The local threat environment remains highly dynamic and diverse and is often influenced by events and circumstances outside Victoria and Australia.

This environment could therefore deteriorate rapidly and be precipitated by events over which we’re likely to have little to no control. This, along with the fact that an increasing number of threats are coming from unexpected and unconventional quarters, creates significant challenges for Victoria Police, as it does for our law enforcement and intelligence partners.

The COVID-19 pandemic is illustrative of this development. While the long-term security implications of the pandemic remain unknown, there are concerns that it has led to the spread and consumption of extremist ideologies that can lead individuals to radicalise to violence.

Importantly, what the past several years have emphasised is that the terrorist threat can take many forms and be shaped by very specific contemporary events and circumstances. Moreover, we’ve seen a greater geographical dispersal across Victoria of individuals at risk of radicalisation to violence, with the result that our counter terrorism capabilities need to be projected more widely than has traditionally been the case.

Despite some of these changes, we’ve also witnessed consistency in terrorist methodologies, with lone actor, low capability attacks continuing to dominate the threat landscape, while attacks on crowded places also remain a strong feature.

Narratives of victimisation and hate, which are so important to the formation of grievances among terrorists and violent extremists of all persuasions, also continue to spread openly throughout the virtual world, sustaining many of the terrorist threats we see today.

On a local and national level, two threats in particular continue to dominate the threat landscape – religiously motivated violent extremism and ideologically motivated violent extremism.

Religiously Motivated Violent Extremism

The primary threat of terrorist activity in Victoria remains that posed by religiously motivated violent extremism (RMVE).

Groups inspired by Salafi-jihadi ideology, such as the Islamic State of Iraq and the Levant (ISIL) and al-Qaeda continue to operate in various parts of the world and retain the ability to garner support within Victoria, particularly through their various carefully constructed propaganda efforts, which are designed to target vulnerable individuals, including youth and existing supporters.

This propaganda often seeks to inspire attacks of varying levels of sophistication, but particularly those best described as lone actor and low capability.

There will for some time be a very small number of individuals for whom this extremist propaganda, including calls for action from among key leaders and ideologues, will resonate and for whom this material, coupled with a range of specific personal circumstances, will serve as a catalyst for action.

It is expected that RMVE will remain the most significant terrorist-related threat in Victoria for the foreseeable future and will continue to be driven by a range of local and international events and circumstances.

Ideologically Motivated Violent Extremism

Since the release of Victoria Police’s previous Strategy, Ideologically Motivated Violent Extremism (IMVE) has come to play a more significant role in the local, national and international security environments.

The most prominent IMVE attack in recent years, the Christchurch mosques shooting in 2019, signaled a development within the global security environment highlighting the ideological breadth of IMVE, whilst raising the prominence of key ideas associated with this broad and diverse movement.

Moreover, there has been a steady rise in the spread of ideologies associated with nationalist and racist violent extremism, an outcome enabled significantly by the accessibility of extremist material circulated through social media and encrypted and private messaging applications.

The most probable terror attack scenario will involve a lone actor operating on the periphery of the nationalist and racist violent extremist movement.

Violence is likely to be targeted towards perceived ideological opponents, but may also extend to politicians and public figures, depending on the prominence or emphasis of individuals’ highly personal grievances or motivations.

In November 2015 Australia adopted the new National Terrorism Threat Advisory System (NTTAS). Comprising five levels, the NTTAS indicates and provides advice about the likelihood of an act of terrorism occurring in Australia.

The National Terrorism Threat Level is regularly reviewed in line with the security environment and intelligence. When the threat level changes, the Australian Government will provide advice on what the new threat level means - where the threat is coming from, potential targets and how a terrorist act may be carried out.

In the event of a change in the National Terrorism Threat Level, Victoria Police will re-evaluate this Strategy to ensure that our activities remain aligned to the threat.

Consistent with our need to engage in the full spectrum of activities necessary to mitigate the threat and impact of terrorism and violent extremism, all our efforts will align with and support one or more of our focus areas.

However, at the centre of our counter terrorism activities rests our persons of interest (POI) management process.

Since these individuals represent varying levels of threat or may be suited to different management strategies, CTC maintains a diverse POI management capability across its various work units.

This provides Victoria Police an integrated, end-to-end, POI management process which allows us to manage individuals in a highly nuanced and coordinated manner.

Victoria Police’s counter terrorism focus areas

Prevention: stop individuals from becoming terrorists or supporting violent extremism

Since we believe that prevention is better than cure, we are committed to stopping people from wanting to engage in terrorist behaviour in the first instance.

Every terrorist-related incident, including those involving the arrest of suspected terrorists, can have damaging effects across a range of areas.

These incidents can heighten inter-community tensions, negatively impact perceptions of public safety, and be exploited by terrorist propaganda.

Current actions include:

• Delivery of dedicated early intervention programs to support individuals at risk of being radicalised to violence.
• The Victorian Fixated Threat Assessment Centre (VFTAC), which provides a state-wide service that works with individuals, many of whom have a major mental illness, who pose a threat to others.

Protection: reduce the vulnerability of Victoria to acts of terrorism and violent extremism

Terrorists, through their propaganda and actions, have demonstrated a preference to attack specific locations and sites. These include crowded places and infrastructure.

It is therefore critical that Victoria Police, in partnership with other areas of government and private industry, work to mitigate the risk associated with these and other potential targets.

Current actions include:

• Victoria Police SHIELD, an information sharing program with the Victorian public and private security sectors.
• Victoria Police’s coordination of the Crowded Places Network, a group of owners and operators of critical infrastructure, major events venues and crowded places.

Disruption: identify and disrupt specific threats of terrorism and other forms of violent extremism

It is not always possible to prevent individuals from wanting to engage in acts of terrorism or violent extremism.

As a result, it is vital that Victoria Police, along with our partner agencies, proactively identify and mitigate threats to the Victorian community.

Our disruption activities need to be carried out in a timely, effective and proportionate manner.

Current actions include:

• Maintenance of a strong intelligence collection and investigations capability, particularly through the activities of CTC’s Security Investigation Unit.
• An end-to-end POI management operating model which integrates the capacities of CTC’s various work units, thereby providing a flexible and comprehensive disruptive capability.
• Substantial commitment to the Victorian Joint Counter Terrorism Team (JCTT), an integrated investigative capability staffed by Victoria Police, the Australian Federal Police (AFP) and the Australian Security Intelligence Organisation (ASIO).

Response: manage the short- and long-term consequences of an act of terrorism or violent extremism

In the event of an act of terrorism in Victoria, an immediate response will be required to mitigate its short-term effects.

This immediate response seeks to protect life and property and contain the effects of an incident.

Current actions include:

• Engaging in extensive exercising to ensure that our engagement with critical partners and response to a range of incidents is well-practiced and refined.
• Established command-and-control capabilities that include the Joint Intelligence Group (JIG), access to specialist legal support and Victoria Police’s Incident Command and Control System (ICCS).

It is comprised of a range of specialist police and Victorian public servants, including investigators and tactical and strategic intelligence analysts, subject-matter experts and mental health specialists.

While CTC undertakes the majority of Victoria Police’s preventative and disruptive counter terrorism activities and carries the primary responsibilities, other areas of the organisation also provide a critical supporting role.

From our frontline members who play an important part in gathering intelligence, to our more specialised areas who may be required to respond to threatened or actual attacks, counter terrorism is an organisation-wide responsibility.

CTC’s activities are closely aligned and coordinated with our Victorian, inter-state and Commonwealth partners.

From the development of policy to measures intended to enhance our operational capability, we are involved in a range of committees and bodies.

This includes the Australia-New Zealand Counter Terrorism Committee (ANZCTC) and its various sub-committees and advisory groups, whilst at the Victorian level we work closely with many government departments and are involved in bodies such as the Security and Emergency Management Committee of Cabinet (SEMC) and the State Crisis and Resilience Council (SCRC).

Victoria Police Counter Terrorism activities and partnerships

Counter Terrorism Command

Supported by:

• Other Victoria Police Commands and Departments, including Crime Command, Intelligence & Covert Support Command, Transit & Public Safety Command
• Regional operations/frontline policing
• Victorian, interstate & Commonwealth governments
• Commonwealth and state agencies including Australian Federal Police (AFP), Australian Security Intelligence Organisation (ASIO) and Australia Border Force (ABF)
• Interjurisdictional bodies such as the Australia-New Zealand Counter Terrorism Committee (ANZCTC)
• International engagement and liaison, including Five Eyes Intelligence Community
• Academia
• Community.

Prevention

Key actions:

• Community Integration Support Program (CISP)
• Network for Intervention and Tailored Engagement (NITE)
• Victorian Fixated Threat Assessment Centre (VFTAC).

Disruption

Key actions:

• Security Investigation Unit (SIU)
• Joint Counter Terrorism Team (JCTT)
• Dedicated legal advice.

Protection

Key actions:

• Victoria Police SHIELD
• Crowded Places Network
• Counter Terrorism Protective Security Network (CTPSN)
• Behavioural Observation and Suspicious Activity Recognition (BOSAR).

Response

Key actions:

• Exercising and training
• Rapid deployment of critical incident response capabilities from across Victoria Police.

Victoria Police has identified a number of key issues which over the next four years are likely to continue to exert an important influence over the local threat environment, and around which we will concentrate our activities.

Key issue 1: Individuals radicalising to violence

The threat from religiously and ideologically motivated violent extremist groups and individuals continues to influence the Victorian security environment, particularly through the endurance of master narratives and underpinning ideologies.

Despite the demise of Islamic State of Iraq and the Levant's (ISIL) Caliphate in the Middle East, violent Islamist narratives from groups including ISIL and al Qaeda continue to resonate with individuals globally, including within Victoria, propagating an ‘us versus them’ worldview.

Similarly, Ideologically Motivated Violent Extremism (IMVE) propaganda and activities can be equally divisive, reinforcing perceptions of the existence of an ‘out group’ against which violence can be used.

Beyond IMVE and Religiously Motivated Violent Extremism (RMVE), the COVID-19 pandemic has also enlivened a variety of issue motivated groups and individuals, creating opportunities for further polarisation and the spread of conspiracy theories.

The radicalisation of youth is also of growing concern to Victoria Police and our law enforcement and intelligence partners.

The number of children at risk of radicalisation to violence, including those being exposed to extremist material and ideas, has increased.

Due to a number of local and international circumstances, this development is also a manifestation of youth vulnerability in general given that this cohort is in a period of identity formation and is more susceptible to external influences.

Identifying individuals at risk of radicalisation to violence within this environment has become increasingly challenging for law enforcement.

Behaviours that may indicate the transition toward violence can be complex, occur within short timeframes, and occasionally even appear in conflict with individuals’ ideological or religious views.

Interpreting indicators can be further complicated by a range of personal factors and circumstances, including mental health issues and drug use.

Key issue 2: Convicted terrorists

Over the coming years there will be an increase in the number of convicted terrorists eligible for release into the Victorian community following the completion of their sentences.

With this comes the concern that these individuals may re-enter the community with undiminished ideological views.

While some may actively participate in prison rehabilitation programs, others may continue to adhere to their violent ideologies for a variety of reasons.

The potential consequences of this were demonstrated in the United Kingdom, where several recently released terrorists went on to commit attacks (Streatham in 2019 and London Bridge in 2020).

While terrorist recidivism in the Australian context is relatively rare, the potential for terrorist recidivism raises a number of issues, including those related to the management of convicted terrorists post-release, the durability of violent extremist beliefs, as well as their potential to exacerbate the local radicalising environment by virtue of their so-called notoriety.

Key issue 3: Mental health and extremism

There has been an increase in the presence of mental disorders among individuals that undertake acts of terrorist violence. This is particularly true among lone actor terrorists.

Mental illness can influence an individual’s decision making and behaviours in diverse ways, adding layers of complexity to our efforts to identity and effectively manage these individuals.

The interplay between mental health and extremist vulnerability is complex.

Mental disorders, when present, may not be the driving factor when mentally unwell terrorists decide to undertake acts of violence, but one of many aggregating factors that contribute to a person’s desire to act.

Understanding how mental disorders may influence an individual’s vulnerability, along with how the threat may present, assists case managers in determining the most appropriate mode of intervention.

Key issue 4: Returning foreign fighters and families

Australian foreign fighters and their families that may return from international conflict zones continue to represent a potential threat due to their exposure or commitment to violent extremist ideology, the acquisition of combat skills, and relationship with violent extremists.

However, it is anticipated that most future repatriations will be of children and their mothers.

The extent to which they may exert any influence will likely be felt primarily through their capacity to exacerbate the local radicalising environment, which will be difficult to determine in the short to medium term.

Additionally, due to the nature of repatriated children’s experiences in particular, they will likely face reintegration and re-socialisation challenges.

While the precise nature of each child’s experiences might never be known, it is likely that returning children will have been exposed to significant physical and psychological trauma.

Moreover, religiously and ideologically motivated Australians may continue to consider travel to international conflict zones in response to events that appeal to, or resonate with, their peculiar ideological and psychosocial needs and circumstances.

Key issue 5: The internet and social media platforms

The anonymity of the internet affords users the ability to express views that they may not otherwise share for fear of repercussion or public condemnation. Moreover, the online environment is attractive to terrorists as it is not subject to centralised control, lacks censorship and is widely accessible.

Online platforms are therefore often utilised as a mechanism to radicalise individuals to violence, propagate hate speech and other extreme views, and promote a range of conspiracy theories.

It can also fulfill other important roles, including providing extremists a forum through which to engage in covert communication.

The online environment also has the capacity to extend the reach of terrorists and terrorist organisations throughout the world.

The internet and social media platforms have allowed terrorists overseas to virtually target, radicalise and recruit individuals in Victoria with greater ease than ever before, creating significant challenges for Victoria Police and its partners.

The targeted removal of extremist material by some mainstream social media platforms has also led many extremists to move their messaging and conversations onto encrypted platforms and the dark web.

This not only hinders the ability of police to identify communication of national security concern but can also hasten individuals’ radicalisation to violence by limiting opportunities for exposure to alternate or moderating views.

Encrypted communications utilised by extremists will likely continue to present challenges for the foreseeable future.

Victoria Police is engaged in several ongoing activities that aim to enhance our overall counter terrorism capability, many of which seek to build relationships across a range of sectors, including partner agencies and private industry.

The following activities demonstrate the breadth and diversity of some of these initiatives:

Crowded Places Network

Victoria Police coordinates the Victorian Crowded Places Network.

Membership of this group comprises owners and operators of critical infrastructure, major events venues and crowded places.

Utilising this network, information, such as key developments in the threat environment and lessons learnt through the experiences of organisations with a counter terrorism mandate, are shared by Victoria Police to enable owners and operators to take proactive steps to minimise the threat and impact of terrorism at their venues and locations.

Victoria Police SHIELD

Victoria Police SHIELD is part of a program of current and future initiatives by Victoria Police that aims to prevent and minimise the impact of terror incidents.

It seeks to strengthen partnerships with the Victorian public and private security sectors through information sharing.

In addition to providing the latest information on the terrorist threat most pertinent to the needs and responsibilities of participants, SHIELD also aims to raise awareness of matters relating to protective security concepts and the latest nationally endorsed security guidelines.

Primarily aimed at partners involved in the Victorian Crowded Places Network, owners and operators of small businesses and the private security sector, the information contained within the SHIELD platform will contribute to these areas’ ongoing efforts to enhance security awareness and build resilience within the Victorian community.

SHIELD is part of the Global SHIELD Network, a collaboration between local law enforcement SHIELD initiatives worldwide.

The network provides valuable engagement opportunities between members to share information on emerging trends, capability enhancement initiatives and best practices.

Counter Terrorism Protective Security Network

The Counter Terrorism Protective Security Network (CTPSN) aims to build a network of counter terrorism trained frontline Victoria Police members.

The primary objectives of the CTPSN are:

• Facilitate broader counter terrorism capability by building a network of specially trained Victoria Police members, with a central coordination and liaison point (CTC).
• Deliver counter terrorism awareness and protective security training to network members.
• Meet responsibilities under the Australia-New Zealand Counter Terrorism Committee (ANZCTC) guidelines by building partnerships with local owners and operators of crowded places.
• Provide support to police Regions for the establishment of local Crowded Places Networks and Forums.

The CTPSN will also play an important role in preparing and supporting a number of regional areas as they prepare for the 2026 Commonwealth Games.

Behavioural Observation and Suspicious Activity Recognition

Behavioural Observation and Suspicious Activity Recognition (BOSAR) provides a behavioural observation capability to assess suspicious activity in an operational setting for counter terrorism, including crowded places, public order management and dignitary protection.

It is a methodical process of observing an individual or object in their natural environment to establish a baseline from which to identify anomalies which may warrant suspicion and further investigation.

Victoria Police delivers BOSAR training to operational members and builds a network of trained front-line police members that can support our core counter terrorism focus areas of prevention, protection, disruption and response.

Training and exercising

Victoria Police engages in extensive exercising to ensure that our response to a range of scenarios is well-practiced and refined.

This exercising extends to many of our counter terrorism capabilities, either in isolation or combination, including those with a strong operational or tactical focus (for example, Special Operations Groups (SOG); negotiators; counter terrorism investigators and intelligence practitioners) to those involving decision making by Victoria Police Executive Command.

These exercises also frequently involve other Victorian, interstate and Commonwealth agencies to ensure effective interoperability.

We also provide ongoing training and awareness raising opportunities across a range of areas and functions throughout Victoria Police, from police recruits to experienced counter terrorism investigators and analysts.

Continuous improvement

Victoria Police is committed to engaging in critical reviews of internal frameworks, processes and practices that inform our operational counter terrorism activities. These have been undertaken by internal subject matter experts and independent third parties.

Our commitment to continuous improvement is also informed by coronial inquest findings and recommendations, along with research and evaluations undertaken internally and in partnership with academia.

For instance, the Applied Security Science Partnership (ASSP) recently reviewed, revised and validated our primary threat assessment tool, which is used by our counter terrorism investigators and intelligence analysts to identify and prioritise persons of interest.

It is also in the process of reviewing, with a view to identifying opportunities for enhancement, our primary early intervention program.

Collectively, these activities have significantly improved the robustness of our person of interest management processes, operational governance arrangements and intelligence sharing practices and protocols.

Number of Victorians arrested on terrorism offences by year

Age at time of arrests

Result of the arrests

Ideology of individuals

Gender of the individuals

Affiliated terrorist organisation*

^{*Inspired or directed.}