Martin Place Siege: Joint Commonwealth - New South Wales Review

Executive Summary

Recommendations

Part One: Overview

One: Introduction

Two: Chronology

Three: Biographical Information

Part Two: Monis’s interactions with government

Four: Arrival, Protection Visa, Citizenship

Five: Social Support

Six: The Justice System

Seven: Access to Firearms

Part Three: Government response to Monis

Eight: Information Sharing and Coordination

Nine: Preventative Measures –  National Security Legislative Powers

Ten: Public Communication

Eleven: Identity

Appendices

I: ASIO Prioritisation Model

II: Contributing agencies

Executive summary

At around 8.33 am on 15 December 2014, Man Haron Monis walked into the Lindt Café, on the corner of Martin Place and Phillip Street, in the heart of Sydney’s commercial district. Shortly thereafter, he produced a gun and ordered that the customers and staff be locked inside as hostages. After a standoff lasting around 17 hours, the siege ended in gunfire. Three people died: two hostages and Monis. Several of the other hostages sustained injuries.

The Martin Place siege has deeply affected the community.

The Review analysed the events that led up to the siege and the range of interactions Monis had with agencies including the criminal justice system, beginning with his arrival in Australia. It asked:

• were the decisions of government agencies in respect of Monis reasonable given the laws and policies in place when the decisions were made?
• should decision-makers have had other information before them when making their decisions?

Overall, the Review has found that the judgments made by government agencies were reasonable and that the information that should have been available to decision-makers was available.

Changes to laws and policies in relation to national security involve judgments about public safety and personal liberty – i.e. the risk framework within which society operates. We expect that public discussion and consultation about these judgments will continue over the coming months as further information about the circumstances of the conduct of the Martin Place siege operation becomes available.

However, the Review has concluded that some modest changes are needed to our laws and government processes to mitigate the public security risks exposed by this case. Some of these changes are already being made. For example, new bail arrangements have now been introduced in New South Wales. New programmes to counter violent extremism in the community are being developed. Other initiatives, such as a review of immigration policies, laws and capabilities in relation to visa applications should be pursued.

The Review’s recommendations would maintain broadly the current balance in our existing regulatory and legislative framework.

The Review’s decision to not propose steps beyond this is based on our view that introducing substantial further controls involves a larger choice about the sort of society we wish to live in and is properly the province of the public and our elected representatives.

Any further controls would be based on judgments as to whether increases in policing, surveillance and controls and the related extra burden on the taxpayer and intrusions into Australians’ lives would make us appreciably safer.

A summary of the Review’s findings is set out below.

National Security threat level

At the time of the Martin Place siege, the general terrorism threat level was High – terrorist attack is assessed as likely.

The threat level had been raised to High on 12 September 2014. While this was not based on any indication a terrorist attack in Australia was imminent, it recognised that the likelihood of such an attack had increased.

The decision to raise the threat level related to a range of factors indicating an escalation in the threat environment – in particular, increasing numbers of Australians connected with, or inspired by, terrorist groups such as the Islamic State of Iraq and the Levant, Jabhat al-Nusra, and al-Qa’ida which have a desire to attack Western countries, including Australia.

Law enforcement and security agencies’ assessments of Monis

Monis was the subject of many law enforcement and security investigations and assessments over the period of his residence in Australia. None of the results of these investigations, or the continuous assessment of information related to Monis in the intervening periods, provided any indication he had the intention to commit an act such as the Martin Place siege.

Of note, in the period April 2008 to January 2009, ASIO conducted a thorough investigation of Monis to determine if he was of concern from a terrorism threat perspective. It concluded that Monis:

• was not involved in politically motivated violence and had not tried to incite communal violence
• had not expressed an intention to commit politically motivated violence
• was not in significant contact with known individuals or groups of security concern. In addition, none of Monis’s immediate circle of acquaintances were themselves in contact with known individuals or groups of security concern.

ASIO’s final assessment of Monis at the conclusion of the 2008‑09 investigation was that Monis was not a threat to national security.

The conclusion of this investigation did not mean that ASIO no longer paid attention to Monis. Indeed, is should be emphasized that the notion that ASIO has some sort of a ‘watchlist’ whereby individuals on the list are subject to scrutiny and individuals off the list are not, is incorrect. ASIO will always investigate national security related information that it receives whether that information relates to an old target, an existing target or a potential new target.

In Monis’s case, following the conclusion of the 2008-09 investigation, ASIO and police agencies continued to assess all new information received on Monis. He remained the subject of consideration and information exchange in the NSW Joint Counter-Terrorism Team due to subsequent National Security Hotline referrals, active social media presence and progress of non-national security-related criminal investigations. He was the subject of Joint Counter Terrorism Team discussions on numerous occasions between 2008 and 2014.

Criminal investigations of Monis undertaken by AFP and NSW Police Force, while not undertaken on national security grounds, also provided coverage of Monis over following years. None of these investigations identified any information to indicate Monis had either a desire or an intent to undertake an act of terrorism in Australia.

The National Security Hotline received 18 calls in relation to Monis between 9 December 2014 and 12 December 2014. All of these 18 calls were complaints about the offensive nature of the content of Monis’s public Facebook page. None of the calls related to any intentions or statements regarding a pending attack – imminent or otherwise.

Importantly, these Hotline reports were all considered by ASIO, AFP and, when deemed relevant to NSW, the NSW Police Force, prior to the siege. All three agencies considered the Facebook posts contained no indications of an imminent threat. The postings were not assessed to meet the threshold for prosecution under new ‘advocacy of terrorism’ legislation.

Given his long history of provocative, attention seeking behaviour and unreliable or false claims, the Review was alert to the possibility that ASIO or the police might actually have been complacent or even dismissive about Monis. There was no evidence this was the case. Each time security or law enforcement agencies received new information, it was assessed in accordance with their policies and procedures.

The Review found that right up until the siege, and not withstanding their familiarity with Monis, ASIO and law enforcement agencies never found any information to indicate Monis had the intent or desire to commit a terrorist act. This included consideration of Monis’s known activities and statements in the period leading up to the siege. While his language and sentiments were offensive, they were not exceptional, either in terms of his previous conduct or other material which is readily available on social media and elsewhere.

Monis was assessed by ASIO in early December 2014. On the basis of the information available at the time, he fell well outside the threshold to be included in the 400 highest priority counter-terrorism investigations. He was only one of several thousand people of potential security concern.

Arrival, Protection Visa, Citizenship

Monis arrived in Australia on a Business Visa on 28 October 1996. Within a month he had sought asylum in Australia.

Over the course of the next eight years he was granted a Bridging Visa (1996), a Protection Visa (August 2000) and Australian citizenship (October 2004).

Monis was interviewed by ASIO several times over this period as part of security assessments undertaken for immigration purposes. Ultimately, he was found not to be a risk to national security.

Decisions made to grant Monis visas and Australian citizenship were made in accordance with the laws, policy and procedures of the time. The Review was advised by the Department of Immigration and Border Protection (Immigration) that if the Monis situation presented itself again today, it seems likely that a visa and citizenship would still be granted.

The Review notes that the establishment of a single Department of Immigration and Border Protection with an Australian Border Force will support improvements in border security. The Review also notes that as part of this merger Immigration will review its internal connectivity and information sharing processes, and identify key policy and legislative changes necessary to support decisions on whether to grant an initial visa, subsequent visas and, citizenship. The Review sees this as a key issue.

Social support

Monis received government funded income support for about seven and a half of the 18 years he lived in Australia. He appears to have supported himself through a variety of jobs and businesses during the other eleven years.

He first received income support through the Asylum Seeker Assistance Scheme, and later through both Newstart Allowance and Austudy. Monis was generally a compliant income support client. The Review did not find evidence he attempted to defraud welfare, and did not receive welfare while in jail.

Monis received treatment at a community mental health centre in 2010 and 2011. The Health Records and Information Privacy Act 2002 (NSW) prohibits the Review from releasing details of Monis’s medical history. That said, the Review has had access to these records and they have informed the judgements reached in the Review.

The NSW Chief Psychiatrist has reviewed the medical documentation and concluded that at no time in his multiple encounters with mental health professionals was Monis assessed to represent a potential risk to others or to himself, and at no time was it necessary to admit him to hospital for treatment of mental illness, or for him to receive coercive or more restrictive care.

NSW Justice System

In July 2011, Monis was charged with intimidating his ex-partner (now deceased). The police made a provisional Apprehended Domestic Violence Order against Monis and this was continued by the court on an interim basis. A final Apprehended Domestic Violence Order to protect his ex-partner was sought by NSW Police Force, but not supported by the court and the charges were dismissed.

Monis was on bail for serious violent offences at the time of the siege. He had been granted bail on charges of being an accessory before (and after) the murder of his estranged partner who died on 21 April 2013. He had also been granted bail in relation to charges for numerous sexual offences.

Monis encountered the victims of his alleged sexual offences while presenting himself as a spiritual healer between 2002 and 2010.

The bail decisions in relation to Monis had been carefully scrutinised by police and prosecuting authorities. Consideration had been given to challenging the decisions, however, under the law in force at the time, and given the circumstances of Monis’s case, it was considered that there was not sufficient basis for such challenges to be successful.

NSW bail laws have undergone an intensive period of reform during the last two years and the effectiveness of these laws continues to be closely monitored. New bail laws, which came into force on 28 January 2015, include a strict ‘show cause’ requirement before bail can be granted in cases where serious charges are alleged.

Bail laws have been strengthened since the decisions to grant Monis bail were made. The Coroner will examine how Monis came to be granted bail for the charges he was facing at the time of the siege and how police and prosecuting authorities responded to this.

The Review did not consider bail legislation in jurisdictions beyond New South Wales. Nevertheless, the Review recommends that other jurisdictions may wish to consider Recommendations 4 and 5.

Access to firearms

Monis entered Martin Place with a pump action shotgun. It was short, having been sawn off at the barrel and at the end.

The Coroner has announced that his inquiry will examine in detail the gun used by Monis. On the information available to the Review, it appears that the firearm used by Monis may have entered Australia lawfully and became a ’grey market’ firearm when not returned as part of the 1996 National Buy Back program.

Monis was at no time issued a firearms licence, and at no time did he legally own or import a firearm.

He did hold a security guard licence from 1997 to 2000 which would have allowed him to carry a pistol while on duty from March to June 1997. Relevant laws were subsequently changed and from 1 July 1997, Monis would have no longer been able to carry a pistol in his capacity as a security guard.

Through its considerations of the issues in this area, the Review has identified shortcomings in the accuracy and consistency of firearms data in Australia.

The Review recommends that State and Territory police forces should conduct an urgent audit of their firearms data holdings before the National Firearms Interface is operational where this has not already occurred.

The Review understands that Monis used an illegal firearm. The Australian Crime Commission has advised there are in the order of 250,000 illegal firearms in Australia. The Review recommends that the Commonwealth and the States and Territories should give further consideration to measures to deal with illegal firearms.

Information sharing and coordination

Monis was well known to security and police agencies. He had been investigated a number of times and successfully convicted on 12 postal charges. He had met with police and ASIO representatives on numerous occasions and these agencies, along with others, held hundreds of thousands of pages of information on him.

Relevant information was shared in a timely and appropriate fashion between the various agencies.

Within the time available to it the Review did not identify within Commonwealth or NSW systems any information which should have led to different decisions by agencies. The information that was available was shared effectively between national security agencies and between Commonwealth and State and Territory agencies.

Given the scale of the task facing law enforcement and security agencies, the Review accepts the need for prioritisation of counter-terrorism efforts as essential. Not every lead or concern can or should be treated as a top priority.

The Review supports new measures currently being developed to identify and respond to individuals who may be susceptible to radicalisation but who do not meet the threshold for investigation on national security or criminal grounds.

The Review recommends that all States and Territories review relevant legislation, in particular with respect to privacy and health, to ensure appropriate access by ASIO.

Preventive measures – national security legislative powers

While Monis was consistently on the radar of national security agencies from the time he arrived in Australia, at no point did he do or say anything which would have enabled him to be successfully charged with a terrorism offence under the law.

Control orders and preventative detention orders deny an individual their liberty based on a suspicion that an offence may be committed rather than based on an actual offence. The threshold for use of these orders is therefore very high and Monis’s actions never reached it. To date, control orders have only been used four times and preventative detention orders have been used three times.

Public Communication

Public communication during and immediately after the siege was conducted effectively and in accordance with relevant protocols.

There was a constant flow of relevant information to the public.

Public safety was properly addressed, and the public received timely messages from political leaders and NSW authorities.

The media was responsible, and effective community outreach helped to ensure there was no subsequent significant community backlash.

Identity

Monis interacted with Government agencies under a significant range of identities, aliases and titles. His multiple identities were not a barrier to information exchange between agencies, nor did he use them to inappropriately access social entitlements. However, the Review has made recommendations for general improvement in this area.

Recommendations

The Review makes the following recommendations to improve the system. Some of them flow directly from the circumstances of the Monis case. Others emerge from the Review as issues where improvements could be made.

The Review has not made any recommendations to increase funding to particular agencies. To the extent that any recommendations have resource implications, we expect that these should be handled through ordinary budget processes.

Recommendations on immigration

1. Immigration should review its internal connectivity and information sharing processes to improve the Department’s ability to verify the initial supporting information provided by visa applicants wishing to travel to Australia.
2. Immigration should better assess the possible risks posed by individuals at the pre visa, post-visa and pre-citizenship stages.
3. Immigration should propose policy and legislative changes necessary to support decisions to grant or revoke an initial visa, subsequent visas and, citizenship.

Recommendations on the NSW justice system

4. The NSW Police Force and Office of the Director of Public Prosecutions should establish a formal memorandum of understanding governing the process for seeking review of bail decisions, including the process for consideration and escalation of contentious bail issues. This recommendation should be considered by the NSW Government at the same time as consideration is given to the final report of the Hatzistergos Review of bail laws.
5. The Department of Premier and Cabinet, Department of Justice and NSW Police Force should develop a proposal for consideration by the NSW Government to require a bail authority to take into account an accused person’s links with terrorist organisations or violent extremism. This recommendation should be considered by the NSW Government at the same time as consideration is given to the final report of the Hatzistergos Review of bail laws.

Recommendations on firearms

6. The Commonwealth, States and Territories should simplify the regulation of the legal firearms market through an update of the technical elements of the National Firearms Agreement.
7. CrimTrac, in cooperation with Commonwealth and State Police and law enforcement agencies, should prioritise bringing the National Firearms Interface into operation by the end of 2015.
8. States and Territories’ police forces should conduct an urgent audit of their firearms data holdings before the National Firearms Interface is operational where this has not already occurred.
9. The Commonwealth and the States and Territories should give further consideration to measures to deal with illegal firearms.

Recommendations on information sharing and coordination

10. The Commonwealth Attorney-General’s Department should work with States and Territories through the Australia New Zealand Counter Terrorism Committee (ANZCTC) to expedite work on a Countering Violent Extremism referral program, including ensuring it is appropriately resourced, and to report back to the Council of Australian Governments (COAG) on implementation by 30 June 2015.
11. Consistent with the October 2014 COAG agreements, all Governments should support communities and front-line service providers in recognising signs that someone may be radicalising and adopting strategies for management.
12. All States and Territories should review relevant legislation, in particular with respect to privacy and health, to ensure appropriate access by ASIO, with a report back to COAG by mid-2015.

Recommendations on legislative powers

13. Noting the enhancement of control order provisions in late 2014, ANZCTC should monitor the operation of control orders, as well as preventative detention orders, to ensure they meet evolving operational needs.

Recommendations on public communications

14. Media representatives should be offered access to government-led training exercises to further improve cooperation in the event of future terrorism incidents.
15. The National Security Public Information Guidelines should be updated to ensure relevant agencies in all States and Territories have clear guidance on accessing information and communicating with the public during an incident in any State or Territory.

Recommendations on identity

16. Agencies should adopt name-based identity checks to ensure that they are using the National Identity Proofing Guidelines and the Document Verification Service, and by improving arrangements for sharing formal name change information between Commonwealth and State bodies (timing and budgetary impacts to be identified by all jurisdictions).
17. Agencies that issue documents relied upon as primary evidence of identity (e.g. drivers’ licences, passports, visas) should explore the possibility of strengthening existing name-based checking processes through greater use of biometrics, including via the forthcoming National Facial Biometric Matching Capability.

Part 1: Overview

One: Introduction

At around 8.33 am on 15 December 2014, Man Haron Monis walked into the Lindt Café, on the corner of Martin Place and Phillip Street, in the heart of Sydney’s commercial district. Shortly thereafter, he produced a gun and ordered that the customers and staff be locked inside as hostages. After a standoff lasting around 17 hours, the siege ended in gunfire. Three people died: two hostages and Monis. Several of the other hostages sustained injuries.

The Martin Place siege has deeply affected the community.

The Commonwealth and NSW Governments have shared the community’s grief over the event. The Prime Minister and Premier have expressed their condolences to the family and friends of the hostages who died and their sympathy to those affected by the incident.

They have also extended their appreciation and gratitude to all those in the community and government agencies involved in the emergency operations surrounding the Martin Place siege.

The Review

This Review, jointly commissioned by the Prime Minister of Australia and the Premier of New South Wales the day following the end of the siege, is the first official government review of the incident.

The Review has been completed in six weeks, drawing on the records and advice of agencies in the Commonwealth, New South Wales and other States and Territories.

Other more detailed inquiries and proceedings into matters concerning the siege and Monis will follow, notably the report of the NSW Coroner who is inquiring into the circumstances of the deaths arising from the siege. The Review has been careful not to prejudice the work of the Coroner, who will be undertaking detailed investigations including interviewing a large number of witnesses before making his findings.

There are also ongoing criminal matters in NSW which limit the public release of information collated during this review.

Terms of reference

The Review was asked to make recommendations in respect of Commonwealth and NSW agencies and the cooperation between them, in relation to:

1. the arrival of Man Haron Monis in Australia and subsequent grant of asylum, permanent residency and Australian citizenship

2. support received from, or any other interactions Man Haron Monis had with, government social support agencies

3. information held by Commonwealth and NSW agencies about Man Haron Monis for the period prior to and following his arrival in Australia up until the siege including how any information relevant to public safety was shared between, and used by, agencies

4. the interaction of Man Haron Monis with the NSW justice system

5. Man Haron Monis’s access to firearms

6. whether, how and at what stage relevant national security legislative powers including Control Orders were or could have been used in relation to Man Haron Monis’s activities of security concern

7. any lessons learnt by the NSW and Australian Federal Police about the handling of the siege

8. the effectiveness of public communication including coordination of messaging between the Commonwealth, NSW and jurisdictions

9. the effectiveness of coordination more generally between the Commonwealth and NSW.

The Review consulted with the NSW Coroner, and agreed that it would not be appropriate at this time for this Report to address Terms of Reference 7 (any lessons learnt by the NSW and the Australian Federal Police (AFP) about the handling of the siege).

Approach to the Review

The Review was conducted by the Secretary of the Commonwealth Department of the Prime Minister and Cabinet, and the Secretary of the NSW Department of Premier and Cabinet. The Review consulted with relevant government agencies at the commonwealth and state levels.

The Review acknowledges the strong cooperation of all agencies consulted during this process. The Review has drawn together information relevant to the terms of reference. It has also analysed the important decisions made by governments – and the contexts in which those decisions were taken – concerning the status of Monis from the time of his arrival in 1996 to his death in 2014.

In undertaking the analysis of government decisions, the Review recognises that in Australia public safety and security are governed under a risk-based system. When reviewing the way decisions are taken about a person who goes on to commit a criminal act, we assessed whether reasonable judgements were made given the risk framework that balances the rights of individuals and the protection of society.

In respect of each important decision, the Review considered:

• whether given the information available to government decision-makers, and the legislative and policy risk framework, their decisions were reasonable
• should the decision-makers have had other information before them when making their decisions. Implicit in these questions is a consideration of the risk framework in which these decisions were made, and whether that framework achieves the right balance between the interests of individuals and wider society.

Structure of the Review

The Review is divided into three parts.

Part One contains an overview of the Martin Place siege, and an overview of what we know today about Monis and key events from his arrival in Australia to the events of 15-16 December 2014.

Part Two describes the interactions of Monis with specific components of the Commonwealth and NSW Governments, and examines whether there are any lessons to be learned.

Part Three analyses the broader performance of Australia’s counter-terrorism machinery, the adequacy of national security legislation, and how the flow of information and coordination between different government agencies worked.

References to Man Haron Monis

The Review uses the name Man Haron Monis (Monis) throughout. When he entered Australia on 28 October 1996, his legal name as evidenced by his travel documentation was Mohammad Hassan Manteghi. On 16 September 2002, he formally changed his name to Michael Hayson Mavros. On 21 November 2006 he again formally changed his name to Man Haron Monis. Monis was also known by a large number of aliases and variant spellings of names and aliases (possibly as many as 31). The Review will consider his use of names and aliases in Chapter Eleven.

Information sources and the Review

In a number of cases, the Review had access to information that cannot be included in the public report. There are numerous areas of legislation which created these restrictions. In each of these cases, these provisions did not hamper the Review’s considerations and recommendations, but have restricted the information that could be made public.

Two: Chronology

Disclaimer: While this chronology provides a summary of many of the key interactions Monis had with Government agencies, it does not constitute a complete record. It includes a summary of relevant information other than that which has been excluded for legislative privacy reasons. As noted elsewhere, governments had access to hundreds of thousands of pages of information on Monis.

1996

1 October -  Monis (under the name Mohammad Hassan Manteghi) applies, in Iran, for a one month business visa to Australia. The then Department of Immigration and Multicultural Affairs (Immigration) refers the application to Australian Security Intelligence Organisation (ASIO) for routine checking (in accordance with standard profile-based security checking processes).

10 October - ASIO assesses the application and issues a non-prejudicial assessment and Immigration grants the visa.

28 October - Monis arrives in Australia at Sydney International Airport.

4 November - ASIO receives potentially adverse information about Monis, none of which relates to a terrorist threat to the Australian community or an intent to commit politically motivated violence.

5 November - Based on the information received on 4 November, ASIO initiates an investigation and ask Immigration to add Monis to the Movement Alert List (MAL) database.

18 November - While in Australia on his Business Visa, Monis applies for a Protection Visa. He remains in Australia on a Bridging Visa while Immigration determines his claim for protection.

1997

26 March - Monis is issued with a security guard licence in NSW.

April - Monis submits claims in support of his Protection Visa.

July - Monis begins receiving support via the Asylum Seeker Income Support scheme.

9 July - Immigration raises the claims made in Monis’s Protection Visa application with ASIO.

16 September - Immigration interviews Monis about his visa application.

1998

26 March - Monis is issued with a renewed security guard licence in NSW.

18 May - Monis contacts ASIO’s public line claiming to have information of interest to ASIO and relevant to the upcoming Sydney Olympics (again, not in any way related to politically motivated violence). ASIO interviews Monis on two separate occasions and assesses he has no information relevant to national security.

3 July - Immigration refers Monis’s case to ASIO for security assessment.

23 November - ASIO conducts a security assessment interview of Monis.

1999

22 January - ASIO provides Immigration with an adverse security assessment on Monis, assessing that his continued presence in Australia poses an indirect, and possibly a direct, risk to national security (but not in relation to politically motivated violence). ASIO recommends against the issue of a Protection Visa.

26 March - Monis is issued a new security guard licence (expiring 17 June 2000).

September - Immigration and ASIO agree to a set of procedures that would allow Immigration to offer natural justice to those Protection Visa applicants in Australia who are subject to adverse assessments – but would also reduce the risk that they might abscond into the community once informed that they had failed Public Interest Criteria (PIC) 4002.

November - ASIO commences an investigation into Monis.

2000

25 February - ASIO conducts another security assessment interview of Monis. Following the interview, a formal assessment is undertaken and ASIO assesses that Monis does not pose a direct or indirect risk to national security and determines that there are insufficient grounds for issuing an adverse assessment. The new assessment supersedes the previous adverse assessment. March Monis ceases receiving support via the Asylum Seeker Income Support scheme.

25 July - ASIO advises Immigration that it does not assess Monis to be a direct or indirect risk to national security. ASIO ceases its investigation.

23 August - Monis (as Manteghi) is granted a Protection Visa.

November - Monis stages a hunger strike outside the Western Australian Parliament House with the purported intention of convincing the Iranian Government to allow him to see his children in Iran.

17 December - On SBS Farsi language radio Monis makes negative comments in relation to the Australian Government, and blames ASIO for delays he experienced during the visa application process.

2001

January - Monis stages a protest outside the NSW Parliament with the purported intention of convincing the Iranian Government to allow his family to come to Australia.

13 February - 13 August - Monis receives Newstart payments.

April - INTERPOL Canberra alerts Immigration that INTERPOL Tehran has advised that Monis (as Manteghi), who they believe is in Australia, is wanted by Iranian authorities for ‘fraud-related offences’. INTERPOL Tehran requests advice on the possible extradition of Monis and provisional arrest on the alleged visa fraud offences committed in Iran.

May – December - Immigration makes repeated requests that INTERPOL Tehran provide relevant documentation relating to the charges. INTERPOL Canberra (on the basis of advice from the Commonwealth Attorney-General’s Department (AGD) also advises Tehran that no extradition relationship exists between Australia and Iran, and that it is not possible to arrest Monis with a view to extradition. No arrest warrant or summary of specific charges against Monis is ever received and in the absence of the requested information no further action is possible and INTERPOL Canberra finalises the case.

20-28 August - Immigration investigates allegations (from another Protection Visa applicant from Iran) that Monis was involved in people smuggling, but finds insufficient information to continue the investigation.

12 September - Monis calls the ASIO public line and volunteers information alleging Iran funded the September 11 attacks. Monis also passes this information to at least one partner agency, and possibly the media. ASIO initiates an investigation and interviews Monis on two occasions in the following days. During one interview, Monis asks whether he might receive a reward from the US Government for his help.

ASIO further interviews Monis in late September 2001, October 2001 and January 2002. These interviews are conducted jointly with a partner agency. After investigating the information provided, both ASIO and the partner agency assess that Monis’s claims are not credible. ASIO ceases its investigation in September 2002.

October – November - In addition to the interviews conducted with partner agencies, ASIO interviews Monis alone on a number of occasions. However, the information he provides is ultimately determined to be not relevant to national security.

2002

March - Monis tells ASIO about an apparent planned protest at the Iranian Embassy in Canberra.

August 2002 – December 2003 - Monis allegedly commits sexual assault offences while representing himself as a spiritual healer and clairvoyant. He is not charged with any sexual offences until 2014.

September - Monis legally changes his name from Mohammad Hassan Manteghi to Michael Hayson Mavros.

11 October - Immigration receives Monis’s (as Mavros) application for Australian citizenship.

7 November - Immigration conducts an initial citizenship interview with Monis.

20 November - Immigration refers Monis’s citizenship application to ASIO for assessment.

2003

16 January - ASIO requests Immigration place a ‘stopper’ on Monis’s citizenship application to allow ASIO to conduct a security assessment.

17 April - Monis’s application for citizenship is deferred to enable further assessment of character requirements under the Australian Citizenship Act 1948.

18 June - ASIO interviews Monis after he calls the ASIO public line to express concern over the delay of his Australian citizenship application.

17 – 22 September - Monis travels to Fiji.

29 October – 5 November - AFP investigates allegations by a community contact that Monis may be an Iranian Government intelligence officer deployed in Australia to gather intelligence and commit acts of violence against Australians. No offences are identified and AFP finalises its case.

2004

27 January - ASIO, internally, recommends a non-prejudicial security assessment be issued with respect to Monis’s citizenship application on the basis that there are no security grounds for assessing that he poses a direct or indirect risk to security.

May - Monis contacts Immigration and requests an explanation as to why his application has been delayed.

2 July - Monis’s legal representatives contact Immigration about the delay, advising that Monis believes the delay is because he is a Muslim and is being treated differently to others.

1 September - ASIO formally advises Immigration that Monis is assessed as not being a direct or indirect risk to national security and ASIO advises it will delete the MAL entry.

16 September - Monis’s citizenship application is approved.

20 October - Monis is granted Australian citizenship.

30 – 31 October - Monis travels to New Zealand.

25 November – 2 December - Monis travels to Canada.

2005

Throughout 2005 - Monis makes a number of overseas trips: to Bahrain, Malaysia, Canada, New Zealand, Singapore, Thailand and Fiji.

17 February - Monis calls the ASIO public line to ask if it is legal for him, as an Australian citizen, to meet officials of other foreign governments, including during a planned upcoming holiday. Monis also claims to have information on Ron Arad, an Israeli airman missing in action since 1986.

15 July - Monis calls the ASIO public line and claims to have urgent information relating to suicide attacks. ASIO meets him on the same day. Monis provides a hypothesis he has developed following the London bombings the week prior. He asks that this hypothesis be passed to UK and US intelligence agencies. Separately, Monis claims he has contacts with information on al-Qa’ida and other similar groups, and offers to assist ASIO. ASIO assesses the information provided by Monis is not credible.  Monis also raises concerns that the Australian government is ‘harassing’ Muslim clerics, noting he was searched at Sydney airport following a return trip from overseas.

22-26 July - Monis calls the UK High Commission, states he is a Muslim cleric and alleges that he has information about the London bombings. Monis follows up with a fax to the AFP and the AFP advise Monis that his information would be provided to the UK authorities.

2006

Throughout 2006 - Monis travels to Hong Kong and makes five separate trips to Thailand.

August 2006 – December 2006 - Monis allegedly commits further sexual assault offences while representing himself as a spiritual healer and clairvoyant. He is not charged with any sexual offences until 2014.

21 November - Monis legally changes his name from Michael Hayson Mavros to Man Haron Monis.

2007

February - Monis calls the ASIO public line and requests a meeting. During the meeting, Monis says he wants to become a teacher of Islam in the community so he has changed his name to be more readily identifiable as a Muslim. He says he intends to teach Muslim youth in order to steer them away from terrorism. To help achieve this he says he will temper his pro-Western views (sic) in order to connect. He offers to become a source for ASIO and provides a three page ‘plan’ outlining the offer. ASIO declines the offer.

Following the meeting, ASIO internally reconfirms contact with Monis should not be pursued, citing concern about his motivation for contact, his unusual behaviour and that he has provided no information of security relevance.

5 July - Using the name Sheikh Haron, Monis writes a letter of complaint to Channel 7 expressing concern about comments made by an academic on the ‘Sunrise’ program on 4 July. The story related to the arrest of Dr Mohammed Haneef and Muslim doctors in the UK. Amongst other things, Monis claims it indirectly promoted terrorist acts. Monis forwards a copy of this letter to ASIO in late July.

18 – 24 July - Monis travels to Thailand. Late July Using the name Sheikh Haron, Monis begins sending letters, faxes and media releases to a range of recipients including the then Prime Minister, Federal Leader of the Opposition, Federal Attorney-General and AFP Commissioner. He copies these letters to ASIO.

30 August - Monis registers the domain name ‘sheikhharon.com’ with a Melbourne-based register and a US-based internet provider. He creates the website www.sheikhharon.com and begins posting inflammatory and provocative statements, including media releases, copies of the letters he sends and responses.

Late 2007 - Monis’s behaviour becomes more provocative as he begins sending offensive letters to the families of Australian soldiers killed in Afghanistan.

2008

February 2008 – September 2010 - Monis allegedly commits further sexual assault offences while representing himself as a spiritual healer and clairvoyant. He is not charged with any sexual offences until 2014.

February - NSW Premier’s office refers a fax from Monis to the AFP regarding Monis’s previous warnings of potential terrorist-related attacks in Australia and his grievances with the AFP (which he claims is corrupt and unjust).

20 March - AFP identifies Monis as a person of interest in relation to the visit to Australia by Pope Benedict XVI for World Youth Days. He had previously displayed obsessive preoccupations and fixated interest in High Office Holders and dignitaries.

April - Monis purports to write a ‘fatwa’ on his website, referring to US, UK and Australian heads of state as war criminals. He sends a DVD of the fatwa to ASIO. The ‘fatwa’ is phrased as a general requirement for Muslims to respond to war crimes, and not as a specific threat to individuals.

April - ASIO commences an investigation into Monis given his continuing inflammatory public statements.

May - Monis posts a video clip titled ‘Suicide fatwa’ on his website in which a female protégé of Monis’s discusses ‘legitimate suicide attacks’.

21 May - Monis writes to the then Federal Opposition Leader alleging that explosions in shopping centres (reported in the media) and fires were the result of terrorist incidents.

3 June - Monis and an associate conduct a protest at Parliament House in Canberra, criticising the Channel 7 ‘Sunrise’ program broadcast on Muslim doctors.

June and July - Monis holds protests in Martin Place, Sydney relating to the concerns he raised previously about a Channel 7 ‘Sunrise’ program aired in July 2007. AFP provides support to NSW Police Force at the protest on 16 June.

July - Monis writes to the then Commonwealth Attorney-General expressing concern about, and drawing to the Commonwealth’s attention to, the availability of material which he believes supports or incites suicide attacks by non-Muslims.

10 July - An officer from the Office of the Inspector-General of Intelligence and Security reviews the ASIO investigation that began in April 2008, and concludes the correct procedure has been followed.

July – August - Monis writes a series of letters to then Qantas CEO, claiming recent mechanical faults are the result of sabotage ‘terrorist attacks’. This letter is later sent to the National Security Hotline (NSH), which refers the matter to ASIO, AFP and all State and Territory police forces.

August - In a post on his website, Monis objects to media reports that he had said Muslims were obliged to commit suicide bombings ‘when the enemy attacks’. He says the reports are misleading and clarifies there are only limited circumstances when this is true, explained elsewhere on his website.

Early September - The Sheikh Haron website carries a statement that there will be an attack on 11 September. The ‘attack’ turns out to be ‘Sister Fatimah’, an apparent acolyte and convert from Hinduism to Islam, ridiculing Hinduism and smashing a statue of the Hindu god Ganesh.

Late September - Monis issues a statement on his website in support of the mujahidin in Pakistan, saying ‘I hope one day I will be able to Jihad in the higher levels as you do’.

6 November - ‘Hizbullah Australia’ – a group registered by a close associate of Monis – sends a letter to the then Commonwealth Attorney-General (with copies to the then Prime Minister, Opposition Leader, Foreign Minister and to ASIO) stating the group is now registered in Australia and hopes to begin activity as an Islamic organisation. ASIO assesses the letter to have been written by Monis.

9 November - Monis sends a letter to the families of the Bali bombers describing the bombers as martyrs. He writes that while he would like Australia to be safe, the Australian Government’s actions make it unsafe. He ‘promised’ Muslims would attack Australia, and Australians would be killed. He sends a media release about this statement to various media outlets, the Saudi Embassy in Canberra, the Australian Embassy in Jakarta, and Buckingham Palace. ASIO assesses that, while this could be interpreted as Monis making a threat, it could equally be interpreted as him expressing his view that Australian Government policy could incite others to take action.

18 November - The Queen is sent a DVD featuring a woman warning, on behalf of Monis, of threats to Australia. The AFP briefs the Commonwealth Director of Public Prosecutions – no offences are identified.

5 December - ASIO’s analysis of the results of the investigation of Monis finds:

• there is no information to indicate Monis’s known associates, in Australia and overseas, are of security concern

• Monis is not involved in politically motivated violence or the promotion of communal violence

• the www.sheikhharon.com website does not pose any significant threat to security.

ASIO’s final assessment notes that Monis: ‘was not involved in politically motivated violence and has not tried to incite communal violence. While [Monis] endeavours to use language that is ambiguous and open to interpretation, he makes sure not to cross any lines and tries to ensure he can protect himself from allegations of inciting terrorism’.

2009

Throughout 2009 - Regular NSW Joint Counter-Terrorism Team (JCTT) meetings discuss Monis’s activities. Issues discussed include his public statements, including speculation the 2009 Victorian bushfires were an act of terrorism perpetrated by Islamist extremists, and potential charges arising from the letters he sent to the families of Australian soldiers killed in Afghanistan .

21 January - ASIO concludes its investigation of Monis.

27 January - JCCT Sydney commences an investigation into the offensive letters and DVDs Monis sent to the families of Australian soldiers killed in Afghanistan and High Office Holders (no counter-terrorism offences are identified during the consideration of charges).

12 March - US Secret Service contacts the AFP about another DVD (with a purported ‘fatwa’ against President Obama) which Monis had sent to the US broadcaster NBC in December 2008. In June, JCTT Sydney briefs the Secret Service that Monis is not perceived as a terrorism threat, but that his actions may be causing offence to numerous people.

April - In a summary of JCTT interest in Monis, NSW Police note that, over time, Monis has been assessed by a number of agencies (including NSW Police, the AFP and ASIO) as not posing a threat to national security.

28 July - ASIO provides a report to Commonwealth and State agencies on Monis, stating that while he uses provocative and inflammatory language, he has not articulated a specific threat. The report states that, ‘at this time, there is no indication Sheikh Haron or his associates are likely to personally engage in violence’. As a result, ASIO investigations find no indication of a threat to national security.

26 August - The NSW Police Force brief the AFP that Monis has not displayed any propensity for politically motivated violence, yet appears to have the potential to influence members of the community who are susceptible and may be desensitised to violent activities. Monis’s persistent correspondence and the nature of his rhetoric is an indication of his desire to seek attention from government authorities and the Australian media. NSW Police Force assess that they cannot discount that Monis’s objective may be an attempt to radicalise or influence others.

16 October - Monis alleges that ‘terrorists’ attacked his residence in an attempt to kill him, but were unable to locate him. Over the following days, Monis reports the alleged attack to NSW Police Force and the AFP. The AFP invites Monis to attend an interview to discuss the allegations but he does not accept.

17 October - Monis faxes NSW Police Force a media release on the possibility of a terrorist attack in Australia.

20 October - The AFP arrest and charge Monis with seven counts involving postal offences in relation to sending offensive letters to families of Australian soldiers killed in Afghanistan. 22 October Monis’s website is suspended at the request of the AFP.

31 October - INTERPOL Tehran advises INTERPOL Canberra that Monis is still wanted by Iranian authorities in relation to fraud offences.

3 November - Monis is issued with court attendance notices for postal services offences and granted bail. Monis remains on bail until convicted in August 2013.

2010

January - Monis posts a video on YouTube stating that he has sent a letter to the UK Prime Minister relating to the death of UK soldiers.

8 January - Monis begins receiving Austudy. From now until 11 December 2014, he will alternate between periods of Austudy, periods of Newstart, pauses in payments while incarcerated, and periods where he did not seek support.

11 May - Monis is charged with a further six postal service offences. One charge was discontinued during subsequent proceedings.

July - Monis pleads not guilty to the postal service offences.

2011

27 July - Monis is charged with intimidating his now former partner. He is granted conditional bail and an interim Apprehended Domestic Violence Order (ADVO) is made.

23 November - In the context of Royal visit to Australia as part of the Commonwealth Heads of Government Meeting (noting that Monis had previously written to the Queen), the AFP identifies Monis as a person of interest fixated on Australian High Office Holders, assessing that Monis has an ‘apparent fixation on corresponding with, and subsequently attempting to embarrass/discredit, Australian Government and Law Enforcement agencies’, which suggests that he is likely to come to the attention of police in the future. The AFP distributes a profile of Monis to relevant agencies involved in CHOGM.

6 December - Monis’s appeal against his indictment on postal service offences is dismissed by the NSW Court of Criminal Appeal.

14 December - Sydney District Court grants Monis’s request to vary his bail conditions (including to allow him to travel anywhere in Australia).

2012

30 May - Monis is found not guilty of the alleged intimidation of his former partner and no final ADVO is made. June Monis’s application for a security guard licence in NSW is refused on the grounds that he is not a ‘fit and proper person’ to hold a class 1ACG security licence. This assessment was informed by advice from within the NSW Police Force, including information about the postal service offence charges.

9 June - Monis attends protests by Hizb ut-Tahrir outside the Iranian, Saudi and Turkish Embassies.

22 June - The High Court grants special leave for Monis to appeal his postal service offences.

16 July - Monis applies for internal review of the decision refusing his application for a security guard licence.

27 July - The decision to refuse security guard licence application affirmed on internal review by a delegate of the NSW Police Commissioner under the Administrative Decisions Tribunal Act 1997 (NSW).

3-4 October - Monis’s appeal, based on a challenge to the constitutional validity of the postal offences in the Criminal Code (Commonwealth), heard by the Full Court of the High Court.

2013

January - Monis is reported to be linked to an outlaw motorcycle group.

27 February - Judgment is handed down by Full Court of the High Court. The Court split 3:3 on the question of validity. Therefore, the NSW Court of Criminal Appeal’s decision that the provision was valid was affirmed.

18 April - The AFP reviews Monis as part of a project identifying people who may be involved in, or connected with, the conflict in Syria and/or Iraq after his attendance at Syria-related protest activity. The AFP concludes that there is nothing to suggest Monis was directly linked to the conflict.

21 April - Monis’s former partner is murdered.

5 August - Monis pleads guilty to postal service offences and is convicted on 12 counts.

6 September - Monis is sentenced to 300 hours of community service, a two year good behaviour bond and a $1,000 surety.

15 November - NSW Police Force arrest and charge Monis with being an accessory to the murder of his former partner. Bail is refused and Monis is remanded in custody.

12 December - Monis is granted conditional bail in relation to the accessory to murder charges and is released on 17 December 2013.

2014

February - NSW Police Force, during the course of criminal investigations into Monis, seeks (through INTERPOL Canberra) a copy of Monis’s criminal history and information on a possible outstanding arrest warrant for Monis from INTERPOL Tehran.

9 February - Monis is banned from visiting NSW Correctional Facilities for 12 months following his refusal to be searched by correctional centre staff at Silverwater Correctional Centre.    March - INTERPOL Canberra provides fingerprints and other documents verifying Monis’s identity in March 2014. On 31 March 2014, INTERPOL Tehran advises that Monis does not have a criminal record in Iran, but was wanted for ‘defrauding Iranian citizens’. The Iranian arrest warrant for Monis had lapsed but INTERPOL Tehran advise that Iranian authorities would issue a new arrest warrant if Monis were to be arrested in Australia. NSW Police Force request details of the expired arrest warrant. This was the last communication between INTERPOL Canberra and Tehran before the 15-16 December Martin Place incident.

14 – 15 April - NSW Police Force charge Monis with three sexual assault charges, dating back to 2002. Bail is refused and Monis is remanded in custody.

16 April - Monis requests that the Parramatta Local Court investigate his allegation that NSW Police Force and ASIO are involved in the murder of his former partner. The request is denied.

26 May - Monis is granted conditional bail for the sex offence charges and released the following day.

10 October - Monis is charged with a further 37 sexual assault charges alleged to have occurred between 2002 and 2010. Bail for the previous indecent and sexual assault charges is continued for these new charges, with the additional condition that he is not to go near or try to contact any complainant or prosecution witness.

9-12 December - The NSH receives 18 calls and emails relating to Monis. Each call or email drew attention to his Facebook page.

All of these NSH calls and emails are referred to ASIO and the AFP (some are also forwarded to the NSW Police Force and Queensland Police) as they are received. ASIO assesses these Hotline reports on 9, 10 and 13 December, including a review of Monis’s public Facebook page by an ASIO analyst with relevant foreign language skills, and decided they do not indicate a desire or intent to engage in terrorism.

Reports that were referred to NSW are also considered by the NSW Police Force on the days they were received, and by the AFP prior to the siege. Both police agencies consider the Facebook posts contain no indications of an imminent threat. Nor are the postings assessed to meet the threshold for prosecution under new ‘advocacy of terrorism’ legislation.

NSW Police Force and the AFP close the referral.

12 December - Monis appears in the High Court (in Sydney) seeking to appeal his conviction for postal offences. The High Court does not allow Monis to appeal having regard to the history of the matter, including that the constitutional issues have already been considered and resolved against Monis.

15-16 December - Martin Place siege.

Three: Biographical information

Having left his wife and two children in Iran, Monis travelled to Australia in 1996 on a business visa, and promptly sought asylum. He then sought citizenship, which after an extended process he finally acquired on 24 October 2004.

Apart from a brief period in Western Australia in 2000, he resided in Sydney throughout his time in Australia.

From February 1997 to the time of the siege in 2014, Monis is known to have resided in at least 17 different locations in southern and western Sydney. His periods of residence varied from four to five months up to almost three years in several locations. He is also recorded as having resided in several locations for only four or five days (but he advised relevant authorities even of these very brief address changes).

During a six week period in 2000 in Western Australia, Monis was issued with four separate traffic infringement notices. He had previously recorded two infringements in NSW. From 2002 to 2012, he committed a further seven driving infringements, three of these resulting in his licence being suspended.

Over the 18 years that he lived in Australia, Monis was at different times on social benefits, was an employee and ran or was associated with businesses and incorporated associations.

He worked as a security guard on occasions between 1997 and 2000 (in 2012 he reapplied for a security licence but his application was rejected as he did not meet the test of being a fit and proper person). He worked as an employee in a Persian carpet retail business in Western Australia but was dismissed and subsequently had a claim for wrongful dismissal upheld by the Western Australia Industrial Relations Commission and was awarded compensation of approximately $14,000.

In July 1999, he registered an association known as Daffar-E-Ayatollah Manteghi Boroujer Incorporated. The association’s purported purpose was to promote spiritual matters through teaching and education and engaging in humanitarian, religious and charity work.

In July 2011, Monis applied to register IISIO Incorporated. The stated purpose of IISIO was to provide humanitarian assistance to mankind especially children and women, to promote peace and spirituality in society and to encourage people to live in harmony. It was also intended to research and provide information, intelligence and advice for the development of International Islamic policy-making about spirituality, culture, economy, education, science, technology, politic and security.

Also linked to Monis were the following entities:

• MHMB, registered in October 1998 and cancelled in January 2001.
• Spiritual Power, active effective July 2001; renamed ‘Spiritual Consultation’ in 2003 and cancelled in September 2014.
• Spiritual Counselling, registered in October 2002 and cancelled in September 2004.
• Holy Spirit Counselling, registered in January 2007 and cancelled in August 2012.
• Australian United Muslim Clerics Pty Ltd, commencing in January 2008 and deregistered March 2010.
• Hizbullah Australia, registered in September 2008 and cancelled in December 2011.

Monis entered the country with the legal name of Mohammad Hassan Manteghi. He formally changed his name twice: in September 2002, he changed his name to Michael Hayson Mavros. In November 2006, he again changed his name to Man Haron Monis. He was also known by a number of aliases.
In 2003, he met Noleen Hayson Pal. The relationship with Hayson Pal in later years at least was quite troubled. Hayson Pal sought an ADVO. The press has reported that there was a dispute over the custody of the children.
Monis claimed a number of religious/ideological affiliations over time:

• He claimed Shiite status of Hujatoleslam (a title provided to middle ranking scholars within Shia Islam).
• He claimed association with the Ahmadi sect to support his application for a Protection Visa.
• He claimed spiritual healing skills and sold related services (while in Australia).
• He presented more as a non-religious businessman in his Michael Hayson Mavros phase, indicating to ASIO that he was putting away his religious garb and was embracing a secular life.
• He subsequently adopted the apparently self-appointed title of Sheikh Haron to increase his standing and appeal in the Islamic community and unsuccessfully sought to build a following.
• Finally, he purported to have converted from Shia to Sunni Islam. Such a conversion is unusual.

For all but four of his 18 years in Australia Monis appears not to have travelled overseas. Then, from September 2003 to July 2007, he travelled overseas on 21 separate occasions including ten times to Bangkok. This travel was generally for less than a week and sometimes for only one day. Twice he flew to London and back in less than two days. The purpose of this travel is not known.

This period of intense travel ended, only to be immediately replaced with a program of heightened activism, with Monis sending around 60 letters, faxes and media releases to a range of people including high profile politicians, the Queen, the Pope and the families of Australian soldiers killed in Afghanistan.

Monis experienced bouts of mental illness. He presented at public hospitals on at least two occasions, was treated at a community mental health service between 2010 and 2011, and was assessed a further two times as part of Justice Health and Forensic Mental Health Screening assessment. Reviewing those cases, the NSW Chief Psychiatrist found that at no time in his multiple encounters with mental health professionals was Monis assessed to represent a potential risk to others or to himself.

Monis appeared to be attracted to intelligence agencies and clandestine activities. He regularly and persistently offered himself as an intelligence source, including to ASIO, initially indicating altruistic motives but often quickly seeking financial reward. He exaggerated his access to information and fabricated information, often tying his reporting to high profile topics which he would have known or assumed would have been of interest to authorities.

In 2013, Noleen Hayson Pal was murdered outside an apartment subleased by Monis. Monis’s new partner, Anastasia Droudis, was subsequently charged with the murder and Monis was charged as an accessory before and after the fact of murder.

There is information to suggest that during 2013 Monis sought association with an outlaw motorcycle group.

He was charged in 2014 with indecent and sexual assault offences dating from 2002.

He had a prolific social media and internet presence which reflected the varied and often contradictory aspects of his personality. He made inflammatory statements but would backtrack quickly.

He consistently pursued publicity. He chained himself to the gates of both the Western Australian and NSW Parliaments and protested on several occasions in Martin Place. He used events such as the September 2001 attacks in the United States, the London bombings and the 2009 Victorian bushfires to promote his own agenda and get the attention of agencies in Australia, for example claiming the bushfires were an act of terrorism. He actively courted the media – often approaching media outlets with claims similar to those he had provided to intelligence agencies.

Law enforcement and security agencies’ assessment of Monis

Monis was the subject of many law enforcement and security investigations and assessments over the period of his residence in Australia. None of these investigations or the continuous assessment of information related to Monis in the intervening periods provided any pointers into the Martin Place siege.

ASIO undertook four investigations of Monis over different periods; the basis for investigative activity changed over time. The first two investigations did not relate to politically motivated violence whereas the final two sought to determine his connections or involvement in politically motivated violence. Both were resolved with no further investigation warranted. The first three investigations also informed ASIO’s security assessments of Monis’s visas and citizenship applications. Ultimately, there were no concerns sufficient to derail his bid for a Protection Visa and subsequently citizenship.

In the period April 2008 to January 2009, ASIO investigated Monis to determine if he was of concern from a counter-terrorism perspective. The investigation found that Monis:

• was not involved in politically motivated violence and had not tried to incite communal violence
• had not expressed an intention to commit politically motivated violence
• was not in significant contact with known individuals or groups of security concern. In addition, none of Monis’s immediate circle of acquaintances were themselves in contact with known individuals or groups of security concern.

Accordingly, ASIO concluded that Monis was not a threat to national security.
Although the ASIO investigation of Monis had concluded, ASIO and police agencies continued to assess all new information received on Monis. In particular, Monis remained the subject of consideration and information exchange in the NSW JCTT including due to subsequent NSH referrals, his active social media presence and progress of non-national security-related criminal investigations. As a result, he was the subject of JCTT discussions on numerous occasions between 2008 and 2014.
During this period, law enforcement agencies also took forward several criminal investigations and subsequent prosecutions of Monis.

• In 2009, the AFP investigated Monis concerning possible charges in relation to the use of a postal service to menace, harass or cause offence. This arose from his sending of letters to families of Australian soldiers killed in Afghanistan.
• NSW Police Force also separately investigated his alleged involvement as an accessory before and after the fact of the murder of his former partner and alleged perpetration of sexual assaults. Monis was charged for these offences in November 2013 and April 2014 respectively.

The Review noted that, while not undertaken on national security grounds, the additional coverage these investigations provided of Monis did not identify any information to indicate Monis had either a desire or an intent to undertake an act of terrorism in Australia.

In April 2013, as part of its broader counter-terrorism remit and in light of the changes in Australia’s security environment, the AFP undertook a wide-ranging project to identify any Australians who may have been connected to the conflict in Syria. This project identified a large number of individuals for initial consideration and assessment – including Monis, given his public involvement in Syria related protest activity in 2012. However, the AFP concluded there was no information to suggest he was directly linked to the conflict and no further analysis was warranted.

A search of the NSH database showed 41 referrals in relation to Monis from 11 May 2004 until 12 December 2014, some of which were calls from Monis himself claiming knowledge of terrorist activities. 18 of the calls and emails to the NSH were received between 9 December 2014 and 12 December 2014. Each call or email drew attention to his Facebook page but provided no new information. Whilst controversial and potentially offensive, Monis’s internet and social media presence did not indicate a specific or a more generalised intent to undertake an act of politically motivated violence or to encourage others to do so.

ASIO assessed these Hotline reports on 9, 10 and 13 December, including a review of Monis’s public Facebook page by an ASIO analyst with relevant foreign language skills, and found they did not indicate a desire or intent to engage in terrorism.

These reports were similarly considered by NSW Police Force on the days they were received, and by the AFP prior to the siege. Both police agencies considered the Facebook posts contained no indications of an imminent threat. Nor were the postings assessed to meet the threshold for prosecution under new ‘advocacy of terrorism’ legislation (refer Chapter Nine).
The Review noted that Monis was well known to security and police agencies. He offered to work for ASIO on several occasions. He contacted intelligence and security agencies frequently, claiming to have information on terrorist attacks including September 11 2001, the London bombings in 2005, as well as information pertaining to a ‘missing Israeli Airman’ and contacts with access to information on al-Qa’ida.

He also publicly alleged that a number of Australia-based events such as the 2009 Victorian bushfires were terrorist attacks. On all occasions, he was assessed as having no credible information. He was a prolific writer of provocative and offensive letters, but did not cross the line into inciting violence.

Given his long history of provocative, attention seeking behaviour and unreliable or false claims, the Review was alert to the possibility that ASIO or the police might actually have become complacent about or even dismissive of Monis. There is no evidence this was the case. Each time security or law enforcement agencies received new information, it was assessed against their broader intelligence holdings and in accordance with their policies and procedures.

The Review placed special emphasis on identifying and considering Monis’s known activities and statements in the period leading up to the siege for possible indicators of his intentions or a shift in the threat he posed to security.

Pieces of information of potential security relevance are never considered in isolation by relevant agencies, but are considered holistically as part of a continuously developing body of intelligence and assessment about an individual or group.

In the current security environment, factors including an individual’s public renunciation of Shia for Sunni Islam or swearing allegiance to an unnamed ‘Caliph’ are not, in and of themselves, indicators of direct security concern. This is particularly the case when contrasted with others in Australia who give direct verbal and real practical support for proscribed terrorist groups such as the Islamic State of Iraq and the Levant (ISIL) or Jabhat al-Nusra. It is this latter group of individuals within Australia that ASIO and law enforcement agencies necessarily prioritise for investigation and disruption.

In the case of Monis, such potential indicators were assessed against considerations such as his long history of making provocative but deniable statements and the results of previous ASIO and law enforcement investigations. ASIO’s investigation and intelligence prioritisation processes are outlined in detail at Appendix I.

Ultimately, the Review found that right up until that fateful day in December 2014, and notwithstanding the fact agencies were familiar with Monis over many years and repeatedly examined his case and any new information that emerged, ASIO and law enforcement agencies never found any information to indicate Monis had the intent or desire to commit a terrorist act. While his language and sentiments were offensive, they were not exceptional, either in terms of his previous conduct or other material which is readily available.

Part 2: Monis's interactions with government

Four: Arrival, Protection Visa, Citizenship

The Review was asked to consider, and make recommendations in relation to Monis’s arrival in Australia and subsequent grant of asylum, permanent residency and Australian citizenship.

Key points

Monis arrived in Sydney, Australia on a 456 Business (Short Stay) Visa on 28 October 1996.

ASIO received potentially adverse intelligence about Monis on 4 November 1996. The information received did not relate to a terrorist threat to the Australian community or any intent by Monis to commit politically motivated violence.

Monis applied for a subclass 866 Protection Visa on 18 November 1996. In June 1998, Immigration assessed that Australia owed Monis protection under the 1951 Refugee Convention, subject to him meeting the requirements for a Protection Visa.

On 22 January 1999, ASIO recommended that a Protection Visa not be issued. ASIO reviewed this assessment in September 1999. On 25 July 2000, ASIO provided a new, non-prejudicial security assessment to Immigration.

Monis was granted a Protection Visa on 23 August 2000.

On 11 October 2002, Monis lodged an application for Australian citizenship. His citizenship application was approved on 16 September 2004 and he acquired citizenship just over a month later on 20 October 2004.

456 Visa (Business Visa)

On 1 October 1996, Monis applied for a subclass 456 Business (Short Stay) Visa at the Australian Embassy in Tehran, Iran (using his legal name). At that time, the Department of Immigration and Multicultural Affairs (Immigration) operations were conducted by locally-engaged staff. Immigration operations at the Embassy were supervised by the Department of Foreign Affairs and Trade staff in Tehran and Immigration staff from Islamabad, Pakistan.

Box 1: 456 Business (Short Stay) Visa: The 456 Business (Short Stay) Visa was available from 1997 to 2013, for short business visits to Australia for activities such as business meetings, seminars and training.

On his visa application, Monis incorrectly identified himself as a Legal Consultant to the Managing Director of the Iran Marine Structure Manufacture and Engineering Company. His stated purpose for visiting Australia was to meet with BHP Billiton. In fact, Monis was not a lawyer and held no such position. In support of his application, Monis would have provided a completed application form, his passport and supporting documents. There are no records of whether or how Immigration staff checked the veracity of Monis’s claims. Had they checked, Monis’s inaccurate claims may have been exposed and the visa may not have been granted. However, the Review acknowledges that the high volume of business visa applications at that time meant that Immigration inevitably had to take a risk-assessment approach in checking applicants’ claims. The Review notes that Immigration continues to use a risk-based approach today but, within the scope of this review, is unable to form a judgement on whether current immigration risk assessment models are effective and appropriate.

Immigration records indicate that Austrade ‘supported’ Monis’s visa application. While there are no records of Austrade preparing any letter or other documentary support for Monis, in 1996 letters of support were issued locally without central oversight. Austrade has advised the Review that BHP Billiton invited many Iranian customers to visit their offices and facilities in Australia in the mid-1990s. As BHP Billiton was a leading Australian exporter to Iran at that time, the local BHP Billiton representative had a practice of calling Austrade to advise that their customers were applying for visas to travel to Australia. Austrade staff would verbally inform the Immigration staff at the Australian Embassy that these applications would be forthcoming. Austrade staff had no further involvement in the visa application or assessment.

Today, Austrade maintains strict protocols around any official letters that staff prepare in support of any entities. A letter template is available for staff to follow in preparing these letters and all of them must be approved by a designated senior manager in Australia. In addition, all letters must only contain factual information and are strictly for the purpose of introducing an entity. In other words, these letters do not ‘endorse’ or ‘support’ the entity in any way.

In 1996, apparent Austrade support for Monis’s visit and his claim to be travelling with a business colleague (Monis eventually travelled to Australia alone) would likely have been taken as sufficient evidence that a genuine visit was intended.

Immigration referred Monis’s visa application to ASIO for routine checking, in accordance with standard profile-based security checking processes. ASIO assessed the application and issued a non-prejudicial assessment on 10 October 1996 (further information on ASIO assessments is in Box 8). Monis was subsequently granted a 456 visa, valid for one month from arrival.

Australia’s visa system, and the checks and balances within it, has changed significantly in recent years. The subclass 456 Business (Short Stay) Visa on which Monis arrived was repealed in March 2013: the short-term work rights related to the 456 visa were moved to a subclass 400 Temporary Work (Short Stay Activity) Visa, and the visitor elements to a subclass 600 (Visitor) Visa.

Immigration has advised the Review that Monis would be unlikely to receive a subclass 400 work visa today. The 400 visa has stricter and more clearly defined eligibility and evidence requirements that link the applicant to a clearly defined role and work or participation need in Australia. Applicants are required to demonstrate a need to undertake work or activities in Australia and to provide a range of supporting evidence, such as a letter of job offer or employment contract, or a letter of invitation from an Australian organisation.
The subclass 600 (Visitor) visa programme supports the entry of genuine tourists, business and family visitors. However, there is more rigour around this process now than existed in 1996. As part of the application process, clients must submit supporting documentary evidence, such as:

• certified copies of the identity page of a valid passport
• one recent passport-sized photograph
• evidence of access to funds for stay period
• other information to show that they have an incentive and authority to return to their country of residence.

In addition, the Australian Embassy website in Iran currently requests Subclass 600 visa applicants to provide:

• full details of countries they have resided in or visited in the last 10 years (including copies of relevant visas)
•  list of all family members in Iran and all other countries
• any immediate family members, relatives or contacts in Australia (including visa status in Australia)
• employment status.

Immigration has advised the Review that, even with these additional requirements, Monis would probably still be eligible for a subclass 600 (Visitor) Visa today.

 

Arrival

On arrival at Sydney International Airport on 28 October 1996, Monis stated his occupation on his Incoming Passenger Card as ‘Doing Business’. Customs records suggest that, when questioned at the entry control point, Monis claimed his business involved ‘carpets’. In 1996, Customs officers did not have access to Immigration records, so the discrepancy between Monis’s visa application and his Incoming Passenger Card would not have been obvious during border checks.

Today, Customs officers at the Entry Control Point are able to access some visa application information in real-time. However, the decision to do so would normally only be taken if a discrepancy in documentation was detected or abnormal behaviour observed and a ‘real time assessment’ conducted. In such cases, the traveller may be referred for secondary Immigration processing or questioning by the Customs Counter-Terrorism Unit if a national security risk is suspected. Immigration has advised the Review that the discrepancy between Monis’s Visa Application and his Incoming Passenger Card might still not be identified if he entered the country today.

Monis did not provide address details for his stay, although this was not unusual at the time.

Box 2: Movement Alert List (MAL)

At the time of Monis’s dealing with Immigration, the MAL system contained information about identity and documents of interest. MAL was used to inform visa and citizenship decisions and to identify non-citizens of interest at the time of their arrival in Australia.
In 2008, the decentralised MAL system was replaced by the Central Movement Alert List (CMAL). CMAL provides an improved operational and management system for records relevant to persons of interest as well as information pertaining to lost, stolen and fraudulent documents.

On 4 November 1996, ASIO received potentially adverse intelligence about Monis, although this information did not relate to a terrorist threat to the Australian community from politically motivated violence. ASIO responded by initiating an investigation into Monis on 5 November 1996. On the same day, Immigration listed Monis on the MAL database, at ASIO’s request. The effect of the MAL listing was to ensure that Immigration alerted ASIO in the event that Monis lodged any further visa applications.

On 18 November 1996, Monis applied for a subclass 866 Protection Visa (as Mohammad Hassan Manteghi).

Box 3: Protection Visa (subclass 866)

At the time that Monis lodged his application there were four key requirements for a Protection Visa to be granted:

• the applicant was found to be owed protection under the Refugees Convention
• the applicant had undergone the required medical examinations
• the applicant satisfied PIC 4001, 4002 and 4003
• the grant of the visa was in the national interest.

Protection Visa requirements are the same today. PIC are defined in Box 5.

On the same day, Monis was granted a subclass 010 (Bridging A) Visa.

Box 4 Bridging Visa

A subclass 010 (Bridging A) Visa is granted to applicants who hold a substantive visa (in Monis’s case, the subclass 456 Work Visa) when they apply for another substantive visa (in Monis’s case, the subclass 866 Protection Visa). The Bridging A Visa ensures the lawful stay of a non-citizen who, after maintaining lawful immigration status in Australia, has an ongoing matter before department.
In Monis’s case, as with other applicants for a subclass 866 visa, the application form for the Protection Visa is also an application for a Bridging A Visa. The Migration Regulations 1994 do not require security or criminality checks for this application.

The Bridging Visa allowed Monis to stay in Australia legally while his application for a Protection Visa was considered. This was consistent with the process used for a Protection Visa of this type at that time.

At that time priority was also given to processing Protection Visa applications from people in detention, over those who had arrived lawfully and were in the community. Monis’s application would not have been a priority.

Immigration advises that, in the absence of an adverse security finding from ASIO, Monis’s name being listed on the MAL database would not of itself have provided a basis for refusing him a Bridging A visa. If Monis arrived in Australia lawfully and applied for a Protection Visa today, he would still receive a Bridging Visa.

Monis submitted his claims in support of his Protection Visa application in April 1997. He claimed he was an Islamic Shia cleric engaged in gathering intelligence for foreign governments through his high-level political and religious contacts in Iran. Monis also claimed that if he returned to Iran, he would be executed summarily for cooperating with and leaking information to foreign governments, writing anti-Islamic poetry and associating with the Ahmadi sect. He further claimed that he was afraid the Iranian government would find out that he was in Australia and might try to assassinate him in order to prevent him from revealing politically sensitive information.

Amnesty International wrote a supporting letter to Immigration stating that Monis’s story was credible, and that it was reasonable to expect he would face arrest as a prisoner of conscience, torture, and possibly the death penalty if he was forced to return to Iran. On 6 January 2014 Amnesty International acknowledged to the media that it had been ‘conned’ by Monis.

Records from that time indicate that Immigration officers doubted aspects of Monis’s claims, including his claim to be associated with the Ahmadi faith. Immigration sought contextual advice from ASIO in July 1997 in an effort to assess his claims about working for foreign intelligence agencies. After Immigration interviewed Monis about his protection claims on 16 September 1997, a perceived lack of credibility was also discussed with ASIO.

Box 5: Public Interest Criteria (PIC)

PIC are defined in the Migration Regulations 1994 (Commonwealth) as follows: PIC 4001 Either: (a) the person satisfies the Minister that the person passes the character test; or (b) the Minister is satisfied, after appropriate inquiries, that there is nothing to indicate that the person would fail to satisfy the Minister that the person passes the character test; or (c) the Minister has decided not to refuse to grant a visa to the person despite reasonably suspecting that the person does not pass the character test; or (d) the Minister has decided not to refuse to grant a visa to the person despite not being satisfied that the person passes the character test. PIC 4002
The applicant is not assessed by ASIO to be directly or indirectly a risk to security. PIC 4003
The applicant:
(a) is not determined by the Foreign Minister, or a person authorised by the Foreign Minister, to be a person whose presence in Australia is, or would be, contrary to Australia's foreign policy interests; and
(b) is not determined by the Foreign Minister, or a person authorised by the Foreign Minister, to be a person whose presence in Australia may be directly or indirectly associated with the proliferation of weapons of mass destruction; and
(c) either:
(i) is not declared under paragraph 6(1)(b) or (2)(b) of the Autonomous Sanctions Regulations 2011 for the purpose of preventing the person from travelling to, entering or remaining in Australia; or
(ii) if the applicant is declared – is a person for whom the Foreign Minister has waived the operation of the declaration in accordance with regulation 19 of the Autonomous Sanctions Regulations 2011.

Immigration officers exercise discretion in assessing protection claims. The Review is not able to assess the specific judgments made by Immigration officers in 1997. However, the final decision to grant Monis a Protection Visa suggests that doubts about his claims did not trigger any of the PIC. The Review notes that it might also reflect how Immigration officers weighed the balance between applicants’ rights and national security considerations at the time.

In June 1998, Immigration assessed that Australia owed protection to Monis under the 1951 Convention relating to the Status of Refugees (The Refugee Convention, see Box 6). On 18 June 1998, Monis was informed that he needed to satisfy medical and public interest requirements to be granted a Protection Visa.
Immigration’s public interest assessment relates to character (PIC, 4001); national security (PIC 4002); and prejudicing relations with a foreign country (PIC 4003).
Immigration has advised the Review that at that time, there was no information about Monis that would have caused concern or led to the Department applying the character test associated with PIC 4001 (see Box 7).

Immigration has also advised that the character test would only be applied when there was an issue of concern. At the time, no agency had any information about Monis that would have triggered the character test (see Box 7).

Consistent with usual practice, Immigration formally referred Monis’s case to ASIO for a security assessment on 3 July 1998.
As part of the public interest requirements, Immigration received an AFP penal certificate on 24 August 1998, which indicated that Monis did not have a criminal record known to the AFP. This check related only to Australian based criminal convictions, as an offshore penal check (relevant to Monis’s residence in Iran) was not conducted. This is standard: penal checks for asylum applicants are not typically conducted with the country from which they are seeking protection. This is consistent with accepted international practice aimed at avoiding possible persecutory action by the home state, including persecution of family members.

ASIO conducted a Security Assessment Interview of Monis on 23 November 1998. On 22 January 1999, ASIO advised Immigration that Monis had been assessed not to have met the PIC 4002 and recommended that a Protection Visa not be issued. ASIO reconfirmed this advice on 25 February 19 February 1999, advising Immigration that Monis was assessed to be an indirect risk to Australian national security (per PIC 4002). The Review notes that this risk was not related to politically motivated violence.

The Review notes that Immigration considered options for cancelling Monis’s Bridging Visa in early 1999, but ultimately did not do so. Under the Migration Act, any Protection Visa applicant living in Australia on a Bridging Visa – and the subject of an adverse security assessment by ASIO – should have had their visa cancelled and been detained. While Immigration might have cancelled Monis’s Bridging Visa and detained him at this point, such an action would have been subject to legal appeals and natural justice procedures. Monis therefore remained in the community during this time.

Box 6: The Refugee Convention

At the time that Monis’s Protection Visa application was decided, and now:

• Under Article 1A of the 1951 Convention relating to the Status of Refugees and its 1967 amending Protocol (the Refugee Convention), Australia owes protection to a person who, owing to a well-founded fear of being persecuted for reasons of race, religion, nationality, membership of a particular social group or political opinion, is outside the country of his nationality or country of former habitual residence and, owing to such fear, is unable or unwilling to avail himself or herself of the protection of that country.
• Under Article 33 of the Refugee Convention, Australia is prohibited from returning refugees to their country of nationality or country of former habitual residence if a refugee’s life or freedom would be threatened for a Refugee Convention reason.

Similar obligations are expressed and/or implied in other international legal conventions to which Australia is a party.

Box 7: Public Interest Criteria (PIC) 4001 The Character Test

Section 501 of the Migration Act 1958 outlines key areas for visa refusal on character grounds (PIC 4001).

At the end of 1996, the Minister for Immigration had special power to refuse or to cancel a person’s visa or entry permit if s/he was satisfied that that person, if allowed to enter or remain in Australia, would:

• be likely to engage in criminal conduct in Australia
• vilify a segment of the Australian community 
• incite discord in the Australian community or in a segment of that community

or

• represent a danger to the Australian community or to a segment of that community, be liable to become involved in activities that are disruptive to, or violence threatening harm to, that community or segment, or in any other way.
• The Minister could also refuse or cancel a person’s visa or entry permit if – based on their past criminal conduct, association with people or groups involved in criminal conduct, or general conduct – s/he believed the person not to be of good character.
• Character provisions were strengthened in 1998 with the introduction of a formal character test. At the time that Monis was undergoing his PIC assessment, a person did not pass the character test if they:
• had a substantial criminal record
• had an association with someone else, or with a group or organisation, whom the Minister reasonably suspects has been or is involved in criminal conduct

or

• was not of good character (based on past and present criminal conduct and/or past and present general conduct).
• Or, in the event the person were allowed to enter or to remain in Australia, there was a significant risk that the person would:
• engage in criminal conduct in Australia
• harass, molest, intimidate or stalk another person in Australia
• vilify a segment of the Australian community
• incite discord in the Australian community or in a segment of that community

or

• represent a danger to the Australian community or to a segment of that community, whether by way of being liable to become involved in activities that are disruptive to, or in violence threatening harm to, that community or segment, or in any other way.

The Review notes that further amendments have been made to strengthen the character test since that time, most recently in December 2014.

Immigration and ASIO operate within the framework of administrative law, which includes principles of natural justice intended to protect the rights of individuals and their access to fair procedures. Natural justice incorporates ideas such as transparent legal procedures and reasons, the need for consistent and widely-understood rules, equality before the law, freedom from bias in decision-making, and the right to be heard: that is, a person affected by a legal decision has a right to present their views and any supporting evidence to the decision-maker before the decision is made. It also means that a person accused of doing something wrong has a right to be told what it is they are said to have done wrong and to be shown the evidence against them so that they can defend themselves against the accusation.

In an immigration context, providing natural justice would normally involve:

• notifying a Protection Visa applicant, in writing, of the information held by Immigration and/or ASIO that is adverse to their claims
• allowing them an extended period of time in which to respond.

In September 1999, Immigration and ASIO agreed to a set of procedures that would allow Immigration to offer natural justice to those Protection Visa applicants in Australia who were subject to adverse assessments – but would also reduce the risk that they might abscond into the community once informed that they had failed against PIC 4002 criteria.

As a result, ASIO decided to interview or re-interview all the adverse security assessment cases subject to the new procedures, including Monis’s. This was to ensure that applicants had the opportunity to give information directly to ASIO, and that they were aware that failure to meet national security criteria would affect their eligibility for a Protection Visa. ASIO requested that Immigration delay any action until after all reviews were completed.

Box 8: Security Assessment
ASIO may issue security assessments to the Department of Immigration and Border Protection (Immigration) in relation to the granting or holding of a visa, or citizenship application. A security assessment for a visa or citizenship application may entail extensive investigation or may be limited to checking intelligence holdings.
Under the Australian Security Intelligence Organisation Act 1979 (Commonwealth) (ASIO Act) ASIO is responsible for conducting security assessments including those related to people:

• wanting to enter or stay in Australia
• seeking access to classified material and designated security-controlled areas.

The purpose is to identify people who pose a threat to security and to ensure that government agencies take this security consideration into account in their decision-making. Under the ASIO Act (s4), security assessments in relation to the suitability of a person to hold a visa generally consider whether an individual poses a direct or indirect risk to security against the ‘heads of security’ – namely, espionage, sabotage, politically motivated violence, promotion of communal violence, attacks on Australia’s defence system or acts of foreign interference. Border integrity is an additional head of security today.
Assessments are completed by ASIO analysts. ASIO’s Office of Legal Counsel provides advice security assessments as required, including providing legal advice for the security assessment interview preparation, the intelligence case supporting the security assessment and the final decision record. Serious and careful consideration is afforded to each step of the assessment process that informs the final decision.
Once a security assessment is complete, ASIO will issue one of three forms of advice:

• A ‘non-prejudicial assessment’ which means advice or a recommendation which does not adversely affect the subject of the assessment. For example, the advice does not recommend against the grant of a visa.
• A ‘qualified security assessment’ which means where ASIO has information, advice or an opinion that is or could be prejudicial to the interests of the person and provides that information to a Commonwealth agency.
• An ‘adverse security assessment’ which means ASIO recommends that a particular action be taken or not taken, which would be prejudicial to the interests of the person, such as the refusal of a visa or cancellation of a passport.

Appeal mechanisms are also available to individuals who are subject to a qualified or adverse security assessment.
 

In Monis’s case, initial analysis by two separate ASIO analysts indicated he merited a further review. Consequently, ASIO started another investigation of Monis before interviewing him again on 25 February 2000.

The information gained from ASIO’s investigation, and from an additional interview with Monis, addressed a number of areas of concern. As a result, ASIO assessed that Monis did not pose a direct or indirect risk to national security. ASIO judged that there were insufficient grounds for issuing an adverse security assessment (per PIC 4002), and provided a new, non-prejudicial security assessment to Immigration on 25 July 2000.

At that time, specific details underpinning ASIO security assessments were not generally provided to Immigration. Immigration was not aware of the reasons for the original security assessment or why ASIO superseded that assessment.

Current immigration procedures are different. Today, when a person receives an adverse security assessment in relation to a Protection Visa application – even if that adverse assessment is later withdrawn – Immigration makes further enquiries about ASIO’s information, which may help to assess the credibility or otherwise of an individual’s protection claims¹.  The Review notes Immigration advice that a different outcome may not have been reached, even if this practice had been in place at the time of assessing Monis’s Protection Visa application.

On 23 August 2000, Monis was granted a Protection Visa. Immigration advised Monis that he could now apply for welfare assistance, a Medicare card, and sponsor relatives who lived overseas. The letter also encouraged Monis to apply for citizenship.

Citizenship

On 11 October 2002, Monis, who had formally changed his name to Michael Hayson Mavros on 17 September 2002, lodged an application for Australian citizenship.

Immigration conducted an initial citizenship interview with Monis (now Mavros) on 7 November 2002 to check Monis’s documents, English language ability and his understanding of the responsibilities and privileges of citizenship.

A criminal record check was also conducted and, as Monis was the subject of a MAL entry, Immigration referred the case to ASIO for assessment on 20 November 2002. On 16 January 2003, ASIO requested that Monis’s citizenship application be deferred until ASIO had provided an assessment. This was to ensure that he was not granted citizenship until ASIO had the opportunity to consider his relevance to security. Immigration records indicated that, on 17 April 2003, Monis’s application was deferred to enable further assessment of character requirements (under s14(1) of the Australian Citizenship Act 1948).

From February 2003 to July 2004, Monis, or his legal representatives, made a number of enquiries to Immigration and ASIO about the delay in finalising his citizenship application. In May 2004, Monis requested a letter from Immigration explaining why his application for citizenship had been deferred. Immigration records indicate that a letter was not sent, based on previous instructions from an Immigration Case Officer not to advise clients being investigated, to avoid jeopardising investigations. The Review notes that Immigration exceeded the maximum legal deferral period for making a decision on citizenship in Monis’s case.

ASIO undertook a non-prejudicial security assessment for Monis’s citizenship application on 27 January 2004. At that time, it assessed that Monis did not pose a direct or indirect risk to security. This assessment was finalised in September 2004, at which point Immigration was informed. ASIO then removed the MAL entry on Monis from the database.

After receiving ASIO’s assessment, Immigration requested an onshore police check and received a ‘clear’ response. Police checks were made under the names Michael Hayson Mavros, Michael Hayson and Mohammad Hassan Manteghi. Monis was not asked to provide an overseas penal clearance as, according to information he had provided, he had not spent significant time outside Australia since being granted a permanent visa. Immigration has advised the Review that it is the Department’s longstanding practice to independently check the periods applicants spend in and outside of Australia to ensure they meet the residence requirement for citizenship eligibility. The Review found no record of this, but it is likely that such checks were conducted for Monis.

Consequently, Monis met the residential qualifying period and character and security requirement for the grant of citizenship. Monis’s citizenship application was approved on 16 September 2004. He acquired citizenship on 20 October 2004.

If Monis presented to Immigration today, would the outcome of his visa and citizenship decisions be any different?

Immigration considers that the decisions to grant Monis visas and Australian citizenship were made in accordance with the law, policy and procedures of the time, although the Review notes that Immigration exceeded the maximum legal deferral period for making a decision on citizenship in Monis’s case.

Immigration has informed the Review that – in the current legal and policy context and with its existing capabilities and policies – Monis would likely be granted a visa and citizenship today if he presented in the same way as he did at that time.

If ASIO conducted a security assessment of Monis’s visa and citizenship applications today, would the outcome be any different?

ASIO has informed the Review that the decisions the agency made in the Monis case were in accordance with the law, policy and procedures of the time.

ASIO has advised the Review that security assessments of Monis’s visa or citizenship applications today – based on a consideration of the same material and operating under a similar legislative mandate that is substantially unaltered – would likely result in similar decisions being made on security grounds.

What could have been done differently?

The Review accepts that in Monis’s case, agencies adhered to the policies and procedures that existed at the time. However, it also notes that those policies and procedures did not prevent Monis from entering Australia and obtaining citizenship – and that there is no guarantee that it would not be the same today.

There may have been opportunities for intervention in the Monis case. There was a chance to recognise that Monis’s visa application, and therefore the basis on which the visa was issued, was fraudulent before he entered Australia. It appears that very few, or no, checks were made to ascertain the legitimacy of Monis’s application.

Conceptually at least, it would have been possible for Immigration officials responsible for Business Visa applications in Tehran to have tested Monis’s application by asking BHP Australia whether he was in fact expected as part of an Iranian customer delegation.

The Review recognises that in practice, the time and resources required to conduct similar checks for all incoming passengers would be enormous. Immigration and Customs officers operate in a high volume environment: Immigration will receive over five million visa applications and Customs will clear over 32 million incoming and departing air passengers this year. While these volumes were lower in 1996, it was still significant and visa and border decision-makers were less well supported at the time. Additionally, in Monis’s case, there were no indicators about him at that time that suggested the need for extra security checks.

Are any additional measures required?

The Review notes that the reform package announced by the Government in May 2014 is strengthening Australia’s borders through significant investment in core capability for intelligence and systems, trade, travel and enforcement. In particular, establishing a single Department of Immigration and Border Protection with an Australian Border Force will support the national security agenda.

The Review also notes that the relationship between ASIO and Immigration has developed considerably since these events occurred. The two agencies communicate regularly on strategic and operational matters, and there have been marked improvements in information sharing, risk management and improving channels of communication.

However, based on Immigration’s assessment that, in the same circumstances, Monis would likely be granted entry to Australia and citizenship if he presented in 2015, the Review considers that there is scope to improve existing Australian visa and citizenship processes.

It is important that Australia continues to enable an open society, promote cultural and business connections with the wider world and maintain our commitment to international legal obligations, including our obligations under the Refugee Convention. However, it is equally important that immigration processes – and the legislative and policy settings that enable them – reflect changing national security considerations.

Recommendations

The Review recommends that:

1. Immigration should review its internal connectivity and information sharing processes to improve the Department’s ability to verify the initial supporting information provided by visa applicants wishing to travel to Australia.

2. Immigration should better assess the possible risks posed by individuals at the pre‑visa, post-visa and pre-citizenship stages.

3. Immigration should propose policy and legislative changes necessary to support decisions to grant or revoke an initial visa, subsequent visas and, citizenship.

Five: Social Support

The Review was asked to consider and make recommendations in relation to any support received from, or any other interactions Monis had with, government social support agencies.

Key points

Monis received government-funded income support for about seven and a half of the 18 years he lived in Australia. He appears to have supported himself through a variety of jobs and businesses during the other eleven years.

Monis was generally a compliant income support client. The Review did not find evidence he attempted to defraud welfare, nor did he receive welfare while in jail.

Beyond this, Monis interacted with and received non-income social support from:

• NSW Health, including public hospitals, ambulance services, community mental health and the Justice Health and Forensic Mental Health Network

• The NSW Department of Family and Community Services (FACS)

• Legal aid support.

Asylum seeker assistance income support

While awaiting an outcome on his application for a Protection Visa, Monis received support through the Asylum Seeker Assistance Scheme. Monis became eligible for assistance in July 1997.

Over the period July 1997 to March 2000, Monis received income support under the scheme. During this time, there were periods totalling four months where assistance under the scheme was suspended because Monis was working. Support under the scheme ceased in March 2000 after he took up a full-time position.

Box 9: Asylum Seeker Assistance Scheme

The Commonwealth established the Asylum Seeker Assistance Scheme in 1992. It assists Protection Visa applicants with basic living needs like food and shelter while they await the decision on their visa application.

Newstart and Austudy income support

For periods totalling about five of the 18 years he lived in Australia, Monis received income support through either Newstart Allowance or Austudy. He received Newstart for approximately four years and Austudy for approximately one year.

After working at a Persian carpet retail business for about 11 months, Monis (as Manteghi) was dismissed from that job and began receiving Newstart. This support began on 13 February 2001 and continued until 13 August 2001. Centrelink cancelled the support on 14 August 2001 after Monis advised that he had started earning income.

Monis received no further income support for the next eight and a half years. It appears he supported himself with money made through his spiritual consultation business during this time.

On 8 January 2010, Monis began receiving Austudy. Thereafter, he would receive either Newstart or Austudy up until the Martin Place siege, with several breaks where he received no support of any kind.

Box 10: Newstart Allowance and Austudy
Newstart Allowance is financial help for residents looking for work, supporting them while they undertake activities to increase their chances of finding a job.
Austudy is financial help to full-time students and Australian apprentices aged 25 or more.

The first break occurred between 28 February 2011 and 7 April 2011. The Department of Human Services’ (DHS) records indicate that Monis did not seek any income support during this time. The reasons for this are not clear.

The other breaks occurred during Monis’s imprisonment. DHS suspended Monis’s Newstart for both of his periods of imprisonment: from 16 November 2013 to 16 December 2013 (the accessory to murder charge); and 14 April 2014 to 26 May 2014 (the sexual and indecent assault charges).

Monis received Newstart while he was on bail. Persons on bail may continue to receive Newstart provided they continue to meet their activity test requirements. These include looking for work, undertaking work experience and participating in training to improve job prospects. Monis met these activity requirements during this period. Chapter Six provides further detail on Monis’s bail.

Once formally advised of Monis’s death, DHS cancelled his Newstart payments from 11 December 2014.

Non-income social support Monis interacted with and/or received non-income social support from a number of government social support agencies, including NSW health agencies and FACS.

FACS has records of interactions with Monis following reporting of concerns relating to welfare of his children. These concerns were not about Monis or his actions, were investigated, and were not substantiated, and this information was appropriately shared between FACS, NSW Police Force and NSW Education.

NSW Health services Monis received treatment for mental and physical health conditions from the NSW Health services, including public hospitals, ambulance services, and community mental health between 2010 and 2011.

The Health Records and Information Privacy Act 2002 (NSW) prohibits the Review from releasing details of Monis’s medical history. That said, the Review has had access to these records and they have informed the judgements reached in the Review.

In September 2011, Monis had a final outpatient appointment with a community mental health centre and was discharged. The practitioner’s records from the final consultation note that he had ceased his medication for three months and had been well.

Monis also had the standard reception screening assessments by the Justice Health and Forensic Mental Health Network on the two occasions he was refused bail for alleged criminal offences. The first occurred in November 2013 in relation to his alleged involvement in the murder of his ex-partner. He was cleared as being fit for the correctional centre community. The second occurred in April 2014 in relation to the sexual assault offences. Monis underwent a reception screening assessment and a Mental Health Assessment and was cleared as having no mental health issues. He was later cleared for normal cell placement. Monis did not disclose any history of mental health issues on either occasion.

The Review Team asked the NSW Chief Psychiatrist to review the medical documentation relating to Monis. The NSW Chief Psychiatrist agreed with the treatment decisions. His preliminary conclusions were that at no time in his multiple encounters with mental health professionals was there evidence that Monis represented a potential risk to others or to himself. Further, at no time was there a necessity for him to be admitted to hospital for treatment of mental illness, or to receive coercive or more restrictive care.

Box 11: Mental Health – should Monis have been detained for mental health treatment?
The fact that a person has a mental health problem does not mean they pose a threat to public safety.
Detaining a person without their consent is a drastic measure. As a result, the rules that manage this risk, such as those in the Mental Health Act 2007 (NSW), are stringent and demanding to balance the need for public safety against an individual’s needs.
For a person to be detained without their consent in NSW, the person must have a condition that seriously impairs, either temporarily or permanently, their mental function and be at risk of seriously harming themselves or other people.
A risk of serious self-harm or a risk of serious harm to someone else is determined by the assessing doctor. It may be found to exist if, for instance, an individual is hearing voices (a symptom of mental illness) and these voices are telling the individual to do things that he or she would not normally do and this poses a serious risk to the individual or another person.
The Review Team asked the Chief Psychiatrist to review the medical documentation relating to Monis. The Chief Psychiatrist agreed with the treatment decisions. His preliminary conclusions were that at no time in his multiple encounters with mental health professionals was there evidence that Monis represented a potential risk to others or to himself.
 

Do the circumstances of Monis’s social support point to a need to change any legal and policy settings?

Monis was a compliant income support client. Records indicate he undertook the Newstart activity requirements. He reported that he had looked for work, undertaken work experience and attended training. On some occasions he told DHS of changes to his circumstances that might adversely impact his benefits, such as receiving income from other sources.

The Review found no evidence that Monis used his aliases to receive additional benefits. While he did claim income support under two different names, both were his legal name at the times he was using them. In addition, when Monis began the second period of claims, he voluntarily disclosed to DHS that he used to be known as Manteghi. He also provided legitimate documentation as evidence that he met Centrelink’s income and asset eligibility requirements.

Where legal and policy frameworks required that Monis’s income support cease, social support agencies duly cancelled or suspended that support.

Sharing personal information with law enforcement and national security agencies.

Chapter Eight sets out the arrangements under which government agencies can share information with law enforcement and national security agencies. This includes the arrangements under which law enforcement agencies can obtain personal information from social support agencies, and those under which social support agencies may disclose personal information to law enforcement.

It is the policy and practice of NSW social support agencies to report individuals who have engaged in acts of violence to law enforcement – not simply because their rules and procedures require it but because it is common sense, particularly to protect their staff.

How did Monis make money when he was not on income support?

The Review’s understanding of Monis’s employment and business history during the twelve years he was not on government funded income support is patchy and incomplete.
That said, the Review found evidence that Monis did indeed make money through a variety of jobs and businesses during the eleven years he was not on income support.

Records of Monis’s Asylum Seeker Assistance Scheme support indicate there were breaks in his support because he was working for periods totalling about four months between 1997 and 1998. This may have been security work, given he received a security guard licence in March 1997. Other records also suggest he was employed by a security company in 1997. Monis worked at a Persian carpet retail business between March 2000 and February 2001. He may also have worked in a Persian carpet business on arrival in Australia in 1996.
Monis’s first period of Newstart support, which began in February 2001, ceased in August 2001 after he requested DHS cancel the payment because he was earning income. However, he declined to provide any details of the employer.

Monis registered a number of businesses, and these may have been a source of income. In 2001 he registered a business called ‘Spiritual Power’, whose name he later changed to ‘Spiritual Consultation’. Monis reported Spiritual Power’s main business activity as ‘spiritual consulting serv [sic] spiritual healing for society’. This is likely the source of income that led him to stop seeking Newstart in 2001. In the mid 2000s, Monis also registered businesses called ‘Holy Spirit Counselling’ and ‘Australian United Muslims Clerics’. It is not clear if these were a source of income for Monis.

Six: The Justice System

The Review was asked to consider, and make recommendations in relation to the interaction of Monis with the NSW justice system.

Key points

Monis was on bail for serious violence offences at the time of the siege. He had been granted bail on charges of being an accessory before (and after) the murder of his estranged partner, Noleen Hayson Pal, who died on 21 April 2013. He had also been granted bail for numerous sexual offences. Monis allegedly encountered his victims while holding himself out as a spiritual healer and clairvoyant between 2002 and 2010.

The bail decisions in relation to Monis were carefully scrutinised by police and prosecuting authorities. Consideration was given to challenging the decisions, however, under the law in force at the time, and given the circumstances of Monis’s case, it appears it was considered that there was not sufficient basis for such applications to be successful. The Coroner will examine how Monis came to be granted bail and the response of police and prosecuting authorities to bail for the charges Monis was facing at the time of the siege.

NSW bail laws have undergone an intensive period of reform during the last two years and the effectiveness of these laws continues to be closely monitored. New bail laws, which came into force on 28 January 2015, include a strict ‘show cause’ requirement before bail can be granted in cases where serious charges are alleged.

The Review has also identified opportunities for potential further reform of bail laws to facilitate taking into account links of the accused to violent extremist organisations in making bail decisions.

In undertaking and reporting on this aspect of the inquiry, it has been necessary for the Review to be mindful of the fact that a criminal trial is currently pending in respect of the alleged murder of Monis’ estranged partner, for which Monis had been charged as an accessory.

Criminal charges and related proceedings against Monis

Allegations of Fraud

In April 2001, INTERPOL Tehran approached INTERPOL Canberra to advise that a person of interest known as Mohammad Hassan Manteghi (Monis), wanted by Iranian authorities for fraud related offences, was believed to be in Australia.

The Australian Department of Immigration and Multicultural Affairs (Immigration):

• confirmed Monis’s immigration status in Australia
• requested that Iranian authorities provide further details on the fraud allegations.

Between May and December 2001 (acting on Immigration’s requests) INTERPOL Canberra made at least three requests of INTERPOL Tehran seeking a copy of Monis’s arrest warrant. A summary of the charges against him and a photograph for identification purposes were also requested. No arrest warrant or summary of specific charges against Monis was ever received from INTERPOL Tehran.

The Review notes that:

• In May 2001, INTERPOL Canberra (on the basis of advice from AGD) advised INTERPOL Tehran that no extradition relationship existed between Australia and Iran, and that it was not possible to arrest Monis with a view to extradition.
• Even if Australia had been legally able to receive an extradition request for Monis, he had been granted a Protection Visa prior to Iran’s initial 2001 extradition enquiry. Australia’s obligations under the International Refugee Convention 1951 would have prevented Monis’s extradition to Iran.

In February 2014, during the course of criminal investigations relating to charges against Monis for accessory before and after the fact to murder and sexual assault charges, NSW Police Force sought (through INTERPOL Canberra) a copy of Monis’s criminal history and information on a possible outstanding arrest warrant for Monis from INTERPOL Tehran. INTERPOL Canberra provided INTERPOL Tehran with fingerprints and other documents verifying Monis’s identity in March 2014.

On 31 March 2014, INTERPOL Tehran advised that:

• Monis did not have a criminal record in Iran, but was wanted for ‘defrauding Iranian citizens’, and
• The Iranian arrest warrant for Monis had lapsed and that Iranian authorities would issue a new arrest warrant if Monis were to be arrested in Australia.

New South Wales Police requested details of the expired arrest warrant. This was the last communication between INTERPOL Canberra and Tehran before the 15-16 December Martin Place siege.

Australia does not have a bilateral extradition treaty with Iran. In 2001 (and currently) Australia could receive an extradition request from Iran only if the offences for which the extradition was sought fell within the scope of a multilateral convention with extradition obligations to which Australia and Iran were both parties. On the basis of the information available, the alleged fraudulent conduct was not within the scope of a relevant multilateral convention in 2001.

By 2014, both Australia and Iran were parties to the United Nations Convention against Corruption. If Iran had provided an arrest warrant for a charge of fraud and other information required for an extradition request, such as detailed information about the alleged conduct and offence provisions, Australia would have been able to assess whether Monis’s alleged fraudulent conduct was relevant under the Convention.

There was no legal basis for Australia to arrest Monis in response to the inquiries made by Iran in 2001 or 2014 on the basis of the very limited information provided by Iran.

At the instigation of the Review, the AFP through INTERPOL Canberra contacted INTERPOL Tehran again for any information relating to Monis’s criminal history in Iran. At the time the Review was finalised, no response had been received to this request.

Charges for the use of a postal service to menace, harass or cause offence

From November 2007 to August 2009, Monis sent offensive letters to the families of Australian soldiers killed in Afghanistan. He also posted copies of those offensive letters on his ‘Sheikh Haron’ website. Monis was charged by the AFP in relation to this conduct in November 2009.

The proceedings were subject to extensive constitutional argument, with Monis claiming that the Commonwealth Criminal Code, in its application to offensive communications, was invalid as infringing the implied freedom of communication on political and governmental matters. That question was resolved against him as a result of decisions made in the District Court, the Court of Criminal Appeal and the High Court.

The final decision by the High Court involved an even split between the six Justices who heard the case. As a result, the Court of Criminal Appeal’s decision was deemed as decisive.

Monis then pleaded guilty to 10 counts of using a postal service to cause offence contrary to the Commonwealth Criminal Code and was sentenced for these offences on 6 September 2013. A two year good behaviour bond and 300 hours of community service were imposed.

On 12 December 2014, Monis appeared in the High Court (in Sydney) seeking to appeal his conviction for postal offences. His application was unsuccessful. The High Court did not allow Monis to appeal having regard to the history of the matter including that the issues had already been constitutionally considered.

Stalking charges and Apprehended Domestic Violence Order (ADVO)

In July 2011, Monis was charged with intimidating his ex-partner (now deceased). Monis was granted conditional bail by police. A provisional ADVO was made by police and continued by the court on an interim basis.

Monis defended the charge, which was prosecuted by NSW Police Force and heard in Blacktown Local Court on 30 May 2012. Monis was found not guilty and the charge was dismissed. A final ADVO to protect his ex-partner was sought by NSW Police Force, but not made by the court.

Murder-related charges

Noleen Hayson-Pal, the ex-partner of Monis, died on 21 April 2013. Monis was charged with being an accessory before and after the fact to her murder in late 2013. His co-accused remains before the court charged with murder.

Monis was arrested by police on 15 November 2013. He did not seek bail at that time and bail was refused. On 12 December 2013, Monis was granted conditional bail by Penrith Local Court. Monis entered bail and was released from custody on 17 December 2013. He remained on bail for the murder-related charges at the time of the siege on 15 December 2014.

Sexual assault charges

Between approximately 2000 and 2010, Monis held himself out to be a spiritual healer and clairvoyant. It was in this capacity that Monis met his ex-partner, now deceased. He also met a number of other females, who are allegedly victims of sexual offences by Monis.

On 14 April 2014, Monis was arrested and charged with three sexual offences alleged to have occurred in 2002. He was refused bail by police and taken into custody. Monis was granted bail on 26 May 2014 at Parramatta Local Court. He entered bail and was released from custody the following day.

On 10 October 2014, court attendance notices were issued for a further 37 sexual assault charges in relation to conduct that allegedly took place between 2002 and 2010.

When the charges were listed at court, the NSW Office of the Director of Public Prosecutions (ODPP) which had carriage of the matters, sought to have bail conditions imposed for the additional charges in the same terms as the grant of bail for the original three charges with the agreement of police. Bail was ‘continued’ with the additional condition which had been sought, that he was not to go near or try to contact any complainant or prosecution witness. The matters were next listed for mention on 27 February 2015.

Monis was on bail for the sexual assault offences at the time of the siege on 15 December 2014.

Legal aid assistance

Between 2010 and 2014, Monis received eight grants of legal aid funding for his criminal charges for postal service offences (including the High Court challenges), murder-related offences and sexual assault offences.

Box 12: Legal Aid

Government-funded legal aid is a fundamental and indispensable component of an effective justice system founded on the rule of law.

Failure to provide legal representation for accused persons facing serious criminal charges may lead to a permanent stay of the criminal proceedings according to the principles in the High Court’s decision in Dietrich v The Queen [1992] HCA 57.

Access to legal aid in criminal proceedings for indigent persons is an essential ingredient in facilitating access to justice, ensuring the criminal justice system operates fairly and that accused persons can be successfully brought to trial.

It is equally essential for the operation of the criminal justice system that persons convicted of crimes can pursue appeal rights when they have reasonable prospects of success.

Legal Aid NSW provides cost-effective legal defence services for socially and economically disadvantaged accused persons charged with serious criminal offences.

Legal Aid NSW assesses grants of legal aid for appeals both on the merits of a case (whether it is likely to succeed and whether it can be justified) and the financial means of the individual (including income and assets).

Legal Aid NSW has confirmed it has policies and procedures in place in respect of appeals in criminal matters and that these were followed in the case of Monis’s appeals.

Legal Aid NSW has advised that a grant of legal aid for an appeal matter is made only once Legal Aid NSW has been provided with advice from Counsel that the appeal has reasonable prospects of success. Appeals to the High Court are only made once advice is provided from Senior Counsel.

Bail decisions

This section includes information on bail issues. The granting of bail is a matter before the Coroner. While the Review has no reason to believe that the account given here is inaccurate, the Coroner is likely to undertake formal investigations with a larger range of witnesses and it is possible that this may lead to some variations in the evidence tendered. The Review does not wish to prejudice the conduct of any witnesses in their interactions with the Coroner.

Monis was on bail for murder-related charges and sexual assault charges at the time of the Martin Place siege.

Box 13: Bail

Not all accused persons are kept in custody until their trial is concluded. Bail enables a person who is in custody charged with a criminal offence to be released from custody on the condition that he or she appears in court and complies with any specified conditions.

Bail laws attempt to strike a balance between the liberty of an accused person who is entitled to the presumption of innocence unless and until convicted for the offence for which he or she has been charged, and ensuring that the accused person will attend court, not interfere with prosecution witnesses and not commit any further offences.

A police sergeant may make an initial bail decision in relation to an accused person in custody for a criminal offence. Police must ensure any accused person charged with an offence who is refused bail is brought before a court as soon as practicable to be dealt with according to law.

Murder-related charges

In relation to the murder-related charges, conditional bail was granted by the Penrith Local Court on 12 December 2013. The decision was made under the Bail Act 1978 (NSW) (the pre-2013 Bail Act), as then in force. The ODPP opposed bail. The court’s decision was made after lengthy written submissions from the applicant and verbal submissions from both the applicant and the ODPP. Under the pre-2013 Bail Act, the court could only grant bail for an offence of murder if the court was satisfied that ‘exceptional circumstances’ justified the granting of bail. Monis had not been charged with murder, but rather with the offences of accessory before and after the fact to murder and it was not entirely clear whether the strict ‘exceptional circumstances’ test applied to those offences under the pre-2013 Bail Act or whether the presumption was neutral.

The court granted bail most relevantly on the basis that the Crown case was considered weak and circumstantial. The court also considered the need for the substantial surety to be provided, the likely lengthy period before trial, and the fact that it did not appear that Monis had ready access to any place to go overseas. The court also concluded that, if there was a threat, it was to the one woman who had been murdered, and that Monis was not a threat to other people.

The pre-2013 Bail Act allowed for a review of local court bail decisions by the Supreme Court. A review could be sought at the request of the accused person, the police or the ODPP. In addition, either the police or the ODPP could seek a temporary stay of a decision to grant bail pending such a review, provided the court was satisfied that bail was granted in the first appearance.

The Review is advised that there is doubt as to whether a temporary stay of the decision to grant Monis bail could have been sought because Monis was first granted bail by the court on a later appearance.

The police and the ODPP have procedures in place for deciding whether or not to seek a review of a decision by the court to grant bail, or a review of the conditions imposed on a grant of bail. Generally, issues about the prosecution’s approach to bail are resolved at the local level between investigating police and ODPP lawyers. This ensures matters are dealt with expeditiously by officers with detailed knowledge of the relevant facts. Following consultation, the ODPP lawyer may decide a review of the decision by the court to grant bail should be sought.

Where the ODPP lawyer responsible for the matter is of the view that bail should not have been granted and a review should be made, he or she will submit a report to the Director of Public Prosecutions for consideration. Similarly, if police formally request a review of bail or make a stay application in the local court, the matter is considered by the Director of Public Prosecutions.

The NSW Police Force advised the Review that it is not their practice to automatically seek review of contested decisions of the local court to grant bail, noting that (under the pre-2013 Bail Act) the NSW Police Force advised that the court overturns initial police decisions with respect to bail in around 47 per cent of cases.

In Monis’s case, the NSW Police Force advised the Review that investigating police were concerned about Monis having been granted bail in light of the seriousness of the offence.

Investigating police raised their concerns verbally about the bail decision with a managing lawyer at the ODPP and the lawyer who had carriage of the prosecution. NSW Police Force verbally requested that the ODPP apply for Monis’s bail to be reviewed. Investigating police also prepared a draft letter to the Director of Public Prosecutions requesting review of the court’s decision about bail and advised a managing lawyer at the ODPP that the letter for review of the bail decision would be submitted to the Director of Public Prosecutions through their chain of command.

The ODPP provided oral advice to NSW Police Force in response about the significant hurdles involved in reviewing the decision to grant Monis bail, including the complexities associated with the prosecution case.

In light of that advice, and the fact that the draft letter did not raise any new information not already available to the ODPP, NSW Police Force advised the Review that the letter to the Director of Public Prosecutions was never finalised and sent, and no review of the bail decision was sought by the ODPP. No stay application was lodged by the NSW Police Force.

Sexual assault charges

Following his arrest on 14 April 2014 on sexual assault offences, Monis was refused bail by police and taken into custody. Monis was granted bail on 26 May 2014 at Parramatta Local Court. He entered bail and was released from custody the following day.

Six days earlier, on 20 May 2014, new bail laws – the Bail Act 2013 (NSW) (the 2013 Bail Act) – had commenced. The 2013 Bail Act replaced the previous scheme of presumptions, exceptions and exceptional circumstances with a general risk-based model for decision-making. This meant:

• The Act operated without a system of offence-based presumptions. Instead, it required the decision-maker to assess the risk posed by an accused person in each case, the nature and seriousness of the offence being one consideration in assessing that risk.

• If the decision-maker was satisfied that the accused person did not present an ‘unacceptable risk’, the accused person was to be released on unconditional bail.

• Otherwise, the decision-maker was required to assess whether the imposition of conditions could mitigate the risk so that it ceased to be an unacceptable risk. If so, the accused was to be released on conditional bail.

• If the decision-maker was satisfied that the risk was an unacceptable risk and this could not be mitigated by conditions, then the accused was to be remanded in custody until trial.

In Monis’s case, the magistrate was satisfied that Monis posed an unacceptable risk of endangering the victim, individuals or the community or interfere with witnesses or evidence, but found that this risk could be mitigated through the imposition of conditions to protect prosecution witnesses and other strict conditions. Conditional bail was therefore granted.

It is noted that, although Monis was charged with the sexual assault offences after he was already on bail for the charge of accessory to murder, the sexual assault offences pre-dated the accessory to murder charge. Accordingly, his subsequent arrest did not constitute evidence of offending whilst on bail or otherwise constitute a breach of his pre-existing bail conditions.

Under the 2013 Bail Act, the ODPP could apply to the Local Court or the Supreme Court for a detention application seeking the refusal or revocation of the decision to grant Monis’s bail. Multiple detention applications are not permitted, unless new information becomes available or circumstances relevant to the grant of bail have changed since the previous application.

Police and the ODPP lawyer with carriage of the matter discussed the possibility of reviewing the grant of bail. The ODPP solicitor advised NSW Police Force orally that the prospects of a successful review would be low, given in particular that Monis already had a history of compliance with bail conditions, including that he had been continuously on bail from 2009 to 2013 on the Commonwealth postal charges, without ever failing to attend court or adhere to bail conditions, the historical nature of some of the sexual assault offences, and the fact that the pre-2013 Bail Act (which required exceptional circumstances to be established by the accused before bail could be granted for the offence of murder) had been repealed in the intervening period. The ODPP lawyer confirmed this advice in writing by email.

No detention application was made. During those discussions, police indicated that further sexual assault charges were likely to be laid in the near future. The ODPP solicitor suggested that consideration be given to laying these charges by way of arrest, which would then enable the police to take Monis into custody and refuse bail on the fresh charges. If that occurred, the ODPP solicitor said that Monis would need to make a further release application and the prosecution would have stronger grounds, by virtue of the new offences, to oppose bail.

However, when the new charges were laid this was done by way of a future court attendance notice, rather than arrest (bail court attendance notice), which meant that Monis was not taken into custody and no bail decision was able to be made by police.

The NSW Police Force advises that the decision to take this course of action was made having regard to:

• the fact that the arrest power under the Law Enforcement (Powers and Responsibilities) Act 2002 (NSW) could not be exercised merely for the purpose of having bail re-determined

• the fact that Monis’s next scheduled court appearance was imminent, and that Monis’s bail could be reconsidered in light of the new charges at that next court date, irrespective of whether Monis had been arrested for them or, as happened, he was to be charged with them at that subsequent court appearance

• the age of the alleged offences.

When the charges were listed at court on 10 October 2014, the prosecution, by agreement with police, did not seek to have bail revoked but instead sought to have bail conditions imposed for the additional charges in the same terms as the grant of bail for the original three sexual offence charges, with one additional condition. The court file records bail as ‘continued’ with the additional condition and the matters listed again for mention on 27 February 2015.

The court (under both the pre-2013 Bail Act and the 2013 Bail Act) is not required to apply the rules of evidence concerning the admissibility of evidence when considering whether or not to grant bail. Instead, the court can take into account any information that it considers credible or trustworthy in the circumstances. Investigating police and the ODPP regularly exchange information relevant to an accused and the charges before the court for the purposes of bail hearings. This information exchange occurred in the case of Monis.

Subsequent changes to bail laws

A review of the 2013 Bail Act was announced in June 2014, less than two months after the Act had commenced. The review was conducted by the former Attorney General John Hatzistergos at the request of the Premier and the current Attorney General, and the report was presented to NSW in July 2014 (the Hatzistergos Review).

The first report from the Hatzistergos Review was released in July 2014 and made a number of recommendations to streamline the operation of the unacceptable risk test and strengthen its application to serious offences. In late 2014, the 2013 Bail Act was substantially amended in accordance with the recommendations of the Hatzistergos Review. The amendments did not come in to effect until 28 January 2015, when they commenced by proclamation.

The commencement date for the new laws was set having regard to the need to implement information technology system changes and to train police and judicial officers required to use the legislation.

Under the new laws, while a person can still be assessed as being an ‘unacceptable risk’, an additional test has been added for people accused of serious offences where they must ‘show cause’ as to why, despite the serious nature of their offence they should be given bail. A court must refuse bail for a ‘show cause offence’ unless the accused person shows cause why his or her detention is not justified.

Accessory before the fact to murder is a serious offence to which the show cause requirement applies. That requirement would therefore have applied to Monis if he were charged now with being an accessory before the fact to murder.

The show cause requirement would also have applied because Monis was on bail for the Commonwealth postal offences at the time the murder-related offences were allegedly committed.

Sexual assault is a serious personal violence offence to which the show cause requirement applies if either:

• the accused person has previously been convicted of a serious personal violence offence; or

• if the offence is allegedly committed whilst the accused person is on bail or parole.

Neither of those circumstances applied to Monis in relation to the three sexual assault charges in relation to which he was granted bail on 26 May 2014. The show cause requirement would have applied to the last of the sexual offences allegedly committed by Monis whilst he was on bail for the Commonwealth postal offences, that is those offences committed after 20 October 2009.

Unlike the ‘exceptional circumstances’ test that applied to murder charges under the pre 2013 Bail Act, there are two hurdles to be overcome before bail can be granted for a ‘show cause’ offence. First, the accused has the onus of showing why his or her detention is not justified. Second, if the accused satisfies the court of this, the court must separately consider whether or not the accused presents an unacceptable risk that, if released from custody, he or she will fail to appear at court, commit a serious offence, endanger the safety of victims, individuals or the community or interfere with witnesses or evidence.

For example, if an accused meets the show cause requirement by satisfying the court the Crown case is weak and there would be significant delay before the matter is brought to trial, the court must separately consider the unacceptable risk factors before deciding whether or not to grant bail.

In addition to considering whether or not Monis presented an unacceptable risk, under the amendments to the 2013 Bail Act, the court could have regard to:

• conduct towards any victim or family member of the victim after the offence

• in the case of a serious offence, the views of any victim or family member to the extent that they are relevant to a concern that if released from custody, the accused could endanger the safety of victims, individuals or the community

• criminal associations (it was alleged Monis had links to an outlaw motorcycle group).

The prosecution continues (as it did under both the pre‑2013 Bail Act and the 2013 Bail Act) to have the right to seek a review by the Supreme Court of a decision of the Local Court to grant bail.

Following the first report of the Hatzistergos Review, NSW established a Bail Monitoring Group to actively monitor and consider the Bail Act. The Bail Monitoring Group meets monthly, and is made up of representatives from:

• the Department of Justice

• the Ministry of Police and Emergency Services

• the NSW Police Force

• the Office of the Director of Public Prosecutions

• NSW Legal Aid Commission

• the Bureau of Crime Statistics and Research

• the Department of Premier and Cabinet.

The group monitors the review of bail by the ODPP. Since May 2014, there have been in excess of 3000 Supreme Court bail listings. Also since May 2014, there have been 48 submissions to the Director of Public Prosecutions seeking a review of a decision to grant bail or the imposition of stricter bail conditions. Twenty-five of those matters resulted in a review being sought. Nineteen of those applications resulted in either bail being revoked or conditions being varied. Two remain to be heard.

Mr Hatzistergos was requested to continue with his review and to liaise with the Bail Monitoring group for 12 months after the release of his first report. The Hatzistergos Review will provide a final report in July 2015 in relation to the implementation of the bail amendments and whether any further amendments are required to strengthen the operation of the Act.

The recent amendments to the Bail Act 2013, which are now in force, require a bail authority to consider any criminal associations in assessing if an accused is an unacceptable risk. This new factor recognises that an accused’s link to crime networks can have a direct impact on their level of risk to the community if released on bail.

The Review found that there is an opportunity to consider strengthening the bail laws to require a bail authority to take into account an accused person’s links with terrorist organisations or violent extremism, even though the Review also found that Monis did not demonstrate a desire or intent to commit politically motivated violence prior to the siege.

A proposal will be developed jointly by the Department of Premier and Cabinet, the Department of Justice and NSW Police Force, with a view to submitting it for the NSW Government’s consideration at the same time as consideration is given to the final report of the Hatzistergos review of bail laws.

This proposal will be developed jointly by the Department of Premier and Cabinet, the Department of Justice and NSW Police Force, with a view to submitting it for the NSW Government’s consideration in mid-April 2015.

Changes to bail review processes

Whilst the NSW Police Force and the ODPP have in place long established processes to consider and request a review of a bail decision (a ‘review request’), the Review was told that the NSW Government would consider the benefits of setting out that process in a formal memorandum of understanding (MOU) between those two agencies. By this it is not suggested that review requests be made in each and every case, nor that a formal process would have altered the outcome in the Monis case.

Given the volume of bail applications before NSW courts (24,735 persons were granted bail in local courts in 2013) for NSW to commit to mandatory reviews of every decision would be counterproductive and reduce each agency’s capacity to properly examine contentious matters.

In order to support the general oversight of review requests, NSW Police Force and ODPP propose a review of bail decisions be included as a standing agenda item of the quarterly liaison meeting between the ODPP and NSW Police Force. This would provide a clear mechanism for consideration and escalation of contentious bail issues. By having the review of bail decisions as a standing agenda item, senior officers of the agencies would have ongoing oversight of bail issues of concern to both agencies.

A formal MOU would also ensure that the agencies have an agreed understanding of the process for reviewing bail decisions that is predictable and transparent.

The liaison group would be the appropriate body to settle the terms of the MOU.

Recommendations

The Review recommends that:

4. The NSW Police Force and Office of the Director of Public Prosecutions should establish a formal memorandum of understanding governing the process for seeking review of bail decisions, including the process for consideration and escalation of contentious bail issues. This recommendation should be considered by the NSW Government at the same time as consideration is given to the final report of the Hatzistergos Review of bail laws.

5. The Department of Premier and Cabinet, Department of Justice and NSW Police Force should develop a proposal for consideration by the NSW Government to require a bail authority to take into account an accused person’s links with terrorist organisations or violent extremism. This recommendation should be considered by the NSW Government at the same time as consideration is given to the final report of the Hatzistergos Review of bail laws.

Seven: Access to Firearms

The Review was asked to consider, and make recommendations in relation to Monis’s access to firearms.

Key points

Monis entered Martin Place with a pump action shotgun; it was short having being sawn off at the barrel and at the end.

The Coroner has announced that his inquiry will examine in detail the gun used by Monis. On the information available to the Review, it appears that the firearm used by Monis may have entered Australia lawfully, but became a ‘grey market’ firearm when not returned as part of the 1996 National Buy Back program.

Monis was at no time issued a firearms licence, nor did he legally own or import a firearm.

He did hold a security guard licence from 1997 to 2000 which would have allowed him to carry a pistol while on duty from March to July 1997 before relevant laws were changed.

The Commonwealth and all States and Territories are currently working to introduce a National Firearms Interface (NFI) which will improve how policing databases can be used to track firearms across the country.

However, to assist this process, all States and Territories that have not already done so, should undertake audits of their data holdings before and after the new NFI is operational. While this work would not prevent acts like Monis’s it would help police to fight gun crime.

Monis was at no time issued a firearm licence in any State or Territory in Australia. He also never lawfully imported a firearm into Australia. Searches have been undertaken by every police force in Australia, checking against all known names and aliases of Monis. Police records show that at no time did Monis ever own a registered firearm.

Monis was granted a security guard licence from 1997 – 2000. Between him first obtaining his licence in March 1997 and changes to NSW law in July of that year, licenced security guards were allowed under NSW law to carry pistols in the course of their duties under the authority of their employer’s licence without separately obtaining a firearms licence.

Monis was later denied a security guard licence in 2012 under updated legislation on the basis that he was not a ‘fit and proper person’. This decision was an administrative decision based on information known to police at the time and did not have broader national security implications.

This report will not address directly the method by which Monis obtained the firearm and ammunition used. These matters fall within the purview of the NSW Coronial Inquiry.

Monis obtained a security guard licence

On 26 March 1997 and renewed a year later for a further year, Monis was issued with a one year security licence under the Security (Protection) Industry Act 1985 (NSW). Under the law at the time, licenced security guards could carry a pistol in the course of their duties under the authority of their employer’s security licence without separately obtaining a firearms licence provided they completed certain weapons training. Any pistol carried for work purposes would have been required to be returned for safekeeping at the completion of each shift.

In May 1997, Monis was issued with ‘security weapons training’ certificate. The certificate states that Monis was accredited to carry a licensed revolver or semi‑automatic pistol whilst engaged in security duties.

The Review did not find any specific evidence of occasions where Monis did in fact carry a pistol during this period. In fact, he informed NSW Police Force in an interview in 2011, tendered in the Blacktown Local Court in relation to an ADVO matter, that he had engaged in firearms training for his prospective role as a security guard. However, he appears to indicate in this interview that he did not use firearms as part of his employment as a security guard.

On 1 July 1997, the Firearms (General) Regulation 1997 (NSW) commenced under the new Firearms Act 1996 (NSW). From this date licenced security guards in NSW could no longer carry firearms under the authority of their employer’s licence. Additionally, from July 1998 the Security Industry Act 1997 (NSW) (Security Industry Act) required security guards to hold their own firearms licence before they could access a firearm for their work. Monis did not apply for a licence and therefore from July 1997 was not authorised to carry a firearm in the course of his security guard duties.

In March 1999 after the expiry of his 1997 security licence, Monis (under the name of Manteghi) was issued with a security licence under the Security Industry Act. This licence also did not permit Monis to carry a firearm and expired in June 2000 without Monis lodging an application to renew.

Security licence refused

In June 2012 Monis applied for a security guard licence, but was refused on the basis he was not a fit and proper person. In denying Monis’s application, NSW Police Force requested advice from its own Terrorism Intelligence Unit and examined their general criminal intelligence holdings. They also considered AFP information relating to Monis’s Commonwealth offences for sending offensive letters to families of Australian soldiers killed in Afghanistan².

The NSW Police Force adjudicating officer denied Monis a security licence indicating that the Commonwealth postal charges justified the refusal.

The process of deciding whether to grant a licence was a routine decision under the Security Industry Act 1997 based on existing police information and did not have broader national security implications.

An internal review requested by Monis in July 2012 affirmed the decision to refuse the application and relied upon the Commonwealth postal charges, general police reports and other police information as reasons for upholding the decision.

Legally obtaining a firearm in Australia in 2014

In Australia, an individual must have a licence and they must obtain a ‘permit to acquire’ for each firearm they carry. ³ A person may be illegally using a firearm, even if they possess a licence, if that licence does not authorise possession of the particular firearm they own or they use the firearm in contravention of licence conditions.

Responsibility for firearm regulation and tracking is shared between the Commonwealth and the States and Territories. The Commonwealth’s main role in relation to the regulation of firearms and firearm parts is through control on imports to ensure they meet minimum requirements for the importation of firearms and firearm-related articles under the Customs (Prohibited Imports) Regulations 1956 Commonwealth) (the Regulations).

Box 14: Risk assessment
The administrative decision-makers had very different information before them when making each decision. The text below details the parameters under which these decisions were made.

1997-1999 decisions

On 26 March 1997, the Review is advised that Monis was issued with a one year class 1, security licence under Security (Protection) Industry Act 1985. A year later Monis sought and was granted renewal of this security licence for one year.

In March 1999, Monis was issued with class 1A and 1B security licence under the new Security Industry Act 1997 (NSW). The licence expired in 17 June 2000.

This decision is an assessment of whether a person is likely to act properly within the requirements of a licence if granted on the information available to police. It is not known what specific information was before the decision-maker when considering this security application. However, the Review team is aware that, due to the nature of Monis’s criminal record and other police holdings at the time, it is likely that there was not substantial police information for the decision-maker to consider for this application.
2012 decision

In April 2012 Monis applied for a class 1ACG security licence under the same 1997 Act. In June 2012 his application was refused on the basis he was not regarded as a fit and proper person to hold the class of licence sought.

Section 15 (7) of the Security Industry Act 1997 provides that the decision not to grant security licence does not require the disclosure of reasons that may disclose the existence or content of any criminal intelligence report or other criminal information relied upon.

In making a decision about whether to grant Monis a security licence, NSW Police Force advised the Review team that it considered police information systems (known as ‘COPS’) holdings available at the time. This included numerous events and information reports, to form the basis of the 2012 licence application refusal. In addition, NSW Police Force considered information from the AFP relating to Monis’s Commonwealth offences regarding the sending of offensive letters.

In July 2012 Monis applied for an internal review of the decision. The internal review affirmed the decision to refuse the application. The internal reviewer’s decision provides details of the Commonwealth postal charges pending against Monis and cites the ‘police reports and information’ that relate to Monis as a reason for upholding the decision to refuse to grant Monis a licence.

The Review considers that the original decision and the internal review were reasonable decisions given the information known then and what we now know. The Review also notes that this was an administrative decision for a licence, rather than the result of an investigation to assess either criminality or national security risk.
Both laws sought to balance the competing interests of person’s right to seek employment in the security industry and the public interest in determining only suitable persons may do so. The process of deciding whether to grant a licence was a routine administrative decision under the Security Industry Act 1997 based on existing police information. The Review did not identify any information to indicate that the current balance is not appropriate.
 

In conjunction with the States and Territories, the Commonwealth works to ensure that the regulation of firearms is consistent nationally and with the 1996 National Firearms Agreement (NFA). States and Territories have responsibility for all matters relating to manufacturing, possession, licensing, sale and use of firearms.

The illicit and grey markets for firearms

The illicit market includes those firearms:

• stolen from legitimate owners

• diverted by crooked firearm dealers

• illegally imported

• manufactured or reactivated by backyard operators.

  Australia’s firearm ‘grey market’ comprises firearms that were not registered or surrendered in accordance with the NFA in the 1996-7 and 2002 National Firearms Buyback Programs. These firearms are generally not held for criminal purposes, but many have been identified as ending up in the illicit market.

  The Australian Crime Commission (ACC) estimates there are more than 250,000 long arms and 10,000 handguns in the grey and illicit firearms market. The durability of firearms ensures that those diverted to the illicit market remain in circulation for many decades.

  It is possible that the firearm used by Monis may have been imported to Australia in the early to mid-1950s. At the time there was neither a requirement for the importer to register its entry nor to have a permit to carry. Information about the importation or ownership may therefore never have been entered onto a database before the 1996 NFA. It is possible that it was not handed in during the 1996 Buyback Program, and, therefore, may be a grey market firearm which would have been invisible to authorities since its importation.

Tracking firearm information in Australia

Immediately following the siege, searches by NSW Police Force and AFP about whether Monis had lawful access to a gun returned an ‘indeterminate’ result in the general policing database, the National Police Reference System (NPRS). An ‘indeterminate’ result would require further checks of specific State or Territory firearm databases to determine whether either a firearm or security licence was held by the person concerned.

While ‘indeterminate’ results are clearly inadequate for time-sensitive policing, they are unsurprising given weaknesses in Australia’s national system for maintaining and sharing firearms information between jurisdictions. In this case, the NSW specific firearm database showed the relevant, accurate information but there was poor interoperability between the state and national databases giving a result that required further checks, if being viewed by a police force outside NSW. The forthcoming introduction of a NFI will significantly improve this situation by creating a single national firearms repository.

Flaws in national firearms databases

National information on firearms is currently coordinated by CrimTrac through two databases.

• The NPRS is a policing database holding general information about ‘persons of interest’ such as charge and conviction history. It has a firearm involvement field that can include information about access to fire-arms (such as licence information and history).

  Information enters the NPRS through both automated uploads from State and Territory police systems and manually by police entering data directly into the system.

• The National Firearms Licensing and Registration System (NFLRS) captures a ‘point-in-time picture’ of firearm information held by State and Territory police agencies’s own firearm registries. This includes information about past and current firearms licence holders and registered, lost and stolen firearms. The NFLRS has been operational since 1997 when it was created as part of the Buyback Scheme.

  There are three problems with this arrangement.

• Gaps in the data – As there was no requirement to register firearms in many States and Territories before 1996, information about people and firearms in each jurisdiction’s firearms database contains gaps, which flow through to the NFLRS at a national level. Firearms data holdings for each State and Territory are also not all automatically shared bilaterally between States and Territories.

• Inconsistency across data holdings – There is no automatic interconnectivity between NPRS and NFLRS – each is a separate repository of information. The information about Monis on the two systems was not consistent: he had a firearm involvement indicator, which was marked ‘indeterminate’ on NPRS, while no data was entered on the NSW state firearm database feeding the NFLRS.

• Firearms are not tracked over time – the NFLRS does not give an indication of a person’s firearms possession history without more detailed interrogation. The system is person-focussed, rather than tracking firearms throughout Australia. This creates the potential for firearms to drop off the system if they are not registered with new owners, by owners who have relocated or where registration lapses.

  These shortcomings will be improved by the roll out of the NFI. In contrast with the NFLRS, the NFI will provide:

• complete history about firearms from point of importation to eventual destruction (as opposed to point in time as per the NFLRS)

• more consistent classification of weapons using the National Firearms Identification Database

• more consistent association between identities and weapons

• a richer information set about the weapon based upon a broader information model

• more timely provisioning of information to support the national view.

While the NFI is currently scheduled to be operational in late 2016, CrimTrac, and police agencies where necessary, should prioritise work on this system to see it is operational as early as possible in 2015.

The information in the new system will only be as good as the information already in the state databases. Given the information in the NFI will be based on integrating information already in the NFLRS holdings. The Review recommends that State and Territory police agencies, that have not already done so, should as a matter of urgency, audit their firearms data and work to upgrade the consistency and accuracy of their own holdings before transferring it to the NFI. While NSW has completed this work all Commonwealth, State and Territory police are reliant on the national picture of information made up of the information from all jurisdictions.

Also, no amount of auditing will be able to capture illegally held weapons if they have never previously been registered in the system. An estimated 1500 firearms are stolen each year, with relatively few of these recovered. This presents an ongoing concern for police nationally, as are the links to organised crime. To this end, Operation Unification – Illegal Guns Off Our Streets is a joint initiative of police agencies focussed on getting illicit firearms out of the hands of criminals through short amnesty periods in each State and Territory. Over two weeks in June 2014, through reports from the public, seizure operations and firearms being handed in, over 180 illicit firearms were removed from circulation in a two week period and 65 charges laid over a period of weeks in 2014.

The second part of improving integration should begin once the NFI is operational. Inconsistencies between the information on the NPRS and the NFI will need to be addressed in a further audit by CrimTrac and police agencies. Better links between NPRS and the NFI will mean officers doing general checks on a person will have reliable indicators to interrogate the NFI holdings further.

While better police information will not always be preventative in the fight against illegal firearm use, the introduction of a NFI and improvements to firearms databases nationally will improve how policing databases can be used to track legal and some illegal firearms.

Further limiting firearms trafficking

On 24 November 2014, the Crimes Legislation Amendment (Psychoactive Substances and Other Measures) Bill 2014 (Commonwealth) was passed by the House of Representatives. It is currently before the Senate. The relevant provisions create a more comprehensive set of offences and penalties to address the trafficking of firearms and firearm parts.

The Bill proposes to:

• create new international firearms offences of trafficking prohibited firearms and firearm parts into and out of Australia. The Bill will close a gap by enabling the conviction of those who engage in the trafficking of firearm parts

• extend the existing offences of cross-border disposal or acquisition of a firearm and taking or sending a firearm across borders within Australia, to include firearm parts as well as firearms

• introduce a mandatory minimum five year term of imprisonment for the new offences and some existing offences.

  Passage of this Bill would strengthen the Commonwealth’s ability to tackle illegal trafficking of firearms and firearm parts into and out of Australia.

National consistency

There have been significant achievements in developing a consistent national approach to the regulation of firearms and firearm-related articles. In particular, the adoption by all States and Territories of the NFA in 1996 and the National Firearms Trafficking Policy Agreement and the National Handgun Control Agreement in 2002 established a common, national framework.

Since the NFA was signed in 1996, significant technological advancements and local factors have resulted in some variations in how jurisdictions apply aspects of the NFA. This includes different periods for licences and different requirements that need to be met to own and possess Category D firearms (which includes self-loading centre fire rifles designed or adapted for military purposes and self-loading shotguns).

There are areas where national consistency could be improved to further restrict the movement of firearms to the illicit market, such as the accountability of deactivation standards and agreed firearm descriptors.

These changes could be worked through at an appropriate Ministerial forum.

Recommendations

6. The Commonwealth, States and Territories should simplify the regulation of the legal firearms market through an update of the technical elements of the National Firearms Agreement.

7. CrimTrac, in cooperation with Commonwealth and State Police and law enforcement agencies should prioritise bringing the National Firearms Interface into operation by the end of 2015.

8. States and Territories’ police forces should conduct an urgent audit of their firearms data holdings before the National Firearms Interface is operational where this has not already occurred.

9. The Commonwealth and the States and Territories should give further consideration to measures to deal with illegal firearms.

Part Three: Government response to Monis

Eight: Information Sharing and Coordination

The Review was asked to consider and make recommendations in relation to:

• information held by the Commonwealth and New South Wales agencies about Monis for the period prior to and following his arrival in Australia up until the siege, including how information relevant to public safety was shared between and used by agencies
• the effectiveness of coordination more generally between the Commonwealth and NSW.

Key points

Monis did not somehow escape the notice of security and police agencies.

Monis was, in fact, well known to authorities: he had been investigated a number of times and successfully prosecuted on 12 charges. He had met police and ASIO representatives on numerous occasions and these, along with other government agencies, held hundreds of thousands of pages of information on him.

The question is whether their knowledge and assessments could have reasonably prevented the Martin Place siege.

Relevant information was shared in a timely and appropriate fashion between the various agencies. The Review team holds the view that there was no critical failure to share information which, if it had been shared, would have sparked an intervention that would have prevented Monis from instigating the siege.

A further question is whether the judgments about the threat he posed were reasonably made at the time.

Monis came into contact with a broad range of government agencies over many years, including social support services, courts, correctives services and police for criminal charges as well as national security agencies.

This chapter explores the various points in which Monis came in contact with government and considers if there were adequate processes and use of those processes in sharing relevant information. It considers what we knew about Monis at the time of the Martin Place siege and finally how this ties in with counter terrorism systems and planning.

How does information sharing and counter-terrorism coordination work?

The effective sharing of information between government agencies is crucial to being able to detect and prevent terrorist threats. For this reason, there are well developed information sharing and coordination arrangements underpinned by legislation in place between Australian law enforcement and security agencies.

Australia also has strong operational partnerships with international counterparts through the AFP and Australia’s national security agencies which feed into these operational coordination mechanisms.

Frameworks for information sharing

The extent to which information held by one government agency may be shared with other government agencies is predominantly guided by the legislation under which the agency providing the information operates together with relevant privacy acts. At the Commonwealth level, the relevant privacy act is the Privacy Act 1988 (Commonwealth) and in New South Wales, the Privacy and Personal Information Protection Act 1998 (NSW), while the Health Records and Information Act (2002) (NSW) also plays an important role in governing the sharing of health related information.

Under these legislative frameworks, regular information exchanges between agencies are often managed through Memorandums of Understanding. In addition, other legislative provisions may affect the use and disclosure of information for a specific purpose.

ASIO’s information sharing arrangements, as with all ASIO activities, are determined and regulated by legislation including the Australian Security Intelligence Organisation Act 1979 (Commonwealth) (ASIO Act) and the Telecommunications (Intercept and Access Act) 1979 (Commonwealth). The ASIO Act sets out the functions of ASIO and defines how it can cooperate with other agencies, share intelligence and provide advice. This is complemented by further Guidelines issued by the Attorney-General, as delegated under the Act, which provide more detailed guidance and advice on how ASIO carries out its functions. ASIO has robust systems for recording and tracking both the information it shares with and the information it receives from other agencies. The appropriateness of ASIO’s activities, including information sharing, is overseen by the independent Inspector-General of Intelligence and Security, who has Royal Commission-like powers to inquire into issues of concern.

ASIO routinely shares intelligence across the full spectrum of its legislated functions with stakeholders across all levels of Australian governments, business and industry and with international partners. Although it does not require formal agreements to share or seek information from Australian agencies, it nonetheless has a range of MOUs in place with key domestic partners to ensure cooperation and information sharing occurs in a systematic way. Key partners include Australian Intelligence Community agencies, State and Federal law enforcement agencies, crime commissions, integrity and anti-corruption agencies and regulatory agencies. Of note, in 2008, ASIO agreed a National Counter-Terrorism Protocol with the AFP, with information sharing being a key tenant of the Protocol.

ASIO also has officers from other security and law enforcement agencies embedded in ASIO teams to facilitate information sharing, coordination and cooperation.

Box 15: Joint Counter-Terrorism Team (JCTT)
JCTTs are established in each State and Territory and comprise AFP, relevant State and Territory law enforcement and ASIO. In NSW, the JCTT also includes the NSW Crime Commission. The make-up of the JCTTs reflects the multi-jurisdictional and trans-national nature of terrorism.
JCTTs are flexible and adaptive multi-agency teams which provide a coordinated and consistent approach to combating terrorism in each jurisdiction. The teams coordinate, collaborate, investigate and disrupt terrorism or terrorism-related activity (including bringing criminal prosecutions for breaches of terrorism legislation) to prevent or respond to terrorist acts in Australia.
MOUs between JCTT partners formally set the agreed objectives and arrangements for achieving JCTT aims in each jurisdiction. Overarching governance arrangements are also in place to provide strategic direction and operational and administrative oversight. This includes cross-jurisdictional arrangements which can be stood up when an operation involves more than one State or Territory.

The role and purpose of the AFP, including the disclosure of information collected by the AFP, is governed by the Australian Federal Police Act 1979 (Commonwealth). The dissemination of particular categories of information gathered by the AFP is also governed by specific legislation. For example, telephone intercept products can be shared only if it is for a permitted purpose as defined in the Telecommunications (Intercept and Access) 1979 (Commonwealth). Similarly to ASIO, the AFP has a range of standing arrangements for sharing information with partner agencies at a local, national and international level. AFP has 11 counter‑terrorism specific agreements with various State, Territory and Commonwealth agencies, and 60 bilateral or multilateral agreements with law enforcement agencies and government departments regarding cooperative arrangements in a broader criminal investigation context which include information sharing.

Depending on the source, type and assessed veracity, AFP shares information with other Commonwealth and State agencies in order to develop accurate intelligence assessments on a case-by-case basis. Operationally, the AFP also engages in specific requests for information and assistance to further investigations.

New South Wales agencies have a similar ability to share their information with law enforcement agencies.

Box 16: Computerised Operational Policing System (COPS)
The Computerised Operational Policing System (COPS) used by NSW Police Force is an operational database used to record information relevant to all victims, offenders and incidents that require police action. COPS is used to record all incidents reported or becoming known to police which of their nature would require some police action (even only to record), for investigative and intelligence purposes. The JCTT and AFP also have access to COPS.
NSW Police Force also use e@gle.i which is an investigative management system used mostly by specialist units within NSW Police Force to hold more expansive investigative information on a particular investigation. All police have access to COPS while e@gle.i access is assigned to the relevant investigators who are undertaking particular investigations.

While NSW Police Force has sound internal information sharing systems, supported by the COPS and e@gle.i systems, improvements to information sharing within NSW Police Force are currently being explored through the development of a new intelligence system that enables analysts to search and identify the nature and scale of entity links across multiple existing databases and intelligence holdings (including COPS, e@gle.i, Counter Terrorism & Special Tactics Intelligence files/holdings and other local intelligence databases/holdings).

In support of their investigations, NSW Police Force are able to obtain information from government agencies and health organisations, provided the disclosure is ‘reasonably necessary for the exercise of law enforcement functions by law enforcement agencies in circumstances where there are reasonable grounds to believe that an offence may have been, or may be, committed’ (Health Records and Information Privacy Act 2002 (NSW)), or ‘reasonably necessary for the purposes of law enforcement in circumstances where there are reasonable grounds to believe that an offence may have been, or may be, committed’ (Privacy and Personal Information Protection Act 1998 (NSW)) (PPIP Act). Furthermore, NSW Police Force are able to share this information with ASIO if required.

However, with regards to health‑related information, a NSW government agency or health organisation can pass information they hold directly to ASIO if they believe that passing this information is necessary to lessen or prevent a serious and imminent threat to life, health or safety of the individual or another person, or a serious threat to public health or public safety.

In the case of Monis, the Review found no deficiencies in the way information was shared between the NSW and Commonwealth Governments.

The issue of possible legislative impediments to sharing information between Australian governments for law enforcement and national security purposes was identified by the Review as something that, while not an issue in the case of Monis nor identified as an issue in New South Wales, has the potential to inhibit the flow of important information in future cases and should be further investigated. The Review recommends all States and Territories review relevant legislation, in particular with respect to privacy and health, to ensure appropriate access by ASIO, with a report back to the Council of Australian Governments (COAG) by mid-2015.

What is shared and when is it shared?

The information sharing arrangements in place between agencies vary between the Commonwealth and New South Wales, but both levels of government have a range of automated and judgment based arrangements in place to govern the flow of relevant information.

Outside of automated sharing processes, decisions as to whether and what information is to be shared are taken on an ‘as‑needs’ basis where agencies are lawfully permitted to do so. Information sharing may have regard to factors such as the recipient and purpose of sharing the information, the nexus to security, the gravity of the subject matter, human rights considerations, the risk to intelligence sources and methods if the information is compromised or used in evidence and whether controls may be put in place to mitigate those risks.

Ultimately, in relation to countering terrorism and other law enforcement matters, the primary consideration guiding information sharing will be a public safety one: the proactive sharing of threat information in a timely way to enable agencies to take preventative action.

Public referrals

The NSH is the primary channel through which the public is encouraged to report matters relevant to national security.

Since the NSH commenced operations on 28 December 2002 it has handled more than 200,000 contacts from members of the public. If a report relates to security or law enforcement information, it will be forwarded by the Hotline to stakeholders including the AFP, ASIO and relevant State and Territory police for further investigation.

Each will consider reports from the perspective of their respective remits: for ASIO, on the basis of whether it may be relevant to national security; AFP for any relevance to a potential breach of federal legislation and State and Territory police for potential breaches of state legislation. Bringing these different perspectives to bear increases the chances of detecting activity of concern.

How information is used

Under the ASIO Act, ASIO’s functions include obtaining, correlating and evaluating intelligence relevant to security. ASIO may investigate to determine whether an individual’s activities, associations and beliefs may be relevant or prejudicial to national security. ASIO receives a continuous stream of information potentially relevant to national security from a wide variety of sources, which is assessed in accordance with these responsibilities.

This triaging and assessment process is critical in managing the sheer volume of material ASIO needs to digest in order to filter significant information from the overall ‘white noise’. Resources are then allocated to the highest assessed threats.

A detailed description of ASIO’s investigation and prioritisation process is at Appendix 1.

AFP and state law enforcement agencies also acquire significant amounts of information independently of ASIO. This may come through a variety of sources, including liaison or source reporting or public referrals. As with the way ASIO deals with its information, this information is triaged and assessed based on credibility and indications of time sensitive threats, and investigations are coordinated with ASIO through the JCTTs.

In taking forward a national security or criminal investigation, agencies may draw on or seek other sources of information to support investigations as required. This may include holdings of other government agencies, such as the Australian Tax Office or Centrelink. The ACC provides support to and is engaged by ASIO or the JCTTs on a case-by-case basis. Like the NSW Crime Commission, the ACC may be used as a further investigative tool particularly through the use of coercive powers and hearings. It is expected the ACC will have greater engagement through the secondment of ACC members to the National Disruption Group and the JCTT’s.

Across these agencies, the information collection, sharing and investigation process is continuous. At a given time, an individual may be assessed as not a priority national security concern. However, information about them that is relevant to national security, when received, will be added to each agency’s holdings and assessed in order to maintain a current and constantly evolving picture of their activities. It is through this process that law enforcement and national security agencies maintain as current and holistic a view of individuals and their activities as possible. Where this is of relevance to one or more agencies within the JCTT environment, updates are provided to the JCTT as necessary or appropriate.

The current systems ensure all information received is subject to analysis on a national security as well as state and federal criminal basis, and that there is an appropriate progression from initial analysis to more detailed analysis and investigation when more concerning information is received.

ASIO’s investigation and information collection activities must be proportionate to the gravity and probability of the threat and with the minimum level of intrusiveness required for it to fulfil its functions. The Review found that systems currently in place ensure ASIO’s investigations and use of sometimes intrusive investigative techniques are properly focussed on the highest priority cases. The Review also found a similar focus on the highest priority cases by the NSW Police Force.

How this applied to Monis

A wide range of agencies at both the Commonwealth and State levels hold information pertaining to Monis, either under that name or one of the other legal names or aliases by which he was known. This includes not only security and law enforcement agencies, but also agencies with which many Australians would routinely engage, such as those involved in providing health or social services and licence and vehicle registrations. The volume of records relating to Monis varied greatly across agencies; some having extensive holdings and some very limited holdings.

In total, searches undertaken by agencies resulted in the identification of hundreds of thousands of pages of documents. While the number is very large, it did include instances of duplicated documents and some documents that were captured in the search terms used but were not relevant to Monis or this review.

No one agency knew everything about Monis. However, in aggregate, security and law enforcement agencies had a very comprehensive shared picture of Monis and shared this information with each other, using it to form assessments of the threat he presented to national security and a picture of his potentially criminal activity.

The amount of information held about Monis, and the number of agencies involved in its collection, highlight the importance of effective information management. This includes the sharing arrangements that are in place to provide appropriate and complementary responses both in terms of services to individuals and in support to public safety.

The Review found a high degree of consistency between the information holdings of law enforcement and national security agencies in relation to Monis. These agencies often held similar information and sometimes the same documents in relation to major events or developments in Monis’s life. Certainly, the Review did not identify any information, shared or not shared, that could have allowed the agencies to foresee and or prevent the Martin Place siege.

The activities that law enforcement and national security agencies undertook, and the findings they made, with regard to the information they held on Monis are discussed in detail in Chapter Nine of this Review. The information sharing arrangements and actions undertaken by the Department of Immigration and Border Protection are discussed in Chapter Four.

Monis had interactions with a wide range of government agencies, often in a transactional way, that in themselves were quite unexceptional. These interactions included Medicare and Pharmaceutical Benefits Scheme claims, claims for Newstart Allowance and Austudy and job seeker activities. Therefore, there was some further information on Monis held by Australian government agencies that was not considered by those agencies to be relevant to the national security interest and therefore was not shared with ASIO or police.

In the case of Monis, ASIO did not seek to access the information held by these agencies as there was no reason to do so. The Review found no information that indicated ASIO should have sought further information held by social support agencies, or that these agencies held any information on Monis that would have caused ASIO to draw different conclusions. For instance, while ASIO had access to law enforcement intelligence about Monis, ASIO did not have access to Monis’s mental health records. However, these records all concluded that Monis did not represent a threat of harm to himself or others and would not have changed ASIO’s assessment.

In any case, the NSW Police Force obtained access to Monis’s mental health records as part of their ongoing criminal investigations.

FACS has records of interactions with Monis following reporting of concerns relating to welfare of his children. These concerns were not about Monis or his actions, were investigated, and were not substantiated, and this information was appropriately shared between FACS, NSW Police Force and NSW Education. Aside from this, NSW Government agencies held a range of unexceptional information such as vehicle registrations and TAFE enrolments that would not have materially altered security and law enforcement agency assessments of Monis, but could have been accessed by the NSW Police Force and provided to the JCTT if an appropriate need was demonstrated.

Why didn’t we know what Monis would do?

As has been noted elsewhere in this Review, Monis was well known to law enforcement and national security agencies. He was the subject of thorough assessments by ASIO, the AFP and NSW Police Force which had continuously determined that he was not of national security concern. Based on what was known at the time, his actions were not foreseen.

ASIO was able to access all relevant information held by government that it needed to conduct its assessment. None of this information led ASIO to conclude that resources should be diverted from higher priority activities to conduct more intrusive investigations of Monis.

His interactions with the justice system, including a conviction in relation to use of a postal service to send offensive material and allegations of sexual assaults and involvement in the murder of his former partner, were known by ASIO, AFP and NSW Police Force, and were taken into account as these agencies continuously considered the threat Monis posed to national security. Having a history of criminal activities does not inevitably mean a person poses a threat to national security and these criminal matters were being dealt with by the justice system.

Are there ways to minimise the risks that people with extremist views pose to the community?

Law enforcement and security agencies must continue to prioritise and focus their efforts on the highest threats to public safety and security. There will be people who do not meet priority thresholds and who do not trigger national security laws but who may nevertheless be susceptible to radicalisation. Waiting until at-risk individuals develop into high threats is not an adequate response – interventions should be undertaken to counter these risks.

This is particularly the case in the context of the current environment of heightened terrorism threat where susceptible (including perhaps mentally unstable) individuals can quickly become radicalised and rapidly move from intent to action.

While ASIO previously assessed that onshore terrorist planning would most likely centre on a complex, mass-casualty attack requiring a long lead time, for example a vehicle‑borne improvised explosive device, ASIO has for at least the past 12 months assessed that an unsophisticated attack using readily available weapons is more likely in Australia. The reduced complexity of such an attack methodology means that a perpetrator could move, without generating typical security indicators, from intent to undertaking a violent action quickly, adding to the challenge of detecting and preventing attacks.

In this context, the Review considered the issue of managing people who do not warrant intrusive investigations by law enforcement and security agencies but who may be susceptible to radicalisation.

If we are to truly get ahead of this challenge, we need to consider ways to reduce the incidence of individuals developing into potential terrorists and what capabilities are required to do this. We need ways to better identify those who may be at risk of radicalisation, and to address the factors that make them susceptible to extremist ideology.

Under the current system, security and police discussion and coordination regarding these individuals can be undertaken bilaterally or within the JCTTs located in all States and Territories. Susceptible individuals can and are engaged by police agencies or referred to other government agencies in order to receive necessary support. This currently occurs in an ad hoc way and would benefit from being systematised. There are currently no formal risk assessment and referral arrangements to identify and actively case manage individuals on a radicalisation trajectory.

This gap has been identified. New counter terrorism measures announced in August 2014 to develop a Countering Violent Extremism intervention program will seek to broaden and embed these arrangements and ensure they are underpinned by risk assessment methods to identify individuals who are becoming radicalised and divert them through active case management. This is being led by AGD with the NSW Government and other State and Territory governments through the Australia-New Zealand Counter-Terrorism Committee. The Review considers that the new AFP-led multi-agency National Disruption Group will play a critical role in managing referrals to the Countering Violent Extremism intervention program on behalf of security and law enforcement agencies.

The challenge is potentially immense. There are many thousands of individuals who may be considered to hold extreme views and who display some indicators of risk. Active case management with individuals like this is hard and resource intensive and there will be a need to prioritise efforts based on resources. This will require a commitment from all jurisdictions to ensure this work is adequately resourced.

Participation in any intervention program will be on a voluntary basis, unless it is a condition of bail. Since these programs are aimed at inducing behavioural change, for many participants, consent is appropriate and indicates a receptiveness to alternative views. Also, any response must be balanced against and proportionate to the safeguards on privacy and personal freedoms that are intrinsic to our Australian values.

It is not likely that Monis would have been picked up in such intervention programmes. Even if he had been, we cannot say that intervention programmes would have prevented him from instigating the siege – but they do provide an additional security net that may capture an extra layer of individuals with a chance to divert them before they become a threat to national security.

The Review recommends that AGD work with State and Territory Governments through the Australia-New Zealand Counter-Terrorism Committee to expedite this work and ensure it is appropriately resourced and to report back to the Council of Australian Governments on implementation by 30 June 2015. This should consider how to formalise referral of individuals from law enforcement and security agencies for Countering Violent Extremism screening and risk assessment through the AFP-led National Disruption Group.

The Review also considers that the role of communities and front-line service providers needs to be better acknowledged, supported and funded through education and training. Law enforcement and security referrals are one pathway to flag individuals of concern but communities, families and friends are most likely to recognise changes in someone that may be radicalising and would be most likely to be able to reach out and divert them from this path. Indeed, they may be able to intervene at an earlier point in the radicalisation process, where they would be otherwise reluctant to refer the matter to Government authorities.

There is a need for much more extensive education and training of communities and front-line service providers, to help them to recognise signs that someone may be at risk of radicalizing to violent extremism, and how to report it.

Recommendations

The Review recommends that:

10. The Commonwealth Attorney-General’s Department should work with States and Territories through the Australia New Zealand Counter Terrorism Committee (ANZCTC) to expedite work on a Countering Violent Extremism referral program, including ensuring it is appropriately resourced, and to report back to the Council of Australian Governments (COAG) on implementation by 30 June 2015.

11. Consistent with the October 2014 COAG agreements, all Governments should support communities and front-line service providers in recognising signs that someone may be radicalising and adopting strategies for management.

12. All States and Territories should review relevant legislation, in particular with respect to privacy and health, to ensure appropriate access by ASIO, with a report back to COAG by mid-2015.

Nine: Preventative Measures – National Security Legislative Powers

The Review was asked to consider and make recommendations in relation to how and at what stage relevant national security legislative powers, including control orders, were or could have been used in relation to Monis’s activities of security concern.

Key points

While Monis was consistently on the radar of law enforcement and intelligence agencies from the time he arrived in Australia, based on information available:

• at no point prior to the siege could he have been successfully charged with a terrorism offence under the law
• control orders and preventative detention orders are extraordinary, and Monis’s actions never reached the threshold for these powers to be used prior to the siege.

However, law enforcement agencies pursued his criminal behaviour.

Despite coming to the attention of authorities on numerous occasions, at no time prior to the Martin Place siege did Monis’s actions constitute a terrorism offence or warrant the use of national security powers (such as a control order or preventative detention order) based on information available to law enforcement and intelligence agencies.

While the JCTT (see Box 15) investigating Monis did not charge him for a terrorism related offence between 2007 and 2009, it did pursue criminal charges against Monis for his use of a postal service to send offensive letters to the families of Australian soldiers killed in Afghanistan. Ultimately Monis was convicted of these offences. Monis was also charged with sexual assault and accessory to murder.

This chapter provides an overview of available national security legislation and powers, and considers whether police could have used specific national security legislative powers during the course of their investigations.

The ‘special powers’ under the Terrorism (Police Powers) Act 2002 (NSW) were activated on the day of the siege. These powers enable police to stop and search vehicles. However, the use of these powers may form part of the Coroner’s investigations so will not be considered as part of this Review.

This chapter also considers if there is a need to amend national security legislation.

Overview of Australia’s national security legislation

Australia first enacted specific counter-terrorism laws in 2002 following the 11 September 2001 terrorist attacks in the United States. Those laws created a range of terrorist offences in Part 5.3 of the Schedule to the Criminal Code Act 1995 (Commonwealth) (Criminal Code), including engaging in, preparing, planning, or training for, terrorist acts, and offences relating to terrorist organisations.

Significant amendments have been enacted over the years, including the modification or addition of offences, the creation of specific powers to investigate those offences, and special police powers to protect the public from a terrorist act. In particular:

• in 2005 following the London bombings, provisions were introduced to enable the police to seek and obtain control orders and preventative detention orders against a person

• in late 2014 reforms were introduced to improve the ability of law enforcement and intelligence agencies to prevent and disrupt Australians from travelling to fight in overseas conflicts and to mitigate the threat posed by those returning from such conflicts, including creating an ‘advocating terrorism’ offence and expanding the grounds upon which a control order could be sought.

States and Territories also have counter-terrorism specific legislation as part of a national framework to combat terrorism. In particular, States and Territories have preventative detention order legislation because the Commonwealth could not enact, for constitutional reasons, legislation which provided for detention of up to 14 days (the Commonwealth can only detain someone under a preventative detention order for a maximum of 48 hours).

In addition to the ongoing review role of the Independent National Security Legislation Monitor (INSLM), the Parliamentary Joint Committee on Intelligence and Security (PJCIS) is scheduled to review certain national security legislation by March 2018, including the control order and preventative detention order provisions.

Tables 1 and 2 summarise relevant terrorism offences and national security powers.

Should the police have used national security legislation powers in relation to Monis?

Given Monis’s history of erratic behaviour, the Review examined whether there were any incidents that could, with hindsight, have triggered the use of national security legislation powers since 2002 when the laws were first introduced.

Law enforcement and intelligence agencies had an ongoing awareness of Monis’s behaviour, which became particularly high profile from 2007 and continued on in that vein in varying degrees until the time of the siege. While the below analysis focuses on particular points in time, agencies’ assessments of Monis were ongoing and reviewed continuously.

2002 – Monis’s engagement with ASIO about the 11 September attacks

In late 2001 and 2002 Monis contacted ASIO to volunteer information relating to the 11 September attacks. Monis was interviewed as part of an ASIO investigation which assessed his claims as not credible. Nothing came to light in the investigation to suggest Monis was himself a national security threat.

2004 – ASIO assessment of Monis in respect of citizenship application

ASIO conducted a security assessment of Monis as part of his application for Australian citizenship in 2004. It found no grounds for assessing that Monis posed a direct or indirect security risk.

2007-09 – Offensive letters, public statements, protests, and web publications

Between 2007 and 2009, Monis, using the name Sheikh Haron (and other aliases agencies were aware of), made a number of provocative statements online and through letters and media releases. This included references to Muslims attacking Australia, suicide bombings, and other terrorist related activity. Some of these actions were very public, including protests out the front of the Channel 7 building.

Table 1 Example Terrorism Offences

Offence	Description
Urging violence against groups or against members of groups (sections 80.2A and 80.2B of the Criminal Code)	It is an offence to intentionally urge another person or group to use force or violence against a group or a member of a group, on the basis of race, religion, nationality, national or ethnic origin or political opinion, where the person intends that force or violence will occur. Maximum penalty: up to seven years imprisonment.
Advocating terrorism (section 80.2C of the Criminal Code)	It is an offence for a person to intentionally advocate terrorism or a terrorist act where they are reckless (or aware of a substantial risk) that their advocacy will result in another person committing a terrorist act or a terrorism offence. Maximum penalty: up to five years imprisonment

Table 2 Key National Security Powers

Powers	Description	Legal threshold applied by issuing authority
Control Orders (Part 5.3 of the Criminal Code)	Used to restrict a person’s movements and activities where necessary and reasonable to protect the public from a terrorist act e.g.: remain in premises between certain times of day wear a tracking device restricted access to the internet participate in counselling or education (if the person agrees).	2005 – 2014: the order would substantially assist in preventing a terrorist act or the person had provided training to or received training from a listed terrorist organisation Post 2014: the order would assist in preventing a terrorist act or the support or facilitation of a terrorist act the order would assist in preventing the engagement in, support or facilitation of hostile activities overseas the person has participated in training with a listed terrorist organisation or the person has been convicted of a terrorism offence in Australia or overseas.
Preventative Detention Orders (Part 5.3 of the Criminal Code, Terrorism (Police Powers) Act 2002 (NSW))	Police can detain a person to prevent an imminent terrorist act or to preserve vital evidence in the immediate aftermath of a terrorist act. Person can be detained for up to 48 hours under Commonwealth law, or up to 14 days under State or Territory law.	the terrorist act is imminent (within the next 14 days) the making of the order would substantially assist in preventing a terrorist act occurring detaining a person is reasonably necessary to prevent a terrorist act occurring.

The ASIO investigation found he was not involved in politically motivated violence and had not tried to incite communal violence. While Monis’s behaviour was offensive, he did not cross the line into inciting violence

The JCTT assessed evidence of Monis’s behaviour against the elements of all relevant criminal offences under the Commonwealth Criminal Code, including national security related offences. The JCTT assessed that based upon the available material which could be used as potential evidence of Monis’s activities during this period, his behaviour did not support pursuing terrorism or urging violence type offences.

There was no evidence Monis was involved with terrorism or related activity throughout the investigation. Whilst Monis made inflammatory public statements, including posting material on his website and Facebook pages, law enforcement agencies assessed the material did not meet legal thresholds for promoting violence or encouraging acts of terrorism. For these reasons, the new advocating terrorism offence introduced in late 2014 would also not have been applicable, even had it been in place.

For example, in 2008 the JCTT, with the assistance of the Commonwealth Director of Public Prosecutions, considered whether a video that was available on Monis’s website breached any Commonwealth laws. The video contained a message delivered by a person on behalf of Monis, which warned of dangers to Australia as a result of the Australian Government’s support of the execution of the Bali Bombers. The video did not breach any Commonwealth laws, because it did not urge the commission of any offence or violence, but were statements of belief about the consequences of Australian Government policy.

Control orders and preventative detention orders are exceptional powers that are used when there is an identified risk to public safety and it has been established that restricting the person’s movements or activities would assist in protecting the public from a terrorist act. Law enforcement agencies did not seek a control order or preventative detention order because the relevant thresholds would not have been met to obtain one. The relevant thresholds would also not have been met had the amendments in 2014 to expand the control order regime been in place.

However, the JCTT did consider there was sufficient evidence to pursue criminal charges against Monis for sending offensive letters during 2007, 2008 and 2009 to the families of Australian soldiers killed in Afghanistan. Accordingly, the JCTT investigation focussed primarily on these offences, which ultimately resulted in Monis being convicted and sentenced to community service.

In October 2009 police made an enquiry about Monis’s website to the Australian Communications and Media Authority, which has the ability to remove prohibited online content (such as advocating the doing of a terrorist act, or promoting, inciting or instructing in matters of crime or violence) if it is hosted in Australia. The Australian Communications and Media Authority provided a preliminary assessment that the material on the site was unlikely to meet the threshold for prohibited content and that therefore there would be no grounds upon which it could remove the web page content. JCTT members then sought to have the site suspended by the Australian host of the website but by December 2009 Monis had re‑established his website with an overseas host.

2013-14 – Monis charged with being accessory to murder and sexual assault offences

In 2013, Monis was arrested and charged with being an accessory to the murder of his former partner, Hayson Pal. In 2014, Monis was further charged with sexual assault offences dating back to 2002. Despite the violent nature of these alleged crimes, Monis had still not breached terrorism laws or met the threshold to trigger the availability of national security powers, such as a control order or preventative detention order. Monis’s acts of personal violence were exclusively directed towards women who he knew in one capacity or another, rather than towards the public at large. National security agencies assessed there was nothing to suggest Monis was involved in terrorist related activities.

December 2014 – Complaints about Monis’s Facebook page

In the weeks prior to the siege, the NSH received 18 reports from members of the public referring security agencies to Monis’s public Facebook page. Agencies concluded these postings did not amount to a national security threat, as discussed further in Chapter Eight.

Box 17: Risk assessment

Whether the information available to the decision-maker at the time was the appropriate information?

The JCTT, AFP and NSW Police Force are the decision-makers that may have pursued preventative detention orders. AFP and JCTT are the relevant decision-makers that could have pursued a control order or prosecution of a terrorist offence.

Both law enforcement and national security agencies were aware of the information relevant to Monis’s activities that was available prior to the siege. The Review has found no information existed prior to the siege that would have allowed law enforcement and national security agencies to better use national security legislation.

Whether the judgements made about risk were reasonable given the policy framework?

In this instance, it is not whether a judgement about risk was reasonable, but whether the judgement of whether his conduct met the legal thresholds was accurate.

While Monis was consistently on the radar of law enforcement and intelligence agencies from the time he arrived in Australia, based on information available:

• at no point prior to the siege could he have been successfully charged with a terrorism offence under the law

• control orders and preventative detention orders are extraordinary, and Monis’s actions never reached the threshold for these powers to be used prior to the siege.

The Review found no evidence that national security legislative powers could have been better used by law enforcement agencies.

Whether the framework had then, or has now, the right balance of risk?

The relevant framework is the national security legislation, which is detailed above (including legislative changes). This legislation must balance individual freedoms against the risk of a terrorist act.

Australia’s control orders and preventative detention orders are preventative regimes that enable intelligence and law enforcement agencies to intervene before a terrorist act occurs.

The regime contains thresholds and safeguards to ensure the powers are proportionate and only used where appropriate. A key threshold is an identified risk to public safety and, in the case of preventative detention orders, an imminent terrorist threat. Whilst recent amendments have strengthened the control order and preventative detention order regimes, they have not departed from this fundamental principle.

Having a balanced threshold for national security legislation is important, and while not triggered for Monis, this regime has been used before. To date, four control orders have been issued under Commonwealth legislation, and three preventative detention orders have been issued under New South Wales legislation.

The Review notes that control orders and preventative detention orders are vital tools in assisting in the prevention of terrorist incidents. Although the INSLM and PJCIS will review the provisions by September 2017 and March 2018 respectively, it is critical that the efficacy of these tools is constantly monitored in light of the evolving nature of the terrorist threat and operational experience.

Is a change in law or practice required to the risk balance – if so, what is it?

The Review recommends the Australia New Zealand Counter Terrorism Committee monitor the operation of control orders, as well as preventative detention orders, to ensure they meet evolving operational needs.

Consequences of this recommendation?

Monitoring by the Australia New Zealand Counter Terrorism Committee of the operation of control order and preventative detention order provisions will ensure all jurisdictions are able to contribute their consideration and use of the provisions.

Recommendation

The Review recommends that:

13. Noting the enhancement of control order provisions in late 2014, ANZCTC should monitor the operation of control orders, as well as preventative detention orders, to ensure they meet evolving operational needs.

Ten: Public Communication

The Review was asked to consider and make recommendations in relation to the effectiveness of public communication including coordination of messaging between the Commonwealth, NSW and jurisdictions.

Key points

Public communication during and immediately after the siege was conducted effectively and in accordance with relevant protocols.

There was a constant flow of relevant information to the public.

Public safety was properly addressed, and the public received timely messages from political leaders and NSW authorities.

The media was responsible, and effective community outreach helped to ensure there was no subsequent significant community backlash.

 This chapter considers whether public communications protocols were followed in relation to the siege, and assesses whether communication by the Commonwealth and NSW governments was effective when considered against the following objectives:

• managing public safety
• informing the public and engaging the media
• providing reassurance, including maintaining confidence in the ability of Australian authorities to respond to the event
• managing the risks of retaliation against the Australian Muslim community
• supporting recovery.

This chapter does not consider how Monis used hostages to communicate through social media, as this issue may be considered by the Coroner.

Overview of Public Communication

Tables 3 and 4 on the following pages summarise the public communication by the Commonwealth and NSW governments during and immediately after the siege on 15‑16 December 2014.

Across the course of the two days, NSW Police Force held six press briefings and issued eight media releases. They also published a steady stream of tweets during the siege – often only minutes apart – providing live updates which were picked up by the media.

The Premier held a joint press conference with the NSW Police Commissioner in the afternoon of 15 December 2014 and again early on the morning of 16 December 2014.

Table 3: Summary of Key Public Messages on 15 December 2014

Time	Public communication	Sample of advice provided
15 DECEMBER
10.00 am – 12.30 pm	NSW Police Force: tweets, Facebook and media release PM: Media release, press conference	Police operation in Martin Place underway Information about safety and public transport arrangements Reassures public that law enforcement is responding PM has spoken with Premier Baird and offered all assistance Thoughts and prayers with persons caught up in the incident
12.30 pm – 4.00 pm	Premier media conference     NSW Police Force press briefing	Premier expressed confidence in the NSW Police Force Prayers and thoughts to hostages and families Provided transport update Informs public about hostage situation Police are addressing the situation Advises no contact with offender so far Refers people to a number to call for Martin Place information
4.00 pm – 5.30 pm	NSW Police Force tweets, Facebook	Key points from DC Burn media briefing Public transport operating normally, OK to leave city Three people have emerged from café, unclear how many remain Do not believe anyone else in café injured Negotiators and investigators on scene. Priority is safety Explains how public can provide information on the situation Safety information, update on transport arrangements
6.45 pm – 10.00 pm	NSW Police Force tweets, Facebook	Reiterates key points from DC Burn media conference Five people have emerged, notes how people can assist police Repeats public safety messages: urges business as usual Map of Martin Place siege exclusion zone

The Prime Minister had one press conference on 15 December, and participated in a joint press conference with Premier Baird, AFP Commissioner Colvin and NSW Deputy Commissioner Catherine Burn on 16 December.

On 17 and 18 December there were further press conferences and media releases by the Prime Minister, the Premier and the Australian Federal Police.

Communication Protocols

Communication during a terrorist event is governed by the protocols summarised in the Box 18. The Review notes that the report released on early 15 December by the NSW State Crisis Centre stated that the NSW Police Force did not indicate whether the incident was a terrorist incident, however, for internal purposes had set up their operations accordingly.

Overall, the Review finds that the communication protocols were followed, noting that all NSW emergency plans are to be implemented with flexibility and scalability and do not need to be activated in their entirety if the situation does not warrant it. This included:

• NSW took the lead for managing public communications during the siege and in the immediate aftermath due to the localised scale of the Martin Place siege and the fact a national terrorist situation was not declared.

• The NSW Crisis Policy Committee was activated, pursuant to the NSW Counter Terrorism Plan, and coordinated the strategic public messaging.

• A Public Information Functional Area Co-ordinator (PIFAC) was established, a police role, responsible for the coordination of public information.

• The NSW Crisis Policy Committee developed and approved public messages and information for dissemination, consistent with the protocols.

Table 4: Summary of Key Public Messages on 16 December 2014

Time	Public communication	Sample of advice provided
16 DECEMBER
2.44 am	NSW Police Force tweet	Siege over, more details to follow
5.30 am – 6.30 am	Premier media conference with NSW Police Commissioner NSW Police Force tweets and media release	The Premier expressed his shock, and said his thoughts and prayers were with the innocent victims Thoughts are also with the hostages who have been freed Critical incident established, advice re roads in Sydney Details of confrontation at 2.10am, with shots fired and several casualties
6.30 am -10.00 am	PM media releases and tweets	Thoughts and prayers with victims Flags on Commonwealth buildings will fly half-mast for victims Confirms PM was briefed on situation by Premier Baird and Commissioner Scipione Commonwealth will work with NSW National Security Committee to meet shortly
10.00 am – 12.00 pm	NSW Police Force: media release, press conference tweets, Facebook	Terrorism hoax alert Direct public to where they can give information about terrorism DC Burn media conference Reassurance that police are assisting victims Information on offender Thanks everyone involved Media release gives victim update (deaths and injuries) Who to contact if experiencing trauma or feeling ill Commissioner Scipione pays tribute to victims and police/emergency services Premier acknowledges victims, pays tribute to NSW Police Force and emergency services
Afternoon	Press conference – PM, Premier, AFP Commissioner Colvin, DC Burn	Detailed press conference Expresses sympathy for victims Thanks police and emergency services Updates public on what happened in siege Update on police operations and investigation
Evening	NSW Police Force Media release tweets, Facebook	Updates on siege Sydney CBD open for business. Explains Operation Hammerhead has begun (safety objectives)

• AGD coordinated statements by the Prime Minister and other State and Territory leaders, based on the strategic public communication decisions of the NSW Crisis Policy Committee (consistent with the Australia-New Zealand Counter-Terrorism arrangements).
• A media assembly area was identified for media from where they had a reasonable vantage point and could be accessed by Media Officers when required.
• CHUMBY (a web based product used by NSW Police Force and other emergency service organisations to disseminate information directly to media newsrooms) was used during the incident. NSW Police Force issued five CHUMBY messages relating to advice to media organisations and advisories for media conferences.
• The ‘sydneyALERT’ system was activated. It is an opt-in service for emergency services to alert the public of Sydney via SMS and e-mail to events that could disrupt normal business. It provides building managers, emergency wardens and security staff with information and instructions to help them manage and assist staff and others in their buildings during an incident.
•  

Box 18: Summary of communication protocols

The National Counter-Terrorism Plan sets out Australia’s strategic approach to preventing, and dealing with, acts of terrorism in Australia and its territories. The National Counter-Terrorism Plan handbook sets out in detail procedures, structures and coordination arrangements necessary to ensure the prevention, response, investigation and management of the consequences of terrorism on a national basis.

The NSW Emergency Management Plan provides the structure for NSW to respond to an emergency, including a terrorism situation. This was activated in response to the siege.

The NSW Counter Terrorism Plan provides for roles and responsibilities during a terrorist incident in NSW.

The NSW Public Information Response and Recovery Arrangements (PIRRA) and the Australia-New Zealand Counter-Terrorism Committee’s National Security Public Information Guidelines (NSPIG) are two terrorism specific protocols for public communication regarding the Martin Place siege. Under these protocols:

• The Commonwealth leads communication on a National Terrorist Situation, otherwise the State or Territory where the event occurs is primarily responsible for public communication on the terrorist response.
• The NSW Crisis Policy Committee which operates from the State Crisis Centre oversees the NSW media strategy.
• The NSW Police Force is the lead agency for the management of information to the public in the event of an imminent or actual terrorist incident.
• PIFAC, a police role, is responsible for the coordination of public information.
• Media speculation must be addressed promptly by the relevant agency.
• Agencies must not make unapproved comment on another agency’s area of responsibility.
• All agencies have a responsibility to ensure adequate training and resources to respond to any situation/incident.

There were options available for activation under PIRRA such as the establishment of a Public Information Coordination Office that were not deemed to be necessary given the Martin Place siege was contained. The Review team is of the view that this was an appropriate response. The effectiveness of the public communication is discussed below against four primary objectives.

Both the NSPIG and the PIRRA are currently being updated. The NSPIG review is the responsibility of the ANZCTC’s Public Information Sub Committee. The PIRRA review is the responsibility of the NSW State Counter Terrorism Committee.

Managing public safety

As summarised in Table 3, early messages about the siege on 15 December issued by NSW Police Force and reinforced by the Prime Minister and NSW Premier focussed on public safety. This included notifications about the location of the incident, the extent of the secured area (including affected transport routes) and information for occupants and managers of nearby buildings.

The Review found that clear and consistent advice was provided to manage risks to public safety and to address the public’s need for information in response to the incident, both nationally and locally.

Within a short time of the siege commencing, government communications made clear that NSW Police Force was the single point of authority for operational updates affecting public safety.

Members of the public were encouraged early to report suspicious information to the NSH, supporting the operational response.

As part of the NSW State Emergency Management Plan, a Public Information Inquiry Centre was activated. It received 1712 phone calls during the Martin Place siege incident.

The sydneyAlert system was activated to alert those who have opted into the system to the events in Martin Place (e.g. building managers). Messages were disseminated rapidly. As with many crisis situations there was a small amount of reliable information about the nature and extent of the threat (e.g. references during the siege to suspicious packages, and overseas experience of multiple gunmen) and so messages were often cautious in the advice given.

Clear advice was provided to the public that there had been no change to the national counter‑terrorism public alert level, and that people should continue to go about their activities as usual.

Informing the public and engaging the media

As summarised in Tables 3 and 4, there was a constant flow of information during and after the siege via press conferences, media releases and social media. The public was kept well informed as the siege unfolded which helped to keep speculation in check.

While the NSW Police Force sought the services of an Auslan interpreter to ensure appropriate messages for people with a disability, the interpreters were not able to attend for logistical reasons. NSW Police Force have details of Auslan interpreters to contact during an emergency but on-call arrangements should be reviewed.

Media reporting about the situation was measured and responsible. Some examples include radio presenters pulling callers off air if they expressed racist or inflammatory anti-Islamic views. Spokespersons conveying public messages about Monis’s actions during the siege were cautious in their choice of language. Monis made attempts to secure media attention, issue demands and speak directly to people such as the Prime Minister or journalists via the media. The cooperation provided by media outlets with NSW authorities ensured these attempts were unsuccessful and the messages he did broadcast on social media were not further broadcast on mainstream media.

The cooperation of the media reflects well on NSW Police Force training sessions conducted with the media prior to the siege. Such sessions ensure media remains vigilant to the risks and responsibilities of public reporting during times of crisis, for example, the importance of not revealing police locations during a hostage situation. While some tactical information was filmed early on during the siege, the media cooperated with police to manage this appropriately.

Box 19: Monis’s contact with media organisations

Monis demanded the ABC broadcast that the siege was an ISIL incident. The ABC and other stations did not follow this request and cooperated with the instructions of NSW Police Force.

The 2GB radio station received calls from people claiming to be hostages. The calls were not put to air.

Media who were directly contacted by Monis (or through the hostages) went immediately to police before responding to the request. Negotiators and media offices were sent to assist the media.

The Review notes the importance of media representatives being offered the opportunity to participate in government-led training exercises to further enhance cooperation in the event of future terrorism incidents.

While cooperation between the media and the police during the siege was very good, it is important that this not be taken for granted.

Reassuring the public and building confidence in the authorities

There are several aspects of the communications during the siege that provided reassurance for the community and instilled confidence in the authorities:

• Authorities spoke with one voice – the information coordinator for the NSW Police Force provided regular press conferences, spoke with authority, and provided information and details that reassured the public.
• Political leaders made early statements to reassure the community that the situation was in hand.
• Rumours and speculation were kept in check – a steady flow of police twitter updates gave the media facts to report, rather than rumours, and also drew attention to any hoaxes that were surfacing on social media.
• Messages were crafted and repeated to reassure the public – the NSW Police Force advised early and often that police were responding and addressing the situation, including ruling out tips about suspicious devices in Sydney, and urging business as usual.
• Public was advised how to obtain information.

Information flows between authorities were also strong and helped maintain order during the crisis.

The NSW Premier and the NSW Police Force Commissioner relayed key messages directly to the Prime Minister and the National Security Committee of Cabinet from the NSW Crisis Centre and via telephone and video conference.

The level of direct real-time briefing from the NSW Police Force Commissioner to the Prime Minister and the NSW Premier assisted situational awareness and leadership messaging. This type of leader-to-leader engagement is encouraged in the national counter‑terrorism handbook in the terms of reference for the National Crisis Committee.

National talking points were developed by AGD on behalf of the Commonwealth on the basis of information from NSW Police Force and other relevant agencies. These points were used as the basis for scripts used by operators of the NSH.

Authorities in other jurisdictions noted that they were approached for comment as soon as news of the incident broke. Cross-jurisdictional communication around an incident that occurs in one state is not well acknowledged in the NSPIG arrangements. The Review considers that the NSPIG should be updated to reflect the importance of the coordination of information and public communication to relevant agencies in all States and Territories during an incident to ensure effective communication across the country.

Managing the risk of violence arising from the siege

Monis proclaimed himself as an Islamic leader, and in the siege, used banners and symbols of Islam. He therefore made religion a part of the incident. This created two risks: that Monis’s actions would encourage further Islamic terrorist activity and that it would cause a backlash against Muslim Australians.

The risk of galvanising those prone to extremism is a growing concern in Australia. Terrorist groups are increasingly aggressive in using social media to promote events like these in their recruitment propaganda. Monis, acting alone, demonstrated the ease of carrying out a low capability attack. Even if Monis was not linked to ISIL, their propaganda magazine, Dabiq, hailed him as a martyr and urged would-be jihadists to mimic his actions.

In the context of public communication, agencies responded by encouraging the public to report incitements to violence to police.

This risk also highlights the need for governments to better understand how events like this will resonate with at risk individuals. This matter is addressed in more detail elsewhere in this Review.

Monis’s actions also created a risk of retaliation against Muslim Australians by other groups. For example, the Australian Defence League issued what it referred to as a ‘call to arms’, potentially encouraging anti-Muslim sentiment in the community with calls such as the one below posted on a social media platform:

If 1 person is harmed, we are calling on all Australians to converge on Lakemba tonight. Who is ready.

However, while there were instances of individual intolerance shown to some Muslims in the community, overall community response to the siege is to be commended.

Muslim community leaders, such as the National Imams’ Council and the Islamic Council of Victoria, delivered strong, unequivocal messages condemning the actions of Monis.

Many Muslim Australians contacted the media and engaged the broader Australian community to share their vision of what it means to be a Muslim Australian.

During and immediately following the incident social media campaigns also encouraged solidarity and support between Muslim and non-Muslim Australians, most notably the #illridewithyou Twitter hashtag.

Government led messaging supported these efforts.

The Commonwealth and NSW acted quickly to categorically condemn any anti-Muslim sentiment and the illegality of any violent actions on the basis of race, religion, nationality or political opinion.

Both the NSW Police Force Commissioner and Minister for Communities held discussions with Muslim leaders on the day of the siege. A prayer vigil was planned, and the Muslim leadership were engaged and wanted to help.

The Premier was also involved in discussions with Islamic community leaders on the night of the siege.

Existing channels for engagement, including the ‘LivingSafeTogether’ networks and AFP and NSW Police Force community-liaison teams, were used effectively to reach out to key community leaders and groups.

Public Communication in the Recovery

The National and NSW emergency plans recognise that following the response phase to an event, there is a phase known as the recovery phase. Recovery is a long-term process designed to address the impacts and effects of the incident, rather than the response phase, which deals with the incident itself.

Public information is critical to an effective recovery.

NSW established a Government Coordination Committee on Wednesday 17 December 2014 to coordinate the recovery. This was chaired by the Ministry of Police and Emergency Services and the PIFAC was a member of this committee.

A key element was the production of information for the public on what was being done to support victims and families, as well as emergency responders, and also setting out where assistance relating to wellbeing, health and small business could be accessed. This information was made rapidly available on the NSW Government Website and contained links to more detailed information on agency and NGO websites.

Recommendations

The Review recommends that:

14.  Media representatives should be offered access to government-led training exercises to further improve cooperation in the event of future terrorism incidents.

15.  The National Security Public Information Guidelines should be updated to ensure relevant agencies in all States and Territories have clear guidance on accessing information and communicating with the public during an incident in any State or Territory.

Eleven: Identity

In the course of its investigation, the Review noted that government agencies interacted with Monis under a significant range of identities, aliases and titles. The Review has summarised its findings and recommendations on Monis’s identity in this chapter.

Man Haron Monis was born Mohammad Hassan Manteghi in Iran in 1964 and this was the name on his travel documentation when he entered Australia on 28 October 1996.

NSW has strong laws governing changing a person’s name. Three changes of name are permitted (unless an exemption is granted) and protocols are in place to share change of name information between NSW Registry of Births, Deaths and Marriages and the NSW Police Force. Common law allows a person to use a new name without formally registering a change with the NSW Registry of Births, Deaths and Marriages, although many government agencies will require evidence of a formal registered change of name.

On 16 September 2002, Monis formally changed his name to Michael Hayson Mavros. On 21 November 2006 he again formally changed his name to Man Haron Monis. The Review has also found that Monis was known by as many as 31 aliases, which were either his legal names or various combinations around a theme of names. However, the Review has not found that any of these aliases were used to defraud, evade or deceive any government agencies. No evidence has been found to indicate that he registered other names in other States or Territories.

While Monis used his current legal name when dealing with NSW agencies, he used aliases when dealing with other agencies such as Australia Post, Australian Business Registry and the Australian Electoral Commission as he was not always required to prove his ‘legal name’ with formal documentation.

Some automated information sharing did occur between agencies such as the NSW Police Force, Roads and Maritime Services and the NSW Registry of Births, Deaths and Marriages. These exchanges related to identity information such as name changes, licence information and car registration details. Despite these exchanges, Monis was able to provide non-formal name details to agencies indicating that more robust checks on identity are needed in Commonwealth and State and Territory government agencies.

Work to improve identity checking has already begun. The Document Verification Service (established in 2009) is a secure online system that allows government agencies to verify information on evidence of identity documents (visa, citizenship, change of name, birth, and marriage certificates, Medicare, Passports, Immigration Cards, Registry by Decent) against the issuing agency. The National Identity Proofing Guidelines (issued in October 2014) set out procedures for collecting and verifying evidence of a person’s identity, based on varying, risk-based levels of assurance. The Commonwealth has also developed the National Facial Biometric Matching Capability to help mitigate the vulnerabilities in name-based identity checks. These systems have not yet been adopted by all Commonwealth or States and Territories government agencies.

Recommendations

The Review recommends that:

16.  Agencies should adopt name-based identity checks to ensure that they are using the National Identity Proofing Guidelines and the Document Verification Service, and by improving arrangements for sharing formal name change information between Commonwealth and State bodies (timing and budgetary impacts to be identified by all jurisdictions).

17.  Agencies that issue documents relied upon as primary evidence of identity (e.g. drivers’ licences, passports, visas) should explore the possibility of strengthening existing name-based checking processes through greater use of biometrics, including via the forthcoming National Facial Biometric Matching Capability.

Appendices

I: ASIO Prioritisation Model

This section provides a synopsis of ASIO’s management of incoming intelligence or information and investigative prioritisation processes. Detailed information on indicators and considerations has been excluded due to its security classification.

ASIO’s role is to protect Australia, its interests, and its people by identifying and assessing possible security threats in sufficient time and with sufficient accuracy to prevent them eventuating. ASIO’s work is predictive and advisory—an exercise in informing risk management and enabling others to take preventative actions. The earlier ASIO can provide advice, the greater opportunities there are to reduce the risk to the community. ASIO is responsible under the ASIO Act for the protection of Australia and Australians from, inter alia, politically motivated violence and the promotion of communal violence. The Act mandates that ASIO’s responsibilities in these areas extend geographically beyond Australia and include Australia’s obligations to other countries.

Australia currently faces a concerning security environment due to the challenge and volatility of threats from terrorism, clandestine activity by foreign powers, and self-motivated malicious insiders abusing privileged access to government information. ASIO has a range of systems for managing these challenges, including partnering with other agencies, ensuring a strategic focus on threats, prioritising collection, investigative and analytical efforts, and ensuring conscious risk-based decisions are made in relation to security investigations.

Sources of information

ASIO derives intelligence to support its counter-terrorism role and activities from a variety of sources. Some, such as referrals received from the NSH, are common to a variety of Australian government and law enforcement agencies. Others, including reporting collected by the Australian Intelligence Community and international partners, can be more sensitive and are shared between agencies in accordance with agreed protective principles. There will also be further information, derived by ASIO in the course of its security intelligence investigations, which will be unique to ASIO and may not be shared as raw reporting (although any relevant threat information will be disseminated as assessed reporting or by passage to relevant actioning agencies) but will be considered when producing analytical products.

Internal information management channels

ASIO gathers information from classified and unclassified sources which is then given an initial assessment to identify whether the information should be classified as a lead and subject to further investigation. Depending on the nature of the information, the initial assessment will be undertaken by one of three different areas.

• The first, with the broadest scope, is the work undertaken by the Leads function which involves a number of clearly defined stages to receive, evaluate, investigate and resolve referrals from reporting streams such as the NSH, Customs and Immigration reporting, and reporting direct to ASIO by the public.
• The second, undertaken by investigative analysts, is into information identified in the course of existing investigations to resolve whether it identifies additional persons or issues of security concern who should be the subject of investigation in their own right.
• The final area resolving incoming information is the 24/7 Monitoring and Alerts area, which ensures continuous review of incoming material and active monitoring of classified and unclassified information to identify any reporting which needs immediate attention.

The quantity of material received through the Leads function is generally more diverse than that identified through other channels. For the past few years, the ratio of inquiry-level activity to more in-depth investigations has been about 10:1. Leads referrals have also surged significantly since September 2014 and remain much higher than the historical average.

Box 20: Leads and the Reasoned Assessment Model (RAM)

The Reasoned Assessment Model (RAM) was developed for the then Emergent Leads Unit in 2005-2006, in consultation with Australian academic experts, and is still used within the leads function to efficiently triage and deal with high volumes of referrals that are often single-source and uncorroborated. The RAM is designed to improve assessment outcomes by accounting for factors such as cognitive bias, and establishes a framework for making assessments based on analysis to better prioritise identification of potential threats and subsequent activity.

Using the RAM, leads assessments take into consideration aspects of the reporting such as intent and capability of the subject of the reporting, the detail provided, the plausibility of a described scenario, source access, motivation and objectivity. Analysts also consider whether reporting may be vexatious in nature, actually referring to a criminal activity or otherwise outside ASIO’s remit.

In order to successfully manage these referrals, strict prioritisation is required to determine how and when referred information will be considered as a possible lead. Referrals containing security indicators such as threats to life, statements indicating radicalisation, threats to High Office Holders or procurement of precursor chemicals are given priority for evaluation and investigation in the Leads function.

Initial assessment of incoming information by the Leads function

ASIO Leads officers will look for security-relevant indicators to inform their assessment of incoming information as a lead. They will also consider the prospect for resolution of the information – so if the information is insufficient to support a Lead investigation and is not clearly linked to one or more security indicators it is likely to be closed without further action.

Referral volumes shift according to events in the security environment, particularly as many referrals come from members of the public. Previous spikes in reporting have occurred as a consequence of terrorist attacks overseas, disruptions and arrests, and NSH advertising campaigns. Not all referrals can be investigated to the same extent. In the current context of high volumes of incoming referrals, Leads analysts and evaluators apply thresholds to assist with determining whether referrals require further work.

Once incoming information has been classified as a lead, it will be subject to a further prioritisation process based on assessment of the risk associated with the lead.

Lead Prioritisation Categories

• High Priority Lead: Leads requiring immediate assessment or further action
  • Leads where there is an assessed urgency of threat, including reference to threat to life, or which have multiple security indicators
• Medium Priority Lead: Leads requiring assessment within a reasonable time
  • Leads with several security indicators but which have no indicators of urgency
• Low Priority Lead: Leads which relate to security but which are comparatively weak
  • Leads not relating to imminent threat and with few security indicators
• No Priority assigned: Leads determined to contain no information of security relevance.
  • Leads where information is unverifiable or unactionable or relates to purely criminal acts – primacy for these reports is with other relevant agencies to which they have been referred (by the NSH or other reporters as appropriate)

The reviewing officer also checks whether the information relates to a previously received lead (for example, advice of recent activities by an identified person who was the subject of a previous referral) and, if so, links it to the previous referral. This may, but does not necessarily, change the priority for the lead.

• For example, if there had been a situation where five different reports, each detailing a different security indicator, were received over a period of time about the behaviour of a specific individual the initial assessment may have identified this as a low priority lead (based on the first advice noting only one indicator). However, the ongoing reporting could result in the lead being re-prioritised as a higher priority, based on the accumulated new intelligence from the subsequent reports.
• Conversely, if five reports were received about an individual maintaining a website of concern, but the website had not changed substantively between reports, then the priority of the lead would likely remain unchanged from the initial assessment.

Prioritisation of Counter-Terrorism investigations

Within the broad national intelligence prioritisation framework, ASIO’s counter-terrorism-related investigative and assessment priorities are informed by its regularly reviewed internal settings for its intelligence strategic focus. This identifies those areas which ASIO has assessed on the basis of available intelligence as representing the most significant threat and/or harm to Australia’s national security and therefore require investigation and assessment.

The key challenge for ASIO investigations is to address both the increased depth and breadth of the counter-terrorism threat. ASIO is focussed primarily on known immediate or obvious threats, with limited capacity to investigate matters which are not of more obvious or immediate security concern. Within current resources, ASIO has had to rigorously prioritise its efforts.

ASIO investigations are prioritised into one of five categories, reflecting the imminence and impact of the assessed threat associated with each case.

Investigation Prioritisation Categories

• Priority 1 Investigation: Imminent extremist activities
  • Investigations have identified current intent and capability to undertake a terrorist act and where there is intelligence of plausible, specific planning and preparation to attack Australian interests
• Priority 2 Investigation: High threat extremist activities
  • Investigations have identified credible information that requires time critical action and where there are consistent indicators of intent and/or capability
• Priority 3 Investigation: Low threat extremist activities
  • Investigations have identified intent to undertake terrorist activity and there are indicators demonstrating plausible but still aspirational preparations
•  Priority 4 Investigation: Potential or latent threats
  • Investigations have identified no specific activity of concern or security indicators for an extended period but a security risk remains; investigative coverage and occasional reactive response is needed
• Priority 5 Investigation: Emergent lead resolution
  • Investigations where information is not related to a current case and is not time critical, but where the security relevance of the information requires resolution

ASIO constantly re-allocates collection, investigative and analytical resources based on the assessed threat in the case of terrorism and harm in the case of espionage and foreign interference. The complexity and scale of managing the priority caseload has grown in recent years, driven predominantly by the influence of the conflicts in Syria and Iraq. The task of detecting planning for terrorist acts is difficult, particularly as they are increasingly driven by individuals and towards acts with a low level of sophistication, and it cannot be guaranteed that there will always be prior intelligence which can enable prevention. Attacks without prior warning are feasible.

In light of the significant residual risk due to the limited resources available to progress these security investigations, on 4 August 2014 the Commonwealth agreed to additional funding and a range of measures to build agency capability and capacity directed at countering terrorism. As part of this initiative, ASIO received significant funding over four years to increase the numbers of specialist officers to strengthen ASIO.

Due to the time it takes to recruit and train suitable staff for ASIO, this additional resourcing will take some time to translate to increased capacity in work areas. In recognition of this, ASIO continues to strictly prioritise its workload in line with the priorities set by the Australian Counter Terrorism Centre and works with law enforcement partners to ensure a best fit of limited resources against the most serious threats.

• Threat to life investigations will always be afforded the highest priority.
• As the new capability builds up, ASIO will remain focussed on the higher categories of terrorism threats, with more limited scope to address other threats (such as radical activities which have not yet become violent).
• This means that ASIO, its counter-terrorism partners, and the Commonwealth will continue to carry a higher level of risk concerning the terrorist threat while the build-up of capability and capacity is undertaken.

II: Contributing agencies

Table 5, NSW agencies

Registry of Births, Deaths and Marriages

Corrective Services NSW

Department of Education and Communities

Department of Family and Community Services (FACS)

Legal Aid NSW

Ministry of Health

Courts & Tribunial Services

NSW Crime Commission

NSW Police Force

Office of Finance and Services

Office of the Director of Public Prosecutions

Roads and Maritime Services

Table 6, Commonwealth agencies

Attorney-General’s Department (AGD)

Australian Federal Police (AFP)

Australian Business Register (ABR)

Australian Communications and Media Authority (ACMA)

Australian Crime Commission (ACC)

Australian Secret Intelligence Service (ASIS)

Australian Securities and Investments Commission (ASIC)

Australian Security Intelligence Organisation (ASIO)

Australian Trade Commission (Austrade)

Australian Transaction Reports and Analysis Centre (AUSTRAC)

Commonwealth Director of Public Prosecutions (CDPP)

CrimTrac

Department of Defence (Defence)

Department of Employment (Employment)

Department of Foreign Affairs and Trade (DFAT)

Department of Human Services (DHS)

Department of Immigration and Border Protection (Immigration)

Office of National Assessments (ONA)

 

 

1. The Review notes that, if Immigration uses adverse information held by ASIO to support its decision making, it must (under the procedural fairness requirements in the Migration Act) provide that information (with some limitations) to the person affected. Some ASIO information is not for public consumption, although the Review judges that the relevant ASIO information was provided to Immigration in Monis’s case.

2. Under section 15(6) of the Security Industry Act, the Police Commissioner or their delegate may take into account any criminal intelligence report or other criminal information held in relation to the application that is relevant to the licence sought by the applicant.

3. Except in Queensland where a ‘permit to carry’ is not required for the swap of a ‘like-for-like’ firearm through a dealer (same category, action and named calibre/cartridge).