As coalition forces drove Islamic State (IS) out of the cities of Mosul and Raqqa, several plots in Australia demonstrated a greater involvement by the terror group than had been seen here before.

The volume and pace of counterterrorism (CT) operations continued to stretch law enforcement resources, but all of the plots were disrupted. The time available to authorities to disrupt attacks remained short and international allies provided vital leads to investigators in Australia.

In many ways, 2017 was a turning point in Australia’s approach to CT. A range of actions taken since 2014 to prevent and respond to terrorism were complete or had evolved to another phase.

Between late 2016 and the end of 2017, authorities stopped a number of planned attacks, including the most complex to date, and identified further links between Australians and IS in the Middle East. In July 2017, the NSW Joint Counterterrorism Team disrupted a plan to place a bomb on an aircraft flying out of Sydney. The group allegedly received plans, funds and equipment from IS in the Middle East to undertake the attack and possibly another, involving the release of toxic chemicals in a public place. The IS connection was reportedly made through an Australian foreign fighter related to some of the men. Authorities became aware of the plans only days before disruption.

In February 2017, an electrician in Young was charged with attempting to help IS use laser-guided missiles. The man was involved with relatives who had left Australia in 2015 and are accused of funding IS and helping it obtain weapons through the Eastern European black market.

In October, a Melbourne man was charged with administering a pro-IS website on behalf of an American foreign fighter and with providing funds to the group.

Authorities advise that they disrupted 14 major mass-casualty plots from mid-2014 to 2017 and 34 major operations saw 78 people charged with terrorism offences in 34 CT operations.

In 2017, Australia was a vocal player in global initiatives to address terrorists’ use of encrypted communications, raising the issue at a Five Eyes conference and being involved in the G20 declaration on the issue. The government’s approach of seeking collaboration with technology businesses, rather than imposing new requirements on them, has been sensible and contrasts favourably with the more legalistic approach taken by others.

Offshore CT operations contributed to the liberation of Mosul and Raqqa, and Australia continued to provide training to the Iraqi military, as well as air force ISR, command and control, and strike capabilities. The ADF commitment to Afghanistan was increased in May by 30 personnel to 300, mostly in training and headquarters roles.

After IS-aligned groups captured the Philippines city of Marawi in May, Australia provided two P3C Orion patrol aircraft to gather intelligence to support the Armed Forces of the Philippines, along with instructors to give urban warfare training. That training drew on the ADF’s experience in Iraq.

At a meeting of the Council of Australian Governments (COAG) in October, the Commonwealth, state and territory governments signed an updated Intergovernmental Agreement on National Counter Terrorism Arrangements and endorsed an updated National-Counter Terrorism Plan. COAG also announced that the jurisdictions would introduce technical systems—rather than the existing manual systems—to share driver licence details and other data in terrorism-related matters. They’d also share biometric data including facial identification.

While this announcement created some debate about privacy, the longstanding national approach to security and CT largely mitigated concerns. COAG also endorsed a recommendation from the Lindt Café coronial inquest for a shared approach to fixated threat assessment. NSW and Victoria established dedicated ‘fixated’ threat assessment units in 2017, following Queensland’s earlier lead.

In 2017, both the Parliamentary Joint Committee on Intelligence and Security (PJCIS) and Independent National Security Legislation Monitor (INSLM) undertook separate statutory reviews of Australia’s control orders, preventative detention orders, police stop, search and seizure powers, and the declared areas regime. The INSLM also reviewed the high-risk terrorist offenders legislation, which provides for the ongoing detention of terrorists who have completed their sentences but still present an unacceptable risk to the community. The INSLM found that all of the laws remained appropriate. The PJCIS is due to report in March 2018.

NSW become the first state or territory to incorporate the 2016 federal high-risk terrorism offenders legislation. The state is home to a high proportion of those serving sentences for terrorism offences, including some whose sentences are due to end.

Another law from 2016 was used for the first time in 2017, when Khaled Sharrouf became the first—and to date the only—Australian to lose citizenship on terrorism grounds. That law can apply only to dual nationals assessed to be terrorists and whose return to their other home nation would not breach Australia’s international obligations.

In June, NSW passed laws clarifying when police had the right to ‘shoot to kill’ during a terrorist incident. This followed the recommendation of the coronial report into the 2014 Lindt Café siege that police officers should ‘have sufficient legal protection to respond to terrorist incidents’. Western Australia and Victoria announced similar enhancements during the year.

COAG’s dedicated CT committee, the ANZCTC, produced new guidelines on protecting crowded places from terrorism, which arose from a review commissioned after the July 2016 attack in the French city of Nice. The package builds on existing strategic-level guidance to provide more detailed advice, points of contact and tools, including a security audit and a self-assessment risk management tool. A welcome development in the new document is its focus on business and community taking a role in preparing for, preventing and responding to terrorist attacks.

Two significant announcements are changing the way CT is managed at the national level. A new Office of National Intelligence will take a long-term, strategic approach to intelligence, prioritise material to be shared and ensure more effective capability development and management.

A new Home Affairs portfolio brings various national security–related agencies and functions into one ministerial portfolio with a shared, strategically focused oversight department. These initiatives take Australia’s management of national security and intelligence matters to a more mature level, provide structure for the already effective relationships between agencies, and should provide improved strategic direction and capability across all organisations.

That Australia has, to date, avoided a mass-casualty attack despite the capability of Islamist terrorist groups, is testament to the success of the thorough approach taken by police and agencies.

The resources and direction being given by IS to its small number of supporters in Australia suggests, however, that a major attack may yet occur and there remains a need for more operationally focused lessons learned reviews of terrorist incidents and responses to them rather than the ad hoc approach currently taken.

There are strong procedures in place to scrutinise security legislation but there’s no regular mechanism for reviewing CT activities outside coronial inquests that are concerned primarily with the cause of death and not how CT operations were—or should be—carried out.

Formalised reviews of terrorist attacks and disruptions would provide evidence-based understanding of the effectiveness of Australia’s arrangements and areas for improvement.

States take the lead in dealing with terrorist incidents, and operational response units exercise regularly under ANZCTC arrangements. But the high level of operational-level interaction doesn’t appear to be matched by similar exercising and testing of strategic-level decision-making in ambiguous environments by federal and state ministers and business leaders.

It’s vital that key actors understand clearly what their roles are to be in an unfolding and uncertain terrorist incident. During such an event isn’t the time to learn about those different roles and capabilities, which need to be both well understood and exercised.

Australia should involve these key decision-makers in the larger field exercises.