Lone wolf killers are the most elusive of terrorists, say intelligence sources, as it emerges our spies were yet to finalise a plan to tackle far-right extremism.
It wasn't far off finished, says Andrew Little, who is Minister for the NZ Security Intelligence Agency.
"It was last year they started explicitly doing work on alt-right stuff that was starting to bubble up."
Little recalls the issue coming up mid-2018 at a time when the intelligence community was setting New Zealand's National Intelligence Priorities.
This is the list of risks which pose the greatest threat to New Zealand, reviewed and agreed by Cabinet every 12-24 months.
During that process, Little was alerted to the emergence of a possible new threat which had come onto the intelligence communities radar.
It was making itself known in those countries with which New Zealand shares an intelligence alliance - Australia, Canada, the United Kingdom and United States.
And the issue was raised again in Britain this year when Little met with Home Secretary Sajid Javid, who wanted to know what New Zealand did about the problem.
READ MORE
• Spies warned of gaps in our security which needed years to fix
• Only 'small' improvements to spies after $179m upgrade
• Analysis: Christchurch massacre - what did we miss and who missed it?
• Kiwi security attitudes 'changed forever' after Christchurch terror
At that time, the intelligence community was still scoping the threat and devising a plan to tackle it.
"They were close to concluding this work - and this has erupted. It was almost complete," said Little.
"I'd like to say I wish we'd done it earlier. I wasn't concerned until now at the pace at which they were going."
Little, like anyone, wishes anything - everything - could have been done to stop the Christchurch atrocity which left 50 dead and 50 wounded.
And yet, intelligence experts say the "lone wolf" is the hardest attacker to stop.
Little: "It's pretty clear the perpetrator behind Friday's attacks was working on his own. There's no indication he was letting on anything about his plan."
Being a spy
Being a spy is as much an art as a science.
Former NZSIS officer, Dr Rhys Ball, turns to a quote from a Central Intelligence Agency leader once asked what made a good intelligence officer.
He replied: "Intelligence officers are trained to smell the flowers and then go looking for the funeral."
Ball said ingrained scepticism - or even cynicism - is critical, whether it is counter-terrorism or counter-espionage.
"They are trained to look for the ills in the world. That's your starting point for an intelligence officer and it applies as much to counter-terrorism as it does to counter-intelligence.
"Don't trust anyone - that's your starting point."
That high degree of suspicion is necessary when hunting out people who would want to hurt New Zealand. Ball also cites aggression, cunning and a determination to push boundaries.
Our intelligence services have long known of the risk posed by a single, motivated individual who fixes on an objective and dedicates their life to achieving it.
The NZ Security Intelligence Service raised this possibility in its latest annual report when referring to extremism.
"Overseas experience shows that it is possible for someone who is not known to security and intelligence agencies to move from radicalised to undertaking a terrorist attack or other action in a short timeframe, often with minimal forewarning.
"While the NZSIS and law enforcement counterparts work hard to identify and mitigate threats, it is possible that an isolated individual, unknown to these agencies, could be inspired to carry out a terrorist act in New Zealand."
The NZ Herald has been told the NZSIS believed the most likely attacker would be an angry young man, radicalised online by Islamic State.
It was an assessment based on almost two decades of war in the Middle East and Afghanistan and Islamic States efforts to radicalise adherents over the internet.
Islamic fundamentalism loomed large on what intelligence agencies call the "threatscape" - the risks in the national security radar which need to be recognised and countered.
The rise of the alt-right
We were at the tail end of a Five Eyes shift towards the threat of far-right extremism.
In the US last year, 73 per cent of extremist-related killings were by domestic far-right extremists.
Hate crimes in Canada increased 47 per cent in 2017 - in May that year a young man with a handgun walked into a mosque and shot dead six worshippers, wounding 19 others.
In Australia, there has been a recorded surge in membership of far-right extremist groups.
The UK's MI5 - the domestic intelligence agency - took over as the lead agency combating the rise in far-right extremism in October amid an increasing number of alleged plots.
Ball, now a lecturer at Massey University's Centre for Defence and Security Studies, says the communication between Five Eyes partners would have seen concerns passed on.
"Everyone would have been aware of that."
Building an intelligence operation in a new sphere takes time. The alt-right wasn't entirely new although it was two decades at least since New Zealand's intelligence agencies focused significant resource into the area.
NZSIS files in Archives NZ show how it carried out detailed, exacting inquiries into the National Front.
Old files would have been pulled, says Ball. It would give a starting point, to which new information would be added.
For the agencies, it would be about identifying potential sources of information and placing figurative tripwires to send alerts when triggered.
The type of "tripwires" include inserting new keywords into technology capable of electronically surveying open source information to pick up leads, meeting with other agencies - Customs, Immigration NZ, police - to ensure activities, movement or reports of interest are passed on.
There's human intelligence efforts. Ball talks of intelligence officers developing sources - recruiting someone to insert into a group, recruiting someone directly in a group or even going in undercover.
"When it comes to humint (human intelligence) sources, it takes a while to work them up or set them up so they do have access to the intelligence you're interested in."
And once in those groups, there is work to identify the people inside who actually want to do something.
Clive Williams, former Director of Security Intelligence for the Australian Defence Force, says the groups themselves don't necessarily pose a threat.
Far-right extremists may present as "a small number of hate-filled people who weren't going to do anything more than march".
Finding the threat
Peeling back the onion, there will be those who go beyond marching and offer financial support to an organisation. Another layer in, you find those who talk of direct action and, further still, those few who will actually take action.
At the time Ball worked for the NZSIS, the criteria for focus was set by "intent over capability".
He offers a scenario to explain. If someone posted a comment online saying: "I don't like you and I'm going to get you," it would signal intent.
Someone presenting in this way wouldn't necessarily rise in an agency's radar.
If the comment was accompanied by a photograph of the poster holding a weapon, it would show intent and capability then escalate in importance.
"There are going to be times when the intelligence information is just not available … (when) you've got an individual who's not connected to anyone.
"It seems to me this is that sort of situation."
Intelligence agencies in other Western countries hit by "lone wolf" attacks have found, after months of investigation into incidents, terrorists have brushed up against or been in contact with others who held similar beliefs, or been identified as someone of concern to law enforcement.
It is those areas where intelligence operations hope their tripwires - if set in the right place - will sound an alarm.
In the case of the Christchurch attacker, he was apparently active in online forums. He bought at least four firearms and a lot of ammunition over the internet from Gun City and another from a Dunedin sporting goods shop.
A former NZ Army soldier, now a hunter, spoke of his frustration of reporting concerns about behaviour at the Bruce Rifle Club outside Dunedin, where the Christchurch attacker practised shooting.
Williams, now an associate professor at the Australian National University and the Australian Defence Force Academy, said similar concerns in other countries had prompted alerts.
"The problem with any loner attack is they have minimal contact with people. Then they flip and decide to do something.
"You must have had people he communicated with, if not physically then online."
Ball: "The challenge is trying to put the dots together. Hindsight is a wonderful thing."
The 'lone wolf'
It was with the benefit of hindsight academics Sophia Moskalenko and Clark McCauley wrote a paper called "The psychology of a lone wolf", having studied two dissimilar cases of attackers who planned then carried out solo attacks.
They found the factors which inspired "lone wolf" attacks were incredibly difficult for intelligence agencies to identify.
Their research found those attackers beliefs were grounded in not only identifying with a group of which they felt part, but also identifying an alternative party which they believed threatened their identity fellowship.
This described many people. It describes alt-right groups of white nationalists who rant about immigration.
The mystery, the researcher said, was what separated those who would take action from others who did nothing.
Again, layers of an onion. "Identification is cheap and action is expensive," they wrote. There were few who would be so motivated as to rank their own self-interest behind the perceived benefit their group would get from direct action.
"That few are moved to action is not mysterious, but what remains a puzzle is which few are moved to action."
They found there was a common theme in the cases they studied. They found a specific incident or situation which turned what had been a political position into something which was very personal.
"In short, we suspect that lone-wolf terrorism requires the combination of strong capacity for sympathy with an experience that moves sympathy to personal moral obligation to act."
The researchers don't explain this as if it makes the action valid, simply describing the thought process in the killers' heads.
The Christchurch shooter's so-called "manifesto" identified a period of time where his political beliefs became personal. If that is genuine, he wrote of travelling in France during April 2017 and May 2017 as the time when he decided to carry out an attack.
He identified three events during that time which set his view.
The first was the death of an 11-year-old girl in the April 7 truck attack in Stockholm, Sweden. The second was the French elections (voting took place on April 23 and May 7), with the outcome destroying his faith in democracy as a solution. Finally, he wrote of being overwhelmed by the sight of cemeteries from the world wars in a country increasingly home to immigrants.
The researchers Moskalenko and McCauley found the combination of "personality and personal experience" be extremely difficult for those trying to profile such attackers.
It was possible to discover those with extreme political leanings, they wrote. Understanding what was in their heads was a far more complicated task.
Spies rebuilding
For the New Zealand intelligence agencies, the Christchurch attacker's radicalisation came during a time when it was only beginning to rebuild its capability.
In 2015 briefings to National Party intelligence minister Chris Finlayson, NZSIS director general Rebecca Kitteridge warned the agency was stretched thin. She told Finlayson "NZSIS capabilities will continue to be less than the demand on our services".
"We will need to continue making difficult prioritisation decisions about which targets we investigate [and for how long] and which we do not."
A series of reviews triggered by the GCSB's Kim Dotcom debacle exposed the intelligence agencies adrift from the public service, good practice and in need of a huge injection of cash to boost resources, technology and training.
The agencies sought the money in 2015 and were knocked back. They tried again in 2016 and got $179m, with a recommended upgrade timetable of five years.
In April 2017 - when Brendon Tarrant was in France - the programme was only one year along its track.
In August 2018, the State Services Commission reviewed the agencies' upgrade work. It found each identified security risk was given a "slider scale" against which the agencies' capability to meet such a threat was identified.
"In many instances the shifts in capability between 2013/14 and 2017 are quite small so far, and indicate the distance yet to travel," it reported.
Our spies have been travelling fast since Friday. Minister Andrew Little was in Wellington's Pipitea House - home for our intelligence agencies - over the weekend and met with the operations team.
Those working there were "totally focused", he said. He said he was impressed by their "keenness and sense of duty".
They are a different breed, say those interviewed by the Herald who are familiar with our spies. Those working at the frontline of our national security are intensely driven. They don't use the word "patriot" but see it as their duty to protect the New Zealand we love.
They always knew it was for real, even as New Zealand failed to move past the Penthouse magazine and meat pie found in an abandoned spy's briefcase in the 1970s, or even the bungled and illegal GCSB spying on Dotcom.
And now there is a different story which writes their history.
"The challenge for the intelligence community is we never see their successes," says Ball. "We only see their failures, and I hate that term."
Failures. In a way, it is like trying to hold back the tide. Or to catch every raindrop. Those in the intelligence field had told the Herald it was always a matter of "when" not "if" there would be an attack on New Zealand soil. No one ever wanted it to happen, but eventually the law of probability catches up.
Those working in Pipitea House will be upset they failed to stop the Christchurch attack. The inquiry ordered today will find out if they should have stopped it.
"It doesn't come as a surprise but it's still shocking it happens on your watch," says Ball.
"This stuff has happened in the past, and it will happen again."
NZ Herald journalist David Fisher is a member of a Reference Group formed by the Inspector General of Intelligence and Security intended to hear views on developments possibly relevant to the work of the oversight office. The group has a one-way function in offering views to the IGIS. It receives no classified or special information from the IGIS or the intelligence community. The information in this story was not sourced from Reference Group discussions.
