Director-General’s Annual Threat Assessment

Wednesday, 17 March 2021

Welcome to ASIO, welcome to the Ben Chifley Building and welcome to my second annual threat assessment.

I’m honoured by the attendance of so many friends, colleagues and partners across government, the intelligence community and law enforcement – including members of the Parliamentary Joint Committee on Intelligence and Security, the Chief of the Defence Force, the Inspector-General of Intelligence and Security, Directors-General, Departmental Secretaries and Deputy Commissioners.

Our Five Eyes partners are also here, including the Canadian High Commissioner, as well as other senior members of the diplomatic corps such as my new friend, Ambassador Shingo Yamagami.

And it’s good to have former ASIO Director-General, Dennis Richardson, back in the building.

The decision to again hold this event here, at our headquarters, is a deliberate one. It’s a sign of my continued determination to make ASIO more open and transparent.

Visitors to the BCB are often surprised by how ‘normal’ our people look. The Hollywood versions of spies and spy catchers are a long way from reality. We need people who can think outside the box—or perhaps get into it without being detected—rather than people who can pepper the box with bullets.

While my main purpose tonight is to update you on the threat environment and what ASIO is doing about it, I also want to explain why we need those people who think outside the box.

Agility and ingenuity are at the core of ASIO’s operations. We go up against sophisticated foreign adversaries that are effectively unconstrained by law, ethics and resources; we need to be able to out-imagine and out-manoeuvre them.

We go up against extremists who are security aware and tech-savvy; we need to be able to know what they are plotting and see what they are doing—always lawfully, of course.

So ASIO officers are expected to do extraordinary things, but it is important to remember that they are ordinary people.

At work, they routinely do things you would think are impossible… but after work they face the same challenges, worries and duties we all have.

They are your neighbours and friends and members of your community. They pay mortgages, coach sporting teams, care for loved ones and volunteer to fight fires or patrol beaches.

Our people include former nurses, teachers, tradies, musicians and engineers—and even journalists.

I’m determined to ensure ASIO reflects the community we serve. ASIO is your security service.

We are headquartered in Canberra but we operate and live in every state and territory, as well as a dozen other countries.

To deliver on our mission, we desire and require diversity. I’m proud of the strides we have taken—particularly in achieving gender equality in our senior executive service—but I recognise there is still a lot of work to be done. We need greater diversity in our workforce—and we need your help to get there.

If you want to make a difference—and you’re a lateral, critical or creative thinker—chances are you’re the kind of person we’re looking for.

In fact, we’re recruiting now for roles that go to the core of what we do—protecting Australians by stopping terrorists and catching spies.

I encourage any curious techies to take a look at our Technologist Graduate Program. You might be surprised by the breadth of technology we work with.

We’ve also opened our Intelligence Professionals round, for aspiring intelligence officers and analysts.

If you think you’re not the ASIO type, let me assure you: there is no ASIO type, other than being an innovative problem-solver.

If that’s you, I hope you’ll apply.

Before I talk about Australia’s current and future security environment, I’d like to look back at 2020.

Like organisations everywhere, ASIO was affected by COVID-19.

I take this opportunity to acknowledge the essential services that have been working so hard to keep Australians safe during the pandemic. The doctors, nurses and other health professionals and frontline workers richly deserve our admiration and thanks, as do the brilliant scientists who have led the global research effort.

Of course, ASIO also operates on a frontline. And it’s fair to say that threats to our safety and security didn’t go away with the onset of COVID. In many areas, they evolved; in some they intensified.

At ASIO, we needed to quickly adapt to our new operating environment to ensure our work could continue.

While I can’t go into too many details about how we adapted to the security challenges posed by the pandemic, I can say that it didn’t involve much working from home!

Despite the challenges we all faced, ASIO maintained our hold on high-priority targets, kept up with a threat landscape that was shaped by the pandemic, and reduced harm—we protected Australia and Australians from threats to their security.

And the threats continued.

For those intent on violence, more time at home online meant more time in the echo chamber of the internet on the pathway to radicalisation. They were able to access hate-filled manifestos and attack instructions, without some of the usual circuit breakers that contact with community provides.

Extreme right-wing propaganda used COVID to portray governments as oppressors, and globalisation, multiculturalism and democracy as flawed and failing.

Islamic extremist narratives portrayed the pandemic as divine retribution against the West for the perceived persecution of Muslims.

For foreign spies, the lack of opportunity for international travel and reduced social mobility meant their tradecraft evolved, and they increased their online activity and approaches.

As our targets changed their modus operandi in response to COVID, we too adapted our methods and approaches.

That is a defining feature of ASIO.

We adapt quickly because our success—and your security—depends on it.

We are continually innovating, changing tack where we need to, and then pushing right to the edge of what is possible. We have to stay ahead of the terrorists and spies, because if our targets know we can do something, we have to be able to do something else. This may seem to be the original impossible task. But with the right capabilities and investment, it’s a task our people are up to.

This will be critical as we emerge from the COVID crisis. Some of our adversaries are seeking to undermine and exploit Australia’s recovery. We have already seen extremists trying to stoke social divisions, and foreign intelligence services wanting intelligence about Australia’s key export, technology and research industries.

ASIO stands ready to detect and disrupt these threats. Australia’s security underpins Australia’s recovery.

So, what is Australia’s security outlook? The environment is complex, challenging and changing.

The terrorist threat remains at PROBABLE.

We have credible intelligence that individuals and groups have the capability and intent to conduct terrorism onshore.

Let me be clear; this threat is significant, and it’s not going away.

Today, there are individuals and groups subscribing to religiously motivated violent extremism that are plotting violence against Australia, and Australians.

ISIL media released a video last year referencing the Australian bushfire crisis to encourage arson attacks in the West. It also featured a firearm—similar to the weapon used by the Christchurch attacker—with inscriptions such as ‘today we invade you in your own homes’ and ‘the Islamic State is remaining’.

And late last year, there were two religiously motivated terrorist attacks in Australia. In December, Raghe Abdi, a radicalised ISIL supporter, allegedly murdered an elderly couple in their Brisbane home. And in October, a Bangladeshi woman—already incarcerated for a terrorist attack—allegedly cited ISIL as the inspiration for a stabbing attack against another inmate.

There have also been disruptions, where we have worked closely with our law enforcement partners. In March 2020, in Sydney, an individual was charged with acts in preparation for a terrorist attack.

In November, police charged another individual with planning to undertake a terrorist attack in the Bundaberg region. And in February of this year, in NSW, an individual was arrested and charged with two counts of acts done in preparation for, or planning, a terrorist attack.

Around the world, violent ideologies continue to inspire attacks. In October 2020 in Nice, France, an attacker stabbed three people to death; one was beheaded. And in November—in Vienna, Austria—a gunman opened fire with an assault rifle, killing four people and injuring 23 others.

In addition to the enduring threat from religiously motivated violent extremists is a growing assortment of individuals with ideological grievances.

So-called right-wing extremism has been in ASIO’s sights for many years, and last year I called out what we have been seeing.

Since then, ideological extremism investigations have grown from around one-third of our priority counter-terrorism caseload, to around 40 per cent. This reflects a growing international trend, as well as our decision to dedicate more resources to the emerging domestic threat.

The face of the threat is also evolving, and this poses challenges as we seek to identify and monitor it.

People often think we’re talking about skinheads with swastika tattoos and jackboots roaming the backstreets like extras from Romper Stomper, but it’s no longer that obvious.

Today’s ideological extremist is more likely to be motivated by a social or economic grievance than national socialism. More often than not, they are young, well-educated, articulate, and middle class—and not easily identified.

The average age of these investigative subjects is 25, and I’m particularly concerned by the number of 15 and 16 year olds who are being radicalised. They are overwhelmingly male.

Investigations into ideological extremists have occurred in all Australian states and territories. Compared with other forms of extremism, it is more widely dispersed across the country, including in regional and rural areas.

The extremists are security conscious and adapt their security posture to avoid attention. In their online forums and chat rooms, they show that they’re savvy when it comes to operating at the limits of what is legal and discuss ways to ‘beat the system’ in what they say and do.

ASIO anticipates that the threat from this form of extremism will not diminish anytime soon— and may well grow.

The online environment is a force multiplier for extremism; fertile ground for sharing ideology and spreading propaganda.

Ideological extremists are now more reactive to world events, such as COVID, the Black Lives Matter movement and the recent American Presidential election.

COVID has reinforced extremist beliefs and narratives about societal collapse and a race war. As a consequence, we are seeing extremists seeking to acquire weapons for self-defence, as well as stockpiling ammunition and provisions.

An ideologically motivated terrorist attack in Australia remains plausible, most likely by a lone actor or small cell rather than a recognised group, and using a knife or a vehicle rather than sophisticated weapons.

But to be clear, even a low-capability attack can still result in loss of life.

If we see an extremist planning or threatening violence, we take action. The threat is real, but we need to put it into perspective.

These groups promote hateful ideologies but that does not automatically put them in the same threat category as ISIL or al-Qa‘ida.

ASIO has the difficult but critical job of distinguishing between talk and action, aspiration and capability.

At ASIO, we’re conscious that the names and labels we use are important. Words matter. They can be very powerful in how they frame an issue and how they make people think about issues.

From today, ASIO will be changing the language we use to talk about the violent threats we counter. We will now refer to two categories:

  • religiously motivated violent extremism, and
  • ideologically motivated violent extremism.

Why are we making a change?

Put simply, it’s because the current labels are no longer fit for purpose; they no longer adequately describe the phenomena we’re seeing.

As an example, when thinking about the proliferation of violent groups that subscribe to various political ideologies, it’s unhelpful to categorise such groups as simply ‘extreme left wing’ and ‘extreme right wing’.

ASIO does not investigate people solely because of their political views, so labels like ‘left’ and ‘right’ often distract from the real nature of the threat.

While the views advocated by many extremists groups are appalling, as a security service, ASIO’s focus is the threat of violence.

In the same way, we don’t investigate people because of their religious views—again, it’s violence that is relevant to our powers—but that’s not always clear when we use the term ‘Islamic extremism’.

Understandably, some Muslim groups—and others—see this term as damaging and misrepresentative of Islam, and consider that it stigmatises them by encouraging stereotyping and stoking division.

Our language needs to evolve to match the evolving threat environment.

We are seeing a growing number of individuals and groups that don’t fit on the left–right spectrum at all; instead, they’re motivated by a fear of societal collapse or a specific social or economic grievance or conspiracy.

For example, the violent misogynists who adhere to the involuntary celibate or ‘incel’ ideology fit into this category.

So we need to use language that can accommodate groups that are outside the traditional categories.

Many of our Five-Eyes partners have changed their terminology for similar reasons. At ASIO, we will use ‘religiously motivated violent extremism’ and ‘ideologically motivated violent extremism’.

I should note that these are umbrella terms – and there may be circumstances where we need to call out a specific threat that sits underneath them – but we believe this approach will more accurately and flexibly describe security-relevant activities.

Threat to life will continue to be the top priority for ASIO, but I also want to talk to you today about threats to our way of life. Specifically, espionage and foreign interference.

Countering these threats is a major part of ASIO’s mission.

Foreign spies are constantly seeking to penetrate government, Defence, academia and business to steal classified information, military capabilities, policy plans and sensitive research.

They are intimidating members of diaspora communities and seeking to interfere in our democratic institutions.

Over the last three years, ASIO has seen espionage and foreign interference attempts against all levels of Australian politics, and in every single state and territory.

As I’ve said before, espionage is a fairly straightforward concept. It is stealing secrets, and it’s the world’s second-oldest profession.

Many countries—including Australia—recognise the advantage that comes from having information about the plans and intentions of others.

And the motivation for foreign states to conduct espionage never goes away. In fact, it heightens during times of tension and conflict.

ASIO’s mission is to identify where espionage is happening in Australia, and to rout it out.

Classic espionage techniques—infiltration, coercion, or the recruitment of sources—is still a feature of the security landscape we face. Some of the spy clichés—like dead letter drops and writing in code—are real, and are used by foreign spies and agents.

Last year, an ASIO surveillance team spent a day following a spy around one of our capital cities as the spy scouted for dead letter drop sites. Don’t worry, we took notes!

But more often than not, these classic approaches to espionage are combined with new technologies. Rather than a spy sidling up to a target in a train station, he or she is now more likely to send a friend request, or a job offer. Or a spy might spam out hundreds of messages, and then sit back to see who responds.

Foreign interference is more of a nuanced concept, and often misunderstood. It refers to actions—that are directed by, on behalf of, or in collaboration with a foreign power—that either involve a threat to any person, or are covert, deceptive and detrimental to Australia’s interests.

Seeking to influence a decision by open lobbying or diplomacy is not foreign interference.

Nor is publicly praising a foreign regime, engaging with overseas stakeholders or attending community events.

But there are points where engagement tips into influence, and influence tips into interference.

So what have we done and what are we doing about it?

Last year, in my first threat assessment, I delivered a pointed message to our adversaries: if you are conducting espionage or foreign interference against Australia, ASIO—and our partners—will be hunting you.

I can report we have made good on my promise. We have hunted, we have discovered and we have dealt with multiple attempts—from multiple countries—to steal Australia’s secrets and undermine its sovereignty. We’ve used all of the human and technical capabilities, partnerships and legislative instruments at our disposal to discover, disrupt and deter threats to Australia and Australians.

And we have significantly reduced harm.

Last year, for example, one of ASIO’s investigations focused on a nest of spies, from a particular foreign intelligence service, that was operating in Australia.

The spies developed targeted relationships with current and former politicians, a foreign embassy and a state police service.

They monitored their country’s diaspora community.

They tried to obtain classified information about Australia’s trade relationships.

They asked a public servant to provide information on security protocols at a major airport.

They successfully cultivated and recruited an Australian Government security clearance holder who had access to sensitive details of defence technology.

ASIO acted. We investigated, identified and verified the activity. We cancelled the government employee’s security clearance. We confronted the foreign spies, and quietly and professionally removed them from Australia.

And before you jump to conclusions—and to underline my point that multiple countries are trying to conduct espionage and foreign interference in Australia—I want to point out that the foreign intelligence service was not from a country in our region. And no, I’m not going to name the country. That would be an unnecessary distraction.

My focus is on detecting harm and dealing with it—professionally and privately, wherever possible, just as we did in the instance I’ve described.

People sometimes talk about the ‘spy game’. A case like this shows that spying is not a game. It is acutely serious. Our secrets, our sovereignty and our safety are all at stake. So when some commentators insinuate that ASIO should turn a blind eye to espionage and interference to avoid upsetting the foreign governments, they are not just suggesting that laws should not be enforced, they are suggesting these sorts of deeply damaging activities should be left unchecked.

I completely reject this approach. When ASIO finds a nest of spies, we will deal with what we find.

This is just one example. In the last twelve months, a significant number of foreign spies and their proxies have either been removed from Australia or rendered inoperative. I can’t give you exact details for obvious reasons, but I’m talking about a number in double figures.

Together with our partners, we stood up the Counter Foreign Interference Taskforce—ahead of schedule. Since then, the Taskforce has investigated over 30 cases, and our law enforcement partners have acted on several of them, including the AFP’s first foreign interference charge in Melbourne late last year.

Prosecutions are only one weapon. Our advice helped Home Affairs deny and cancel a number of visas. And often, merely questioning a spy or their proxy is enough to make them pack up and flee the country because they know their cover is blown.

While I cannot talk about exactly what we do in these cases, let me explain what we do NOT do when we are dismantling a spy ring.

We do not operate unlawfully or without oversight.

We do not impose arbitrary detention.

We do not threaten and intimidate.

And we do not investigate journalists for their journalism, academics for their research or politicians for their politics.

While I’m talking about things we don’t do, let me put on the record that we do not investigate peaceful protests. Under law, we are only allowed to focus on demonstrations where violence is planned or likely. Non-violent protest is a component of a healthy democracy, not a threat to it.

I’ve said before, it’s the way that ASIO does business that sets us apart. We act ethically and within the law. We are proportionate. And we work with our partners.

Spying is a race to innovate: between the spies and the spy catchers, and between those intent on inflicting violence on our citizens and those who seek to prevent it.

ASIO is particularly skilful at this. We know our success depends on our ability to fuse new technologies, opportunities and advantages into our existing skillsets, and to imagine new ways of doing things.

That imperative to innovate is reflected in all aspects of our business, and we have been changing how we are structured and how we do business to ensure we are the most creative, most innovative, most modern organisation we can be.

We’re particularly focused on being at the crest of the new world of data. Lawfully used, bulk data, modern analytics and machine learning provide rich opportunities for ASIO as an organisation to be more effective and more precise—as well as proportionate—in how we do our business.

But the environment we operate in is a challenging one. We are seeing an exponential uptake of encrypted and secure communication platforms by violent extremists. Even supposedly unsophisticated targets are routinely using secure messaging apps, virtual private networks, fake emails and number generators to avoid detection.

Now please don’t get me wrong—encryption is fundamentally a force for good. But we need to recognise how it is being used and abused by terrorists and spies.

Last year I revealed that end-to-end encryption damages intelligence coverage in 90 per cent of our priority counter-terrorism cases. Now the figure is 97 per cent.

Perhaps at a deeper level, though, there is an essential conundrum in intelligence work: the better you get, the harder it gets. Let me explain what I mean.

If we are successful in identifying and disrupting the work of foreign spies, or violent extremist groups, they can often reverse engineer what has happened, to discover our capabilities. Every time we do our job, we necessarily tip our hand.

What happens then? Our targets bank that knowledge and change tack.

To detect and defeat our adversaries, we have to do things they think are impossible. And that applies whether we are seeking to stop a low-capability terrorist attack or confronting an incredibly sophisticated and well-resourced nation state.

Once an adversary knows what we can do, we need to do new things they consider impossible. That’s why we don’t talk about our capabilities and why we need our laws and capabilities to evolve.

There is no set and forget in security intelligence.

That is why ASIO will sometimes ask for legislative change, or investment for new capabilities. We don’t do it lightly, we do it because we need to keep technology on our side, not on the side of our opponents.

Late last year, for example, Parliament passed legislation allowing us to be more flexible in our use of less intrusive tracking devices, and to compel suspected spies to attend interviews. I can report that ASIO has already used one of these powers and will soon use the other; evidence that an evolving threat environment requires evolving capabilities—and that we don’t ask for new powers or resources unless we need them.

As I have explained tonight, the threats facing Australia are significant and constantly evolving. But you should be reassured that ASIO and our partners are alive to these threats, and that we are continuously evolving to meet them.

As a result of our actions over the last twelve months, it is no longer accurate to describe levels of espionage and foreign interference as ‘unprecedented’.

Our work made a material difference to Australia’s safety and security.

But this is not a declaration of victory; even less of a ‘mission accomplished’. The spies I most worry about are the ones I do not know about.

Intelligence gathering requirements have not gone away during COVID. Indeed, we know some foreign governments desperately want to know the secrets underpinning our medical and economic recovery. The spies will seek to return, with deeper cover, improved tradecraft and better technology at their disposal. As I noted earlier, the better we do, the harder it gets.

The challenges I have laid out tonight are making it more difficult for us to identify and counter these threats.

But like those ASIO officers who came before us, our staff are responding to this challenge with agility and ingenuity.

We are constantly honing our skills and approaches.

Spies and terrorists should know this: we are looking for you.

And for the rest of the Australian community: we are looking out for you. ASIO is your security service.

Thank you.