{"id":138533,"date":"2021-04-27T05:49:59","date_gmt":"2021-04-27T05:49:59","guid":{"rendered":"https:\/\/www.radiofree.org\/?p=191262"},"modified":"2021-04-27T05:49:59","modified_gmt":"2021-04-27T05:49:59","slug":"nz-police-had-no-dedicated-team-to-scan-internet-before-mosque-attacks-2","status":"publish","type":"post","link":"https:\/\/radiofree.asia\/2021\/04\/27\/nz-police-had-no-dedicated-team-to-scan-internet-before-mosque-attacks-2\/","title":{"rendered":"NZ police had no dedicated team to scan internet before mosque attacks"},"content":{"rendered":"

By Phil Pennington<\/a>, RNZ News<\/a> reporter<\/em><\/p>\n

It took seven months for the New Zealand police to set up their first team for scanning the internet after the mosque attacks<\/a> \u2013 but it was almost immediately in danger of being shut down.<\/p>\n

An internal report released under the Official Information Act (OIA) said this was despite the team already proving its worth \u201cmany times over\u201d in countering violent extremists.<\/p>\n

The unit still does not have dedicated funding, despite a warning last July it risked being \u201cturned off\u201d.<\/p>\n

This is revealed in 170 pages of OIA documents charting police intelligence shortcomings<\/a> over the last decade, from pre-2011 extending through to mid-2020, and their attempts to overhaul the national system since 2018.<\/p>\n

These show police had no dedicated team before 2019 to scan the internet for threats \u2013 what is called an OSINT team, for \u201cOpen Source Intelligence\u201d.<\/p>\n

\u201cThe OSINT team was stood up quickly last year with seconded staff to ensure\u2026 [an] appropriate emphasis on this new capability,\u201d an internal report from July 2020 said.<\/p>\n

In fact, police began the planning at the end of 2018, then \u201caccelerated\u201d it after the attacks, but it took till late October for the team to start, and training began in November 2019, a police statement to RNZ last week said.<\/p>\n

This was all well after a January 2018 official assessment of the domestic terrorism threatscap said: \u201cOpen source reporting indicates the popularity of far right ideology has risen in the West since the early 2000s\u201d.<\/p>\n

When the police OSINT unit was finally set up, there was no guarantee it would last.<\/p>\n

\u201cThis team is not permanent,\u201d the July 2020 report said.<\/p>\n

\u201cThis has meant uncertainty for staff and our intelligence customers.\u201d<\/p>\n

\u2018Seriously compromises\u2019
<\/strong>The team had no dedicated budget, and lacked trained staff.<\/p>\n

It also was still looking for tools to \u201cquickly capture and categorise online intelligence elements\u201d.<\/p>\n

\u201cThe lack of a strong OSINT capability seriously compromises our intelligence collection posture, especially in major events,\u201d said the report last July.<\/p>\n

This is the sort of scanning that can pick up threats on 4chan or other extremist sites.<\/p>\n

Despite the shortcomings, the internet team\u2019s worth had already been proven \u201cmany times over in recent months, particularly in the counterterrorism and Countering Violent Extremism space\u201d, the report said.<\/p>\n

Three people have faced extremist charges in the last year or so.<\/p>\n

\u2018Turned off\u2019
<\/strong>An April 2019 report said police would begin recruiting for OSINT analytics and other specialists in April-May 2019.<\/p>\n

Police had lacked a tool to search the dark web \u2013 where the truly egregious chat and trades take place on the internet \u2013 so bought one.<\/p>\n

But last July\u2019s report said \u201ccurrently we run the risk\u201d of OSINT \u201cbeing turned off unless there is a dedicated budget\u201d.<\/p>\n

In a statement on Friday, police told RNZ: \u201cThe OSINT team has been funded as part of the overall allocation for intelligence since it was established.<\/p>\n

\u201cMaintaining this capability is a NZ Police priority, and dedicated funding is being sought as part of next year\u2019s internal funding allocation process (note, this is funding from within Police\u2019s existing baseline).<\/p>\n

\u201cAdditional supplementary funding was also received in the last financial year to support the work of OSINT.\u201d<\/p>\n

\n
An excerpt from the July 2020 Transforming Intelligence report. Image: RNZ screenshot<\/figcaption><\/figure>\n<\/div>\n

They had known they needed the team, they said.<\/p>\n

\u201cPrior to March 15, New Zealand Police used some OSINT tools to support open source research of publicly available information and had identified the requirement to develop a dedicated capability.<\/p>\n

\u201cThe development of this capability was accelerated by the events of March 15.\u201d<\/p>\n

\u20189\/11 moment\u2019
<\/strong>The OIA documents show the OSINT intelligence weakness was not an isolated example.<\/p>\n

These warned police needed to avoid \u201ca \u20189\/11\u2019 moment\u201d \u2013 a situation where police obtain information about a threat but do not understand it due to a failure to analyse how the dots join up, as happened to CIA and FBI before the terror attacks on New York in 2001.<\/p>\n

The solution was to have \u201ca complete intelligence picture\u201d.<\/p>\n

But the July 2020 report then laid out very clearly how police did not have this:<\/p>\n

\u201cRecent operational examples conclude there is no current ability to access all information in a timely and accurate manner,\u201d it said.<\/p>\n

\u201cCurrently there is no tool that can search across police holdings [databases] when undertaking analysis of investigations.<\/p>\n

\u201cWe are still depending on manual searches.\u201d<\/p>\n

\u2018Locked down or invisible\u2019
<\/strong>\u201cSources are either locked down or invisible to analysts. Our intelligence picture is consequently incomplete.\u201d<\/p>\n

The 31-page, July 2020 report detailed the police\u2019s \u2018Transforming Intelligence\u2019 programme, dubbed TI21, that was begun in December 2018 and meant to be complete by this December.<\/p>\n

It indicated the right technology would not be in place \u2013 or in some cases even identified \u2013 for 6-18 months.<\/p>\n

As things stood, \u201cthere are many single points of failure in our intelligence system\u201d, the report said.<\/p>\n

Threat information was broken up into silos, without a centralised document management system or powerful enough analytic and geospatial software to connect the threats.<\/p>\n

A section of the 2020 report detailing problems within the police\u2019s High-Risk Targeting Teams has been mostly blanked out.<\/p>\n

The OIA documents describe what is and is not working, especially when it comes to national security and counterterrorism, but also around intelligence on gang and drug crime, family violence, combating child sex offending, and the like, at a point many months after both the mosque attacks and the beginning of the system overhaul.<\/p>\n

The Royal Commission of Inquiry into the mosque attacks in late 2020 called police national security intelligence capabilities \u201cdegraded\u201d \u2013 not just once but six times.<\/p>\n

It showed weaknesses elsewhere when it came to OSINT: The Security Intelligence Service had just one fulltime officer doing Open Source Internet searching, and the Government Communications Security Bureau had few resources for this, too. It was not till June 2019 that the Government\u2019s Counter-Terrorism Coordination Committee suggested \u201cleveraging open-source intelligence capability\u201d.<\/p>\n

Police, unlike SIS, did not do an internal review of how they had performed in the lead-up to March 15.<\/p>\n

They did get a review done of how they did 48 hours after the attacks<\/a>, which praised their efforts.<\/p>\n

Tools missing<\/strong><\/p>\n

Among the key systems police have been lacking are:<\/strong><\/p>\n