Back to top

Australia's Security Environment and Outlook

Australia’s national terrorism threat level remains at PROBABLE—credible intelligence, assessed to represent a plausible scenario, indicates an intention and capability to conduct a terrorist attack in Australia. Since the national terrorism threat level was raised in September 2014, there have been 14 major disruption operations of imminent attack planning and six terrorist attacks targeting people in Australia. The primary terrorist threat in Australia comes from a small number of Islamist extremists who are committed to violence as part of their ideology.

  • All but one of the attacks and disruptions have been related to Islamist extremism. Of the six successful terror attacks Australia has experienced, three involved the use of knives and three involved firearms.

The most likely form of terrorism in Australia remains an attack by an individual or small group using simple attack methodologies, though the possibility of more complex attacks cannot be ruled out.

  • While the threat of terrorist attacks conducted by lone actors continues, these threats are not isolated to Islamist extremists. Individuals motivated by other ideologies—such as an extreme left- or right-wing ideology—may consider conducting an act of terrorism.

Any terrorist attack in Australia over the next 12 months would probably involve weapons and tactics that are low-cost and relatively simple, including basic weapons, explosives and/or firearms. Basic weapons are readily available, as everyday objects that do not require specialist skills. Globally, terrorists have used basic weapons such as knives or vehicles to conduct lethal attacks, though explosives remain a favoured terrorist weapon.

Terrorist attacks that occurred in the West in 2017 have demonstrated the trend towards targeting people at crowded places such as bridges, stadiums, public transport facilities and restaurant areas—locations that feature a large number of people and relatively low levels of security. Attacks at crowded places can achieve terrorist objectives by causing fear, death and injury, as well as significant international media coverage. The 2017 attacks on the London and Westminster bridges in the United Kingdom showed the use of a mixed-mode attack, with the assailants using a vehicle in the first stage of the attack before continuing the attack with knives.

  • A range of online literature, including propaganda, provides weapons and tactics advice on how to conduct and improve the lethality of an attack. This literature includes simple instructions, which do not require specialist skills, on how to use readily available materials to make weapons, such as homemade explosives. Publicity about terrorist incidents is likely to provide further guidance and inspiration to terrorists.

While propaganda is still being produced by Islamist extremist groups overseas, there has been an overall decline in propaganda from groups such as the Islamic State of Iraq and the Levant (ISIL). This propaganda still calls for attacks in Western countries, and we continue to expect that, for years to come, this propaganda will remain accessible and justify the use of violence.

Dispersal of foreign fighters

Although significant uncertainty exists about the future shape of ISIL and the foreign fighters who joined it, we expect the legacy of ISIL and the networks it has built, in person or online, will continue to adversely affect both the global and Australian security environments for years to come. These will also endure long past the current manifestation of ISIL in Syria and Iraq.

The collapse of ISIL’s caliphate and its loss of territory in Syria and Iraq resulted in the dispersal of many foreign fighters who had travelled to Syria and Iraq to support ISIL. It is likely some ISIL fighters and their families have tried to depart Syria, and thousands have been detained in Syria and Iraq. Others may travel to alternative conflict zones, but this will depend on each individual’s contacts, language skills, cultural affinity and associated networks. However, we remain concerned about a significant, but unknown, number of foreign fighters who cannot be accounted for.

Australian returnees

Of the Australians who travelled to fight with or support Islamist extremist groups in Syria or Iraq, we expect a very small number may return to Australia voluntarily or through deportation. Whether these individuals will present an ongoing terrorist threat to Australia depends on their ideology and willingness to engage in violence onshore in support of that ideology. Beyond planning attacks they may also hold a position of greater standing among Australia-based Islamist extremists, which they could use to influence, radicalise and recruit others.

Those foreign fighters who have remained longer in the conflict zone are likely to have demonstrated more resolve and commitment to the ISIL cause and narrative, endured hardship and poor living conditions, and participated in multiple battles. Many may have developed international connections, been exposed to sophisticated military planning or become part of ISIL’s terrorist support networks that move money, people and materials across international borders.

This cohort is likely to return with increased security awareness, which will limit our understanding of their experiences, their networks—both in Australia and overseas—and, more importantly, of the potential threat they may pose now and in the future.

Communal violence and violent protest

Most Australian protests, while occasionally employing disruptive tactics, comply with regulations and conclude without significant incident. However, hostility between extreme left- and right-wing proponents at protests occasionally results in confrontational behaviour. Protests on other issues—such as government policy and the environment—are mostly peaceful, and counter-protests are rare. Occasionally, disruptive tactics are employed and incidental acts of violence may occur.

Minimal violence was observed at protests between left- and right-wing proponents during 2017–18. This may be due to a number of factors, including the police response at these protests, which effectively kept groups separate.

Australia continues to experience low levels of communal violence, although incidents in response to specific local or international events that resonate with expatriate communities do occur occasionally.

Terrorism—the international security environment

South-East Asia

ISIL propaganda and calls for attacks continue to shape the security environment in South-East Asia, influencing extremist networks, small groups and lone actors to undertake acts of violence. In May 2018 an Indonesian pro-ISIL network conducted the deadliest terrorism campaign in Indonesia in over a decade, carrying out coordinated suicide-bombing attacks against police and churches in Indonesia’s second largest city, Surabaya. In the Philippines, the May–October 2017 ISIL-backed seizure of territory in the southern Philippines city of Marawi was the first time ISIL had held territory outside the Middle East and Africa. Elsewhere in South-East Asia, counter-terrorism operations in Malaysia have disrupted several pro-ISIL attack plots over the course of the 2017–18 reporting period. Under ISIL’s influence, disparate groups have coalesced, expanding cooperation and traditional areas of operation. Since the start of the conflict in Syria and Iraq, hundreds of individuals from South-East Asia have travelled to Syria and Iraq to fight with or give support to militant groups, including ISIL. The potential return of individuals with a hardened ideology, technical expertise or combat experience poses an ongoing risk to the South-East Asian security environment, where these individuals, or other foreign fighters travelling to South-East Asia, provide capability to networks in the region.

Middle East

The conflict in Syria and Iraq continues to dominate the Middle East security environment, which remains highly complex. Across the region, numerous threat actors continue to pose a significant security threat and retain the intent and capability to conduct attacks of varying complexity in several countries. ISIL has reverted to insurgency tactics in Syria and Iraq following large-scale territorial losses, and continues to conduct highly lethal attacks, including with explosive devices. The threat from al-Qa‘ida has also not diminished—al-Qa‘ida-aligned groups in Syria are well placed to benefit from ISIL’s losses in the region. While al-Qa‘ida’s presence in Syria continues to evolve, and al-Qa‘ida-aligned groups in Syria appear focused on local issues, they collectively represent an enduring threat to Australian interests.

Outside Syria and Iraq, ISIL-affiliated or -aligned groups and individuals have attacked a range of targets, aiming to exacerbate political and sectarian divisions. Despite a reduction in successful terrorist attacks, Turkey remains a high-threat environment. While authorities have disrupted several plots, both ISIL and Kurdish groups retain the intent and capability to conduct attacks, including in metropolitan centres. Yemen’s security environment remains highly unstable and complex—factors which both al-Qa‘ida in the Arabian Peninsula and ISIL-Yemen continue to exploit.


Islamist extremists continue to view Europe as a legitimate target for terrorist attack, and a number of attacks occurred there in 2017–18, including in France, Belgium, the United Kingdom, Russia and Spain. There were also a number of disruptions across Europe, including the disruption of a biological attack plot in Germany. Individuals and small groups inspired by Islamist extremist propaganda, or encouraged by groups such as ISIL, will continue to plan and conduct attacks in Europe. These attacks will most likely use basic weapons (such as knives and vehicles), firearms and explosives, and are likely to continue to target crowded places and police and military targets.

South Asia

The security environment in South Asia continues to decline. Afghanistan faces an enduring threat from the Taliban and Haqqani Network. Islamic State—Khorasan Province remains aggressive and has been reinforced by Central Asian ISIL fighters fleeing Iraq and Syria. Insurgent groups will continue to plan attacks against the semi-secure zone in Kabul, where the Australian Embassy and other embassies are located. Notwithstanding Pakistan’s continuing offensive against insurgent forces, extremist groups in Pakistan will continue to conduct attacks against government targets and religious and ethnic minorities.

India continues to face threats from domestic militants including Hindu extremists, Sikh separatists and north-east separatists, as well as India-based Islamist extremists inspired by al-Qa‘ida and ISIL. External threats from al-Qa‘ida, ISIL and Lashkar-e-Tayyiba are ongoing.

ISIL and al-Qa‘ida in the Indian Subcontinent continue to influence groups in Bangladesh, and maintain the intent and capability to conduct attacks against both domestic and foreign targets there.


In Africa, al-Qa‘ida- and ISIL-aligned groups pose a significant and ongoing security threat. Al-Qa‘ida affiliates in Africa continue to expand their areas of operation while ISIL-aligned groups pursue their own agendas and activities. Their terrorist campaigns seek to destabilise regional governments and undermine multinational efforts to improve the security environment, and they maintain their intent and capability to attack Western interests. Despite ongoing international and regional counter-terrorism operations, global jihadist ideology continues to resonate in the region and has resulted in the emergence of new areas of extremist activity, particularly in East Africa.

Espionage and foreign interference

Australia continues to be a target of espionage and foreign interference. Australia’s position as a major commodity supplier, scientific and technological innovator, and potential joint venture partner makes it a target of foreign states seeking to gain an advantage. Australia’s military modernisation program (including niche research and development capabilities) is also of interest to a wide range of foreign intelligence services seeking to obtain or compromise sensitive technologies.

We have identified foreign powers clandestinely seeking to shape the opinions of members of the Australian public, media organisations and government officials to advance their country’s own political objectives. Ethnic and religious communities in Australia have also been the subject of interference operations designed to diminish their criticism of foreign governments. A range of countries target Australia, some of which we have strong and enduring relationships with, which doesn’t appear to curtail their willingness to target Australia.

We are focused on activities that accord with the Australian Security Intelligence Organisation Act 1979 definition of ‘acts of foreign interference’—that is, activities related to Australia conducted by or on behalf of a foreign power that are clandestine, deceptive and/or threatening, or otherwise detrimental to Australia’s national interests, in Australia and internationally. These activities—undertaken covertly—represent a threat to our sovereignty, the integrity of our national institutions and the exercise of our residents’ rights.

We fully support the need to ensure Australia remains attractive to foreign investment by balancing national security against trade imperatives. However, the threat to critical infrastructure is changing and remains an ongoing challenge. While foreign investment can provide a measure of access and control over organisations and assets in Australia which may not otherwise be attainable, the threat is no longer only about access to critical infrastructure and associated data. For example, foreign intelligence services could use the ownership and the access provided through foreign investment to influence key decision-makers in the Australian Government and/or manipulate suppliers and customers during business decisions.

We regularly observe cyber espionage activity targeting Australia. Foreign state-sponsored adversaries target the networks of the Australian Government, industry and individuals to gain access to information and progress other intelligence objectives.

  • The number of countries pursuing cyber espionage programs is expected to increase, as these programs can offer significant intelligence returns with relatively low cost and plausible deniability.

As technology evolves, the sophistication and complexity of cyber actors and their targeting methods will increase. Our understanding of the cyber threat has also evolved. The blurring of traditional lines between the cyber activities of state and non-state actors means that attributing the source of cyber intrusions can be a difficult and lengthy process. It is therefore vital that we continue to develop our capabilities to ensure we can assist government to respond quickly and proportionally to any cyber intrusions.

The transition from influence to interference

Espionage and foreign interference are insidious threats—activities that may appear relatively harmless today can have significant future consequences. The harm may not manifest until many years, even decades, after the activity has occurred. Hostile intelligence activity can undermine Australia’s national security and sovereignty; damage Australia’s reputation and relationships; degrade Australia’s diplomatic and trade relations; inflict substantial economic damage; degrade or compromise nationally vital assets, defence capabilities and critical infrastructure; and threaten the safety of Australian nationals or others who serve Australian interests. Aggregate cost is difficult to quantify, particularly in dollar terms, but the harm poses a real and potentially existential threat to Australian security and sovereignty.

While there are now more vectors than ever through which espionage and foreign interference can be carried out, the passage of the National Security Legislation Amendment (Espionage and Foreign Interference) Bill and Foreign Influence Transparency Scheme Bill will provide valuable new tools to help combat this threat, offer a significant public deterrent, and make it more difficult for our adversaries to do business here. In our view, the new espionage and foreign influence offences and foreign influence transparency scheme regime will impose appropriate restrictions on foreign and Australian entities seeking to act contrary to Australia’s sovereignty, security and prosperity, while including important protections for our democratic rights and institutions.