Australia’s security environment and outlook

Espionage, foreign interference and sabotage

The threat to Australia from espionage and foreign interference is enduring, and sabotage of Australian critical infrastructure is possible. Although legislative change, operational initiatives and the impact of COVID-19 have made the operating environment more difficult for our adversaries, they have adapted their methods without changing their intent.


Foreign powers and their proxies, including intelligence services, continue to steal proprietary, sensitive and commercially valuable Australian information. Their efforts harm almost all facets of Australian society at all levels of government in every state and territory, as well as Australia’s science and technology sectors, both military and civilian.

Espionage is the theft of Australian information or capabilities for passage to another country, which undermines Australia’s national interest or advantages a foreign country.

The COVID-19 pandemic accelerated global digital transformation and uptake of new technologies, altering the way espionage can occur and the corresponding level of harm. Cyber espionage remains the most pervasive approach adopted by our adversaries; it is highly effective and deniable, and can be executed remotely. The Internet of Things and the popularity of social networking sites increase Australia’s exposure, while powerful digital tools make our adversaries more effective. Robust cyber security remains critically important in defending Australia from threats to security in the digital age.

The threat is not just from cyber espionage; foreign intelligence services and their proxies are seeking to develop relationships across government, academia and business to steal information. The abundance of personal information online helps foreign intelligence services identify and contact potential targets at all levels, to recruit as human sources. Despite efforts to either remove foreign intelligence officers and their proxies from Australia or hamper their activities, we anticipate the threat from espionage will increase during times of heightened tension.

Foreign interference

Australia remains the target of sophisticated foreign interference by a range of states.

Almost every sector of the community is a potential target for foreign interference. Foreign powers are targeting Australia’s parliamentarians, their staff and government officials; the media and opinion-makers; and the business and university sectors. The goal of these foreign powers is to build and leverage community and business relationships to covertly shape decision-making to Australia’s detriment—and they are prepared to invest years of effort to do so.

Foreign interference involves clandestine, deceptive or threatening activity conducted on behalf of a foreign power which aims to affect political or governmental processes or is otherwise detrimental to Australia’s interests.

Australians, including those from diaspora communities, continue to report that they are being threatened and intimidated by foreign intelligence services to change their behaviour.


Sabotage is damaging or disruptive activity against infrastructure—including electronic systems—to undermine Australia’s national security or advantage a foreign power. Acts of sabotage are not limited to irreversible, destructive attacks on physical infrastructure; they can include small-scale, selective and temporary acts of degradation or disruption to networked infrastructure.

The increasingly interconnected nature of Australia’s critical infrastructure exposes vulnerabilities which, if targeted, could result in significant consequences for our economy, security and sovereignty. Pre-positioned malicious software—which can be activated at a time of a foreign power’s choosing—presents the potential for disruptive or damaging attacks. While we have not observed an act of sabotage in Australia by a foreign power, it is possible—and becomes more likely—when geopolitical tensions increase.

Pre-existing foreign access to Australia’s infrastructure, established through foreign investment and/or involvement, and magnified through concentrations of ownership in key sectors, can provide or enhance opportunities for foreign powers and their intelligence services to conduct hostile activities.

Terrorism in Australia

Violent extremists, both religiously and ideologically motivated, continue to pose a threat to the Australian community.

Australia’s national terrorism threat level is PROBABLE—credible intelligence, assessed to represent a plausible scenario, indicates an intention and capability to conduct a terrorist attack in Australia.

COVID-19 has not substantially diminished the threat of terrorism in Australia. Lockdowns have limited in-person contact, but have probably increased online exposure to violent extremists, both religiously motivated and ideologically motivated, who are seeking to connect, inspire, influence and radicalise.

The proliferation of secure messaging apps means communications can be more anonymous and directly targeted to vulnerable individuals and groups, isolating them from alternative views and hardening their beliefs. Their use also makes detecting attack planning more difficult.

There were two terrorist attacks in 2020–21; and three planned attacks were disrupted over this period. Both terrorist attacks were by lone actors using simple weapons. Future attacks and plans are likely to follow this pattern. Violent extremists across the ideological spectrum are most likely to target easily accessible crowded public places. Any terrorist attack in Australia is more likely to be committed by a lone actor or a small group using simple methods and basic weapons—such as guns, knives or vehicles. This type of threat is difficult to detect, and can emerge with little to no forewarning.

New terminology

In early 2021, ASIO adopted new terminology to describe terrorism and violent extremism to ensure our terminology remains fit for purpose in an evolving threat environment.

The framework uses two umbrella terms for violent extremism—religiously motivated violent extremism, and ideologically motivated violent extremism.

Religiously motivated violent extremism denotes support for violence to oppose or achieve a specific social, political or legal system based on a religious interpretation. Ideologically motivated violent extremism denotes support for violence to achieve political outcomes or in response to specific political or social grievances.

Religiously motivated violent extremists—specifically Sunni violent extremists—remain an enduring threat and continue to be shaped by ISIL and, to a lesser extent, al-Qa‘ida. These groups continue to promote attacks against the West by publishing propaganda designed to radicalise, instruct on and inspire terrorist attacks. Australia continues to be specifically mentioned.

Ideologically motivated violent extremists—specifically nationalist and racist violent extremists—remain focused on producing propaganda, radicalising and recruiting others, and preparing for an anticipated societal collapse. They are security-conscious and adapt their security posture to avoid legal action. Nationalist and racist violent extremists are located in all Australian states and territories. Compared with other forms of violent extremism, this threat is more widely dispersed across the country—including in regional and rural areas. The emergence of nationalist and isolationist narratives globally is normalising aspects of ideologically motivated violent extremist ideology, including nationalist and racist, and specific-issue violent extremism.

Violent extremism and minors

We continue to identify minors who are involved in both religiously motivated and ideologically motivated violent extremism.

Minors have planned and conducted terrorist attacks, occupied leadership positions in violent extremist groups, and radicalised others.

Violent extremist narratives across the spectrum particularly appeal to teenagers, and may resonate with some minors’ feelings of alienation, unease about the future and mistrust of adults. Radicalisation can occur quickly and without the knowledge of family or friends. A home-based audience of unprecedented size, pushed online by COVID-19, is likely to have increased exposure to violent extremist propaganda, though minors also continue to be radicalised in-person by peers or older associates.

Communal violence and violent protests

Communal violence in Australia is infrequent, but we have seen isolated incidents involving diaspora communities in Australia reacting to specific events overseas. Communal tensions are generally expressed through public events and demonstrations aimed at drawing the attention of the broader Australian community to specific issues.

There is a limited tradition of violent protest in Australia, and most protests continue to resolve peacefully. While incidental violence has occurred in the past 12 months, it has generally been opportunistic and most likely to occur when events are attended by counter-protesters.

The COVID-19 pandemic has been used by issue-motivated groups to promote their individual views. These groups are seeking to exploit social and economic dislocation, and their ideology has been spreading more quickly and widely as Australians spend more time online.

Terrorism—the international security environment

South-East Asia

Despite COVID-19 restrictions largely constraining the movement of violent extremists, those in South-East Asia collaborate and consume ISIL propaganda online, and also plan and conduct simple—often opportunistic—attacks, primarily directed against local security forces and sectarian targets. Under ISIL’s influence, religiously motivated violent extremists are adapting their methods, with suicide bombings becoming more common in the southern Philippines and attacks by females and families occurring across the region more broadly.

Al-Qaʻida-aligned groups also continue to recruit, train and prepare for possible future violence. Cross-border connections, both in the region and into international conflict zones, increase the risk that skills, attack methods and ideology will be transferred between religiously motivated violent extremist groups across the world.

The scheduled release of terrorist detainees in South-East Asia, many of whom probably maintain violent extremist ideologies, will be detrimental to the security environment in the region.

South and Central Asia

Attacks by religiously motivated violent extremists continued throughout 2020–21, particularly in the less-governed areas of Afghanistan and Pakistan. Attacks on government interests, security forces and minorities will continue, particularly in Afghanistan where the security environment has further deteriorated. High-profile attacks by terrorist groups, including Islamic State—Khorasan Province (IS-KP), will persist.

Elsewhere in the region, violent extremist narratives—typically religiously motivated, but including those that are ideologically motivated—are still radicalising individuals and groups which primarily conduct basic attacks. Although a small-scale attack, the May 2021 improvised explosive device attack in the Maldives indicates that violent extremists operating there have an interest in conducting more complex attacks.

The impact of COVID-19 on South Asia increased in mid-2021, but its effect on the terrorist threat remained limited. While decreased tourism reduces the likelihood of Westerners being attacked, the anti-Western intent of some violent extremists is unchanged.

Middle East

ISIL’s post-caliphate insurgency persists in Syria and Iraq. Although ISIL has not reclaimed territory, and continues to lose senior leaders and fighters, it maintains a high attack tempo in these countries, and continues to inspire and direct attacks. Low-capability Sunni violent extremist attacks will persist across the Middle East, mostly posing the threat of incidental harm to Australian interests.

Al-Qaʻida-affiliated or al-Qaʻida-linked groups continue to exploit civil unrest and ungoverned spaces in the Middle East—particularly north-west Syria and Yemen—and remain intent on attacking Western interests. Al-Qaʻida will prioritise its longevity and adapt to work with local sympathisers. Large-scale attacks are unlikely, but basic attacks by individuals and groups—driven by local issues and objectives—will persist.

Separate to ISIL and al-Qaʻida, nationalist and revolutionary violent extremists continue to pose a threat. In May 2021, an 11-day conflict followed rising tensions in Israel and the Palestinian Territories. The conditions for cyclical violence remain, despite a fragile ceasefire. In Iraq and Turkey, Kurdish militants continue to clash with Turkish authorities over a separate Kurdish state and identity.

Iran-backed Shia militia groups in Iraq will almost certainly continue to target United States (US) and Coalition interests, in an attempt to effect a US Coalition withdrawal from Iraq. Tensions between the US and Iran will continue to destabilise the region.

Europe and North America

Terrorist attacks and disruptions in Europe—including in Austria, France and Germany—highlight the persistent threat posed by religiously motivated violent extremist attacks. Such attacks are most likely to be inspired by Sunni violent extremism and use basic weapons—such as knives, vehicles, firearms and/or explosives—to target crowded places or police and uniformed personnel. The release of terrorist prisoners across Europe is likely to exacerbate the terrorist threat.

Individuals or small cells motivated by nationalist and racist or specific-issue violent extremism are more likely to pursue violence than established groups. These types of violent extremists primarily pose a threat to Jewish, Muslim or other minorities, as well as ideological opponents.


In Africa, established -aligned and ISIL-aligned groups continued their attacks aimed at destabilising regional governments. Emerging ISIL affiliates have gained strength, including in northern Mozambique—demonstrated by their concerted March and April 2021 attacks on foreign mining operations in the northern province of Cabo Delgado which killed several foreigners. And from Mali, terrorist groups have expanded their areas of operation into neighbouring Burkina Faso, Niger and some coastal states. Most terrorist groups in Africa will target Westerners, including Australians, if they have the opportunity.

Border security

The demand for irregular maritime ventures to Australia remains suppressed. COVID-19 global travel restrictions and lockdown measures offshore have created a particularly difficult operating environment for people smugglers. Despite this, attempts at irregular maritime migration to Australia and our region occurred throughout the period at low levels.

While deteriorating economic, health or security conditions in the source countries of potential irregular immigrants have the potential to drive individuals to take desperate measures to escape such conditions in the future—possibly through irregular migration to Australia—there is no evidence that this has occurred in the last 12 months. Potential irregular immigrants remain aware that there is a low prospect of permanent resettlement in Australia, which reduces demand for irregular maritime ventures to Australia.