How did the Christchurch gunman stay under the radar of state agencies?

Despite his active online persona, the alleged perpetrator of the Christchurch terror attacks wasn't known to law enforcement and intelligence agencies. When companies as big and wealthy as Facebook can't properly monitor and moderate online content, how can state agencies hope to stay on top of it? Katie Kenny reports.

Following an attempted assassination of then-Prime Minister of the United Kingdom, Margaret Thatcher, the Irish Republican Army (IRA) claimed responsibility for the Brighton bomb, which killed five others.

"Today we were unlucky," the IRA statement said, "but remember we only have to be lucky once."

That sums up counter-terrorism, says Dr Rhys Ball, a lecturer at Massey University's Centre for Defence and Security Studies, and former New Zealand Security Intelligence Service (SIS) officer.

"Until now, we've had a relatively successful hit ratio, in terms of preventing things going bang in this country. Attacks have been thwarted. But we don't see the successes, we only see the failures."

READ MORE: 
* How YouTube spreads extremist ideas that inspire events like the Christchurch mosque shootings
* NZ's Security Intelligence Service is monitoring more Kiwis after terror attacks
* How hate ran riot on the internet following the Christchurch mosque shootings

The "failure" he's referring to is, obviously, the terror attacks in Christchurch on March 15, when a gunman shot dead 50 worshippers in two mosques. 

In the days before the attacks, the alleged gunman, using his full name, posted racist content and photos of firearms on Twitter, Facebook, and other social networks. In the hours and minutes prior, the 28-year-old Australian man shared a so-called manifesto referencing internet subculture and alt-right ideology – a fringe, fascist movement found mostly in dark corners of the internet. He also live-streamed the attacks, captured by a camera on his helmet. 

Despite his online activity, the gunman wasn't on watch lists for either New Zealand or Australia, Prime Minister Jacinda Ardern confirmed within hours of the attack.

At any one time over the past few years, between 30 and 40 people have been listed on the SIS's counter-terrorism risk register, according to the briefing to the incoming minster in 2017, Andrew Little. That document said New Zealand's counter-terrorism environment was "dominated by the influence of the so-called Islamic State of Iraq and the Levant (ISIL)". It didn't mention white supremacists or right-wing extremists, though the Islamic Women's Council said it told the Department of the Prime Minister and Cabinet, and other government agencies, that its members were concerned about rising racism. 

(Little has since said the SIS commissioned an internal review into the far right in the middle of last year. It was in response to the "obvious rise" of white supremacism and other far right activity around the world, he said.)

In response to questions and criticisms, Ardern has announced a Royal Commission of Inquiry, with a budget of $8.2 million, to analyse what relevant state agencies knew about the accused before the attack, and what measures they should take to prevent such attacks in the future. 

Ball says he wasn't surprised by the attacks, but that's based on a career working in the intelligence community, and, in particular, counter-terrorism. "You're always looking for violence, extremism, that's your job."

On Wednesday, it was reported the alleged Christchurch gunman had an online exchange with a Melbourne man in which he defended an anti-immigration group in 2016. He warned the Melbourne man to "choose your words carefully" and "think of who you insult". The man, who asked to remain anonymous, said he went to the police but wasn't taken seriously. 

"This demonstrates extreme ignorance on the part of police," Australian cyberhate expert Ginger Gorman says. Globally, law enforcement are "completely out of their depth when it comes to predator trolling and the real-life harm it causes," the "Troll Hunting" author says.

She says it's common for predator trolls who go on to commit crimes to leave "a trail of breadcrumbs". Many of them feel as though they're above the law, or simply don't care if they get caught, she explains.

"The online chat boards where [the gunman] hung out are extremist and white supremacist hotbeds." There will be more attacks, she warns, unless law enforcement are "properly trained and resourced to monitor and investigate cyberhate."

But what if the internet is just too big and complex to police? That's what concerns Massey University Centre for Defence and Security Studies counter-terrorism expert Dr John Battersby.

While Facebook and Twitter quickly deleted the accounts that published the video and manifesto (now classified as objectionable in New Zealand), they had already been saved and shared around the world. Removing them has proved "impossible," Battersby says. 

The internet has revolutionised communications, allowing individuals, companies, criminals, and terrorist cells to deliver content worldwide. "States have generally found themselves struggling to police the mass of it all," he says. 

"You and I are legally liable for the passengers in our car if we have an unsafe car. Pub owners are liable for the safety of their patrons. Why are social media companies not liable for facilitating the online bullying, criminal transactions, and terrorist activities that occur on their platforms?"

Users of these platforms also have a role to play, he says. "Terrorists target volumes of people and operate in the vastness of cyberspace. The rest of us who use those spaces have to learn to act, and the platforms need to empower us to do so."

Anyone who's reported a concerning post on the likes of Facebook, YouTube, Instagram or Twitter, knows the feeling of helplessness when the platform doesn't act. But there's a growing sense individuals won't be ignored. 

On March 22, Twitter's public policy account tweeted: "Kia Kaha. We stand together with New Zealand."

One Wellington user replied: "I've just reported some death threats against our Prime Minister, complete with pictures of guns, that were tweeted 48 hours ago — if you wouldn't mind sorting those out while you're here standing with us."

More than 600 other users like the tweet, and dozens responded saying they had also seen and reported the threats. Eventually, they were removed. A man believed to be behind the tweets, a teenager in Northern Ireland, has since been charged with sending death threats. He appeared in court on Friday.

Social media companies won't fix themselves — they're beholden to shareholders, not state agencies and citizens, says Otago University's Associate Professor Ali Knott at the Department of Computer Sciences. He agrees laws and policies are needed to ensure technology companies "pay heed to the public good". 

When Privacy Commissioner John Edwards met with Facebook representatives last week, he asked if the company had made any improvements to its live-streaming service since March 15. They said it hadn't. 

Edwards later took to Twitter, saying Facebook "cannot be trusted": "They are morally bankrupt pathological liars who enable genocide (Myanmar), facilitate foreign undermining of democratic institutions." (The tweets have since been deleted by Edwards, owing to "the volume of toxic and misinformed traffic they prompted," he said.)

Facebook does have the ability to fix its problems, but not necessarily the will, says Dr Belinda Barnet, senior lecturer in social media at Swinburne University of Technology in Australia. The company has done "a great job" getting rid of content related to self harm, child sexual abuse and exploitation, and Islamic State propaganda.

A combination of public, political, and legal pressures were behind the step change, she says. "It took [Facebook] a long time to do that and they learnt to do that with a combination of algorithms, human moderators, and community reporting."

Until recently, governments and social media companies didn't realise how dangerous right-wing extremism is, she says. The shift was delayed, but at least it appears to be happening now, she says. 

"It's just striking the online part of his persona was clearly visible. It wasn't confined to the dark web. If someone had been watching, perhaps they could have picked it up."

When it comes to identifying patterns and predicting attacks, intelligence agencies will always have an advantage, she says. "They're better at putting two and two together, because they're tracking across different platforms."

To many New Zealanders the March 15 attacks felt "imported", even though the Muslim community, and others, have been vocal about the country's issues of racism and anti-immigration rhetoric. The alleged gunman was born in Australia, travelled the world, and resided in New Zealand. But, from all accounts, he lived on the internet, in online communities, echo-chambers, of hate.

Hindsight is a wonderful thing, says former intelligence officer Ball. "Retrospectively, you can map where someone has come from and who they've met and engaged with. We're seeing that now, with a whole bunch of people receiving visits from police and other agencies. But it's very difficult to do that proactively and be consistently successful," he says. 

"If someone doesn't want to be found, then they're hard to find.  And then there is the challenge of prosecuting someone who has not committed an act of violence — but on the balance of probabilities had every intention of doing so."

People like the Christchurch gunman, seemingly lone actors, can be particularly difficult to track, he says. But online or offline, the basics of intelligence gathering remain the same. 

"You're looking for different leads and you're reliant on people flagging potential problems for you to investigate further. [The internet] has made things harder in the sense it's easier to hide there. As others have said: 'We've gone from trying to find the needle in the haystack to trying to find the needle in the haystack of needles'."

More resourcing always helps: "In my view, I think those agencies could benefit from a lot more resources."

However, more importantly, there needs to be a "fundamental shift" in how the public views intelligence, he says. Many New Zealanders aren't keen to see money become available to the defence forces to buy weapons and upgrades. "In a similar sense, they recoil when 'the spooks' ask for more, because there's this perception the intelligence community is a bunch of spies that carry out mass surveillance. SIS and GCSB are not the only agencies involved in collecting intelligence in this country.

"I'm hoping this perception might change following the March 15 attacks."

Living in a free, democratic society comes with risks, he adds. "You're always trying to prevent [attacks] from happening, but it's unrealistic to believe you can stop everything, in my opinion. Unless you go down the path of a totalitarian state, with massive surveillance and no privacy or rights. And we're not going to tolerate choosing that path any time soon, nor is there any guarantee that this will work, either."

Online threats are routinely reported to police. But attribution to a real identity is often a key to understanding their credibility.

Most threats are dealt with by district police, as part of "everyday business". Where one requires more attention, various groups including the high tech crime group, will become involved. There are currently more than 100 staff in the group, which includes digital forensics and a cybercrime unit, and plans to recruit more.

The inquiry, headed by Supreme Court Justice Sir William Young, will begin considering evidence on May 13 and report back by December 10. Ardern has said she wouldn't rule out "serious consequences" for relevant agencies, depending on the inquiry's findings. 

She's also called for a global approach to the regulation and punishment of social media companies, as other governments, such as Australia and the United Kingdom, have moved to legislate. When asked what steps have been taken on this front, a government spokesperson said: "Domestic legislation would be all the more strengthened if we have the global community asking for the same thing and we intend to play a key role in pursuing this approach."