Society.

7. Fatalities do not include perpetrators.

8. Office of the Controller and Auditor-General Managing Threats to Domestic Security (October 2003) at page 7.

9. Simon Murdoch Counter-Terrorism: A review of the New Zealand CT landscape (Department of the Prime Minister and Cabinet, May 2013).

10. Simon Murdoch, footnote 9 above at pages 4-6.

11. Steven Metz “Can the U.S. Counter Terrorism’s Shift to Decentralised and Radicalized Violence?” (29 July 2016) World Politics Review.

12. Colin P Clarke and Steven Metz ISIS vs Al Qaida: Battle of the Terrorist Brands (RAND Corporation, Santa Monica, California, August 2016).

13. Khusrav Gaibulloev and Todd Sandler, footnote 5 above at page 279.

14. Max Abrahms, Matthew Ward and Ryan Kennedy “Explaining Civilian Attacks: Terrorist Networks, Principal-Agent Problems and Target Selection” (February 2018) 12(1) Perspectives on Terrorism at page 23.

15. Alexander Spencer “Questioning the Concept of ‘New Terrorism’” (January 2006) Peace, Conflict & Development at page 7.

16. Max Abrahms, Matthew Ward and Ryan Kennedy, footnote 14 above at page 23.

17. Wilson Center Timeline: the Rise, Spread, and Fall of the Islamic State (28 October 2019).

18. Clare Ellis, Raffaello Pantucci, Jeanine de Roy Van Zuijdewijn, Edwin Bakker, Benoit Gomis, Simon Palombi and Melanie Smith Lone Actor Terrorism: Final Report (Royal United Services Institute for Defence and Security Studies: Countering Lone-Actor Terrorism Series, London, April 2016) at page 1.

19. Steven Metz, footnote 11 above.

20. Clare Ellis, Raffaello Pantucci, Jeanine de Roy Van Zuijdewijn, Edwin Bakker, Benoit Gomis, Simon Palombi and Melanie Smith, footnote 18 above at page 2.

21. Maura Conway, Ryan Scrivens and Logan Macnair Right-Wing Extremists’ Persistent Online Presence: History and Contemporary Trends (International Centre for Counter-Terrorism – The Hague, October 2019) at page 2.

22. Ilan Berman “Technology is making Terrorists more Effective – And Harder to Thwart” The National Interest (United States of America, 22 February 2019).

23. Miron Lakomy “Cracks in the Online ‘Caliphate’: How the Islamic State is Losing Ground in the Battle for Cyberspace” (June 2017) 11 Perspectives on Terrorism at page 40.

24. Heather J Williams, Nathan Chandler and Eric Robinson Trends in the Draw of Americans to Foreign Terrorist Organisations from 9/11 to Today (RAND Corporation, Santa Monica, California, 2018).

25. Heather J Williams, Nathan Chandler and Eric Robinson, footnote 24 above at page 20.

26. Ilan Berman, footnote 22 above.

27. Clare Ellis, Raffaello Pantucci, Jeanine de Roy Van Zuijdewijn, Edwin Bakker, Benoit Gomis, Simon Palombi and Melanie Smith, footnote 18 above at page 3.

28. “The Failed Crusade” (October 2014) No. 4 Dabiq at page 44 in Clare Ellis, Raffaello Pantucci, Jeanine de Roy Van Zuijdewijn, Edwin Bakker, Benoit Gomis, Simon Palombi and Melanie Smith, footnote 18 above.

29. Clare Ellis, Raffaello Pantucci, Jeanine de Roy Van Zuijdewijn, Edwin Bakker, Benoit Gomis, Simon Palombi and Melanie Smith, footnote 18 above at page 8.

30. In the study, the Southern Poverty Law Center observed “there is no hard and fast agreement on what constitutes a terrorist action”. The survey relied upon records maintained by Indiana State University and the University of Maryland’s Global Terrorism Database, as well as the Southern Poverty Law Center’s own roster of apparent domestic terror incidents. It included incidents that likely involved mental illness, but that seemed to have an obvious political aspect. It covered terrorism inspired by anti-government, Islamist extremist and various forms of race or group hatred. And it encompassed both actual terror attacks and those that were disrupted.

31. Katrin Bennehold “Body Bags and Enemy Lists: How Far Right Police Officers and Ex-Soldiers planned for ‘Day X’” The New York Times (New York, 1 August 2020) https://www.nytimes.com/2020/08/01/world/europe/germany-nazi-infiltration.html.

32. Sam Levin “White supremacists and militias have infiltrated police across US, report says” The Guardian (Los Angeles, 27 August 2020) https://www.theguardian.com/us-news/2020/aug/27/white-supremacists-militias-infiltrate-us-police-report.

33. Lizzie Darden “British Army Lance Corporal was recruiting soldiers for neo-Nazi terrorist group” The Independent (United Kingdom, 13 November 2018) https://www.independent.co.uk/news/uk/crime/british-army-officer-national-action-mikko-vehvilainen-neo-nazi-terrorist-group-recruitment-a8632331.html.

34. Karen Pauls and Angela Johnston “FBI arrests reveal shocking details in case against former Canadian reservist Patrik Mathews” CBC NEWS (Canada, 18 January 2020) https://www.cbc.ca/news/canada/manitoba/fbi-arrests-the-base-georgiawisconsin-1.5432006.

35. Charlotte Cook “Soldier’s arrest raises concerns far-right could infiltrate Defence Force” RNZ (New Zealand, 18 December 2019) https://www.rnz.co.nz/news/national/405784/soldier-s-arrest-raises-concerns-far-right-could-infiltrate-defence-force.

36. Isaac Davison “NZ Defence Force says white supremacist is a former soldier” The New Zealand Herald (New Zealand, 13 March 2020) https://www.nzherald.co.nz/nz/nz-defence-force-says-white-supremacist-is-a-former-soldier/WAKCYC7K4ENTMF2N26RGVKW2AI/.

37. Te Urewera is an area of mountains, forests, lakes and river valleys in the North Island of New Zealand. Te Urewera is “the homeland and heartland of the Tūhoe people”. See Te Urewera Board land management plan Te Kawa o Te Urewera (2017) at page 43.

38. Hon Sir Michael Cullen KNZM and Dame Patsy Reddy DNZM Intelligence and Security in a Free Society: Report of the First Independent Review of Intelligence and Security in New Zealand (Cullen-Reddy Report) (29 February 2016) at page 14.

39. Rebecca Kitteridge Review of Compliance at the Government Communications Security Bureau (March 2013).

40. Hon Sir Michael Cullen KNZM and Dame Patsy Reddy DNZM, footnote 38 above at page 24.

41. Office of the Inspector-General of Intelligence and Security Report into the release of information by the NZSIS in July and August 2011 (November 2014).

42. Performance Improvement Framework: Review of the agencies in the core New Zealand Intelligence Community (NZIC) (March 2014).