Security services briefings show the LynnMall attacker was highly likely to carry out a terrorist attack in New Zealand only if he was prevented from leaving the country.
They show Ahamed Samsudeen believed he had been set up and that a Syrian friend suggested he post material on Facebook.
The 32-year-old stabbed shoppers at the Countdown supermarket last September, before being shot dead by police who were following him. Eight people were injured in the attack.
SIS briefings released under the Official Information Act show assessments that it was "highly likely Samsudeen would only consider undertaking a domestic terrorist attack in New Zealand if he believed he would be unable to fulfil his intention to reach Syria and die as a martyr".
"The individual is assessed to have the capability to carry out a low sophistication attack using bladed or other improvised weapons and or possibly a vehicle," said another. "If he believes he'll be prevented from travelling again or in response to being arrested and detained, NZSIS assesses it's likely he will once again consider undertaking a domestic terrorist attack."
Police first arrested Samsudeen at Auckland Airport in 2017, when the SIS believed he was travelling to Syria to join Isis fighters.
He denied charges against him throughout his remand in prison, suggesting he was persuaded into posting extremist content on social media by a man who befriended him.
"Corrections reporting also indicates Samsudeen has continually refuted his charges throughout his incarceration," said one SIS briefing. "For instance, in reporting from 5 January 2018 [he] showed a fellow prisoner a list of his current charges from his legal papers, explaining he planned to fight them.
"In earlier reporting from mid '17 Samsudeen told staff he felt he was being set up, claiming a Syrian friend told him to put things on Facebook. Later in the same reporting [he] stated he didn't know why he was in custody, accused police of making things up and said he didn't see how he was breaking the law."
He was arrested again in 2018 and remained in custody until July 2021. He spent a total of four years in custody on remand.
His convictions were for: using a document for pecuniary advantage, knowingly distributing restricted material (R18) and failing to assist the police in their exercise of a search power in 2018; and in 2021, two charges of possessing an objectionable publication and one charge of failing to assist a police officer exercise a search power.
'Information doesn't seem to tally up'
The Federation of Islamic Associations (FIANZ) said Samsudeen's attack in September was "horrendous and cowardly". It has been carrying out its own research, which it has been sharing with the three agencies reviewing the decisions and actions taken by police, Corrections and the NZSIS in his case.
FIANZ's Abdur Razzaq, who chaired its submissions to the Royal Commission on the Christchurch mosque attack, said it was undertaking a "deep-dive" into Samsudeen's background.
He is concerned about whether there was evidence that Samsudeen was radicalised when police and SIS first had him on their radar, as the initial evidence suggested he was searching for news reports on Isis attacks instead of extreme content.
"What we found was there was a profile which has been developed through inconsistent usage of information, though I think lack of awareness, and also in some cases probably deliberate, which is not consistent with the information we have received.
"But it's up to the coordinated review to give their findings because they have more information. They're having a much more thorough look at it.
"A lot of the information which we have been given by the authorities through the media doesn't seem to tally up with the information we've received."
FIANZ has also looked at what might have affected Samsudeen since then, including the amount of time he was held as a remand prisoner at Mt Eden prison (two periods May 2017 to July 2020) and from then until July 13 last year at Auckland prison in Paremoremo.
A criminologist who deemed the LynnMall attacker "low risk" in 2018 believes opportunities were missed to steer him away from violent extremism.
SIS noted in a briefing that Corrections did not provide programmes focused on mitigating the risk of radicalisation, and applied management strategies, including segregation, where radicalisation was a concern.
Razzaq said Samsudeen ended up being held in segregation at Paremoremo, where the mosque terrorist Brenton Tarrant was - and is - being held. The last three years on remand ended with convictions that boiled down to listening to two religious hymns, he said.
The coordinated review's report - made up of findings from the Independent Police Conduct Authority (IPCA), the Office of the Inspectorate at the Department of Corrections, and the Inspector-General of Intelligence and Security - is due to be published in May.
Initially, the review was confined to events after Samsudeen was remanded in custody a second time in 2018. However, the IPCA has told RNZ the three bodies decided to extend the inquiry to take in the events leading up to his first arrest in 2017 to give it a fuller picture of what occurred.