New documents provide early insights into the thinking of New Zealand's security agencies during and after the Parliament occupation, Marc Daalder reports
The Government's cross-agency threat assessment panel warned in the second week of the Parliament occupation that it could devolve into violent protest.
Documents released to Newsroom under the Official Information Act chart the cautious attitudes of the Combined Threat Assessment Group (CTAG) over the course of the protest in Wellington. CTAG consists of representatives from the New Zealand Security Intelligence Service, the Government Communications Security Bureau, the military, the police, aviation security, corrections and the Ministry for Foreign Affairs and Trade.
All of the documents only canvassed the terrorism and violent protest risks from the occupation. Issues like foreign interference or the non-violent disruption from the protest fell outside of CTAG's purview.
A February 17 report marks the first time the group issued an assessment of the protest. That document said the occupation had not yet met CTAG's definition of violent protest - a "premeditated decision or agreement by a group of protesters to commit violence against people or significant damage to public or private property, as part of their protest activity. This includes acts of sabotage, which may be conducted outside formal protest activity for ideological reasons."
The security experts added that while the protest had "featured violent extremist rhetoric", the majority weren't violent extremists. Most of the references to Nazism and the Holocaust were comparing the Government to Nazi Germany, not supportive of Hitler's regime.
However, the security experts were already concerned that "a small minority of individuals in New Zealand - inspired by the protest and its perceived success or failure - have or will develop the intent to carry out an act of extremist violence". This act of violence would be triggered by the violent sovereign citizen rhetoric surrounding the occupation, a police action intended to end the occupation or the "perceived lack of 'progress' or 'success' from the protests".
The occupation saw sovereign citizen ideology, which falsely posits that the New Zealand Government is inherently illegitimate and that people can resist arrest or not pay their bills without consequence, go viral on fringe online networks.
"We assess the anti-authority nature of the protests continues to resonate strongly with PMVE [politically-motivated violent extremist] adherents, notably those who hold a violent interpretation of the Sovereign Citizen (SovCit) movement," CTAG wrote. "Consistent with protests in Canada and Australia, SovCit and other pseudo-legal rhetoric has become increasingly prominent among protesters. Pseudo-legal theories have appeared particularly in regards to the legality of Covid-19 mitigation programmes, as well as police's ability to lawfulIy interact with protesters."
This "includes stated intent to arrest, try, and execute elected officials, including using otherwise legal provisions for 'citizen's arrests'".
The security services also worried about non-extremist attendees being radicalised by the violent rhetoric at the occupation.
"A number of ideologues involved in the protest have called for violence in reaction to Covid-19 mitigation programmes, either in connection to the current protests or in the past. While this threatening rhetoric has not generated significant support or traction within the protest movement, we judge that increasing exposure to this rhetoric has a realistic possibility of radicalising individuals not already on the violent extremist spectrum, particularly in the event that frustration over perceived 'failures' of the protest emerges or becomes a dominant narrative."
On February 25, CTAG compiled a new threat assessment relating to the protest and building on a document from November 2021 which detailed the risk violent extremists posed to the Covid-19 response.
This document reiterated that "the vast majority of movements opposed to New Zealand’s Covid-19 mitigation programmes are not inherently violent extremist in nature" and none had yet met the definition for violent protest. However, the Parliament occupation had seen isolated incidents of violence. These included a car being driven at the police line during a skirmish with protesters and some occupiers throwing faeces at officers.
CTAG also reported that protesters had "concealed metal poles and wooden 'weapons' by the concrete bollards positioned around Parliament. Concealing potential weapons indicates premeditation and a willingness to use violence".
Online commentary around the protest indicated that some present might mobilise to violence. "Inspired and promoted by a prominent social media channel, a small number of protesters have expressed violent extremist rhetoric using anti-authority and politically-motivated themes, both online and at the protests, including calls to arrest and execute politicians and members of mainstream media," CTAG reported.
Any violence would likely be sporadic due to the fractured nature of the occupation's leadership. It would also "likely involve the continued use of basic capability, including readily available weapons and harmful liquids".
Politically-motivated extremists who opposed the Covid-19 response were also seen as a potential terror threat. CTAG's annual terrorism threat level review, from December 2021, had "assessed it is probable New Zealand-based PMVE anti-authority adherents have the intent to conduct a domestic terrorist attack".
The February 25 review said anti-authority extremists "represent the highest level of intent to conduct an attack and are most likely to attack targets representative of the Covid-19 mitigation programmes". Such an attack would target politicians, police or the media.
There was a "realistic possibility" - about an even chance - that these individuals possessed intermediate terrorist capability. In the parlance of the agencies, that meant access to things like restricted firearms or commercial explosives.
CTAG said the online environment complicated its work, with the deluge of violent extremist content making it difficult to identify actual threats.
"We assess the anonymity offered by online platforms provides a sense of security for individuals to make threats online (genuine or otherwise) without fear of identification or repercussion," the February 25 report found.
"Likewise, the sheer volume of online rhetoric and 'normalisation' of violent and threatening language in relation to the anti-Covid-19 mitigation programme space increases the possibility that genuine threats could be overlooked. CTAG judges these factors will continue to challenge the ability of intelligence and law enforcement agencies to identify legitimate attack plots and distinguish them from hoax or non-credible threats."
The third and final document released to Newsroom is dated March 4. It deals with the potential for extremist violence in the two weeks after the clearing of Parliament grounds on March 2.
The lighting of fires on Parliament grounds and hurling of bricks at police meant the event met CTAG's definition of "violent protest" - what it had warned about two weeks prior.
"CTAG assesses that the actions of some protesters to this action meets our threshold for violent protest, including the use of pre-planned weapons and projectiles."
While some of the ringleaders of the occupation claimed in the aftermath that Antifa - left-wing antifascist activists - was responsible for the violence on March 2, CTAG debunked that and the general notion that Antifa has a significant or violent presence in New Zealand whatsoever.
"CTAG has seen no indication of the presence of violent extremist actors in New Zealand claiming affiliation with the 'Antifa' movement."
The panel said it had received no "specific, credible threats of violent extremism connected to the clearance". That said, the sovereign citizen rhetoric continued to warn of violent executions of prominent individuals. "Threatening rhetoric on social media - particularly pseudo-legal 'trials' of political figures and public servants - have been present throughout, and prior to, the 'Convoy' protest and continue to manifest following the police action."
Extremists were "almost certain" to capitalise on the police action to "reinforce pre-existing narratives of government 'tyranny' and political 'rejection'". However, the rhetoric itself was unlikely to change as it had "already escalated to incorporate calls for the violent overthrow of the Government" before the end of the occupation.
