"The country doesn't often see or hear about the various terrorism exercises that take place. But they happen for this very reason."
Police would be involved in working back from the suspects to find out how co-ordinated the attacks were, he said, and whether they were the work of one person or a handful of people, or a larger group.
"They would have spent the last 12 hours starting to work that up - going through all sorts of information, from phone logs to emails to social media, going to various addresses, interviewing others."
Ball said the Government Communications Security Bureau (GCSB) and NZSIS would be helping to collect intelligence, and perhaps carry out surveillance on targets: "You would expect to have a number of warrants in place to intercept communications".
Some security experts have questioned how the alleged gunman, Australian Brenton Tarrant, was not on NZ or Australian intelligence agencies' watch-lists or radar, including RMIT Professor Joe Siracusa, who told 9 News the killings were a "catastrophic failure of intelligence".
Paul Buchanan, director of 36th Parallel Assessments, has said intelligence agencies weren't focused on the threat of right-wing extremism, despite repeat and obvious incidents involving white supremacists in Christchurch.
Ball said right-wing extremism has been investigated from time to time in New Zealand, and there were significant groups in Australia.
"The intelligence community don't like missing things, because the finger gets pointed and it's described as an intelligence or security failure ... people will be very unhappy they haven't been on top of this."
However, he said it was hard to prevent attacks from individuals, and they had occurred in countries with substantive security agencies and powers.
Police Commissioner Mike Bush last night said no agency here or in Australia had any information about the attackers before the mosque shootings.
Today, Jacinda Ardern said Tarrant had travelled "sporadically" to New Zealand "for a period of time". He obtained a gun licence here in November 2017, and purchased the weapons the following month.
Asked if agencies had missed the threat from white supremacists, Ardern said, "given the rise of extremist views by those who hold ideology that I can only describe as violent and extreme, our agencies here in New Zealand have stepped up the work that was being done in that area".
However, when asked what was the most burning question she wanted, she said, "very much whether or not there was any indication, including on social media, that this individual should have been responded to earlier".
"I've asked for immediate follow-up on some of the concerns I've heard reported by members of our Muslim community, around their safety concerns in the weeks prior," Ardern said, also pledging to significantly toughen gun laws.
Another question was about longer-term changes, including arming police and beefed up security on regional flights. Ardern paused, then said: "there are elements of the way that we undertake our work here in New Zealand that I think New Zealanders would want us to do everything we can to preserve".
On Monday the Prime Minister will reconvene security and intelligence agencies to further piece together the alleged gunman's prior travel and movements, including his purchase of guns.
Legislation that passed in 2017 gave the NZSIS and GCSB greater powers, and allowed the latter to monitor New Zealanders if national security issues are at stake. The intelligence agencies received a large cash injection in the previous year's Budget - $179 million over four years - and staff numbers have almost doubled from six years ago.
Ball said he believed the current legislation gave agencies enough powers to operate effectively. However, the way Kiwis think about security will have changed forever, he said.
"This will change the psyche of our society, and our attitude to defence and security. Because before now, all this stuff happened overseas. It doesn't happen in little 'ole New Zealand."
