ASIO's 'grim reality' as it picks over Bondi intelligence gaps

The sheer number of threats to Australia means the father and son who killed 15 people at Bondi Beach may never have become subjects of active, persistent surveillance by the nation's intelligence agencies.

Naveed Akram, 24, was assessed by the Australian Security Intelligence Organisation (ASIO) in 2019 but little is known about his or his father Sajid's activities between that date and last weekend when the pair allegedly carried out the worst terror attack on Australian soil.

Prime Minister Anthony Albanese has conceded that "quite clearly" ASIO and other agencies missed something between 2019 and the Bondi attacks, saying "there have been real issues".

Federal and state government leaders are also due to assess whether criminal intelligence gathered by security agencies could be used when making assessments about applications for gun licences, which currently are determined only on a person's criminal history.

The prime minister has flagged that how Australia's intelligence systems work must be the subject of closer scrutiny.

"We need to look back at what happened in 2019 when this person was looked at, the assessment that was made," Mr Albanese said.

"We need to look at the way the Commonwealth and state agencies interact and we need to make any adjustments that are necessary to the way that our intelligence, security agencies, police agencies all interact with each other."

The federal government has noted funding for ASIO and the Australian Federal Police is at record levels.

'Sheer scale' of people on ASIO's radar

But security analysts, including the Australian Strategic Policy Institute's Chris Taylor, warn the "grim reality" of intelligence gathering is that will always be more persons of interest "than there's any possibility to deal with through man or machine".

"I think people can potentially underestimate the sheer scale of that breadth of people of interest," Mr Taylor said.

"Look at the numbers of Australian-born people who went to fight with or join the ISIS caliphate [last decade]. Really extraordinary, and that's the tip of the iceberg."

Mr Taylor, who was a senior national security official in the public service, says there is a misconception that suspected terrorists are placed on a single "watchlist" where they fall under enduring surveillance.

But, as in the case of Naveed Akram, assessments are more generally made at a point in time.

"People are being assessed on the strength of what's available in a moment and then prioritised and triaged in that space. And of course, people change," Mr Taylor said.

"So you then need, in a way, almost for there to be another kind of intersection point for them to be drawn back up again into focus."

A raft of expected internal and external inquiries will ask whether there were more "intersection points" between 2019 and last weekend — and what could have been done to detect them.

Former Home Affairs secretary Mike Pezzullo, who led the department until 2023, says a commission of inquiry should examine whether resourcing for counterterrorism has been sufficient and whether agency frameworks were appropriate to deal with rising antisemitism since October 7, 2023 and after raising the terror threat level last year.

And it should ask if opportunities to prevent the Bondi attack were missed.

Mr Pezzullo says the inquiry could be held principally in-camera so it could begin immediately, without interrupting police investigations, and when legally safe to do so public hearings could subsequently be conducted.

But until scrutiny could be applied, Mr Pezzullo said, it was difficult to determine any intelligence failures based on "one fact laid out on a blank canvas" in 2019, noting that it would need to be considered in the context of other persons also under ASIO assessment at the time, the documents ASIO had to rely on and the collapse of the IS caliphate in that year.

Former ASIO director-general Dennis Richardson agreed it was still too early to tell if intelligence had failed.

"There may well have been a failure, or there may well have been a combination of failures. Equally, it is possible that ASIO made the right judgements at the right time," Mr Richardson told ABC Radio National.

"We simply don't know. We simply need to put a question mark over that."

Questions for ASIO over Akram pair

Naveed Akram was assessed between October 2019 and April 2020 due to his associations with members of a Sydney Islamic State group terror cell.

The ABC has reported that he was involved with Dawah Street Movement, a vehicle of radical Islamist preacher Wisam Haddad that has also been linked to self-declared Islamic State group commander Isaac El Matari and IS youth recruiter Youssef Uweinat.

El Matari and Uweinat, whom Akram was associated with, were both arrested just weeks after the then-teenager came to the attention of ASIO.

But the prime minister says ASIO found no evidence at the time "of any ongoing threat or threat of him engaging in violence".

The ABC has also reported that Akram was a regular attendee of the Al Madina Dawah Centre in Bankstown where Wisam Haddad regularly preached.

Mr Haddad, through his lawyer, has vehemently denied any knowledge or involvement in Sunday's terror attack.

But since that assessment of Akram, little has been said about whether intelligence agencies had any other further awareness of him or his father.

Mr Taylor said the Akrams' relationships and associations, centres they attended and other affiliations or communications would be the "jumping off point" for investigators looking into the black spot between 2019 and 2025.

"We're in a slightly odd space where we have these really discrete and quite obviously really contrasting data points at the moment and we just don't know what the kind of behaviour was, particularly around intent," he said. 

"We've seen the capability bit in relation to access to firearms and indirect access to firearms. What I don't think I've seen anywhere yet is affiliation or other forms of communication or association by either of them in that period between 2019 and 2025." 

Counterterror expert Greg Barton said ASIO would have to examine how it missed Naveed Akram's radicalisation.

"The question is: did he walk away from Islamic State extremism and come back to it after a few years because of somebody else? Or had he stayed that course and then his father been radicalised in the process and yet we didn't see it because we didn't go back to check on how he was going," Mr Barton said. 

"And it seems to be that's the case.

"I'm not sure, unless something else comes to light, that there were any efforts made to follow up in the last six years to see whether his condition had changed. If that's the case, that's a glaring omission."

Home Affairs Minister Tony Burke has acknowledged there was obviously "a radical change in the risk profile of [Naveed Akram]" — but whether that could have been detected between 2019 and 2025 remains to be answered.

Mr Taylor says data science could provide opportunities to generate fresh leads on persons of interest — and there will be questions about whether agency data capabilities are sufficient, and whether moments like Sajid Akram's application for a gun licence could have been fed back to intelligence agencies.

"There will be questions ultimately raised about the linkages between systems, such as we look at the firearms registry in New South Wales," he said.

"Are there ways to, in a sense, correlate information there so you can generate a new lead out of those circumstances that can then provide for another point-in-time assessment?"

Mr Taylor says the pair's travel to the radical Islam hotspot of Davao on the southern Philippines island of Mindanao, where authorities are investigating claims the father and son received military-style training, will also have to be examined.

He said there would be questions about the extent Australian authorities were aware of travel to Davao, which had been declared to the Philippines border officials.

Mr Barton agreed.

"If somebody was paying attention, that would be … a dashboard of flashing red lights and bells. But it looks like no one was watching that dashboard because they had fallen down the list of priorities," Mr Barton said.

Mr Taylor noted while hundreds of thousands of Australians travel to the Philippines every year, "there's a really significant difference between an Australian travelling from Sydney to Manila than there is from an Australian travelling to Mindanao".

The intelligence analyst noted that the circumstances of the shooters in this attack were also different to what Australian agencies had previously dealt with, and it would have to be examined whether their methods would need to be adapted.

Former ASIO boss Mr Richardson said if the intelligence agency made the correct assessments in 2019 about Naveed Akram, then it would be reasonable to expect that he would not be on a "movement alert list" five years later.

He added that relationships with foreign intelligence partners would also be an important piece of the puzzle.

Father-son duo presents differing pattern of behaviour

Alongside questions around ASIO's monitoring activities, Mr Taylor said the agency would also have to review whether its processes captured a different behaviour pattern with the father and son duo than it was used to.

The dynamics of attacks involving relatives can differ not only from the terror cell "conspiracies" seen in the 2010s, Mr Taylor said, where there was often communications between individuals that could be detected, but also from so-called "lone wolf" threats where there was often at least a digital footprint available.

"Are intelligence agency systems [that] developed to deal with organised conspiracy and lone actors able to deal with this kind of manifestation of terror?" he asked.

The Lowy Institute notes that family threats pose different challenges, often radicalising and mobilising quicker and with greater operational secrecy and security, not only evading some law enforcement tactics but also making it harder for bystanders to notice and raise an alarm.

They have also become a more common manifestation of terror threats, including by brothers in the 2013 Boston Marathon bombing, by brothers in the 2015 Charlie Hebdo shooting in Paris, and by a husband and wife in the 2015 San Bernadino attack in California.