This is a declassified case study on how the New Zealand Security Intelligence Service (NZSIS) conducts a security intelligence investigation.
Step 1: The initial lead
The NZSIS is notified of a new threat. The source could be a foreign liaison partner, a member of the public, a government department or even a previous investigation. The lead is assessed for reliability and priority before it is referred to an Intelligence Officer.
NZSIS case study
A trusted foreign liaison partner tells NZSIS that:
- a Syria-based individual called Dave, who has a kiwi accent, has been in contact with a facilitator for Islamic State of Iraq and the Levant (ISIL) and has been living in an ISIL camp
- Dave is seeking to travel to New Zealand “at the direction of the ISIL leadership”, and
- Dave has a New Zealand mobile number, which is not being used in Syria.
The Intelligence Officer must consider what this information means for New Zealand. Does Dave intend to undertake activities that are prejudicial to New Zealand’s security?
Step 2: Initial enquiries
The Intelligence Officer decides the initial investigative steps. They must consider the necessity and proportionality, legality and propriety of every step before it is taken. If initial enquiries reveal that there is no threat, the investigation will be discontinued. If further investigation is required, the Intelligence Officer will talk to a manager about the next steps
NZSIS case study
The Intelligence Officer needs to know more about Dave so, using Dave’s mobile phone as a reference point, the officer:
- first, searches NZSIS intelligence holdings, which produces no results
- second, asks domestic partners for assistance, which reveals his full name, date of birth, his New Zealand citizenship, and that a flight to Auckland has been booked in his name for two days’ time, and
- third, asks foreign liaison partners for information on the ISIL facilitator and receives confirmation that the facilitator is involved in ISIL recruitment
After Dave returns to New Zealand, further enquiries indicate that he is in regular contact with John, a New Zealand citizen known to NZSIS. John has previously expressed interest in extremist ideology and is assessed as very susceptible to radicalisation. This may indicate that Dave is recruiting others, such as John, to join ISIL or even attempt to harm people in New Zealand.
Step 3: Intelligence collection
NZSIS uses a range of collection capabilities to build the best picture of a possible threat and determine if further investigation requiring a warrant is necessary. This step may involve, for example, the use of human intelligence, such as talking to members of the public, or observing an individual in public places to understand their movements.
NZSIS case study:
The NZSIS observes Dave’s interactions with John in public. Dave and John continue to meet up at a library where they use computers to watch ISIL propaganda on YouTube.
The Intelligence Officer engages Case Officers to find out more about what Dave and John are doing. The Case Officers have an existing human source with whom John is closely associated.
The human source reports that John “idolises” Dave who is always talking favourably to John about his time with ISIL. John has also said he is keen to travel to Syria with Dave “the next time he goes”. The human source says the two men talk on the phone a lot but the source does not know what they talk about because they’re both very secretive.
Based on this information and what is already known, the Intelligence Officer assesses that Dave may be seeking to encourage or direct John to travel to Syria and join ISIL.
Step 4: Warrant application if required
If more intrusive investigative activities are required, such as intercepting a person’s communications, the Intelligence Officer will begin an application for a warrant. Managers and legal staff will review the proposal before the application is submitted for external approval in accordance with legislation.
NZSIS case study
The Intelligence Officer determines that further information is required regarding the nature of the phone conversations, which is not possible using non-warranted methods. The Intelligence Officer and their manager decide it is necessary and proportionate to seek a warrant on both Dave and John for this purpose. Both Dave and John are New Zealanders so a Type 1 intelligence warrant is required under the Intelligence and Security Act 2017.
After a rigorous internal process, the application is presented to the Minister reponsible for the NZSIS and a Commissioner of Intelligence Warrants. The warrant is approved and NZSIS begins exercising its warranted power to intercept Dave and John’s communications. The intercepted information corroborates the human source’s information that Dave and John are in regular contact.
In one call, they discuss packing for an upcoming “trip”. In a later call, John says “everything over there is on track for next week”. Further enquiries reveal that Dave and John have booked one way flights to a country neighbouring Syria.
Step 5: Assessment and action
Once all the necessary collection has been undertaken, the Intelligence Officer will determine what risk a particular individual poses. If the person does not pose a threat, the investigation is concluded. If a threat is posed, NZSIS will send a report to political decision-makers and/or an enforcement agency, such as the New Zealand Police.
NZSIS case study
The Intelligence Officer is now highly confident in their assessment that Dave and John intend to travel to Syria imminently to join ISIL. This poses risks to New Zealand since Dave and John may commit terrorist acts overseas and/or may return to New Zealand and commit terrorist acts.
The Intelligence Officer and their managers determine it is necessary to issue formal advice to relevant officials and partner agencies to mitigate the threat posed by Dave and John, including advice recommending the cancellation of Dave and John’s passports to prevent them travelling to Syria and joining ISIL.
This is not the end of the investigation. The human source reports that Dave, John and a third person have been meeting in a park. Surveillance Officers confirm this, which opens a new line of enquiry for NZSIS based on steps 2-5 above.