New Zealand spy agencies and police have been criticised for failing to detect threats to car bomb two Christchurch mosques on the March 15 terror attack anniversary. Why was it left to members of the public to flag? Has anything changed since the mosque shootings? Kurt Bayer reports.
Armed police raided two Christchurch properties on Thursday after receiving two separate tip-offs about concerning posts made on notorious online public forum 4chan on the night of Sunday, February 28.
Posts mentioned the Christchurch mosque terrorist, the Al Noor and Linwood mosques, car bombs, and March 15.
One tip-off came from anti-fascist activist group Paparoa, who "directly approached a police contact" with full details, including the suspect's name.
Another report from a member of the public came through the anonymous Crimestoppers phone line, which they acted on, Canterbury District Commander Superintendent John Price confirmed.
A 27-year-old man was charged with threatening to kill at the Al Noor and Linwood mosques just ahead of the second anniversary of the terror attack that killed 51 people at the two city mosques on March 15, 2019.
At a brief Christchurch District Court appearance on Friday, the man was granted interim name suppression and remanded in custody without plea to come back to court on March 19.
Since the raids, police and spy agencies have been criticised for failing to detect the threats themselves.
But responding to the criticisms this week, police, spy agencies, and Andrew Little, minister responsible for the Security and Intelligence Service (SIS) and the Government Communications Security Bureau (GCSB), have all said the job is too big to manage alone.
They all say the public plays a large role in helping alert them to threats – so they can assess the information and react appropriately.
The Royal Commission of Inquiry into the March 15, 2019, terrorist attack criticised security agencies for having previously deployed "an inappropriate concentration of resources" probing Islamic extremism whereas white supremacy had been considered just a fringe threat.
It resulted in SIS Director-General Rebecca Kitteridge apologising to the Muslim community and stress that "significant areas" needed change.
Also in the wake of the attacks, police launched a specialised unit utilising artificial intelligence (AI) technology to scour New Zealanders' Facebook, TikTok, Instagram and other social media channels, as well as online platforms such as 4chan.
The open-source intelligence (Osint) team "provides a dedicated capability that assists in the understanding and collection of information from online sources", police confirmed to the Herald in December.
The expert unit was set up to search publicly available information on the internet and gather information "in relation to people, events and issues of interest" to police.
But Paparoa – a volunteer group, which also formed after the Christchurch mosque attacks to research and monitor fascists – said they discovered the threats and who had made them through "old-fashioned Osint techniques" themselves.
A Paparoa spokesperson, who wished to remain anonymous, said although they usually use Crimestoppers to report concerns, a "liaison" made a direct approach to a police contact last week to raise the alarm.
Paparoa say their researchers are "embedded in local communities and online spaces" and use a combination of "Osint, historical knowledge and intuition to identify threats".
"That is why anti-fascist community self-defence often works faster than policing," the spokesperson said.
Paparoa monitors a mixture of public and private forums, the Herald understands.
But the group is bemused as to why official agencies didn't pick up the threat.
"This particular case involves a threat posted on a public 4chan forum. It should have been picked up without help from the public," the Paparoa spokesperson said.
They used "one of the most simple and trivial Osint techniques" to find the concerning post.
Responding to questions over police handling of the threats, an NZ Police spokeswoman said they were unable to discuss the details of how and when the online threat was brought to their attention, given the case is now before the courts.
However, as soon as police received the tip-offs, the information was taken seriously and investigators "began analysing the source of the threat which resulted in an arrest last week".
While the police Osint unit works with a number of government agencies and international law enforcement to search the internet, the spokeswoman said it was an "enormous task".
"This is why it's important that members of the public continue to provide us with information so we can act as quickly as possible," the police spokeswoman told the Herald this week.
Security expert Paul Buchanan, a former intelligence analyst for US security agencies, also questioned how police, and intelligence agencies, were unable to pick up on it themselves.
"Police and SIS, with support from the GCSB, supposedly have dedicated units focused on internet chatter and social media and yet they missed a 4Chan threat even though it is a well-known extremist gathering place that one would think is being regularly monitored by government security agencies around the world," he said.
"Instead, a loose group of volunteers with very little resources located and reported the threat.
"So the question begs as to why, with the resources at their disposal, the security community did not identify the threat on its own, especially since 4Chan is basically an open forum for those who know how to access it."
Andrew Little defended the spy agencies' work, saying online threats could be made on "literally thousands" of websites and online platforms.
Intelligence agencies work off leads, he stressed, and in this case, they followed the lead, helped police, and it all led to a man's arrest.
"That's the intelligence agencies doing their job," he said.
Little, minister responsible for the Security and Intelligence Service (SIS) and the Government Communications Security Bureau (GCSB), cited the example of the Christchurch mosque terrorist, who had a minimal online presence and "went largely under the radar".
Intelligence agencies must work closely with communities who can help identify risks, and then the agencies' expert skills, accumulated knowledge and information can "evaluate what the next best steps are".
"That's what happened in this case and that contributed to the apprehension of the person who is before the courts," Little said.
Close scrutiny from two recent intelligence agencies reviews – one internal plus the royal commission of inquiry launched after March 15 – has left Little satisfied that the way they operate is "consistent with the range of threats that we as a country face".