A person who helped alert police about a threat to attack two Christchurch mosques had previously met the man who was arrested and recognised him online.
With help from Paparoa - a group that tracks white supremacy and extremism online - they providedthe police with the accused's name, after verifying his identity online.
Paparoa said this raised serious questions about what involvement the security agencies had in the operation.
The minister responsible for the country's spy agencies, however, is confident the NZSIS identified the person.
A 27-year-old man, who cannot be named for legal reasons, was last week arrested and charged with threatening to kill after the police were alerted to threats made online.
Police said the man made the threat on 4chan, a website frequently used by extremists and white supremacists.
An archived version of the website shows posts made on Sunday, February 28 which detail a plan to detonate car bombs outside the Linwood and Al Noor mosques on the two-year anniversary of the March 15 terror attack.
4chan posts detailed a plan to detonate car bombs outside the Linwood and Al Noor mosques on the two year anniversary of the March 15 terror attack. Photo / Mark Mitchell
Paparoa said it received a tip-off about the threat made on 4chan and began investigating it.
Coincidentally and fortunately, the group said, a colleague remembered interacting with someone who matched the personal details the poster shared on 4chan.
RNZ has verified the interaction but has agreed not to detail what happened to protect the colleague's identity.
Their biographical details also matched with someone they were already monitoring on another site, Paparoa said.
The group used "a range of techniques that are relatively easy to apply" to verify and confirm the poster's identity before passing it on to police on Wednesday afternoon.
"This information included the threat that was posted on 4chan and the identity of the person who made the threat."
Canterbury District Commander Superintendent John Price. Photo / Jason Oxenham
On Thursday last week, Canterbury District Commander Superintendent John Price confirmed the police first became aware of the threat through its Crimestoppers line.
It's not clear if the first tip-off the police received was made by Paparoa or a separate source.
The minister responsible for the country's spies, Andrew Little, last week said the NZSIS became involved with the police operation once the tip-off had been received.
But Paparoa questioned what involvement the security agency really had in the operation, as they had already provided the accused's identity to the police.
Little refused to explain exactly what involvement the NZSIS had in the operation but did say "[NZSIS is an] intelligence agency that has intelligence and has the means to assist, in this case, the police to identify someone who has made a threat online. That is one of the things that they do and that happened in this case."
Little wouldn't say if the NZSIS verified the information provided to the police by the person who previously met the accused or whether the tip-off sent to the police assisted the NZSIS in any way.
He had been informed about the threat "early last week" but wouldn't say what day he was told.
He did confirm that he was told about the operation before the public were informed about the arrest.
Minister for the Government Communications Security Bureau and the New Zealand Security Intelligence Service Andrew Little. Photo / Supplied
In response to the latest threat, Little last week said the country's spies can't constantly monitor the internet to identify terror threats and instead rely on the public to raise the alarm.
But Paparoa rejected that, saying "most of the sites that are haunted by far-right activists can be monitored, penetrated and probed with automated programmes looking for keywords and with manual shift work of real-time monitoring and checking - again, this does not seem to be an impossible task for a govt agency".
Little stood by his comments and reiterated that security agencies rely on tip-offs.
"We don't have a situation where every New Zealander and their email accounts and their websites that they get access too are monitored. That's not the state that we live in.
"We do live in a country where our intelligence agencies are across the various threats, have a body of information and knowledge and act accordingly in conjunction with prosecuting agencies like the police," Little said.
