Coroner
Decision ofState Coroner O'Sullivan
Date of death
2024-04-13
Finding date
2026-02-05
Cause of death
Multiple causes: stab wounds (six victims identified with specific injuries to chest, back, abdomen)
AI-generated summary
On 13 April 2024, a mass stabbing incident at Westfield Bondi Junction resulted in six deaths and multiple injuries. The coronial investigation examined security response, identifying critical systemic failures: the CCTV Control Room was unoccupied when the attack began; an inexperienced CCTV operator (CR1) was unsupervised despite known competency deficiencies documented in operational minutes; initial radio communication was unclear, delaying recognition of an active armed offender scenario; emergency alerts and alarms were activated too late to prevent fatalities; and there were delays in alarm activation and PA announcements. Key lessons: CCTV control rooms in crowded places must be continuously staffed with appropriately trained personnel during trading hours; radio protocols during emergencies require clarity emphasizing weapon details; competency assessments must precede unsupervised deployment in critical roles; and dual-operator control rooms improve emergency response capacity.
AI-generated summary — refer to original finding for legal purposes. Report an inaccuracy.
Specialties
Error types
Coroners Court of New South Wales Inquest into the deaths at Westfield Bondi Junction on 13 April 2024 Volume Two Findings of Magistrate Teresa O'Sullivan New South Wales State Coroner 5 February 2026
State Coroner of New South Wales Inquest into the deaths at Westfield Bondi Junction on 13 April 2024 Findings and Recommendations 5 February 2026
Published 5 February 2026 by the Coroners Court of New South Wales 1A Main Avenue, Lidcombe NSW 2141 Phone: (02) 8584 7777 Fax: (02) 8584 7788 Email: lidcombe.coroners@justice.nsw.gov.au The photograph on the report’s cover was taken by Brendan Esposito of ABC News.
It is reproduced here with the kind permission of ABC News.
Volume Two
Part 5 Active Armed Offender (AAO) events
PART 5 ACTIVE ARMED OFFENDER (AAO) EVENTS Active Armed Offender events 5.1 During the course of the coronial investigation into the events of 13 April 2024, it became apparent that Mr Cauchi’s actions that day met the definition of what is known as an Active Armed Offender (AAO) incident.
5.2 In light of this, this Part will consider AAO events and is divided into the following sections: Section A Introduction Section B AAO incidents in Crowded Places Section C Responding to an AAO incident – “Escape. Hide. Tell.” Section D Witness evidence Section E Submissions regarding AAO incidents Section F Recommendations
PART 5 ACTIVE ARMED OFFENDER (AAO) EVENTS A. Introduction The Australian landscape 5.3 The events of 13 April 2024 were not a “terrorist attack” by definition; that is, Mr Cauchi did not have any intention of “advancing a political, ideological or religious cause”778 through his actions.
5.4 Nevertheless, his actions that day met the definition of what is known as an Active Armed Offender (AAO) incident.
5.5 The Australian Government has developed a strategy to manage the threat of terrorism, including the occurrence of AAO incidents in Australia. Therefore, the advice, guidelines, and policies that apply within Australia to AAO incidents are relevant to the Court’s consideration of the events of 13 April 2024. This includes the response of those involved that day, in particular from security at WBJ, NSWPF and NSWA.
5.6 As acknowledged by the Australian Government, the threat posed by terrorism and violent extremism is dynamic and constantly evolving, and Australia’s current security environment reflects the need for our nation’s response to be flexible and multifaceted.779 5.7 AAO attacks continue to be one of the most common tactics adopted by terrorists around the world,780 and they have, and continue to remain, a real threat to our community.
5.8 Noting that a terrorist threat can manifest across jurisdictional boundaries, a nationally consistent and coordinated response is required.781 In addition to the government response to terrorism, members of the community also play a vital role in keeping themselves and others safe.
5.9 Prior to considering the relevant response to the events of 13 April 2024, it is necessary to consider the background to the counter-terrorism strategy within Australia, including the available guidance regarding AAO attacks.
The Australia-New Zealand Counter Terrorism Committee 778 Exhibit 1, Vol 45, Tab 1602, Statement of Chief Inspector Colin Green, Annexure D, ANZCTC Active Armed Offender Guidelines for Crowded Places at p. 153.
779 Australian Government, A Safer Australia, Australia’s Counter Terrorism and Violent Extremism Strategy, January 2025 at pp. 3-4, available at https://www.nationalsecurity.gov.au/what-australia-is-doing-subsite/Files/australias-counter-terrorism-violentextremism-strategy.pdf.
780 Exhibit 1, Vol 45, Tab 1602, Statement of Chief Inspector Colin Green, Annexure D, ANZCTC Active Armed Offender Guidelines for Crowded Places at p. 141.
781 Australian Government, National Counter-Terrorism Plan, 5th Edition, 2024 at p. 7, available at https://www.nationalsecurity.gov.au/what-australia-is-doing-subsite/Files/anzctc-national-counter-terrorism-plan.pdf.
PART 5 ACTIVE ARMED OFFENDER (AAO) EVENTS 5.10 The Australia-New Zealand Counter Terrorism Committee (ANZCTC) was established following the 11 September 2001 terrorist attacks. Relevantly, its objectives are to “maintain the National Counter Terrorism Strategy, plan and guidance” and to “coordinate an effective nation-wide counter-terrorism capability”, including the sharing of relevant intelligence and information.782 5.11 The ANZCTC is a partnership between the Commonwealth, state and territory governments, and a bilateral relationship with New Zealand. The ANZCTC works with all jurisdictions, together with communities and the private sector, to enhance the effectiveness of Australia’s counter-terrorism efforts. Central to this effort is the focus on enabling nationally consistent approaches to countering terrorism, with an emphasis on interoperability.783 Active Armed Offender (AAO) 5.12 The ANZCTC Guidelines define an Active Armed Offender (AAO) as: … an armed offender who is actively engaged in killing or attempting to kill people, and who demonstrates their intention to continue to do so while having access to additional potential victims.784 5.13 This section considers broadly the Australian approach (and relatedly, the NSW approach) to an AAO incident that may occur in a what is termed a “Crowded Place”.
These places include a location like WBJ.
5.14 Noting the importance of this issue, this Part will also draw on evidence received by the Court during the Inquest from various witnesses regarding the community messaging around what individuals can do in an AAO attack.
5.15 At the outset, it is noted that AAO attacks are rare in Australia. As is often the case with AAO attacks, Mr Cauchi’s actions unfolded rapidly, with many people affected in a short period of time after his attack began. By definition, an AAO will seek to kill and injure as many people as possible within the shortest possible time period. As will be further outlined in Part 6, within three minutes of commencing his attack, Mr Cauchi had stabbed 16 people, six of whom suffered fatal injuries.
5.16 As will be reflected further in these findings, the nature and scale of the incident involving Mr Cauchi tested the organisations involved on 13 April 2024, including Scentre, NSWPF and NSWA. Their specific organisational policies and procedures, approach and response to the events of 13 April 2024 are considered in Parts 7, 8 and 9 respectively.
782 Exhibit 1, Vol 45, Tab 1602, Statement of Chief Inspector Colin Green at [22].
783 Australian Government, A Safer Australia, Australia’s Counter Terrorism and Violent Extremism Strategy, January 2025 at p. 29, available at https://www.nationalsecurity.gov.au/what-australia-is-doing-subsite/Files/australias-counter-terrorism-violentextremism-strategy.pdf.
784 Exhibit 1, Vol 45, Tab 1602, Statement of Chief Inspector Colin Green, Annexure D, ANZCTC Active Armed Offender Guidelines for Crowded Places at p. 141.
PART 5 ACTIVE ARMED OFFENDER (AAO) EVENTS B. AAO incidents in Crowded Places What is a Crowded Place?
5.17 Crowded Places are locations that are vulnerable to terrorist attacks and are used by a large number of people on a regular basis. These include, but are not limited to, sports stadiums, transport infrastructure, shopping centres, pubs, clubs, places of worship, tourist attractions, movie theatres and civic spaces.785 5.18 The large, concentrated crowds that may populate a Crowded Place make them locations that are considered “attractive terrorist targets.” The impact of this is twofold, as it requires owners and operators of Crowded Places to take steps to protect people who work, use or visit those locations, and it also requires members of the public attending Crowded Places to be conscious of the vulnerability of these locations and be prepared to react quickly should an attack occur.786 5.19 One committee that forms part of the ANZCTC is the Crowded Places Sub Committee (CPSC), which reports to and advises the ANZCTC on protecting Crowded Places from terrorism, as well as providing a forum through which all jurisdictions “can identify and share best practice, develop capabilities, and oversee activities related to protecting crowded places.”787 ANZCTC AAO Guidelines for Crowded Places 5.20 In 2023, ANZCTC published the current “Active Armed Offender Guidelines for Crowded Places” (ANZCTC Guidelines).
5.21 The purpose of the ANZCTC Guidelines is: … to help owners or operators of Crowded Places to be more aware of the threat posed by Active Armed Offenders (AAO). They also provide guidance on considerations during risk mitigation and contingency planning activities. 788 5.22 The creation of the ANZCTC Guidelines was specifically to assist owners of Crowded Places in preparing for and responding to any AAO event, regardless of an incident’s similarity or otherwise to an act of terrorism. This is reflected in the definition of an AAO adopted in the ANZCTC Guidelines outlined above.
5.23 In addition to the ANZCTC Guidelines, the ANZCTC publishes supplementary materials to assist operators of Crowded Places to understand and implement protective security 785 Australian Government, Australian National Security, Crowded Places, 22 September 2024, available at https://www.nationalsecurity.gov.au/protect-your-business/crowded-places/overview.
786 Australian Government, Australian National Security, Crowded Places, 22 September 2024, available at https://www.nationalsecurity.gov.au/protect-your-business/crowded-places/overview 787 Exhibit 1, Vol 45, Tab 1602, Statement of Chief Inspector Colin Green, Annexure B, ANZCTC, Australia’s Strategy for Protecting Crowded Places from Terrorism at p. 98.
788 Exhibit 1, Vol 45, Tab 1602, Statement of Chief Inspector Colin Green, Annexure D, ANZCTC Active Armed Offender Guidelines for Crowded Places at p. 141.
PART 5 ACTIVE ARMED OFFENDER (AAO) EVENTS measures. These supplementary materials include items such as the Crowded Places Self-Assessment Tool, which assists operators of Crowded Places to understand and assess the vulnerability of their location to a terrorist attack.789 5.24 The ANZCTC Guidelines operate in conjunction with Australia’s National CounterTerrorism Plan for “Prevention, Preparedness, Response, Recovery” (PPRR) from terrorist acts.790 The PPRR framework was developed overseas and has been used in Australia for many years.
5.25 In respect of “Preparedness”, the ANZCTC Guidelines emphasise the importance of security culture, development, review, and testing of security plans, policies, and procedures.791 5.26 In respect of “Response”, the ANZCTC Guidelines emphasise the importance of the initial response by operators of “Crowded Places”. They state (emphasis added): The dynamic and unpredictable nature of active armed offender incidents means there is no single best practice that crowded place owners and operators can build into their plans, arrangements and training activities. Your organisation must determine its response priorities and ascertain what is realistic through planning and testing. This should include preparing and empowering security and frontline personnel to make decisions to counter an active armed offender attack that may prevent unnecessary delays coordinating a response. The primary objective of any initial response planning should be to minimise the offender's access to victims. Owners and operators should develop and practise strategies aimed at evacuating people and isolating the offender.792 5.27 The ANZCTC Guidelines also suggest the initial and most critical tasks to be undertaken by an operator of a Crowded Place are to detect the attack, inform emergency services, and alert members of the public. It is not to intervene in the incident or try to stop it.
5.28 The ANZCTC Guidelines acknowledge that the operator of a Crowded Place will not ultimately be responsible for the ongoing response to an AAO – that is the responsibility of emergency responders. This is emphasised by the “Transition considerations” set out in the ANZCTC Guidelines. These emphasise the need to transition responsibility for managing the initial response from management/security staff of the Crowded Place to police. This is considered further with respect to the response of Scentre Group and the security staff at WBJ in Part 7.
5.29 The ANZCTC guidelines acknowledge that whilst operators of Crowded Places (including security personnel) play an important role in any initial response, including the collation 789 Australian Government, Australian National Security, Crowded Places Self-Assessment Tool, 22 September 2024, available at https://www.nationalsecurity.gov.au/protect-your-business/crowded-places/overview/self-assessment-tool.
790 Exhibit 1, Vol 45, Tab 1602, Statement of Chief Inspector Colin Green, Annexure D, ANZCTC Active Armed Offender Guidelines for Crowded Places at pp. 144-150.
791 Exhibit 1, Vol 45, Tab 1602, Statement of Chief Inspector Colin Green, Annexure D, ANZCTC Active Armed Offender Guidelines for Crowded Places at p. 146.
792 Exhibit 1, Vol 45, Tab 1602, Statement of Chief Inspector Colin Green, Annexure D, ANZCTC Active Armed Offender Guidelines for Crowded Places at p. 147.
PART 5 ACTIVE ARMED OFFENDER (AAO) EVENTS and timely provision of information, the ultimate response to an AAO incident will come from first responders, namely police (in terms of apprehending any threat) and ambulance (in terms of providing medical care to any victims).
NSWPF Terrorism Protection Unit 5.30 The NSWPF Terrorism Protection Unit (TPU) is responsible for providing terrorism threat information and protective security advice (informed by the ANZCTC and the ANZCTC Guidelines) to stakeholders. This relevantly includes owners and operators of Crowded Places in NSW.793 5.31 Chief Inspector Colin Green (CI Green) has been the manager of the TPU since 2018. He gave evidence at the Inquest concerning the security function of the TPU and how it engages with owners and operators of Crowded Places, in particular shopping centres like WBJ.
5.32 The TPU team is comprised of 10 NSWPF staff members, including CI Green.
Consequently, he maintains a high degree of involvement in the functions of the TPU.
5.33 CI Green explained that it is the responsibility of the TPU to provide terrorism threat information and protective security advice to government, police and owner-operators of Crowded Places, critical infrastructure and regional airports. To undertake this task, the TPU provides advice and guidance via several different mechanisms and formats.794 5.34 For example, in 2024, the TPU had over 500 engagements where advice was provided or a meeting, conference or seminar was held. This included seven Crowded Places Forums, discussed further below, and 18 vulnerability assessments for major events or critical infrastructure. All advice provided by the TPU in this capacity is free of charge and funded by the NSWPF.795 5.35 Since around 2010, the TPU has worked directly with the owner-operators of shopping centres and the Shopping Centre Council of Australia. That work has included planning for prevention and response to AAOs. This is discussed further with reference to Scentre Group (WBJ) in Part 7.
Crowded Places Forums 5.36 In 2017, the Crowded Places Sub Committee (CPSC) funded the first Crowded Places Forum in NSW to launch the ANZCTC documents outlined above. The purpose of Crowded Places Forums is to provide participants (owners and operators of Crowded Places and other stakeholders) with an understanding of terrorism threats and provide 793 Exhibit 1, Vol 45, Tab 1602, Statement of Chief Inspector Colin Green at [13].
794 Exhibit 1, Vol 45, Tab 1602, Statement of Chief Inspector Colin Green at [13].
795 Exhibit 1, Vol 45, Tab 1602, Statement of Chief Inspector Colin Green at [15].
PART 5 ACTIVE ARMED OFFENDER (AAO) EVENTS information in respect of Australia’s Strategy for Protecting Crowded Places Against Terrorism and the ANZCTC Guidelines.796 5.37 The aim of the forum is to, among other matters, provide participants with an understanding of the current terrorism threat environment, and provide protective security advice on how to deter, detect, delay, and respond to threats. Discussion exercises are used to reflect on what should be done in response to an AAO.797 5.38 Since 2017, Crowded Places Forums in NSW have been entirely funded by NSWPF. The TPU, managed by CI Green, conducts approximately six forums a year, at a cost of $10,000 to $15,000 each.798 5.39 Oral evidence given by CI Green at Inquest highlighted that the role of the TPU is advisory and it was incumbent upon the relevant entity (including operators of Crowded Places) to develop and implement their own security policies and procedures, having regard to the advice provided by the TPU. In particular, CI Green noted that: … it's the responsibility of the owner/operator to implement that advice. We've got no control on that. We influence them on what the threat is, to understand it, and we provide advice to them about what can be done to prevent and prepare.799 ANZCTC engagement through the Business Advisory Group 5.40 The ANZCTC also engages with businesses and owners/operators of Crowded Places through the ANZCTC Business Advisory Group (BAG).800 5.41 The BAG is comprised of representatives from industry sectors and provides feedback and guidance to police in relation to industry needs. Both the Shopping Centre Council of Australia and Scentre are represented in BAG,801 with Mr Yates being an industry representative to BAG.
5.42 CI Green explained that private security providers (such as Glad) are not involved in the
BAG: No, they're not, and that's quite strategic in the means we do that. We do have in New South Wales very good links in with the security, the Australia Security Industry Association, but no, they're not part of that. We find that at that strategic level we've got to manage conflicts, and that's one of the conflicts we see, as providing one security provider with that information could be seen as a competitive advantage, so we don't.
But we certainly are involved with activities across Australia with the security industry within our licensing command in New South Wales Police Force, our security enforcement licensing directorate, and also with industry groups.802 796 Exhibit 1, Vol 45, Tab 1602, Statement of Chief Inspector Colin Green at [45]-[48].
797 Exhibit 1, Vol 45, Tab 1602, Statement of Chief Inspector Colin Green at 61.
798 Exhibit 1, Vol 45, Tab 1602, Statement of Chief Inspector Colin Green at [53].
799 Transcript, D4 (Green): T269.26-29 (1 May 2025).
800 Exhibit 1, Vol 45, Tab 1602, Statement of Chief Inspector Colin Green at 61.
801 Exhibit 1, Vol 45, Tab 1602, Statement of Chief Inspector Colin Green at 61.
802 Transcript, D4 (Green): T274.34-42 (1 May 2025).
PART 5 ACTIVE ARMED OFFENDER (AAO) EVENTS 5.43 Steve Iloski, the CEO of Glad, gave evidence that he considered private security providers would gain value from attending such forums and would welcome such an opportunity. He stated: I would love the opportunity for organisations like ourselves to be part of the BAG forum.
It'd be - give us insight and learnings and that way we also know we can change and tweak our organisation around training and learnings and continue evolving that, that's vital for us.803 5.44 This is considered further below.
803 Transcript, D18 (Iloski): T1672.29-32 (26 May 2025).
PART 5 ACTIVE ARMED OFFENDER (AAO) EVENTS C. Responding to an AAO incident – “Escape. Hide. Tell.” “Escape. Hide. Tell.” 5.46 The message “Escape. Hide. Tell.” is the current guidance provided by the ANZCTC Guidelines regarding what to do in a terrorist attack, in particular, an AAO. This message is also used by the TPU consistent with these national guidelines. The message is unique in that it specifically relates to the response to an AAO, as distinct from a response to other types of emergencies and consists of three components.
5.47 The “Escape. Hide. Tell.” message is a key focus of the AAO Guidelines. The intent of this message is to encourage members of the public to escape from the armed offender, hide somewhere safe, and if possible, report the incident to the authorities. The development of this message followed a review of both the United Kingdom's message: “Run, Hide, Tell.”, and the United States of America's message: “Run, Hide, Fight”.
5.48 The key difference between the approach of the United Kingdom and Australia, as outlined by CI Green, is that that in Australia the aim is for people to think about where the threat is prior to escaping so that they do not run towards the threat.
5.49 In evidence, CI Green further explained the “Escape. Hide. Tell.” message: It’s a general message we want all the public to know. We want people to know that if they see something, they need to get [situational] awareness and they need to escape away from it if they can. If they can't escape, they need to hide. Hide behind something that offers protection or something that can just physically hide them. So it takes into account people that panic, and people that have got accessibility issues. We want people to tell us as well. The primary piece there is we need information, so we want to find out through triple-0 calls. We don't want people to be standing up with a mobile phone filming what's occurring. We want people to hide or escape, but tell us where the person is, what they're doing, so it assists our police response.804 5.50 The evidence of CI Green reflects the variability in how individuals may respond in the event of an AAO attack and the importance of this message to guide their response. As referred to further below, evidence in the Inquest suggested that the “Escape. Hide. Tell.” messaging is not well known within the community and was not reflected in the way members of the public responded to the events of 13 April 2024.
5.51 Appendix C of the ANZCTC Guidelines provides detailed advice about the optimal response to an AAO, utilising “Escape. Hide. Tell.” as referred to further below.805 804 Transcript, D4 (Green): T275.47-T276.10 (1 May 2025).
805 Exhibit 1, Vol 45, Tab 1602, Statement of Chief Inspector Colin Green, Annexure D, ANZCTC Active Armed Offender Guidelines for Crowded Places at p. 155.
PART 5 ACTIVE ARMED OFFENDER (AAO) EVENTS 5.52 In addition to this Appendix to the ANZCTC Guidelines, the Australian National Security website provides posters of this messaging to educate individuals on what to do in the event of an attack, including a trainer’s guide and presentation.806 Figure 1: “Escape. Hide. Tell.” Poster “Escape” 5.53 In respect of “Escape”, the ANZCTC Guidelines advice provides “[y]our priority action should be to remove yourself and others from close proximity to the offender/s, or areas they might reasonably access.” It suggests a number of actions, including:807
(a) Take cover if under immediate attack but attempt to leave the area as soon as it is safe to do so;
(b) Leave belongings other than one’s mobile phone;
(c) Avoid congregating in open areas or at evacuation points;
(d) Guide people who appear unfamiliar with the area; 806 Australian Government, Australian National Security, What to do in an attack, 23 October 2025, available at: https://www.nationalsecurity.gov.au/what-can-i-do/what-to-do-in-an-attack.
807 Exhibit 1, Vol 45, Tab 1602, Statement of Chief Inspector Colin Green, Annexure D, ANZCTC Active Armed Offender Guidelines for Crowded Places at p. 155.
(e) Make use of gunfire-resistant cover and other concealment opportunities while escaping; and
(f) Consider, as a last resort, self-defence if located by an offender.
5.54 In short, the primary action in response to an AAO is to get away, as quickly as possible, provided it is safe to do so.
“Hide” 5.55 In respect of “Hide”, the ANZCTC Guidelines provide “[i]f you don’t believe you can safely evacuate, then you may need to consider sheltering in place”. It provides various suggestions, including:808
(a) Lock/barricade oneself in a room or secure area;
(b) Secure your immediate environment and vulnerable areas;
(c) Move away from doors;
(d) Silence phone or other devices that may sound;
(e) Try to contact police or others to advise of the situation;
(f) Re-assess for better options or locations for sheltering; and
(g) Consider, as a last resort, self-defence if located by an offender.
5.56 This reinforces that, when faced with an AAO, if it is not safe to escape, a person should remove themselves from danger.
“Tell” 5.57 In respect of “Tell”, the ANZCTC Guidelines provide “[t]he more information you can give about your location, surroundings, the attackers and the events that have occurred, the better”, but state that contacting the police should never be done at the risk of personal or others’ safety.809 The advice provides examples of useful information, including the location of the offender, a description of the offender, the direction the offender is heading in, the weapon(s) being used, the number of injuries, and any details concerning motive (if apparent).810 5.58 This component emphasises the importance of information (including the communication of such information) when responding to an AAO.
808 Exhibit 1, Vol 45, Tab 1602, Statement of Chief Inspector Colin Green, Annexure D, ANZCTC Active Armed Offender Guidelines for Crowded Places at p. 155.
809 Exhibit 1, Vol 45, Tab 1602, Statement of Chief Inspector Colin Green, Annexure F, Australian National Security, Trainer’s Guide ‘In an attack, what you do matters’ at p. 162.
810 Exhibit 1, Vol 45, Tab 1602, Statement of Chief Inspector Colin Green, Annexure D, ANZCTC Active Armed Offender Guidelines for Crowded Places at p. 155.
PART 5 ACTIVE ARMED OFFENDER (AAO) EVENTS D. Witness evidence Crowded Places Forums 5.59 During oral evidence at Inquest, CI Green further emphasised the critical nature of Crowded Places Forums in ensuring owners and operators of Crowded Places are well versed in the risks facing them and how to manage those risks. He explained: … it's an opportunity not just for us to deliver content, but it's an opportunity for operators to engage with each other and share information. We have a diverse group of operators, some that are very security aware and very much invested in security, and others that aren't so mature in that space. And it gives the opportunity for people to work together, provide them an understanding of the threat, the impacts to their business and their people, and what advice we can, from the guidelines, that they can put in place to again prevent and prepare and get ready for that initial response if an incident occurs.
… … they’re a fundamental part of our, our – what we do in New South Wales. They’re also a fundamental part of the, all the policing jurisdictions in Australia as well. … our primary means of engagement is through that forum… 811 5.60 As noted above, Crowded Places Forums in NSW are currently entirely funded by NSWPF. CI Green gave evidence that the forums are heavily over-subscribed, providing an example in which, within the first two hours of release, over 445 people sought to attend a recent forum with only 150 places available. He also observed that resourcing limits the number of forums that can be run by the TPU.812 5.61 Additionally, as discussed above, Mr Iloski, the CEO of Glad, gave evidence that he would welcome the opportunity to be involved in these forums, noting that currently private security providers do not participate.
“Escape. Hide. Tell.” public messaging 5.62 In his expert report, Scott Wilson observed that “Escape. Hide. Tell.” was similar to the UK Government advice relating to AAO incidents: “Run Hide Tell”.813 5.63 As outlined above, CI Green noted the key difference between the UK and Australian approach is that “in Australia we want people to think about where the threat is prior to escaping (so they do not run towards the threat)”.814 Mr Yates gave evidence that he considered “Escape. Hide. Tell.” to be better messaging for this reason.815 811 Transcript, D4 (Green): T279.17-27, T280.47-50 (1 May 2027) 812 Transcript, D4 (Green): T280.18-20, T281.35-36 (1 May 2025).
813 Exhibit 1, Expert Volume, Tab 20, Report of Scott Wilson at [5.9].
814 Exhibit 1, Vol 45, Tab 1602, Statement of Chief Inspector Colin Green at [35].
815 Transcript, D15 (Yates): T1311.24-36 (20 May 2025).
PART 5 ACTIVE ARMED OFFENDER (AAO) EVENTS 5.64 At the time his statement was prepared in February 2025, CI Green noted that the “Escape. Hide. Tell.” message had not been subject to a public awareness campaign in Australia.816 CI Green, Mr Wilson, Mr Yates, and Mr Iloski were all in agreement that there was a lack of public awareness in Australia in respect of the “Escape. Hide. Tell.” messaging and were supportive of a campaign to raise public awareness.817 5.65 Bradley Goldberg, member of Scentre Management at WBJ, gave evidence that public awareness of “Escape. Hide. Tell.” could be improved. He explained: … when I turn to someone and ask, "All right. What does escape, hide, tell mean to you?", they, they look at me like I'm - like, "What are you talking about?" So I agree. I think that messaging needs to be out there in the public. They need to know if they instantly see it, what it means and, and to, to act. 818 5.66 CI Green recommended that more information about “Escape. Hide. Tell.” could be shared by businesses and media, as well as through the Crowded Places Forums, noting “this should be a message that is as common to our younger generation as “Get down low and go go go””. CI Green noted that NSWPF were in the process of developing infographics for distribution on social media.819 5.67 Mr Wilson gave evidence that a public awareness campaign in the UK with the support of public figures and celebrities had increased awareness of the “Run Hide Tell” message from approximately 10% (of a sample group) to 60 – 70% after the campaign.
Mr Yates agreed with this, noting the UK government website for “Run Hide Tell” received approximately seven million visits during the campaign.820 I will refer specifically to the UK campaign further below.
5.68 Mr Wilson ultimately described the need for public awareness in respect of AAO attacks and the importance of the “Escape. Hide. Tell.” Messaging. He gave evidence that: … the normal person on the street will hesitate. They'll not have the general awareness, and they don't get away from the danger zone quick enough. And that was the idea, to increase that vigilance, increase that awareness, so when people were in crowded places and they hear screaming and they hear shouting, they hear - they see signage, they know they're in the danger zone and need to get to safety. 821 5.69 Mr Wilson also stressed the importance of security personnel of a Crowded Place in the event of an AAO, namely that: Visitors and members of the public are likely to be less able to recognise an attack as well as being less familiar with an organisation’s site layout, environment and procedures. It is unrealistic to expect these people to be prepared for an attack and their actions may put themselves or others in danger. In the event of attack, knowledgeable 816 Exhibit 1, Vol 45, Tab 1602, Statement of Chief Inspector Colin Green at [35].
817 Transcript, D4 (Green): T276.20-39 (1 May 2025); Transcript, D14 (Wilson): T1262.1-T1263.16 (19 May 2025); Transcript, D15 (Yates): T1338.48-T1339.20 (20 May 2025); Transcript, D18 (Iloski): T1674.30-49 (18 May 2025).
818 Transcript, D9 (Goldberg): T768.43-46 (9 May 2025).
819 Transcript, D4 (Green): T276.31-T277.2 (1 May 2025).
820 Transcript, D14 (Wilson): T1262.8-T1263.16 (19 May 2025); Transcript, D15 (Yates): T1339.6-10 (20 May 2025).
821 Transcript, D14 (Wilson): T1263.1-7 (19 May 2025).
PART 5 ACTIVE ARMED OFFENDER (AAO) EVENTS personnel should guide these people on what to do utilising the Escape Hide Tell methodology. 822 5.70 It was apparent from the evidence received by the Inquest that the response of civilian bystanders on 13 April 2024 was not consistent with the “Escape. Hide. Tell.” messaging.
This is not to be critical of any of the civilians present that day.
5.71 Examples of civilian responses to the events of 13 April 2024 that illustrate this include:
(a) A bystander who observed Insp Scott shoot Mr Cauchi asked another witness: “What's going on here? Is this a movie or something. Are you guys filming a movie?”;
(b) Various instances of people using their mobile phones to film the incident, including as it was ongoing; and
(c) Whilst undeniably courageous, civilians pursuing Mr Cauchi, rather than retreating to safety.
5.72 Whilst it may be the case that the response of the public is not solely dependent on any alarms or alerts that occur during an AAO event, it is nevertheless noted that on 13 April 2024, there was no alert in relation to the events that were unfolding that day (whether by way of alarm, PA announcement, or other audio/visual means) until after Mr Cauchi had been shot, as discussed further in Part 7.
5.73 Mr Goldberg stressed the importance of disseminating the “Escape. Hide. Tell.” message to the broader public in his evidence, stating: Situational awareness is important. It's key. If you watch some more of the footage, you'll actually see people are just walking around looking on their phones while it's all happening around them, oblivious to what was going on. And it's, it's actually one of the key lessons I taught my kids about situational awareness when, when they're out. Just don't be on your phones. Just know what's happening around you. It's definitely, definitely a key learning. 823 5.74 This evidence highlights the importance of increasing public awareness of the “Escape.
Hide. Tell.” message so that members of the public know what they can do to keep themselves and others safe should such an incident occur.
UK Public Awareness Strategy 5.75 In the UK, public guidance is provided via the “Run Hide Tell” message, which similarly sets out the three key steps to assist members of the public faced with a terrorist event or AAO situation. This advice states that people should first try to flee an attack, or alternatively, find somewhere safe to hide, and then alert authorities.
822 Exhibit 1, Expert Volume, Tab 20, Expert Report of Scott Wilson at [5.4].
823 Transcript, D9 (Goldberg): T769.5-11 (9 May 2025).
PART 5 ACTIVE ARMED OFFENDER (AAO) EVENTS 5.76 Around September 2017, a high-level campaign was run by Counter Terrorism Policing in the UK, enlisting several celebrities to deliver the “Run Hide Tell” message. Notably, research has indicated that in the UK, members of the public would rather hear this messaging from celebrities than senior police or government officials.824 5.77 At the time of the campaign’s release, police had expressed concerns regarding bystanders filming recent terror incidents. Accordingly, this campaign was aimed at 11 to 16 year olds, with a focus on telling those present at the scene of a terror attack to move away from the danger rather than using their mobile phones to record.825 5.78 This was followed in April 2018 by the release of Action Counters Terrorism (ACT) ELearning Training, with the initial aim of delivering awareness training to more than a million Crowded Places workers as part of what was, at that time, a groundbreaking learning package. Since this launch, other content has been released including ACT for Youth, designed for young people aged 11 to 16 years old and ACT for Education designed for staff in education settings. 826 Figure 2: Run Hide Tell advertisements 824 Exhibit 1, Expert Volume, Tab 20, Expert Report of Scott Wilson at [11.4.1].
825 BBC, ‘Don’t film terror attacks, police warn eyewitnesses’, 28 September 2017, available at https://www.bbc.com/news/uk41417659.
826 Exhibit 1, Expert Volume, Tab 20, Expert Report of Scott Wilson at [11.4.1].
PART 5 ACTIVE ARMED OFFENDER (AAO) EVENTS E. Submissions regarding AAO incidents Crowded Places Forums 5.79 Regarding Crowded Places Forums, Counsel for the Commissioner, NSWPF submitted that the evidence at Inquest established that:
(a) The Crowded Places Forums are essential to the education of owners and operators of Crowded Places as to how to prepare and respond to AAO incidents;
(b) The forums are heavily oversubscribed with demand far exceeding the number of places available;
(c) The forums are currently entirely funded by NSWPF, and limited resources restrict the number of forums that can be conducted each year; and
(d) There are difficulties in increasing funding through, for example, charging an attendance fee.
5.80 In light of this evidence, it was submitted on behalf of the Commissioner that this bears directly on the capacity of NSWPF to facilitate greater access to the Crowded Places Forums, including by increasing the number of forums held each year.
5.81 Submissions on behalf of Glad acknowledged that, as a private security provider, Glad Group is not currently involved in the CPSC or ANZCTC BAG. Consistent with the evidence of Mr Iloski, Glad would welcome the opportunity to participate in these forums and would gain value from doing so.
5.82 It was submitted on behalf of Glad that the Court may wish to make a recommendation encouraging engagement by providers such as Glad in these forums to ensure broader perspectives and input are available to the consultation/advisory groups.
5.83 A recommendation regarding the attendance of private security companies at ANZCTC CPSC or BAG forums was not suggested by Counsel Assisting.
5.84 Counsel on behalf of the Commissioner, NSWPF submits that a recommendation regarding the attendance of private security companies at the ANZCTC CPSC or BAG forums would be inappropriate. Relying on the evidence of CI Green, it was submitted:
(a) First, the involvement of some private security companies in these fora would give rise to the real potential for a conflict of interest. This is because private security companies tender or are contracted to provide security advice to owners and operators; providing some providers with such information could be perceived as preferential treatment or giving those providers a competitive advantage.
(b) Secondly, there are other avenues by which NSWPF in particular engages directly with private security companies in New South Wales to provide them with important information and guidance about preparing for and responding to AAO
PART 5 ACTIVE ARMED OFFENDER (AAO) EVENTS incidents, including through the NSWPF Security Enforcement Licencing Directorate, NSWPF Shield and direct industry group engagement.827 “Escape. Hide. Tell.” 5.85 Counsel Assisting submitted that there was uniform support for greater public awareness of the “Escape. Hide. Tell.” messaging.
5.86 Given the extensive evidence before the Inquest of reactions on the part of civilian bystanders as outlined in this Part, Counsel Assisting proposed that the Court consider a recommendation regarding the active promotion of the “Escape. Hide. Tell.” principles.
5.87 Counsel for Scentre strongly endorsed the proposed recommendation regarding the “Escape. Hide. Tell.” principles.
5.88 Submissions of behalf of Glad also agreed with the proposed recommendation as articulated by Counsel Assisting.
October 2025 launch of “Escape. Hide. Tell.” materials 5.89 Since the conclusion of the Inquest hearing, the Australian Department of Home Affairs has launched updated “Escape. Hide. Tell.” materials on 23 October 2025.828 5.90 The “Escape. Hide. Tell.” materials: … have been updated to reach all Australians, including culturally and linguistically diverse (CALD) communities, First Nations people and people living with disability along with their carers. The updates include translations in multiple languages and animated videos to improve understanding and recall.829 5.91 It is apparent that this relaunch of the “Escape. Hide. Tell.” materials have also been in conjunction with wider coverage of the message by police forces within Australia, including NSWPF.
827 Written submissions on behalf of the Commissioner, NSWPF at [60].
828 Australian Government, Department of Home Affairs, ‘Media Release: Escape. Hide. Tell. Empowering All Australians’, 23 October 2025, available at: https://www.homeaffairs.gov.au/news-media/archive/article?itemId=1360; Exhibit 1, Vol 54, Tab 1690, Australian Department of Home Affairs, Media Release ‘Escape. Hide. Tell. Empowering All Australians.’ 829 Exhibit 1, Vol 54, Tab 1690, Australian Department of Home Affairs, Media Release ‘Escape. Hide. Tell. Empowering All Australians’.
PART 5 ACTIVE ARMED OFFENDER (AAO) EVENTS F. Recommendations 5.92 Counsel Assisting proposed the following recommendation directed to the NSW Government: That the NSW Government actively promote, by way of an advertising campaign, the principles of “Escape. Hide. Tell.”, including by encouraging operators and owners of Crowded Places to disseminate the messaging amongst staff, retailers, and attendees.
5.93 An AAO situation is unlike any other emergency, and it requires a specific message.
5.94 Unlike the UK messaging, the Australian guidance of “Escape. Hide. Tell.” is framed in such a way to focus on ensuring that in the event of an AAO attack, people move away from danger, are not filming with their phones, and take themselves out of harm’s way as swiftly as possible.
5.95 Whilst the Court commends the recent media release and circulation of the “Escape.
Hide. Tell.” materials, including updates to make this material more accessible to members of the community, the evidence received during Inquest establishes that it is necessary and desirable for there to be further promotion and dissemination of this message to the NSW public, including wider dissemination amongst those who work or attend Crowded Places by the owners and operators of such locations.
5.96 Accordingly, I propose to make the following recommendation:
RECOMMENDATION Recommendation 13: To the NSW Government That the NSW Government actively promote, by way of an advertising campaign, the principles of “Escape. Hide. Tell.”, including by encouraging operators and owners of Crowded Places to disseminate the messaging amongst staff, retailers, and attendees.
5.97 It was submitted on behalf of Glad that I consider a recommendation encouraging engagement by private security providers such as Glad, in relevant forums (ANZCTC CPSC or BAG), to ensure broader perspectives and input are available to those consultation/advisory groups.
5.98 I accept the evidence provided by CI Green, as outlined above, namely, that such involvement of private security companies could give rise to a potential conflict of interest noting the competitive advantage that may arise should one security provided receive information via such a forum, and also that the NSWPF currently has in place a number of avenues through which they directly engage with private security companies, such as the NSWPF Security Enforcement Licencing Directorate (SLED), NSWPF Shield and via direct industry group engagement.
PART 5 ACTIVE ARMED OFFENDER (AAO) EVENTS 5.99 Having closely considered the evidence regarding the function of the forums and groups, I do not propose to make a recommendation regarding the engagement of private security providers in such forums/groups.
Part 6 The events of 13 April 2024
PART 6 THE EVENTS OF 13 APRIL 2024 A. Introduction Introductory note 6.1 A number of Mr Cauchi’s surviving victims wished for their names to not be published to preserve their privacy. Accordingly, for the purposes of these findings they have been given pseudonyms commencing with “Victim” followed by a number to indicate the order in which they were injured by Mr Cauchi. No disrespect is intended by referring to them in this way and I acknowledge the distress they have each experienced as a result of what occurred at WBJ on 13 April 2024.
The events of 13 April 2024 6.2 On the morning of 13 April 2024, Mr Cauchi was experiencing homelessness and had spent the night near a toilet block at Maroubra beach. After packing up his belongings, he travelled by bus to Kennards Storage, Waterloo, arriving around 7:30am. That facility had 24-hour access, and as outlined in Part 4, Mr Cauchi had been renting a small storage locker to store some of his belongings, with his rental agreement commencing on 6 March 2024.
6.3 Mr Cauchi entered Kennards and accessed his rented locker. He took out a bottle of soft drink from inside the locker and several other items, including a small backpack. At times, Mr Cauchi lay down on the ground in front of the rental locker, appearing to rest.
He charged his mobile phone using a nearby power outlet.
6.4 At 8:09am, Mr Cauchi returned to his storage locker and removed a light brown sheath and a brown KA-BAR knife box from inside, placing both items next to a backpack on the ground nearby. Mr Cauchi removed the knife from the box and placed it in and out of both the sheath and different bags. He continued to do this for a further 20 minutes, pacing back and forth and placing the knife in and out of different bags.
6.5 Mr Cauchi changed clothes, putting on an Australian NRL uniform (jersey and shorts) and blue shoes from within the storage unit. He then left Kennards and made his way to Bondi Junction by train. It does not appear he took the knife with him on this trip.
6.6 The Kennards Waterloo Assistant Manager gave evidence that when she went to clean the bathroom inside the facility, she found it to be occupied and saw Mr Cauchi’s backpack was outside.
6.7 She heard crying noises coming from inside the bathroom and later heard the same crying noises coming from the direction of Mr Cauchi’s locker. The Assistant Manager did not observe Mr Cauchi crying, although she did see him wipe his face multiple times with his forearm. Otherwise, his behaviour that day was the same as during their previous interactions.
PART 6 THE EVENTS OF 13 APRIL 2024 6.8 After arriving at Bondi Junction Railway Station, Mr Cauchi entered a nearby café before leaving a short time later. He then entered a nearby restaurant and looked at the menu before leaving without purchasing any food. Mr Cauchi returned to Kennards Storage Waterloo by train, arriving just after 11:00am, and went to his storage locker.
6.9 There, Mr Cauchi removed another backpack from the storage locker and placed it on the floor. He remained in the vicinity of the locker and at this time appears to have placed into his backpack the knife he would use later that afternoon at WBJ.
6.10 At 11:30am, Mr Cauchi left Kennards and travelled by train to WBJ, arriving around 12:17pm. Shortly after arriving, Mr Cauchi fell to the ground outside a store on Oxford Street Mall but picked himself up. He walked around WBJ until approximately 1:15pm and then travelled to Bondi Beach by bus.
6.11 Mr Cauchi returned to WBJ by bus, arriving and entering the Centre at 2:48pm. He attended a supermarket and purchased food and drink, and then walked around the shopping centre, in and out of shops in an apparently aimless manner.
6.12 Just after 3:22pm, Mr Cauchi walked into WBJ for the last time via the Centre Court Entry on Level 4 (Oxford Street level). He was wearing the Australian NRL jersey and shorts he had put on earlier that morning, with a black backpack on his back.
6.13 Mr Cauchi walked through Level 4 of WBJ before lining up in a queue of customers at the Sourdough Bakery and Café just after 3:31pm. One of these customers was Dawn Singleton.
6.14 The events that followed were rapid and unpredictable. Within a period just shy of three minutes, Mr Cauchi would stab a total of 16 victims, including the six who tragically died of their injuries. As a result of the thorough investigation by DCI Marks and his team and the extensive CCTV footage available, there is clear and detailed evidence of Mr Cauchi’s movements that day.
6.15 It is necessary, for the purpose of these findings, to outline the chronology of Mr Cauchi’s attack – in doing so, the Court is conscious of the impact of outlining the traumatic events of that day.
6.16 As part of the Inquest proceedings, plans were prepared with the assistance of the NSWPF Forensic Imaging Section, depicting the location of those who were injured and killed on 13 April 2024 and the route of Mr Cauchi across three levels of WBJ. These plans were prepared using CCTV footage from within WBJ. As a result of this process, the plans provide an accurate representation of Mr Cauchi’s movements that day and the location of the victims. These were tendered in the Inquest.
6.17 The plans are replicated below, with pseudonyms applied, commencing with Level 4, the location where Mr Cauchi’s attack began.
PART 6 THE EVENTS OF 13 APRIL 2024 6.18 The plans also depict the location and movements of civilian witnesses, Silas Despreaux, Damien Guerot, and Noel McLaughlin, the husband of Jade Young, as well as Insp Amy Scott following her arrival at WBJ. This is discussed further below.
PART 6 THE EVENTS OF 13 APRIL 2024 Figure 3: Level 4 Floor Plan of WBJ (with pseudonyms)
PART 6 THE EVENTS OF 13 APRIL 2024 Figure 4: Level 3 Floor Plan of WBJ (with pseudonyms)
PART 6 THE EVENTS OF 13 APRIL 2024 Figure 5: Level 5 Floor Plan of WBJ (with pseudonyms)
PART 6 THE EVENTS OF 13 APRIL 2024 Chronology of the attack 6.19 At 3:32:55pm, Mr Cauchi stabbed the first victim, Dawn Singleton, who was standing in line at Sourdough Bakery and Café on Level 4 of WBJ.
6.20 Mr Cauchi began to run and seconds later, at 3:33:01pm, he fatally stabbed Jade Young who was walking with her young daughter in a southerly direction outside Orlebar Brown, not far from the Sourdough Bakery and Café. He then continued to run south along Level 4.
6.21 At 3:33:11pm, Mr Cauchi stabbed another victim (Victim 3) who was standing outside AJE Athletica. Victim 3 had seen Mr Cauchi run towards her and as he approached, he reached across his body and in a stabbing motion put the knife through the left sleeve of her jumper. Mr Cauchi then pointed the knife at her stomach, and she took evasive action, receiving a shallow cut to her stomach. Victim 3 received treatment later that day.
6.22 Mr Cauchi continued to run south, and at 3:33:17pm, fatally stabbed Yixuan Cheng, who was walking in a northerly direction between the Cotton On and Peter Alexander stores.
6.23 Almost immediately after fatally stabbing Yixuan, at 3:33:20pm, Mr Cauchi stabbed Victim 5, who was exiting Cotton On. Victim 5 lost consciousness and ultimately required admission to hospital, undergoing major surgery for her injuries.
6.24 Mr Cauchi continued to run past Cotton On, and at 3:33:23pm, he attempted to stab another male civilian, who dove out of the way, and Mr Cauchi fell to the floor. A bystander, Victim 6, saw the men and then saw Mr Cauchi run towards her, with something held in his right hand which was down by his side.
6.25 A few seconds later, at 3:33:27pm, Mr Cauchi ran past Lululemon and stabbed Victim 6 and at 3:33:29pm, he stabbed Victim 7, who was near Kookai. Victim 6 witnessed this and stated: While [Mr Cauchi] was stabbing this other person, he said in a very monotone voice “I have a knife, I have a knife, I have a knife.” I remember him saying this so clearly. His tone was very strange. It didn’t sound normal.830 6.26 Victim 6 was later transported to hospital where she underwent surgery for her injuries.
Victim 7 left the Centre and attended a nearby medical centre, bleeding heavily. He was seriously injured and later underwent surgery in hospital.
6.27 At 3:33:34pm, Mr Cauchi ran into the nearby Myer store and stabbed Victim 8, who was injured but survived. After exiting Myer, Mr Cauchi ran north back towards the location of the Sourdough Bakery and Café.
830 Exhibit 1, Vol 1, Tab 50, Statement of Victim 6 at [9].
PART 6 THE EVENTS OF 13 APRIL 2024 6.28 At 3:34:00pm, Mr Cauchi moved south towards Ashlee Good, who was pushing her baby daughter in a pram outside AJE Athletica. Mr Cauchi stabbed Ashlee from behind, causing Ashlee to momentarily move away from him and let go of the pram carrying her daughter.
6.29 At 3:34:05pm, Mr Cauchi then stabbed Ashlee’s daughter (Victim 10), who was inside the pram. Ashlee by this stage had turned back towards Mr Cauchi.
6.30 Immediately, and without any hesitation, Ashlee charged towards Mr Cauchi with both arms outstretched and pushed him in the chest and away from her daughter’s pram. It appears that it was at this time that Ashlee received a further stab wound to her chest, and her injuries were ultimately fatal. Ashlee’s daughter was wounded and later had surgery, thankfully surviving her injuries.
6.31 Mr Cauchi continued to move south and jogged back past Sourdough Bakery and Café.
By this stage, security guards Faraz Tahir and Muhammad Taha were approaching the area, having been alerted to the incident.
6.32 Between 3:34:24pm and 3:34:26pm, Mr Cauchi stabbed both men – Faraz was stabbed in the left abdomen, and Mr Taha in the left lower chest. Faraz’s wound was ultimately fatal. Mr Taha was later transported to hospital and survived his injury. Mr Cauchi continued to run across the airbridge near Chanel.
6.33 At 3:34:40pm, Mr Cauchi stabbed Victim 13, who was standing outside the Chanel Fragrance Store, which by that stage had its shutters down. She received a stab wound to her back and later received treatment at hospital.
6.34 At 3:34:46pm, Mr Cauchi stabbed Witness X (Victim 14) outside the Chanel Boutique Store. Witness X states that she had seen Mr Cauchi approaching her from the airbridge and prior to this, had seen several people run past her. Witness X said to Mr Cauchi, “excuse me, why is everyone running,” and he then stabbed her in the chest. Mr Cauchi continued running past Chanel.831 6.35 Seconds later at 3:34:50pm, Mr Cauchi fatally stabbed Pikria Darchia, who was moving along the outside of the Christian Dior store, near the Chanel stores.
6.36 Mr Cauchi proceeded towards YSL in the North-Western corner of Level 4 and then travelled down the escalators to Level 3.
6.37 On Level 3, Mr Cauchi walked past Zimmerman and encountered Liya Barko (Victim 16), who was walking in the opposite direction and stabbed her to her left side at 3:35:40pm.
As she was stabbed, Ms Barko recalls: 831 Exhibit 1, Vol 1, Tab 56, Statement of Witness X at [6].
PART 6 THE EVENTS OF 13 APRIL 2024 I heard a male voice say to me “Catch you”. He said this quickly but in a normal voice and with no other emotion. 832 6.38 Ms Barko was Mr Cauchi’s last victim. She later had surgery for her injuries and survived.833 6.39 Whilst the following section considers the evidence regarding the section 81 findings in relation to the deaths of the six victims who were fatally stabbed, the context in which Mr Cauchi performed the acts he did that day (which bear upon the manner of death of his six victims), has been considered in Part 2.
832 Exhibit 1, Vol 1, Tab 58, Statement of Lyia Barko at [16].
833 Exhibit 1, Vol 1, Tab 58, Statement of Lyia Barko at [23].
PART 6 THE EVENTS OF 13 APRIL 2024 B. Dawn Singleton 6.40 On the afternoon of 13 April 2024, Dawn attended WBJ on her own and parked her car in the WBJ car park.
6.41 Around 3:30pm, Dawn was walking along Level 4 of the Centre, past Dior and towards the airbridge leading to the Sourdough Bakery and Café. Dawn walked past Mr Cauchi, who, at that time, was also walking along Level 4 at a slow pace with his arms crossed across his waist.
6.42 Dawn continued to walk along Level 4 and past security guards Muhammad Taha and Faraz, who were standing together next to a balustrade, talking. Mr Cauchi walked slowly a few metres behind Dawn with his gaze downwards, occasionally looking up.
6.43 Dawn turned left at the Tiffany and Co store and walked over the airbridge whilst looking down at her phone. She stopped in line behind some other customers at the Sourdough Bakery and Café, which is located directly at the other end of the airbridge.
6.44 Mr Cauchi continued to walk in the same direction as Dawn. After Dawn turned left at the airbridge, Mr Cauchi continued to walk straight momentarily, before he appeared to look in Dawn’s direction, walk one or two more steps, and then turn and walk across the airbridge towards Dawn, who was in line at the Sourdough Bakery and Café. Mr Cauchi then stood in line at the cafe directly behind Dawn.
6.45 At 3:32pm, Mr Cauchi took off his backpack and placed it on the floor. Seconds later, Mr Cauchi retrieved a KA-BAR knife from his backpack and at 3:32:55pm stabbed Dawn whilst she faced away from him. Dawn dropped to the floor, and Mr Cauchi leaned over her and stabbed her again.
6.46 After Mr Cauchi stabbed Dawn, he immediately ran from the Sourdough Bakery and Café, and Dawn was assisted by bystanders.
Witness evidence 6.47 At the time Dawn was stabbed, there were several civilians in the area near Sourdough Bakery and Café who provided her with immediate aid.
6.48 Nathan Hunt and his partner Megumi Kitamoto were waiting for a coffee order at Sourdough Bakery and Café at the time Dawn was attacked and immediately ran to assist her, helping her to lie down. They found a cloth from behind the counter in the café and used it to apply pressure to Dawn’s wounds, placing her into the recovery position to keep her airway clear.
6.49 Zubair Ahmed was shopping inside a nearby store and heard screams outside. He went out to investigate and saw Dawn, severely injured; he then tried to assist Mr Hunt and Ms Kitamoto in providing aid to Dawn until further assistance arrived.
PART 6 THE EVENTS OF 13 APRIL 2024 6.50 Michael Burke, who was at WBJ with his family, was on Level 4 not far from the cafe at the time Mr Cauchi commenced his attack. He saw Dawn, critically unwell, and being assisted by Mr Hunt and Ms Kitamoto. He located a chair with metal legs and stood near the group providing first aid to Dawn and said, “I will fight him off for you guys if he comes back.” 6.51 NSWPF officers attended to Dawn and commenced further first aid around 3:41pm, including applying direct pressure to her wounds. It was identified that Dawn was unresponsive and was not breathing, and officers commenced CPR until the arrival and handover to NSWA officers around 3:55pm. Paramedics examined Dawn and opened her airway. Sadly, Dawn was unable to be revived and was declared deceased a short time later.
6.52 A limited post mortem examination of Dawn was conducted on 15 April 2024, with her cause of death identified as “Stab wound(s)” (to the right chest, back and right upper arm).
Section 81 findings 6.53 As a result of considering all of the documentary evidence and the oral evidence given at the inquest, the findings I make under section 81(1) of the Act are: The identity of the deceased The person who died was Dawn Grace Singleton Date of death Dawn died on 13 April 2024 Place of death Dawn died at Level 4, Westfield Bondi Junction, 500 Oxford Street, Bondi Junction, NSW 2022 Cause of death Dawn died as a result of stab wounds Manner of death Dawn died as a result of injuries inflicted by Joel Cauchi, who attacked her with a knife while suffering a psychotic relapse of his chronic schizophrenia
PART 6 THE EVENTS OF 13 APRIL 2024 C. Jade Young 6.54 On the afternoon of 13 April 2024, Jade and her daughter had attended WBJ together.
Just after 3:33pm, while Mr Cauchi was in line behind Dawn, they walked across the airbridge and past the Sourdough Bakery and Café, continuing south past RM Williams.
6.55 At 3:33:01pm, in a quick movement, Mr Cauchi stabbed Jade once to the left side of her body, the force causing her to fall to the ground. Mr Cauchi did not say anything, and after stabbing Jade, he kept running past.
6.56 Jade’s husband, Noel McLaughlin, was inside the Centre and had just parked his car when he received a phone call from his daughter on Jade’s phone. She told him what had happened, and he ran to Level 4 of the Centre. Whilst on his way to assist his wife, Mr McLaughlin encountered Mr Cauchi on Level 3 of WBJ. This is referred to further below.
Witness evidence 6.57 Mr McLaughlin arrived on Level 4 and found Jade lying down outside the RM Williams store. He called Triple 0 but did not speak to anyone.
6.58 Mirko Nuotatore was downstairs on Level 3 and heard someone yelling “help, help”. Mr Nuotatore made his way up to Level 4, along with his friend, and saw Jade on the ground with Mr McLaughlin tending to her. Jade was unresponsive and Mr Nuotatore and Mr McLaughlin commenced CPR on Jade. They tried to control the bleeding and rotated CPR, continuing until further help arrived.
6.59 NSWPF officers attended to assist around 3:40pm and continued to apply direct pressure to Jade’s wound and assisted with CPR.
6.60 By 3:48pm, NSWA paramedics were with Jade, who remained unresponsive. By this stage, a defibrillator had been sourced from within WBJ. Paramedics performed an assessment of Jade and commenced further procedures with no response, and Jade was subsequently declared deceased.
6.61 A limited post mortem examination of Jade was conducted on 15 April 2024, with the cause of death identified as “Stab wound to back penetrating the chest.”
PART 6 THE EVENTS OF 13 APRIL 2024 Section 81 findings 6.62 As a result of considering all of the documentary evidence and the oral evidence given at the inquest, the findings I make under section 81(1) of the Act are: The identity of the deceased The person who died was Jade Andrea Young Date of death Jade died on 13 April 2024 Place of death Jade died at Level 4, Westfield Bondi Junction, 500 Oxford Street, Bondi Junction, NSW 2022 Cause of death Jade died as a result of a stab wound to the back penetrating the chest Manner of death Jade died as a result of injuries inflicted by Joel Cauchi, who attacked her with a knife while suffering a psychotic relapse of his chronic schizophrenia
PART 6 THE EVENTS OF 13 APRIL 2024 D. Yixuan Cheng 6.63 On 13 April, Yixuan had just finished a university exam and decided to go shopping at WBJ. Between 2:30pm and 3:30pm, Yixuan attended the Chanel Store at WBJ, where she tried on bags inside the store, sending two photographs to her fiancé in China via social media.
6.64 At 3:33:18pm, Yixuan was walking past Peter Alexander as Mr Cauchi was running along Level 4. Mr Cauchi approached her at pace, front on, and stabbed Yixuan in the chest with force, causing her to fall backwards.
Witness evidence 6.65 Julie Flaherty, a patron at WBJ, was assisting Victim 5 outside of the Cotton On store, when she looked around and saw another female, Yixuan, in a pool of blood outside of Peter Alexander. Ms Flaherty said, “[h]as anyone seen to the lady over there?” and a man said, “[w]e’ve been there, we need to work on this one”. They continued assisting Victim 5.
6.66 Andrew Flaherty recalls noticing Yixuan on the ground with a pool of blood around her head, that she was not moving, and she looked blue. He says he saw a man check her pulse for about 15 – 20 seconds before signalling that Yixuan was deceased.
6.67 Andrew Reid, an off-duty lifeguard, was shopping at WBJ and rendered aid to several victims. Mr Reid saw Yixuan on the floor being tended to by NSWPF officers. He observed that she had a large wound towards the top of her chest, about 10cm in diameter, which was bleeding. Mr Reid assisted with CPR, which was further continued by NSWPF officers who attended upon Yixuan around 3:40pm.
6.68 By 3:54pm, NSWA officers had attended and assessed that Yixuan was deceased. She had tragically sustained unsurvivable injuries, which would have rapidly proved fatal.
6.69 A limited post mortem examination of Yixuan was conducted on 15 April 2024, with the cause of death identified as a “Stab wound to central chest structures.”
PART 6 THE EVENTS OF 13 APRIL 2024 Section 81 findings 6.70 As a result of considering all of the documentary evidence and the oral evidence given at the inquest, the findings I make under section 81(1) of the Act are: The identity of the deceased The person who died was Yixuan Cheng Date of death Yixuan died on 13 April 2024 Place of death Yixuan died at Level 4, Westfield Bondi Junction, 500 Oxford Street, Bondi Junction, NSW 2022 Cause of death Yixuan died as a result of a stab wound to the central chest structures Manner of death Yixuan died as a result of injuries inflicted by Joel Cauchi, who attacked her with a knife while suffering a psychotic relapse of his chronic schizophrenia
PART 6 THE EVENTS OF 13 APRIL 2024 E. Ashlee Good 6.71 On 13 April 2024, Ashlee was at WBJ shopping with her baby daughter.
6.72 Between 3:32:39pm and 3:32:43pm, Ashlee was walking south across the Level 5 airbridge, directly above the location of the Sourdough Bakery and Café. By this stage, Mr Cauchi was standing in line behind Dawn, with his attack commencing at 3:32:55pm as outlined above.
6.73 Between 3:32:43pm and 3:33:13pm, Ashlee traversed Level 5 of WBJ, walking on the western side of the level before turning into a corridor leading to the lifts.
6.74 Ashlee took the lift from Level 5, arriving on Level 4 at 3:33:41pm, where she exited the lift and walked east towards the Level 4 western side walkway, where she turned right and continued walking south.
6.75 At 3:34pm, only seconds after she had exited the lift, Ashlee was walking south along the western side walkway of Level 4 pushing her daughter in the pram. Mr Cauchi was running on the eastern side of the walkway towards the Sourdough Bakery and Café; he doubled back and approached Ashlee from behind and stabbed her outside of AJE Athletica.
6.76 Ashlee attempted to move away from Mr Cauchi and leapt to the side and in doing so let go of the pram. Mr Cauchi quickly lunged towards the pram and stabbed downwards into the pram in rapid succession. Ashlee by this stage had turned back towards Mr Cauchi.
6.77 As outlined above, immediately, and without any hesitation, Ashlee charged towards Mr Cauchi with both arms outstretched and pushed him in the chest and away from the pram. Mr Cauchi then stabbed Ashlee again in the chest with his right hand before he turned away and ran towards the café.
Witness evidence 6.78 Ashlee’s stabbing was witnessed by Paul Robinson, who then shouted at Ashlee to come into the Tommy Hilfiger store. Ashlee entered the store and handed over her daughter before collapsing.
6.79 At 3:34pm, Joe Tomarchio, who was also inside Tommy Hilfiger, called Triple 0. Whilst on the phone, Mr Tomarchio saw that Ashlee was becoming more unwell.
6.80 Mary Farrell, a patron at WBJ, saw Ashlee walk towards the Tommy Hilfiger shop with the help of some men. She was holding her chest. Initially, there was not much blood visible.
6.81 Ms Farrell placed T-shirts on Ashlee’s chest and kept pressure on until assistance arrived for both Ashlee and her baby daughter, who was cared for by customers inside the store (and in particular Joe and Ricardo Tomarchio).
PART 6 THE EVENTS OF 13 APRIL 2024 6.82 By 3:42pm, NSWPF officers had entered Tommy Hilfiger and assisted in applying direct pressure to Ashlee’s apparent wound on her chest area, although it appears officers did not identify that she also had a stab wound on her back and shoulder.
6.83 Ashlee’s mother-in-law, Maree, was inside the Centre and quickly made her way to Ashlee to comfort her and was with her until her extrication from the centre by paramedics. Maree accompanied paramedics as Ashlee’s daughter was taken down to the street and placed into an ambulance.
6.84 NSWA deemed Ashlee to be in a critical state and deteriorating. They evacuated her swiftly from WBJ and transported her to St Vincent’s Hospital, the closest major trauma hospital, leaving around 3:54pm.
6.85 Upon arrival at St Vincent’s at 4:04pm, the surgical team undertook emergency surgery.
Despite their efforts, Ashlee was declared deceased at 4.29pm.
6.86 A limited post mortem examination of Ashlee conducted on 15 April 2024 determined that the cause of death was “Stab wound(s)” (to the right upper back, right shoulder and upper arm, and to the chest).
Section 81 findings 6.87 As a result of considering all of the documentary evidence and the oral evidence given at the inquest, the findings I make under section 81(1) of the Act are: The identity of the deceased The person who died was Ashlee Kate Good Date of death Ashlee died on 13 April 2024 Place of death Ashlee died at St Vincent’s Hospital, 390 Victoria Street, Darlinghurst, NSW 2010 Cause of death Ashlee died as a result of stab wounds Manner of death Ashlee died as a result of injuries inflicted by Joel Cauchi, who attacked her with a knife while suffering a psychotic relapse of his chronic schizophrenia
PART 6 THE EVENTS OF 13 APRIL 2024 F. Faraz Tahir 6.88 On 13 April 2024, Faraz was working as part of the security team at WBJ. It was his first shift at WBJ. Faraz was proud of his new job as a security guard.
6.89 Just prior to the stabbing of Dawn, Faraz and his colleague, Muhammad Taha, were standing between Gucci and David Jones on Level 4 of WBJ.
6.90 As outlined later in these findings, security staff within WBJ, including Faraz and Mr Taha, were alerted to a “code black” incident in the Centre following the stabbing of Dawn. As a result of this alert, Faraz and Mr Taha responded to the Sourdough Bakery and Café. As the pair approached the area, Mr Taha saw two people laying on the floor next to the café, being Dawn and Jade.
6.91 As Faraz and Mr Taha walked towards Sourdough Bakery and Café, Mr Cauchi arrived on the air bridge. Faraz was around two metres ahead of Mr Taha when he was stabbed in the stomach by Mr Cauchi. A second later, Mr Taha was also stabbed by Mr Cauchi.
6.92 Mr Taha could see that Faraz was bleeding from his stomach and appeared badly injured and pale. Mr Taha made a call over the radio that he had been stabbed and gave his location. He also called two other security colleagues by phone to tell them he had been stabbed, as he and Faraz awaited further assistance.
Witness evidence 6.93 Another security guard, Muhammad Fahad, responded to Mr Taha’s radio message. He saw Faraz lying on the ground close to where Mr Taha was sitting. Faraz was covered in blood. He was breathing and was alive, however appeared unconscious.
6.94 An off duty intensive care nurse, Catherine Moulihan, was at WBJ that day, and went to assist Faraz and Mr Taha, applying pressure to their wounds and assisting police until paramedics arrived. Ms Moulihan had left the safety of a nearby store to go outside and help others, including Faraz, and in doing so, showed incredible bravery. Ms Moulihan provided comfort to Faraz until further help arrived.
6.95 Another bystander, Paul Robinson, also assisted Faraz and applied pressure to his wounds prior to the arrival of police and paramedics, helping to flag them down and staying close while they rendered aid to Faraz.
6.96 NSWPF officers who attended to Faraz by 3:41pm placed direct pressure on his wound.
He was moved out into space to assist with rendering aid, with police ensuring his airway was clear and placing him into the recovery position.
6.97 Paramedics attended upon Faraz around 3:56pm and conducted an initial assessment and commenced treatment, inserting an intraosseous needle into his leg and supporting his airway.
PART 6 THE EVENTS OF 13 APRIL 2024 6.98 Faraz was placed on a stretcher and extricated from WBJ around 4:07pm and down to Level 3 (ground level), where further NSWA crews were waiting. Not long after this, Faraz went into cardiac arrest, in the presence of an NSWA medical team, including Dr Ruby Hsu, who then performed surgery on Faraz to try to save his life.
6.99 The medical team provided further extensive treatment to Faraz; sadly, their efforts were unsuccessful and Faraz was declared deceased at 4:24pm.
6.100 A limited post mortem examination of Faraz conducted on 15 April 2024 determined that the cause of death was “Stab wound to the abdomen.” Section 81 findings 6.101 As a result of considering all of the documentary evidence and the oral evidence given at the inquest, the findings I make under section 81(1) of the Act are: The identity of the deceased The person who died was Faraz Ahmad Tahir Date of death Faraz died on 13 April 2024 Place of death Faraz died at Level 3, Westfield Bondi Junction, 500 Oxford Street, Bondi Junction, NSW 2022 Cause of death Faraz died as a result of a stab wound to the abdomen Manner of death Faraz died as a result of injuries inflicted by Joel Cauchi, who attacked him with a knife while suffering a psychotic relapse of his chronic schizophrenia
PART 6 THE EVENTS OF 13 APRIL 2024 G. Pikria Darchia 6.102 At the time Dawn was attacked at 3:32:55pm in front of the Sourdough Bakery and Café, Pikria was seated nearby at one of the café tables. At this time, there were around 40 to 50 people either seated, standing, or walking across the WBJ Level 4 airbridge.
6.103 CCTV footage captured Pikria’s movements from this point. Pikria was the final victim to sustain fatal injuries, and there is a more detailed consideration of her movements in Part 7.
6.104 At 3:34:46pm, Mr Cauchi attacked Victim 14, Witness X, outside the Chanel store on Level 4.
6.105 At around 3:34:50pm, Pikria was moving along the outside of the Christian Dior store, near the Chanel stores, when she was attacked by Mr Cauchi.
6.106 Mr Cauchi approached Pikria from behind and used his right arm to make a slashing motion with the knife across her back. He grabbed the right side of Pikria’s shirt with his left hand and stabbed her with his right hand with force.
6.107 After the attack, Pikria made her way to the Chanel Boutique Store and then collapsed onto the floor.
Witness evidence 6.108 A security officer inside Chanel saw Pikria; she was struggling to breathe and looked critically unwell. Witness X was also inside Chanel at this time.
6.109 Sgt 1834 entered Chanel and assessed Pikria, commencing CPR at 3:51:06pm and continuing until there was a radio broadcast alerting police officers to the possibility of a second offender.
6.110 Further police attended and continued CPR on Pikria before ambulance officers arrived at 4:00:58pm. Pikria was pronounced deceased a short time later. Sadly, Pikria’s injuries were unsurvivable, and she declined rapidly after entering Chanel.
6.111 A limited post mortem examination of Pikria on 15 April 2024 determined that her cause of death was “Stab wound(s)” (in the right upper arm and right side of the chest).
834 Sgt 1 is a pseudonym and this officer’s name is subject to a Non-Publication Order dated 28 May 2025.
PART 6 THE EVENTS OF 13 APRIL 2024 Section 81 findings 6.112 As a result of considering all of the documentary evidence and the oral evidence given at the inquest, the findings I make under section 81(1) of the Act are: The identity of the deceased The person who died was Pikria Darchia Date of death Pikria died on 13 April 2024 Place of death Pikria died at Level 4, Westfield Bondi Junction, 500 Oxford Street, Bondi Junction, NSW 2022 Cause of death Pikria died as a result of stab wounds Manner of death Pikria died as a result of injuries inflicted by Joel Cauchi, who attacked her with a knife while suffering a psychotic relapse of his chronic schizophrenia
PART 6 THE EVENTS OF 13 APRIL 2024 H. The movements of Mr Cauchi prior to the arrival of
NSWPF 6.113 By the time Mr Cauchi had stabbed his final victim at 3:35:40pm, a NSWPF Computer Aided Dispatch (CAD) job,835 had been created, merged from the multiple CAD jobs arising from numerous calls made to emergency services regarding the incident occurring at WBJ. Many emergency service resources from both NSWPF and NSWA made their way to WBJ.
Chronology of events Mr Cauchi’s interaction with Noel McLaughlin 6.114 At 3:35:49pm, as Mr McLaughlin was making his way to assist his wife, Jade, on Level 4, he saw Mr Cauchi with the knife in his hand, moving along Level 3. As Mr Cauchi moved closer, Mr McLaughlin shouted at him to warn other nearby shoppers, saying repeatedly, “he has a knife”, causing people in the area to move back.836 Mr Cauchi was less than a metre away from Mr McLaughlin when he lifted the knife from his waist and started to point it at him.
6.115 Mr McLaughlin saw that Mr Cauchi seemed uncomfortable holding the knife and did not say anything. Mr McLaughlin said, “what are you doing?”.837 Mr McLaughlin realised that he had nothing to defend himself with, that he could be stabbed as well, and that he needed to get to his wife. Mr McLaughlin turned and ran in the direction of the RM Williams shop.
6.116 Mr Cauchi continued along Level 3 and then began to make his way up to Level 4 via an escalator located near Woolworths.
The actions of Silas Despreaux and Damien Guerot 6.117 Silas Despreaux and Damien Guerot, who had attended WBJ that afternoon together, entered on ground level and observed a group of people running down an escalator from the level above. Mr Despreaux heard someone say, “[t]here is a man stabbing people”.838 He then decided, along with Mr Guerot, to locate Mr Cauchi.
6.118 When Mr Despreaux and Mr Guerot saw Mr Cauchi for the first time, they ran back to find something to protect themselves with, locating some metal bollards nearby. Mr Despreaux and Mr Guerot then followed Mr Cauchi, and knowing that he was moving towards Woolworths, ran to the escalator that was going down to that area. Mr Despreaux recalled “many people” going down the escalator so he said to them, “come 835 The Computer Aided Dispatch (CAD) is an online system used by police radio (VKG) to prioritise the deployment of police resources to an incident.
836 Exhibit 1, Vol 1, Tab 35, Statement of Noel McLaughlin at [18].
837 Exhibit 1, Vol 1, Tab 35, Statement of Noel McLaughlin at [19].
838 Exhibit 1, Vol 14, Tab 745, Statement of Silas Despreaux at [6].
PART 6 THE EVENTS OF 13 APRIL 2024 up, come up, don’t go down” and that as he and Mr Guerot came to the escalator, Mr Cauchi was coming up.839 6.119 At 3:36:09pm, as Mr Cauchi continued up the escalator, Mr Guerot and Mr Despreaux took position at the top of the escalators, having armed themselves with the bollards.
6.120 At 3:36:12pm, Mr Despreaux threw the bollard he was holding at Mr Cauchi, hitting his leg. Some seconds later, at 3:36:25pm, Mr Guerot also threw the bollard he was holding at Mr Cauchi, hitting his arm, although Mr Cauchi did not appear affected. Both Mr Despreaux and Mr Guerot retreated and ran from the Centre onto Oxford Street.
6.121 Mr Cauchi continued up to Level 4 and walked along the level towards Zara where he remained from around 3:36:46pm in the area at the bottom of the escalator.
6.122 Almost simultaneously, at 3:37:15pm, NSWPF officer, Insp Amy Scott arrived on scene via the Level 4 entrance from Oxford Street near Zara. Mr Cauchi had begun to make his way up the escalator to Level 5.
839 Transcript, D2 (Despreaux/Guerot): T114.45-50 (29 April 2024).
PART 6 THE EVENTS OF 13 APRIL 2024 I. The arrival of NSWPF and the fatal shooting of Joel Cauchi Introduction 6.123 As outlined above, there is clear and detailed evidence of Mr Cauchi’s movements on 13 April 2024 as a result of the extensive review of CCTV undertaken by DCI Marks and his team.
6.124 Available CCTV footage from 13 April 2024 therefore captured in full the arrival of Insp Scott and her actions, culminating in the fatal shooting of Mr Cauchi just after 3:38pm that day. In addition to the CCTV footage itself, a 3D reconstruction was also prepared by NSWPF Forensic Imaging and formed part of the brief of evidence tendered at Inquest.
6.125 Issue 10 of the Issues List was the circumstances in which Insp Scott discharged her firearm, and whether such use of force was justified, reasonable and appropriate.
6.126 Whilst Insp Scott’s actions form one part of the broader NSWPF response to the events of 13 April 2024, given the mandatory nature of this Inquest and the circumstances that arose on 13 April 2024, this section specifically considers Insp Scott’s actions and her use of force in discharging her firearm that day.
6.127 The broader response of the NSWPF is considered further at Part 8.
Inspector Amy Scott 6.128 Insp Scott is an experienced officer of the NSWPF and has been awarded and commended numerous times in her career, including receiving a Commissioner's Unit Citation for the Lindt Café Siege in February 2023, a highly commended award for outstanding female investigator from the Australian Council for Women in Policing in 2021, and the Police Officer of the Year Award (Kings Cross LAC) in 2020.
6.129 At the time of the incident at WBJ on 13 April 2024, Insp Scott was up to date with her training, having successfully completed the 2022-2023 Mandatory Training Weapons Course on 7 March 2024, which included training in the use of her firearm. Insp Scott was booked to complete her 2023-2024 Mandatory Training Weapons Course on 22 May 2024.
6.130 On 13 April 2024, Insp Scott, who was attached to Eastern Suburbs Police Area Command (Eastern Suburbs PAC), was rostered as a Duty Officer and was assigned to a marked police vehicle with call sign Eastern Suburbs 10 (ES10).
6.131 Insp Scott commenced her shift that morning at 6:00am as the Duty Officer. She had certain police appointments, namely a NSWPF-issued firearm (Glock), handcuffs,
PART 6 THE EVENTS OF 13 APRIL 2024 baton, OC spray, radio, a Leatherman tool, and a body-worn camera. Insp Scott was not carrying a taser because she had not received training on “Taser 7”, the current model issued to NSWPF officers (with the training a requirement to carry the equipment).
Chronology of events 6.132 Around 3:00pm on the afternoon of 13 April 2024, Insp Scott was en route from Bondi Police Station, where she had been conducting station checks, to an address in the vicinity of WBJ.
6.133 Around 3:35pm, whilst driving along Bondi Road, Insp Scott heard a “double beeper,” a Priority 2 urgent job, broadcast for Eastern Suburbs cars. A “double beeper” refers to the recognisable “beep beep” of the radio, drawing the attention of police to a job about to be broadcast as requiring an urgent response.
6.134 Insp Scott pulled her vehicle over anticipating the priority broadcast, knowing that most of her staff were tied up, and that she might be the first officer in a position to respond to the job. Insp Scott recalled hearing the radio operator saying that there were “…multiple calls, multiple stabbings, multiple locations at [WBJ]” and she “…knew right then that it was very real.”840 6.135 Insp Scott acknowledged the job on the police radio and proceeded in her marked police car under lights and sirens to WBJ. Whilst en route, Insp Scott directed other responding police, via police radio, to meet her at Oxford Street.
6.136 At 3:37:15pm, Insp Scott arrived at the corner of Oxford Street and Adelaide Street. This was just over four minutes since the start of Mr Cauchi’s attack. Insp Scott recalled in her evidence: So as I turned the corner into Oxford Street, there were people pouring out of that exit, and on the road and waving me down to the point where I couldn’t ignore it so I stopped.
As I got out of the vehicle, people started saying to me “There’s a guy in there with a knife.
They’re stabbing people. He’s killing people. You’ve got to help us. Please get in there.841 6.137 Civilians Damien Guerot and Silas Despreaux, who had earlier confronted Mr Cauchi, had run onto the street on the corner of Oxford Street and Adelaide Street and saw Insp Scott pull up.
6.138 They walked with Insp Scott as she entered WBJ and directed her towards the location where they had last seen Mr Cauchi. Mr Guerot explained in oral evidence that he was giving Insp Scott instructions that “…someone is stabbing people. It’s very dangerous [and]…she had to be ready.”842 840 Transcript, D2 (Scott): T81.5-14 (29 April 2025).
841 Transcript, D2 (Scott): T82.40-45 (29 April 2025), 842 Transcript, D2 (Guerot):T121.44 (29 April 2025).
PART 6 THE EVENTS OF 13 APRIL 2024 6.139 Mr Guerot and Mr Despreaux directed Insp Scott to the escalators to her right near Zara, saying “…that they saw [the] guy with a knife go up the escalators.” In oral evidence, Insp Scott stated: So I went in, turned right and it sort of wraps like a really hard U-turn almost off to the right, and then it was at that stage that I unclipped my service firearm because I was concerned that I would meet somebody with a weapon, and I also wasn't sure how many people there were, just by the distance and the amount of victims that there were obviously. So we started to proceed up the escalators.843 6.140 At this time, Insp Scott did not know how many offenders might be involved and thought there could be more than one. Given the information from civilian bystanders, Insp Scott considered the situation to involve an AAO. She formed the view that she could not wait for her colleagues to arrive and had to go into the Centre to “try and find the threat”.844 The significance of Insp Scott’s immediate identification of the incident as involving an AAO is considered further below in Part 8.
6.141 At 3:37:21pm, CCTV footage captured Insp Scott’s entry into the Centre, where she was approached by Mr Despreaux and Mr Guerot. At this time Mr Cauchi was on the level above (Level 5). Insp Scott went up the escalator from Level 4 to Level 5 and as she reached the top, she heard screaming to her right, and someone behind her said “[o]ver there”; she turned and started to jog slightly: I saw Joel for the first time. His back was to me. It was very evident that he was the person, just by the size of the knife he was holding. And I yelled out something along the lines of, “Stop”. He turned, looked in my direction and ran.845 6.142 When Insp Scott first saw Mr Cauchi, he was around 15 to 20 metres away from her and as Mr Cauchi started running, Insp Scott gave chase, notifying police radio that she was in foot pursuit and naming stores she could see to give an indication of where she was.
6.143 Insp Scott did not draw her firearm immediately, as she recognised the potential for a “sympathetic body response” and was conscious of the many civilians inside WBJ. Insp Scott kept the firearm holstered and had her hand on it, holding it in place as she ran after Mr Cauchi.
6.144 Insp Scott ran along Level 5 and then left towards an airbridge located near Eckersley’s Art & Craft Store (Eckersley’s), where Mr Cauchi paused “…as if he was going to stab some shopkeepers outside…” but continued moving before stopping suddenly around 10 metres beyond the shop.846 At this time, Insp Scott was around 15 metres away from Mr Cauchi.
6.145 Mr Despreaux and Mr Guerot accompanied Insp Scott, running behind her as she pursued Mr Cauchi on foot. Mr Despreaux had grabbed a plastic shopping cart from 843 Transcript, D2 (Scott): T83.47-T84.2 (29 April 2025).
844 Transcript, D2 (Scott): T84.28-34 (29 April 2025).
845 Transcript, D2 (Scott): T86.27-30 (29 April 2025).
846 Transcript, D2 (Scott): T88.8-12 (29 April 2025).
PART 6 THE EVENTS OF 13 APRIL 2024 within the Centre and brought this with him as he continued with Insp Scott in pursuit of Mr Cauchi. Mr Guerot picked up a chair as he was running with the group.
6.146 Insp Scott was conscious of nearby civilians and began to usher those in her vicinity back behind her and into nearby shops. She observed a lady with a pram ahead of her, further along the footbridge and indicated with her hand for the lady to move, which she did.847 6.147 Insp Scott yelled out “mate!” to get Mr Cauchi’s attention, which caused him to turn and face her. As she was trying to turn on her body worn video (BWV), Mr Cauchi “… just sprinted downhill at me with the knife out.”848 6.148 It was at 3:38:34pm that Mr Cauchi ran towards Insp Scott, holding the knife.
6.149 At 3:38:40pm, in response to Mr Cauchi running towards her, Insp Scott retreated backwards and drew her firearm, discharging three rounds, two of which struck Mr Cauchi, fatally wounding him, and he fell to the ground. At the time Mr Cauchi began running at Insp Scott, to when she shot him whilst also retreating backwards, the distance between them was around six metres.
6.150 In oral evidence, Insp Scott stated, “I knew my first shot had hit him, but – that was because of the jolt of his body, but he continued to come towards me… [I] fired two further shots because I had not been able to stop the threat with the first one.”849 6.151 When asked what was going through her mind at this time, Insp Scott replied: “That [Mr Cauchi] was going to kill me”.850 6.152 After shooting Mr Cauchi, Insp Scott made a broadcast on police radio at 3:39:40pm:
YEAH RADIO - SHOTS FIRED - I HAVE 1 MALE DOWN - I NEED AMBOS - HE IS ABOUT 50 YEARS OLD - RADIO I AM OUTSIDE PRICELINE.851 6.153 The CCTV footage demonstrates that the point at which Mr Cauchi fell to the ground was where Insp Scott had initially been standing. Had she not backed up, he would have landed on top of her.852 6.154 Mr Cauchi was shot one minute and 25 seconds after Insp Scott entered WBJ; she had covered 166 metres during that period.
6.155 Having provided an update to police radio regarding her location, Insp Scott, mindful as to whether there may be other offenders, did not immediately start CPR on Mr Cauchi.853 847 Transcript, D2 (Scott): T88.30-89.1 (29 April 2025).
848 Transcript, D2 (Scott): T89.2-5 (29 April 2025).
849 Transcript, D2 (Scott): T90.39-42 (29 April 2025).
850 Transcript, D2 (Scott): T90.33-35 (29 April 2025).
851 Exhibit 1, Vol 9, Tab 521A, CAD Police Radio Transcript 264181-13042024 (Informant Rachael Auteri) at p. 2.
852 Transcript, D2 (Scott): T91.11-20 (29 April 2025).
853 Exhibit 1, Vol 14, Tab 736, Transcript of Electronic Interview with Insp Amy Scott at Q.228.
PART 6 THE EVENTS OF 13 APRIL 2024 6.156 A short time later, at 3:40:48pm, two further police officers, Senior Constable Robert Fricki (S/Cst Fricki) and Constable Rajit Singh (Cst Singh), who were rostered on together using callsign CLM 722, arrived at WBJ.
6.157 At 3:41:25pm S/Cst Fricki and Cst Singh made their way to Insp Scott’s location. S/Cst Fricki commenced CPR on Mr Cauchi at 3:42:00pm (which continued until around 3:54pm). NSWA paramedics subsequently attended Level 5 and assessed Mr Cauchi. At 3:59pm, he was formally declared deceased.
Witness evidence 6.158 In considering the circumstances in which Insp Scott discharged her firearm and whether her use of force was justified, reasonable and appropriate, the Court was assisted by evidence from Senior Sergeant William Watt of the NSWPF (S/Sgt Watt).
6.159 S/Sgt Watt is the Coordinator of Operational Safety Training & Governance (OSTG) within the Educational and Operational Safety Command of NSWPF. The OSTG is the Command within the NSWPF which oversees the delivery and development of training for non-specialist units, including mandatory annual training completed by police officers. S/Sgt Watt attested from the NSWPF Academy in May 2000 and has over 20 years’ experience as an Operational Safety Instructor (OSI).
6.160 S/Sgt Watt provided two statements to assist the Inquest. The first statement, dated 12 August 2024, outlined S/Sgt Watt’s opinion regarding the actions of police, including Insp Scott on 13 April 2024, following a request made by SCII, DCI Andrew Marks.
6.161 To undertake this task, S/Sgt Watt reviewed available evidence, including statements of police and other witnesses who were present on 13 April 2024, in conjunction with BWV of attending officers and CCTV footage from within WBJ including from relevant stores inside the Centre.
6.162 S/Sgt Watt’s second statement, dated 23 April 2025, provided further evidence regarding training provided to NSWPF officers responding to AAO incidents and mass casualty incidents, considered in further detail in Part 8.
6.163 S/Sgt Watt also gave evidence at the Inquest on 26 May 2025.
Use of force by NSWPF officers 6.164 S/Sgt Watt outlined the philosophical policing approach regarding the use of force including that the use of force by police should be in accordance with the Australia New Zealand Policing Advisory Agency (ANZPAA) Use of Force Guiding Principles:
PART 6 THE EVENTS OF 13 APRIL 2024 Police should only use force that is reasonable, necessary, proportionate and appropriate to the circumstances. Police should use no more force than is reasonably necessary for the safe and effective performance of their duties.854 6.165 In NSW, police are governed by section 230 of the Law Enforcement Powers and Responsibilities Act 2002 (NSW) (LEPRA). That provision states: 230 Use of force generally by police officers It is lawful for a police officer exercising a function under this Act of any other Act or law in relation to an individual or a thing, and anyone helping the police officer, to use such force as is reasonably necessary to exercise the function.
NSWPF Tactical Options Model and STOPAR 6.166 The NSWPF operates within a tactical options model framework, that is: The use of force in any situation is based upon the officers' assessment of the level of resistance met, weighed against the appropriate level of force or response required to control the situation confronting them. 855 6.167 The NSWPF Tactical Options Model856 provides guidance to NSWPF officers regarding the appropriate use of force in conjunction with the Use of Force Concepts. S/Sgt Watt explained: When considering the use of force, an officer’s ultimate goal is control. If control is not gained during any confrontation, the propensity for injury to the officer, subject or member of the public escalates. In a confrontational situation the officer needs an advantage to gain control, however the force used must always be reasonable.857 854 Exhibit 1, Vol 14, Tab 764, Statement of Senior Sergeant William Watt at [7].
855 Exhibit 1, Vol 14, Tab 764, Statement of Senior Sergeant William Watt at [10].
856 Exhibit 1, Vol 14, Tab 764, Statement of Senior Sergeant William Watt, Annexure A, NSWPF Tactical Options Model at p. 37.
857 Exhibit 1, Vol 14, Tab 764, Statement of Senior Sergeant William Watt at [16].
PART 6 THE EVENTS OF 13 APRIL 2024 Figure 6: NSWPF Tactical Options Model 6.168 In conjunction with the Tactical Operations Model and use of force concepts, a critical thinking model, “STOPAR,” was also introduced as a mandatory training module from January 2015 to assist all sworn police officers when attending incidents. Training in STOPAR is also provided to recruits at the NSWPF Academy.
6.169 The STOPAR model: … reinforces the dynamic nature of the decision-making process…. [with] the aim of the model… to reiterate the importance of an officer [refocussing] their mind on the immediate situation at hand, and, in so doing, thereafter giving it the correct appreciation in all aspects.858 858 Exhibit 1, Vol 14, Tab 764, Statement of Senior Sergeant William Watt at [13]. See also, Exhibit 1, Vol 14, Tab 764, Statement of Senior Sergeant William Watt, Annexure B, NSWPF STOPAR Model at p. 38.
PART 6 THE EVENTS OF 13 APRIL 2024 Figure 7: NSWPF STOPAR Insp Scott’s use of her firearm 6.170 In relation to use of a firearm, the Tactical Options Model states: … Firearms are only discharged when there is no other reasonable course of action available. The use of the firearm occurs when there is an immediate risk to the officer's life or the life of someone else, or there is an immediate risk of serious injury to the officer or someone else, and there is no other way of preventing that risk.859 6.171 The Tactical Options Model also includes “Active Armed Offender Tactics,” further considered in Part 8 below.
Evidence of S/Sgt William Watt 6.172 S/Sgt Watt was asked to consider the use of force by Insp Scott, in particular the use of her firearm, stating: … police are trained that the discharge of their firearm should only occur when there is an immediate risk to their life, or the live of someone else, and there is no other way to 859 Exhibit 1, Vol 14, Tab 764, Statement of Senior Sergeant William Watt at 11.
PART 6 THE EVENTS OF 13 APRIL 2024 prevent the risk. When the offender ran at Inspector SCOTT, she believed “that he was about to stab me” and “that I was going to die”. Based on the information she had received from the public about the offender’s actions, coupled with training she has received regarding the potential for the significant injuries that can be caused by a knife, it is impossible to disagree with her subjective assessment of the situation. Objectively, it is clear that the offender was willing to kill or injure people, and his decision to run at Inspector SCOTT whilst armed can only be interpreted as an intention to stab her.
Inspector SCOTT’s decision to discharge her firearm is entirely consistent with training and policy.860 6.173 S/Sgt Watt in particular considered aspects of Insp Scott’s actions: … From a technical perspective, there [were] a number of other aspects that nobody bar an instructor is likely to key on [and Insp Scott’s] situational awareness particularly about risk when she’s discharging her firearm is well beyond most police that I’ve ever seen, given the circumstances that was confronting her. She’s made decisions which didn’t necessarily increase her risk, but she's made decisions that put her at a disadvantage and made those decisions because of what she perceived to be the risk of safety to members of the public. …861 6.174 Regarding Insp Scott’s actions, S/Sgt Watt stated that she had “done exactly what she’s trained to do and she’s done it exceptionally well.”862 Evidence of Assistant Commissioner Peter McKenna 6.175 Assistant Commissioner Peter McKenna (AC McKenna) is the Commander of the Central Metropolitan Region.
6.176 AC McKenna provided an executive statement in relation to the NSWPF response to the events of 13 April 2024 and gave oral evidence at the Inquest. AC McKenna stated: Inspector Scott’s actions, including her decision to enter Westfield Bondi Junction alone to seek out the active threat, were essential to the prevention of further casualties and entirely consistent with her training. Her actions were also incredibly brave, as has been recognised by the Commissioner in awarding the Commissioner’s Valour Award to Inspector Scott. The actions of the officers who followed Inspector Scott into Westfield Bondi Junction, many of whom were very junior in rank, were also exemplary, particularly given the traumatic scenes they faced and the difficult decisions they were presented with in a high-pressure and dangerous environment.863 6.177 AC McKenna further expanded on his opinion at the inquest: … It goes without saying that I think Detective Inspector Scott performed her duties admirably that day, not only her but all of the police that responded to this incident. It is a level of bravery which is right up there with anything I've ever seen, and to be honest, 860 Exhibit 1, Vol 14, Tab 764, Statement of Senior Sergeant William Watt at [52].
861 Transcript, D18 (Watt): T1625.1-8 (26 May 2025).
862 Transcript, D18 (Watt): T1626.7-8 (26 May 2025).
863 Exhibit 1, Vol 45, Tab 1602B, Statement of Assistant Commissioner Peter McKenna APM at [20].
PART 6 THE EVENTS OF 13 APRIL 2024 it is absolutely consistent with our training. It was textbook, and in my opinion, absolutely perfect.864 Evidence at Inquest regarding Insp Scott’s actions 6.178 In addition to the evidence of AC McKenna and S/Sgt Watt regarding the actions of Insp Scott, the Court also had the benefit of the expertise of Mr Scott Wilson, who in addition to his other qualifications and experience, had a 31 year policing career in the United Kingdom, including senior roles for the Metropolitan Police at New Scotland Yard and the National Counter Terrorism Headquarters as outlined in Appendix 9.
6.179 In addition to his commentary regarding the speed of Insp Scott’s response (considered in Part 8), Mr Wilson concurred with the conclusion of S/Sgt Watt that Insp Scott’s decision to discharge her firearm was entirely consistent with the NSWPF training and policy that he had reviewed in the preparation of an expert report in this matter.
6.180 The evidence at Inquest was that had a Taser been available to Insp Scott, this would not have been a suitable option in the circumstances faced by Insp Scott. Regarding this, S/Sgt Watt stated: Hypothetically, had a Taser been available to [Insp Scott], it is my view that any attempt to use the Taser in the circumstances that confronted her would have been both a poor and dangerous decision. The circumstances were, in my view, such that the consequences of a failed Taser deployment would be the near immediate death of Inspector Scott. Had that occurred the offender would have had unfettered access to her firearm. Based on my experience and training, my opinion is that the only option available to Inspector Scott was the use of her firearm.865 6.181 Mr Wilson agreed with this conclusion and that the use of lethal force was the only available option to Insp Scott in the circumstances that she found herself in on 13 April 2024.
Submissions 6.182 As identified above, an issue in the Inquest proceedings (Issue 10) was the circumstances in which Insp Scott discharged her firearm, and whether such use of force was justified, reasonable and appropriate – noting that an inquest was mandated in relation to this aspect under sections 23 and 27 of the Act.
6.183 In oral evidence on 26 May 2025, S/Sgt Watt “wholeheartedly agreed” with the propositions put by Counsel Assisting that, first, Insp Scott’s use of force was entirely justified and appropriate; secondly, Insp Scott’s training had equipped her to deal with the violent and unpredictable scenario she faced on that day; thirdly, Insp Scott demonstrated extraordinary courage and situational awareness in executing her training 864 Transcript, D19 (P McKenna): T1714.6-10 (27 May 2024).
865 Exhibit 1, Vol 14, Tab 764, Statement of Senior Sergeant William Watt at [53].
PART 6 THE EVENTS OF 13 APRIL 2024 and confronting Mr Cauchi in the most stressful of circumstances; and finally, that she acted with exceptional bravery and skill and saved lives.866 6.184 Counsel Assisting submitted that the actions of Mr Cauchi, as described by Insp Scott, are entirely consistent with the CCTV footage of the incident and it was noted that she had arrived on scene at WBJ in just over two minutes from first hearing the police “double beeper” job, and that within one minute and 25 seconds (during which time, she covered 166 metres in WBJ), she had confronted Mr Cauchi and neutralised the threat by shooting him in circumstances where he was clearly about to attack her with the knife.
6.185 The CCTV footage of Insp Scott’s confrontation with Mr Cauchi demonstrates exceptional situational awareness: almost simultaneously, Insp Scott moved civilians behind her or into shops nearby to protect them; she also directed a woman with a pram and a young child hiding behind a pot plant directly behind Mr Cauchi – and thus in the line of fire – to move to safety with definitive and clear hand gestures.
6.186 Counsel Assisting submitted that it was beyond question that the actions of Insp Scott, in discharging her firearm and fatally shooting Mr Cauchi, were justified, reasonable and appropriate in the circumstances. Counsel Assisting notes that by the time Insp Scott entered WBJ – with “great alacrity and tremendous courage,” believing that she was going to die – Mr Cauchi had already stabbed 16 victims. There was the potential for him to injure and kill many more persons at WBJ.
6.187 It is submitted by Counsel Assisting that it was only through Insp Scott’s clear-headed action and indeed, “textbook” technical execution of her AAO training, that Mr Cauchi was stopped.
6.188 Counsel Assisting submits that the Court would acknowledge Insp Scott’s extraordinary courage and situational awareness in executing her training and confronting Mr Cauchi in the most stressful of circumstances. Insp Scott acted with exceptional bravery and skill and saved lives. And that her decisive and skilled actions on 13 April 2024 will be held out as an exemplar of policing both nationally, and internationally.
6.189 Counsel Assisting submits that the Court would note the exceptional bravery of other police who entered WBJ that day around the same time as Insp Scott.
6.190 Counsel for the Commissioner of NSWPF, in adopting the submissions of Counsel Assisting regarding Insp Scott’s actions that day, describes her role on 13 April 2024 as critical and that she showed “extraordinary courage and skill and saved lives.” 6.191 In submissions on behalf of the family of Faraz Tahir, it was submitted that the description of Insp Scott as having demonstrated extraordinary courage, composure and skill was accurate. The family of Faraz Tahir thank Insp Scott and submit that she 866 Transcript, D18 (Watt): T1624.38-T1625.9 (26 May 2025).
PART 6 THE EVENTS OF 13 APRIL 2024 displayed the most extraordinary heroism in running towards a situation in which she thought she would die, to save the lives of others.
6.192 In submissions on behalf of Scentre, the extraordinary bravery of Insp Amy Scott is recognised.
Findings 6.193 I agree with the submissions of Counsel Assisting and find that Insp Scott’s use of force on 13 April 2024 was entirely justified and appropriate.
6.194 On that day, Insp Scott attended WBJ rapidly in response to reports of patrons being stabbed; she arrived just over two minutes from when she heard the priority broadcast on police radio.
6.195 Not long after her arrival, Insp Scott was approached by civilians and became aware of the significant danger posed by Mr Cauchi, that he was stabbing people inside the Centre, and people had been seriously injured. As a result of her training, Insp Scott determined to enter WBJ alone and not wait for her colleagues to arrive. This was incredibly brave. Insp Scott was candid in her evidence in that she believed she may not come out of WBJ alive that day.
6.196 Within one minute and 25 seconds, Insp Scott had entered WBJ, proceeded up to Level 5, pursued Mr Cauchi on foot and confronted him. At this time, Insp Scott and Mr Cauchi were around the Level 5 footbridge near Eckersley’s. Insp Scott showed incredible situational awareness, providing direction to those around her, conscious of her surroundings and that she may need to use her arms and appointments, including her firearm.
6.197 Mr Cauchi turned to face Insp Scott, holding the knife he had used in the attack, and ran towards her. Mr Cauchi’s actions were captured entirely on CCTV footage and are consistent with the description provided by Insp Scott in her account of the events of that day.
6.198 I find that Insp Scott’s use of her firearm was consistent with NSWPF policy and procedures, and in circumstances where it is clear from the available footage that Mr Cauchi was advancing towards Insp Scott and about to attack her with a knife.
AAO training 6.199 I accept the submission of Counsel Assisting that the training Insp Scott had received, in particular the NSWPF AAO training, outlined above, had equipped her to deal with the violent and unpredictable scenario she faced on 13 April 2024.
6.200 There is no doubt that Insp Scott displayed extraordinary courage, bravery and skill, and she saved lives that day.
PART 6 THE EVENTS OF 13 APRIL 2024 6.201 On 21 June 2024, Insp Scott was awarded the NSWPF Commissioner’s Valour Award in recognition of her bravery on 13 April 2024.
6.202 The Court reiterates the sentiments expressed by many parties in the Inquest, who acknowledged Insp Scott’s courage and bravery.
6.203 The Court acknowledges, as Insp Scott has herself, the bravery of the numerous NSWPF officers who attended that day and entered WBJ in the same violent and unpredictable circumstances.
6.204 It is highly commendable that the AAO training provided by the NSWPF facilitated the rapid response of Insp Scott and other members of the NSWPF that day.
Section 81 findings 6.205 As a result of considering all of the documentary evidence and the oral evidence given at the inquest, the findings I make under section 81(1) of the Act are: The identity of the deceased The person who died was Joel Andrew Cauchi Date of death Mr Cauchi died on 13 April 2024 Place of death Mr Cauchi died at Level 5, Westfield Bondi Junction, 500 Oxford Street, Bondi Junction, NSW 2022 Cause of death Mr Cauchi died due to gunshot wounds involving the neck and chest Manner of death Mr Cauchi was fatally and lawfully shot by Inspector Amy Scott, an officer of the NSW Police Force during a police operation
PART 6 THE EVENTS OF 13 APRIL 2024 J. Recommendations 6.206 Counsel Assisting submits that the Court consider a recommendation regarding the formal acknowledgement of the courage of several individuals in relation to the events of 13 April 2024, in particular Insp Amy Scott, Silas Despreaux, Damien Guerot, Mr McLaughlin and Ashlee Good.
6.207 Counsel Assisting have proposed a recommendation in the following terms: To the Council for the Australian Bravery Decorations Given the evidence disclosing exceptional bravery on the part of a number of individuals who confronted Joel Cauchi on 13 April 2024, it is recommended that those persons are referred to the Council for the Australian Bravery Decorations (Council) for consideration of an appropriate award in recognition of their actions on that day – namely: Inspector Amy Scott; Ashlee Good; Mr McLaughlin (the husband of Jade Young); Damien Guerot; and Silas Despreaux (with relevant evidence in support to be provided to the Council).
6.208 The Australian Bravery Decorations Council is an independent advisory body that considers nominations for awards and makes recommendations to the GovernorGeneral.
6.209 I accept the submission of Counsel Assisting that the five named individuals displayed extraordinary courage and bravery in confronting Mr Cauchi on 13 April 2024. Their actions are worthy of formal recognition.
6.210 Accordingly, I make the following recommendation per s 82(1) and 82(2)(b) of the Act:
RECOMMENDATION Recommendation 14: To the Council for the Australian Bravery Decorations Given the evidence disclosing exceptional bravery on the part of a number of individuals who confronted Joel Cauchi on 13 April 2024, I recommend that the Council for the Australian Bravery Decorations review the relevant evidence in the Inquest and consider an appropriate award in recognition of their actions on that day – namely: Inspector Amy Scott; Ashlee Good; Noel McLaughlin; Damien Guerot; and Silas Despreaux.
PART 6 THE EVENTS OF 13 APRIL 2024 K. Timing of the communications to the families of the deceased 6.211 Following consultation with the families, a further issue (Issue 12(g)) was added to the Issues List. Issue 12(g) was “the adequacy and timing of communications with families of the deceased in the aftermath of the events of 13 April 2024.” 6.212 Mr Manzoor said that he observed that information concerning Mr Tahir was “all scattered like different departments were working separately, like, and nobody knows what’s going on, initially, but later on all synced up but initially obviously it, it was not properly synced.”867 6.213 This issue was particularly acute for the Tahir family who, at the time of the incident, were based in Pakistan. Faraz’s brothers, Muzafar Ahmad Tahir and Sheraz Ahmad, attempted to obtain information from Ashfaq Ahmad, a friend of Faraz based in Australia, who first called the family to advise them that Faraz had been seriously injured in an incident at work.
6.214 Mr Sheraz Ahmad stated: We started to call Ashfaq continuously to tell us what happened. Ashfaq said there is no confirmed news but we are trying to find out. For next 20 hours until the next morning until almost 7am there was no confirmed news. I searched on [YouTube] news channels, only saw there was an attack and people passed away but we didn’t know who it was. We told everyone in the family that we need prayers for him because we were not able to contact him. We tried to call his mobile, texted and called but no one picked up. Because we were in Pakistan, we prayed and contacted Ashfaq and continued in contact with Ashfaq all the time. It was around 7 – 8am the next morning, I can’t remember the exact time, when we found out about Faraz. We found out through a text message that our Imam had sent to Muzafar.868 6.215 Muzafar Ahmad Tahir described receiving confirmation that Faraz was deceased via a phone call from the national president of the Ahmadiyyah Muslim community in Australia, Inam Ul Haq Kauser, whom he did not know prior to receiving this call.869 6.216 Ashfaq Ahmad also provided a statement to the Court. Mr Ahmad described first being advised that Faraz had been injured in an incident at WBJ by Faraz’s employer.870 Mr Ahmad described making a number of attempts over several hours to obtain further information about Faraz, including by contacting the Deputy Premier’s Office.871 Mr Ahmad was advised by an officer at Bondi Junction Police Station to keep calling Faraz’s 867 Transcript, D18 (Manzoor): T1705.7-10 (26 May 2025).
868 Exhibit 1, Vol 1, Tab 45A, Statement of Sheraz Ahmad at [16]-[21].
869 Exhibit 1, Vol 1, Tab 45, Statement of Muzafar Ahamd Tahir at [21].
870 Exhibit 1, Vol 1, Tab 45B, Statement of Ashfaq Ahmad at [9].
871 Exhibit 1, Vol 1, Tab 45B, Statement of Ashfaq Ahmad at [12].
PART 6 THE EVENTS OF 13 APRIL 2024 phone and was told that “maybe he [is] hiding somewhere, it is a very active crime scene and it is too soon to ask about this”.872 6.217 At around 11am the following morning, Mr Ahmad was informed that Muzafar had been contacted by their Imam and notified that Faraz was deceased. Mr Ahmad stated: It was a very stressful time for me before I had confirmation that it was Faraz who had died. It would have been helpful if there was a help line or special number for the families that I could have contacted.873 6.218 DCI Marks gave evidence that a Family Liaison Officer (FLO) was allocated to Faraz’s family at 11:00pm on 13 April 2024. He said: That FLO commenced inquiries in relation to the identity of Faraz Tahir, arranged for police to go around to the address of Faraz and there was no person at home. A number of inquiries were made on the COPS system and also attempts were made to get in contact with the Pakistan consulate here in Australia. And that continued up until about 7:30 in the morning. At that stage the officer involved had concerns for his own health and requested that he be taken off those duties and he was replaced sometime later with the FLO that’s currently in existence now.874 6.219 DCI Marks explained that, when undertaking the death notification process when the families of the deceased are overseas, NSWPF are required to communicate via consular officials, which may result in some delay. DCI Marks told the Court: When we are required to issue a death notice to the family, protocol will dictate that we’ll have to contact the consular – it’s not best practice to make a phone call overseas to tell somebody that their loved one has died. We prefer to have somebody in person deliver that message. So that, that again takes time.875 6.220 Counsel Assisting submitted that, ultimately, beyond some limited evidence that was taken from DCI Marks as to the delays in appointing a FLO, and issues concerning delays relating to the need to contact the relevant consulate with respect to the deaths of foreign nationals, this matter did not emerge as an issue during the Inquest.
6.221 Counsel for the Commissioner of NSWPF submits that there was no delay in relation to the appointment of a FLO to Faraz’s family, but that on 14 April 2024 the allocated FLO had concerns for their own health and requested to be taken off those duties, requiring a replacement to be found.
6.222 It is submitted on behalf of the Tahir family that they felt helpless in the 20-24 hour period between when they were first notified by Mr Ahmad and when they received confirmation of Faraz’s death by NSWPF.
872 Exhibit 1, Vol 1, Tab 45B, Statement of Ashfaq Ahmad at [13].
873 Exhibit 1, Vol 1, Tab 45B, Statement of Ashfaq Ahmad at [19].
874 Transcript, D1 (Marks): T71.36-43 (28 April 2025).
875 Transcript, D1 (Marks): T72.6-10 (28 April 2025).
PART 6 THE EVENTS OF 13 APRIL 2024 6.223 Accordingly, the Tahir family have proposed I recommend that NSWPF should implement a central hotline for the provision of information to families and friends in the aftermath of a mass casualty event.
6.224 It must have been an extremely difficult time for the families not knowing what happened to their loved ones.
6.225 Given the evidence of DCI Marks that there is a requirement to go through the consulate in the case of Faraz, a hotline might not have assisted.
6.226 In any event, there is not sufficient evidence before me to make a recommendation. As this has been raised by the Tahir family, I would urge the NSWPF to review the procedure for advising families of a death, when there is a requirement to contact a consulate, to see if there are any improvements that can be made to address the concerns of the Tahir family.
Part 7 The response of security to the events of 13 April 2024
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 INQUEST INTO THE DEATHS AT WESTFIELD BONDI JUNCTION ON 13 APRIL 2024 309
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 The response of security to the events of 13 April 2024 7.1 To address the evidence arising in relation to consideration of issues 8 and 9 with respect to the response of security staff at WBJ, this Part will be separated into the following sections: Introduction, expert and executive evidence regarding the Section A response of security staff and matters of context Section B Overview of security at WBJ Section C Scentre emergency practices, policies and procedures Section D Local security function at WBJ Section E Training of security staff at WBJ Chronology of the security response at WBJ on 13 April 2024 Section F The initial radio broadcast and identification of an AAO Section G incident by WBJ security staff The communications as between staff at WBJ and between Section H staff at WBJ and emergency services The response of certain security staff at WBJ to the AAO Section I Section J The nature and timings of alerts/alarms Section K Changes made at WBJ since the events of 13 April 2024 7.2 Section A is an introduction to the Part and addresses a number of preliminary matters.
Sections B – E largely relate to the preparedness of Scentre and Glad for an AAO event.
Sections F – J deal with the response of security staff on 13 April 2024 to the AAO event and issues that arose out of that response, which required further examination. The final section, Section K, addresses the changes made by both Scentre and Glad since the events of 13 April 2024.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 A. Introduction, expert and executive evidence regarding the response of security staff and matters of context Introduction 7.3 WBJ is a large shopping centre in the Eastern Suburbs of Sydney, and in accordance with the evidence outlined in Part 5, is considered a “Crowded Place” that is a vulnerable location for an AAO attack.
7.4 On the afternoon of 13 April 2024, the security staff of WBJ were tested by an unprecedented event. As outlined in Part 6, Mr Cauchi, having entered WBJ with a knife carried in his backpack, commenced a rapid and unpredictable attack on Level 4 of WBJ.
At this time, as would be expected on a Saturday afternoon, there were many members of the public inside WBJ.
7.5 This Part will consider the security arrangements at WBJ on 13 April 2024 and the response of those security staff to the events that unfolded that day.
7.6 At the outset, it is important to acknowledge that members of the WBJ security team present on 13 April 2024 responded to an unprecedented, violent, and rapid AAO incident. The security team was alerted and responded within approximately 40 seconds of the attack commencing. In responding, several members of the security team moved towards an unknown danger and exposed themselves to a real risk of harm.
That harm eventuated: two security officers were stabbed by Mr Cauchi while responding to the incident. The injuries sustained resulted in the death of one security officer, Faraz Tahir, and the serious wounding of another, Muhammad Taha.
7.7 The security team undertook a number of actions in response to the incident, including directing shoppers and retailers to safety, obtaining assistance from police and paramedics, locating the offender, providing first aid to victims, and providing other support to emergency services. Scentre employees carrying out emergency roles assisted Insp Scott and Chief Inspector Whalley (CI Whalley) following the critical incident. Many members of the security team suffered traumatic experiences on 13 April 2024, which have stayed with them.
7.8 As Scott Wilson noted in his first report: It is fully acknowledged that this was an extremely challenging and demanding set of circumstances that all security staff including control staff were faced with. No matter what training is provided, the human factors of time pressure, fear, unfamiliarity, weight of expectation, lack of control and information overload will always be a factor in these types of incidents. 876 876 Exhibit 1, Expert Volume, Tab 20, Expert Report of Scott Wilson at [6.7.2].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.9 The Court acknowledges that whilst the Inquest sought to identify any potential shortcomings or areas for improvement in the response of staff to the incident that occurred on 13 April 2024, this was done with the benefit of hindsight. The aim of this Inquest was to learn from the extraordinary events of that day and identify any improvements that could be made with respect to the response.
7.10 Whilst it is necessary in these findings to consider individual actions within the broader context of the security response, this does not detract from the acts of compassion and selflessness displayed by staff responding to patrons in the centre, in particular those who were injured.
7.11 At Inquest, oral evidence was provided by the following witnesses in relation to the WBJ security response:
(a) Jerry Helg, Glad Security Officer and on duty as the Security Supervisor, who was present at WBJ on 13 April 2024;
(b) Andrew David, former Project and Training Manager, WBJ. Mr David was responsible for training Glad staff in WBJ security policies and procedures from around October 2023 until March 2024;
(c) Lulu Fatima, Assistant Security Supervisor at WBJ from late March 2024. Ms Fatima was not on duty at WBJ on 13 April 2024;
(d) Joseph Gaerlan, Retail Manager (RM) on duty at WBJ on 13 April 2024, and assigned to perform the role of Chief Warden on the day. Mr Gaerlan is part of the Scentre Management Team at WBJ;
(e) Bradley Goldberg, Risk and Security Manager (RSM) on duty at WBJ on 13 April
(f) John Yates QPM, the current Director of Security within the Scentre Corporate Security Team. He has enterprise-wide responsibility for all aspects of security at Scentre.
7.12 It is acknowledged that Scentre and Glad, each of which was involved in the provision of security services at WBJ, engaged fully in the Inquest process. As I will identify later in this Part, there was substantial agreement regarding many aspects of the chronology of events on 13 April 2024, which effectively reduced the matters of contention to a range of specific issues.
7.13 By reference to the Issues List, this Part 7 concerns the evidence, findings, and recommendations arising out of Issues 8 and 9, which are outlined in full at Appendix 5.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.14 Consequently, this Part will consider the context and background to the security services provided at WBJ, including emergency practices, policies, and procedures with respect to AAO events. This will be followed by an outline of the chronology that emerged regarding the security response, sections pertaining to the issues that arose, and findings regarding these aspects of the response.
Witness evidence and applications to be excused from giving evidence 7.15 It is acknowledged that certain witnesses called to give evidence at the Inquest were directly involved in the incident on 13 April 2024 or its immediate aftermath, and despite the traumatic events of that day, some gave oral evidence to assist the Court in understanding what occurred.
Applications to be excused 7.16 A small number of witnesses made applications to be excused from giving evidence during the hearing of the Inquest. Counsel Assisting noted in their closing submissions that the applications were supported by compelling medical evidence.
7.17 Further, those witnesses each provided written statements and, as a condition of their excusal, agreed to provide further statements addressing queries formulated by the Counsel Assisting team in conjunction with families.
7.18 It is necessary to consider the excusal of witnesses at the outset of this Part, in particular regarding CR1, the Control Room Operator who was rostered in the WBJ CCTV Control Room at the time of Mr Cauchi’s attack, and GLA2, the security officer who made the initial radio broadcast to other security personnel once Mr Cauchi’s attack was underway. Both witnesses were ultimately excused from giving evidence, and this was the subject of submissions regarding findings with respect to those witnesses.
7.19 It was submitted on behalf of Glad that the Court should tread carefully before making any adverse findings against CR1 in circumstances where she was not given an opportunity to respond. In particular, Glad submitted: In relation to CR1, Glad considers it important to observe that she was not called to give evidence (because of her fragile psychological state) and the Court should, therefore, tread carefully before making any adverse findings against her when she was not given an opportunity to respond to specific (and serious) allegations made against her. This is not a criticism of Counsel Assisting but simply an observation of the procedural difficulties involved when a witness is too unwell to give evidence. Further, any adverse findings made against CR1 would need to meet the Briginshaw standard which we submit is an insurmountable hurdle in the context of the evidence in this case. 877 877 Written submissions on behalf of Glad at [36].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.20 Glad made similar submissions in relation to GLA2 and submitted that the Briginshaw standard would not be met in relation to GLA2, “given the poor and uncertain state of the evidence on this issue”.878 7.21 Counsel for Scentre made a similar submission that certain findings (such as those considered in Section E regarding CR1’s competency to be left alone in the CCTV Control Room) would be considered serious adverse findings that must be supported by clear and cogent proof.879 7.22 In response, Counsel Assisting submitted: … to the extent that the submissions suggest that there would be a denial of procedural fairness to CR1 to make an observation that is critical of her actions, because the Court acceded to her request not to give oral evidence, the Court would reject that. CR1 did have an opportunity to give evidence orally or in writing. She asked to give evidence in writing rather than orally because of the circumstances I've set out, and therefore she wasn't subjected to cross-examination. She was represented by very experienced senior counsel and a legal team who could take instructions from her and who advocated on her behalf during and after the hearing.
It would make a mockery of an application to avoid giving evidence on health grounds if the corollary was then to silence proper analysis and critique, and that analysis and critique I'll just say for the final time is not intended to be a criticism of her personally or her competence more generally. But moreover, it warrants emphasis that [Counsel Assisting’s] submissions are premised on the facts as known, including from contemporaneous records and CCTV footage. So it cannot properly be contended for that inferences drawn in relation to those facts can't be critical or adverse because a witness relevant to the factual matrix has not given evidence for health reasons, and that's particularly so when the witness is represented.
The factual analysis of what happened is done with a view to learning lessons that may save lives in the future. It's an essential part of this Court's statutory mandate and no doubt the Court is grateful for the assistance that CR1 was able to give … 880 Finding 7.23 I accept the submission of Counsel Assisting and note that in the case of CR1 particularly there are objective facts relied upon with respect to making findings about matters dealt with in Section E. I refer to those objective facts specifically in Section E with respect to my findings regarding CR1’s competence to be left in the Security Control Room unsupervised on 13 April 2024 and her capacity to respond following the commencement of Mr Cauchi’s attack.
878 Written submissions on behalf of Glad at [50].
879 Transcript, Closing Submissions D2: T1971.7-12 (28 November 2025).
880 Transcript, Closing Submissions D1: T1932.8-32 (25 November 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.24 I also accept, as submitted by Counsel Assisting, that CR1 had the opportunity, via her counsel, to provide any evidence that she wanted to.
7.25 Noting this, however, it is important for me to acknowledge that at Inquest there was a significant focus on CR1 and her actions on 13 April 2024.
7.26 In making findings regarding the events of 13 April 2024, and in particular the lessons to be learnt from the response to Mr Cauchi’s attack, it is necessary for me to closely examine the evidence regarding CR1 as well as GLA2.
7.27 It is important to highlight that, in doing so, I am conscious of the impact the events of that day have had on them both and reiterate the intention of the Inquest to focus on systemic issues as opposed to criticisms of individuals.
Expert evidence 7.28 To assist the Court in the consideration of the adequacy and appropriateness of the response of agencies, including Scentre, NSWPF, and NSWA, to the events of 13 April 2024, it was necessary for expert evidence to be sought, regarding a number of aspects, including in the area of security.
Scott Wilson 7.29 Scott Wilson was retained as a court-appointed independent security expert to opine on the response to the events of 13 April 2024. This included the adequacy and effectiveness of the preparedness, response, and interagency collaboration on that day, including whether there were any identified opportunities for improvement. By virtue of the entities involved and Mr Wilson’s expertise, his evidence traversed not only the Court’s consideration of the response of WBJ security, but also that of emergency services (NSWPF and NSWA).
7.30 Mr Wilson’s abridged curriculum vitae is outlined in Appendix 9.
7.31 Mr Wilson provided two reports and travelled from the United Kingdom (UK) to attend the Inquest in person. He gave oral evidence on 19 May 2025.
The expertise of Mr Wilson 7.32 At Inquest, questions were posed by counsel for certain interested parties that suggested that Mr Wilson may not be qualified to express particular opinions in circumstances where he does not have experience “in relation to the practical and commercial aspects of operating a large shopping centre.”881 7.33 Following the conclusion of the Inquest hearing, written submissions received on behalf of certain interested parties also raised matters for the Court’s consideration regarding 881 Transcript, D14 (Wilson): T1277.27-30 (19 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Mr Wilson’s expertise. The expertise of Mr Wilson is, therefore, of relevance to the Court’s determination of issues on which Mr Wilson opined with respect to the response on 13 April 2024.
7.34 Noting this and given that Mr Wilson’s expert evidence pertains both to this Part, as well as the response of the NSWPF and NSWA (outlined below at Parts 8 and 9 respectively), it is necessary for the submissions regarding his expertise to be considered at the outset.
Submissions Written submissions 7.35 Counsel Assisting submitted that Mr Wilson was eminently qualified to express the opinions in his report as a result of:
(a) 31 years of policing in the UK, including senior roles for the Metropolitan Police at New Scotland Yard and the National Counter Terrorism Headquarters.
Between 2014 and 2018, Mr Wilson was the National Co-ordinator for “Protect and Prepare”, based at the National Counter Terrorism Headquarters at New Scotland Yard, with responsibility for reducing the risk of terrorism to UK and overseas interests; and
(b) Following his retirement from policing, his extensive experience in the private sector as a security advisor and consultant to various organisations, including Festival Republic, Marks & Spencer, Primark, and Center Parcs.
7.36 Regarding Mr Wilson’s experience in relation to the practical and commercial aspects of operating a large shopping centre, Counsel Assisting submitted that Mr Wilson accepted he does not have such experience and that no suggestion to the contrary is or could be made. But insofar as the “lack” of experience was relied upon by any interested parties’ submission to undermine or criticise Mr Wilson’s opinions with respect to the security response by a large shopping centre such as WBJ, Counsel Assisting submit that the Court ought to reject such a submission.
7.37 Counsel Assisting submit that any such submission does not hold weight given Mr Wilson’s extensive experience in the private sector since his retirement from policing, including in relation to retailers and operators of “Crowded Places”. It also ignores entirely the extensive experience obtained by Mr Wilson in his policing roles, which include working closely with commercial operators of premises, such as for the 2012 London Olympics.
7.38 Counsel for the family of Faraz Tahir agreed with the submission of Counsel Assisting, and noted that Mr Wilson’s evidence was thoughtful, measured, and helpful, and it was based on his very high level of competence and unmatched experience. It is submitted on behalf of the family of Faraz Tahir that the challenge to Mr Wilson by Scentre is an
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 attempt to diminish his undoubted expertise on the basis of his asserted lack of expertise in relation to the practical and commercial aspects of operating a large shopping centre.
7.39 Counsel for the family of Faraz Tahir referred to evidence given by Mr Yates, Scentre Director of Security, in response to questions from their Counsel, regarding this challenge to Mr Wilson’s expertise: Q. You accept his expertise as a security and policing expert, don’t you?
A. I do.
Q. His experience is comparable to your experience in security and policing, would that be correct?
A. I would say no. I’ve held some of the most senior posts in British policing.
Probably the second most senior job in the country, as the head of counterterrorism and, and all those of other responsibilities I’ve had. So I would say no, with respect to Mr Wilson.
Q. You accept the validity of the opinions that he has placed before this Inquest, is that right?
A. I accept that he is - he has an opinion and I accept he has some expertise.
Q. In terms of his opinions, you accept many of the opinions that he has put forward that have been addressed at this Inquest, do you agree with that?
A. Absolutely, yes.
Q. Do you yourself have any challenge to his ability to give expert opinion evidence before this Inquest?
A. He, he has, he has a view and he’s absolutely - that’s what he’s come to give, an independent view.
Q. Do you have a problem saying yes or no? Do you have a challenge to his ability-- A. No, I don’t.
Q. --to give expert evidence before this Inquest?
A. No, I don’t.
… Q. I’m going to ask you your opinion. Is this your opinion of Mr Wilson that he doesn’t have any particular expertise in relation to the practical and commercial aspects of operating a large shopping centre?
A. I think he’s got wide, wide experience in the private sector world. I didn’t hear anything apart from Westfield Stratford where he has some engagement to suggest he’s had an intimate involvement in commercial operations at a shopping centre level. But I can’t really say, Mr Fernandez.
Q. That’s something that you have though, is it, practical and expertise in
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 practical and commercial aspects of running a-- A. Commercial aspects.
Q. Of operating a large shopping centre?
A. I’ve been director of security for nearly 12 years, so I would suggest I have a great deal of experience in the security operations of a shopping centre.882 7.40 It is submitted on behalf of the family of Faraz Tahir that Mr Wilson’s vast experience was obvious and there was no basis for Scentre to challenge his expertise. It is submitted that this challenge should be rejected by the Court.
7.41 The family of Pikria Darchia support the written submissions on behalf of the family of Faraz Tahir outlined above regarding the challenge to Mr Wilson’s expertise.
7.42 The families of Ashlee Good, Dawn Singleton, and Jade Young agree with the submission on behalf of the family of Faraz Tahir that there is no basis to challenge the expertise of Mr Wilson.
7.43 It is submitted on behalf of Scentre that, regarding Mr Wilson’s criticisms of CR1, when properly scrutinised, it is apparent that his opinion in this respect was affected by inaccuracies, poorly founded assumptions, and was inappropriately general or made widely cast propositions.
7.44 Counsel for Scentre submit that, whatever the experience and specialised knowledge of an expert witness, the weight that opinion deserves will be informed by the extent to which it is based upon assumptions that are supported by fact, and the transparency and robustness of the underlying reasoning. It is submitted that other matters are also relevant, such as whether the expert unnecessarily uses absolute terms; does not identify relevant criteria against which the validity of conclusions can be evaluated; is not prepared to make appropriate concessions; or adopts argumentative positions.
7.45 It is submitted on behalf of Scentre that some aspects of the opinion regarding CR1 bore these features and accordingly, submit that Mr Wilson’s evidence on any topic concerning the security response should be scrutinised carefully before it is accepted.
7.46 Counsel for Scentre further submitted that the appropriate security systems, infrastructure, and response (short and long term) for an AAO attack incorporated into the ANZCTC Guidelines (as referred to in Part 5) are influenced by the AAO attacks that are prevalent in the USA business or commercial environments. The ANZCTC Guidelines are therefore intended, in this context, to assist private owners and operators of crowded places with the security challenges presented when discharging the responsibility to protect these places.
882 Transcript, D15 (Yates): T1340.37-T1343.33 (20 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.47 It is submitted on behalf of Scentre that Mr Wilson’s relative inexperience as to the practical and commercial aspects of shopping centre operations were raised on behalf of Scentre during the hearing of the Inquest in case it had become necessary for me, as the State Coroner, to resolve disputes concerning the practicability of specific recommendations in relation to operational aspects of WBJ and/or shopping centres more generally.
7.48 Counsel for Scentre submits that, broadly speaking, it is important to remain conscious of the risk of imposing unrealistic expectations upon Scentre and its security staff, derived from critical analysis with the considerable advantages of hindsight, and notes that this is fairly acknowledged by Counsel Assisting. Within this context, it is submitted on behalf of Scentre that in some respects, Mr Wilson’s criticisms, and the tone of those criticisms, tend to impose unrealistic hindsight expectations which pay inadequate regard to the extreme trauma and stress being experienced by those who were involved.
7.49 Counsel for Glad, in response to the submission of Counsel Assisting, outlined at [7.36] regarding the reliance of any interested party on Mr Wilson’s “lack” of experience to undermine or criticise his opinion, submitted that little weight should be given to Mr Wilson’s opinions in circumstances where he lacks specific experience in overseeing security operations in large shopping centres.
7.50 It is submitted on behalf of Glad that, in contrast, Mr Yates possesses direct, relevant and lengthy experience in overseeing security operations for large shopping centres. It is submitted that any divergence of opinion between Mr Wilson and Mr Yates is readily resolved by accepting Mr Yates’ evidence as he is, of the two, more experienced in the relevant field. The submissions regarding Mr Yates are considered further below.
7.51 In written submissions on behalf of the Commissioner of NSWPF, there was reference to the opinions of Mr Wilson regarding aspects of the police response (which are referred to in Part 8); however, there was no submission made regarding Mr Wilson possessing the requisite expertise to opine on this matter.
7.52 No submission was made on behalf of NSWA regarding the expertise of Mr Wilson.
Oral submissions 7.53 On 25 November 2025, the first day of oral submissions, Counsel Assisting addressed the criticism of Mr Wilson as an expert.
7.54 Counsel Assisting submitted that the two-pronged attack on Mr Wilson by both Scentre and Glad was not warranted, and in their respectful submission, did those parties no credit.883 883 Transcript, Closing Submissions D1: T1924.28-31 (25 November 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.55 Counsel Assisting submitted that Scentre and Glad are more than happy to accept positive opinions of them rendered by Mr Wilson, such as in respect of the Red Book, the quality of the services agreement between Scentre and Glad, and the training programs provided by Scentre and Glad. But when it comes to criticism, they take umbrage and say that his opinions cannot be sensibly accepted or that he lacks the requisite expertise to express such views.884 7.56 Counsel Assisting submit that Mr Wilson was eminently qualified to give the evidence that he did, as addressed in the written submissions of Counsel Assisting outlined above at [7.35]. It is submitted that Mr Wilson’s CV (see Appendix 9) is objectively impressive, including that he gave evidence as an expert on the Manchester Arena bombing and Christchurch terrorism attack. He also has extensive private sector experience, including in relation to retailers and operators of crowded places.885 7.57 It is submitted by Counsel Assisting that the submission of Scentre directed at Mr Wilson’s opinions in a broader sense falls short. It is submitted that Mr Wilson repeatedly accepted and made concessions in relation to his expert report and, in his supplementary report, acknowledged errors such as the timing of the call by CR1 to Triple 0.886 7.58 Counsel Assisting submits that Mr Wilson was briefed late in 2024 and worked through a huge volume of material in a short period of time, providing very valuable assistance to this Court, and there is no reason why his opinion should not be accepted.887 7.59 In oral submissions on 25 November 2025, Counsel for Glad submitted that the divergence of opinion between Counsel Assisting, Glad and Scentre, where it exists, largely depends on an assessment of the evidence and how much weight the Court ought to give that evidence. This submission was made in the context of the assessment of the competency of CR1 (considered in Section E) and referred to the opinion of Mr Wilson and the contemporaneous weekly minutes as opposed to “a large body of evidence of subject matter experts, such as, Ms Lulu Fatima, Mr Jerry Helg, and Mr Cameron Stuart”.888 7.60 On 28 November 2025, oral submissions were made on behalf of Scentre. No further submissions were made specifically regarding Mr Wilson’s expertise.
7.61 On 28 November 2025, it was submitted by Counsel for the family of Faraz Tahir that the family found Mr Yates to be arrogant in his unwillingness to even acknowledge Mr Wilson’s expertise and Mr Wilson’s ability to give evidence at the Inquest until he was forced to accept that.889 884 Transcript, Closing Submissions D1: T1924.46-50-T1925.1 (25 November 2025).
885 Transcript, Closing Submissions D1: T1925.3-9 (25 November 2025).
886 Transcript, Closing Submissions D1: T1925.11-15 (25 November 2025).
887 Transcript, Closing Submissions D1: T1925.15-19 (25 November 2025).
888 Transcript, Closing Submissions D1: T1956.29-35 (25 November 2025).
889 Transcript, Closing Submissions D2: T2003.27-29 (28 November 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.62 Counsel submitted that the attack on Mr Wilson’s credibility was unfounded and reiterated their agreement with the submission of Counsel Assisting that he was eminently qualified to give the evidence that he did.890 7.63 Further submissions were made on behalf of the family of Faraz Tahir on the approach of Scentre and Glad to Mr Wilson’s evidence regarding CR1, which are addressed further in Section E.
Finding 7.64 Mr Wilson provided expert evidence in the Inquest with respect to various aspects of the response on 13 April 2024 in the context of his security and policing expertise.
7.65 I accept the submission of Counsel Assisting that Mr Wilson was eminently qualified. Mr Wilson considered a large volume of material to provide independent security expert evidence to the Inquest on a compressed timeframe. He balanced negative and positive aspects of the evidence and made appropriate concessions. This was clearly demonstrated in his glowing report with respect to the underlying Scentre policies, a matter considered further in Section C.
7.66 There was no criticism of Mr Wilson from NSWPF and NSWA.
7.67 A challenge was made to Mr Wilson’s expertise, and therefore to the opinions he expressed regarding the response on 13 April 2024, in particular by WBJ security staff.
This challenge was founded on Mr Wilson’s limited experience in relation to the practical and commercial aspects of operating a large shopping centre like WBJ.
7.68 Mr Wilson did have some such experience, including his involvement in the private sector as a security advisor and consultant to retailers Marks & Spencer and Primark (among other private companies), although not as much experience as Mr Yates in a retail setting.
7.69 Nevertheless, Mr Wilson was clearly eminently qualified to express the opinion that he did. Even one look at his extensive curriculum vitae demonstrates the major and wideranging experience he has. There is no question regarding his expertise and ability to provide valuable assistance to the Court in relation to consideration of the response to the events of 13 April 2024.
890 Transcript, Closing Submissions D2: T2004.23-26 (28 November 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Executive evidence John Yates QPM 7.70 A consequential issue arising from the submissions pertaining to Mr Wilson was the evidence given by Mr Yates in relation to the WBJ security response.
7.71 Mr Yates is employed as Director of Security within the Scentre Corporate Security Team and has enterprise-wide responsibility for all aspects of security at Scentre.891 Mr Yates provided three statements and gave evidence at the Inquest on 20 May 2025.
7.72 Mr Yates has more than 30 years’ experience with the UK Metropolitan Police and active involvement with the Australian and New Zealand Business Advisory Groups, each of which advise the Crowded Places Sub-Committee of the ANZCTC. Since 2013, Mr Yates has worked for Scentre (and other entities) in a corporate security role.
Written submissions 7.73 It is submitted by Counsel Assisting that due to Mr Yates’ current role, as Director of Security, there was an understandable conflict that existed, to which no criticism was attached. Counsel Assisting submitted that there was ultimately minimal disagreement between Mr Wilson and Mr Yates, and the Court was fortunate to receive evidence from two seasoned security professionals.
7.74 Counsel for the family of Faraz Tahir submit that this conflict was insurmountable, and that Mr Yates gave evidence before the Inquest as a representative and advocate of Scentre.
7.75 It is submitted on behalf of the family of Faraz Tahir that Mr Yates was not an impartial expert. At no stage in any of his statements before the Inquest did Mr Yates refer to his role as an independent expert, and he did not acknowledge the Expert Code of Conduct.
It is submitted that Mr Yates stated he was making his statements on behalf of Scentre and sought to portray Scentre in the best possible light and defend Scentre from criticism. It is submitted that Mr Yates spoke on behalf of Scentre.
7.76 Counsel for the families of Ashlee Good, Dawn Singleton, and Jade Young submitted that Mr Yates is not only the global head of security for the Westfield Group, but he is also extensively involved in representative positions across the security industry. It is submitted that Mr Yates serves as Chair of the Forum of Australasian Security Executives, he founded and chairs the Retail Leaders Security Forums in Australia and New Zealand and is involved as an industry representative to the Australian and New Zealand Business Advisory Groups, who in turn advise the Crowded Places SubCommittee of the ANZCTC.
891 Exhibit 1, Vol 42, Tab 1599, Statement of John Yates (Director of Security) at [19].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.77 In the context of this submission, Counsel for the families of Ashlee Good, Dawn Singleton and Jade Young make further submissions regarding the preparedness of Scentre and Glad for the events of 13 April 2024, considered further in Section C.
7.78 Counsel for Scentre submits that Mr Yates gave evidence in three capacities, namely:
(a) As a Scentre representative authorised to speak on behalf of the company, (which is submitted was entirely orthodox);
(b) To give opinion evidence on some matters relevant to his expertise; and
(c) To give evidence describing things that he saw, such as observations of what occurred in the Control Rooms that he visited.
7.79 It is submitted on behalf of Scentre that neither (a) nor (c) involve an expression of expert opinion and no question of “conflict” arises in respect of that evidence. It is submitted that, as to the expert evidence Mr Yates gave, courts recognise the total impracticability to always require “independent” witnesses to give expert opinion evidence.
7.80 Counsel for Scentre submits that the fact that an expert may be employed by a party may be a matter considered when determining the weight to be given to the evidence, but there is no foundation in principle to set the evidence aside altogether (in the coronial jurisdiction) or to find the evidence inadmissible (where the rules of evidence apply). It is submitted that such evidence is often given or invited to be given by police officers, as was the case in this Inquest.
7.81 It is submitted on behalf of Scentre that, of greater importance in determining the weight to be given an opinion based on expertise, are matters such as whether the opinion is properly supported by transparent reasoning, whether it is based upon established facts, whether any assumptions are properly identified, and other matters that enable an objective evaluation of the reliability and validity of the opinion.
7.82 Counsel for Scentre submits that from the time of his first statement, through to the conclusion of his oral evidence, Mr Yates identified and made appropriate concessions.
For example, he acknowledged that there were issues with the Triple 0 call by CR1, and he accepted that the Triple 0 call from the Control Room, the activation of the Centre Management Emergency Override (CMEO) and Emergency Warning and Intercommunication System (EWIS), and the making of PA announcements were all too slow.
7.83 It is submitted that Mr Yates’ oral evidence was responsive to questioning and was provided in a calm and balanced manner. He explained the reasons for his opinions, for example, why he considered CR1 to have been competent; why he considered that immediate or instant responses in operation of CCTV were unrealistic; his own
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 experience of potential idiosyncratic reactions of people, including police officers, facing a highly pressured situation; and his views on wanding.
7.84 Counsel for Glad agrees with and adopts the submissions of Scentre as outlined from [7.78] – [7.83]. As noted above, with respect to Mr Wilson, it is submitted on behalf of Glad that the divergence of any opinions between Mr Wilson and Mr Yates is readily resolved by accepting Mr Yates’ evidence as he is, of the two, more experienced in the relevant field (namely, overseeing security operations in large shopping centres).
Oral submissions 7.85 In oral submissions on 25 November 2025, insofar as Mr Yates is sought to be qualified as an expert, Counsel Assisting submitted that Mr Yates does have very significant expertise and experience. However, nothing should be taken as to have elevated him to the role of an independent expert. It is submitted that Mr Yates gave evidence as a partial witness and, whilst not a criticism of him, Mr Yates is by definition conflicted because he's a paid representative of Scentre and an advocate for their interests. It was submitted that the suggestion that his evidence is to be preferred to that of an independent expert cannot seriously be made in those circumstances.892 7.86 On 28 November 2025, it was submitted by Counsel for the family of Faraz Tahir that Mr Yates came before the Inquest as an advocate for, and on behalf of, Scentre Group.893 7.87 No further oral submissions were made by Scentre and Glad concerning Mr Yates.
Finding 7.88 Whilst Mr Yates’ significant expertise and experience are acknowledged, he is not an independent expert.
7.89 I accept the submission of Counsel Assisting that this is no criticism of Mr Yates, but he is a paid employee of Scentre.
Matters of context 7.90 Counsel for Scentre drew to my attention five matters of context that I am asked to bear in mind:
(a) That AAO attacks tend to have quite specific or unique features compared with other emergencies. They are rare in Australia. They are violent, rapid, unpredictable, and especially dangerous. At that time, the attack at WBJ was unprecedented in its nature and scale. Mr Cauchi’s attack exhibited these features and, even with the best efforts to reduce the risk and consequences of 892 Transcript, Closing Submissions D1: T1925.20-28 (25 November 2025).
893 Transcript, Closing Submissions D2: T2003.11-12 (28 November 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 such an attack, Scentre will not be able to completely prevent or predict all such attacks.894
(b) That Scentre’s existing policies and procedures in preparation for an AAO incident were industry-leading and best practice.895 This is further considered in Section C below.
(c) The impact of natural human responses to AAO attacks, being: i. Obtaining situational awareness in a large, crowded space can take some time, and the initial information provided may be insufficient to make properly informed decisions. Consequently, Scentre has built into its procedures the necessary initial emergency response (which is generic) and a requirement for verification of an AAO, but this is never going to be instantaneous; ii. The natural and involuntary physiological responses of human beings when faced with extreme stress and fear. These may impair the ability to observe and report details; and iii. The general individual responses will vary – fight, flight, freeze, or even film.
(d) The generic response guidelines are designed to allow for prompt activation of an emergency response before the specific nature of the emergency is known and before full situation awareness can be achieved. There is ample evidence that these guidelines were being implemented before Mr Cauchi’s attack was verified.897
(e) As at 13 April 2024, WBJ was equipped with sophisticated and extensive security infrastructure and technology, which was industry-leading.898 7.91 I note the contextual matters raised by Counsel for Scentre and will bear them in mind when making my findings in this Part.
7.92 I also note that these contextual matters are closely linked to findings arising from consideration of the adequacy of the policy and procedures pertaining to the actions of security staff on 13 April 2024, considered specifically in Sections C and E, and to the response of security staff on 13 April 2024 considered in Sections G - J.
894 Transcript, Closing Submissions D2: T1963.48-T1964.8 (28 November 2025).
895 Transcript, Closing Submissions D2: T1964.28-30 (28 November 2025).
896 Transcript, Closing Submissions D2: T1964.36-T1965.49 (28 November 2025).
897 Transcript, Closing Submissions D2: T1966.1-21 (28 November 2025).
898 Transcript, Closing Submissions D2: T1966.23-32 (28 November 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 B. Overview of Scentre (WBJ) security 7.93 In order to understand the response of security personnel on 13 April 2024, it is necessary to outline the approach of Scentre to security within shopping centres including WBJ.
7.94 WBJ is owned and operated by Scentre, which operates 42 Westfield shopping centres in Australia and New Zealand. Those centres reach approximately 90% of the Australian population.899 7.95 WBJ is one of Scentre’s largest shopping centres.900 WBJ contains 350 retail stores and 150 commercial spaces.901 Approximately 21 million customers visit WBJ annually.902 The Scentre security function 7.96 The security function at Scentre’s Westfield shopping centres is achieved through:
(a) Strategies and policies developed at a national level, by the Scentre National Security team; and
(b) Implementation by local Scentre management, in conjunction with specialist security sub-contractors.
7.97 As at 13 April 2024, the National Security function at Scentre was comprised of two interrelated teams: a Corporate Security team and a Customer, Community and Destination (CCD) team.903 The Corporate Security team manages an intelligence function. The CCD team is responsible for operational oversight of Scentre’s security functions.904 7.98 As noted above, Mr Yates is employed as Director of Security within the Corporate Security team and has the enterprise-wide responsibility for all aspects of security at Scentre.905 7.99 Ms Emily Hunt is employed as the National Risk and Security Operations Manager within the CCD team.906 “Risk and security” at Scentre encompasses a broad spectrum of risks, including structural risks, environmental hazards, loss prevention and other potential liabilities.907 899 Transcript, D9 (Goldberg): T723.1-8 (9 May 2025).
900 Transcript, D9 (Goldberg): T723.19-21 (9 May 2025).
901 Exhibit 1, Vol 30, Tab 993, Statement of Emily Hunt, Annexure E, Pre-Response Planning at p. 695.
902 Exhibit 1, Vol 30, Tab 993, Statement of Emily Hunt, Annexure E, Pre-Response Planning at p. 695.
903 Exhibit 1, Vol 42, Tab 1599, Statement of John Yates (Director of Security) at [30]-[31].
904 Exhibit 1, Vol 42, Tab 1599, Statement of John Yates (Director of Security) at [30]-[31].
905 Exhibit 1, Vol 42, Tab 1599, Statement of John Yates (Director of Security) at [19].
906 Exhibit 1, Vol 42, Tab 1599, Statement of John Yates (Director of Security) at p. 50; Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt at [8].
907 Transcript, D9 (Goldberg): T722.46-49 (9 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.100 The National Security team has various functions, including responsibility for the development and review of Scentre’s emergency policies and procedures, as well as its security practices.908 Approach of Scentre to security services 7.101 As at 13 April 2024, Scentre had what can only be described as extensive and welldeveloped security plans, policies, and procedures. Those policies were informed, in part, by advice and guidelines provided through Australia’s National Counter-Terrorism Plan.909 That advice and relevant associated guidelines are further considered in Section C below.
7.102 Scentre, at an organisational level, employs a bifurcated approach to security services at its shopping centres, including WBJ.
7.103 Mr Yates described the various models an organisation can adopt for implementing and maintaining the security of its premises. This includes:
(a) A fully insourced specialist licensed security service for day-to-day operations and directly employed security personnel. This model is not frequently used by operators in Australia;910 or
(b) A fully outsourced security function, with the owner/operator maintaining ownership and responsibility for some or all security infrastructure at the site. This is a common approach amongst shopping centre owners and operators in Australia.911 7.104 Mr Yates explained the model employed by Scentre, namely that it is a: … model of engaging specialist licensed security contractors to provide security services at Westfield Centres, with the additional element that Scentre directly employs an RSM (and in some cases also an RSS, including at Westfield Bondi Junction) to oversee the delivery of the security services at Westfield Centres. This approach allows for oversight by the RSM (and, where applicable, RSS) while recognising that security services are not a core business activity of Scentre, and that specialist security businesses have greater experience and expertise in the provision of security services to crowded places. 912 7.105 While Scentre retains an integral role in respect of the security functions as WBJ (including the development of relevant policies and procedures), the delivery of those functions (including by personnel) are, however, ultimately provided by Glad, a specialist security sub-contractor.913 Scentre engaged Glad to provide security services at WBJ for 908 Exhibit 1, Vol 42, Tab 1599, Statement of John Yates (Director of Security) at [32]-[33].
909 Transcript, D15 (Yates): T1324.22-26 (20 May 2025).
910 Exhibit 1, Vol 42, Tab 1599, Statement of John Yates (Director of Security) at [100].
911 Exhibit 1, Vol 42, Tab 1599, Statement of John Yates (Director of Security) at [100].
912 Exhibit 1, Vol 42, Tab 1599, Statement of John Yates (Director of Security) at [101].
913 Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg at [12]-[15]; Exhibit 1, Vol 30, Tab 993, Statement of Emily Hunt at [12]-
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 the period 4 September 2023 to 3 September 2028. This engagement is governed by the terms of a Services Agreement between Scentre and Glad (Services Agreement).914 The nature of this arrangement is considered further in Section D.
[14].
914 Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt at [13]; Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt, Annexure B, Scentre Group Services Agreement (4 September 2023 – 3 September 2028).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 C. Scentre emergency practices, policies and procedures 7.106 As outlined in Part 5, the actions of Mr Cauchi on 13 April 2024 were consistent with an AAO attack.
7.107 To understand and consider Scentre’s response to the events of 13 April 2024, it is necessary to understand the policies and procedures applicable to the events of that day.
7.108 As discussed further below, the evidence received during the Inquest demonstrated that whilst Scentre had not experienced an AAO attack at one of their centres prior to 13 April 2024, their emergency response practices, policies and procedures embodied Australian and international good practice.915 Policies and procedures applicable on 13 April 2024 7.109 Scentre has a suite of documents through which its emergency response and security policies and procedures are implemented at a local level, components of which are customisable to the specific operational characteristics and environment of a given shopping centre.
7.110 The policies and procedures relevant to the security response on 13 April 2024 include the Emergency Response Procedures document (the Red Book), the Pre-Response Planning document (the Green Book), and the Security Site Orders (Site Orders). The Red Book is explained further below.
7.111 Each of these documents is reviewed periodically and updated in accordance with developments in good practice.
915 Exhibit 1, Expert Volume, Tab 20, Expert Report of Scott Wilson at [2.2].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Figure 8: Scentre Emergency Response Procedures (the Red Book), Pre-Response Planning document (the Green Book), and the Security Site Orders (Site Orders) 7.112 The Green Book sets out practical guidelines for security officers in preparation for responding to a major incident or emergency (pre-response planning). The Site Orders are a summary of tasks and duties to be performed by security officers during shifts at WBJ, including general responsibilities, duties and expectations.
7.113 The central document providing guidance regarding the response to an AAO incident was, and is, the Red Book and consequently, its contents assumed prominence during the hearing of the Inquest.
The Red Book 7.114 WBJ (and other Scentre shopping centres) use the Red Book when responding to emergency situations. The Red Book is supplemented by responsibilities set out in the Site Orders.
7.115 The Red Book is consistent with Australian Standard A23745-2010 and contains comprehensive response guidelines in the event of major incidents and/or emergencies, including AAO incidents. These form the basis of the training and preparation at Scentre shopping centres for major incidents and emergencies, and as noted above, they are regularly reviewed and updated.
7.116 Some aspects of the Red Book guidelines were examined closely at the Inquest, particularly aspects of the guidelines summarised below.
7.117 Prior to and throughout the Inquest process, Scentre took on board potential improvements identified in relation to its policies and procedures and has made relevant
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 changes. These are addressed further below in Section K. Scentre has committed to considering any further matters identified as a result of this Inquest.
Generic Response Guidelines 7.118 The Red Book is governed by the principle that security staff are to act where it is “Safe to do so; Personnel are available; The actions are reasonable and required”. The Red Book sets out recommended actions for first responders (those being security staff) to an emergency, including:
(a) Conduct an initial assessment of the condition/situation;
(b) Contact emergency responders via Triple 0; and
(c) Identify hazards that could cause more casualties and, if the area is not safe, move people away from dangers and warn others against entering the danger area.916 7.119 These steps are specifically outlined as the recommended actions as part of the Generic Response under the Red Book.
Roles of staff in an emergency 7.120 The Red Book sets out various roles that are to be undertaken by designated staff in the event of an emergency. The specific responsibilities of each role are determined by the nature of the event being responded to.917 7.121 Those roles are, relevantly, and in summary form, as follows:
(a) Chief Warden: the Chief Warden is responsible for “Command and Control” of emergencies, including: i. Coordinating the response and communication among Scentre personnel, retailers, commercial tenants, customers, media, and any other relevant stakeholders; and ii. Obtaining accurate information from Scentre personnel on the scene, conducting an assessment, and developing an appropriate course of action; and assisting emergency responders.
The Chief Warden is, effectively, in charge of Scentre’s initial response to an incident at one of its centres. 918 916 Exhibit 1, Vol 29, Tab 993, Statement of Emily Hunt, Annexure D, Emergency Plan – Emergency Response Procedures at p. 316.
917 Exhibit 1, Vol 29, Tab 993, Statement of Emily Hunt, Annexure D, Emergency Plan – Emergency Response Procedures at pp. 314323.
918 Exhibit 1, Vol 29, Tab 993, Statement of Emily Hunt, Annexure D, Emergency Plan – Emergency Response Procedures at pp. 309, 318.
(b) On-Scene Coordinator: where Scentre personnel are available, the Chief Warden should assign a qualified person to act as the On-Scene Coordinator.
The On-Scene Coordinator’s role is to: i. Communicate and coordinate the actions of other Scentre personnel in accordance with the directions given by the Chief Warden and liaise with emergency responders.
ii. Manage the actions of personnel and ensure appropriate ongoing updates are provided to the Chief Warden.
iii. Gather facts, particularly the location and extent of casualties and hazards; prioritise life safety issues, including that first aid is provided; and iv. To direct employees to meet with emergency responders. 919
(c) Wardens: Wardens are responsible for: i. Implementing emergency procedures; ii. Providing information to the Chief Warden; iii. Assisting in the evacuation of tenants, customers, and contractors and the movement of people to safe areas, including those requiring special assistance; and iv. Are otherwise required to act in accordance with the directions of the Chief Warden. 920 Radio usage, call signs and colour codes 7.122 Radio communications are an important part of any emergency response.
7.123 In respect of radio communications, the Red Book provides (emphasis in original): Upon reports of an emergency, ALL Scentre Group personnel will maintain strict radio protocols and reduce unnecessary radio use to facilitate clear lines of communication between the Chief Warden and responding personnel. 921 7.124 The Red Book provides that radio colour codes are to be used to improve radio communication between security staff and other personnel. These colour codes signify certain types of events, consistent with Australian Standards.922 For example: 919 Exhibit 1, Vol 29, Tab 993, Statement of Emily Hunt, Annexure D, Emergency Plan – Emergency Response Procedures at pp. 309, 319, 320.
920 Exhibit 1, Vol 29, Tab 993, Statement of Emily Hunt, Annexure D, Emergency Plan – Emergency Response Procedures at pp. 323.
921 Exhibit 1, Vol 29, Tab 993, Statement of Emily Hunt, Annexure D, Emergency Plan – Emergency Response Procedures at p. 313.
922 Exhibit 1, Vol 29, Tab 993, Statement of Emily Hunt, Annexure D, Emergency Plan – Emergency Response Procedures at p. 313.
(a) Code Blue means a medical emergency;
(b) Code Orange means an evacuation;
(c) Code Purple means a bomb threat; and
(d) Code Green means a crime in progress.923 Figure 9: Scentre Group Radio Colour Codes924 7.125 Relevantly, “Code Black” is used to report a personal threat, meaning a person engaging in or threatening violence to one or more other persons, including themself. “Code Black” does not distinguish whether a weapon is in use.925 7.126 The Red Book notes that: A code for ‘Weapon’ Displayed or Used is no longer used. Because of the importance of this information, state the type of weapon so that there is NO CONFUSION about the nature of the threat. 926 7.127 The Red Book also provides for “modifier” or “intensifier” phrases in addition to the specific colour code. The use of the word “Alpha”, alongside a colour code, is intended 923 Exhibit 1, Vol 38, Tab 1253, Radio Colour Codes.
924 Exhibit 1, Vol 38, Tab 1253, Radio Colour Codes.
925 Exhibit 1, Vol 29, Tab 993, Statement of Emily Hunt, Annexure D, Emergency Plan – Emergency Response Procedures, p. 313; Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [28].
926 Exhibit 1, Vol 29, Tab 993, Statement of Emily Hunt, Annexure D, Emergency Plan – Emergency Response Procedures at p. 313.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 to escalate the seriousness of the report, indicating an immediate response is required.927 Red Book AAO Response Plan 7.128 The Red Book AAO Response Plan is based on advice from the ANZCTC Guidelines.928 7.129 In the Red Book, and consistent with the ANZCTC Guidelines referred to in Part 5, an AAO is defined as (emphasis added): An Armed Offender who is actively engaged in killing or attempting to kill people, and who demonstrated their intention to continue to do so while having access to additional potential victims. 929 7.130 As already noted at Part 5, Mr Cauchi satisfied the definition of an AAO on 13 April 2024.
7.131 On 13 April 2024, the Red Book contained two “Main Objectives” when responding to an emergency situation:930 Figure 10: “Main Objectives” from the Red Book AAO Response Plan 7.132 These were the core responsibilities of Scentre staff and security subcontractors on 13 April 2024. They reflect the ANZCTC Guidelines, as outlined in Part 5.
7.133 The Red Book AAO Response Plan then contained five “Main Assignments” which were to be carried out by security responders in the event of an AAO:931 Figure 11: “5 Main Assignments” from the Red Book AAO Response Plan 927 Exhibit 1, Vol 29, Tab 993, Statement of Emily Hunt, Annexure D, Emergency Plan – Emergency Response Procedures at p. 313.
928 Exhibit 1, Vol 29, Tab 993, Statement of Emily Hunt, Annexure D, Emergency Plan – Emergency Response Procedures at p. 331; Transcript, D15 (Yates): T1324.22-25 (20 May 2025).
929 Exhibit 1, Vol 29, Tab 993, Statement of Emily Hunt, Annexure D, Emergency Plan – Emergency Response Procedures at p. 325.
930 Exhibit 1, Vol 29, Tab 993, Statement of Emily Hunt, Annexure D, Emergency Plan – Emergency Response Procedures at p. 325.
931 Exhibit 1, Vol 29, Tab 993, Statement of Emily Hunt, Annexure D, Emergency Plan – Emergency Response Procedures at p. 325.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.134 The Red Book AAO Response Plan contained recommended initial actions, including to safely investigate an “unverified” report, and “if confirmed”, to immediately assign personnel to carry out the five main assignments. The issue of verification is considered further in Section G.
7.135 The AAO Response Plan provided that when confronted by an offender, staff should:
(a) Escape where possible, utilising cover and concealment (including taking others to safety);
(b) Move to a safe haven, or, if unable to escape, utilise confrontation management and de-escalation techniques; and
(c) If in imminent danger (and as a last resort) try to disrupt or incapacitate the offender. 932 7.136 The Red Book AAO Response Plan provided specific actions for the Chief Warden, including ensuring the five main assignments are carried out and the “Escape. Hide.
Tell.” advice is delivered.933 The Red Book AAO Response Plan set out other actions to be undertaken by security officers, including establishing perimeters and providing information to police and/or Triple 0.934 Responsibilities of the CCTV Control Room Operator 7.137 The CCTV Control Room Operator is tasked with further specific responsibilities in the event of an AAO, including:
(a) Using the CCTV system to substantiate the report and locate any offenders;
(b) Reviewing footage to track an offender; and
(c) Conveying information to the Chief Warden, PA announcer, and police on site (or via Triple 0).935 932 Exhibit 1, Vol 29, Tab 993, Statement of Emily Hunt, Annexure D, Emergency Plan – Emergency Response Procedures at p. 331.
933 Exhibit 1, Vol 29, Tab 993, Statement of Emily Hunt, Annexure D, Emergency Plan – Emergency Response Procedures at pp. 326327.
934 Exhibit 1, Vol 29, Tab 993, Statement of Emily Hunt, Annexure D, Emergency Plan – Emergency Response Procedures at pp. 325327.
935 Exhibit 1, Vol 29, Tab 993, Statement of Emily Hunt, Annexure D, Emergency Plan – Emergency Response Procedures at p. 328.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Responsibilities of the PA Operator 7.138 The PA Operator within the CCTV Control Room is tasked with shutting off mall music, using the evacuation EWIS tone to gain attention, and delivering a scripted PA message, in the following terms:936 Figure 12: PA Message from the Red Book AAO Response Plan 7.139 The PA Operator is to repeat the message, interposed with three seconds of evacuation tones, and if possible, to use information obtained from the CCTV to provide PA messaging advising of the specific location of the threat.937 7.140 The PA Operator is also required to activate the CMEO system to display an AAO warning on electronic displays located throughout the shopping centre.938 7.141 The emergency systems in place at WBJ, including PA and CMEO, are described further in Section D below.
7.142 The Red Book AAO Response Plan also provided information about liaising with police.
This includes:
(a) Providing police with a radio and instructions on use so police can communicate directly with the CCTV Control Room Operator;
(b) Providing any necessary centre maps to police;
(c) Assisting with identifying a safe location for police to establish an Emergency Command Centre;
(d) Offering to remain near the Police Commander to provide any other assistance; and
(e) Offering to escort police to the CCTV Control Room. 939 936 Exhibit 1, Vol 29, Tab 993, Statement of Emily Hunt, Annexure D, Emergency Plan – Emergency Response Procedures at p. 328.
937 Exhibit 1, Vol 29, Tab 993, Statement of Emily Hunt, Annexure D, Emergency Plan – Emergency Response Procedures at pp. 328329.
938 Exhibit 1, Vol 29, Tab 993, Statement of Emily Hunt, Annexure D, Emergency Plan – Emergency Response Procedures at p. 329.
939 Exhibit 1, Vol 29, Tab 993, Statement of Emily Hunt, Annexure D, Emergency Plan – Emergency Response Procedures at pp. 329330.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Evidence regarding the Red Book 7.143 Describing Scentre’s preparedness for an AAO incident, Mr Wilson characterised Scentre as an organisation that was “aware of the risks faced from an Active Armed Offender within their premises” with “specific comprehensive plans within their Red Book Guidance on how staff should respond if such an attack took place”.940 7.144 In his first report, Mr Wilson concluded: The Emergency Response Procedures referred to as the “Red Book” is an example of the professionalism of this organisation. The document control page is regularly updated stretching back to 2014 with the current version having being [sic] updated in February 2024. … This document should be viewed as excellent practice. The PreResponse Planning Document should also be viewed as an excellent reference document and seen as good practice. 941 7.145 Mr Wilson gave oral evidence that he considered the Red Book to be “excellent practice” and explained: … I think it's one of the, the - overall, the preparation from Scentre, I thought, was excellent. I mean, without a doubt - they've not just been looking at Australian good practice, they've been looking at good practice worldwide…There's a lot of, there's a lot of UK practice in there, there's some US practice in there, so going through that, it was probably one of the best - having worked with lots of organisations, it was probably one of the best prepared documents I had seen.942 Submissions 7.146 Issue 9 in the Inquest referred to the adequacy of the applicable policies and procedures at WBJ for dealing with an AAO, including having regard to the subcontracting of security services.
Written submissions 7.147 With respect to this issue, Counsel Assisting submitted that the evidence in the Inquest indicates that Scentre is an organisation that is conscious of the risks it faces as an operator of a “crowded place” and has invested in ensuring that it is appropriately prepared for a variety of emergency incidents that may occur at its premises. It was submitted that this includes the peculiar, rare, and dangerous risk posed by an AAO event.943 7.148 It was further submitted that Scentre’s policies and procedures for responding to an AAO incident are informed by, and are a result of, Scentre’s engagement with the 940 Exhibit 1, Expert Volume, Tab 20, Expert Report of Scott Wilson at [2.2].
941 Exhibit 1, Expert Volume, Tab 20, Expert Report of Scott Wilson at [3.1.14].
942 Transcript, D14 (Wilson): T1205.44-T1206.10 (19 May 2025).
943 Written submissions of Counsel Assisting at [1107]-[1108].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 ANZCTC, BAG, and the NSWPF TPU – each of which provide important material and guidance for operators of “crowded places”.944 7.149 Counsel Assisting also submit that Glad, under the terms of the Services Agreement, complies with and meets the expectations of Scentre concerning the provision of security services at WBJ, and has demonstrated an awareness of the risks faced by its employees and subcontractors. It was noted that Glad has its own extensive policies and procedures regarding the delivery of security services, and following the events of 13 April 2024, has implemented its own “Crowded Places” policy.945 7.150 It was submitted on behalf of Scentre that the Red Book “was and is industry-leading” and that the written submissions of Counsel Assisting in this respect should be accepted.946 7.151 Counsel for Scentre submitted that the Red Book is structured to first provide an “overarching generic response guideline” before the applicable specific response guidelines, such as the AAO, are implemented. It was submitted that the generic response provides for the first steps of a response where the nature of an emergency is not immediately known to staff.947 7.152 Counsel for Scentre submit that both Scentre staff and contracted security staff are trained on how to implement the generic response guideline, and on the interaction of this guideline with specific emergency responses.948 7.153 Regarding the expert evidence of Mr Wilson, Counsel for Scentre submit that while Mr Wilson strongly endorses the Red Book and “his appraisal should be accepted”,949 he did not make specific reference to the generic response guideline in his analysis of the implementation of the Red Book procedures on 13 April 2024.950 7.154 Counsel for Glad submit that they adopt the submissions advanced by Scentre on this issue.951 It was submitted that Glad takes the provision of security services: … very seriously, and consistently strives to implement and maintain measures that are proportionate, reasonable, and effective… Glad remains committed to continuous improvement and to upholding industry-leading standards in the delivery of security services.952 944 Written submissions of Counsel Assisting at [1110].
945 Written submissions of Counsel Assisting at [1111].
946 Written submissions on behalf of Scentre at [38].
947 Written submissions on behalf of Scentre at [39].
948 Written submissions on behalf of Scentre at [40].
949 Written submissions on behalf of Scentre at [43].
950 Written submissions on behalf of Scentre at [44].
951 Written submissions on behalf of Glad at [38].
952 Written submissions on behalf of Glad at [19].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.155 It was further submitted that, “despite not being required to”, Glad has developed and implemented a number of policies to “elevate its capability and to support both the environments Glad staff work in, and Scentre generally”.953 7.156 Counsel for Glad submitted that there is no reason why Mr Wilson’s evidence that the Red Book is excellent practice should not be accepted by the Court. It was submitted on behalf of Glad that the Red Book is a detailed document that assists Glad and its staff with training, policy, and procedure in respect of WBJ.954 Oral submissions 7.157 In oral submissions, Counsel Assisting submitted that Scentre policies and procedures for responding to an AAO “represented best practice.”955 7.158 Counsel for Glad submitted that Glad had made a number of changes to policy following 13 April 2024. This includes the implementation of a Crowded Places policy to “assist with what Scentre is already doing”, an enhanced security training programme, and the updating of all relevant policies and procedures related to situational awareness, AAO procedures, hostile reconnaissance, use of force, crowded places, and terrorism awareness.956 The changes implemented are further considered in Section K.
7.159 Counsel for Scentre submitted that a consideration arising from the features of AAO attacks is that: … the practical reality is that even the most robust security measures by operators of crowded places will not be able to completely prevent all active armed offender attacks and it can be impossible to predict particular attacks.957 7.160 I consider this aspect of the policy later in this Part. Counsel for Scentre submit that Scentre’s existing policies and procedures were industry-leading and best practice, and that was “acknowledged by Mr Wilson and is fairly reflected in the submissions of [Counsel Assisting].”958 Findings 7.161 In relation to the preparedness of Scentre, as stated by Mr Wilson: Scentre, as an organisation, were aware of the risks faced from an Active Armed Offender within their premises. They had specific comprehensive plans within their Red Book Guidance on how their staff should respond if such an attack took place.959 953 Written submissions on behalf of Glad at [20].
954 Written submissions on behalf of Glad at [45].
955 Transcript, Closing Submissions D1: T1924.1 (25 November 2025).
956 Transcript, Closing Submissions D1: T1959.34-T1960.40 (25 November 2025).
957 Transcript, Closing Submissions D2: T1964.22-24 (28 November 2025).
958 Transcript, Closing Submissions D2: T1964.33-34 (28 November 2025).
959 Exhibit 1, Expert Volume, Tab 20, Expert Report of Scott Wilson at [2.2].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.162 Mr Wilson described the Red Book as “excellent practice” and that it was probably one of the best prepared documents he had seen.960 I accept this evidence.
7.163 I accept the expert opinion of Mr Wilson regarding the Red Book and consequently the underlying policy approach of how Scentre personnel would respond to an AAO.
7.164 There is no criticism of the policy approach of Scentre to an AAO, and indeed, as indicated by Mr Wilson, they had drawn on worldwide practice and learnings in the content of the Red Book which reflected best practice in the response to an AAO.
960 Exhibit 1, Expert Volume, Tab 20, Expert Report of Scott Wilson at [3.1.14].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 D. Local security function at WBJ 7.165 As outlined in Section A, Scentre operates a number of shopping centres throughout Australia and New Zealand. Each shopping centre retains local management and has localised arrangements for contracting services, including for specialised security service providers.
7.166 The content of this section provides context for the assessment of the response of Scentre and Glad staff to the events of 13 April 2024, and is broken down into the following Sub-sections: Section D1 Provides an overview of the role of security guards Addresses the security arrangements at WBJ, including Section D2 the circumstances in which Glad came to be the security services provider Addresses the relevant security systems at WBJ and Section D3 appointments provided to security officers as at 13 April 2024
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 D1. The role of security officers 7.167 It is important, in assessing the response by Scentre and Glad to the events of 13 April 2024, to understand what exact role security officers have in responding to an AAO (or any other type of emergency incident).
7.168 Security officers in Australia are principally tasked with observing, reporting, and escalating incidents as they occur. They are not trained to engage with or attempt to detain offenders.961 7.169 In accordance with directives provided by the licensing body, the NSWPF Security Licensing and Enforcement Directorate (SLED), security guards are to ensure the safety and security of premises and individuals within those premises. But they are not trained or encouraged to engage in activities beyond their scope or ability.962 Evidence regarding the role of security officers 7.170 Evidence was received at Inquest regarding the role of security officers, including in response to an AAO.
7.171 The CEO of Glad, Steve Iloski, gave evidence that the general purpose of security officers is to act as a visible deterrent, monitoring unusual or suspicious behaviour and escalating when necessary, as well as performing an important customer service role.963 7.172 In the context of an AAO scenario, Mr Yates (Scentre) observed that while security guards are trained to de-escalate hostile situations, they are not trained or equipped to engage, detain or disarm an armed offender, and there is no expectation that they will do so.964 Security officers do not possess police powers and are generally not permitted to carry firearms or other prohibited weapons.965 7.173 Notably, no Glad employees are permitted to carry weapons or other “appointments”, and none did so on 13 April 2024.966 During an AAO scenario, their role is to prioritise the safety of themselves and others, by observing, reporting and escalating to relevant emergency services, such as NSWPF.967 7.174 Mr Helg, who was the Security Supervisor on duty at WBJ on 13 April 2024, explained that in the event of an AAO, his role was: 961 Transcript, D18 (Iloski): T1649.31-39 (26 May 2025).
962 Exhibit 1, Vol 30, Tab 995C, Third statement of Steve Iloski at [24]-[25].
963 Exhibit 1, Vol 30, Tab 995C, Third statement of Steve Iloski at [27].
964 Exhibit 1, Vol 42, Tab 1599, Statement of John Yates (Director of Security) at [108].
965 Exhibit 1, Vol 30, Tab 995C, Third statement of Steve Iloski at [23].
966 Transcript, D18 (Iloski): T1649.27-29 (26 May 2025).
967 Exhibit 1, Vol 30, Tab 995C, Third statement of Steve Iloski at [26].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 … to obtain situational awareness of the emergency and ensure that the Chief Warden and other security officers were made aware of what was occurring…also to provide immediate assistance to injured persons and to protect others where safe to do so.968 7.175 Mr Wilson gave evidence that the role of guards in an emergency was to “get people to safety and to do that in as safe a way as possible.”969 He further observed that: ... their role … isn't to go in there and start tackling armed offenders or terrorists, like it may be in some American states where they give them guns and tasers and batons.970 7.176 Mr Yates agreed with that evidence, stating: [T]heir role is to observe, report, escalate, help people get to safety, provide first aid. It is certainly not to engage.971 7.177 I accept the evidence of Mr Wilson and Mr Yates. The role of a security guard is to observe, report, and escalate incidents. Security guards are not trained to engage with offenders.
Security licensing 7.178 An individual working in the security industry in NSW must have completed the appropriate course at an accredited training provider and hold a current security licence.972 7.179 There are three classes and several subclasses of security licence which confer authorisation for defined security activities. As noted above, in NSW, security licensing is overseen by SLED. 973 7.180 The licence category of primary relevance with respect to the WBJ personnel present on 13 April 2024 is the Class 1A (Security Officer) licence.
Class 1A (Security Officer) 7.181 A Class 1A (Security Officer) licence authorises the licensee to carry on activities including:
(a) Patrol, protect or guard property while unarmed, whether static or mobile; and
(b) To act as a crowd controller or in a similar capacity. 974 968 Exhibit 1, Vol 42, Tab 1598, Second statement of Jerry Helg at [31].
969 Transcript, D14 (Wilson): T1256.21-22 (19 May 2025).
970 Transcript, D14 (Wilson): T1256.29-31 (19 May 2025).
971 Transcript, D15 (Yates): T1301.25-29 (20 May 2025).
972 Exhibit 1, Vol 45, Tab 1602A, Statement of Cameron Smith (Director of SLED) at [8].
973 Exhibit 1, Vol 45, Tab 1602A, Statement of Cameron Smith (Director of SLED) at [8]-[16], [29]-[39].
974 Exhibit 1, Vol 45, Tab 1602A, Statement of Cameron Smith (Director of SLED) at [17].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.182 To obtain a Class 1A security licence, a person must complete the NSW Security Licence Course, which includes:
(a) Completing a language and numeracy test;
(b) Obtaining a First Aid certificate from a Registered Training Organisation; and
(c) Obtaining either a Certificate II or Certificate III in Security Operations from a Registered Training Organisation. 975 7.183 The competency requirements for a Certification in Security Operations involve 14 units of competency to be gained over approximately 80 hours of classroom and/or online study.976 A security officer may also be required to undertake additional training relevant to the particular employer’s operational requirements and security policies and procedures.977 D2. Overview of security arrangements at WBJ 7.184 To provide context to the response of WBJ security personnel on 13 April 2024, it is necessary to consider the security arrangements in place within the context of the broader WBJ centre management arrangements.
Scentre 7.185 Scentre employ management teams responsible for the operation of their shopping centres. The management team includes persons who have oversight and responsibilities in respect of security functions, including emergency incident management.978 7.186 At WBJ, the Centre Management Team as at 13 April 2024 was comprised as follows. The relevant Centre management roles were:
(a) Centre Manager (CM), Luke Caleo;
(b) Retail Manager (RM), Joseph Gaerlan (on-duty); and
(c) Risk and Security Manager (RSM), Bradley Goldberg. 979 975 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [70]-[73].
976 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [71]-[72].
977 Exhibit 1, Vol 35, Tab 1135, Glad Group Security Training & Quality Assurance (QA) Procedure at [4.2].
978 Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg at [12]-[14], [18]-[20], [22]-[24], [28]-[30].
979 Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg at [12].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.187 Additionally, relevant assistant manager positions as at 13 April 2024 were:980
(a) Facilities Coordinator (FC), Tyson Rogers (on-duty); and
(b) Risk and Security Supervisor (RSS), Rahim Zaidi (on-duty).
Evidence from the Centre Management Team 7.188 Mr Gaerlan provided three statements and gave evidence at the hearing. Mr Gaerlan described his role (Retail Manager) as helping “… the retailers conduct their business within the centre in the best way possible”.981 Mr Gaerlan was Chief Warden on 13 April 2024.982 His actions on the day are addressed in Section F.
7.189 Mr Goldberg provided five statements and gave evidence at the hearing. His role as an RSM is addressed in this section. Mr Goldberg’s actions on 13 April 2024 are addressed in Section F.
7.190 Mr Zaidi provided two statements in this matter. Mr Zaidi was not required to give evidence. His role as RSS is explored in this section. Mr Zaidi’s actions on 13 April are addressed in Section F.
Service Agreements and the interaction with Centre Management roles 7.191 As addressed above, the Scentre Management Team utilises service agreements to engage specialist security subcontractors who provide security services and licensed, trained, and experienced security officers at WBJ.983 7.192 The Services Agreement with Glad also enables Glad to subcontract personnel from other authorised companies. The Services Agreement and subcontracting provisions are described in further detail below.
Role of the Risk and Security Manager/Supervisor 7.193 The Scentre Management Team includes an RSM and (at some locations) an RSS. The role of the RSM and RSS is “to oversee the security provider’s performance of its day-today duties under the Services Agreement”.984 The RSM’s job description provides that the RSM is to be “the eyes and ears of customer and employee safety and security”.985 7.194 Risk and security comprise a spectrum of potential liabilities. In evidence, Mr Goldberg, the RSM at WBJ, explained: 980 Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg at [13].
981 Transcript, D7 (Gaerlan): T475.1-5 (7 May 2025).
982 Transcript, D7 (Gaerlan): T476.14-16 (7 May 2025).
983 Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt at [12]-[13].
984 Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt at [14].
985 Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg at [14].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 … the role of a risk and security manager is to oversee all the risks associated, so it's not just relating to security risks. It's public liabilities, slips and falls, work health safety risks, as well as compliance along those lines. 986 7.195 Part of the RSM’s role at WBJ (and at other Scentre shopping centres) is to liaise with and build working relationships with the relevant Police Area Command (PAC), and other emergency services as well as the Local Emergency Management Committee, which includes representatives from local councils, emergency services, and NSW Health.987 7.196 Mr Goldberg maintains a working relationship with Eastern Suburbs Police Area Command (ES PAC) under Superintendent Jodi Radmore (Supt Radmore). Mr Goldberg gave evidence as to how he engages with local police: We meet monthly at a minimum where we'll sit down and we'll talk about issues in the community, we'll talk about issues in the centre, we'll talk about potentially any threats to the greater community and or us, and then we'll talk further enhancing things.
We talk about when new police are coming through, we offer - and we normally work together and bring probationary constables through to get familiar with the centre. And we talk about loss prevention. We arrange loss prevention and retailer information forums which we hold normally on an annual basis where we invite the retailers to come and give them an opportunity to understand their rights and responsibilities directly from the police what they can and can't do, and how we can assist with them. So we work well together. 988 7.197 Of particular relevance, Mr Goldberg has a close working relationship with Detective Inspector Adam Solah (DI Solah), who was the Acting Crime Manager at ES PAC on 13 April 2024. DI Solah explained the relationship in his statement: Eastern Suburbs PAC has regular engagement with Westfield Bondi Junction to discuss any issues arising, such as youth crime, shoplifting/larceny or large events. While I had some communications with Mr Bradley Goldberg (Risk and Security Manager at Westfield Bondi Junction) in my role as a Duty Officer (Inspector) at Eastern Suburbs, I have come to meet and speak with Mr Goldberg more regularly and develop a working relationship with him in my capacity as Crime Manager coming from about July 2023.989 7.198 DI Solah and Mr Goldberg met approximately once a month and stored each other’s personal mobile phone number to allow them to arrange meetings or call one another depending on the nature of the issues to be discussed.990 This close relationship played an important role during the events of 13 April 2024, as addressed in Section F regarding the chronology of events that day.
986 Transcript, D9 (Goldberg): T722.46-49 (9 May 2025).
987 Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg at [24].
988 Transcript, D9 (Goldberg): T724.39-T725.2 (9 May 2025).
989 Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg at [26]; Exhibit 1, Vol 13, Tab 695A, Supplementary Statement of Detective Inspector Adam Solah at [10]-[11].
990 Exhibit 1, Vol 13, Tab 695A, Supplementary Statement of Detective Inspector Adam Solah at [10]-[11].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Scentre’s Tenant’s/Retailer’s Security Arrangements 7.199 Mr Goldberg, in his statement, explained that retailers within Westfield Bondi have “a large degree of autonomy over the fit out and security arrangements in their store.”991 This includes the type of doors selected for a tenancy and internal security arrangements (such as additional security guards). Large retailers, like Myer, have “their own mimic EWIS and procedures” independent of the Scentre WBJ security procedures and systems.992 7.200 Larger retailers at Westfield Bondi, including Apple, Chanel, and David Jones, have security plans and associated training for their own employees.993 7.201 As part of the coronial investigation into the events of 13 April 2024, further evidence was sought from retailers at WBJ regarding security arrangements.
7.202 Chanel is a French fashion brand with locations in WBJ. Felicity Tighe, Senior Work Health and Safety Manager at Chanel, provided a statement in the Inquest. Ms Tighe explained Chanel had policies developed in line with the National Counter Terrorism Security Office and Australian National Security recommendations.994 Similarly, in a statement provided on behalf of David Jones, Louise Harding, Chief People Officer, explained that David Jones had an Emergency Management Plan in operation, which aligned with Australian Standard 3745-2010: Planning for Emergencies in Facilities.995 On 13 April 2024, David Jones implemented evacuation procedures in accordance with its own internal plans, which resulted in all entrances and exits being locked down and the store cleared of all customers and team members by approximately 3:55pm.996 7.203 Smaller retailers, such as Sourdough Bakery and Café and Louna Hair and Beauty (which occupy kiosks located in thoroughfares in WBJ) lack the means to “close and secure [their] store like other enclosed retail shops”.997 At the time of the incident, Sourdough Bakery and Café and Louna Hair and Beauty did not have formal security plans in place or associated training.998 7.204 Mr Goldberg in his evidence observed that regular tenant and retailer training occurs at WBJ in relation to evacuation and lockdown procedures.999 991 Exhibit 1, Vol 44, Tab 1600A, Supplementary statement of Bradley Goldberg at [150].
992 Exhibit 1, Vol 44, Tab 1600A, Supplementary statement of Bradley Goldberg at [150].
993 Exhibit 1, Vol 52, Tab 1659, Letter from McCullough Robertson Lawyers (Apple); Exhibit 1, Vol 52, Tab 1660, Letter from Louise Harding (David Jones); Exhibit 1, Vol 53, Tab 1666, Statement of Felicity Tighe (Chanel).
994 Exhibit 1, Vol 52, Tab 1666, Statement of Felicity Tighe (Chanel) at [34].
995 Exhibit 1, Vol 52, Tab 1660, Letter from Louise Harding (David Jones) at p. 71. See also Annexure G, Safety and Security Awareness Poster at p. 310.
996 Exhibit 1, Vol 52, Tab 1660, Letter from Louise Harding (David Jones) at p. 2.
997 Exhibit 1, Vol 52, Tab 1664, Statement of Denis Tarasov (Owner of Sourdough Bakery and Café) at [16].
998 Exhibit 1, Vol 52, Tab 1664, Statement of Denis Tarasov (Owner of Sourdough Bakery and Café) at [18]; Exhibit 1, Vol 52, Tab 1665, Statement of Louna Calavera (Founder of Louna Hair and Beauty) at p. 2.
999 Exhibit 1, Vol 44, Tab 1600A, Supplementary statement of Bradley Goldberg at [151].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.205 The steps taken in onboarding and liaising with retailers in respect of security practices was described in the statement of Mr Gaerlan. These include:
(a) Involvement of retailers in twice-annual practical simulation evacuation exercises, conducted by an external training provider;1000
(b) Conducting onboarding for retailers, involving: i. Discussion of operational specifics with senior business stakeholders;1001 ii. Provision of a physical copy of a “Risk and Security Poster” with a QR code to access a summary video produced by Scentre;1002 and iii. An evacuation diagram identifying the location of the retailer;1003 and
(c) Email correspondence providing key Scentre Management Contacts, a digital copy of the “Risk and Security Poster”, and a copy of the “Work Health and Safety Information Pack”.1004 7.206 Mr Yates, in his statement, described Scentre’s engagement with retailers in respect of AAO awareness: AAO awareness continues to be provided by Scentre to all retailers. Scentre cannot compel retailers to undertake training or attend exercises and does not have awareness in respect of retailer staffing or training that is conducted by individual retailers. Prior to 13 April 2024, training material was provided to retailers at the Centre which included videos and posters to support training of their own staff and this continues to be the case. In addition, retailers continue to be invited to attend emergency evacuation exercises at the Centre twice a year. 1005 7.207 For completeness, certain “smaller” retailers (namely Sourdough Bakery and Café and Louna Hair and Beauty) gave evidence that they had not been invited to participate in the “emergency drills” organised by Scentre.1006 This was not an area of particular focus during the Inquest. Without attributing any blame or criticism, the evidence from those smaller retailers demonstrates there may be an opportunity for greater engagement between Scentre and those smaller retailers. This could potentially involve the implementation of more definitive plans and steps to be taken in the event of an AAO, or 1000 Exhibit 1, Vol 45, Tab 1600D, Supplementary statement of Joseph Gaerlan at [62], [85]; Transcript, D7 (Gaerlan): T479.37-47; T521.8-14 (7 May 2025).
1001 Exhibit 1, Vol 45, Tab 1600D, Supplementary statement of Joseph Gaerlan at [79].
1002 Exhibit 1, Vol 45, Tab 1600D, Supplementary statement of Joseph Gaerlan at [79], [81]. See also, Exhibit 1, Vol 37, Tab 1109 for a copy of this poster and Exhibit 1, Vol 44, Tab 1600A, Supplementary statement of Bradley Goldberg, Annexure T for a copy of the Safety and Security Awareness training video provided to retailers. Mr Gaerlan gave evidence that the Retail Awareness Poster is a “key touch point of the retail orientation into the centre” (see Transcript, D7 (Gaerlan): T504.22-25 (7 May 2025).
1003 Exhibit 1, Vol 45, Tab 1600D, Supplementary statement of Joseph Gaerlan at [79]-[81].
1004 Exhibit 1, Vol 45, Tab 1600D, Supplementary statement of Joseph Gaerlan at [83], [87]. Examples of correspondence appear at Exhibit 1, Vol 45, Tab 1600D, Supplementary statement of Joseph Gaerlan, Annexures E-K. See also the summary at Exhibit 1, Vol 44, Tab 1600A, Supplementary statement of Bradley Goldberg at [150]-[155].
1005 Exhibit 1, Vol 42, Tab 1599A, Supplementary statement of John Yates at p. 41.
1006 Exhibit 1, Vol 52, Tab 1664, Statement of Denis Tarasov (Owner of Sourdough Bakery and Café) at [18]; Exhibit 1, Vol 52, Tab 1664, Statement of Denis Tarasov (Owner of Sourdough Bakery and Café) at p. 2.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 further dissemination of the “Escape. Hide. Tell.” messaging. As addressed below at Section K, there has been a noticeable increase in such engagement since the events of 13 April 2024.
Glad 7.208 As of 13 April 2024, Scentre had engaged Glad to provide specialist security services at WBJ for the period 4 September 2023 to 3 September 2028. This is governed by the terms of the Services Agreement.
7.209 Glad won the contract in 2023 from another security services provider, SecureCorp, whose contract term was approaching completion.1007 7.210 The Services Agreement sets out Glad’s responsibilities, including staffing, training, compliance, daily security operations, and use of subcontractors.
7.211 As indicated above, Scentre directly employed an RSM and RSS at WBJ whose roles include oversight of Glad’s performance of its day-to-day security related duties under the Services Agreement.1008 7.212 The following Glad employees were involved in the delivery of the Services Agreement in the period 12 September 2023 to 13 April 2024:
(a) Mr Andrew David, former Project and Training Manager at WBJ. Mr David had responsibility for training Glad staff in WBJ security policies and procedures from around October 2023 onwards.1009 Mr David was involved in training the security team - primarily in testing and signing off on competencies of security officers following training provided to them by the Supervisor or Assistant Supervisor, prior to final sign off by the RSM;1010
(b) Mr Shaun Luxford, Customer Service Manager (also referred to as an “Account Manager”) (up to December 2023);1011 and
(c) Mr Cameron Stuart, Glad Security Manager for NSW/ACT. Mr Stuart also performed the role of Account Manager for WBJ from December 2023 to May 2024.1012 7.213 Mr Iloski, the CEO of Glad, did not play a direct role in the delivery of security services under the Services Agreement.1013 1007 Transcript, D9 (Stuart): T693.42-47 (9 May 2025); Transcript, D18 (Iloski): T1643.46-T1644.13 (26 May 2025).
1008 Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt at [14].
1009 Exhibit 1, Vol 49, Tab 1609B, Statement of Andrew David at [8].
1010 Transcript, D8 (David): T608.8-9; T611.28-29 (8 May 2025); Transcript, D8 (Fatima): T657.4-12 (8 May 2025).
1011 Exhibit 1, Vol 30, Tab 995A, Statement of Shaun Luxford at [5].
1012 Transcript, D9 (Stuart): T694.5-30 (9 May 2025).
1013 Transcript, D18 (Iloski): T1645.4-23 (26 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Change of security service providers at WBJ 7.214 As noted above, Glad took over the provision of security services at WBJ in around September 2023, following the end of the previous security contract held by SecureCorp.1014 7.215 In the period leading up to Glad taking over security operations at WBJ, a number of experienced security officers employed by SecureCorp were offered the opportunity to transfer their employment to Glad. Many of those staff chose not to transfer and ceased working at WBJ in around September 2023.1015 7.216 Mr Iloski explained the departure of experienced guards from Westfield Bondi Junction in his evidence: The reason being at the time, the previous incumbent, Securecorp had been there for a long time and, and held the contract. A lot of the staff had tenure with the previous organisation, and you tend to find that when staff have long tenure they tend to leave with the provider, and particularly in an industry, there's a shortage of officers at the moment so there's, there's no - there's, there's definitely work for them, so they moved on. 1016 7.217 The result of this was that there was a pressing need for Glad to fill a number of security roles at WBJ from October 2023 onwards.
7.218 Glad utilised its workforce and approved subcontractors to comply with its staffing obligations under the Services Agreement. However, in late 2023, it was identified that there was a need to recruit additional security staff – in particular, staff who would work in the CCTV Control Room as a CCTV Control Room Operator.1017 7.219 The need to recruit additional security officers further increased in October 2023, when in response to increased security threats arising from the outbreak of conflict in Israel and Gaza, Scentre management increased security measures at WBJ, including requiring seven to 12 additional security officers per shift.1018 7.220 Evidence before the Inquest demonstrated that the need for further recruitment manifested as “pressure”: 1014 Transcript, D9 (Stuart): T693.42-47 (9 May 2025).
1015 Exhibit 1, Vol 44, Tab 1600A, Supplementary statement of Bradley Goldberg at [53].
1016 Transcript, D18 (Iloski): T1644.8-13 (26 May 2025).
1017 Transcript, D8 (David): T630.21-50 (8 May 2025); Exhibit 1, Vol 44, Tab 1600A, Supplementary statement of Bradley Goldberg at [53].
1018 Transcript, D9 (Goldberg): T769.46-T770.1 (9 May 2025); Exhibit 1, Vol 44, Tab 1600A, Supplementary statement of Bradley Goldberg at [57].
(a) Mr David gave evidence that recruitment generally was difficult due to the location of WBJ, as many of Glad’s employees live in Western Sydney.1019 Mr David further observed that: … was there pressure for…staffing and recruitment in general for… Westfield Bondi, absolutely. As I said earlier, recruitment was always a major concern.1020
(b) Mr Goldberg acknowledged there was pressure to retain more CCTV Control Room Operators;1021 and
(c) Mr Goldberg in his statement further described recruitment difficulties for security personnel, including as a result of the reduced size of the workforce following the COVID pandemic and certain government visa requirement changes in 2023.1022 This included: Prior to, to Glad taking over, we had a security team on site which had been there for five plus years. They were very experienced. They've had a lot of experience in that time they, they worked together. They gelled well and formed.
When the contract changed over, 70% of the staff declined to stay on, which normally when there's a contract transition, normally a lot of the staff stay on.
So we were left with two CCTV controllers at that time, and we did need to start recruiting, or Glad needed to start fulfilling the roles of the 5 required staff. 1023 7.221 In those circumstances, in late 2023, Glad created the position of Project and Training Manager to manage the onboarding and training of security personnel at WBJ. Mr David was employed in this position between October 2023 and March 2024. His principal role was to assist with the training of staff at WBJ.1024 7.222 There were particular difficulties associated with identifying suitable and willing candidates to work as a CCTV Control Room Operator at WBJ.
7.223 Ms Fatima gave evidence of the challenges associated with the CCTV Control Room Operator position, including long shifts and sedentary work, all of which occurred in a high-pressure environment.1025 She described the role as requiring a person to be courageous and requiring a person to assume significant responsibility. She gave evidence that not a lot of people want to do the job, and while CCTV Control Room Operators are paid more than retail rovers generally, they are paid “not as much as we should [be]”.1026 Further evidence regarding the stressful nature of the role is addressed below.
1019 Transcript, D8 (David): T615.41-T616.4 (8 May 2025).
1020 Transcript, D8 (David): T624.33-35 (8 May 2025).
1021 Transcript, D9 (Goldberg): T751.16-18; T752.49-50 (9 May 2025).
1022 Exhibit 1, Vol 44, Tab 1600A, Supplementary statement of Bradley Goldberg at [53]-[54].
1023 Transcript, D9 (Goldberg): T740.27-32 (9 May 2025).
1024 Exhibit 1, Vol 44, Tab 1600A, Supplementary statement of Bradley Goldberg at [55].
1025 Transcript, D8 (Fatima): T645.22-25 (8 May 2025).
1026Transcript, D8 (Fatima): T647.31-44 (8 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.224 In late 2023, there were discussions between Scentre and Glad in respect of expanding the pool of CCTV Control Room Operators at WBJ.1027 7.225 Mr Goldberg gave evidence in respect of efforts to recruit CCTV Control Room Operators in that period.1028 Mr Goldberg acknowledged there were significant difficulties as of September 2023 to attract CCTV Control Room Operators and that further steps needed to be taken. That included: We had meetings with Glad just in regards to general recruiting of staff. Glad put in a lot of incentives and measure throughout their networks. They raised what was then the pay rate I believe that they were paying that role to try and attract more people. They also put out referral bonuses to all their staff, and they also tried to get controllers that were at other centres to try and come across to Bondi.1029 7.226 The staffing pressures, including the need to recruit further CCTV Control Room Operators, continued up until March 2024.
Further security subcontractors 7.227 The Services Agreement provides that Glad may utilise further sub-contracted security officers from “authorised providers” approved by Scentre.1030 7.228 The authorised provider for WBJ is Falcon Manpower Solution Pty Ltd (Falkon). Mr Murtaza Manzoor, a Director of Falkon, provided two statements and gave evidence at the hearing.
7.229 Sub-contractors such as Falkon are used to meet rostering requirements at WBJ during times when Glad is unable to meet the staffing requirements with directly employed staff and where additional security officers are required, such as during holiday periods.1031 7.230 Security officers directly employed by Glad are referred to as “core” guards.
Subcontracted security officers are referred to as “ad-hoc” guards.1032 Generally, ad-hoc guards are employed on a temporary or casual basis.1033 Mr Iloski described the distinction in evidence: So core guards … are prescribed to … manning levels that are in the master service agreement, and we ensure that we adhere to those manning levels. They're direct employees. If there are any requests of search [sic] capacity or any requirements on 1027 Exhibit 1, Vol 44, Tab 1600A, Supplementary statement of Bradley Goldberg at [128].
1028 Transcript, D9 (Goldberg): T740.18-32 (9 May 2025).
1029 Transcript, D9 (Goldberg): T740.27-32 (9 May 2025).
1030 Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt, Annexure B, Scentre Group Services Agreement (4 September 2023 – 3 September 2028); Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg at [40].
1031 Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt, Annexure B, Scentre Group Services Agreement (4 September 2023 – 3 September 2028); Transcript, D9 (Goldberg): T722.6-19 (9 May 2025).
1032 Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg at [38]-[39].
1033 Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg at [39].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 short notice, we do have an approved partner that we use, in this instance for Bondi was Falkon, and we, would call upon them on a, on a short-term basis.1034 7.231 Mr Manzoor explained the role of Falkon in supplying security officers to WBJ: We, we provide manpower to other security companies, whenever they need any security staff, they request us on ad hoc basis or a permanent basis, depends. So whenever they request we just provide them a competent, licensed security guard as per the law. We check all of their compliances, if they are valid and once every - check
7.233 As of 13 April 2024, the roles included:
(a) Retail Rover (also referred to as Rover);
(b) Security Supervisor (also referred to as Site Manager or S1);
(c) Assistant Security Supervisor (also referred to as Assistant Site Manager or S2); and
(d) CCTV Control Room Operator (also referred to as Controller or Control). 1036 7.234 A short summary of each of these roles is set out below.
Retail Rover 7.235 Security officers who undertake duties in the public areas of WBJ are referred to as “Retail Rovers” or “Rovers”. Their responsibilities are described by Ms Hunt as “providing a secure and safe environment for all of the Centre’s staff, contractors, tenants, 1034 Transcript, D18 (Iloski): T1645.38-44 (26 May 2025).
1035 Transcript, D18 (Manzoor): T1687.44-T1688.8 (26 May 2025).
1036 Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg at [31]-[33].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 customers and visitors.”1037 The specific roles of security officers performing the role of a “rover” at WBJ are further set out in the Site Orders.1038 7.236 Security officers are expected to observe and report in respect of incidents they identify or respond to. Reports are made to the CCTV Control Room Operator and escalated as necessary to the Site Supervisor or RSM/RSS.1039 7.237 In exceptional circumstances, a security officer may exercise common law powers of arrest.1040 Security Supervisor and Assistant Security Supervisor 7.238 Jerry Helg was the Security Supervisor on duty on 13 April 2024. Mr Helg provided two statements and gave evidence at the hearing. Mr Helg described his role as: Managing the guards on the floor, managing different incidents, respond[ing] to the different incidents on the floor, and - yeah. There's pretty much training – a lot of training of the guards. 1041 7.239 The Security Supervisor plays a key role in the delivery of security services at WBJ. The Site Orders provide that the Security Supervisor performs the following: 1042
(a) Allocating duties and deploying staff in line with the Site Orders and as required during the shift;
(b) Ensuring compliance with all Scentre policies and procedures by all Security Officers;
(c) Ensuring all Security Officers are properly trained and have been signed off on relevant tasks prior to undertaking those duties unsupervised;
(d) Overseeing incidents and deploying staff as required;
(e) Ensuring any security or safety vulnerability that has been identified is reported in a timely manner and via the appropriate channels; and
(f) Ensuring that only staff members approved by the RSM and competent in the use of the CCTV system operate that system.
1037 Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt (Part 1) at [15]-[16].
1038 Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt (Part 1), Annexure C, Scentre Group Security: Site Orders (v 1.1) (dated 29 January 2022) at p. 201.
1039 Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt, Annexure C, Scentre Group Security: Site Orders (v 1.1) (dated 29 January
1040 Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt (Part 1), Annexure C, Scentre Group Security: Site Orders (v 1.1) (dated 29 January 2022) at p. 201.
1041 Transcript, D7 (Helg): T551.14-16 (7 May 2025).
1042 Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt (Part 1), Annexure C, Scentre Group Security: Site Orders (v 1.1) (dated 29 January 2022) at p. 200.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.240 Ms Fatima was an Assistant Security Supervisor at WBJ from late March 2024.1043 She described her role as: I am responsible for ensuring that Glad security officers have accessed and completed all necessary training and induction materials. I also supervise security officers during their shifts to ensure they are adequately trained. 1044 7.241 Both the Security Supervisor and Assistant Security Supervisor roles have a large training emphasis. Ms Fatima gave evidence in relation to her role and the training of staff: Both as at 13 April 2024 and currently, my role involves training Glad employees to ensure they meet the requirements outlined in Scentre's training documents. I train all security personnel, using the materials provided to me by Scentre… I regularly review and audit the knowledge of Glad security personnel. Upon testing a staff member, I am able to either pass them or identify the areas they need to improve. In such cases, approval is then required from the state manager after I have audited the staff member.
On occasion, I also conduct random reviews of the performance of staff members following incidents at the centre. For example, if I am not satisfied with the performance of a security officer, I will review any footage of their performance before identifying any issues with them, and retraining them to improve their performance. 1045 CCTV Control Room Operator 7.242 The CCTV Control Room Operator manages the CCTV captured throughout WBJ and assists in coordinating responses to incidents that are reported to the CCTV Control Room. Incidents may relate to customer assistance, contractor enquiries, maintenance and facilities, or general security matters.1046 7.243 The CCTV Control Room Operator reviews CCTV footage to “ensure any security or safety vulnerability that has been identified is reported in a timely manner and via the appropriate channels.” 1047 In addition, the CCTV Control Room Operator is expected to fulfil duties such as completing administrative tasks, escalating major incidents using the appropriate channels, deploying staff to incidents as required, and ensuring accurate details are obtained for first aid and public liability incidents.1048 7.244 Mr Helg gave evidence regarding the CCTV Control Room Operator’s role: … as a CCTV [O]perator you're sort of managing the day to day tasks, rostering the guards, managing different incidents at once and - yeah - just sort of managing the guards and managing different incidents. Any sort of – any sort of task that gets reported 1043 Exhibit 1, Vol 48, Tab 1609C, Statement of Lulu Fatima at [11].
1044 Exhibit 1, Vol 48, Tab 1609C, Statement of Lulu Fatima at [10].
1045 Exhibit 1, Vol 48, Tab 1609C, Statement of Lulu Fatima at [45]-[47].
1046 Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg at [36].
1047 Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt (Part 1), Annexure C, Scentre Group: Security Site Orders (v 1.1) (dated 29 January 2022) at p. 203.
1048 Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt (Part 1), Annexure C, Scentre Group: Security Site Orders (v 1.1) (dated 29 January 2022) at p. 203.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 we would - we would then direct it to the right person. For example, facilities, car park or cleaning. We'll assist in directing any issues towards them. That would be as the CCTV Control Room Operator. 1049 7.245 At WBJ, the role of CCTV Control Room Operator was acknowledged to be demanding and stressful.
7.246 In evidence, Mr Helg described the stressful nature of the role: … it's one of the most stressful roles that we have at Westfield… There's so much liability and lots of responsibilities on the controlling operator to take on managing different incidents. There could be two or three medical incidents happening at once, and the controlling operator needs to understand which team she has on, which team is good at responding to different incidents. And yeah it's just a really stressful role. You've got to manage different incidents, fire alarms, manage different guards, manage their breaks. So, yeah it's one of the most stressful roles. 1050 7.247 Ms Fatima described the CCTV Control Room Operator position as a specialised role.1051 She gave evidence that the number of cameras and views at WBJ makes the role difficult, requiring time in order to become familiar with the camera locations.1052 She described the role as involving both active and responsive monitoring of CCTV, with static images on 14 monitors displaying critical infrastructure and high-risk areas. She observed the role involves actively monitoring several monitors displaying CCTV footage “every five to seven minutes and then to just skim through and scan through to make sure things are going smooth.”1053 7.248 Mr Yates gave evidence that the CCTV monitoring deployed at WBJ was not “real time”, that is, the CCTV Control Room Operator is not required to continuously scan the monitors looking for or attempting to identify potential issues or threats. Rather, the CCTV Control Room Operator relies on information provided from roving security officers on the floor to enable the Operator to locate a particular camera view to observe a notified incident.1054 7.249 As at 13 April 2024, there was no written policy or procedure that specified that the CCTV Control Room was not to be left unoccupied. As addressed further below, an unattended CCTV Control Room can result in serious issues, as evidenced by the events of 13 April 2024.
7.250 Mr Goldberg gave evidence that it was his “expectation” that the CCTV Control Room would never be left unattended: for instance, if the Operator needed to take a bathroom 1049 Transcript, D7 (Helg): T550.30-35 (7 May 2025).
1050 Transcript, D7 (Helg): T552.46-T553.7 (7 May 2025).
1051 Transcript, D8 (Fatima): T644:18-25 (8 May 2025).
1052 Transcript, D8 (Fatima): T646:40-44 (8 May 2025).
1053 Transcript, D8 (Fatima): T666.17-38 (8 May 2025).
1054 Transcript, D15 (Yates): T1306.27-T1307.34, T1359.7-9 (20 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 or lunch break, appropriate coverage from another member of staff should first be arranged.1055 7.251 Ms Fatima gave evidence that her general practice was to take her radio with her to the bathroom.1056 In addition to required breaks, Ms Fatima described receiving ad hoc check-ins from the RSS and RSM to assist with maintaining focus and concentration during shifts, including standing, moving about and stretching while the RSS or RSM relieved her.1057 7.252 Mr Helg also gave evidence that there was no formal policy in place regarding breaks and that he would get a supervisor to relieve him when required.1058 7.253 Mr Wilson expressed his expert opinion that during core trading hours, there should always be an appropriately trained security officer in the CCTV Control Room with access to the various security systems.1059 7.254 The lack of a clear written policy has been subsequently addressed by Scentre. There are now placards placed in the CCTV Control Room which make clear that the CCTV Control Room is to be constantly staffed.1060 The placard is depicted below:1061 Figure 13: CCTV Control Room placard 1055 Transcript, D9 (Goldberg): T742.24-T743.47 (9 May 2025).
1056 Exhibit 1, Vol 48, Tab 1609C, Statement of Lulu Fatima at [15]-[16]; Transcript, D8 (Fatima): T645:27-T646.14 (8 May 2025).
1057 Exhibit 1, Vol 48, Tab 1609C, Statement of Lulu Fatima at [22].
1058 Transcript, D7 (Helg): T554.5-12 (7 May 2025).
1059 Exhibit 1, Expert Vol, Tab 20, Expert Report of Scott Wilson at [6.1.4]; Transcript, D15 (Wilson): T1304.12-15 (20 May 2025).
1060 Transcript, D9 (Helg): T742.24-T743.47 (9 May 2025).
1061 Exhibit 1, Vol 42, Tab 1599B, Third statement of John Yates at [68].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.255 Mr Goldberg emphasised that it has also been made clear to all CCTV Control Room Operators that appropriate coverage must first be obtained before any breaks are taken, no matter how short.
Emergency Roles 7.256 In addition to the day-to-day functions and responsibilities of security officers, Glad’s security team and Scentre management are assigned emergency roles to be assumed in the event of an emergency incident. Emergency roles include Chief Warden, OnScene Coordinator, and CCTV Control Room Operator.1062 These roles have functions set out in the Red Book, Green Book, and Site Orders.1063 7.257 At WBJ, the Daily Centre Emergency Roles (DCER) document establishes which persons are to assume the particular roles should an emergency eventuate during a shift.1064 The DCER is circulated daily amongst Scentre management and senior staff and is discussed in a “team huddle” of rostered managers and senior staff at the commencement of trading each day.1065 Management of Services Agreement 7.258 The management of the Services Agreement is principally achieved through weekly operational meetings, which address security operations at WBJ.
7.259 The meetings are held between Scentre and Glad security personnel leadership. The purpose of those meetings was, as explained by Mr Stuart: Just to go through contract compliance, so we would discuss issues on site, invoicing issues, staff performance, upcoming events that may require additional staffing, training needs, general overall operational discussions. 1066 7.260 Glad kept minutes of these meetings. Those minutes were iterative and updated at each meeting (without removing the content of the previous minutes).1067 The minutes distinguished between various topics. Dated notes recording action items and updates relevant to each topic were added to each section.1068 1062 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [15]-[18]; Exhibit 1, Vol 48, Tab 1608A, Fifth Statement of Bradley Goldberg, Annexure D, Daily Centre Emergency Roles sheet (dated 13 April 2024).
1063 Exhibit 1, Vol 29, Tab 993 , Statement of Emily Hunt (Part 2), Annexure D, Scentre Group: Emergency Plan – Emergency Response Procedures (Issue 36) (‘Red Book) (dated February 2024); Exhibit 1, Vol 30, Tab 993, Statement of Emily Hunt (Part 3), Annexure E, Scentre Group: Emergency Plan – Pre-Response Planning (Issue 7) (“Green Book”) (dated September 2023); Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt (Part 1), Annexure C, Scentre Group: Site Orders, Westfield Bondi Junction (v 1.1) (dated 29 January 2022).
1064 Exhibit 1, Vol 45, Tab 1600D, Supplementary Statement of Joseph Gaerlan at [15]. See also, Exhibit 1, Vol 48, Tab 1608A, Fifth Statement of Bradley Goldberg, Annexure D, Daily Centre Emergency Roles sheet (dated 13 April 2024).
1065 Exhibit 1, Vol 45, Tab 1600D, Supplementary Statement of Joseph Gaerlan at [15]-[16]. See also, Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [19]-[21].
1066 Transcript, D9 (Stuart): T701.48-50 (9 May 2025).
1067 Transcript, D9 (Stuart): T702.25-27 (9 May 2025).
1068 See, for example, Exhibit 1, Vol 37, Tab 1231, Weekly Operational Minutes.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.261 Generally, Mr Goldberg and Mr Helg attended all meetings. Mr Zaidi, Mr Stuart, and Mr David also attended frequently, as well as other Scentre/Glad personnel who attended from time to time.1069 Submissions Written submissions 7.262 Counsel Assisting provided written submissions regarding the security arrangements at WBJ. It was submitted that Scentre relies upon various security subcontractors for the provision of staff and the delivery of the security function across its shopping centres. In the case of WBJ, that subcontractor is Glad. As noted above, Glad may in turn further subcontract security staff from other providers on an “ad-hoc” basis.
7.263 It was submitted by Counsel Assisting that there are various models that can be utilised by operators of crowded places in order to ensure that the security of those venues is adequately protected. There are various commercial, logistical, and capability factors that will determine which model is the best fit for a particular business.
7.264 Counsel Assisting submitted that there was no evidence before the Inquest to suggest that, had a different model been implemented (for instance, a fully insourced model), the preparedness for, or response to, the events of 13 April 2024 would have been any different.
7.265 It was submitted that Scentre was aware of and actively invested in minimising the risks posed to it as an operator of crowded places (as well as more general potential risks faced by it) and has a dedicated National Security function.
7.266 Counsel Assisting submitted that Scentre has oversight of the security specialists at its centres through the RMS and RSS roles (as applicable), and is actively involved in security management, including engagement with local police and other emergency responders. Scentre is responsible for establishing the applicable security policies and procedures that its specialist security subcontractors are required to comply with.
7.267 Counsel Assisting submitted that (as demonstrated in the evidence outlined below in Section E), Scentre is involved in the selection and approval of staff for roles as a security officer (including in respect of critical roles, such as that of CCTV Control Room Operator) and is involved in the training provided to those security staff.
7.268 It is submitted that the system used by Scentre is not a system of “set and forget”. There is a continual process of engagement between Scentre and its security subcontractors in relation to all aspects of the security function, including monitoring of Glad’s performance on a monthly basis. The evidence before the Inquest was that of a robust working relationship between Scentre and Glad. Mr Wilson observed that the Services 1069 Transcript, D9 (Stuart): T703.6-22 (9 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Agreement between Scentre and Glad was a “comprehensive document” and represented “good practice”. Counsel Assisting submits that this evidence should be accepted.1070 7.269 Counsel Assisting submitted that during the course of the Inquest, certain “gaps” emerged in part as a result of the subcontracting arrangements. These included:
(a) That “ad-hoc” security staff (that is, those security staff provided by Glad’s subcontractor, Falkon) did not receive the full suite of training provided to security staff employed directly by Glad; and
(b) Further, certain guards present on 13 April 2024 were not provided by the approved subcontractor, Falkon, and were rather employed by a further subcontractor of Falkon.
7.270 Counsel Assisting submits that when identified, each of these issues were promptly attended to by Scentre. Subcontracted security staff provided by Falkon now receive additional training before the commencement of their shift at WBJ, including mandatory online induction training addressing AAOs.1071 It is submitted that this is a positive development, and Mr Wilson reflected similar views in his first report.1072 7.271 It was submitted by Counsel Assisting that evidence provided during the Inquest identified that GLA2 (addressed below, and who was responsible for the initial alert to Mr Cauchi’s attacks on 13 April 2024) was an employee of Cogent Security & Services Pty Ltd, a subcontractor of Falkon. As indicated above, this was not a matter known to Glad prior to the Inquest.1073 7.272 Counsel Assisting submitted that the CEO of Falkon, Mr Manzoor, acknowledged that this should not have occurred and was a mistake. Mr Manzoor further provided details of the steps that Falkon has subsequently taken to ensure such issues do not occur in future with respect of WBJ, including additional sign-offs and periodic reviews of staff provided to Glad.1074 7.273 It was submitted that Glad also has the ability under its Master Services Agreement with Falkon to conduct random audits, so Glad can verify the employment status of all security staff provided by Falkon.1075 7.274 Ultimately, Counsel Assisting submitted that no significant criticism can be attached to the above issues that arose as a result of the subcontracting model implemented at WBJ.
There is no evidence that such matters directly contributed to the issues that emerged 1070 Exhibit 1, Expert Vol, Tab 20, Expert Report of Scott Wilson at [3.1.2].
1071 Exhibit 1, Vol 41, Tab 1581, Statement of Murtaza Manzoor at [10]-[16]; Exhibit 1, Vol 41, Tab 1581A, Supplementary Statement of Murtaza Manzoor at [18]-[19].
1072 Exhibit 1, Expert Vol, Tab 20, Expert Report of Scott Wilson at [2.3].
1073 Transcript, D18 (Iloski): T1647.46-T1648.32 (26 May 2025).
1074 Transcript, D18 (Manzoor): T1691.21-39 (26 May 2025).
1075 Transcript, D18 (Iloski): T1648.23-36 (26 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 in respect of the events of 13 April 2024. Moreover, the issues, when identified, were promptly addressed.
7.275 In written submissions on behalf of Scentre, it was submitted that Scentre had taken on board the submissions of Counsel Assisting, suggesting greater engagement with smaller retailers, and since 13 April 2024 has maintained the provision of TrimEvac emergency training twice a year to which retailers are invited.
7.276 It was submitted on behalf of Scentre that Mr Gaerlan provided evidence of the extensive efforts he took, as Retail Manager, to engage with new retailers throughout 2025. It was noted that it is his practice to provide each retailer, upon “onboarding” to WBJ, an induction and the Risk and Security Poster, which includes the “Escape, Hide, Tell” message and is normally accompanied by an evacuation diagram.
7.277 Counsel for Scentre submitted that the Inquest also received evidence that Scentre delivers invitations to retailers by placing invitations under the door of each tenancy, or by email, and records acknowledgments of receipt. The records of retailer acknowledgements prior to 13 April 2024 are not in evidence and are not available to verify the accuracy of the reports by smaller retailers of not having been invited to participate in emergency drills organized by Scentre, as submitted by Counsel Assisting.
7.278 However, it was submitted on behalf of Scentre that the records of acknowledgments by retailers for TrimEvac training conducted in March 2025 were tendered in the Inquest and, for example, include acknowledgment by Sourdough Bakery and Café of receipt of the invitation to attend. Noting this, it was submitted that the reason Sourdough Bakery and Café suggests otherwise is not clear on the available evidence, but that suggestion ought not be accepted in the circumstances. It was further submitted on behalf of Scentre that Louna Hair and Beauty operate pop-up temporary stores, typically during school holidays, rather than permanent small retail stores, and may not have been in the Centre at the time of the emergency drills.
7.279 It was submitted on behalf of Scentre that, as Counsel Assisting had recounted in fitting terms, Scentre has long actively invested in its responsibilities as a crowded places operator, including in its local conscientious management of security contractors and presence, in monitoring and managing risk, and in its engagement with police forces and other crowded places operators at the national through to local levels. It is submitted that Mr Wilson’s observation of the Services Agreement being comprehensive, and good practice should be accepted.
7.280 Counsel for Glad agreed with and adopted the submissions advanced by Scentre regarding the context for consideration of the issues pertaining to the Security Control Room.
7.281 It is submitted on behalf of Glad that in the context of the Control Room, Glad has developed its own Control Room Coverage Procedure, Control Room Suitability
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Assessment, and updated its Control Room Operator – Active Armed Offender – Advanced training document.
7.282 Counsel for Glad submits that, as was revealed during the Inquest, it was unknown to Glad that GLA2 was not an employee of Falkon, but rather an employee of another subcontractor of security services. It is submitted that this is not a matter that Glad could reasonably have become aware of at the time of GLA2’s commencement, as it appears to have arisen from an administrative error on the part of Falkon.
7.283 It is submitted on behalf of Glad that notwithstanding this, the Court ought to pay attention to the fact that GLA2 had received training that surpassed what would ordinarily be afforded to a contracted security officer.
Findings 7.284 I accept the submissions of Counsel Assisting that no significant criticism can be attached to the above issues that emerged as a result of the subcontracting model implemented at WBJ. There is no evidence that such matters directly contributed to the issues that emerged in respect of the events of 13 April 2024. Moreso, the issues, when identified, were promptly attended to.
7.285 In relation to the issue of GLA2 being an employee of an unapproved subcontractor of Falkon, the CEO of Falkon, Mr Manzoor, acknowledged that this should not have occurred and was a mistake. Mr Manzoor further provided details of the steps that Falkon has subsequently taken to ensure such issues do not occur in the future with respect to WBJ. His response was responsible and appropriate.
D3. WBJ security systems 7.286 At Inquest, evidence was received regarding the actions of WBJ security personnel within various areas of the centre. To provide context to this evidence, it is necessary to understand the layout of WBJ and the security systems in place to facilitate an emergency response.
Zoning 7.287 WBJ is divided into two Zones: Zone A, situated to the north, and Zone B, situated to the south. The two Zones are bordered by Grafton Street to the north, Adelaide Street and Hollywood Avenue to the east, Gray Street to the south, and Bronte Road to the west.
Oxford Street runs east/west, bisecting Zones A and B.1076 7.288 Each Zone contains six levels of publicly accessible retail space above and below Ground Level (Ground Level being Level 3 at Oxford Street). There are also various levels of carparks, and multiple levels of commercial and residential space above the retail 1076 Exhibit 1, Vol 1, Tab 30, Statement of Detective Chief Inspector Andrew Marks at [22].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 levels. There are seven ground-floor pedestrian entrances in addition to a number of car park and retail entrances.1077 7.289 Level 13 of Zone A at WBJ contains the Centre Management Office (CMO). The CMO is where Scentre management conduct the day-to-day operation of WBJ. Level “13” is one floor above Level 6.1078 CCTV Control Room 7.290 The CCTV Control Room is a secure space on Level P4 of Zone B.
7.291 Glad conducts day-to-day security operations from this space, including managing the signing-in and out and provision of keys for security officers and other contractors visiting the site; storage and distribution of security equipment including radios and other appointments; co-ordination of daily security activities; managing security relevant communications from Scentre management, police, retailers, security officers and other staff on the retail floor, as well as enquiries from members of the public.
7.292 The CCTV Control Room houses operational equipment including computers and monitors displaying CCTV, a telephone, radio, and specialised systems with emergency functions, namely: an electronic Fire Control Panel, a PA system, an EWIS, and a CMEO system (the function of these systems is described further below).1079 7.293 On the first day of the Inquest, images were displayed of the CCTV Control Room as it appeared on 13 April 2024, noting that since that time, Scentre has undertaken significant changes to the layout and setup of the room. Two images of the CCTV Control Room on 13 April 2024 are displayed below.
1077 Exhibit 1, Vol 44, Supplementary Statement of Bradley Goldberg at [7]-[10].
1078 Exhibit 1, Vol 28, Tab 988, Westfield Bondi Floor Plans (Scentre Group); Exhibit 1, Vol 28, Tab 989, Westfield Bondi Floor Plans (Scentre Group) overlays; Exhibit 1, Vol 28, Tab 990, Annotated Westfield Diagram of Level 3 (Westfield Management; Exhibit 1, Vol 28, Tab 991, Annotated Westfield Diagram of Level 4 (Westfield Management); Exhibit 1, Vol 28, Tab 992, Annotated Westfield Diagram of Level 5 (Westfield Management); Exhibit 1, Vol 44, Supplementary Statement of Bradley Goldberg at [8].
1079 Exhibit 1, Vol 28, Tab 988, Westfield Bondi Floor Plans (Scentre Group); Exhibit 1, Vol 28, Tab 989, Westfield Bondi Floor Plans (Scentre Group) overlays; Exhibit 1, Vol 28, Tab 990, Annotated Westfield Diagram of Level 3 (Westfield Management; Exhibit 1, Vol 28, Tab 991, Annotated Westfield Diagram of Level 4 (Westfield Management); Exhibit 1, Vol 28, Tab 992, Annotated Westfield Diagram of Level 5 (Westfield Management).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Figure 14: CCTV Control Room on 13 April 2024 Fire Control Room 7.294 The Fire Control Room is a secure room accessible from the CCTV Control Room, however requires navigation of some 100 metres of hallways, stairs, and access points.
It houses an extensive built-in Fire Control Panel, EWIS, PA system, and a sprinkler control system. It also contains a computer, a radio, and telephone system directly connected to Fire Control access points located around the Centre, including the CCTV Control Room.1080 Some of the emergency systems located in this room are discussed further below.
1080 Exhibit 1, Vol 28, Tab 988, Westfield Bondi Floor Plans (Scentre Group); Exhibit 1, Vol 28, Tab 989, Westfield Bondi Floor Plans (Scentre Group) overlays; Exhibit 1, Vol 28, Tab 990, Annotated Westfield Diagram of Level 3 (Westfield Management; Exhibit 1, Vol 28, Tab 991, Annotated Westfield Diagram of Level 4 (Westfield Management); Exhibit 1, Vol 28, Tab 992, Annotated Westfield Diagram of Level 5 (Westfield Management); Exhibit 1, Vol 45, Tab 1600B, Third Statement of Bradley Goldberg at [15].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Operational/Emergency systems at WBJ 7.295 As at 13 April 2024, there were several operational and emergency systems installed and in use at WBJ. These systems are relevantly described below.
Radio 7.296 Scentre staff and Glad employees were provided with two-way radios (either in-ear pieces or handpieces), which enabled staff to communicate with one another throughout the Centre. There was also functionality to move to separate channels for designated or special purposes, for example, an emergency channel.1081 The physical radios provided to security staff are described further below.
Telephone 7.297 Scentre staff and Glad employees also had access to telephones in the CCTV Control Room and CMO, and throughout the Centre at concierge desks. Scentre staff, Glad employees and tenants were able to communicate internally throughout the Centre, as well as externally, using these phones. Some Scentre staff and Glad employees also had work-related mobile phones with access to an instant messaging and organising application, Microsoft Teams, which was also used for incident escalation.1082 CCTV cameras 7.298 On 13 April 2024, there were 706 CCTV cameras providing 954 views throughout WBJ.1083 The cameras were situated around WBJ and provided views of the main access and exit points, high-traffic areas, retail space throughout the Centre, operational space (including the CMO, CCTV Control Room, and Fire Control Room), plant and equipment.1084 The CCTV could be reviewed, or viewed live, on monitors in both the CCTV Control Room and the CMO.1085 Fire Control Room 7.299 The Fire Control Room contains two walls of panels, including an EWIS panel.1086 On 13 April 2024, a “mimic” electronic Fire Control Panel (also referred to as “Secondary Panel”) was installed in each of the CCTV Control Room and CMO, and could be operated from a computer in the CCTV Control Room and in the boardroom in the CMO.1087 The Fire Control Panel includes the EWIS and the PA system (discussed below).
1081 Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt at [16]; Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt, Annexure B, Scentre Group Services Agreement, Schedule 2 Specification at p. 43.
1082 Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt at [16]; Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt, Annexure C, Site Orders at p. 241.
1083 Transcript, D8 (Fatima): T639.20-21; Exhibit 1, Vol 42, Tab 1599, Statement of John Yates at [113] cf Transcript, D14 (Wilson): T1237.44-T1238.5, T1265.35-50 (19 May 2025).
1084Transcript, D8 (Fatima): T665.48-T666.2 (8 May 2025).
1085 Transcript, D7 (Gaerlan): T490.40-46 (7 May 2025).
1086 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [36].
1087 Exhibit 1, Vol 45, Tab 1600B, Third Statement of Bradley Goldberg at [5]-[12].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 The Fire Control Panel (and “mimic” systems) enables the Operator to activate or deactivate an EWIS alarm.1088 Emergency Warning and Intercommunication System 7.300 The EWIS is part of the fire control infrastructure, including an alarm system that can be automatically or manually activated to sound an alarm in one or more areas of the Centre. Alternatively, the alarm can sound throughout the entire building. There are two “mimic” or “secondary” EWIS systems on computers in the CCTV Control Room and the CMO, respectively.
7.301 Mr Goldberg explained in his statement that “[b]y pressing particular buttons, the [O]perator can select that the tones sound only in chosen locations in the Centre, or can choose for the alert to sound throughout the entire Centre.”1089 The alarms are programmed to sound at a volume set by the Australian Standard 1670.1:2024.1090 The alarm has two different tones, being an Alert Tone and an Evacuation Tone.1091 7.302 An image of the EWIS panel located in the Fire Control Room at WBJ is shown below in Figure 15.
Figure 15: EWIS panel located in the Fire Control Room 1088 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [43]-[46].
1089 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [45].
1090 Exhibit 1, Vol 45, Tab 1600B, Third Statement of Bradley Goldberg at [13]-[16].
1091 Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt, Annexure B, Scentre Group Services Agreement (4 September 2023 – 3 September 2028), Schedule 4, Work Health & Safety Management Plan at p. 165; Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [43]-[46].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 PA system 7.303 The PA system enables an Operator to broadcast to one or more areas of the Centre, or throughout the entire building via the EWIS (or through the digital “mimic” EWIS panels in the CCTV Control Room and CMO). The PA system enables the Operator to provide instructions and information to people in the relevant area, for example, the location of a hazard. When operating simultaneously, the PA system is programmed to interpose the EWIS alarm tone.1092 7.304 During the Inquest, evidence emerged which suggested that it was the practice of the security team at WBJ to make PA announcements from the Fire Control Room, where there would be less background noise for the announcer.1093 7.305 Announcements made over the PA system were in accordance with pre-prepared scripts.1094 7.306 In respect of an AAO, the relevant script was:1095 Figure 16: AAO PA announcement scripts 7.307 A copy of these scripts (including the script outlined above with respect to an AAO) were situated in both the Fire Control Room and CCTV Control Room.
1092 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [47].
1093 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [47].
1094 See Exhibit 1, Vol 29, Tab 993, Statement of Emily Hunt (Part 2), Annexure D, Scentre Group: Emergency Plan – Emergency Response Procedures (Issue 36) (‘Red Book’) (dated February 2024) at p. 442.
1095 Exhibit 1, Vol 29, Tab 993, Statement of Emily Hunt (Part 2), Annexure D, Scentre Group: Emergency Plan – Emergency Response Procedures (Issue 36) (‘Red Book’) (dated February 2024) at pp. 328-329.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Figure 17: EWIS scripts displayed in the Fire Control Room and CCTV Control Room Centre Management Emergency Override 7.308 Activation of the CMEO would override 80 visual display units (advertising screens) throughout the retail areas of WBJ and display a uniform pre-programmed emergency message.1096 7.309 On 13 April 2024, there were two pre-programmed messages: evacuation and armed offender. Images of the pre-programmed messages that could be displayed on the CMEO are depicted below.
Figure 18: CMEO display 1096 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [37]-[38].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.310 It was established that on 13 April 2024, the CMEO panels displayed the message as depicted below: Figure 19: CMEO display on 13 April 2024 7.311 The CMEO has a clear protective panel and a tamper seal to prevent accidental use.1097 Images of the CMEO as at 13 April 2024 appear below:1098 Figure 20: CMEO panel (including image of tamper proof tags) as at 13 April 2024 1097 Exhibit 1, Vol 29, Tab 993, Statement of Emily Hunt (Part 2), Annexure D, Scentre Group: Emergency Plan – Emergency Response Procedures (Issue 36) (‘Red Book’) (dated February 2024) at p. 435.
1098 Exhibit 1, Vol 29, Tab 993, Statement of Emily Hunt (Part 2), Annexure D, Scentre Group: Emergency Plan – Emergency Response Procedures (Issue 36) (‘Red Book’) (dated February 2024) at p. 433.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.312 As at 13 April 2024, the Red Book emphasised in relation to use of the CMEO that (emphasis in original): Authorization to use the system will only be given on confirmation that: An EVACUATION is required, or a confirmed ACTIVE ARMED OFFENDER is present Before activating the system, the user must re confirm authorisation with both the Chief Warden and the EWIS/FIP Controller 1099 7.313 The “Deactivation” procedure requires the Operator to press “Cancel All” when the CMEO is no longer required.1100 The Red Book as at 13 April 2024 did not contain instructions for the procedure to be adopted in the event of incorrect mode activation, for example, how to change from an evacuation message to an AAO alert.
Security officer appointments 7.314 As at 13 April 2024, WBJ security staff were required to wear uniforms including a name badge, jacket, waistcoat, pants or skirt, shirt or polo shirt, belt, tie, pocket square, black leather shoes.1101 In accordance with the Scentre Group Uniform Policy, security officers were required to carry the following:1102
(a) A radio earpiece with all 2-way radio handsets;
(b) Absorbent cloths for cleaning small spills;
(c) Disposable gloves;
(d) A notebook, pen and master key set; and
(e) Small first aid pouches/CPR pouches if applicable to their role. First aid kits and Automated External Defibrillator (AED) devices are also located throughout WBJ.
7.315 WBJ staff communicate using two-way radios. Some staff use a combination of in-ear radio earpieces and lapel microphones.1103 7.316 As noted above, the system has the capability to operate on a number of radio system channels. WBJ staff primarily use four: a carpark operations channel, a general channel (or “chat” channel), a cleaning operations channel, and an emergency channel.1104 The 1099 Exhibit 1, Vol 29, Tab 993, Statement of Emily Hunt (Part 2), Annexure D, Scentre Group: Emergency Plan – Emergency Response Procedures (Issue 36) (‘Red Book’) (dated February 2024) at p. 432.
1100 Exhibit 1, Vol 29, Tab 993, Statement of Emily Hunt (Part 2), Annexure D, Scentre Group: Emergency Plan – Emergency Response Procedures (Issue 36) (‘Red Book’) (dated February 2024) at p. 433.
1101 Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt, Annexure C, Site Orders at pp. 44-45.
1102 Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt, Annexure E, Scentre Group Emergency Plan – Pre-Response Planning (Issue
1103 Transcript, D7 (Gaerlan): T477.10-33 (7 May 2025).
1104 Transcript, D7 (Gaerlan): T477.43-47 (7 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 evidence before the Inquest demonstrated that the radio functionality only permits one person to speak at a time.1105 7.317 For the majority of the time, most WBJ staff, other than carpark and cleaning operations, use the general channel for daily activities.1106 This radio is used for communication throughout the day, including between security officers, and between security officers and the CCTV Control Room.1107 7.318 Each staff member is allocated a call sign. These call signs, which are contained on the staff lanyard and in the Red Book, are consistent across all Scentre sites.1108 7.319 Security officers are also issued with flash cards which contain an easy-to-read summary of radio call codes, call signs, emergency numbers, and key objectives in the event of an emergency. These cards are attached to a lanyard that is provided to all security officers.1109 Stab-resistant vests 7.320 Stab-resistant vests are a type of personal protective equipment (PPE) designed to resist puncture and penetration from sharp objects or weapons, such as a knife. “Stabresistant” vests are also often referred to as “stab-proof” vests. As at 13 April 2024, security officers at WBJ did not wear protective vests of any variety.1110 7.321 During the Inquest, information was received concerning a proposal in 2021 at Westfield Tea Tree Plaza (WTTP) (located in Adelaide, South Australia) regarding the potential introduction of stab-resistant vests for security personnel. WTTP is owned and operated by Scentre. Certis Group was the security contractor at the relevant time.1111 7.322 In 2021, Shannon Rodda (the Security Supervisor at WTTP) and Daniel Mykytyschyn (Assistant Security Supervisor at WTTP) prepared a proposal regarding a trial implementation of stab-resistant vests at WTTP.1112 The proposal came about as a result of various security risks identified by security staff at WTTP, including knife crime and other violent incidents.1113 Incident reports filed on Scentre’s Beakon system (discussed further below) indicate that between 24 December 2020 and 23 March 2021, knives were 1105 Transcript, D8 (Helg): T585.17-19 (8 May 2025).
1106 Transcript, D7 (Gaerlan): T477.35-36 (7 May 2025).
1107 Exhibit 1, Vol 44, Tab 1600A, Supplementary statement of Bradley Goldberg at [30].
1108 Exhibit 1, Vol 44, Tab 1600A, Supplementary statement of Bradley Goldberg at [301].
1109 Exhibit 1, Vol 44, Tab 1600A, Supplementary statement of Bradley Goldberg at [27],[80].
1110 Transcript, D9 (Goldberg): T728.3-6 (9 May 2025).
1111 Exhibit 1, Vol 50, Tab 1625, Letter from Holding Redlich to CSO (18 May 2025) at [5].
1112 Exhibit 1, Vol 50, Tab 1625A, Statement of Shannon Rodda at [25].
1113 Exhibit 1, Vol 50, Tab 1625, Letter from Holding Redlich to CSO (18 May 2025), Annexure B, Email Correspondence re “Stab Proof Vest Proposal”; Exhibit 1, Vol 50, Tab 1625, Letter from Holding Redlich to CSO (18 May 2025), Annexure C, Email correspondence re “Protective Vest Proposal”; Exhibit 1, Vol 50, Tab 1625, Letter from Holding Redlich to CSO (Vol May 2025), Annexure D, Email correspondence re “Protective Vest Proposal”, attaching “Security Risk” document; Exhibit 1, Vol 50, Tab 1625, Letter from Holding Redlich to CSO (18 May 2025), Annexure E, Email correspondence re “Protective Vest Proposal” attaching “Security Risk” document; Exhibit 1, Vol 50, Tab 1625, Letter from Holding Redlich to CSO (18 May 2025), Annexure F, Email correspondence re “Vest”, attaching “Security Risk (003)” document.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 confiscated from patrons at WTTP on three occasions and, on a further occasion, a female patron threatened to stab another female patron.
7.323 Ms Rodda recalled that the proposal was discussed with the Scentre-employed RSM at WTTP, Kylie Williamson, at a Risk and Security Team meeting on 14 April 2021.1114 Ms Rodda emailed a document titled “Risk and Security Team Meeting Minutes” to Ms Williamson on 14 April 2021. Those minutes included the following discussion item: Daniel presented a document of current incidents and why Security need stab proof vests to protect themselves against weapons. Armed offender incidents have grown over the past few months. Mostly juvenile offenders carrying knives.1115 7.324 Ms Williamson stated that she did not receive a copy of the proposal by email, nor could she locate any other record of it. Further, she could not recall attending a meeting on 14 April 2021 with Ms Rodda and Mr Mykytyschyn.1116 7.325 On 4 May 2021, Ms Rodda sent the proposal to Certis Group managers Thomas Mander and Victoria Callaghan. Mr Mander replied, on the same day, “I’ll have a look through this now. Appreciate all you and your team do, keep us in the loop for any support, needs or ideas.”1117 7.326 On 21 May 2021, Ms Callaghan emailed Mr Mykytyschyn, confirming receipt of the proposal from Ms Rodda and noting “Tom is going to take the lead on this and liaise with the powers that be about a possible trial/implementation. He will update you very soon.”1118 7.327 Ms Rodda stated that later that year she spoke with Certis State Operations Manager, Jason Koh, at WTTP, “where he told me that CERTIS Security were onboard for the stab proof vest proposal, but the client said they weren’t customer friendly”.1119 Ms Rodda understood that by “client”, Mr Koh was referring to Scentre.1120 7.328 Ms Rodda left WTTP in 2022 and does not know if the proposal progressed further.1121 Scentre indicated, by way of written correspondence, that it did not have any record of the proposal having been sent to its employees, nor the issues in the document being raised further.1122 Scentre further indicated that the incidents described in the proposal were not at the threshold level to be escalated to the National Risk and Security Team, 1114 Exhibit 1, Vol 50, Tab 1625A, Statement of Shannon Rodda at [26].
1115 Exhibit 1, Vol 52, Tab 1655, Statement of Kylie Williamson, at [11]-[13]; Exhibit 1, Vol 52, Tab 1655, Statement of Kylie Williamson, Annexure A, Email correspondence re “RST Meeting Minutes 14/4” at p. 6.
1116 Exhibit 1, Vol 52, Tab 1655, Statement of Kylie Williamson at [6]-[9].
1117 Exhibit 1, Volume 50, Tab 1625, Letter from Holding Redlich to CSO (18 May 2025), Annexure C, Email correspondence re “Protective Vest Proposal”.
1118 Exhibit 1, Vol 50, Tab 1625, Letter from Holding Redlich to CSO (18 May 2025), Annexure B, Email Correspondence re “Stab Proof Vest Proposal”.
1119 Exhibit 1, Vol 50, Tab 1625A, Statement of Shannon Rodda at 26(d).
1120 Exhibit 1, Vol 50, Tab 1625A, Statement of Shannon Rodda at 26(d).
1121 Exhibit 1, Vol 50, Tab 1625A, Statement of Shannon Rodda at 26(d).
1122 Exhibit 1, Vol 50, Tab 1625, Letter from Holding Redlich to CSO (18 May 2025) at 6.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 as the incidents did not involve an armed intruder (defined as “a person who enters the Centre precinct, is armed with a weapon and behaving in a threatening manner towards a person (whether or not a weapon has been used”)).1123 7.329 Further information was sought from Scentre regarding any consideration or proposal for stab-resistant vests prior to the events of 13 April 2024. Ms Hunt provided a further statement in which she relevantly stated:
(a) In around October 2023, Ms Hunt had, of her own initiative, and “as part of the ongoing review process for setting priorities for the national security function”, created a Security Risk Presentation.1124
(b) That around that time, the Scentre National Security Team had been considering increased conflict situations involving anti-social behaviour, youth aggression and retail theft, as well as a knife related incident at Westfield Helensvale on 25 August 2023.1125 The security review was broadened after the Helensvale incident to consider “review of available and proportionate PPE”.1126
(c) The Security Review Presentation was presented at a meeting on 16 October
(d) The Security Review Presentation included a recommendation to “Explore options for slash, cut and stab resistant clothing/vests in the event risk increased”.1129 The Security Review Presentation further provided that “there is no recommendation to roll resistant PPE out. Discovery exercise only”.1130
(e) Other than the Helensvale incident, Scentre properties were not at that time experiencing conflict situations involving knives;1131 and
(f) She undertook research and determined that the majority of shopping centres, and their security contractors, did not utilise stab-resistant vests at that time.1132 1123 Exhibit 1, Vol 52, Tab 1680, Supplementary Statement of Emily Hunt at [34]-[35].
1124 Exhibit 1, Vol 52, Tab 1680, Supplementary Statement of Emily Hunt at [8]. See Exhibit 1, Vol 52, Tab 1657, Review by Scentre National Risk and Security Team.
1125 Exhibit 1, Vol 52, Tab 1680, Supplementary Statement of Emily Hunt at [14]-[17].
1126 Exhibit 1, Vol 52, Tab 1680, Supplementary Statement of Emily Hunt at [18]-[19].
1127 Exhibit 1, Vol 52, Tab 1680, Supplementary Statement of Emily Hunt at [10]-[11].
1128 Transcript, D15 (Yates): T1323.28-34 (20 May 2025).
1129 Exhibit 1, Vol 52, Tab 1657, Review by Scentre National Risk and Security Team at p. 6.
1130 Exhibit 1, Vol 52, Tab 1657, Review by Scentre National Risk and Security Team at p. 8.
1131 Exhibit 1, Vol 52, Tab 1680, Supplementary Statement of Emily Hunt at [20]-[21].
1132 Exhibit 1, Vol 52, Tab 1680, Supplementary Statement of Emily Hunt at [22]-[24].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Submissions 7.330 Consistent with the approach taken to its policies and procedures, Scentre had an extensive and diverse array of security systems available at WBJ on 13 April 2024.
CCTV security monitoring 7.331 With respect to the status of CCTV security monitoring at WBJ and related policies and procedures, it was submitted by Counsel Assisting that as of 13 April 2024, there was extensive CCTV capability at WBJ. There were 706 CCTV cameras providing 954 views throughout WBJ. It was submitted that there was no evidence before the Court to suggest any issue with the adequacy or coverage of CCTV security monitoring at WBJ.
7.332 Counsel Assisting submitted that the purpose of CCTV monitoring at WBJ, consistent with the evidence outlined above, does not involve live monitoring of CCTV footage. The CCTV Control Room Operator is not tasked with actively identifying incidents or threats, and such a requirement would result in a significant alteration to the CCTV Control Room Operator role, including the requisite training and skills.
7.333 It was submitted by Counsel Assisting that the evidence before the Inquest further identified that as at 13 April 2024, there was no explicit or written policy requiring the CCTV Control Room to be staffed at all times. It was submitted that Scentre, to its credit, has acknowledged this lack of clarity and rectified the situation.
7.334 It was submitted on behalf of Scentre that the security systems at WBJ were amongst the most extensive and sophisticated of any Australian shopping centre.
7.335 Counsel for Scentre submit that CI Green gave evidence that it is often the case that crowded places, including shopping centres, do not have the luxury of CCTV monitoring as they lack the relevant infrastructure. CI Green explained that decisions about CCTV monitoring should be centred on risk, a concept which is distinct from threat.
7.336 It is submitted on behalf of Scentre that at WBJ, as at 13 April 2024, there were 706 cameras throughout the Centre, which captured 954 views. On the monitors above the eye level of the Control Room Operator, there were about 15 images of various locations, managed via lists of cameras on a computer monitor on the desk in front of the Operator. The Control Room also had additional computer monitors for a second Operator, which CR2 used during the incident. It is submitted that, relevant to the incident, there were 173 cameras in locations on Levels 3, 4 and 5, including 61 cameras located along the route that Mr Cauchi took from the Sourdough Café to Eckersley’s, where he was shot. Mr Cauchi was captured in footage from those cameras, sometimes fleetingly and sometimes for a longer period.
7.337 Counsel for Scentre submits that evidence was adduced of how the facilities of the Control Room at WBJ compare with other shopping centres. Scentre relied upon a survey by the Shopping Centre Council of Australia (SCCA) of 266 shopping centres, of
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 all types and in a range of locations, to gauge the status and staffing of Control Rooms.
Only 29 of the 266 (about 11%) shopping centres in the SCCA survey had a dedicated Control Room which was staffed with dedicated CCTV Operators “24/7” or during trading hours.
7.338 It was further submitted that the other 237 centres (about 89%) had no dedicated or staffed Control Room, or no Control Room at all. Where there is no Control Room in a shopping centre, monitor/s with CCTV footage may be located in a security room which is not staffed with an Operator, or on a desk or in a room in a centre management office, and will typically only be checked occasionally and if there is a particular reason to do so, such as if there is an incident or a request for footage.
7.339 Counsel for Scentre submitted that membership of the SCCA comprises Australia’s major shopping centre owners, who together own around 39% of all shopping centres across Australia. There are many more minor owners and operators of shopping centres throughout Australia, that are not SCCA members and were not part of the SCCA survey.
These minor operators are most unlikely to have sophisticated CCTV infrastructure, Control Room capabilities or dedicated CCTV Operators.
7.340 Accordingly, it is submitted on behalf of Scentre that as at 13 April 2024, the CCTV infrastructure and capabilities at WBJ significantly exceeded the capabilities of the majority of shopping centres across Australia. It is submitted that in the event of an AAO incident, in around 89% of the shopping centres sampled, there would not be a dedicated Control Room Operator at all. That figure is higher once minor operators are taken into account.
7.341 Counsel for Scentre submits that although Scentre acknowledges that critical time was lost in the initial stages of the attacks, the CCTV facilities and expertise at WBJ were of substantial assistance to Scentre and police in the later stages of the emergency response, and in the aftermath. That level of assistance from CCTV facilities, in responding to an equivalent emergency, would not have been available in the majority of other shopping centres in Australia.
7.342 It is submitted on behalf of Scentre that this perspective and context confirm that the efforts and investment by Scentre into CCTV infrastructure and resources were and are industry-leading. It is submitted that it also provides context when evaluating the various acknowledged issues and learnings in relation to the WBJ Control Room on 13 April 2024, further considered in Section G.
7.343 Counsel for Scentre submits that Scentre agrees that a written policy or procedure is appropriate, and one has been implemented, to specify that the Control Room is not to be left unoccupied so that the unfortunate coincidence of the timing of CR1’s bathroom break cannot occur again. It is submitted that Counsel Assisting fairly have not been overtly critical of Scentre that, previously, temporary absences occurred in the Control Room. In Scentre’s submission, this is fair because, in context, WBJ is industry leading by having a staffed Control Room.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.344 The particular circumstances of CCTV monitoring on 13 April 2024 are addressed further below.
Alarm and warning systems 7.345 Counsel Assisting submitted that Scentre had in place necessary and appropriate alarm and warning systems at WBJ as at 13 April 2024. It was submitted that there were a number of advantages of the alert and warning systems utilised by Scentre (when used correctly), including:
(a) The EWIS system can be automatically or manually activated, and can sound in particular areas or across the entirety of the Centre;
(b) There is functionality for alerts to be made by both audio (EWIS / PA) and visual means (CMEO); and
(c) PA announcements allow specific, targeted and informative advice to be provided to those present at WBJ.
7.346 It was submitted that on any view, the alarm and warning systems available at WBJ are comprehensive.
7.347 Counsel Assisting highlighted that one issue that emerged during the Inquest was the volume of the alarms, which were ultimately sounded after Mr Cauchi had been shot.
This had a significant impact on first responders as outlined in Parts 8 and 9.
7.348 The issue of the volume of the alarm, and subsequent engagement with Standards Australia, is considered further in Section K.
7.349 Other than with respect to the issue concerning the volume of the alarm, no further submissions were made on this issue by Scentre or Glad.
Equipment available to security guards in an AAO scenario 7.350 Counsel Assisting submitted that there were two issues regarding equipment that emerged as areas of focus during the Inquest: radios and stab-resistant vests.
7.351 In relation to the radios, Counsel Assisting submitted that while security staff had difficulties communicating on 13 April 2024, these were not the result of an equipment issue, but rather, related to poor radio “hygiene”. This issue is considered further below in Section H.
7.352 In relation to stab-resistant vests, Counsel Assisting submitted that as at 13 April 2024, security staff were not obliged to wear stab-resistant vests and that there was no legislative requirement or guideline which otherwise provided that vests should be worn.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.353 Following the events of 13 April 2024, all security staff at WBJ are now required to wear stab resistant vests.
7.354 In relation to the WTTP issue, Counsel Assisting submitted that it does not appear that there was any further consideration of stab-resistant vests prior to 13 April 2024, nor does it appear that any further steps were taken in relation to the recommendation in the Security Review Presentation to “explore” options for stab-resistant vests.
7.355 Counsel Assisting submitted that no criticism should be directed to Scentre for the approach taken in relation to stab-resistant vests, including that they were not mandated prior to 13 April 2024. Stab-resistant vests were neither required, nor commonly deployed by security contractors at the time.
7.356 Counsel Assisting submitted that the issue of what, if any, protection stab-resistant vests may have offered security guards on 13 April 2024 was not the subject of any evidence in this Inquest, and whether such vests would have made any difference is not known and is ultimately speculative.
7.357 No submissions were made on behalf of Scentre in relation to the WTTP issue or in relation to the equipment available to security guards generally (other than with respect to radio communications, which are separately considered).
7.358 It was submitted on behalf of Glad that, having regard to the equipment available to security officers at the date of the incident, the resources and equipment provided, particularly given the low number of previous knife-related incidents, were appropriate and in conformity with industry best practice.
Findings 7.359 The capabilities for CCTV monitoring at WBJ on 13 April 2024 were extensive and appropriate. It is accepted that the purpose of CCTV monitoring at WBJ does not involve live monitoring of CCTV footage and that the CCTV Control Room Operator is not tasked with actively identifying incidents or threats.
7.360 As at 13 April 2024, there was no written policy or procedure that required the CCTV Control Room at WBJ to be staffed at all times. To its credit Scentre have acknowledged that lack of clarity and rectified the situation. A policy has now been implemented, specifying that the Control Room is not to be left unoccupied and a sign is now displayed in the room to that effect (see Figure 13).
7.361 The alarms and warning systems installed at WBJ were comprehensive and appropriate.
An issue did emerge in relation to the volume of the alarm and the impact that had upon emergency responders. That issue is discussed further in Section K.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.362 In relation to stab-resistant vests and the issues that arose at WTTP, there is no criticism of Scentre with respect to their approach.
7.363 As at 13 April 2024, stab-resistant vests were neither required or commonly deployed. I accept that the issue of what, if any, protection stab-resistant vests may have offered security guards on 13 April 2024 was not the subject of any evidence in this Inquest, and whether such vests would have made any difference is not known.
7.364 I accept that the resources and equipment provided to security guards at WBJ on 13 April 2024 was appropriate.
7.365 All security staff at WBJ are now required to wear stab resistant vests.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 E. Training of security guards at WBJ 7.366 In order to assess the response of security personnel on 13 April 2024, it was necessary to closely examine the training provided to security staff, including security guards, noting the evidence (as outlined in Part D) regarding the specific arrangements in place at WBJ.
Training provided to security guards 7.367 As at 13 April 2024, all security officers engaged through Glad were required to be licenced and qualified in the provision of security services, including with respect to guarding, “roving”, and other associated functions.1133 This Section will consider broadly the training provided to those security guards.
7.368 Glad is required to ensure that each of its employee and subcontractors maintain compliance with the training matrix in the Services Agreement.1134 Scentre and Glad utilise software called “Beakon” to track and store records relating to the induction and training of personnel.1135 Pre-induction meeting 7.369 Persons proposed to be “core” security guards at WBJ are first screened by Glad and then put forward to the RSM for approval. The RSM (and/or RSS) then attends a preinduction meeting with the candidate to assess their suitability based on the candidate’s background, experience, and personal presentation.1136 Mr Goldberg agreed in evidence that the purpose of this meeting is to test basic competency, skills, and temperament.1137 He described the pre-induction meeting as involving: … an introduction with the security officer, see how they - what experience they've had, see that they're able to perform the role, see if there's any specific areas of the role that they wouldn't, and then I like to ask three scenario-based questions to, sort of, test their competency prior to accepting. 1138 Life Safety Induction training 7.370 A candidate who is successful in the pre-induction meeting and holds the necessary licences and certificates then commences the first formal induction component, the CX National Life Safety Induction.1139 The Life Safety Induction is required to be completed 1133 Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt at [20]; Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt, Annexure B, Scentre Group Services Agreement (4 September 2023 – 3 September 2028) at Clause 3.5, p. 14.
1134 Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt at [20]; Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt, Annexure B, Scentre Group Services Agreement (4 September 2023 – 3 September 2028), Schedule 2 Specification, Scope of Works at p. 40.
1135 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg, Annexure C, Table of Training and Induction of Core and Ad Hoc Guards as at 13 April 2024 and February 2025.
1136 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [73]-[74]; Transcript, D9 (Goldberg): T729.34-44 (9 May 2025).
1137 Transcript, D9 (Goldberg): T730.15-17 (9 May 2025).
1138 Transcript, D9 (Goldberg): T729.37-41 (9 May 2025).
1139 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [75]. See also Exhibit 1, Vol 38, Tab 1269, CX
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 prior to the guard’s first shift at the Centre (and refreshed on an annual basis).1140 It has a substantial work health and safety focus. It is undertaken online and comprises a comprehensive PowerPoint presentation and video content on topics including “what to do in an emergency”, “first aid”, and “incident management.” At the end, the inductee is tested by randomly generated questions concerning the content and must receive 80% to pass. If the inductee does not pass, they must re-take the course.1141 7.371 Participants receive a Certificate of Completion upon passing, and records of completion are stored on Beakon.1142 Core security officer site orientation 7.372 Site orientation for core guards is conducted on site by an authorised Glad representative (either an S1 or S2), an experienced core guard, or a Training Manager of Glad.1143 Mr Goldberg gave evidence that he is not normally involved in the orientation of core guards.1144 7.373 The orientation involves showing new personnel around WBJ to familiarise them with the site.1145 7.374 Mr Goldberg explained in his statement that during the orientation, a verbal overview of Scentre site rules, workplace emergency procedures, and site-specific personal protective equipment requirements is provided.1146 7.375 The completion of the Security Site Orientation is recorded on the CX Security Site Orientation Checklist and stored on Beakon. Core guards provide written confirmation that they have understood all information provided during the orientation.1147 Core security officer induction training 7.376 Core security guards are required to undertake further and comprehensive site and business specific training provided by Glad, in conjunction with Scentre.1148 Certain training is delivered by the RSM and/or the RSS.1149 The induction process takes approximately four weeks.1150 National Life Safety Induction Course.
1140 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [77].
1141 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [75]-[76].
1142 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [77].
1143 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [80].
1144 Transcript, D9 (Goldberg): T728.26-27 (9 May 2025).
1145 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [81].
1146 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [82].
1147 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [83]. See copy of template at Exhibit 1, Vol 38, Tab 1270, CX – Site Orientation Checklist (template).
1148 Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt at [21].
1149 Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg at [45].
1150 Transcript, D9 (Goldberg): T730.38-39 (9 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.377 The induction requirements are described in the Services Agreement.1151 The induction is intended to cover key policies and procedures, including:
(a) Assessing the guard’s understanding of Scentre’s Use of Force and Powers of Arrest Policy;
(b) Demonstrating to the guard how to use the Fire Panel, including how to respond to a fire alarm and the location of first aid facilities; and
(c) Confirming the guard has viewed the Terrorism Awareness module, which incorporates Active Armed Offender procedures.1152 7.378 Core security guards are rostered on to shifts and work during the induction program.1153 7.379 Completion of the security officer induction program requires verification by either the RSS or RSM that a core guard is able to demonstrate that they:
(a) Can describe the location of the centre’s AED devices and trauma tents; and
(b) Have competency in respect of various topics, including: the location of the Fire Control Room, silencing alarms, use of the PA system, activation of emergency tones, and the use of the manual, auto and isolate keys.1154 7.380 An inductee is also required to complete Maybo conflict management and deescalation training (Maybo training) and AED training.1155 Maybo training is focused on “training security officers in how to respond to situations they may encounter on the shop floor”1156 and to “give people a little bit more insight into how to deal with people”.1157 The training content includes de-escalation strategies and preventing conflict and risk.1158 The Maybo training is delivered by Mr Goldberg and Mr Zaidi who are qualified instructors.1159 Terrorism Awareness Module 7.381 The induction training includes completion of the Terrorism Awareness Module. Mr Goldberg gave evidence that the module incorporates AAO procedures and has been included in the induction program since before 2018.1160 1151 Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt, Annexure B, Scentre Group Services Agreement (4 September 2023 – 3 September 2028), Schedule 2, “Specification” at p. 46.
1152 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [87].
1153 Transcript, D9 (Goldberg): T730.41-46 (9 May 2025).
1154 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [90]-[91].
1155 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [92]. See also, Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg, Annexure F, Re: Viva First Aid Training Pack Materials (2022) regarding the contents of the AED training.
1156 Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg at [86].
1157 Transcript, D9 (Goldberg): T737.36-42 (9 May 2025).
1158 Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg, Annexure H, Material regarding MAYBO Certification and Training at pp. 267-367.
1159 Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg at [86].
1160 Transcript, D9 (Goldberg): T731.5-34 (9 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.382 Mr Goldberg explained in his statement that this module is completed by all core guards within 30 days of commencing at WBJ.1161 The module includes viewing three videos on “Suspicious behaviour and Suspicious Items”, “Escape. Hide. Tell.”, and “Hostile Vehicle and Mixed Mode Attacks”.1162 He further explained that the principles in the “Escape.
Hide. Tell.” video had been derived the ANZCTC Guidelines as outlined in Part 5.
Ongoing training 7.383 Core security guards also participate in ongoing, on the job, and additional training including:1163
(a) Terrorism awareness training, emergency management training workshops, and multi-agency exercises;
(b) Evacuation exercises;
(c) Internal training sessions (referred to as “Toolbox training”, “desktop training”, and “Red Book audits”) conducted by the RSM, RSS, Supervisor or Assistant Supervisor. These internal training sessions cover a range of topics, including “Armed Intruder & Hostage incidents” and “Fatality or Serious Injury Incidents”; and
(d) “Huddle” sessions between Scentre and Glad personnel to talk through emergency scenarios.
7.384 External parties, such as Fulcrum Risk Management, provide training workshops on topics including Terrorism Awareness and Emergency Management. These workshops are provided to the leadership team at WBJ, including senior team members from Glad’s security team.1164 Jerry Helg, Joseph Gaerlan, CR1, and Tyson Rogers were present at a Terrorism Awareness and Emergency Management Workshop on 2 April 2024.1165 Mr Goldberg described that training session as involving the following three objectives: … to learn how to mount an effective response, learn how to decide to evacuate, or shelter-in-place and/or lockdown and finally to understand the need for personal safety in an emergency.1166 7.385 Mr Goldberg gave evidence describing the joint responsibilities of Scentre and Glad for the delivery of ongoing training. He agreed that even though “[Scentre] contract out to 1161 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [88].
1162 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg, Annexure R, Terrorism Awareness module material (see Item 61 of Electronic Material).
1163 Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt at [22]; Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [95].
1164 Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg at [64]-[65].
1165 Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg, Annexure D, Training Log – training received by Bradley Goldberg (3 January 2018 – 2 April 2024) at p. 62.
1166 Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg at [65].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Glad the provision of staff and [Scentre] require basic competencies, Scentre sits over the top of it to ensure that [Scentre is] getting a person who is properly trained”.1167 7.386 A further element of ongoing training is the use of “toolbox talk” or “desktop training” exercises. Mr Goldberg explained in his statement that Scentre delivers this training either weekly or fortnightly, and it is attended by the Scentre Management Team as well as a senior representative from Glad.1168 These are delivered by either the RSM or RSS, and focus on sections of the Red Book, Green Book, Site Security Orders, and Scentre’s Critical Policies and Procedures. Mr Goldberg stated that each topic of the Red Book will be addressed twice during a 12-month period.1169 7.387 Mr Goldberg, in his evidence, explained that it is expected that the information from the toolbox talks delivered by Scentre is “fed back” to the security team by the attending senior representative from Glad. This includes by way of further toolbox talks or desktop training delivered by Glad.1170 These are required to be delivered twice per month, and the delivery of this training is monitored by the RSM in accordance with the Security Contractor KPIs.1171 7.388 Redbook audits are short-form, one-on-one training sessions conducted by Glad Security Supervisors and Client Service Managers with security guards. This training involves 5-10 questions posed to a guard to gauge the individual guard’s understanding of a given Red Book topic, including, for example, AAO incidents. The audits are a KPI required by Scentre, and the results are provided to the RSM on a monthly basis.1172 7.389 Mr Helg gave evidence of how a Red Book audit was conducted: So I would bring the guard into my office. I would sit him down. I would then start to ask him questions on one of the Red Book audits, and then I would - I'd then assess him.
Once I asked the questions, if he didn’t get it right, I would then tell him the correct answer, but I would then mark him down as not competent in that answer. 1173 7.390 Mr Helg described this training as occurring randomly, with an intention to audit all team members on various Red Book topics about four to six times per week. If a team member was not competent in an area when tested, they would be provided the relevant Red Book policy and required to read it. They would then be reassessed “in a couple of weeks”.1174 1167 Transcript, D9 (Goldberg): T732.39-42 (9 May 2025).
1168 Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg at [45]; Exhibit 1, Vol 44, Supplementary Statement of Bradley Goldberg at [99].
1169 Exhibit 1, Vol 44, Supplementary Statement of Bradley Goldberg at [99].
1170 Exhibit 1, Vol 44, Supplementary Statement of Bradley Goldberg at [99].
1171 Exhibit 1, Vol 44, Supplementary Statement of Bradley Goldberg at [99]; Exhibit 1, Vol 30, Tab 993 (Part 3), Statement of Emily Hunt, Annexure F(xxv), Security Contractor KPIs (v 2.0) at pp. 851–856.
1172 Exhibit 1, Vol 45, Tab 1601, Statement of Cameron Stuart at [27]-[30].
1173 Transcript, D7 (Helg): T560.21-26 (7 May 2025).
1174 Transcript, D7 (Helg): T560.28-48 (7 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 WBJ-specific training for ad-hoc security guards 7.391 As at 13 April 2024, Scentre required “ad-hoc” guards engaged by Glad to be licensed and qualified in the provision of security services, including with respect to guarding, “roving”, and undertaking other associated functions. However, the training received by “ad-hoc” guards differs from the scope and breadth of training provided to “core” guards employed by Glad.1175 7.392 In his second statement, Mr Goldberg explained that ad-hoc guards at WBJ were required to have:1176
(a) Completed CX National Life Safety Induction;
(b) Signed on to Beakon; and
(c) Participated in a site orientation run by Glad.
7.393 Ad hoc guards were also required to participate in specific toolbox talk training sessions as relevant to their particular position from time to time, conducted by the Security Supervisor or Assistant Security Supervisor.1177 7.394 As noted above, ad-hoc guards now receive additional training before the commencement of their shifts. This is addressed further in Section K below.
Multi agency exercises 7.395 A multi agency exercise (MAE) is a simulated scenario designed to replicate a real-life emergency incident or situation involving multiple agencies or stakeholders. MAEs are undertaken to assist with preparing for such an event. MAEs can involve discussions and scenario-based planning (a desktop or tabletop scenario) or a simulated practical environment involving the physical deployment of personnel (a field scenario).
7.396 The most recent MAE at WBJ prior to 13 April 2024 was an exercise organised by Fulcrum Risk Management conducted on 11 October 2023.1178 7.397 The exercise ran for 3.5 hours and was delivered in a discussion-style format.1179 The scenario presented to participants was an attack by an AAO, commencing with the offender lighting a vehicle on fire on the rooftop carpark before proceeding into an AAO scenario with multiple persons injured.1180 1175 Exhibit 1, Vol 28, Tab 993, Statement of Emily Hunt (Part 1) at [23].
1176 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [103].
1177 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [103].
1178 Exhibit 1, Vol 38, Tab 1266, Draft Multi Agency Exercise Report at p. 1.
1179 Exhibit 1, Vol 38, Tab 1266, Draft Multi Agency Exercise Report at p. 1.
1180 Exhibit 1, Vol 38, Tab 1266, Draft Multi Agency Exercise Report at p. 2.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.398 Participants at this exercise were:1181
(a) Six WBJ security staff including Bradley Goldberg, Rahim Zaidi, Lulu Fatima and Sharooz Khan (the then Security Supervisor at WBJ);
(b) Four NSWPF officers: Supt Radmore (Eastern Suburbs PAC Commander), two Inspectors (duty officers) and a Sergeant;
(c) Two Fire and Rescue NSW Officers: Supt Greg Houston and Insp Jeremy Hood; and,
(d) Two Local Council Emergency Planning Committee Members.
7.399 A Draft Report was prepared following completion of the MAE, which included various “Outcomes & Observations”. Those outcomes were consistent with the relevant Scentre policies and procedures:1182
(a) All security staff should, as a first priority, keep themselves safe and not put themselves in a position of danger;
(b) The provision of information to emergency responders (including police in the event of an AAO) is critical. The provision of this information should not be delayed, regardless of whether members of the public are alerting police, or if not all of the details are known. Security staff should inform the Triple 0 operator that they are staff members to ensure the Operator can obtain as much factual information as possible for responders;
(c) The Chief Warden has principal responsibility for the security response in the initial phases;
(d) Where it is safe to do so, security staff should be made available to engage with responding police or other emergency services to provide them with information regarding the facility;
(e) Updated information, including that obtained through CCTV footage, should be provided to first responders as soon as possible;
(f) It is likely that responding police entering the Centre will want any additional noises (evacuation tones, EWIS announcements) discontinued. This action would support their ability to hear activities within the centre (for example, gunshots or screaming) more clearly and assist their own communications via police radio; and 1181 Exhibit 1, Vol 38, Tab 1266, Draft Multi Agency Exercise Report at p. 2.
1182 Exhibit 1, Vol 38, Tab 1266, Draft Multi Agency Exercise Report at pp. 4-5.
(g) Security staff will be able to assist with establishing staging areas for emergency responders, given their knowledge of the site.
7.400 NSWA did not participate in the exercise on 11 October 2023. The Draft Report noted that “[d]espite the non attendance of a [NSWA] representative, this Exercise was a very successful learning experience for the Centre ECO members who attended.”1183 Other evidence given in the Inquest hearings suggests that NSWA would attend exercises on a voluntary basis and were not paid for such attendance.1184 7.401 Ms Fatima participated in the MAE in October 2023 in the role of “CCTV Control Room Operator.” She described the main learning she took from the exercise was the need to be “…as quick as possible, as efficient as possible, and managing the time effectively.”1185 CCTV Control Room Operator training 7.402 There is a more extensive training programme in place for security officers who are to take on the role of CCTV Control Room Operator.
7.403 This reflects the added responsibility and pressure associated with the CCTV Control Room Operator role. These matters have already been addressed above. In particular, Mr David gave evidence that the CCTV Control Room Operator position:
(a) Is a critical role in terms of delivering situational awareness during an emergency;1186
(b) Requires the person to be proficient in Scentre’s systems, processes and communication protocols;1187
(c) Is a specialised role;1188
(d) Is a stressful role;1189 and
(e) Requires communication skills.1190 7.404 A security officer at WBJ must have completed their security officer induction prior to being considered for the CCTV Control Room Operator position.1191 Generally speaking, a security officer would not be considered for the CCTV Control Room Operator position until they had worked as a “rover” for three months.1192 This would permit the officer to 1183 Exhibit 1, Vol 38, Tab 1266, Draft Multi Agency Exercise Report at p. 6.
1184 Transcript, D9 (Simpson): T685.35-38 (9 May 2025).
1185 Transcript, D8 (Fatima): T642.34-T643.25 (8 May 2025).
1186 Transcript, D8 (David):T606.14-17 (8 May 2025).
1187 Transcript, D8 (David): T606.19-21 (8 May 2025).
1188 Transcript, D8 (David): T606.23-24 (8 May 2025).
1189 Transcript, D8 (David): T606.26-28 (8 May 2025).
1190 Transcript, D8 (David): T606.30-31 (8 May 2025).
1191 Transcript, D8 (David): T612.25-34 (8 May 2025).
1192 Transcript, D8 (David): T614.1-18 (8 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 have become familiar with the centre, including the layout and the location of key infrastructure and equipment that is relevant to the coordination and response responsibilities of the CCTV Control Room Operator role, and to have completed the primary induction training of core security officers (which, as noted above, takes about four weeks).1193 7.405 The process of selecting candidates for the CCTV Control Room Operator role involves agreement from the Scentre RSM/RSS and Glad’s site manager and client service manager.1194 Mr David gave evidence that: … Glad would dig through their pool of, of, of strong candidates, and then bring them in for like an interview, which would involve the client [Scentre].
… it would be an agreement with the team leadership, so definitely the client, so he would obviously have a say, Bradley Goldberg and Rahim, and also our leadership team, so you know, site manager, myself, the project training manager, client service manager would come to an agreement about who was a, a good candidate to, to run through the, the [C]ontrol [R]oom training.1195 7.406 Once a candidate was selected and agreed upon, they would complete training for the position of CCTV Control Room Operator. This involves one-on-one training with another experienced CCTV Control Room Operator.1196 Twenty one components of training are completed as required by the Control Room Training Checklist. The Control Room Training Checklist covered numerous topics, including: Telephone and Radio Procedure; EWIS operation and PA announcements; following a person of interest (POI) on CCTV; responding to emergencies; and understanding of the CMEO operations.1197 Mr David gave evidence that the checklist is a document prepared by Scentre and provided to Glad for use in CCTV Control Room Operator training.1198 Each component of training would be signed off by the trainee and the trainer (with any comments) upon completion.1199 The training ordinarily took approximately five to six weeks.1200 7.407 At the conclusion of training on all components, the checklist would be provided to the RSM or RSS, and the trainee would be assessed.1201 The assessment would include a verbal and a practical component to assess knowledge and skills associated with the CCTV Control Room Operator role. If deemed to have passed the assessment, the RSM or RSS would sign the checklist, thereby approving the candidate to “commence CCTV Control” room operation unsupervised.1202 1193 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [121]-[123].
1194 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [122].
1195 Transcript, D8 (David): T612.36-T613.11 (8 May 2025).
1196 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [124].
1197 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [124]; Transcript, D8 (David): T619.18-44 (8 May 2025).
1198 Transcript, D8 (David): T612.22-23 (8 May 2025).
1199 Transcript D8 (David): T621.32-48 (8 May 2025).
1200 Exhibit 1, Vol 48, Tab 1609C, Statement of Lulu Fatima at [24]; Transcript, D8 (David): T624.17-28 (8 May 2025).
1201 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [124]-[125].
1202 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [125]; Transcript, D8 (David): T614.1-33, T626.2223 (8 May 2025); Exhibit 1, Vol 37, Tab 1229, Email from Andrew David to Bradley Goldberg re “In rel & Control Training”, Annexure A, CR1 Training Checklist.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.408 The CCTV Control Room Operator then had an ongoing requirement to participate in training as directed or required.1203 Training: Faraz Tahir 7.409 Faraz Tahir was a security officer employed by Falkon and sub-contracted by Glad to work as an ad-hoc guard at WBJ. Faraz’s first shift at WBJ was on 13 April 2024.
7.410 Faraz was one of the first security officers to respond to the incident involving Mr Cauchi.
7.411 Faraz held a valid Security Industry Licence, with Class 1AE 2BC,1204 and a current Statement of Attainment for first aid and CPR.1205 7.412 Faraz completed the Scentre CX Life Safety Induction course on 9 April 2024, with a score of 100%, which was recorded on Beakon.1206 7.413 Faraz was provided a site orientation tour at WBJ on 13 April 2024 by security officer Qasim Shah.1207 7.414 The specific training of CR1, who was the Control Room Operator at WBJ on 13 April 2024 is considered at Section G.
Expert evidence on training 7.415 Mr Wilson gave expert evidence regarding the training provided by Scentre and Glad.
That evidence, in summary, was that:
(a) Scentre ensures security officers undergo an extensive training programme prior to deployment and during their employment in Scentre premises;1208
(b) The training of security personnel by Scentre and Glad, including the induction process, evacuation exercises, MAEs, and continual testing on knowledge, are overall excellent practice;1209 and
(c) Scentre and Glad have “great join-up” in terms of joint training and participation in training programmes.1210 1203 See, for example, Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg, Annexure E, Material regarding Fulcrum Workshops.
See also, Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at 101.
1204 Exhibit 1, Vol 30, Tab 995, Second Statement of Steve Iloski, Annexure A.m.ii, Statement of Attainment (issued 27 November 2023).
1205 Exhibit 1, Vol 30, Tab 995, Second Statement of Steve Iloski, Annexure A.m.i, Statement of Attainment (issued 27 November 2023).
1206 Exhibit 1, Vol 40, Tab 1575, CX Life Safety Induction; Exhibit 1, Vol 30, Tab 1576, Screenshot of CX Life Safety Induction record of Faraz Tahir.
1207 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at p. 471.
1208 Exhibit 1, Expert Volume, Tab 20, Expert Report of Scott Wilson at [3.1.5].
1209 Transcript, D14 (Wilson): T1208.18-27 (19 May 2025).
1210 Transcript, D14 (Wilson): T1208.29-36 (19 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.416 Mr Wilson gave evidence that training is a key component of ensuring security officers can respond to emergency incidents.1211 He observed that: … the human factors of time pressure, fear, unfamiliarity, weight of expectation, lack of control and information overload will always be a factor in these types of incidents.
Testing, Exercising and Resilience Training is vital to ensure all staff are equipped to deal with such circumstances. Learning from those exercises needs to be introduced into business as usual.1212 7.417 Mr Yates agreed that people react differently and can make errors in high-pressure scenarios, noting that the same applied equally to trained and experienced police.1213 7.418 Mr Wilson further expressed the view that, in relation to exercises: Scentre take exercising seriously with annual evacuation exercises and multi- agency exercising being delivered by independent consultancy companies. This should be viewed as excellent practice on behalf of this organisation.1214 7.419 In his report, and as addressed above, Mr Wilson identified a gap in terms of training provided to ad-hoc security staff as at 13 April 2024. Scentre and Glad have implemented further training for ad-hoc guards, including in respect of AAO incidents and counter terrorism.1215 Mr Wilson considered this a “great improvement” in his evidence.1216 7.420 The expert evidence regarding the training of CR1 is considered in Section E.
Submissions Written submissions 7.421 It was submitted by Counsel Assisting that, as observed by Mr Wilson, Scentre and Glad require security personnel to undergo an extensive training programme prior to and during their deployment in Scentre premises. This training programme continues through the entirety of the period in which the security officer is employed by Glad.
7.422 It is submitted that in totality, the training programme designed by Scentre and implemented in conjunction with Glad is extensive, both in terms of content and its ongoing nature, and represents good practice. That is not a matter that could be disputed. The content of the programme is comprehensively set out above.
1211 Transcript, D14 (Wilson): T1208.6-8 (19 May 2025).
1212 Exhibit 1, Expert Volume, Tab 20, Expert Report of Scott Wilson at [6.7.2].
1213 Transcript, D15 (Yates): T1302.18-T1303.20 (20 May 2025).
1214 Exhibit 1, Expert Volume, Tab 20, Expert Report of Scott Wilson at [3.1.14].
1215 Exhibit 1, Vol 42, Tab 1599A, Supplementary Statement of John Yates (Director of Security) at p. 41; Transcript, D15 (Yates): T1312.36-T1313.22 (20 May 2025).
1216 Transcript, D14 (Wilson): T1209.4-15 (19 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.423 Counsel Assisting submit that Mr Wilson identified in his evidence potential areas for improvement, including in relation to the topics addressed during training, as well as the training provided to ad-hoc security officers. Scentre has taken on board Mr Wilson’s recommendations, including by making changes to its training programme in response.
This is further considered in Section K.
7.424 Counsel Assisting submit that it is acknowledged by Scentre and Glad that there was a shortage of appropriately trained CCTV Control Room Operators in late 2023. Whilst there is evidence that all involved in the recruitment of security staff were aware of associated recruitment pressures, the evidence does not suggest that this, of itself, directly compromised any recruitment or training of staff.
7.425 Glad submitted that the nature and extent of training provided to its security officers was both comprehensive and thorough and respectfully submits that the training was sufficient to enable staff to perform their duties safely and effectively. Glad’s security training equipped officers to observe, report, and escalate incidents. Notwithstanding the high level of training staff received, Glad has taken proactive steps to remediate any missed opportunities that have been identified.
Oral submissions 7.426 Counsel for Scentre accepted that that ad hoc security staff did not receive the full suite of training that core security staff received.1217 Findings 7.427 Whilst there was evidence that there was a shortage of appropriately trained CCTV Control Room Operators in late 2023, there is no evidence that recruitment pressures directly compromised any recruitment or training of staff.
7.428 I am satisfied that Scentre and Glad require security personnel to undergo an extensive training programme prior to and during their deployment in Scentre premises. I accept the evidence that both Scentre and Glad have taken proactive steps to remediate any missed opportunities that have been identified.
Training and background of CR1 7.429 While, as stated above, the focus of this Inquest was not to attribute blame or fault to any particular person, scrutiny of what occurred that day inevitably led to the actions of particular individuals assuming some focus. That was the case with CR1.
7.430 CR1 was the CCTV Control Room Operator at the time of the incident on 13 April 2024.
As will be discussed more fully later in this Part, some of CR1’s actions were the subject 1217 Transcript, Closing Submissions D2: T1967.17-18 (28 November 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 of criticism by Mr Wilson. Some of those criticisms were accepted by Scentre. Others were not.
7.431 The evidence of Mr Wilson raised the issue of CR1’s competency and, accordingly, whether she should have been left alone, unsupervised, in the CCTV Control Room on 13 April 2024.
7.432 These questions resulted in a need to examine the adequacy of the training received by CR1 prior to 13 April 2024, which in turn informed consideration of CR1’s ability to respond on that date.
7.433 This section sets out the training and development received by CR1 at WBJ prior to 13 April 2024 (primarily relating to her role as a Control Room Operator). Three main issues arose from examination of this evidence, being:
(a) The circumstances in which all topics in CR1’s Control Room Training Checklist came to be dated the same date (being 31 January 2024);
(b) The timing and nature of review/s undertaken of CR1, to approve her becoming a Control Room Operator (in early 2024); and
(c) Whether CR1 was competent to work in the CCTV Control Room on 13 April 2024 unsupervised, and to what extent (if any) Scentre and/or Glad were aware, or should have been aware, of any concerns regarding CR1’s competency prior to 13 April 2024, and, if so, whether adequate steps were taken in response.
7.434 As noted above, it is important to remember that whilst it is necessary to carefully examine how the events on 13 April 2024 came to unfold, consideration of CR1’s competency for the role she was in on 13 April 2024 is not about attributing blame to her as an individual.
7.435 Counsel Assisting and the parties, including family members, did not seek to apportion blame to CR1. The submissions on behalf of the Tahir family specifically commented that they intend no disrespect to CR1, and that CR1 does not bear responsibility for the tragic events,1218 and the submissions on behalf of the Darchia family stated that they do not blame CR1.1219 Training and development of CR1 at WBJ CR1 commences at WBJ (late 2023) 7.436 In around late October 2023, CR1 commenced working at WBJ. Prior to that, she had worked in the security industry for approximately four years.1220 1218 Written submissions on behalf of the Tahir family at [15], [44].
1219 Written submissions on behalf of the Darchia family at [7.b].
1220 Exhibit 1, Vol 4, Tab 291, Statement of CR1 at [3].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.437 On 31 October 2023, CR1 completed a “Customer Experience Life Safety Induction”. On 1 November 2023, CR1 completed a “Customer Experience Security Site Orientation Checklist”.1221 Andrew David was involved in CR1’s induction during November 2023.1222 7.438 On 5 November 2023, CR1 worked her first shift at WBJ. CR1 continued to work as a “retail rover” throughout November and December 2023.1223 7.439 In late 2023, there was a particular need to increase the number of available CCTV Control Room Operators at WBJ given the departure and long-term leave of other experienced CCTV Control Room Operators at around that time.1224 7.440 CR1 was identified as a potential CCTV Control Room Operator by Glad after she had expressed interest in the role.1225 By 27 December 2023, CR1 had commenced training for that position.1226 Counsel Assisting submitted that CR1’s training was principally conducted by Mr David and Lulu Fatima (Control Room Operator at WBJ from Glad),1227 and Scentre and Glad submitted that Ms Fatima primarily trained CR1.1228 7.441 On 5 January 2024, a Red Book audit for CR1 was conducted by Mr David, which indicated CR1 was unable to answer questions regarding "What are the two main objectives?" and “What are the five main staff assignments in connection with an active armed offender scenario?".1229 7.442 On 17 January 2024, CR1 had a further Red Book audit and again did not correctly answer the question concerning the two main objectives in an AAO event.1230 Control Room Training Checklist (dated 31 January 2024) 7.443 Training for the role of CCTV Control Room Operator at WBJ is recorded on a “Control Room Training Checklist” (the Checklist). The Checklist is Scentre and Westfield branded, and a field for the trainee’s name appears at the top. There are 21 training topics recorded in the left-hand column. These include “EWIS/FIP panel operation + PA announcement”, “Emergency Response-Co-Coordinating Emergencies/Emergency contacts and numbers”, “General Knowledge of the Computer Towers/Location and what tower controls what screen”, and “Strong understanding of the CMEO operation”.
7.444 Against the column of topics are three further columns entitled “Date”, “Trainee signature”, and “Trainer signature & comments”. Towards the bottom there is a section 1221 Exhibit 1, Vol 40, Tab 1541, Customer Experience Life Safety Induction; Exhibit 1, Vol 40, Tab 1538, Customer Experience Security Site Orientation Checklist.
1222 Transcript, D8 (David): T608.19-30 (8 May 2025).
1223 Exhibit 1, Vol 37, Tab 1231, Weekly Operational Minutes, “Guarding Levels” at p. 1; Transcript, D9 (Goldberg): T744.30-46 (9 May 2025); Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [137].
1224 Transcript, D9 (Goldberg): T744.48-T745.3 (9 May 2025).
1225 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [136]; Transcript, D8 (David): T630.39-44 (8 May 2025).
1226 Exhibit 1, Vol 37, Tab 1231, Weekly Operational Minutes, “Staff Training” at pp. 1-2.
1227 Written submissions of Counsel Assisting at [1331].
1228 Written submissions on behalf of Scentre at [164]; Written submissions on behalf of Glad at [31].
1229 Transcript, D8 (David): T627.5-31 (8 May 2025).
1230 Transcript, D8 (David) T8634:45-T635:3 (8 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 entitled “Risk & Security Manager’s Comments” and “Approved to Commence Security Control”. At the very bottom are the fields “Name”, “Signature” and “Date” below which the following is stated: *Note: Please sign and date above to acknowledge that I have received and understood the training in the procedure for Control Room and I agree to comply with my OH&S responsibilities and this procedure whilst undertaking my tasks associated with this Centre.
7.445 On 3 January 2024, it was noted in WBJ’s Weekly Operational Minutes (the Minutes): “[CR1] to go through checklist for [C]ontrol [R]oom training”.1231 7.446 On 31 January 2024, Mr David sent an email to Mr Goldberg (copying Shaun Luxford of Glad), attaching a completed Control Room Training Checklist. In that email, Mr David stated: Attached Control Room Training Checklist for [CR1].
My feedback for Supervisor and Control Coverage: … [CR1] (Control) - [CR1] is signed off by both myself and Lulu and ready to commence a position as Control. There will be things that she will only learn if given the opportunity to step into the role, and myself [and] Lulu will be here to provide this feedback. 1232 7.447 The Control Room Training Checklist attached to that email does not record CR1’s name or her signature anywhere. Where “Name of Trainee” appears at the top of the document, it records “31-01-24 ANDREW DAVID”. Against all 21 topics: “31/01/24” appears in the date column; “ANDREW” and “LULU” are recorded in the “Trainee signature” column; and the signatures of Mr David and Ms Fatima appear in the “Trainer signature & Comments”. Nothing is recorded against “Risk & Security Manager’s Comments” nor “Approved to Commence Security Control”. As previously stated, the document is unsigned by CR1, including in relation to the acknowledgement that training has been received and understood.1233 7.448 At 4:24pm on the same date (31 January 2024), Bradley Goldberg replied stating “[i]f you feel she’s ready, I’m happy to test her tomorrow. Let me know. I’m free in the afternoon”.1234 7.449 The CCTV Control Room Checklist is addressed further below.
1231 Exhibit 1, Vol 37, Tab 1231, Weekly Operational Minutes, “Staff Training” at pp. 1-2.
1232 Exhibit 1, Vol 37, Tab 1229, Email from Andrew David to Bradley Goldberg re “In rel & Control Training”; Transcript, D8 (David): T618.32-T619.11 (8 May 2025).
1233 Exhibit 1, Vol 37, Tab 1229, Email from Andrew David to Bradley Goldberg re Supervisor Coverage & Control Training.
1234 Exhibit 1, Vol 37, Tab 1230, Email from Bradley Goldberg dated 31 January 2024, p. 1.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Events from February to April 2024 7.450 On 8 February 2024, CR1 had her first shift in the CCTV Control Room at WBJ.1235 7.451 The approval of CR1 to commence as a CCTV Control Room Operator is addressed further below.
7.452 On 16 March 2024, CR1 completed a “Red Book AAO revision”.1236 Scentre submitted this was organised for all security officers and did not involve an assessment or “signoff”.1237 7.453 On 2 April 2024, CR1 attended a Terrorism Awareness and Emergency Management Workshop.1238 Weekly Operational Minutes 7.454 From around mid-February 2024 to 10 April 2024, the Minutes record various entries in relation to CR1’s performance in her role as the CCTV Control Room Operator. This includes the following:1239
(a) 21 February 2024 (under “Staff responses” heading): “[CR1] will need to [do] some more training in control especially during mult[iple] incidents.”
(b) 21 February 2024 (under “Incident reports” heading): “[N]ot getting better, [CR1] reports need work [l]ots of details missing.”
(c) 13 March 2024 (under “Controllers” heading): “[CR1] needs further training, Doesnt follow up with further details, constantly [sic] asks to repeat, Labelling photos correctly.”
(d) 13 March 2024 (under “Incident reports” heading): “[CR1] needs updated training.”
(e) 24 March 2024 (under “Incident reports” heading): “Still ongoing issues with
(f) 27 March 2024 (under “Controllers” heading): “Ongoing issues with [CR1], Reschedule Full Control room Trainig [sic] again with [CR1].”
(g) 27 March 2024 (under “Staff responses” heading): “Code Red Response from [CR1] not handled appropriate”.
1235 Exhibit 1, Vol 43, Tab 1600A, Supplementary statement of Bradley Goldberg at [126.c], [137], [140].
1236 Exhibit 1, Vol 38, Tab 1275, Glad Group Memo.
1237 Written submissions on behalf of Scentre at [168].
1238 Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg, Annexure D, Training Log – training received by Bradley Goldberg (3 January 2018 – 2 April 2024) at p. 62.
1239 Exhibit 1, Vol 37, Tab 1231, Weekly Operational Minutes, Staff responses at pp. 1-2.
(h) 10 April 2024 (under “Controllers” heading): “Responses from [CR1] too slow Retraining to be rescheduled for [CR1]”.
Completion of the Control Room Training Checklist Evidence 7.455 Ms Fatima gave evidence that from December 2023 to early January 2024, she would sit with CR1 during shifts in the CCTV Control Room to supervise her, that CR1 completed all training topics in the Control Room Training Checklist over about five to six weeks, and that Mr David would audit CR1 once a particular training topic had been completed.1240 7.456 With respect to the CCTV Control Room Training Checklist completed by Ms Fatima and Mr David dated 31 January 2024, Ms Fatima, Mr David, and Mr Goldberg gave the following evidence in relation to how it was that all topics came to be signed off on the same date:
(a) Mr David gave evidence that he did not recall the actual testing for the sign-off (on 31 January 2024), however, the reason all topics were signed off on the same date may have been because they were signed off in one go after all were completed adequately.1241 He accepted it was not possible to test someone on all 21 topics in a single day.1242 Mr David stated he was confident he would not have approved CR1 as competent if she had not completed the training as listed on the checklist.1243
(b) Ms Fatima gave evidence that all the training on the checklist was not undertaken on the same date. Mr David asked her to sign the checklist either on 30 or 31 January 2024, after she had completed all the training topics and Mr David had audited CR1 on each topic;1244 and
(c) Mr Goldberg gave evidence that the checklist would ordinarily have different dates recording when training was completed (as it was not possible for the training to be delivered on one day) and that: In regards to the multiple dates, I believe that they'd lost the original paperwork.
There was a lot of confusion with paperwork around that time. With so many training managers, it wasn't uncommon for the originals to get misplaced at that 1240 Exhibit 1, Vol 48, Tab 1609C, Statement of Lulu Fatima at [24]; Transcript, D8 (Fatima): T650.47-T651.41 (8 May 2025); Transcript, D8 (David): T624.17-29 (8 May 2025); Transcript, D8 (Fatima): T650:29-45 (8 May 2025); Transcript, D8 (Fatima): T652.1-19 (8 May 2025).
1241 Transcript, D8 (David): T619.46-T620.13 (8 May 2025).
1242 Submissions of Counsel Assisting at [1344].
1243 Transcript, D8 (David): T620.1-21, 23-32 (8 May 2025); Exhibit 1, Vol 49, Tab 1609B, Statement of Andrew David at [10].
1244 Transcript, D8 (Fatima): T656.1-21 (8 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 stage. So my initial thought when I saw that is that they lost the original, and then they've just signed it on the date that they finished everything. 1245 7.457 In relation to Mr David’s email dated 31 January 2024 attaching the Control Room Training Checklist, Mr David gave evidence that he assumed that whilst CR1 was learning on the job she would be “heavily supervised”, and that while that was not referred to in the email to Mr Goldberg, he assumed he would have discussed it with either Cameron Stuart (of Glad), Mr Luxford, Mr Goldberg or Mr Zaidi.1246 7.458 Mr Goldberg gave evidence that the checklist dated 31 January 2024 having the same date (for each topic) was not satisfactory practice.1247 7.459 With respect to Control Room CCTV Checklists more generally, Mr David gave evidence that the Control Room Training Checklist is a document prepared by Scentre and provided to Glad for use in CCTV Control Room Operator training.1248 Each component of training would be signed off by the trainee and the trainer (with any comments) as each was completed.1249 The training ordinarily took approximately five to six weeks.1250 At the conclusion of training on all components, the checklist would be provided to the RSM or RSS, and the trainee would be assessed (including a verbal and a practical component).1251 If deemed to have passed the assessment, the RSM or RSS would sign the checklist, thereby approving the candidate to “commence CCTV Control” room operation unsupervised.1252 The CCTV Control Room Operator then had an ongoing requirement to participate in training as directed or required.1253 Submissions 7.460 Counsel Assisting submitted that each topic on CR1’s Control Room Training Checklist, having been signed off on the same date (31 January 2024), was in contrast to other checklists (for other staff), and those other checklists demonstrated training had occurred over different dates and months.1254 7.461 Counsel Assisting submitted that the evidence suggests CR1 ostensibly completed all training required to be undertaken (as at January 2024) relevant to the role of CCTV Control Room Operator; however, that the evidence regarding CR1’s training is 1245 Transcript, D9 (Goldberg): T749.44-49, T751.24-30 (9 May 2025).
1246 Transcript, D8 (David): T625.15-T626.2 (8 May 2025).
1247 Transcript, D9 (Goldberg): T752 (9 May 2025).
1248 Transcript, D8 (David): T612.22-23 (8 May 2025).
1249 Transcript D8 (David): T621.32-48 (8 May 2025).
1250 Exhibit 1, Vol 48, Tab 1609C, Statement of Lulu Fatima at [24]; Transcript, D8 (David): T624.17-28 (8 May 2025).
1251 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [124]-[125].
1252 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [125]; Transcript, D8 (David): T614.1-33, T626.2223 (8 May 2025); Exhibit 1, Vol 37, Tab 1229, Email from Andrew David to Bradley Goldberg re Supervisor Coverage & Control Training, Annexure A, CR1 Training Checklist.
1253 See, for example, Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg, Annexure E, Material regarding Fulcrum Workshops.
See also, Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at 101.
1254 Written submissions of Counsel Assisting at [1342].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 “unsatisfactory and remains opaque”, including as to why the CCTV Control Room Training Checklist was all signed off on the same date .1255 7.462 Counsel Assisting submitted that: … there was no proper explanation as to why the CCTV checklist was signed off on the same day by Ms Fatima and Mr David. Mr Goldberg offered the further perspective that they had lost the original checklist, but what really happened was not resolved.1256 7.463 The submissions on behalf of the Tahir family agreed that the evidence regarding this checklist was unsatisfactory and opaque.1257 Further, it was submitted on behalf of the Tahir family that: The Control Room Training checklist was not signed off by CR1, but by her trainers. This was not adequate. The document leaves open the possibility that CR1 either didn’t complete her training and/or she completed her training all in one day …1258 7.464 It was submitted on behalf of Glad that: Some criticism has been made of the [C]ontrol [R]oom checklist. It is accepted by Glad that the documentation in relation to CR1 and her initial training in respect of the checklist was less than satisfactory. But importantly is whether or not the training occurred, and it's without doubt that it did …1259 7.465 It was also submitted on behalf of Glad that there is overwhelming evidence that between December 2023 and April 2024, CR1 did receive satisfactory training and supervision from a number of experienced personnel, including primarily Ms Fatima, and that CR1 was deemed competent to be a Control Room Operator. It was submitted on behalf of Glad that this body of evidence should be accepted. 1260 7.466 It was submitted on behalf of Scentre that CR1’s Control Room training occurred between 22 December 2023 and 31 January 2024; the CCTV Control Room Training Checklist topics require about five to six weeks to be comprehensively covered and it was not indicative of it having been rushed, contrary to a submission on behalf of the Tahir family; Ms Fatima confirmed that she trained CR1 in everything on the Control Room checklist, involving demonstrating and sitting with CR1 in her shifts; and Ms Fatima confirmed Glad assessed CR1 for each topic. 1261 Findings 7.467 The evidence as to how or why the CCTV Control Room Checklist came to have all topics signed off on the same date of 31 January 2024 is entirely unsatisfactory. I am not 1255 Written submissions of Counsel Assisting at [1370]; Transcript, Closing Submissions D1: T1925.34-35 (25 November 2025).
1256 Transcript, Closing Submissions D1: T1925.38-41 (25 November 2025).
1257 Submissions on behalf of the Tahir family at [39].
1258 Submissions on behalf of Tahir family at [26].
1259 Transcript, Closing Submissions D1: T1958.21-24 (25 November 2025).
1260 Written submissions on behalf of Glad at [59].
1261 Written submissions on behalf of Scentre at [164]-[165].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 satisfied that there has been an adequate explanation provided as to why the checklist was signed off on the same date in the way it was, given the evidence is clear that the training did not all occur on that one day.
7.468 There has also been insufficient explanation as to why that checklist was not signed by
7.469 The documentation was clearly less than satisfactory as no witness has been able to clearly say, definitively, what happened to bring about the checklist in the form it was.
Whilst Mr Goldberg gave evidence that he believed the original paperwork must have been lost, that is only a matter of speculation as to what may have occurred.
Timing and nature of reviews undertaken to approve CR1 commencing as a Control Room Operator (early 2024) Evidence 7.470 Mr Goldberg’s evidence regarding the timing of the reviews he was involved in included the following:
(a) In his statement dated 14 February 2025: 1262 i. Mr Goldberg does not recall whether he tested CR1 the day after his email dated 31 January 2024 (which indicated that if Mr David felt CR1 was ready, Mr Goldberg could test her the next day); ii. CR1 had her first shift as a Control Room Operator on 8 February 2024; iii. Mr Goldberg said “In an update on 14 February 2024, to my recollection following an assessment by either [Mr Zaidi] or myself, … We did not sign off her approval at the time pending this further work”. Scentre submitted this update on 14 February 2024 refers to an entry in the Minutes on that date; iv. After a further month of working shifts in the Control Room, on about 13 March 2024, Mr Zaidi and/or Mr Goldberg “took [CR1] through a verbal assessment to again test her knowledge and competency and determined that she needed further training”; v. On an unknown date in around March 2024, Mr Goldberg went to the Control Room to conduct a review of CR1 and to the best of his recollection, Mr Zaidi had already reviewed CR1. Mr Goldberg asked CR1 questions from the checklist. He did not recall there being any significant deficiencies or red flags and he recalls CR1 understood and met about 90% of the criteria. He cannot recall whether he signed the checklist that 1262 Exhibit 1, Vol 44, Tab 1600A, Supplementary statement of Bradley Goldberg at [139]-[146]:
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 day and he would usually have left it with Ms Fatima (who was present at the time and responsible for the ongoing training).
(b) In Mr Goldberg’s oral evidence on 9 May 2025, he said the following: 1263 i. He believes Mr Zaidi conducted the first review with CR1 at some stage and she did not pass.
Although Mr Goldberg’s email dated 31 January 2024 at 4:24pm suggested “[i]f you feel she’s ready, I’m happy to test her tomorrow. Let me know. I’m free in the afternoon…”. Mr Goldberg said, “I believe I would have sent Rahim [Zaidi] down to the first one, and I did the second”.
Mr Goldberg gave evidence that he believes Mr Zaidi did the first review and Mr Goldberg did the second, because he distinctly remembers Mr Zaidi mentioning that he had failed CR1 and telling Mr Goldberg the areas that needed a little bit more work. Also, Mr Zaidi “would normally do the first assessments of the [C]ontrol [R]oom [O]perators, because he was a previous experienced [C]ontrol [R]oom [O]perator, so he had a lot more insight into the technical aspects of the systems to a degree than, than myself”. Counsel Assisting acknowledged that these questions would be taxing Mr Goldberg’s memory.
ii. Once CR1 was retrained and re-assessed, Mr Goldberg then conducted a second review of CR1 with CR1 in the CCTV room. Mr Goldberg corrected his statement by clarifying that the review he had referred to as occurring on about 13 March 2024 actually happened sometime around 14 February
A. Correct.
Q. Are you able to tell us the dates, firstly of Rahim [Zaidi]'s review?
A. Rahim [Zaidi]'s review would've been maybe close to this period of time, and mine would have been about a week or so, potentially, after, because she didn't pass.
I note Scentre submitted that Mr Goldberg was referring to “close to” 31 January 2024 when Mr David sent him the checklist.1264 Q. Was the testing that - I'll come to your testing. You think you conducted similar testing about a week later. Is that right?
1263 Transcript, D9 (Goldberg): T751.7-754.20 (9 May 2025).
1264 Written submissions on behalf of Scentre at [133].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 A. Correct.
Q. In this statement, I'll just ask you to correct it. You say at paragraph 141, "After a further month of working shifts in the [C[ontrol [R]oom on about 13 March 2024, Rahim [Zaidi] and or myself undertook CR1 through a verbal assessment". You think now that that happened much earlier. Is that right?
A. That's correct.
Q. Approximately when?
A. Approximately like maybe a week or two after the initial assessment.
Q. Sometime around 14 February rather than 14 March. Is that right?
A. Correct.
I note Counsel Assisting submitted that Mr Goldberg was referring to this being approximately two weeks after 31 January 2024 when Mr David and Ms Fatima completed their sign-off,1265 whereas Scentre submitted he was referring to approximately a week or two after the initial assessment by Mr Zaidi. 1266 iii. Mr Goldberg had a memory of that review. It took about an hour and a half.
They went through the checklist as a guide. Ms Fatima was also present in the room.
Mr Goldberg believed he completed a document which is not in evidence, and he does not know where that checklist is. The basis for Mr Goldberg’s belief that he completed it was that at the time, he was using it step-bystep to make sure he covered everything. The process at the time was to hand all documentation to the Glad supervisors to update to a “G drive” and he believes he handed the checklist to Ms Fatima to be uploaded (which was not uploaded by Glad). Ultimately, “there were a few areas like the incident report writing, some of the bigger things that we needed to address” and he said to Ms Fatima “You heard that. All right, let’s work on those things”.
7.471 The Minutes include entries under the heading “Controllers” indicating: 1267
(a) On 7 February 2024:,“[CR1] [sic] is doing Okay final training today”; and
(b) On 14 February 2024, “[CR1] is doing well though still requires little more work…”.
1265 Written submissions of Counsel Assisting at [1350].
1266 Written submissions on behalf of Scentre at [139].
1267 Exhibit 1, Vol 37, Tab 1231, Weekly Operational Minutes at p. 2.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Submissions 7.472 As noted above, CR1 had her first shift in the CCTV Control Room on 8 February 2024.
7.473 Counsel Assisting in written submissions submitted that the evidence suggests Mr Zaidi conducted a first review of CR1 on 7 February 2024 (which she did not pass) and Mr Goldberg conducted a review of CR1 on around 14 February 2024. In particular, Counsel Assisting submitted: 1268
(a) Mr Goldberg gave evidence that on approximately 7 February 2024, Mr Zaidi conducted a first review of CR1, that CR1 did not pass that, and that there were a few areas that needed to be addressed;
(b) Despite that, on 8 February 2024, CR1 had her first shift as a CCTV Control Room Operator; and
(c) Mr Goldberg gave evidence that he conducted a second review of CR1 approximately two weeks after the sign-off by Mr David and Ms Fatima (that is, on around 14 February 2024). Mr Goldberg gave evidence as to what the review included, although accepted there was no record that this had occurred. It is ultimately not known what the content of this further training was.
7.474 However, it was submitted on behalf of Scentre that the evidence suggests Mr Zaidi conducted a first review of CR1 closer to 1 February 2024 than 7 February 2024 (which CR1 did not pass), and Mr Goldberg conducted a review of CR1 on or around 7 February 2024 (which she did pass, before her first shift as a Control Room Operator on 8 February 2024). In particular, Scentre’s submissions provided: 1269
(a) Mr Zaidi conducted a first review of CR1, which is the review she “failed”, however that was performed closer to 1 February 2024 than 7 February 2024.
This is suggested by Mr Goldberg’s email having been sent on 31 January 2024 at 4:24pm, although it ended up being Mr Zaidi (rather than Mr Goldberg) who conducted that first review.
Mr Goldberg’s evidence was that Mr Zaidi’s first review occurred close to 31 January 2024. Contrary to Counsel Assisting’s submissions, no evidence of Mr Goldberg has been identified that provides that Mr Zaidi conducted a first review of CR1 on approximately 7 February 2024. There is insufficient evidence to support an adverse finding that Mr Zaidi’s review of CR1 was on approximately 7 February 2024; and
(b) Mr Goldberg sought corrections in his evidence, including that he believed he conducted only one assessment (instead of two) of CR1 in the Control Room, which occurred on or around 7 February 2024. Mr Goldberg also believed that he 1268 Written submissions of Counsel Assisting at [1348]-[1350].
1269 Written submissions on behalf of Scentre at [125]-[127], [136], [141]-[143], [150]; Transcript, Closing Submissions D2:T1969.2941 (28 November 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 signed a Control Room checklist that he used to assess CR1 (however, subsequently that checklist had been misplaced as there “was a lot of confusion with paperwork” at the time, which has since been rectified). CR1 successfully completed this assessment, before her first shift in the CCTV Control Room as an Operator on 8 February 2024, and Mr Goldberg, on this occasion, signed off CR1 to commence being rostered as a Control Room Operator. Mr Goldberg gave detailed oral evidence about how the assessment was done and said CR1 met about 90% of the criteria and needed finessing on some aspects, which were not significant deficiencies or red flags.
This is the most significant assessment or review of CR1, because it cleared CR1 to work in the CCTV Control Room.
7.475 Further, it was submitted on behalf of Scentre that Mr Goldberg (in his oral evidence) referred to his unclear memory of the dates on which the reviews occurred (and his statement was qualified in terms of timeframes); however, Mr Goldberg’s memory of the content of the review he conducted with CR1 was more detailed than his recollection of the date, and he did his best to accurately recount the details of what occurred. Scentre submitted that, contrary to other submissions, Mr Goldberg did not identify during his review issues with CR1’s “suitability” for the role of Control Room Operator. 1270 7.476 Ultimately, Counsel Assisting submitted that the evidence regarding CR1’s training including the content of further reviews undertaken by Mr Goldberg and Mr Zaidi was “unsatisfactory and remains opaque”, that there is a lack of clarity as to who did signoffs from Scentre’s perspective and when those occurred, and that despite “the valiant efforts by Scentre to recast Mr Goldberg's frank evidence” (in the written submissions on behalf of Scentre), “nothing in Scentre's submissions make the situation any less opaque”. 1271 7.477 Counsel Assisting also submitted that: Mr Goldberg referred to having conducted his sign-off of CR1 by reference to a checklist, which he completed, and which he accepted was not in evidence and that he doesn't know where that document is. We've given the transcript references. It's again another mystery in respect of the sign-off process that hasn't been answered, and it raised more concerns about the entire training procedure. I just interrupt myself to say, there's no intention to be critical of Mr Goldberg, he was doing his best to assist the Court, but the evidence remains in a state that is unsatisfactory. 1272 7.478 It was submitted on behalf of Scentre in terms of possible adverse findings that: There is insufficient evidence to support making adverse findings that i) the evidence of the reviews undertaken by Mr Goldberg and Mr Zaidi is “unsatisfactory and remains opaque” and/or ii) that CR1 failed a review on 7 February 2024 and then had her first 1270 Written submissions on behalf of Scentre at [144]-[145], [149].
1271 Written submissions of Counsel Assisting at [1370]; Transcript, Closing Submissions D1: T1925.30-36 (25 November 2025).
1272 Transcript, Closing Submissions D1: T1925.48-T1926.5 (25 November 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 shift as a Control Room Operator the next day on 8 February 2024; and such findings are not open to be properly made, including taking into account Neat Holdings Pty Ltd v Karajan Holdings Pty Ltd (1992) 67 ALJR 170 at 171) (Neat Holdings case). 1273 Findings 7.479 There is no documentary evidence showing when the reviews of CR1 (to approve her commencing as a CCTV Control Room Operator) were performed. That in itself is unsatisfactory.
7.480 The evidence before me is as follows:
(a) In his reply to Mr David on 31 January 2024, Mr Goldberg indicated that he would be happy to test CR1 “tomorrow”;
(b) On 7 February 2024, the Minutes record “[CR1] is doing Okay final training today”;
(c) On 14 February 2024, the Minutes record “[CR1] is doing well though still requires little more work…”;
(d) In his statement dated 14 February 2025, Mr Goldberg stated: i. He did not recall whether he tested CR1 on 1 February 2024; ii. CR1 undertook her first shift in the Control Room on 8 February 2024; iii. Prior to the “update” that occurred on 14 February 2024, CR1 had been assessed by himself or Mr Zaidi and she was not “signed off”; iv. After a “further month of working shifts in the [C]ontrol [R]oom” he or Mr Zaidi took CR1 through a verbal assessment and “determined that she needed further training”; v. In around March 2024, he went to the control room in the late afternoon “to conduct a review of CR1.” Mr Zaidi had already reviewed her; and vi. He reviewed CR1 in the presence of Ms Fatima, and CR1 “understood and met most, as in about 90%, of the criteria and … also needed finessing of some aspects”.
(e) In his oral evidence on 9 May 2025, Mr Goldberg: i. Stated he believed Mr Zaidi conducted the first review of CR1 because he recalls Mr Zaidi telling him that CR1 did not pass; 1273 Written submissions on behalf of Scentre at [127].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 ii. Stated that Mr Zaidi’s first review occurred “close to” the 31 January 2024, and that his review was “a week or so, potentially, after, because she didn’t pass”; and iii. Accepted as correct that his assessment of CR1 occurred “sometime around 14 February rather than 14 March”.
7.481 Having regard to the above, I do not consider that there is clear and cogent evidence as to when the reviews of CR1 by Mr Zaidi and Mr Goldberg occurred, and accordingly, it is not possible to make a finding about when these may have occurred.
7.482 I do not consider there to be sufficient evidence for me to make a finding that CR1 was assessed for the purposes of becoming a CCTV Control Room Operator, and that she successfully completed that assessment, on or before 7 February 2024.
7.483 I am unable to find when it was that CR1 was reviewed/assessed for the purposes of her approval to work as a CCTV Control Room Operator.
Whether CR1 was competent to work in the CCTV Control Room on 13 April 2024 unsupervised 7.484 As previously discussed, CR1 participated in a Red Book audit in early January 2024, and she was unable to answer questions regarding "What are the two main objectives in an AAO scenario?" and “What are the five main staff assignments in connection with an active armed offender scenario?". 1274 In a further Red Book audit on 17 January 2024, CR1 again did not correctly answer the question concerning the two main objectives in an AAO event. 1275 7.485 As set out above there were a number of references to CR1 in the Minutes between midFebruary 2024 to 10 April 2024. These included the following: 1276
(a) On 21 February 2024 (under “Staff responses” heading): “[CR1] will need to [do] some more training in control especially during mult[iple] incidents.”
(b) On 21 February 2024 (under “Incident reports” heading): “[CR1] reports need work [l]ots of details missing.”
(c) On 13 March 2024 (under “Controllers” heading): “[CR1] needs further training, Doesnt follow up with further details, constantly [sic] asks to repeat, Labelling photos correctly.”
(d) On 13 March 2024 (under “Incident reports” heading): “[CR1] needs updated training.” 1274 Transcript, D8 (David): T627.5-31 (8 May 2025).
1275 Transcript, D8 (David): T634:36-T635:3 (8 May 2025).
1276 Exhibit 1, Vol 37, Tab 1231, Weekly Operational Minutes, Staff responses at pp. 1-2.
(e) On 24 March 2024 (under “Incident reports” heading): “Still ongoing issues with
(f) On 27 March 2024 (under “Controllers” heading): “Ongoing issues with [CR1], Reschedule Full Control room Trainig [sic] again with [CR1].”
(g) On 27 March 2024 (under “Staff responses” heading): “Code Red Response from [CR1] not handled appropriate”.
(h) On 10 April 2024 (under “Controllers” heading): “Responses from [CR1] too slow Retraining to be rescheduled for [CR1]”.
7.486 It appears from the Minutes that Mr Goldberg, Mr Stuart, Mr Helg, Mr Rod Moolman and Mr Zaidi attended at least the meeting on 10 April 2024. The Minutes are themselves an iterative document and the Minutes dated 10 April 2024 included all of the above entries.
Evidence of lay witnesses 7.487 Ms Fatima gave evidence that CR1 was competent to be a CCTV Control Room Operator in March and April 2024. She noted that CR1 required assistance when multiple events were happening at once, but that CR1 should have been able to respond to emergencies.
CR1’s communication and competencies had improved from December 2023/January
(a) Ms Fatima’s statement dated 2 May 2025 provided: 1278 Prior to 31 January 2024 as a part of [CR1]'s training some areas of improvement were identified in relation to her. One issue that was identified was around her communication style. Another issue that was identified for improvement, early on in [CR1]'s training, was the operations of the CCTV systems which were understandably new to her. Overall, these issues were addressed as a part of [CR1]'s training and by 31 January 2024, [CR1] was competent to be a Control Room Operator.
[CR1] was noted to be keen to learn the role of Control Room Operator. If I had any serious concerns about [CR1]'s ability to perform this role, I would not have signed her off on the training form.
(b) In oral evidence, Ms Fatima noted “escalation” as another area for improvement for CR1. With respect to CR1’s communication style, Ms Fatima described CR1 as having difficulty understanding other officers’ dialect, slang and accents. In terms of CR1’s ability to operate the CCTV systems, Ms Fatima explained that it 1277 Transcript, D8 (Fatima): T661:13-49 (8 May 2025).
1278 Exhibit 1, Vol 48, Tab 1609C, Statement of Lulu Fatima at [25]-[26].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 “was a work in progress” as it takes time to gain expertise in the CCTV Control Room; 1279
(c) Ms Fatima gave evidence that she had raised the above with Mr David, who expressed the view that on-the-job training would adequately resolve these issues. She recalled further raising CR1’s communication style with “management”, although Ms Fatima could not recall who she discussed this with. Ultimately, Ms Fatima did not consider these issues to have affected CR1’s ability to perform the role as CCTV Control Room Operator; 1280
(d) At around the end of February 2024 or early March 2024, Ms Fatima provided refresher training to CR1. Ms Fatima gave evidence that she was not aware of the reason she was asked to do so, and that she did not recall being asked to do a complete CCTV Control Room re-training for CR1. Instead, Ms Fatima gave evidence that she was asked by Mr Stuart and Mr Helg to “touch on” specific topics including incident report writing and further CCTV training; 1281and
(e) When asked if she thought CR1 was competent to be a Control Room Operator on her own she answered, “[t]hat’s correct.” When asked if she was comfortable that CR1 did not need supervision in her role as a CCTV Control Room Operator in March and April, she replied “[s]he would require assistance, but not supervision”. 1282 7.489 Mr David gave evidence that he could not recall discussing any of the areas for improvement identified by Ms Fatima, and whilst he recalled receiving feedback from Ms Fatima about CR1 during her training, nothing stood out to him other than that CR1 was new to the role, and there were certain things that she would need to learn while performing the job.1283 7.490 With respect to the Red Book Audits in January 2024, Mr David accepted those questions were critical information to know and CR1 needed “foundational training on the absolute basics”. Mr David gave evidence that these issues should have been escalated to Scentre management following CR1’s second failure to answer the question concerning the two main objectives in an AAO event on 17 January 2024. 1284 7.491 Mr Goldberg gave evidence that he could not recall the particular issues that were raised in the Minutes, and that any further training of CR1 would have been undertaken by Glad.
Mr Goldberg gave evidence that he considered CR1 competent to undertake the basic roles set out in the checklist. 1285 1279 Transcript, D8 (Fatima): T652.28-T53.39 (8 May 2025).
1280 Transcript, D8 (Fatima): T657.31-49 (8 May 2025); Exhibit 1, Vol 48, Tab 1609C, Statement of Lulu Fatima at [29], [32].
1281 Transcript, D8 (Fatima): T659.40-T660.10, T660.33-T661.11 (8 May 2025).
1282 Transcript, D8 (Fatima): T661.13-19 (8 May 2025).
1283 Transcript, D8 (David): T624.45-T625.13, T625.5-13 (8 May 2025); Exhibit 1, Vol 49, Tab 1609B, Statement of Andrew David at [13].
1284 Transcript, D8 (David): T627.5-31, T632:16-T634:4, T634:45-T635:3 (8 May 2025).
1285 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [141]-[142]; Transcript, D9 (Goldberg): T753.42T754.1 (9 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.492 However, in response to questions of Counsel Assisting during oral evidence on 9 May 2025, Mr Goldberg gave evidence as follows: Q. I'm just asking again for your reflections, I started to read to you something that Mr Wilson says in his report, and just in summary, what he says is that "Although these issues were being raised, it should've been the case that CR1 was never left alone in the [C]ontrol [R]oom on her own, due to those identified needs". When you reflect on it, given how incredibly important that role is in the event of an emergency, like an active armed offender, is it the case that your reflection is she should not have been left on her own?
A. I suppose no-one expected the, a situation of this gravity to occur and in hindsight I would agree with that. 1286 7.493 Mr Helg gave evidence that: 1287
(a) CR1 had communication difficulties, namely “[s]he was constantly asking people to repeat. Her communication sort of was a bit hard to understand sometimes, and she would have trouble understanding other people as well”. As a consequence of these issues, CR1 was to be retrained by Ms Fatima;
(b) While CR1 was not necessarily “a gun”, his view was that she was authorised to be in the CCTV Control Room Operator role because she had completed the CCTV Control Room Checklist; and
(c) Given the various issues identified, Mr Helg agreed that it would have been sensible for CR1 to have had supervision in the CCTV Control Room.
7.494 Mr Stuart gave evidence that, as at 13 April 2024, he considered that CR1 could competently perform the CCTV Operator role on her own in an AAO emergency, working quickly, even in light of Mr Stuart having been at a meeting in April 2024 where it was noted that CR1’s responses were too slow, and re-training was needed. 1288 7.495 Mr Yates gave oral evidence that he continued to believe, as at the time of giving oral evidence on 20 May 2025, that CR1 was competent to be in the CCTV Control Room. 1289 Expert evidence 7.496 With respect to CR1’s training, Mr Wilson gave expert evidence that, having regard to the Minutes, Glad had identified CR1’s performance and training issues and put in place steps to deal with the issues. However, in his view it was clear that there had been ongoing issues regarding CR1’s training for some time, such that she should never have 1286 Transcript, D9 (Goldberg): T761.46-T7624 (9 May 2025).
1287 Transcript, D8 (Helg): T570.15 – T573.49 (8 May 2025).
1288 Transcript, D9 (Stuart): T717.11-23 (9 May 2025).
1289 Transcript, D15 (Yates): T1317.46-T1318.4 (20 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 been left in the CCTV Control Room on her own due to the identified training needs and should always have been subject to supervision in the CCTV Control Room. 1290 7.497 In his supplementary report, Mr Wilson said the following in relation to CR1’s competency: I am still of the opinion that CR1 was not fully competent to have been left in the [C]ontrol [R]oom without supervision. From available CCTV we can witness her response on the day and she had to be constantly reminded to carry out basic actions.
Within one minute of logging onto the CCTV system at 15.37.10 CR2 is able to locate the offender and has situational awareness that he was being pursued by police. Up until this point there had been no visual on the suspect within the [C]ontrol [R]oom.
Further evidence has also become available that when tested she was not aware of the basic actions required when dealing with an AAO to get people to safety and notify emergency services. 1291 7.498 Mr Wilson’s ultimate view with respect to CR1 being a Control Room Operator was that: You need to multitask, be a good decision-maker, a good communicator and I just don't feel she had that skillset. And that should have been the piece that said she's not match fit to do this job and whether that's going back to the floor to be a security guard, then most probably that might have to be the case.1292 Submissions Submissions of Counsel Assisting 7.499 Counsel Assisting submitted that CR1 was not competent to be left unsupervised in the CCTV Control Room on 13 April 2024 (in accordance with Mr Wilson’s expert opinion) and that this was known to both Scentre and Glad prior to 13 April 2024. 1293 7.500 Counsel Assisting submitted that there is clear and cogent proof upon which such a finding can be made, being the contemporaneous Weekly Operational Minutes, and in doing so, I would not need to find that witnesses were unreliable or reject the body of evidence. Counsel Assisting submitted that those contemporaneous business records are candid, self-reflective and not suggested to be inaccurate, and “stand in stark contrast” to the opinions of the relevant Scentre and Glad witnesses. Counsel Assisting submitted the Minutes “are the best account of CR1’s competence in the lead up to that event, uncoloured by the subsequent tragic events”. They include an entry providing that CR1 required full Control Room re-training two weeks prior to the incident and an entry as recently as three days before the events, from 10 April 2024 indicating CR1’s responses were “too slow” and retraining was to be scheduled for her. 1294 1290 Exhibit 1, Expert Vol, Tab 20, Expert Report of Scott Wilson at p. 32.
1291 Exhibit 1, Expert Vol, Tab 21A, Supplementary Expert Report of Scott Wilson at [3].
1292 Transcript, D14 (Wilson): T1226.6-9 (19 May 2025).
1293 Transcript, Closing Submissions D1: T1928.10-18 (25 November 2025).
1294 Transcript, Closing Submissions D2: T2015.25-35 (28 November 2025); Transcript, Closing Submissions D1: T1926.21-26 (25 November 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.501 Further, Counsel Assisting submitted that issues were identified contemporaneously as to CR1’s suitability for the role, and those issues (communication skills, deficiencies in the ability to operate the CCTV system, and issues with escalating matters) were exactly the skills required of a CCTV Operator facing an AAO scenario.1295 Counsel Assisting noted they do not suggest CR1 could not perform a substantial part of the role; however, she was not well-equipped to respond in these circumstances. 1296 7.502 Counsel Assisting submitted with respect to the Minutes that they suggest “issues had been identified and were being actively considered and discussed”. 1297 7.503 Counsel Assisting submitted that CR1 being in the CCTV Control Room unsupervised on 13 April 2024 was “a failing of the overall system”. 1298 Submissions on behalf of the Families 7.504 It was submitted on behalf of the Tahir family that Scentre and Glad made a critical mistake in placing CR1 in the Control Room when she was not competent to operate in the Control Room, and that they did not take the “simple and obvious step” of removing CR1 from the Control Room, which had tragic consequences. It was submitted on behalf of the Tahir family that Scentre and Glad bear responsibility for that failure, rather than it being a failure of “the system”. 1299 7.505 It was further submitted on behalf of the Tahir family that Scentre and Glad knew that CR1 was not competent for the role because of the series of reports on her performance (which is not a matter of hindsight). 1300 7.506 In addition, it was submitted that Scentre and Glad failed to accept responsibility for placing CR1 in the Control Room “despite the overwhelming evidence presented at the Inquest of her unsuitability for that role over a significant period of time” and that Scentre and Glad “deflected scrutiny and defended their actions”, which are not indicative of organisations that are willing to acknowledge their failures and improve. 1301 7.507 The submissions on behalf of the Good, Singleton and Young families supported the written submissions on behalf of the Tahir family and submitted that CR1 should not have been placed in the role of Control Room Operator unsupervised as she did not have the skills needed to respond on 13 April 2024 and was “manifestly unfit” for the role; the issue was a result of deliberate managerial decisions made by Scentre and Glad (rather than a failing of the overall system), and they should have removed CR1 from the Control Room prior to 13 April 2024; Scentre and Glad had contemporaneous knowledge of CR1’s deficiencies prior to 13 April 2024 of the inadequacy of CR1’s skills (and this is not a matter of hindsight); and Mr Yates, Mr Stuart and Mr Goldberg did not accept (even in 1295 Written submissions of Counsel Assisting at [1374].
1296 Transcript, Closing Submissions D1: T1926.50-T1927.2 (25 November 2025).
1297 Written submissions of Counsel Assisting at [1351].
1298 Written submissions of Counsel Assisting at [1378].
1299 Written submissions on behalf of the Tahir family at [15], [43]-[45].
1300 Written submissions on behalf of the Tahir family at [17], [36].
1301 Written submissions on behalf of the Tahir family at [16], [48].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 retrospect) that CR1’s skills were inadequate, despite being taken to contemporaneous records regarding CR1’s performance issues. These families also submitted that there is a dissonance in Scentre and Glad staff acknowledging the critical and demanding nature of the Control Room Operator role while believing it was appropriate for CR1 to learn on the job when she still needed “foundational training on the absolute basics.” 1302 7.508 The oral submissions on behalf of the Good, Singleton and Young families emphasised that Scentre and Glad have not shown insight, in that they maintain that CR1 was competent to be in the position she was on 13 April 2024, despite the training documents and the Minutes entries showing the opposite. 1303 7.509 The submissions on behalf of the Darchia family similarly submitted that CR1 was placed in her important role by her superiors who knew she lacked the necessary skills for her position and that she was unsuitable for the role (which is not merely a matter of hindsight). The Darchia family also urged that the submissions on behalf of the Tahir, Good, Singleton and Young families be adopted. 1304 7.510 As canvassed further elsewhere, Counsel Assisting and the families submitted that Mr Wilson’s expertise cannot be challenged. 1305 Submissions on behalf of Scentre 7.511 It was submitted on behalf of Scentre that there is an insufficient basis to reject the substantial body of first-hand evidence which shows “that on the information then available, CR1 was competent to perform the [C]ontrol [R]oom [O]perator's role as at 13 April 2024”. 1306 7.512 In particular, Scentre submitted that submissions as to CR1’s suitability and skills are to be evaluated against all of the evidence in this respect, and the evidence of Scentre and Glad employees who worked with and/or trained CR1 was essentially that they considered her competent to be in the Control Room Operator role as at 13 April 2024 (and did not consider she needed to be supervised in that role). It was submitted on behalf of Scentre that CR1 undertook the Control Room-related training and was assessed and accepted as competent to work in the Control Room by Mr Goldberg, Mr David and Ms Fatima. Scentre also submitted that as Mr Zaidi was not asked to provide a statement addressing the meaning of or basis for the entries in the Minutes (including the 10 April 2024 entry), there is accordingly some speculation with respect to those entries, “which is not a sound basis to overlook consistent oral evidence to the contrary”.1307 7.513 In addition, it was submitted on behalf of Scentre that the weight of the evidence (including a consistent body of evidence from several witnesses) was that CR1 1302 Written submissions on behalf of the Young, Singleton and Good families at [9.1]-[9.12].
1303 Transcript, Closing Submissions D2: T2011.21-26 (28 November 2025).
1304 Transcript, Closing Submissions D2: T2013.11-16 (28 November 2025).
1305 Transcript, Closing Submissions D2: T2004.23-26 (28 November 2025).
1306 Written submissions on behalf of Scentre at [171]; Transcript, Closing Submissions D2: T1971.9-12 (28 November 2025).
1307 Written submissions on behalf of Scentre at [150], [176], [179].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 continued to improve throughout the period leading up to 13 April 2024 and was a competent Control Room Operator by 13 April 2024. Scentre submitted that the Red Book audits occurred prior to CR1 starting in the Control Room, CR2 had answered the same two AAO Red Book audit questions incorrectly, and CR1 in any event later attended a related toolbox training session. It was submitted on behalf of Scentre that by the end of January 2024, Ms Fatima did not have concerns about CR1’s ability, although she needed to improve in communication (which meant that CR1 had difficulties understanding accents, dialects or slang), escalation, and CCTV. Further, Scentre submitted that by the start of April 2024, Ms Fatima considered CR1 had improved quite a lot, the communication issues had resolved, and CR1’s CCTV skills had improved. It was submitted on behalf of Scentre that an important distinction which should be recognised is that (per Ms Fatima’s evidence) CR1 required assistance in March and April 2024 with multiple incidents and other simultaneous demands, however, she did not require supervision. 1308 7.514 It was also submitted on behalf of Scentre that the proposed adverse findings are not open to be made without a cogent basis to reject the witnesses’ evidence (such as credibility or reliability), citing Neat Holdings. 1309 7.515 Scentre also submitted that submissions that CR1 should have been removed from the role prior to 13 April 2024 are untenable as doing so would have removed “the expertise that was available” and may have resulted in insufficient staff being available for proper rostering of the CCTV Control Room. Scentre also submitted that other submissions indicating CR1 could not perform “mundane tasks” overlooked Mr Wilson’s opinion that CR1 was capable “95%” of the time in performing the “mundane” work. 1310 7.516 It was also submitted on behalf of Scentre that it could not reasonably have been known that CR1 would not be competent in responding to the attacks on 13 April 2024, because they were unprecedented. 1311 7.517 Further, Scentre submitted that Mr Wilson’s opinion regarding CR1’s competency to be in the Control Room was based on his perception of the actions taken on 13 April 2024 and does not refer to events in the months beforehand, and accordingly does not materially assist in assessing those prior events. It was also submitted that Mr Wilson was mistaken in believing that Glad had raised issues with Scentre.1312 7.518 Scentre submitted that there was always another trained Operator rostered on with CR1, although usually in another role, and CR1 was supported and generally had access to assistance and supervision from more experienced Operators and supervisors. They note that on 13 April 2024, CR2 assisted CR1 in the CCTV Control Room and filled in when CR1 took breaks (whilst CR2 was rostered as a security officer on the Centre floor), 1308 Written submissions on behalf of Scentre at [166]-[167], [170], [177.d]; Transcript, Closing Submissions D2:T1970.23-33 (28 November 2025).
1309 Written submissions on behalf of Scentre at [172].
1310 Written submissions on behalf of Scentre at [157], [177.e].
1311 Transcript, Closing Submissions D2: T1970.47-50 (28 November 2025).
1312 Written submissions on behalf of Scentre at [176], [178].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 and Mr Helg was also based in the Control Room, sitting behind CR1 (although CR1 did not need his assistance during the morning whilst he was there). CR2 also went to the CCTV Control Room to assist as a second Operator in response to the incident on 13 April 2024, which is in accordance with the Red Book’s AAO guideline. 1313 7.519 Scentre also submitted that Mr Goldberg was confident WBJ had a good team of security officers following a difficult period, and “pressure” regarding filling roles did not equate to “compromise” (as suggested in other submissions). 1314 Submissions on behalf of Glad 7.520 It was submitted on behalf of Glad that Ms Fatima’s evidence that she assessed CR1 as competent to be a Control Room Operator on her own should be accepted without reservation, and any findings inconsistent with Ms Fatima’s evidence would lack a proper evidential foundation. 1315 7.521 Glad submitted the issue is how much weight should be given to “on the one hand … [to] a large body of evidence of subject matter experts such as Ms Lulu Fatima, Mr Jerry Helg, Mr Cameron Stuart, and on the other, a very small body of contemporaneous weekly minutes, and the expert opinions of Mr Wilson”.1316 Glad submitted that Ms Fatima was the best placed person to make a reliable assessment of CR1’s competency (including as she spent the most time with CR1 in the CCTV Control Room and her evidence was experience-based). It was also submitted on behalf of Glad that Ms Fatima was an impressive and credible witness whose evidence was cogent, persuasive, entirely unassailable, and not seriously challenged, and that it was not put to Ms Fatima that her opinion may have been in some way impacted by unconscious or conscious bias. Glad submitted that Ms Fatima’s evidence should be preferred over Mr Wilson’s opinion, including because Mr Wilson’s opinion did not properly engage with Ms Fatima’s evidence and was “necessarily at a high level of generality, influenced by hindsight bias and removed from the practical realities of the site”. 1317 7.522 Glad adopted Scentre’s submission that Counsel Assisting’s proposed findings cannot be made without rejecting the evidence of Ms Fatima (as well as Mr Stuart, Mr Helg, Mr David, and Mr Goldberg), which indicated that CR1 was competent.1318 Glad submitted that a finding that CR1 was not competent is in effect a finding that each relevant witness is unreliable and their evidence cannot be accepted, which is not a finding that can be made having regard to the overwhelming evidence. 1319 1313 Transcript, Closing Submissions D2: T1969.42-T1970.12 (28 November 2025); Written submissions on behalf of Scentre at [159], [255].
1314 Written submissions on behalf of Scentre at [156].
1315 Written submissions on behalf of Glad at [31].
1316Transcript, Closing Submissions D1: T1956.32-35 (25 November 2025).
1317 Transcript, Closing Submissions D1: T1956.31-35, T1958.8-50 (25 November 2025); Written submissions on behalf of Glad at [31], [33]-[34].
1318 Written submissions on behalf of Glad at [33].
1319 Transcript, Closing Submissions D1:T1959.28-32 (25 November 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.523 It was submitted on behalf of Glad that any finding adverse to CR1 would need to meet the Briginshaw standard which is an insurmountable hurdle in this context. It was also submitted on behalf of Glad that a prospective (rather than retrospective) test should be applied when determining this issue. 1320 7.524 Further, it was submitted on behalf of Glad that I would not accept that Glad knew CR1 was not competent to perform the Control Room Operator role and that I would reject in its totality the submission that Scentre and Glad made critical mistakes by placing CR1 in the Control Room at WBJ when she was purportedly incapable of fulfilling that position. 1321 Further submissions of Counsel Assisting 7.525 Counsel Assisting submitted that Glad’s submissions overpitch the evidence given by the relevant witnesses, which are ultimately a matter of opinion given after the events, and that the inference could be drawn that their opinions may have been influenced by their own involvement in CR1’s training and sign-off, even if subconsciously. Counsel Assisting emphasised that their submissions are not a criticism of those witnesses. 1322 7.526 It was further submitted that while there is no dispute that the particular circumstances of the attack on 13 April 2024 were unprecedented, it should not be accepted that it “wasn’t known that [C]ontrol [R]oom [O]perators needed to be competent to respond to any active armed offender”. Counsel Assisting submitted that an AAO event was a scenario that “Scentre was conscious could occur”, demonstrated by emergency response procedures like the Red Book AAO Response Plan.1323 7.527 Counsel Assisting also submitted that Mr Goldberg’s acceptance, with the benefit of hindsight, that CR1 should not have been left in the Control Room unsupervised on 13 April 2024, was ignored in submissions made on behalf of Scentre. 1324 Submissions in relation to Mr Iloski’s evidence 7.528 A separate issue raised on behalf of the Tahir family was that the ability of their Senior Counsel to test the evidence of Glad’s CEO, Steve Iloski (regarding CR1’s competency) was disadvantaged by Mr Iloski’s withdrawal of portions of his statement that related to CR1’s competency. It was submitted on behalf of the Tahir family that their Senior Counsel did not ask other witnesses questions during the hearing regarding CR1’s competency, on the basis that Mr Iloski had given evidence by way of a statement addressing that issue. 1325 7.529 In response, it was submitted on behalf of Glad that Ms Fatima was clearly the most material witness on this issue and Senior Counsel for the Tahir family made a decision 1320 Written submissions on behalf of Glad at [34], [36].
1321 Written submissions on behalf of Glad at [58], [60].
1322 Transcript, Closing Submissions D1: T1927.4-8 (25 November 2025).
1323 Transcript, Closing Submissions D2: T2015.45-T2016.3 (28 November 2025).
1324 Transcript, Closing Submissions D1: T1927.4-11 (25 November 2025).
1325 Written submissions on behalf of the Tahir family at [138]-[143].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 not to cross-examine her on the issue, that there was no disadvantage or prejudice by the withdrawal of certain paragraphs of Mr Iloski’s witness statement (which were in the nature of a submission so were offered to be withdrawn), and that no adverse findings should be made against Mr Iloski. 1326 7.530 In the event that Mr Iloski had been cross-examined by Counsel for the Tahir family about CR1’s competence as a CCTV Control Room Operator the weight that could have been given to that evidence was marginal. Counsel for the Tahir family could have crossexamined Ms Fatima about this issue.
Findings 7.531 CR1 was not competent to be in the CCTV Control Room unsupervised on 13 April 2024.
There is clear and cogent evidence before me that CR1 was not equipped to carry out the critical duties required of the CCTV Control Room Operator on 13 April 2024. The most significant of which is the Minutes, which contemporaneously recorded a series of ongoing concerns about CR1’s performance as a CCTV Control Room Operator from February 2024 to 10 April 2024.
7.532 In addition to the minutes, Mr Goldberg accepted, with the benefit of hindsight, that CR1 should not have been left alone in the CCTV Control Room given the identified issues.
7.533 Finally, there is the expert evidence of Mr Wilson that CR1 was not fully competent to have been left in the Control Room without supervision.
7.534 It was submitted on behalf of Scentre and Glad that the overwhelming weight of the evidence of witnesses cannot be dismissed. However, I cannot accept and rely upon the evidence of witnesses who were involved in CR1’s training, over what is documented in the Minutes. The Minutes themselves are persuasive. The evidence from witnesses involved in CR1’s training, despite best intentions and without any criticism of those witnesses, may be influenced by that involvement (even if not consciously).
7.535 In relation to the evidence of Mr Goldberg regarding whether CR1 should have been left alone in the CCTV Control Room, I accept that proposition was put to him by Counsel Assisting and he agreed. I accept also, the caveat in his answer, that his agreement was with the benefit of hindsight, and I note the totality of his evidence on this topic.
Nevertheless, the question was put to him in a very clear and deliberate way, and he agreed to that proposition.
7.536 I note that Mr Wilson’s assessment of CR1’s competence was, in part, informed by an analysis of her performance on 13 April 2024. I do not need to rely on Mr Wilson’s views to make the finding that CR1 was not competent to be in the CCTV Control Room unsupervised on 13 April 2024. I am satisfied on the basis of the Minutes and the evidence of Mr Goldberg.
1326 Written submissions on behalf of Glad at [66]-[69].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.537 This finding is not a personal criticism of CR1. And I accept that CR1 may have been improving prior to 13 April 2024, and that Scentre and/or Glad may have believed CR1 was improving. However, CR1’s improvement was not to the level that would have made her competent on 13 April 2024. The last negative comment in the Minutes regarding CR1’s competency was from only a few days before the incident, on 10 April 2024.
Accordingly, it is hard to accept that the issues had been resolved prior to 13 April 2024.
7.538 Counsel Assisting submitted that CR1 being in the CCTV Control Room unsupervised on 13 April 2024 was “a failing of the overall system”. However, Counsel for the Tahir family submits that Scentre and Glad bear responsibility for the failure to remove CR1 from the CCTV Control Room. Counsel for the Good, Singleton and Young families submit that CR1 was manifestly unfit for her role and that her being in the CCTV Control Room unsupervised was the result of deliberate managerial decisions made by Scentre and Glad. Further, Scentre and Glad had contemporaneous knowledge of CR1’s deficiencies.
7.539 I accept that CR1 being on duty in the CCTV Control Room unsupervised on 13 April 2024 was the result of deliberate managerial decisions made by Scentre and Glad. In placing her in that role on that day they were aware, or should have been aware, that she did not have the skills necessary to respond to the circumstances that arose on 13 April 2024.
7.540 CR1 had, on two occasions, in January 2024 failed a Red Book audit concerning an AAO scenario conducted by Mr David. Ms Fatima had provided training to CR1 in around late March in relation to certain topics, including enhancing her CCTV skills at the request of Mr Stuart and Mr Helg. And again, the Minutes record that persons in positions of management at Scentre and Glad were discussing concerns in relation to CR1’s performance as a CCTV Control Room Operator up until 10 April 2024.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 F. Chronology of WBJ security response on 13 April 2024 Introduction 7.541 This section discusses the actions, and timeliness of those actions, taken by members of the security team on duty at WBJ on 13 April 2024. This includes when and what alarms and alerts were activated by members of the security team to warn members of the public of what was occurring inside WBJ and to alert emergency services that they would be required.
7.542 This section commences with a chronology of the events that occurred on the afternoon of 13 April 2024, with a focus on the actions of certain members of security staff and the WBJ management team, including CR1, who, as identified above, was rostered as the CCTV Control Room Operator that day. As noted elsewhere in the Findings, the actions of security personnel on 13 April 2024 were entirely captured on CCTV cameras from within WBJ. This was also supplemented by statements provided by several staff present that day.
7.543 Following the chronology is an outline of the expert evidence of Mr Wilson in relation to the security response and the evidence of Mr Yates. Mr Wilson identified a number of issues with the response of security staff, a number which were accepted by Mr Yates.
7.544 The section concludes with my findings on the key elements of the response and any contested issues.
7.545 It is acknowledged that many of the security officers on duty were involved, in some way, in the response to the events of 13 April 2024, including by interacting with customers and assisting those in the Centre. Some of these actions are detailed below, however, this does not capture the totality of all actions taken by all security officers present.
7.546 The Court was greatly assisted by the chronology that was prepared collaboratively and has also considered and incorporated further relevant factual material that has been set out in the written submissions provided, in particular from Scentre, Glad and the Darchia, Tahir, Young, Singleton and Good families.
Security personnel on duty that day 7.547 On 13 April 2024, Glad security personnel were on duty at WBJ in accordance with the weekly roster. In addition, members of the Scentre Management Team were present. As it was the weekend, the Management Team was comprised of only three personnel.1327 1327 Exhibit 1, Vol 30, Tab 996, Statement of Joseph Gaerlan at [10].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.548 Emergency roles, split between the Glad security staff and the Scentre Management Team, were dictated by the Daily Centre Emergency Roles sheet (DCER).1328 7.549 Fifteen security officers (and the three Scentre personnel with emergency roles) were on duty on 13 April 2024.1329 They included:
(a) Joseph Gaerlan: Retail Manager (Duty Manager), designated Chief Warden;
(b) Rahim Zaidi: Risk and Security Supervisor (RSS), designated On Scene Coordinator;
(c) Jerry Helg: Security Supervisor (S1);
(d) CR1: CCTV Control Room Operator;
(e) CR2: Security guard/rover;
(f) Muhammad Taha: Ad-hoc guard (employed by Falkon);
(g) Faraz Tahir: Ad-hoc guard (employed by Falkon); and
(h) GLA2: Security guard (provided by Falkon).
Pre-incident 7.550 As indicated above, CR1 was rostered in the CCTV Control Room as the CCTV Control Room Operator.1330 7.551 CR2 was also on duty. CR2 was an experienced CCTV Control Room Operator, having worked previously as a member of the prior security team engaged at WBJ, SecureCorp.
CR2 transferred to Glad during the changeover in security provider in late 2023.1331 On 13 April 2024, CR2 had recently returned from a period of leave and was rostered to work as a retail rover. However, he relieved CR1 in the CCTV Control Room at times during her shift.1332 7.552 At approximately 12:50pm, CR1 took her lunch break for about an hour.1333 CR2 relieved her in the CCTV Control Room during that time.
1328 Exhibit 1, Vol 49, Tab 1608A, Fifth Statement of Bradley Goldberg, Annexure D, Daily Centre Emergency Roles sheet (dated 13 April 2024) at p. 13.
1329 Exhibit 1, Vol 37, Tab 1232, Guard names and shift times; Exhibit 1, Vol 35, Tab 1123, Timesheets for staff working from Westfield Bondi.
1330 Exhibit 1, Vol 37, Tab 1232, Guard names and shift times; Exhibit 1, Vol 35, Tab 1123, Timesheets for staff working from Westfield Bondi; Exhibit 1, Vol 4, Tab 291, Statement of CR1 at [4].
1331 Exhibit 1, Vol 45, Tab 1600C, Supplementary Statement of CR2 at [12]-[26].
1332 Exhibit 1, Vol 45, Tab 1600C, Supplementary Statement of CR2 at [30].
1333 Exhibit 1, Vol 4, Tab 291, Statement of CR1 at [5]; Electronic Material, Item 57, CCTV Footage, Camera ZA P4 CCTV Control Room [from 12:45pm].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.553 The CCTV footage indicates that after her lunch break, CR1 attended to other tasks while CR2 performed the role of CCTV Control Room Operator until approximately 2:54pm. At that time, CR1 returned to the CCTV Control Room and resumed control of the CCTV monitors.1334 7.554 Just prior to 3:00pm, CR2 met with Jerry Helg and Rahim Zaidi outside the CCTV Control Room. Together, they attended the Centre Management Office (CMO) to complete a security officer induction refresher training for CR2.1335 CR1 was the sole CCTV Control Room Operator from that time.
7.555 At 3:32:15pm, CR1 left the CCTV Control Room to use the bathroom. Accordingly, the room was unattended. She did not take her radio with her nor request another officer to relieve her during the break.1336 7.556 At the same time, Mr Taha and Faraz, were standing between Gucci and David Jones on Level 4, Zone A.1337 7.557 GLA2 was standing near the void at the southern end of Level 5, Zone B.1338 Other security staff were located throughout WBJ.
Incident commences 7.558 As set out previously in these Findings, Mr Cauchi attacked his first victim, Dawn Singleton, at 3:32:55pm.
7.559 At approximately 3:33:17pm, Mr Cauchi arrived near Cotton On in the vicinity of the void at the southern end of Level 4, Zone B, where at 3:33:20pm he stabbed Victim 5.1339 7.560 At that time, GLA2 was located on Level 5, Zone B, near Myer. She had a view through the void to the shops below, including of Cotton On.1340 While GLA2 provided a statement recounting the incident, she was excused from giving evidence on medical grounds.
7.561 GLA2 said in her statement that she “started hearing people yelling and screaming” on Level 4, but she could not hear anything specific.1341 7.562 At 3:33:20pm, GLA2 looked towards Cotton On.1342 She said: 1334 Electronic Material, Item 57, CCTV Footage, Camera ZA P4 CCTV Control Room [from 1:50pm]; Exhibit 1, Vol 1, Tab 32, CCTV Review at p. 1.
1335 Exhibit 1, Vol 4, Tab 293, Statement of CR2 at [9]; Exhibit 1, Vol 42, Tab 1598, Second Statement of Jerry Helg, at [33].
1336 Exhibit 1, Vol 4, Tab 291, Statement of CR1 at [6]; Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at row 52.
1337 Exhibit 1, Vol 4, Tab 54, Statement of Muhammad Taha, at [16]-[17]; Exhibit 1, Vol 1, Tab 32, CCTV Review (v 1) at row 70.
1338 Exhibit 1, Vol 4, Tab 286, Statement of GLA2, at [12]-[13]; Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at row 59.
1339 Exhibit 1, Vol 1, Tab 30, Statement of Detective Chief Inspector Andrew Marks at [59]-[63]; Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at rows 65-67.
1340 Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at rows 61-68.
1341 Exhibit 1, Vol 4, Tab 286, Statement of GLA2 at [11].
1342 Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at rows 65-67.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 I looked down to Level 4 and I saw that outside of Lululemon near the Kookai shop there was a male, he looked about 30 – 35 years of age, he looked like [an] Aussie guy, like Caucasian, about 5’9 in height and had a skinny build, possibly black pants, possibly shorts, he was holding a knife in his right hand that looked about 15 – 20cm in length.
I saw that male run towards a woman from behind her, and with a large knife stab her around the right hip. He struck her at least one time, I think it was only once.1343 7.563 Based on the location of the attack described, it appears that GLA2 observed either the attack on Victim 5, or more likely, the attack on Victim 6, who was stabbed at 3:33:27pm.1344 7.564 Mr Cauchi then stabbed Victim 7 at 3:33:29pm.1345 7.565 At 3:33:33pm, GLA2 delivered a radio broadcast alerting security personnel. The content of this radio broadcast is unclear. This was a matter of some significance, given that the content of her message would dictate the response implemented by security staff.
7.566 While GLA2 provided a statement recounting the incident and her actions that day, she was excused from giving evidence on medical grounds. The effect of this was that the content of the message could not be further explored with her. Members of the Scentre Management Team and members of the security team provided various accounts; however, there were certain inconsistencies in that evidence. Noting this, the broadcast of GLA2 at 3:33:33pm is addressed separately in Section G of this Part.
7.567 It appears, from the CCTV footage, that GLA2 made a number of subsequent radio broadcasts after her initial broadcast, including at 3:33:45pm and 3:34:25pm.
7.568 The security officers on scene responded to the incident in various ways. For example, between 3:33:44pm and 3:33:51pm, three security officers – Mr Tretch Moses, Mr Nurul Hoda, and Mr Qasim Shah – interacted with their radios or moved from their locations, presumably in response to hearing the broadcast of the incident. Further, at 3:34:21pm, Mr Nikolovski (who was on a break and not using his radio earpiece at the time) saw customers running and interacted with them.
7.569 At 3:36:56pm, Mr Nikolovski, then outside WBJ, gained the attention of Insp Scott. He told her there was someone with a knife stabbing people, and then he appeared to use his radio. He then returned to the WBJ to evacuate customers.
7.570 Between 3:37:41pm and 3:38:10pm, Mr Moses ran across Level 4 and commenced to evacuate the area in front of Zara and towards Chanel.
7.571 At 3:38:11pm, GLA2 directed customers near Harvey Norman, opening the staff entrance doors for people to run through.
1343 Exhibit 1, Vol 4, Tab 286, Statement of GLA2 at [12]-[13].
1344 Exhibit 1, Vol 4, Tab 286, Statement of GLA2 at [12]-[13]; Tab 32A, CCTV Review Timeline (amended) at row 68-69.
1345 Exhibit 1, Vol 1, Tab 30, Statement of Detective Chief Inspector Andrew Marks at [71]-[75].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.572 At 3:38:30pm, Mr Shah assisted people in the Nespresso store and also towards exits at Oxford Street as he ran to get first aid kits for the victims at the Sourdough Bakery and Café.
7.573 Between 3:41:07pm and 3:55pm, there were a number of further actions demonstrating the assistance provided by the security officers. This included Mr Chowdhury directing customers on Level 2 to the emergency assembly point, Mr Hoda assisting NSWPF on Level 3, and Mr Moses assisting a victim in Chanel, flagging down NSWPF and paramedics, and then escorting NSWPF to the loading dock as they were looking for a command post location. Mr Moses stayed in the loading dock with NSWPF until around 7pm. Further, Mr Shah assisted NSWPF with first aid on Level 4; Mr Nikolovski accompanied NSWPF through WBJ, to the CCTV Control Room and also to the shops; and Mr Rogers assisted NSWPF and obtained a defibrillator at their request.
Response in the CMO 7.574 At approximately 3:30pm, Mr Zaidi, Mr Helg, and CR2 were in the CMO.1346 Mr Gaerlan was in the bathroom, located outside of the CMO.1347 7.575 At 3:33:33pm, CCTV footage records Mr Helg touching his earpiece. This is around the time of GLA2’s initial radio broadcast.1348 7.576 Upon hearing the broadcast, Mr Helg, CR2, and Mr Zaidi quickly exited the CMO, entering an elevator at 3:33:53pm.1349 Mr Helg recalled Mr Zaidi asking what was happening and Mr Helg saying, “I think it’s a heart attack or someone is bleeding.”1350 7.577 Mr Gaerlan, who had heard the radio broadcast whilst in the bathroom,1351ran back to the CMO, passing the elevators where he had a conversation with Mr Zaidi at 3:33:57pm.1352 Mr Gaerlan said the conversation was “very short, brief, acknowledging that he had heard what I had heard and that he was on his way to respond.”1353 Mr Zaidi said that Mr Gaerlan asked him “Hey what’s happening? Is it a fire”.1354 Mr Gaerlan did not recall this.1355 7.578 Mr Zaidi, Mr Helg, and CR2 descended in the elevator to Level 6, Zone A. Mr Zaidi was aware at this time that his emergency role was On-Scene Coordinator, and that Mr Gaerlan was Chief Warden.1356 1346 Exhibit 1, Vol 42, Tab 1597, Statement of Rahim Zaidi at [29].
1347 Exhibit 1, Vol 30, Tab 996, Statement of Joseph Gaerlan at [14].
1348 Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at row 76.
1349 Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at row 80; Exhibit 1, Vol 4, Tab 293, Statement of CR2 at [9]-[10]; Exhibit 1, Vol 4, Tab 283, Statement of Jerry Helg at [4]; Exhibit 1, Vol 42, Tab 1597, Statement of Rahim Zaidi at [31]-[32]; Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at row 85.
1350 Exhibit 1, Vol 42, Tab 1598, Supplementary Statement of Jerry Helg at [38].
1351 Exhibit 1, Vol 30, Tab 996, Statement of Joseph Gaerlan at [14].
1352 Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at row 93.
1353 Transcript, D7 (Gaerlan), T493:13-16 (7 May 2025).
1354 Exhibit 1, Vol 42, Tab 1597, Statement of Rahim Zaidi at [33].
1355 Transcript, D7 (Gaerlan): T493.27-28 (7 May 2025).
1356 Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at row 93; Exhibit 1, Vol 42, Tab 1597, Statement of Rahim Zaidi at
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.579 CR2 recalled that during the elevator ride Mr Zaidi radioed the CCTV Control Room and asked CR1 if she was “able to locate the POI” to which CR1 replied “negative.”1357 7.580 In the CMO, Mr Gaerlan retrieved his coat from his workstation and took the elevator down to Level 5, where he exited at about 3:34:56pm.1358 Response of Muhammed Taha and Faraz Tahir 7.581 At 3:15pm, Faraz and Mr Taha were on Level 4, Zone A, near the Gucci store.1359 7.582 At approximately 3:33:28pm, Faraz and Mr Taha were alerted to an incident by customers running from the airbridge.1360 7.583 Accounts from customers suggest that they told Faraz and Mr Taha that there was someone with a knife or gun “back there” and directed them towards the Sourdough Bakery and Café.1361 7.584 Mr Taha did not recount in his statement being informed by shoppers of the presence of a person with a weapon, only hearing “people shouting and screaming.”1362 7.585 Mr Taha stated he heard “Code Black” broadcast over the radio by GLA2. He and Faraz then walked towards the airbridge and the Sourdough Bakery and Café to investigate.1363 7.586 A witness described seeing Faraz and Mr Taha appearing calm as they approached.1364 7.587 At 3:34:11pm, Faraz and Mr Taha continued to make their way towards Dawn, who was located next to the Sourdough Bakery and Café, with members of the public attending to her.1365 7.588 Shortly after this, Mr Cauchi arrived at the airbridge. At 3:34:34pm, Mr Cauchi first stabbed Faraz, and then at 3:34:36pm, Mr Taha. Mr Cauchi continued north towards Level 4, Zone A.1366 Mr Taha said of the attack: I didn’t notice anything at first but Faraz stepped approximately two metres ahead of me, this is when I saw a Caucasian male with a beard jump towards Faraz and stab him with [a] big knife. I couldn’t assess the situation everything was happening so quickly. … [34].
1357 Exhibit 1, Vol 4, Tab 293, Statement of CR2 at [12]; Exhibit 1, Vol 45, Tab 1600C, Supplementary Statement of CR2 at [35].
1358 Exhibit 1, Vol 30, Tab 996, Statement of Joseph Gaerlan at [16]; Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at row 121.
1359 Exhibit 1, Vol 1, Tab 30, Statement of Detective Chief Inspector Andrew Marks at [126].
1360 Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at row 70.
1361 Exhibit 1, Vol 2, Tab 79, Statement of Sinead Hagney at [11]; Exhibit 1, Vol 2, Tab 78, Statement of Alison Fullam at [13].
1362 Exhibit 1, Vol 1, Tab 54, Statement of Muhammad Taha at [18].
1363 Exhibit 1, Vol 1, Tab 54, Statement of Muhammad Taha at [18]-[20]; Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at rows 73, 94 and 104.
1364 Exhibit 1, Vol 3, Tab 204, Statement of Janka Lisiakova at [13].
1365 Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at row 104.
1366Exhibit 1, Vol 2, Tab 85, Statement of Michelle Jeffries at [9]; Exhibit 1, Vol 2, Tab 76, Statement of Nathan Hunt at [8]; Electronic Item 66H, CCTV Compilation Clip – Muhammad Taha.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 The male then came towards me, he tried to jump towards me on me and I positioned my body to the side in order to tackle him and defend myself. The male then stabbed me from the front towards the left side of my stomach. I didn’t notice that I was stabbed at first. I didn’t say anything to the male and he didn’t say anything to me. He was holding a large black knife. He only stabbed me once, it was very sharp.1367 7.589 Mr Taha and Faraz moved to a seating area at the side of the airbridge. Mr Taha saw Faraz slide to the floor. Mr Taha attempted to assist Faraz, but was hampered by his own injury.1368 At approximately 3:35:59pm, Mr Taha broadcast on the radio, “I’ve been stabbed”. At approximately 3:36pm, Mr Taha made at least two phone calls to other security officers, telling them he had been stabbed.1369 7.590 Mr Taha then waited for assistance. He maintained pressure on his wound, and members of the public attended to him and Faraz until NSWPF and then NSWA arrived.1370 Rahim Zaidi and Jerry Helg 7.591 Mr Zaidi, Mr Helg, and CR2 arrived on Level 6 at 3:34:14pm.
7.592 Mr Zaidi states that he told CR2 to go to the Fire Control Room. He said: I told [CR2] to go to the Fire Control Room. I do not recall whether I had heard a specific code sign that had been called at this time, beyond blurry words along the lines that someone was on Level 4. I did not know what the incident was although still had in mind it may be a fire and so initiated a generic response in accordance with the Red Book guidelines. I was aware there was already a controller in the [C]ontrol [R]oom. It is harder to manage PA Announcements from the [C]ontrol [R]oom and in an emergency my view is that we need someone in the Fire Control Room to do that job. I was confident in [CR2]'s ability to respond to an emergency, with the Chief Warden's direction. I had also just completed his refresher induction training.1371 7.593 Mr Helg said: … either in the lift on level 6 as soon as exited the lift, Rahim Zaidi and I said to CR2 words to the effect of "go to the Control Room and help [CR1]". I knew that [CR1] was in the Control Room and was still gaining experience, whereas [CR2] had a lot of experience in the Control Room. He would know how to allocate tasks quickly to guards, including to direct guards to get privacy screens and where to wait for and bring in the paramedics as I thought at that time we were dealing with a heart attack or some kind of code blue.1372 1367 Exhibit 1, Vol 1, Tab 54, Statement of Muhammad Taha at [21]-[22].
1368 Exhibit 1, Vol 1, Tab 54, Statement of Muhammad Taha at [25]; Exhibit 1, Vol 41, tab 1588, Handwritten Notes on Incident at Westfield Bondi Junction (Falkon Security) at p. 3.
1369 Exhibit 1, Vol 1, Tab 54, Statement of Muhammad Taha at [25]-[26]; Electronic Item 66H, CCTV Compilation Clip – Muhammad Taha.
1370 Exhibit 1, Vol 1, Tab 54, Statement of Muhammad Taha at [26]-[28].
1371 Exhibit 1, Vol 42, Tab 1597, Statement of Rahim Zaidi at [35].
1372 Exhibit 1, Vol 42, Tab 1528, Supplementary Statement of Jerry Helg at [39].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.594 Given Mr Helg’s evidence, and that CR2 proceeded directly to the CCTV Control Room, it is more likely than not that Mr Zaidi directed CR2 to go to the CCTV Control Room.
7.595 At 3:40:38pm, CR2 activated the EWIS from the panel in the Fire Control Room, and a loud alarm began sounding in WBJ. The alarm continued to sound for about 23 minutes until it was turned off at 4:03:48pm.1373 7.596 Mr Zaidi and Mr Helg moved towards Level 5, Zone B, where they thought the incident was located.1374 At approximately 3:34:30pm, they ran across the airbridge. 1375 7.597 Mr Zaidi recalled hearing communications over the radio but did not recall the specifics.
He said that he was trying to contact the CCTV Control Room to confirm what was taking place. He did not recall receiving a response at this time. 1376 7.598 At 3:35:15pm, Mr Helg arrived at Level 5, Zone B. Through the void between floors, he observed two victims (Jade and Dawn) lying on the ground on Level 4.1377 This was the moment that Mr Helg understood people were being stabbed. Despite this, he continued to run towards the southern end of Zone B. 1378 7.599 At 3:35:30pm, Mr Zaidi crossed the airbridge and arrived at Level 5, Zone B. He recalled hearing “Code Black” on the radio for the first time, although he does not recall who gave that alert. Mr Zaidi stated: … I continued to try to call the [C]ontrol [R]oom again to understand what was happening. I tried to radio the [C]ontrol [R]oom a number of times during the incident although I cannot now say how many times. I would have been asking for the [C]ontrol [R]oom to review the CCTV. I do not recall receiving a response from the [C]ontrol [R]oom at this stage. 1379 7.600 Through the void Mr Zaidi saw two victims (Jade and Dawn) lying on the ground on Level
1374 Exhibit 1, Vol 42, Tab 1958B, Supplementary Statement of Jerry Helg at [39].
1375 Electronic Item 66H, CCTV Compilation Clip – Rahim Zaidi.
1376 Exhibit 1, Vol 42, Tab 1597, Statement of Rahim Zaidi at [36].
1377 Exhibit 1, Vol 42, Tab 1597, Statement of Rahim Zaidi at [36].
1378 Exhibit 1, Vol 42, Tab 1598, Supplementary Statement of Jerry Helg at [40].
1379 Exhibit 1, Vol 42, Tab 1597, Statement of Rahim Zaidi at [37].
1380 Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at row 128; Exhibit 1, Vol 42, Tab 1597, Statement of Rahim Zaidi at [38]; Electronic Item Item 66H; CCTV Compilation Clip – Rahim Zaidi.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 recalled at this point radioing the CCTV Control Room for information regarding the number of offenders and their locations and receiving no response. 1381 7.602 Upon reaching Level 4, Mr Helg observed a third victim (Yixuan) and a fourth victim (Victim 5) lying on the ground near Cotton On. 1382 Mr Helg can be seen on CCTV using his radio at 3:36:17pm from near the Peter Alexander store.1383 7.603 Mr Helg then ran to the Sourdough Café and observed Dawn and Jade receiving CPR from members of the public.1384 As he approached the café, Mr Helg observed other members of the public who did not appear to know what was going on. 1385 7.604 At 3:36:20pm, Mr Zaidi, while descending to Level 4 via the escalator, used his mobile to call the CCTV Control Room, but did not get a response. 1386 7.605 On reaching Level 4, Mr Zaidi saw two victims (Yixuan and Victim 5). Victim 5 told Mr Zaidi she had been stabbed. This was the first time Mr Zaidi was aware that anyone had been stabbed. At 3:36:36pm, Mr Zaidi made a repeated radio broadcast: Code black alpha, someone is on the floor, unconscious, active armed offender, contact blue lights, there are multiple victims. 1387 7.606 Mr Zaidi gave directions to members of the public to provide first aid and then ran towards the Sourdough Café.1388 At about this time, Mr Zaidi heard a radio broadcast from Facilities Coordinator, Tyson Rogers, “saying something about a male running around with a knife.” 1389 7.607 Mr Zaidi said that around this time, at approximately 3:38:19pm, he contacted Bradley Goldberg on his mobile and informed him, “there is an active armed offender and there are people deceased, I need you here.” At around this time, Mr Zaidi heard gunshots. He said “that moment was terrifying, and I did not expect to survive. I thought I would do what I could while I was alive.” 1390 7.608 Following the gunshots, Mr Zaidi radioed the CCTV Control Room and said words to the effect of “press evac tones and CMEO”. Mr Zaidi recalled police running towards him at that time and that he directed them towards the sound of the gunshots. 1391 7.609 When Mr Helg heard the gunshots, he and members of the public took shelter in a nearby shop. He said he “thought the guy was going to come to the front door and start shooting 1381 Exhibit 1, Vol 42, Tab 1598, Supplementary Statement of Jerry Helg at [41].
1382 Exhibit 1, Vol 42, Tab 1598, Supplementary Statement of Jerry Helg at [43].
1383 Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at row 109.
1384 Exhibit 1, Vol 4, Tab 283, Statement of Jerry Helg at [7].
1385 Transcript, D8 (Helg): T585.31-37 (8 May 2025).
1386 Exhibit 1, Vol 42, Tab 1597, Statement of Rahim Zaidi at [39].
1387 Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at row 153; Exhibit 1, Vol 45, Tab 1600D, Supplementary Statement of Joseph Gaerlan at [36]; Exhibit 1, Vol 42, Tab 1597, Statement of Rahim Zaidi at [37]-[39], [41].
1388 Electronic Item 66H, CCTV Compilation Clip – Rahim Zaidi.
1389 Exhibit 1, Vol 42, Tab 1597, Statement of Rahim Zaidi at [43].
1390 Exhibit 1, Vol 42, Tab 1597, Statement of Rahim Zaidi at [44]-[45].
1391 Exhibit 1, Vol 42, Tab 1597, Statement of Rahim Zaidi at [45].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 at us”. He told people in the shop, “if he comes to the door, we got to do something”. Mr Helg said that shortly thereafter, he heard a radio broadcast from Mr Gaerlan that “the POI, person of interest is down. And when I heard that, I felt like it was safe to come out and help, help those people with CPR.” 1392 7.610 After assisting with CPR, at approximately 3:41:50pm, Mr Helg spoke to customers on Oxford Street and, soon after, gave emergency services directions to the victims next to the Sourdough Café and Cotton On.
7.611 Having returned to Oxford Street, Mr Zaidi was present with NSWA Forward Commander, Inspector Brett Simpson, and guided him and other paramedics through WBJ.
CCTV Control Room 7.612 As set out above, at 3:32:15pm, CR1 exited the CCTV Control Room to use the bathroom and did not take the radio with her.1393 She explained: … I needed to go to the toilet so I left the [C]ontrol [R]oom and attended the toilet inside my work area which isn't far from the [C]ontrol [R]oom. From the bathrooms you can hear if the phone ringing or if people are talking over the radio. Whilst inside the bathroom I could people walking over the radio although could not make out what was being said. [sic] I left the bathroom and re-entered the [C]ontrol [R]oom. 1394 7.613 At that time, there was no written policy clarifying that the CCTV Control Room was not to be left unattended.
7.614 CR1 further described the initial broadcast as follows: I was in the bathroom and heard over the radio something to the effect of "why are people running." I then quickly returned to the [C]ontrol [R]oom and reviewed the screens whilst trying to understand what was happening. I recall seeing people on every screen running, they were running through the centre towards the exits. It was very chaotic. I then called 000.1395 7.615 CR1 returned to the CCTV Control Room at 3:34:01pm. She heard a security officer radioing that “people were running” and observed groups of people running on the
CCTV.1396 7.616 CCTV footage shows CR1 began reviewing CCTV footage and using a radio intermittently upon her return to the CCTV Control Room. This continued between 3:34pm and 3:36pm. 1397 1392 Transcript, D8 (Helg): T587.10-42 (8 May 2025).
1393 Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at row 52; Exhibit 1, Vol 4, Tab 291, Statement of CR1 at [6].
1394 Exhibit 1, Vol 4, Tab 291, Statement of CR1 at [6].
1395 Exhibit 1, Vol 4, Tab 291A, Supplementary Statement of CR1 at [36].
1396 Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended), row 98; Exhibit 1, Vol 4, Tab 291, Statement of CR1 at [7].
1397 Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at row 108; Electronic Item 66H, CCTV Compilation Clip – CR1.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.617 CR1 dialled Triple 0 on the CCTV Control Room landline telephone at 3:36:03pm. This call did not connect.1398 CR1 attempted to call Triple 0 again at around 3:36:11pm, which connected.1399 It appears that the call was terminated at 3:42:31pm and that CR1 was on hold for several minutes during that call.1400 The timing, nature and content of CR1’s communication with emergency services are addressed separately, below.
7.618 CR2 arrived at the CCTV Control Room at 3:36:44pm, and he began reviewing CCTV footage. CCTV footage shows that at that time CR2 entered the room CR1 was using the radio and reviewing CCTV footage. 1401 7.619 CR1 then picked up the telephone and continued to observe CR2 reviewing CCTV footage. At approximately 3:39:45pm, CR2 activated the CMEO then left the CCTV Control Room. 1402 7.620 At approximately 3:40:05pm, Mr Gaerlan arrived in the CCTV Control Room. CR1 confirmed she had called Triple 0 and was waiting to speak to police. 1403 7.621 At 3:40:52pm, CR1 spoke with the Triple 0 operator with the call ending at 3:42:30pm.
CR1 conveyed the following information to the operator:
(a) Armed offender in WBJ, 500 Oxford Street;
(b) Shots fired;
(c) Centre being evacuated;
(d) Offender last seen on Level 5;
(e) Three to four injured, two stabbed; and
(f) Police doing CPR on someone on Level 5. 1404 7.622 It does not appear that CR1 observed any of the attacks or saw the shooting of Mr Cauchi in real time. In her statement she said: 1398 Exhibit 1, Vol 31, Tab 1002, Call log re Westfield Bondi Junction’s landline numbers on 13 April 2024; Electronic Item 66H, CCTV Compilation Clip – CR1.
1399 Exhibit 1, Vol 31, Tab 1002, Call log re Westfield Bondi Junction’s landline numbers on 13 April 2024; Electronic Item 66H, CCTV Compilation Clip – CR1.
1400 Exhibit 1, Volume 42, Tab 1599A, Supplementary Statement of John Yates at [53]-[54].
1401 Electronic Material, Item 66H, CCTV Compilation Clip – CR1.
1402 Electronic Material, Item 66H, CCTV Compilation Clip – CR1; Electronic Material, Item 60, CCTV footage of Centre Management Areas; CCTV Control Areas; Fire Control Room: D. ZA P4 CCTV Control Room [from 3:37pm]; Exhibit 1, Vol 4, Tab 291A, Supplementary Statement of CR1 at [27]; Exhibit 1, Vol 31, Tab 1001, Centre Management Emergency Override (CMEO) log, Annexure C, CMEO Server Log (dated15 April 2024).
1403 Electronic Material, Item 60, CCTV footage of Centre Management Areas; CCTV Control Areas; Fire Control Room: D. ZA P4 CCTV Control Room [from 3:36pm]; Exhibit 1, Vol 45, Tab 1600D, Supplementary Statement of Joseph Gaerlan at [47]; Exhibit 1, Vol 4, Tab 291A, Supplementary Statement of CR1 at [28]; Exhibit 1, Vol 31, Tab 1002, Call log re Westfield Bondi Junction’s landline numbers on 13 April 2024.
1404 Electronic Item 66H, CCTV Compilation Clip – CR1; Exhibit 1, Vol 10, Tab 531B, CAD Incident Log 264247-13042024 (Informant CR1); Tab 689A, Transcript of Triple 0 call made by CR1, CAD264247-13042024.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 I backtracked the footage from that camera and saw Tyson who I know to be the facilities coordinator [and] another member of the public standing behind a female police officer.
I saw the female police officer kneel with her gun out and pointed in the direction of the male. I saw the gunshots via the footage although did not hear anything. I believed I reviewed the footage 3 – 5 minutes after the actual incident. I then fast forwarded the footage and remember seeing several police officers giving the male on the ground CPR.
I believe I reviewed this footage live at the time. I then stopped looking at the cameras and began to pick up the phone inside the [C]ontrol [R]oom.1405 7.623 At 3:51:14pm, CR1 moved to the Fire Control Room and used the PA system as she was tasked with making PA announcements. 1406 The words for the announcements were read from the PA Evacuation script at the EWIS panel as follows: Attention Attention!! All customers and retailers please evacuate the centre. Please go to the nearest exit. 1407 7.624 At around 4:03pm, CR1 was in the Fire Control Room, intermittently using the PA system.
Around this time, Mr Rogers arrived and deactivated the EWIS. CR1 then returned to the CCTV Control Room with Mr Rogers. 1408 CR2 attends the CCTV Control Room 7.625 Upon arriving on Level 6 at 3:34:14pm with Mr Zaidi and Mr Helg, CR2 recalled Mr Zaidi asking him to go to the Control Room. 1409 CR2 ran to the service elevator to make his way to the CCTV Control Room. 1410 7.626 CR2 recalled that while he was in the service elevator, he heard Mr Zaidi request information on the location of the POI, and CR1 reply “no”. 1411 7.627 As noted above, CR2 arrived in the CCTV Control Room at 3:36:40pm. He asked CR1 if she had located the perpetrator and she said she had not. 1412 7.628 CR2’s actions can be seen on CCTV footage from the CCTV Control Room. He described his actions as follows: I was looking at the CCTV footage in the [C]ontrol [R]oom and located the POI on [L]evel
1406 Exhibit 1, Vol 4, Tab 291, Statement of CR1 at [16]; Exhibit 1, Vol 4, Tab 32A, CCTV Review Timeline (amended) at rows 309, 311, 314, 324 1407 Exhibit 1, Vol 4, Tab 291, Statement of CR1 at [16].
1408 Electronic Material, Item 60, ZA P5 Fire Control Room, 4:03-4:04pm.
1409 Exhibit 1, Tab 1600C, Supplementary Statement of CR2 at [35].
1410 Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at row 122.
1411 Exhibit 1, Tab 1600C, Supplementary Statement of CR2 at [36]; Exhibit 1, Vol 4, Tab 293, Statement of CR2 at [12].
1412 Exhibit 1, Tab 1600C, Supplementary Statement of CR2 at [37].
1413 Exhibit 1, Vol 4, Tab 293, Statement of CR2 at [14].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.629 CR2 further described viewing Insp Scott from the time she entered Level 4, Zone A, through to her shooting Mr Cauchi on Level 5 outside Eckersley’s. 1414 7.630 The CCTV footage depicts CR2 assuming a workstation at the CCTV monitors at 3:36:45pm. He logged onto the system at approximately 3:37:10pm, with the monitors taking a moment to load. 1415 7.631 CR2 said that he reviewed the CCTV footage as quickly as he could and that his initial notification of the perpetrator was assisted by a radio broadcast by Tyson Rogers, who stated his location. 1416 7.632 CR2 scrolled through a list of camera views and selected a view of Boost Juice on Level 5, Zone A. That view displayed Mr Cauchi threatening a customer and moving away at 3:37:53pm. 1417 7.633 CR2 can then be seen scrolling for another view. At the same time, on the screen, Insp Scott and other bystanders can be seen running in the direction of Mr Cauchi. 1418 7.634 CR2 then selected a view away from Boost Juice, where he observed the group following Mr Cauchi’s head towards the airbridge above Oxford Street.1419 7.635 At 3:38:32pm, CR2 reached for the CMEO box. 1420 However, Scentre records indicate the CMEO was not activated at that time.
7.636 Mr Cauchi was shot by Insp Scott at 3:38:33pm.
7.637 At approximately 3:39:45pm, CR2 pressed a button on the CMEO panel. 1421 The CMEO Event Log shows that the “EVAC ALL” button was activated at that time. 1422 There was no longer an active offender at the time the “EVAC ALL” button was pressed.
7.638 After CR2 activated this function, the visual display units in WBJ began displaying the following emergency evacuation message: 1423 1414 Exhibit 1, Vol 4, Tab 293, Statement of CR2 at [16]-[17].
1415 Electronic Material, Item 60, ZA P4 CCTV Control Room [3:36:45pm-3:37:15pm].
1416 Exhibit 1, Tab 1600C, Supplementary Statement of CR2 at [38].
1417 Electronic Material, Item 60, ZA P4 CCTV Control Room, [3:37:45-3:37:55pm].
1418 Electronic Material, Item 60, ZA P4 CCTV Control Room, [3:38:06pm].
1419 Electronic Material, Item 60, ZA P4 CCTV Control Room, [3:38:10pm].
1420 Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at row 215.
1421 Electronic Material, Item 66H, CCTV Compilation Clip – CR1; Electronic Material, Item 60, CCTV footage of Centre Management Areas; CCTV Control Areas; Fire Control Room: D. ZA P4 CCTV Control Room [from 3:37pm]; Exhibit 1, Vol 4, Tab 291A, Supplementary Statement of CR1 at [27]; Exhibit 1, Vol 31, Tab 1001, Centre Management Emergency Override (CMEO) log, Annexure C.
1422 Electronic Material, Item 56, CMEO Server Log Billing Logs, [CMEO] Activation Status.
1423 Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [39].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Figure 21: CCTV depicting visual display unit.
7.639 At approximately 3:39:55pm, CR2 ran from the CCTV Control Room to the Fire Control Room.1424 7.640 At approximately 3:40:38pm, CR2, in the Fire Control Room, activated the EWIS to “Evacuation” setting for all areas.1425 7.641 At around 3:42pm, CR2 returned to the CCTV Control Room, where he began reviewing CCTV footage. He observed the critical incident and tracked through a number of views throughout the Centre.1426 7.642 CR2 continued to review CCTV footage up to 4:22:14pm when CI Reimer arrived in the CCTV Control Room. CR2 showed CI Reimer a number of views indicating Mr Cauchi’s movements and attacks. CR2 then continued reviewing CCTV footage while CI Reimer used his radio to communicate with other police. CI Reimer left the CCTV Control Room at around 4:31pm.1427 Joseph Gaerlan investigates and assumes Chief Warden role 7.643 At 3:34:55pm, Mr Gaerlan exited the elevator from the CMO on Level 6, Zone A. He walked to an escalator and descended to Level 5 Zone A while listening to his radio earpiece.1428 7.644 At about this time, Mr Gaerlan could see and hear some nearby retailers closing their shutters.1429 1424 Electronic Material, Item 60, ZA P4 CCTV Control Room, [3:39:55pm].
1425 Exhibit 1, Vol 31, Tab 999, Electronic Warning and Intercommunication System (EWIS) Report; Exhibit 1, Vol 4, Tab 293, Statement of CR2 at [11].
1426 Electronic Material, Item 60, ZA P5, Fire Control Room, [3:42pm-4:22pm].
1427 Electronic Material, Item 60, ZA P4 CCTV Control Room 2, [4:22pm-4:31pm]; Exhibit 1, Vol 5, Tab 326, Statement of Chief Inspector Reimer at [7].
1428 Electronic Material, Item 66H, CCTV Compilation Clip – Joseph Gaerlan.
1429 Exhibit 1, Vol 45, Tab 1600D, Supplementary Statement of Joseph Gaerlan at [32].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.645 At 3:35:25pm, Mr Gaerlan spoke with a crowd of shoppers gathered at the bottom of the escalator on Level 5.1430 He said: As I was trying to listen to my radio, customers were also speaking to me. They had surrounded me and were saying to the effect of "am I going to be ok, what's happening what's happening". I said to the effect of "stand by and we'll provide you with an update with what we know as soon as we are able".1431 7.646 Mr Gaerlan did not recall hearing Mr Taha’s radio that he had “been stabbed” at approximately 3:35:39pm. 1432 7.647 Mr Gaerlan said that he decided to walk further into the Center “to understand more of what was happening”. 1433 He walked towards the airbridge to Level 6, Zone A.
7.648 At approximately 3:36:36pm, Mr Gaerlan heard Mr Zaidi’s repeated radio broadcast (referred to above), which confirmed there was an AAO and multiple victims. 1434 7.649 Mr Gaerlan gave evidence that this was the first moment he was aware of the nature of the emergency – being an AAO – and that it was necessary for him to assume the role of Chief Warden. 1435 7.650 At the time Mr Gaerlan heard the AAO announcement from Mr Zaidi, there were a number of shoppers and store attendants in his vicinity. 1436 Mr Gaerlan gave evidence that while he was aware of the “Escape. Hide. Tell.” principles, he did not give consideration to informing those people of the threat, as his focus was to enact the key assignments under the Red Book, including PA announcements and the activation of the CMEO. 1437 7.651 Mr Gaerlan turned around and walked quickly back towards the CMO, reaching the escalator to Level 6 at approximately 3:37:02pm.1438 Mr Gaerlan said: It was at this time I formed a view that I would be better able to perform my duties as Chief Warden not by going downstairs to the scene of the incident. I instead needed to immediately set up an Emergency Operations Centre (EOC) and continue to receive information from the Control Room. The EOC is essentially the location where the Chief Warden will establish themselves to conduct Command and Control. The process for the EOC is set out in the Red Book …1439 7.652 Mr Gaerlan also gave evidence that his main goal at that time was to make a radio announcement to the CCTV Control Room.1440 Mr Gaerlan recounted that the radio was 1430 Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at row 126.
1431 Exhibit 1, Vol 45, Tab 1600D, Supplementary Statement of Joseph Gaerlan at [34].
1432 Transcript, D7 (Gaerlan): T487.18-21 (7 May 2025).
1433 Transcript, D7 (Gaerlan): T488.21 (7 May 2025).
1434 Exhibit 1, Vol 45, Tab 1600D, Supplementary Statement of Joseph Gaerlan at [36].
1435 Transcript, D7 (Gaerlan): T488.35-46 (7 May 2025).
1436 Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at row 181.
1437 Transcript, D7 (Gaerlan): T504.41-T505.11 (7 May 2025).
1438 Electronic Material, Item 66H, CCTV Compilation Clip – Joseph Gaerlan.
1439 Exhibit 1, Vol 45, Tab 1600D, Supplementary Statement of Joseph Gaerlan at [37].
1440 Transcript, D7 (Gaerlan), T489:14-30 (7 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 congested with radio chatter, making it difficult to communicate. While on the escalator ascending from Level 5 to Level 6, Mr Gaerlan directed the CCTV Control Room: … to activate the CMEO and make PA announcements for an AAO situation. And once again [I] had really tried to repeat that as much as possible.1441 7.653 Mr Gaerlan stated this direction to the CCTV Control Room was: "M2 to control, activate CMEO, and confirm that blue lights have been contacted, make sure PA announcements are made". Mr Gaerlan’s evidence was that he did not hear a response or confirmation from the CCTV Control Room, however, he knew his message had been broadcast. 1442 7.654 Mr Gaerlan returned to the CMO via elevator, at which time he made a further radio broadcast: Code black, there's an armed active offender situation, seek shelter. 1443 7.655 Mr Gaerlan explained that he attended the CMO as an automatic response, because he knew he could activate and view CCTV footage from there. However, having given consideration to the time it would take for him to log in to the system from the CMO, Mr Gaerlan decided it would be more efficient for him to head directly to the CCTV Control Room. 1444 7.656 Mr Gaerlan returned to the elevators and proceeded to Level P4. At Ground Level, the elevator stopped, and a crowd of customers rushed in. Mr Gaerlan arrived on Level P4 at approximately 3:39:30pm.1445 7.657 Mr Gaerlan headed to the CCTV Control Room. En route, he made telephone calls to Luke Caleo (WBJ Centre Manager) and Chris Zerial (Regional Manager) as part of the escalation procedure (in accordance with the Red Book) to notify them of the incident.1446 7.658 Mr Gaerlan could not recall hearing alarms or any PA announcements being made at this time.1447 7.659 Mr Gaerlan entered the CCTV Control Room at approximately 3:40:04pm, having passed CR2 who was heading to the Fire Control Room. Mr Gaerlan gave evidence that he did not know where CR2 was running to or why.1448 1441 Transcript, D7 (Gaerlan), T489.14-30 (7 May 2025).
1442 Exhibit 1, Vol 45, Tab 1600D, Supplementary Statement of Joseph Gaerlan at [38]; Transcript, D7 (Gaerlan): T489.5-30 (7 May 2025).
1443 Transcript, D7 (Gaerlan): T490.25-35 (7 May 2025).
1444 Transcript, D7 (Gaerlan): T490.40-50 (7 May 2025).
1445 Electronic Material, Item 66H, CCTV Compilation Clip – Joseph Gaerlan.
1446 Exhibit 1, Vol 45, Tab 1600D, Supplementary Statement of Joseph Gaerlan at [44]; Transcript, D7 (Gaerlan): T491.15-22 (7 May 2025); Exhibit 1, Vol 229, Tab 993, Statement of Emily Hunt, Annexure D, Emergency Plan – Emergency Response Procedures at p.
485-487.
1447 Transcript, D7 (Gaerlan): T499.48-T500.29 (7 May 2025).
1448 Transcript, D7 (Gaerlan): T496.48-T497.5 (7 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.660 Mr Gaerlan gave the following evidence about his actions upon arriving in the CCTV Control Room: A. I got to the [C]ontrol [R]oom. I'd seen [CR1] on the phone and I had asked her to contact the police, you know. Whilst I'd made the direction on the escalators on retail level for the things that I had said, I wanted to verify that those things were taking place.
So I'd asked, "Have you contacted police, are we on the phone"? She says, "I'm on the phone with the police". And I could visually see her on the phone. And then I had asked the question, "Where are we now, what's happened?" Like, "What do we know", effectively. Because at that point, as I said, we still hadn’t known any information around what was unfolding.
Q. Was she able to respond to those questions?
A. As I mentioned, she was, she was on the phone, so I can't recall exactly what the conversation or exchange was. She'd confirmed, however, that she was on the phone.1449 7.661 Mr Gaerlan gave evidence that his priority upon arriving in the CCTV Control Room was to confirm the five main assignments in respect of the Red Book AAO guidelines were being or had been carried out.1450 7.662 As set out earlier in this Part in Section D, those assignments were:
(a) Notify Triple 0
(b) CCTV
(c) Public Address System
(d) CMEO
(e) Liaison with Police Responder 7.663 Mr Gaerlan gave evidence that as he entered the CCTV Control Room, he did not see whether the EWIS was activated on the mimic EWIS screen. 1451 However, he could see the CMEO seal had been removed and therefore assumed it had been activated.1452 7.664 Upon entering the CCTV Control Room, Mr Gaerlan described asking CR1 words to the effect of “[w]hat do we know?” and not receiving any answers, which caused frustration: I remember being immensely frustrated, being my key focus was to, to understand what was happening. I hadn't known any, any information other than the last call, as I mentioned, that [Mr Zaidi] had called through. And it was frustrating for me, because 1449 Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at row 249; Transcript, D7 (Gaerlan): T491.31-44 (7 Mary 2025).
1450 Transcript, D7 (Gaerlan): T498.28-T499:3 (7 May 2025).
1451 Transcript, D7 (Gaerlan): T500.26-29 (7 May 2025).
1452 Transcript, D7 (Gaerlan): T499.23-36 (7 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 without that information, I, I wouldn't be able to continue to do what's expected of myself.1453 7.665 CCTV footage of the CCTV Control Room shows Mr Gaerlan continued to use his phone, take notes, and observe CCTV footage for approximately three minutes after entering the room.1454 7.666 At approximately 3:42:37pm, Mr Gaerlan reached over towards the CMEO.1455 In his evidence, Mr Gaerlan explained he had done so in order to verify it had been activated.1456 7.667 The CMEO logs indicate that from 3:42:37pm to 3:42:41pm the “AAO” button was pressed eight times. However, the button press was “ignored”, because the “EVAC ALL” override was already active (having been already activated by CR2).1457 7.668 At around 3:42:29pm, CR2 re-entered the CCTV Control Room from the Fire Control Room. CR2 resumed his review of CCTV footage at this time.
7.669 Mr Gaerlan asked CR2 a number of questions regarding the incident, including asking him to confirm the number of attackers and the use of a weapon.1458 Mr Gaerlan explained that he needed answers to those questions as it would dictate the next steps in the response. Mr Gaerlan gave evidence that CR2 was ultimately able to confirm that Mr Cauchi was the only offender. CR2 was able to provide this confirmation through his review of the CCTV footage. 1459 7.670 Mr Gaerlan made a radio broadcast to Mr Zaidi to confirm that the CCTV review indicated there was one offender. He assumed Mr Zaidi would pass that information on to emergency services, though he did not give a clear direction for that information to be provided to police.1460 Mr Gaerlan accepted that the number of offenders was critical information.1461 7.671 At around 3:50pm, Mr Gaerlan directed CR1 to attend the Fire Control Room and make PA announcements after her phone call to police.1462 7.672 Mr Gaerlan recalled hearing a radio broadcast that police had requested the EWIS to be turned off and that the alarm was turned off at around 4:03pm.1463 1453 Transcript, D7 (Gaerlan): T498.14-26 (7 May 2025).
1454 Electronic Material, Item 66H, CCTV Compilation Clip – Joseph Gaerlan.
1455 Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended), row 274.
1456 Exhibit 1, Vol 45, Tab 1600D, Supplementary Statement of Joseph Gaerlan at [52]; Transcript, D7(Gaerlan): T505.48-T506.14 (7 May 2025).
1457 Electronic Material, Item 56, CMEO Server Log Billings Logs, CEMO [sic] Activation Status [1].
1458 Transcript, D7 (Gaerlan): T501:46-T502:41 (7 May 2025), 1459 Exhibit 1, Vol 45, Tab 1600D, Supplementary Statement of Joseph Gaerlan at [55]; Transcript, D7 (Gaerlan): T501.40-T502.33 (7 May 2025); Electronic Material, Item 60, ZA P4 CCTV Control Room, [3:50:00pm-3:51:30pm] 1460 Transcript, D7 (Gaerlan): T503.44-46 (7 May 2025).
1461 Transcript, D7 (Gaerlan): T503.33- T504.2 (7 May 2025).
1462 Exhibit 1, Vol 45, Tab 1600D, Supplementary Statement of Joseph Gaerlan at [53]; Electronic Material, Item 66H, CCTV Compilation Clip – Joseph Gaerlan.
1463 Transcript, D7 (Gaerlan): T514.4-14 (7 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.673 Mr Gaerlan remained in the CCTV Control Room into the evening, conducting welfare checks on staff and briefing Scentre management. He also recalled assisting with police requests including the establishment of a command centre on Level 6, the provision of Centre maps for tactical police conducting a sweep, and providing an NSWPF recorded message to be played via the PA.1464 Tyson Rogers 7.674 At approximately 3:37pm, Tyson Rogers (Scentre Facilities Coordinator) was working on the WBJ roof when he heard the radio alert from GLA2. Mr Rogers returned to the retail floor to investigate. He was walking through Level 5 Zone A towards Level 5 Zone B and heard a radio broadcast mentioning the Level 5 food court (located in Zone A). He changed course and walked in the direction of the food court.1465 7.675 Mr Rogers was walking against a crowd of people who were running in the opposite direction. He said: Around this time, I then saw a man that was running but his movements were not normal. His movements were between a jog and a walk, and his arms were hanging. I remember clearly he was wearing rugby gear. He had a knife which I think was in his right hand. The knife was massive and it was hanging in his hand. He was not making any sound. I observed a man who was with his family. The man turned around to face the male with the knife. He made one or two steps towards the male with the knife. The male with the knife then made about a degree turn away from the man with the family and continued to jog/walk…1466 7.676 At approximately 3:37:43pm, Mr Rogers used his radio to report that he had observed a man with a knife on Level 5 near Boost Juice.1467 7.677 Mr Cauchi passed Mr Rogers and jogged away from him. Mr Rogers followed Mr Cauchi because he “wanted to alert others within the Centre to the danger that he posed to them”.1468 7.678 Mr Rogers saw Insp Scott chasing Mr Cauchi, with a number of people following her, some wielding chairs.1469 7.679 Mr Rogers followed Insp Scott and made another radio broadcast near the airbridge on Level 5, as Insp Scott confronted Mr Cauchi.1470 1464 Exhibit 1, Vol 30, Tab 996, Statement of Joseph Gaerlan at [30]-[35].
1465 Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at row 200; Electronic Material, Item 66H, CCTV Compilation Clip – Tyson Rogers.
1466 Exhibit 1, Vol 42, Tab 1594, Statement of Tyson Rogers at [18]-[]-19]..
1467 Exhibit 1, Vol 42, Tab 1594, Statement of Tyson Rogers at [21]; Exhibit 1, Vol 42, Tab 1594A, Supplementary Statement of Tyson Rogers at [7]; Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at row 200.
1468 Exhibit 1, Vol 42, Tab 1594, Statement of Tyson Rogers at [21].
1469 Exhibit 1, Vol 42, Tab 1594, Statement of Tyson Rogers at [21].
1470 Exhibit 1, Vol 42, Tab 1594, Statement of Tyson Rogers at [21]; Exhibit 1, Vol 42, Tab 1594A, Supplementary Statement of Tyson Rogers at [7]; Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at row 214.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.680 Mr Rogers saw Insp Scott shoot Mr Cauchi as he ran towards her.1471 7.681 Mr Rogers immediately spoke to Insp Scott and offered assistance. Insp Scott asked him to keep the crowd of people back. Mr Rogers interacted with the crowd, including having to raise his voice, and prevented people from approaching Insp Scott and Mr Cauchi.1472 7.682 At approximately 3:40pm, Inspector Scott asked Mr Rogers to check no one else had been injured by the gunfire.1473 Mr Rogers confirmed with Insp Scott that there was no other injured person in the area.1474 Security staff interactions with emergency services 7.683 At approximately 3:41pm and following the confirmation from Mr Gaerlan that Mr Cauchi had been shot, Mr Helg went out to Oxford Street and waited for paramedics to arrive.
7.684 At 3:43pm, Mr Helg told paramedics: … there's possibly three that are deceased upstairs, and just told them there's, there's a lot of blood, there's people on the ground and we need to get up there. Once I told him that, he went onto his radio. He contacted someone, and then he told me to wait down here and don't let any other paramedics up until he approves.1475 7.685 Mr Helg described at that time members of the public were still attempting to enter WBJ, despite him telling them that they needed to leave and evacuate.1476 7.686 At 3:45pm, Mr Helg escorted paramedics to the elevators on Level 3, Zone B. Mr Zaidi entered the lift with the paramedics and took them to Level 4, while Mr Helg remained on Level 3.1477 7.687 Mr Helg returned to Oxford Street, where he directed and otherwise assisted NSWPF and paramedics, including using police tape to establish a perimeter.1478 Mr Helg attended Loading Dock B sometime after 4:00pm, where the NSWPF had established a Forward Command Post. He recounted that there was uncertainty among the police as to whether there was a second offender. Police asked for assistance from security guards to complete a sweep of the premises. Mr Helg gave evidence that he did not receive a response to his call for guards to come to the Loading Dock at that time.1479 7.688 Following gunshots, Mr Zaidi ran to the CCTV Control Room to ensure the CMEO and EWIS tones were activated. He had not seen the CMEO system activate when on the 1471 Exhibit 1, Vol 42, Tab 1594, Statement of Tyson Rogers at [22]-[23].
1472 Exhibit 1, Vol 42, Tab 1594, Statement of Tyson Rogers at [24].
1473 Exhibit 1, Vol 42, Tab 1594, Statement of Tyson Rogers at [25]; Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended), row 234.
1474 Exhibit 1, Vol 42, Tab 1594, Statement of Tyson Rogers at [27]; Electronic Item 66H, CCTV Compilation Clip – Tyson Rogers.
1475 Electronic Material, Item 66H, CCTV Compilation Clip – Jerry Helg; Transcript, D8 (Helg): T590:35-41 (8 May 2025); Exhibit 1, Vol 4, Tab 283, Statement of Jerry Helg at [16].
1476 Transcript, D8 (Helg): T589:28-41 (8 May 2025) 1477 Electronic Item 66H, CCTV Compilation Clip – Jerry Helg.
1478 Electronic Item 66H, CCTV Compilation Clip – Jerry Helg.
1479 Transcript, D8 (Helg): T592:47-593:7 (8 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 retail floor. He heard the EWIS tones as he arrived in the carpark on Level P4.1480 Mr Zaidi entered the CCTV Control Room at around 3:42:09pm. Mr Zaidi said: The conversation in the [C]ontrol [R]oom was very brief. I told [Mr Gaerlan] to press the CMEO so that I could see it had been activated. I think [Mr Gaerlan] said to me that this step had been taken but I wanted to verify it as I had not seen the screens activated when I was in the Centre. I saw [Mr Gaerlan] press the CMEO while I was there although I could not see the actual buttons. I told [Mr Gaerlan] that there were multiple casualties and at least one person deceased.
I then left the [C]ontrol [R]oom, because I could see that the [C]ontrol [R]oom was manned and because I needed to continue in my role of on-scene coordinator. I grabbed an emergency warden vest so I would be visible and went outside onto Oxford Street. My job was to direct people to safety and to liaise with police and emergency responders on the ground.1481 7.689 Mr Zaidi returned to Oxford Street at approximately 3:44pm. He recounted using his radio to attempt to get information on the status of the security officers. He met with arriving paramedics and escorted them to victims.1482 Mr Zaidi said: On Oxford Street, I had to request multiple times for paramedics to come into the Centre… When I was in the lift, one of the paramedics said to the effect that there may be a second offender in the Centre. I immediately radioed to the [C]ontrol [R]oom and said to the effect of "M20 to control I need an answer, is there any other offenders or not'. The [C]ontrol [R]oom responded that they were reviewing and would confirm this over the radio.1483 7.690 At around 4:00pm, Mr Zaidi returned to Oxford Street and spoke with Sgt 21484 regarding police attending the CCTV Control Room. Sgt 2’s account of this interaction is described in Part 8. Mr Zaidi recalled the following interaction: I went back to Oxford Street. The sergeant was there, who told me there was another inspector I should be speaking to. After further conversation, the sergeant agreed to come to the [C]ontrol [R]oom with me. I knew from training, including multi-agency exercises, that we needed police in the [C]ontrol [R]oom to get access to live footage, Westfield radios, floor plans and other things the police might need. I said words to the effect of, "I need someone there so that you can tell us what you need from us, and if you need to issue us instructions and so you are able to view live footage".
[Mr Goldberg] and Chris Zerial (were in the [C]ontrol [R]oom. At 4.09pm, either Brad or Chris asked me to make announcements from the [C]ontrol [R]oom. I think [CR1] was next to me. The sergeant then left the [C]ontrol [R]oom having only been there a few minutes. Seeing him leave, I asked Brad whether he had spoken to the police. To the 1480 Exhibit 1, Vol 42, Tab 1597, Statement of Rahim Zaidi at [48].
1481 Exhibit 1, Vol 42, Tab 1597, Statement of Rahim Zaidi at [50]-[51].
1482 Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at rows 289-290; Exhibit 1, Vol 42, Tab 1597, Statement of Rahim Zaidi at [52]-[53].
1483 Exhibit 1, Vol 42, Tab 1597, Statement of Rahim Zaidi at [55]-[56].
1484 Sgt 2 is a pseudonym and this officers name is subject to a Non-Publication Order dated 28 May 2025
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 best of my recollection, he said he had not, and asked where the sergeant had gone, and we decided to go and get him again. I do not now remember whether I made announcements but I gave the PA handpiece to someone, who I believe was [CR1]. My attention was on having the police in the [C]ontrol [R]oom. 1485 Bradley Goldberg attends WBJ 7.691 At approximately 3:37pm, Mr Goldberg received a call from Mr Zaidi reporting the incident and requesting Mr Goldberg’s attendance on-site.1486 Mr Goldberg received a further call at approximately 3:39pm from Mr Zaidi advising police were onsite, and he heard Mr Zaidi say, “shots fired”.1487 7.692 Mr Goldberg arrived at WBJ around approximately 3:50pm and accessed the Centre via a loading dock.1488 7.693 Mr Goldberg ran through Level 1, Zone A and at approximately 3:55pm arrived in the CCTV Control Room.1489 7.694 Upon arrival in the CCTV Control Room, Mr Goldberg received a brief update from Mr Gaerlan and CR2, “including that it appeared that there was one perpetrator who had been shot by the police.” Mr Goldberg used the radio to organise to meet Mr Zaidi on Oxford Street.1490 7.695 At approximately 4:02pm, Mr Goldberg returned a missed call from DI Adam Solah: I called [Detective] Inspector Solah back and he asked me to verify whether there was one or multiple attackers. I said "from what I've seen on CCTV, there is only one". I had only seen one perpetrator on the CCTV but could not be sure there was not another. On our call, Inspector Solah also requested that the emergency tones cease across the Centre as they were causing difficulty in communication. To action this I radioed through to the Control Room to get the tones silenced (while still on the line to Inspector Solah). He asked me to arrange for a senior police officer to be taken down to the Control Room to verify that there was only one perpetrator. …1491 7.696 Mr Goldberg directed Mr Zaidi to bring a NSWPF officer to the CCTV Control Room. 1492 Mr Zaidi took steps to make this happen.
7.697 At approximately 4:06pm, Mr Goldberg briefed Mr Zerial, who had by that stage arrived at WBJ. Mr Goldberg was satisfied there were sufficient emergency coordination resources in the CCT.
1485 Exhibit 1, Vol 42, Tab 1597, Statement of Rahim Zaidi at [59]-[60].
1486 Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg at [46].
1487 Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg at [47].
1488 Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg at [51].
1489 Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg at [52]-[53]; Electronic Item 60, ZA P4 CCTV Control Room, [3:55pm].
1490 Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg at [53].
1491 Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg at [54].
1492 Exhibit 1, Vol 43, Tab 1600, Statement of Bradley Goldberg at [54].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.698 Over the course of the afternoon, Mr Goldberg assisted NSWPF with locating and accessing various areas in the centre. Mr Goldberg assisted NSWPF establish a command centre in a suite on Level 6 Zone A, as well as the search and clearance of
Expert evidence concerning response 7.699 As set out earlier, Scott Wilson was engaged by those assisting me to provide an expert report. Amongst other matters, Mr Wilson was tasked with analysing the response of security staff to the events of 13 April 2024.
7.700 Mr Wilson identified a number of matters of concern and identified various opportunities for improvement.
7.701 These matters were:
(a) The CCTV Control Room was not occupied at the time of the incident, which was a lost opportunity to immediately start the review of CCTV footage. This adversely impacted the timeliness of the response.1493 Further, Mr Wilson expressed the view that due to CR1 not being present in the CCTV Control Room at the time the incident began, CR1 can be seen catching up on events that have taken place, and attempted to build up situational awareness of what was occurring and was therefore not in a position to provide direction to the security team.1494
(b) That CR1 was not fully competent to have been left in the control room without supervision. In his supplementary report, Mr Wilson pointed to the need for CR1 to be constantly reminded to carry out basic actions on the day, as visible in CCTV footage of the Security Control Room, and to the issues identified in her training records as the main basis for his views.1495 This is discussed further below.
(c) During core trading hours, there should always be an appropriately trained security officer in the CCTV Control Room with access to security systems.1496
(d) The CCTV Control Room Operator plays a critical role in establishing situational awareness during an emergency. Being in a position to promptly review footage and provide real-time updates as to critical details such as the nature, extent, and location of the threat is inherently important to establishing and sharing situational awareness with other security staff, customers, and emergency services, as appropriate. This ability to obtain and share situational awareness 1493 Transcript, D14 (Wilson): 1204.36-41 (19 May 2025).
1494 Exhibit 1, Expert Volume, Tab 20, Expert Report of Scott Wilson at [2.6], [6.1.4].
1495 Exhibit 1, Expert Volume, Tab 20, Expert Report of Scott Wilson at [6.2.3].
1496 Transcript, D14 (Wilson): T1204.36-41 (19 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 also inherently underpins the nature and timeliness of the response to an emergency and the command and control of an incident.1497
(e) There were failings in the clarity of GLA2’s initial reporting of the incident. In the event of an AAO incident, clear and concise information is critical, including details of the location, the direction, the weapon, and the actions of the offender.1498
(f) Had there been greater clarity in the messaging from GLA2 at around 3:33:33pm, there would have been a faster response to the emergency by Scentre and Glad staff. The nature of GLA2’s initial radio broadcast of the incident, as well as the impact of the nature of that broadcast on the overall security response to the incident, is addressed further below.1499
(g) There were issues with the volume of traffic on the radio and the nature of the communications between the security guards. Mr Wilson opined that the communication between security staff and the control room with regard to the active armed offender was ineffective. He noted that whilst some initial information that was shared did provide useful information, vital messages were not followed up, and the information was not used to safeguard other security or the public. He proffered the view that there was poor radio management throughout and that the control room should have requested to keep the channels clear unless vital information was being transmitted and provided direction and command to the team on the ground on what action they should have been taking. In his view, the four golden rules of good radio communication are “Clarity, Simplicity, Brevity and Security”; and that none of these were evidenced on 13 April 2024 apart from the initial message.1500
(h) The telephone call by CR1 to Triple 0 should have occurred earlier (although it is acknowledged that CR1 was on hold for around 6 minutes). Mr Wilson noted that as at 3:38.33pm, at a time when Mr Cauchi had been neutralised by Insp Scott, there had been virtually no command, control, or direction from the CCTV Control Room to Emergency Services (amongst others). It is noted that Mr Wilson ultimately retracted the position in his first report, that at the time Insp Scott entered WBJ, CR1 had not made contact with emergency services. However, he maintained his criticism that CR1 ought to have known that police had shot the armed offender. Relatedly, Mr Wilson expressed the view that the information supplied to police was not accurate. In addition, the standard of information expected to be provided by a CCTV Control Room Operator should generally be better than that of members of the public.1501 1497 Transcript, D14 (Wilson): T1204.36-46 (19 May 2025).
1498 Transcript, D14 (Wilson): T1218.41-T1219.15 (19 May 2025).
1499 Exhibit 1, Expert Volume, Tab 20, Expert Report of Scott Wilson at [6.3.6].
1500 Exhibit 1, Expert Volume, Tab 20, Expert Report of Scott Wilson at [6.3.6].
1501 Exhibit 1, Expert Volume, Tab 20, Expert Report of Scott Wilson at [6.2.2].
(i) The CMEO should have been activated immediately after Mr Gaerlan communicated that it should be. Mr Wilson expressed the opinion that the activation was far too slow. He concluded that the CMEO should have been activated (along with the PA announcements) within the first few minutes of the incident, and after the code black alpha was received, and it had been confirmed that there was an AAO in the centre. It was approaching almost 10 minutes until the majority of these alerts were put in place (and 20 minutes until the PA was utilised). He stated that this delay could have resulted in the loss of life and more people being injured. Whilst the correct alarms and alerts were put in place, the activation was too slow.1502
(j) The first sounding of the EWIS alarm was too slow. As above, it took almost 10 minutes for the EWIS to sound, the consequence of which could have resulted in increasing the number of customers who were exposed to an unknown and serious threat. In addition, it was noted that rather than sounding from the Fire Control Room, the EWIS alarm could have been activated from the CCTV Control Room.1503
(k) The PA announcements could have been made from the CCTV Control Room rather than the Fire Control Room. Mr Wilson explained that ideally, security personnel will be able to monitor CCTV, make calls to emergency services, and deliver both the CMEO and PA systems from the same room immediately after an incident has been confirmed. By leaving the CCTV Control Room to attend the Fire Control Room, situational awareness is lost. PA announcements were regarded as the best way to inform people of an AAO.1504 Evidence of Mr Yates 7.702 In oral evidence, Mr Yates was questioned on the issues identified by Mr Wilson. In the course of that questioning, Mr Yates accepted the following:
(a) That the CCTV Control Room was not occupied at the time of the incident, which was a lost opportunity to immediately start the review of CCTV footage. This adversely impacted the timeliness of the response, and that the impact of these lost opportunities is unquantifiable; 1505
(b) That during core hours, there should always be an appropriately trained security officer in the Control Room with access to the various security systems; 1506 1502 Exhibit 1, Expert Volume, Tab 20, Expert Report of Scott Wilson at [6.4.6].
1503 Exhibit 1, Expert Volume, Tab 20, Expert Report of Scott Wilson at [6.4.6]. See also, Exhibit 1, Expert Volume, Tab 20, Expert Report of Scott Wilson at [7.3.1].
1504 Exhibit 1, Expert Volume, Tab 20, Expert Report of Scott Wilson at [6.6.3]. See also, Exhibit 1, Expert Volume, Tab 20, Expert Report of Scott Wilson at [7.3.1].
1505 Transcript, D15 (Yates): T1303.45-T1304.10 (20 May 2025); Transcript, D18 (Iloski): T1652.50-T1653.8 (26 May 2025).
1506 Transcript, D15 (Yates): T1304.12-15 (20 May 2025); Transcript, D18 (Iloski): T1653.10-17 (26 May 2025).
(c) That the CCTV Control Room Operator does play a critical role in establishing situational awareness during an emergency; 1507
(d) There were failings in the clarity of the communication by the first security guard reporting the incident (GLA2). And that in the event of an AAO, clear and concise information is imperative, including the details of the location, direction, the weapon, and the actions of the offender; 1508
(e) There were issues with the volume of traffic on the radio and the nature of the communications as between the security guards; 1509
(f) That had there been greater clarity in the messaging from GLA2 at around 3:33:33pm, there would have been a faster response to the emergency by Scentre and Glad staff;1510
(g) There should have been an earlier call to Triple 0 and that the standard of information expected to be provided by a CCTV Control Room Operator should generally be better than members of the public;1511
(h) That the CMEO should have been activated earlier than 3:39:43pm. And that it should have been activated immediately after the Chief Warden (Mr Gaerlan) verified that there was an AAO and directed its activation; 1512
(i) That the first sounding of the EWIS alarm tones was too slow. And that this arose in part from the absence of a Control Room Operator at the time the incident commended. Further, that it could have been activated from the CCTV Control Room instead of the Fire Control Room; 1513 and
(j) The PA announcements could have been made from the CCTV Control Room rather than the Fire Control Room. 1514 7.703 There were, however, a number of matters which remained in dispute as between Mr Wilson and Mr Yates.
1507 Transcript, D15 (Yates): T1305.41-44 (20 May 2025); Transcript, D18 (Iloski): T1653.19-21 (26 May 2025).
1508 Transcript, D15 (Yates): T1309.1-26 (20 May 2025); Transcript, D18 (Iloski): T1653.23-36 (26 May 2025).
1509 Exhibit 1, Vol 41, Tab 1599A, Supplementary Statement of John Yates (Director of Security) at [21]-[22]; Transcript, D18 (Iloski): T1653.38-41 (26 May 2025).
1510 Exhibit 1, Vol 41, Tab 1599A, Supplementary Statement of John Yates (Director of Security) at [19]; Transcript, D18 (Iloski): T1653.23-36 (26 May 2025).
1511 Transcript, D15 (Yates): T1309.46-T1310.5, T1310.24-T1310.26 (20 May 2025); Transcript, D18 (Iloski): T1653.43-T1654.1 (26 May 2025).
1512 Transcript, D15 (Yates): T1311.11-17(20 May 2025; Transcript, D18 (Iloski): T1654.3-9 (26 May 2025).
1513 Transcript, D15 (Yates): T1311.43-T1312.10 (20 May 2025) ; Transcript, D18 (Iloski): T1654.11-16 (26 May 2025).
1514 Transcript, D15 (Yates): T1312.15-18T1312.26 (20 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.704 One point of contention related to Mr Wilson’s “expectations” of the response by security officers at WBJ. The complaint being that Mr Wilson was, in effect, holding security officers to too high a standard, comparable to that of trained police officers.1515 7.705 Mr Yates did not agree with Mr Wilson’s views regarding the expected response by security officers. In particular, Mr Yates noted that: … I think Mr Wilson places, to my mind, unrealistic expectations on what a security guard can do compared to what a police officer can do…1516 7.706 I note that no submission was made to this effect, rather a more generalised submission was made in relation to the standards Mr Wilson held security staff to, which was addressed in Section A.
7.707 Further, Mr Yates did not accept Mr Wilson’s evidence that CR1 was not competent to respond to the AAO and that she should not have been performing the role of CCTV Control Room Operator without supervision.1517 I have already found that CR1 was not competent to be unsupervised in the CCTV Control Room on 13 April 2024.
Summary of timing of key events 7.708 In relation to the chronology above it is established that the following events occurred at the following times:
TIME EVENT 3:32:55pm Mr Cauchi attacked his first victim (Dawn Singleton) The first radio broadcast relating to the incident was made by 3:33:33pm
GLA2 3:36:03pm CR1 attempted to call Triple 0 3:36:11pm CR1 called Triple 0 and is connected (approximately) Mr Zaidi made a repeated radio broadcast: 3:36:36pm Code black alpha, someone is on the floor, unconscious, active armed offender, contact blue lights, there are multiple victims.1518 3:38:33pm Mr Cauchi was shot by Insp Scott 1515 Transcript, D14 (Wilson): T1289.31-43 (19 May 2025).
1516 Transcript, D15 (Yates): T1322.2-3 (20 May 2025).
1517 Transcript, D15 (Yates): T1318.50-T1319.5 (20 May 2025).
1518 Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at row 153; Exhibit 1, Vol 45, Tab 1600D, Supplementary Statement of Joseph Gaerlan at [36]; Exhibit 1, Vol 42, Tab 1597, Statement of Rahim Zaidi at [37]-[39], [41].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 3:39:45pm The CMEO was activated by CR2 with “EVAC ALL” option (approximately) selected 3:40:38pm The EWIS system was activated 3:51:14pm PA announcements commenced 7.709 As identified above, notwithstanding the apparent agreement between Mr Wilson and Mr Yates regarding aspects of the security response on 13 April 2024, there remained some issues in dispute, or that otherwise warranted more detailed examination, that were subject to further evidence and submissions of the parties. These issues will now be considered in turn.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 G. The initial radio broadcast and identification of an AAO incident by WBJ security staff 7.710 GLA2 is a security guard who was on duty at WBJ on 13 April 2024. As set out in the chronology above, GLA2 was the first security staff member to initiate radio communication to alert the WBJ security team to Mr Cauchi’s attack at approximately 3:33:33pm.
7.711 The issue of what was conveyed by GLA2 in that radio broadcast assumed some prominence in the Inquest as the actions of other security staff on that day proceeded on the basis of the information that they understood was conveyed in this broadcast. In particular, it is necessary to consider, noting the timing of this initial broadcast, at what stage staff did become aware that the events occurring amounted to an AAO incident.
7.712 At the outset, as outlined further below, it is acknowledged that there was no account available from GLA2 as to the content of her initial radio broadcast nor a recording of that broadcast.
Radio usage in an emergency 7.713 As noted above, radio communications are an important part of any emergency response.
7.714 As outlined above in Section C, Scentre uses standard radio colour codes to improve communications between personnel.
7.715 To provide further context to the evidence to follow, I note that the phrase Code Black is used by Scentre security personnel to report a personal threat, meaning a person engaging in or threatening violence to one or more other persons, including themself.
“Code Black” does not distinguish whether a weapon is in use.1519 This is because, as outlined in the Red Book, the broadcast should state the type of weapon to avoid confusion about the nature of the threat and convey this clearly in the broadcast.1520 7.716 As noted above, the Red Book provides for “modifier” or “intensifier” phrases in addition to the specific colour code. The use of the word “Alpha”, alongside a colour code, is intended to escalate the seriousness of the report, indicating that an immediate response is required.1521 1519 Exhibit 1, Vol 29, Statement of Emily Hunt, Annexure, Annexure D, Emergency Plan – Emergency Response Procedures p. 313; Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [28].
1520 Exhibit 1, Vol 29, Statement of Emily Hunt, Annexure, Annexure D, Emergency Plan – Emergency Response Procedures at p. 313.
1521 Exhibit 1, Vol 29, Statement of Emily Hunt, Annexure, Annexure D, Emergency Plan – Emergency Response Procedures at p. 313.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Figure 22: Extract of Scentre Group Radio Colour Codes1522 7.717 With respect to an AAO scenario under the Red Book, one of the Initial Actions is to “Use 2-way radio to advise all Scentre Group personnel – Active Armed Offender and location.”1523 It is noted however, that this follows the requirement to “verify” a report of an AAO. This aspect is considered further below.
Evidence regarding expected content of the initial alert 7.718 In the context of his assessment of overall radio communications on 13 April 2024 (considered further in Section H), Mr Wilson stated that the “golden rules of good radio communication are clarity, simplicity, brevity and security.” 1524 7.719 Noting the importance of radio communication in the context of the response to an AAO offender, Mr Yates, in oral evidence, gave his own views on what the “ideal” radio alert would have been: So GLA2, GLA2 would have said something to the effect, "Code black alpha. Code black alpha. I've seen a man stab somebody. He has a large knife." Give a description of him, and where he - and his direction of travel. And you'd repeat that, "Code black alpha, code black alpha". So, absolute clarity, "It is an AAO event in progress. I've seen it happen." So it's verified because it's a guard, and you've seen the direction of travel and you've seen where he's gone. And you provide that information immediately.1525 7.720 Mr Goldberg accepted that security officers in GLA2’s position “need to convey exactly what they see in terms of location and perpetrator and weapon.” 1526 Evidence from GLA2 7.721 GLA2 was excused from giving evidence at the Inquest on medical grounds.
Consequently, there was no oral account provided in Court of the content of the radio alert by GLA2, who made the transmission.
1522 Exhibit 1, Vol 38, Tab 1253, Radio Colour Codes at p. 1.
1523 Exhibit 1, Vol 29, Statement of Emily Hunt, Annexure, Annexure D, Emergency Plan – Emergency Response Procedures at pp.
325-326.
1524 Exhibit 1, Expert Volume, Tab 20, Expert Report of Scott Wilson at [6.3.6].
1525 Transcript, D15 (Yates): T1309.20-26 (20 May 2025).
1526 Transcript, D9 (Goldberg), T766:49-50 (9 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.722 GLA2 provided a statement on 13 April 2024 recounting the incident, and her actions and observations that day.1527 That statement did not contain specifics as to GLA2’s initial radio broadcast on 13 April 2024.
GLA2 observes Mr Cauchi 7.723 Around 2pm on the afternoon of 13 April 2024, GLA2 was tasked to monitor a specific area of WBJ, that being an area on Level 5, Zone B.
7.724 At 3:32:15pm, just prior to the commencement of Mr Cauchi’s attack at 3:32:55pm, GLA2 was standing near the void at the southern end of Level 5 Zone B, near Myer.1528 At this time, GLA2 had a view through the void to the shops below, including Cotton On.1529 7.725 Recounting her first observations of the incident, GLA2 stated that she “started hearing people yelling and screaming” on Level 4, but she could not hear anything specific.1530 CCTV shows this moment, at 3:33:20pm, GLA2 looked down towards Cotton On from her position on Level 5.1531 Figure 23: CCTV depicting GLA2 at 3:33:20pm 7.726 In her statement she described what she observed: I looked down to Level 4 and I saw that outside of [Lululemon] and near Kookai shop there was a male, he looked about 30 – 35 years of age, he looked like [an] Aussie guy, like Caucasian, about 5’9 in height and a skinny build, possibly black pants, possibly shorts, he was holding a knife in his right hand that looked about 15 – 20 cm in length.
I saw that male run towards a woman from behind her, and with the large knife stab her around the right hip. He struck her at least one time, I think it was only once. 1532 1527 Exhibit 1, Volume 4, Tab 286, Statement of GLA2.
1528 Exhibit 1, Vol 4, Tab 286, Statement of GLA2, at [12]-[13]; Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at row 59.
1529 Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at rows 61-68.
1530 Exhibit 1, Vol 4, Tab 286, Statement of GLA2 at [11].
1531 Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at rows 65-67.
1532 Exhibit 1, Vol 4, Tab 286, Statement of GLA2 at [12]-[13].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.727 Based on the location of the attack described in her statement, GLA2 observed either the attack on Victim 5 (marked as “5” on the plan in Figure 23 below) or, more likely, Victim 6, who was stabbed at 3:33:27pm near Lululemon.
Figure 23: Location of GLA2 with respect to the location of victims on Level 4 7.728 At approximately 3:33:29pm, while running around the void on Level 4 Zone B, Mr Cauchi then stabbed Victim 7 (marked as “7” on the plan), in front of Kookai.1533 7.729 GLA2 does not recount observing Mr Cauchi stab Victim 7. CCTV shows GLA2 at around 3:33:33pm holding her radio to her mouth and looking towards Mr Cauchi as he ran past the Kookai shop, shortly after he stabbed Victim 7.1534 7.730 In her statement, GLA2 states she “heard people yelling “He’s coming to [L]evel 5””.
GLA2 stated: I remember thinking “He’s crazy man, he’s killing everyone”. It made me feel very scared, disturbed and my mind stopped working. I started to move away and my view was obstructed. 1535 7.731 At approximately 3:33.33pm, GLA2 delivered a radio alert to security personnel.1536 The content of this broadcast is uncertain. GLA2 did not provide an account of the alert in her statement; however, various accounts were provided by other witnesses, which are set out below. The content of the alert was the subject of submissions; these are addressed further below.
1533 Exhibit 1, Vol 1, Tab 30, Statement of Detective Chief Inspector Andrew Marks at [72].
1534 Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at rows 71-72.
1535 Exhibit 1, Vol 4, Tab 286, Statement of GLA2 at [16].
1536 Written submissions of Counsel Assisting at [1404].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.732 GLA2’s radio message alerted Westfield personnel on the general channel of an incident.1537 7.733 CCTV shows GLA2 moving away from the void while using her radio. At about this time, Mr Cauchi entered Myer on Level 4 below (where he attacked Victim 8, “8” in Figure 23 above).1538 GLA2 sheltered in a fire escape on Level 5 near Harvey Norman with a male shopper. She continued to use her radio to communicate with the security team.1539 7.734 GLA2 returned from the fire escape at approximately 3:36pm to her position on Level 5 Zone B, from where she used her mobile phone to film the scene below.1540 7.735 The evidence of the security officers and the expert opinion (addressed below) indicate that the radio communications between the security officers from the time of GLA2’s initial broadcast were chaotic. Aspects of the ongoing radio communication considered further below.
Witness evidence 7.736 Noting that there was no direct account provided by GLA2 regarding the specific content of her initial radio message, the evidence available at Inquest centred on the accounts provided by various members of the WBJ management team and security team who were present at WBJ on 13 April 2024 and heard the initial broadcast of GLA2.
7.737 There were certain inconsistencies between that evidence.
7.738 Table 1 below provides a summary of the accounts of GLA2’s initial broadcast drawn from the evidence available at Inquest.
1537 Written submissions of Counsel Assisting at [1569].
1538 Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at row 75.
1539 Exhibit 1, Vol 1, Tab 32A, CCTV Review Timeline (amended) at row 87.
1540 Exhibit 1, Vol 4, Tab 286, Statement of GLA2 at [18]-[21].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Table 1: Summary of accounts of GLA2’s initial broadcast
WITNESS SUMMARY OF ACCOUNT OF GLA2’S INITIAL BROADCAST Joseph Gaerlan Account 1 in his “Pre-Scribe Account of Events” written on 16 April 2024: RM on duty at WBJ on 13 April S to Control, Code Black, Code Black Alpha, there is lots of blood, Code 2024, and Black – we need assistance. There is a man with a knife!”; “Please hurry, assigned to he is running”, another “code black”, “possible fatality, there is lots of perform the role blood. 1541 of Chief Warden on the day Account 2 in his first statement dated 5 August 2024: Whilst I was in the bathroom, I heard a radio broad cast over our centre radio network something along the lines of; “code black” and then “code black alpha” which was repeated at least three times and then broadcast details saying; “there’s someone running through the centre, looks someone’s been injured, there’s a lot of blood, you need to hurry.” The security member who made the broadcast then said the location, but I can’t recall exactly what they said. 1542 Account 3 in his second statement dated 6 March 2025: I do not know what the security call sign was for the person who made the radio call when I was in the bathroom, but it was a female voice. She said to the effect of, "S to control we've got a code black, a code black alpha there’s lots of blood there’s lots of blood, you need to hurry, code black alpha”. I do not now recall hearing a reference to a “man with a knife”, “he is running” or “possible fatality” as noted in the pre-scribe account and think that I may have made that note with the benefit of hindsight during the initial difficult few days after the Incident. I also do not now recall hearing a reference to “there is someone running through the Centre” as referred to in paragraph 14 of the August Statement.1543 In his evidence at Inquest: Mr Gaerlan said, “there is no way” he would have investigated the incident further (including by travelling to the Centre floor) if he had known it was an AAO from the initial radio alert. 1544 1541 Exhibit 1, Vol 32, Tab 1010, Typed notes of Joseph Gaerlan: This was a typed document prepared by Mr Gaerlan on 16 April 2024, transcribing Mr Gaerlan’s handwritten notes (or “scribbles”) written on “any bit of paper that was available” during the incident on 13 April 2024, which could not be located for the inquest. Mr Gaerlan described the document was prepared by direction to document in a formal way what he recalled from the incident. Mr Gaerlan gave evidence that he was “probably still high on adrenaline” when he drew the document and accepted there were a number of errors in the document (Transcript, D7 (Gaerlan): T473.20-T474.17 (7 May 2025); Exhibit 1, Vol 32, Tab 1010, Typed notes of Joseph Gaerlan at p. 1.
1542 Exhibit 1, Vol 1, Tab 996, Statement of Joseph Gaerlan at [14].
1543 Exhibit 1, Vol 45, Tab 1600D, Supplementary statement of Joeseph Gaerlan at [28].
1544 Transcript, D7 (Gaerlan): T486.43-46 (7 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 WITNESS SUMMARY OF ACCOUNT OF GLA2’S INITIAL BROADCAST Rahim Zaidi Account 1 in his first statement dated 7 February 2025: RSS on duty on 13 Shortly after 3:30pm my radio was sitting on my desk immediately next to April 2024 my left hand. It was on loudspeaker. My recollection of that radio call was that it said to the effect of, "emergency on Level 4 zone B". It was not very clear and I could not hear the call sign of the person who made the call…The voice was very panicked and we did not know who it was. 1545 Account 2 in his supplementary statement dated 5 May 2025: I do not recall receiving any radio communications about the location of Mr Cauchi prior to him being shot by NSW Police other than the radio communication referred to in paragraph [43] of my First Statement [as outlined above], although it is possible that other radio communications were made. 1546 Jerry Helg Account 1 in his first statement dated 13 April 2024: Security "Code Blue Alfa [sic]". This means medical attention urgently requested.
Supervisor on duty The radio called for attention at Level 4 Zone B which [is] next to Cafe on 13 April 2024 Sourdough and Cotton On store. 1547 Account 2 in his supplementary statement dated 7 February 2025: In paragraph 4 [of my first statement], I also refer to a radio call. I do not now have a specific recollection of the words "Code Blue Alfa [sic]" or that the radio call referred to the location of Level 4 zone B. Later in the day, but before the police took the April Statement, one or more of the security officers had said to me that a Code Blue alpha had been called and I remember thinking at the time I did not hear that. However, there was so much going on at the time. That comment (of the Code Blue Alpha) was in my head at the time I spoke to the police. At the time of making this statement what I do remember is that the radio call was from [GLA2]. I recall that [GLA2] was screaming. I recall that [GLA2] said to the effect of "Help, Help, we need help down here. Someone's down. Someone's bleeding". At this time I was not aware of any active armed offender. I knew that [GLA2] was assigned to Level 5, Zone B as I had seen the run sheet in the morning, and so was aware that the emergency was occurring in that location. 1548 1545 Exhibit 1, Vol 42, Tab 1597, Statement of Rahim Zaidi at [31], [33].
1546 Exhibit 1, Vol 42, Tab 1597A, Supplementary Statement of Rahim Zaidi at [30].
1547 Exhibit 1, Vol 4, Tab 283, Statement of Jerry Helg at [4].
1548 Exhibit 1, Vol 42, Tab 1598, Second Statement of Jerry Helg at [36].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 WITNESS SUMMARY OF ACCOUNT OF GLA2’S INITIAL BROADCAST In oral evidence on 8 May 2025, Mr Helg gave the following account: I do hear a lot of screaming. I heard [GLA2] screaming for help, that there was someone on the ground, someone bleeding. My initial thought was someone either had a cardiac arrest and they've hit their head on the ground and maybe they're bleeding, but I couldn't be sure to what I was hearing. 1549 Mr Helg gave oral evidence that he would not have gone to investigate if he had been aware the incident involved a person with a knife attacking people or an AAO. If he had been aware of those matters, Mr Helg gave evidence he would have attended the CCTV Control Room.1550 CR2 Account 1 in his first statement dated 31 July 2024: Control Room …"armed intruder onsite, Alpha, Alpha, Code black". I do not know who Operator at WBJ made the radio broadcast, but I understand alpha, alpha, code black to on 13 April 2024 mean there is a physical altercation and someone has been stabbed. 1551 Account 2 in his supplementary statement dated 27 February 2025: The call on the radio referred to in paragraph 10 of my July Statement was a female voice and my recollection is that she used the word "offender" rather than "intruder".1552 Other Accounts 7.739 In addition to the accounts outlined in Table 1, there are various other accounts from security personnel in the brief of evidence regarding the content of the radio alert.1553 Including:
(a) Muhammad Taha states that he heard a radio message containing “Code Black”.1554
(b) Tretch Moses states that he heard, “Code Black, [L]evel 4” followed seconds later by “[t]here’s a man with a knife! People are running!”1555 1549 Transcript, D8 (Helg): T579.31-34 (8 May 2025).
1550 Transcript, D8 (Helg): T581.42-T582.7 (8 May 2025).
1551 Exhibit 1, Vol 4, Tab 293, Statement of CR2 at [10].
1552 Exhibit 1, Vol 45, Tab 1600C, Supplementary Statement of CR2 at [32].
1553 Exhibit 1, Vol 4, Tab 290, Statement of Usman Khokhar at [4]; Exhibit 1, Vol 4, Tab 287, Statement of Bulbul Chowdhury at [5]; Exhibit 1, Vol 42, Tab 1594, Statement of Tyson Rogers at [14].
1554 Exhibit 1, Vol 1, Tab 54, Statement of Muhammad Taha at [18].
1555 Exhibit 1, Vol 4, Tab 284, Statement of Tretch Moses at [5].
(c) Cane Nikolovski states he heard “[it’s] bad, please security” followed by “[m]an bleeding, please, this no good”.1556
(d) Qasim Shah states that he heard “Code black, code black” followed by “[e]mergency, emergency.”1557
(e) Md Nurul Hoda states he heard there was an emergency on Level 4 in building
(f) Muhammad Fahad states he heard “[e]mergency, emergency … someone was stabbing people with a knife.”1559
(g) Irshadunnisa Dharwarkar states she heard GLA2 say to Control “one person is stabbing people and running, stabbing people and running.”1560 Other evidence relevant to the content of GLA2’s initial broadcast 7.740 In relation to GLA2’s initial broadcast, Mr Goldberg stated in oral evidence that the radio alert provided by GLA2 did not sufficiently convey information regarding the AAO incident.1561 Expert evidence 7.741 As outlined above, Mr Wilson stated that the “golden rules of good radio communication are clarity, simplicity, brevity and security.”1562 He considered that those golden rules were not adhered to on 13 April 2024.1563 7.742 Mr Wilson acknowledged that GLA2’s first communication was “very prompt,” noting that the message was delivered to other Scentre personnel prior to the attack on security guards Faraz and Mr Taha, and would therefore have been around one minute after the attack commenced. 1564 7.743 Nevertheless, Mr Wilson identified some deficiencies with respect to the initial broadcast of GLA2 that were accepted by Scentre and Glad and were accordingly not in dispute. These were:
(a) There were failings in the clarity of GLA2’s initial reporting of the incident. In the event of an AAO incident, clear and concise information is critical, including 1556 Exhibit 1, Vol 4, Tab 285, Statement of Cane Nikolovski at [5]-[7].
1557 Exhibit 1, Vol 4, Tab 288, Statement of Qasim Shah at [6].
1558 Exhibit 1, Vol 4, Tab 289, Statement of Md Nurul Hoda at [4].
1559 Exhibit 1, Vol 4, Tab 292, Statement of Mohammad Fahad at [8].
1560 Exhibit 1, Vol 4, Tab 296, Statement of Irshadunnisa Dharwarkar at [6].
1561 Transcript, D9 (Goldberg): T766:31-43 (9 May 2025).
1562 Exhibit 1, Expert Volume, Tab 20, Expert Report of Scott Wilson at [6.3.6].
1563 Transcript, D14 (Wilson): T1220.50-T1221.2 (19 May 2025).
1564 Exhibit 1, Expert Volume, Tab 20, Expert Report of Scott Wilson at [6.3.1].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 details of the location, the direction, the weapon, and the actions of the offender;1565 and
(b) Had there been greater clarity in the messaging from GLA2 at around 3:33:33pm, there would have been a faster response to the emergency by Scentre and Glad staff (that is, the unclear alert delayed an AAO-specific response).1566 7.744 Mr Wilson’s evidence of what the first radio alert ideally would have been: … "Keep radio channels clear. Level 4, there's a man stabbing people. Emergency assistance required." So where it is, what's happening and what you want, that, that's the three messages you need to deliver as quickly as possible. So there's a man shooting people or a man stabbing people - what's the activity that's taking place, where it's taking place, and what you want to get out of that.1567 7.745 Both Mr Yates and Mr Iloski accepted the evidence of Mr Wilson that (a) there were failings in the clarity of GLA2’s initial reporting of the incident,1568 and (b) that had there been greater clarity in the initial broadcast, there would have been a faster response to the emergency by Scentre and Glad staff. 1569 7.746 The steps taken by other Scentre personnel in response to GLA2’s initial alert are considered further below.
Submissions 7.747 The parties made detailed and extensive submissions on the issue of the content of the initial broadcast by GLA2, and this is considered further below.
7.748 Those submissions centred around whether a finding could made as to the content of GLA2’s first radio broadcast.
Written submissions 7.749 Counsel Assisting submitted that, noting that GLA2 could not explain her account of the initial broadcast, it is not possible to ascertain what was said by GLA2. 1570 It would be ultimately unhelpful speculation to attempt to do so. 1571 7.750 It was submitted by Counsel Assisting that it is apparent that the initial radio alert made by GLA2 was insufficient as it did not readily convey crucial information, including:1572 1565 Transcript, D15 (Yates): T1309.1-26 (20 May 2025); Transcript, D18 (Iloski): T1653.23-36 (26 May 2025).
1566 Exhibit 1, Vol 41, Tab 1599A, Supplementary Statement of John Yates (Director of Security) at [19]; Transcript, D18 (Iloski): T1653.23-36 (26 May 2025).
1567 Transcript, D14 (Wilson) :T1219.23-28 (19 May 2025).
1568 Transcript, D15 (Yates): T1309.1-26 (20 May 2025); Transcript, D18 (Iloski): T1653.23-36 (26 May 2025).
1569 Exhibit 1, Vol 41, Tab 1599A, Supplementary Statement of John Yates (Director of Security) at [19]; Transcript, D18 (Iloski): T1653.23-36 (26 May 2025).
1570 Written submissions of Counsel Assisting at [1567].
1571 Written submissions of Counsel Assisting at [1567].
1572 Written submissions of Counsel Assisting at [1568].
(a) The location of the incident; and
(b) The nature of the threat.
7.751 Counsel for the Tahir family submitted that I should make a finding as to the content of the first radio alert, accepting that a finding regarding the actual words could not be made. With regard to the evidence before the Court and the fact-finding function of the coronial process, Counsel submitted there was no obstacle in making findings about what GLA2 said.1573 7.752 It was submitted on behalf of the family of Faraz Tahir that determining the content of the first radio message involves synthesising the different messages (which are set out primarily in Table 1 and [7.739] above), and taking into account the evidence of the circumstances under which the message was heard, and what witnesses said about their recollections of the message.1574 7.753 In summation, Counsel for the Tahir family submitted that the first message included, at minimum, the following:1575
(a) “Code black, code black alpha” said a number of times (two to three times);
(b) Some way of describing an emergency;
(c) There was mention of blood or people bleeding; and
(d) There was a man with a knife.
7.754 In addition to words to the effect of “Code Black Alpha” being repeated two or three times, Counsel submitted GLA2 may also have said words to the effect of “Level 4 Zone
B”.1576 7.755 Counsel for Scentre agreed with Counsel Assisting that GLA2 was speaking into the radio at 3:33:33pm,1577 and that it is not possible to ascertain what was said by GLA2 in her broadcasts on 13 April 2024, nor desirable where she did not give evidence.1578 7.756 Contrary to submissions made for the Tahir family, Counsel for Scentre submitted: A suggestion by one party to the effect that an absence of evidence of a fact leaves at large the findings that may be made of that fact is unsound. Plainly, findings in this respect may only be made upon evidence of what was said and when it was said and, 1573 Written submissions on behalf of the Tahir Family at [52]-[54].
1574 Written submissions on behalf of the Tahir Family at [55]-[60].
1575 Written submissions on behalf of the Tahir Family at [57], [63].
1576 Written submissions on behalf of the Tahir Family at [57].
1577 Written submissions for Scentre Group at [182].
1578 Written submissions on behalf of Scentre Group at [183].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 where evidence conflicts, an evaluative exercise must be undertaken to determine what, if anything, may be found to the requisite standard.1579 7.757 Concerning the first radio broadcast, it was submitted on behalf of Scentre that:1580
(a) 13 security staff or management staff heard one or more radio calls by GLA2 (or a female security officer), and their evidence followed a highly stressful and compacted event consequently, the witnesses understandably have different recollections of the broadcast(s) and of the sequence and timing;
(b) CCTV footage shows that GLA2 made a number of subsequent radio calls after her initial broadcast at 3:33:33pm, including at 3:33:45pm and 3:34:25pm,1581 with potentially more not captured in the evidence;
(c) The most consistently reported content of what was broadcast by GLA2 was that she called “code black” and/or “code black alpha”. Seven of the 13 accounts from security or Scentre management staff refer to having heard one or both of the expressions “code black” and “code black alpha”; however, those seven accounts vary as to timing or sequencing of that broadcast;1582 and
(d) Four of the 13 accounts refer to having heard “emergency”, attributable to GLA2; however, they are again inconsistent as to whether this was in the first or a subsequent broadcast. 1583 7.758 Counsel submitted that GLA2 more probably than not broadcast “code black” or “code back alpha” within one or more of her radio calls, but there is not sufficient evidence to find that this was part of her initial broadcast.1584 7.759 It was submitted on behalf of Scentre that although it transpired that GLA2 was an employee of a sub-contractor of Falkon, she had received training that surpassed the training of most ad hoc security staff at WBJ, including one-on-one training with Mr Helg on the day of the incident.
7.760 Counsel for Scentre submitted that GLA2 had undertaken training, including additional training to that ordinarily provided to ad hoc guards, consisting of:
(a) CCTV management policy and procedure compliance on 17 September 2023; 1579 Written submissions on behalf of Scentre Group at [183].
1580 Written submissions on behalf of Scentre Group at [184]-[188].
1581 Exhibit 1, Volume 1, Tab 32A, CCTV Review Timeline (amended) at lines 87, 112, 197, 244.
1582 Exhibit 1, Volume 42, Tab 1597, Statement of Rahim Zaidi at [31], [33], [37] (Rahim Zaidi, who heard “code black” subsequently to the first broadcast); Transcript, D7 (Gaerlan): T484.45-485.2 (7 May 2025); Exhibit 1, Volume 30, Tab 996, Statement of Joseph Gaerlan at [14], Exhibit 1, Volume 45, Tab 1600D, Supplementary Statement of Joseph Gaerlan at [27] - [28]; Exhibit 1, Volume 4, Tab 293, Statement of CR2 at [10], Exhibit 1, Volume 45, Tab 1600C, Supplementary Statement of CR2 at [32]; Exhibit1, Volume 1, Tab 54, Statement of Muhammad Taha at [18]; Exhibit 1, Volume 4, Tab 290, Statement of Usman Khokar at [4]; Exhibit 1, Volume 4, Tab 288, Statement of Qasim Shah at [6]; Exhibit 1, Volume 4, Tab 284, Statement of Tretch Moses at [5].
1583 Exhibit 1, Volume 42, Tab 1597, Statement of Rahim Zaidi at [31], [33]; Exhibit 1, Volume 4, Tab 292, Statement of Muhammad Fahad at [8]; Exhibit 1, Volume 4, Tab 289, Statement of Md Nurul Hoda at [4]; Exhibit 1, Volume 4, Tab 288, Statement of Qasim Shah at [6].
1584 Written submissions on behalf of Scentre Group at [187].
(b) Emergency escalation on 26 September 2023;
(c) Having partially completed the security officer induction checklist in September 2023;
(d) Terrorism awareness on 10 October 2023;
(e) Red Book audits;
(f) Legal awareness on 24 October 2023;
(g) First aid and AED locations on 22 November 2023;
(h) Red Book – fire alarm activation on 28 November 2023; and
(i) Conflict management (undated).
7.761 It is submitted on behalf of Scentre that, as can be seen above, a number of the topic areas where GLA2 had undertaken training were relevant to equipping her to respond to an AAO event.
7.762 Counsel for Glad agreed with and adopted the submissions of Counsel for Scentre Group.1585 It was submitted on behalf of Glad that there is no definitive or objective evidence that would permit findings as to the precise words spoken by GLA2 in her initial radio broadcast; however submitted that the evidence reflects the most consistently reported content was “code black” and/or “code black alpha”.1586 7.763 Counsel for Glad submitted that further detail could have been provided, however, it was submitted that no finding could be made that the provision of further information would have altered the outcome, given the dynamic, erratic and fast-moving actions of the offender. Counsel further submitted that the high level of stress GLA2 must have undoubtedly been experiencing at the time of her initial broadcast may explain why some information was not broadcast by her.1587 7.764 It was submitted on behalf of Glad that the Court should be cautious before making any adverse findings against GLA2 where she was not given an opportunity to respond to certain potential criticisms, and that any adverse findings sought against GLA2 could not meet the Briginshaw standard.1588 1585 Written submissions on behalf of Glad Group at [38].
1586 Written submissions on behalf of Glad Group at [48].
1587 Written submissions on behalf of Glad Group at [49].
1588 Written submissions on behalf of Glad Group at [50]citing Briginshaw v Briginshaw (1938) 60 CLR 336 at 361–362.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Oral submissions 7.765 In oral submissions, Counsel Assisting submitted that the suggestion made on behalf of the Tahir family that any reasoning process done by the accumulation or aggregation of various accounts of GLA2’s initial call cannot be adopted by the Court.1589 7.766 It was submitted by Counsel Assisting that the reference in the submission on behalf of the Tahir family that there was a man with a knife stands in the face of objective evidence.
It is submitted that given the fact that Mr Gaerlan and others went to the scene, this suggests that whatever was conveyed in the call was inadequate, as further information was required. That includes the location or the nature of the threat.1590 7.767 In oral submissions, Counsel for Scentre Group, in submissions regarding the Scentre response to the AAO event, states that GLA2’s first alert did not contain sufficient information, and this is reflected in the earlier responses of many security staff at WBJ doing their best to respond and get people to safety on the limited information then known to them.1591 7.768 It was submitted on behalf of Scentre that: Scentre accepts that clear and concise information from security staff of an active armed offender event is critical, and that there were failings in the clarity of GLA2’s first reporting of the attack. If there had been greater clarity in GLA2’s first radio call, this would have facilitated situational awareness and a more rapid implementation of the specific active armed offender red book guidelines. 1592 7.769 Counsel for Scentre reiterated the submission that it is not possible to ascertain what was said by GLA2 in her broadcasts during the response, and that, on the available evidence, the initial broadcast was insufficient. It is submitted that the Court ought not forget that GLA2 was afraid for her life when she made that first radio alert, and her mind stopped working because she thought Mr Cauchi was coming up the escalator to her location on Level 5.1593 7.770 Counsel for the family of Faraz Tahir submitted that what was said in the first security call by GLA2 is an area of disagreement with respect to the submissions of Counsel Assisting on the matter. 1594 7.771 It is submitted on behalf of the family of Faraz Tahir that the content of that first message communicated over security radio by GLA2 is extremely important because it was the point at which the security response commenced. It was submitted that what follows 1589 Transcript, Closing Submissions D1: T1934:44-46 (25 November 2025).
1590 Transcript, Closing Submissions D1: T1934:46-50 (25 November 2025).
1591 Transcript, Closing Submissions D2: T1966.9-12 (28 November 2025).
1592 Transcript, Closing Submissions D2: T1967.18-23 (28 November 2025).
1593 Transcript, Closing Submissions D2: T1967.25-30 (28 November 2025).
1594 Transcript, Closing Submissions D2: T2005.5-6 (28 November 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 from that first point is how the actions of those involved can be assessed and analysed.1595 7.772 Counsel for the family of Faraz Tahir submitted, in response to the submission of Counsel Assisting, that it was “ultimately unhelpful speculation” to attempt to ascertain what GLA2 said, that this submission should not be accepted. 1596 7.773 It is submitted on behalf of the family of Faraz Tahir that GLA2 did not give evidence and, as Counsel Assisting referred to orally, she was appropriately excused on medical grounds. It is submitted that the fact that GLA2 did not give evidence is not an insurmountable obstacle in making findings of fact, and it is noted that others did give evidence and that evidence is before the Court. It is submitted that what is required is the process of fact-finding with which this Court has more experience than any other court. 1597 7.774 It is submitted on behalf of the family of Faraz Tahir that it was self-evident that insufficient information was conveyed from GLA2, and it is submitted that a finding ought to be made and it is desirable that a finding be made for the following reasons:
(a) Counsel Assisting has not explained why, in relation to all of the facts that this Court will make findings about, this one fact, noting the volume of evidence, should be excluded from a finding to be made by this Court. It is submitted that the content for that call was the subject of extensive evidence and submissions;
(b) Having regard to its importance and the significance the contents of the broadcast of GLA2 had in the evidence and in submissions, it is submitted that the Court ought make findings about the contents of the call. 1598 Findings 7.775 I accept the submission of Counsel Assisting and Counsel on behalf of Scentre and Glad that it is not possible for me to make a finding about the content of GLA2’s initial broadcast around 3:33:33pm.
7.776 I have closely considered the submissions made on behalf of the family of Faraz Tahir and their submission seeking a positive finding regarding the content of GLA2’s broadcast.
7.777 Notwithstanding those detailed submissions, ultimately, I cannot make a finding as to what was said, and it would be speculation to do so.
7.778 Whilst my finding is that it is not possible to say what GLA2 said in her initial broadcast, on the available evidence, I am satisfied that the content of the initial broadcast was 1595 Transcript, Closing Submissions D2: T2005.7-11 (28 November 2025).
1596 Transcript, Closing Submissions D2: T2005.42-46 (28 November 2025).
1597 Transcript, Closing Submissions D2: T2005.48 - T2006.3 (28 November 2025).
1598 Transcript, Closing Submissions D2: T2006.38 -T 2007.3 (28 November 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 insufficient in terms of conveying the necessary information to other security personnel that an AAO attack was taking place. This was conceded by Scentre and Glad.
7.779 Notwithstanding this, I acknowledge that at the time of the initial broadcast, noting her direct observations of Mr Cauchi’s actions, GLA2 would have been fearful for her life.
When did staff in the CCTV Control Room become aware of an
AAO 7.780 As set out above, the first alert made by a member of security staff at WBJ was that of GLA2 at 3:33:33pm. There was insufficient information conveyed in this call to alert security staff at that time that there was an AAO within WBJ.
7.781 Counsel Assisting submit that even if the alert had been sufficient to convey that an AAO was occurring, the CCTV Control Room was, at that time, unattended.
7.782 As set out in the chronology above, at 3:33:33pm, the CCTV Control Room was unoccupied as CR1 had left to use the bathroom. She had not taken her radio with her.
She returned at 3:34:01pm.
7.783 Counsel Assisting submit that it is likely that CR1, in her capacity as CCTV Control Room Operator, became aware of the AAO incident between 3:35:30 to 3:36:46pm, that is between when: a) Mr Zaidi made the initial call of “Blue lights” at 3:35:30pm; b) CR1 first attempted to contact Triple 0 at 3:36:03pm; and c) Mr Zaidi made his second radio call of "code black alpha, someone is on the floor, unconscious, active armed offender, contact blue lights, there are multiple victims" at 3:36:36pm.
7.784 Counsel for Scentre accepts that CR1’s initial absence from the CCTV Control Room resulted in a delay in her response. However, it is submitted that the insufficiency of information in the radio broadcast did not delay actioning emergency response procedures, because the generic response guidelines were enacted immediately in accordance with the Red Book.1599 This is discussed separately below.
Findings 7.785 CR1 attempting to call Triple 0 at 3:36:03pm indicates that it is likely that she understood there was some form of emergency at around that time. It followed a radio broadcast from Mr Zaidi requesting “Blue lights”. This does not, however, indicate that the emergency was, at that time, understood to be an AAO.
1599 Written submissions on behalf of Scentre, [228]-[231].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.786 The nature of the emergency was made clear in Mr Zaidi’s radio call at 3:36:36pm.
Accordingly, CR1 would have understood there was an AAO by 3:36:36pm.
Verification of the AAO 7.787 As set out above, the Red Book provided specific guidance to security staff on the steps that were required to be taken in the event of an AAO.
7.788 The Red Book guidelines provided that security personnel are to “investigate safely” when “the report is not verified” and set out what should be done if an AAO is confirmed.
1600 7.789 It is not disputed that, on 13 April 2024, there was verification of an AAO at 3:36:36pm via the radio broadcast of Mr Zaidi set out in the chronology above. This was around three minutes after the initial radio broadcast by GLA2, which occurred at 3:33:33pm.
7.790 It was the evidence of both Mr Wilson and Mr Yates that there is a need for verification before emergency responses in respect of an AAO are implemented.
7.791 Mr Wilson said: You need some sort of confirmation before you start ringing 000 or pressing CMEO buttons and that confirmation I feel can come in two ways. Either the CCTV [O]perator can visually see what’s happening on the scene. That’s confirmation, so if they can see it live that’s confirmation, or a security operative who works for them rings up saying, “There is a man stabbing people in the centre.” that should be good enough confirmation. 1601 7.792 Mr Yates told the Court: Verification is not taking what - unless you're a trained security guard or a trained member of staff, is not taking what you've been told at face value, because members of the public we know can give - see things and put an interpretation on them that's either not right or whatever it is, in the panic of the moment. So the important thing is to have either visual verification, as in you're on the floor, you see it as we saw with Mr Helg and Mr Zaidi, or you're seeing it on CCTV and you can verify it that way. 1602 Potential issue with a verification process 7.793 Counsel Assisting submits that there is a concern in relation to the need to verify that an AAO is occurring because, depending on how long the verification takes, it may delay the implementation of certain emergency responses.
7.794 Mr Gaerlan, who assumed the role of Chief Warden on 13 April 2024, gave evidence that in the period between the initial radio broadcast and verification of the incident as an 1600 Exhibit 1, Volume 29, Tab 993, Statement of Emily Hunt, Annexure D, Red Book at pp. 325-326.
1601 Transcript, D14 (Wilson): T1235.20-26 (19 May 2025).
1602 Transcript, D15 (Yates): T1314.6-12 (20 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 AAO, he entered onto the Centre floor in order to obtain sufficient information to confirm the nature of the incident that was occurring. That is, he was seeking further information to verify the incident. He said: … I guess it’s, its quite common that … there’s lots of I guess situations that unfold in a centre and it’s quite common as a response to walk towards the scene of what’s taking place and, and often, outside of this particular situation … you are best placed to walk towards the scene and coordinate, whether it be moving customers away or assisting … so my intent of walking into the mall was to understand more of what was happening.1603 7.795 Counsel for Scentre submit that Counsel Assisting’s concern about the effect of any potential delay should be understood in the context of the generic emergency responses provided for in the Red Book. During the period between when an AAO may commence and the time at which it is verified, the generic responses provided for in the Red Book may be being implemented. Counsel for Scentre submit that this is in fact what occurred on 13 April 2024. Counsel for Scentre submit that this is in fact what occurred on 13 April 2024.
7.796 The generic response guidelines include components such as conducting an initial assessment of the condition/situation and to prioritise assistance to casualties. They further provide that first responders are to arrange appropriate emergency equipment and other resources, and, if required, contact emergency services on Triple 0.1604 7.797 Counsel for Scentre submit that the evidence demonstrates that Scentre staff responded to prioritise assistance to casualties and moved people away from danger, in accordance with the generic response guideline. In evaluating Counsel Assisting’s concern for a potential delay in the implementation of a response, the evidence demonstrates that the implementation of the generic response should be taken into account.
7.798 As discussed above, Counsel for Scentre submit that the evidence supports a finding that GLA2 did not call an AAO in her initial radio broadcast. The evidence supports that she conveyed there was an emergency in her initial broadcast, but not, at that point, the nature of the emergency. There was not sufficient information conveyed in that broadcast to enable verification of an AAO at that time.
7.799 It follows, according to Counsel for Scentre, that there was no delay in the response by staff occasioned by verification but rather, because the initial radio broadcast did not convey that the emergency was an AAO, it was necessary to undertake further investigative steps to ascertain the nature of the emergency that was occurring. This was achieved at 3:36:36pm.
1603 Transcript, D7 (Gaerlan): T488.12-21 (7 May 2025).
1604 Exhibit 1, Volume 29, Tab 993, Statement of Emily Hunt, Annexure D, Red Book at pp. 316-321.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Further submissions 7.800 During oral submissions, Counsel Assisting submitted that Scentre have sought to blunt any criticism in relation to the delay between the initial radio broadcast and the time at which verification of AAO occurred and the AAO Red Book procedures commenced, by seeking to identify and contextualise what occurred during that period as being in accordance with the generic response guideline.1605 7.801 Counsel Assisting submit, however, that an AAO is a highly particular incident which occurs at great rapidity, across a large area, and is unpredictable, and that it is necessary to default to the specific response as soon as possible to save lives. 1606 The generic response guidelines provide for a course of action that could apply to a range of scenarios, whereas the AAO guideline provides for procedures that stress the urgency of disseminating the messaging of the threat posed by an AAO.
7.802 More critically, Counsel Assisting submit that Scentre’s position ignores the fundamental problem that there should not have been a need for verification by any member of the Scentre team because the alert came from a security guard who had personally witnessed the relevant event.1607 7.803 Counsel Assisting submit that this did not occur on 13 April 2024 and that this necessarily compromised the response from other security responders who exposed themselves to potential danger in the pursuit of verifying what was happening. It resulted in a delayed response when there was a critical need for the AAO procedures to be implemented as soon as possible.1608 Findings 7.804 I note that in making my findings regarding this aspect of the evidence, I have once again borne in mind the matters raised by Scentre as outlined in Section A, in particular the application of the generic response guidelines prior to verification of the AAO.
7.805 I accept the expert evidence of Mr Wilson and the evidence of Mr Yates that it is necessary to have some form of verification before AAO procedures are implemented.
7.806 I have earlier found that the content of the initial radio broadcast was insufficient to convey to other members of the security team, including Mr Gaerlan, that the incident the subject of that broadcast was an AAO. The incident was not verified as an AAO until Mr Zaidi’s radio broadcast about three minutes later. At that time, Mr Gaerlan attempted to have the five AAO assignments implemented by security staff.
7.807 Had the initial radio broadcast been of a quality to alert the security staff to an AAO, this itself would have constituted verification, as the information would have come from a 1605 Transcript, Closing Submissions D1: T1928.23-27 (25 November 2025).
1606 Transcript, Closing Submissions D1: T1928.35-38 (25 November 2025).
1607 Transcript, Closing Submissions D1: T1929.6-9 (25 November 2025).
1608 Transcript, Closing Submissions D1: T1929.18-22 (25 November 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 member of the security staff who had witnessed the incident. Accordingly, the approximately three-minute delay that occurred did so as a result of the need to obtain further information to verify the incident as an AAO, which is what Mr Gaerlan was attempting to do when he proceeded out onto the Centre floor.
7.808 In the period between the initial radio broadcast and verification, Scentre staff were responding in accordance with the generic response guidelines.
7.809 I acknowledge that Mr Yates has committed to reviewing and resolving any uncertainty in the Red Book in relation to the terminology of verification and I understand that will, at least in part, clarify that when the initial alert that advises an AAO is occurring is disseminated, and the genesis of the initial alert is the witnessing of an AAO by a member of the security staff (including the CCTV Control Room Operator), there is no need for further investigation by a member of security team before the AAO assignments can be implemented.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 H. The communications as between staff at WBJ and between staff at WBJ and emergency services 7.810 The evidence setting out the relevant communications between staff within WBJ in relation to the AAO, and between WBJ staff and emergency services, is outlined in the above chronology at Section F.
7.811 Having regard to that evidence, and the expert reports of Mr Wilson, two communications-related issues require closer examination. Those issues concern firstly, the difficulties experienced by security staff at WBJ in communicating over the radio, and, secondly, the Triple 0 call made by CR1.
Radio communications generally on 13 April 2024 7.812 In the event of an AAO, clear and concise communication is imperative. This includes the need to convey in as timely a manner as possible matters such as the details of the location, the direction an offender may be moving, the weapon, and other actions of the offender.
7.813 It appears that in the period after GLA2’s alert, there was significant radio traffic, with several staff members attempting to speak over one another.1609 For example, Bulbul Chowdhury stated that “… when the security radio started going and everyone was yelling a major incident had happened”.1610 Usman Khokhar stated that, “I could hear multiple voices on the radio. They were excited voices all talking over the top of one another.”1611 And CR2 said, “I could hear the radio broadcasts stating multiple people had been stabbed.”1612 7.814 As set out above, the radio devices deployed by Scentre only permit one person to speak at a time.1613 7.815 Further, Mr Zaidi described difficulty using the radio to communicate with the CCTV Control Room while he investigated on Level 5 Zone A. Mr Zaidi was able to make a radio call at about 3:34:30pm, but did not hear a response, then up to 3:35:30pm, he was unable to make a broadcast due to the radio traffic.
7.816 Mr Gaerlan gave evidence that the amount of radio traffic at the time of the incident caused difficulty for him to transmit messages.1614 Mr Gaerlan gave evidence that once he was aware of an AAO incident, he was “listening out for radio calling and the first 1609 Exhibit 1, Vol 42, Tab 1598, Second Statement of Jerry Helg at [36]; Exhibit 1, Vol 4, Tab 283, Statement of Jerry Helg at [6]; Exhibit 1, Vol 4, Tab 286, Statement of GLA2 at [11]; Transcript, D7 (Gaerlan): T478.28-31 (7 May 2025).
1610 Exhibit 1, Vol 4, Tab 287, Statement of Bulbul Chowdhury at [5].
1611 Exhibit 1, Vol 4, Tab 290, Statement of Usman Khokhar at [4].
1612 Exhibit 1, Vol 4, Tab 293, Statement of CR2 at [15].
1613 Transcript, D8 (Helg): T585.17-19 (8 May 2025).
1614 Transcript, D7 (Gaerlan): T478.28-31 (7 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 opportunity that I had to, to jump on the radio to make an announcement to control”,1615 which he did at approximately 3:37:03pm.
7.817 When it was put to Mr Yates that Mr Gaerlan could not get answers in response to his questions, he told the Court that “the radio was overwhelmed on the day and it doesn’t, it doesn’t surprise me.”1616 7.818 The expert evidence of Mr Wilson was that the “golden rules of good radio communication are clarity, simplicity, brevity and security”, and that he considered that those golden rules were not adhered to on 13 April 2024. 1617 7.819 Counsel Assisting submit that this poor radio hygiene compounded the issues in the response.
7.820 Counsel for Scentre agreed that the difficulties that arose in respect of the radio communications, and the high traffic volumes, were not an equipment issue as much as an issue with their use. Counsel for Scentre submits that the use of radios during a highpressure incident has subsequently been addressed through enhanced training and policy measures.1618 7.821 The concession made by Scentre is appropriate and I am satisfied that they have adequately addressed the issue.
The Triple 0 call made by CR1 7.822 As set out above, CR1 dialled Triple 0 on the CCTV Control Room landline telephone at 3:36:03pm. This call did not connect. 1619 CR1 attempted to call Triple 0 again at around 3:36:11pm, which connected. 1620 It appears that the call was terminated at 3:42:31pm and that CR1 was on hold for several minutes during that call. 1621 7.823 What was said in this call, in particular the information provided by CR1 to the Triple 0 operator, is a matter that requires further examination.
7.824 The call commences with CR1 stating, “Hi, we’ve got an armed offender in the Bondi Westfields”. CR1 is then asked for the address, which she provides. 1622 7.825 CR1 then states, “Yeah. Yes. And we’ve been um, informed there’s been shots fired.” 1615 Transcript, D7 (Gaerlan): T489.16-18 (7 May 2025).
1616 Transcript, D15 (Yates): T1319.24-28 (20 May 2025).
1617 Transcript, D14 (Wilson): T1220.50-T1221.2 (19 May 2025).
1618 Written submissions on behalf of Scentre at [105].
1619 Exhibit 1, Vol 31, Tab 1002, Call log re Westfield Bondi Junction’s landline numbers on 13 April 2024; Electronic Item 66H, CCTV Compilation Clip – CR1.
1620 Exhibit 1, Vol 31, Tab 1002, Call log re Westfield Bondi Junction’s landline numbers on 13 April 2024; Electronic Item 66H, CCTV Compilation Clip – CR1.
1621 Exhibit 1, Volume 42, Tab 1599A, Supplementary Statement of John Yates at [53] - [54].
1622 Exhibit 1, Volume 12, Tab 689A, Transcript of Triple 0 call made by CR1 at p.1.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.826 The following exchange occurred between CR1 and the Operator: Operator: So they’re armed offender and shots fired.
CR1: Yes.
Operator: Now do you know if anyone’s been inured there?
CR1: Um, we’re not aware. We’re just, we’re evacuating the centre as quickly as we can.
Operator: No. So trying to evacuate.
CR1: Yes.
Operator: Do you know where the armed offender is?
CR1: Um, last reports he was on Level 5. O.K. So I was just informed that we’ve got three to four um, injuries of two stabbings.
Operator: O.K. So three to four people injured.
CR1: Yes.
Operator: With two people being stabbed.
CR1: Yes. The police are doing CPR on someone on Level 5.
Operator: O.K. Do you have a description of the armed offender at all?
CR1: No.
Operator: No. So just your name as well?
CR1: My name is [CR1’s first name]. What was the other question you needed sorry?
Operator: Sorry [CR1]. So you’ve got police there do you?
CR1: We do have police on site yes.
Operator: I’ll update them with this call. 1623 7.827 Mr Wilson gave evidence that CR1:
(a) Should have had better information at hand by the time the dispatcher was connected;
(b) Should have provided better information to the dispatcher;
(c) In providing incomplete or vague information, may have exacerbated dangers present at the scene (that is, by not specifying from whom shots had been fired or that there was one suspect apprehended); and 1623 Exhibit 1, Volume 12, Tab 689A, Transcript of Triple 0 call made by CR1 at pp. 1-2.
(d) Should have remained on the call to provide continuous “linkage” with police until a police liaison arrived in the CCTV Control Room. 1624 7.828 Mr Yates, in his oral evidence, stated the call to Triple 0 “wasn’t the best call” and accepted that the clarity of the call could have been better. 1625 Submissions 7.829 Counsel Assisting submitted that the content of the Triple 0 call by CR1 was not, given her role as CCTV Control Room Operator, adequate. Her inability to convey useful information during that call was partly as a result of the fact that she was playing “catchup” following her return to the CCTV Control Room, but also due to the issues previously identified in respect of her competency. It was submitted that Mr Wilson’s evidence as to the deficiencies in the call should be accepted.
7.830 Counsel Assisting submitted that ultimately it cannot be ignored that by the time CR1 connected with the Triple 0 operator, Mr Cauchi was dead and that any failings in terms of the provision of information did not ultimately result in more deaths on the part of Mr Cauchi. However, it very much had the potential to have had an impact upon the balance of the emergency response.
7.831 In written submissions, Counsel for Scentre submit that I should take the following five matters into account in considering the Triple 0 call content. First, the Operator probably had sufficient situational awareness of what had happened at WBJ, as numerous Triple 0 calls had been directed to NSWPF, and by that time, police were on site. Further, the Operator sought to terminate the call - not CR1.
7.832 Secondly, after being placed on hold, CR1 picked up the landline phone and remained with the handset to her ear for around one minute, 30 seconds. There is no evidence of who she spoke with or what she said.
7.833 Thirdly, Mr Wilson’s assessment of the call is significantly undermined by his incorrect timings and exemplifies a lack of rigour brought to his task.
7.834 Fourthly, Mr Wilson made assumptions of what CR1 must have known when she spoke to the operator and these assumptions do not have a sound basis.
7.835 Fifthly, the challenges faced by CR1 were far removed from those facing operators in the Manchester Stadium bombing cited by Mr Wilson.
7.836 Counsel for Scentre submitted that, having regard to the above, the approach to evaluating the content of the call and findings should be tempered.
7.837 In oral submissions, Counsel for Scentre, submitted that Scentre accepts that the phone call by CR1 to Triple 0 should have been made earlier, whether by CR1 or another 1624 Transcript, D14 (Wilson): T1228.29-T1230.25 (19 May 2025).
1625 Transcript, D15 (Yates): T1313.24-36 (20 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 officer, and that the standard of information expected to be provided should generally be better than information provided by members of the public.1626 Findings 7.838 The phone call made by CR1 to Triple 0 was below the standard of what might be expected of a person in the position of CCTV Control Room Operator. As Scentre appropriately conceded, with respect to the information conveyed to Triple 0, it should generally be better than information provided by members of the general public. I acknowledge, however, that the extremely stressful circumstances in which this call was made.
Proposed recommendation by Glad 7.839 In the context of the length of time for which CR1 was on hold during her call to Triple 0, Glad proposed a further recommendation that a dedicated priority landline into the NSW Emergency Dispatch Services Authority could be created to save valuable time in the event of a further AAP at WBJ.
7.840 Evidence in relation to the viability of a priority landline from WBJ to the NSW Emergency Dispatch Services Authority was not received in this Inquest and, accordingly, I am not in a position to make the recommendation proposed by Glad. I note that this is a matter that Scentre may wish to independently assess and explore.
1626 Transcript, Closing Submissions D2:T1968.45-T1969.4 (28 November 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 I. The response of certain security staff at WBJ to the AAO 7.841 The actions of relevant security guards and Scentre Management Staff to the AAO on 13 April 2024 are comprehensively set out in the chronology above.
7.842 Two issues emerge, however, that require further examination. The first relates to the actions of Mr Gaerlan, and the second relates to the actions of CR1. As set out in the above chronology, the evidence in relation to Mr Gaerlan’s actions from when he first heard the initial radio broadcast is as follows.
Joseph Gaerlan 7.843 At 3:33:33pm, the time of the initial radio broadcast by GLA2, Mr Gaerlan was in the bathroom located outside the CMO. He ran back to the CMO, collected his coat, and then took the elevator from Level 13 to Level 6. 1627 7.844 Mr Gaerlan was then on Level 5, Zone A when Mr Zaidi made the radio alert at 3:36:36pm, verifying the AAO.1628 He was on the Centre floor at the time he made the Chief Warden broadcast over the radio at 3:37:02pm. 1629 He then moved towards the escalators on Level 6 (at the eastern end of Zone A).1630 Between 3:37:13pm and 3:39:54pm, Mr Gaerlan travelled from the Centre floor, to the CMO on Level 13, to Level P4 and through the carpark and security corridor. He arrived in the CCTV Control Room at 3:40:01pm.1631 7.845 Counsel for the Tahir family have made submissions in relation to the actions of Mr Gaerlan. They are as follows:
(a) The initial radio broadcast by GLA2 was more than sufficient to indicate to Mr Gaerlan that he needed to immediately get to the Control Room to undertake his role as Chief Warden, and that he made a mistake in going to the scene to try and verify the incident for himself. 1632
(b) That GLA2’s radio alert clearly indicated there was an emergency, and once Mr Gaerlan was aware of that emergency, and once he was aware of that emergency he should have commenced his role as Chief Warden, gone straight to the Control Room and implemented the procedures in the Red Book. Mr Gaerlan made an error in going to the scene to verify what was happening rather than commencing his role a Chief Warden.1633 1627 Exhibit 1, Volume 1, Tab 32A, CCTV Review Timeline (amended) at pp. 13, 15, 17.
1628 Exhibit 1, Volume 1, Tab 32A, CCTV Review Timeline (amended) at p. 23. See also, Exhibit 1, Volume 45, Supplementary statement of Joseph Gaerlan at p. 6.
1629 Exhibit 1, Volume 1, Tab 32A, CCTV Review Timeline (amended) at p. 25. See also, Exhibit 1, Volume 45, Supplementary statement of Joseph Gaerlan at p.6.
1630 Exhibit 1, Volume 1, Tab 32A, CCTV Review Timeline (amended) at p. 26.
1631 Exhibit 1, Volume 1, Tab 32A, CCTV Review Timeline (amended) at pp. 26, 33, 34.
1632 Written submissions on behalf of the Tahir Family at [64]-[68].
1633 Transcript, Closing Submissions D2:T2005.34-40 (28 November 2025).
(c) That when Mr Gaerlan was on the Centre floor, at the bottom of the escalators on Level 5, he should have told members of the public what was happening.
Specifically, he should have advised and informed Eckersley’s to close their shop.
(d) That as the Chief Warden, Mr Gaerlan needed to provide important information to police.1634 7.846 Counsel for Scentre submit that, first, it is not necessary for the Chief Warden to be located in the Control Room to exercise command and control.1635 Secondly, it is not accepted by Scentre that the initial radio broadcast was sufficient and did not require verification.1636 In the absence of verification of the specific nature of the incident, the generic response, which was to attempt to obtain situation awareness, was the correct procedure. This was demonstrated by Mr Gaerlan proceeding to the floor of the Centre.
1637 7.847 In relation to whether Mr Gaerlan should have informed members of the public, including those at Eckersley’s, what was happening, Counsel for Scentre submits that Mr Gaerlan was focused on enacting the key assignments in the AAO guideline and could not afford to be slowed down. Counsel further submits that this submission is not supported by the evidence of Mr Wilson, who said “I can’t be critical of him in any way of him not giving direction … he needs to get himself into a command position … so the best place for [him] to get was to a [C]ontrol [R]oom where he could get some sort of eyes on and some sort of situational awareness.” 1638 7.848 Finally, Counsel for Scentre submits that the Red Book does not envision that it is the Chief Warden who calls Triple 0, and Mr Gaerlan was aware that Mr Zaidi was coordinating with police. Further, while Mr Gaerlan was present in the Control Room, he was not himself reviewing the CCTV to determine the number of offenders.1639 Findings 7.849 As set out above I do not accept that the initial broadcast by GLA2 was sufficient to identify the nature of the emergency as an AAO. Mr Gaerlan entered onto the shopping centre floor in an attempt to verify the nature of the incident as a result of that not being clear. I am not critical of him, in the circumstances, for taking that step.
7.850 In relation to the submission that Mr Gaerlan should have advised members of the public, including those at Eckersley’s, about what was happening I am not critical of him for not doing so. As Mr Wilson said, at that time Mr Gaerlan needed to get to the CCTV 1634 Written submissions on behalf of the Tahir Family at [85]-[86].
1635 Written submissions on behalf of Scentre at [233].
1636 Written submissions on behalf of Scentre at [235].
1637 Written submissions on behalf of Scentre at [46].
1638 Transcript, D14 (Wilson): T1232.43-49 (19 May 2025).
1639 Written submissions on behalf of Scentre at [235].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Control Room to establish command and control and the CCTV Control Room was where he had the best opportunity to gain further situational awareness.
7.851 In relation Mr Gaerlan’s communications with NSWPF, I accept the submission that it is not necessarily the Chief Warden who is required to contact Triple 0 and that Mr Gaerlan was aware Mr Zaidi was coordinating with NSWPF. There is no criticism of Mr Gaerlan in relation to this issue.
CR1 7.852 CR1 was the sole CCTV Control Room Operator on duty in the CCTV Control Room on 13 April 2024. At 3:33:33pm, the time of GLA2’s initial radio broadcast, the CCTV Control Room was unoccupied as CR1 had left to use the bathroom. She had not taken her radio with her. She returned at 3:34:01pm.
7.853 Her actions on her return to the CCTV Control Room are set out in the chronology above.
7.854 Mr Wilson gave evidence that, first, the fact that the CCTV Control Room was not occupied at the time of the incident was a lost opportunity to immediately start to review the CCTV footage.1640 This adversely impacted the timeliness of the response.
7.855 Secondly, that during core hours, there should always be an appropriately trained security officer in the CCTV Control Room with access to the security systems.1641 7.856 Thirdly, that the CCTV Control Room Operator plays a critical role in establishing situational awareness during an emergency.
7.857 Mr Wilson’s evidence in relation to these three matters was accepted by Mr Yates and Mr Iloski.1642 7.858 Further, Mr Yates agreed that a CCTV Control Room Operator must discharge their duty with a high degree of competence to obtain immediate situational awareness during an AAO incident.1643 Mr Yates agreed that the CCTV Control Room Operator has a key role in supporting the Chief Warden in an emergency response,1644 including by providing situational awareness and to manage radio communication in a pressured environment.1645 7.859 Assessing CR1’s ability to obtain situational awareness using the CCTV, Mr Wilson compared her performance to that of CR2 who was able to quickly locate Mr Cauchi 1640Transcript, D14 (Wilson): T1204.43-46 (19 May 2025).
1641Transcript, D14 (Wilson): T1204.36-41 (19 May 2025).
1642 Transcript, D15 (Yates): T1303.45-T1304.15, T1305.41-44 (20 May 2025); Transcript, D18 (Iloski): T1652.50-T1653.21 (26 May 2025).
1643 Transcript, D15 (Yates): T1305:30-33 (20 May 2025).
1644 Transcript, D15 (Yates), T1305:34-39 (20 May 2025).
1645 Transcript, D15 (Yates): T1319:24-33, T1305:34-39, T1305:41-44 (20 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 upon his attendance in the CCTV Control Room on 13 April 2023. CR2’s ability to do this demonstrated what a competent CCTV Control Room Operator could do in an emergency situation. 1646 Mr Wilson also noted that CR1 “had to be constantly reminded to carry out basic actions”. 1647 7.860 Mr Wilson expressed the view that had a CCTV Control Room Operator with the experience and competence of CR2 been in the CCTV Control Room from the outset, there could have been a different reaction from the CCTV Control Room Operator and therefore a “different outcome” although, the outcome would not be “completely different”. 1648 7.861 Mr Wilson concluded in relation to CR1: [S]he couldn’t … step up under pressure, because we could she couldn’t step up under pressure, it’s evidenced in so many ways. 1649 7.862 Mr Yates considered that CR2 was assisted by radio information from Mr Rogers regarding Mr Cauchi’s location, such that the comparison was unfair. 1650 7.863 Mr Gaerlan gave evidence that upon entering the CCTV Control Room, he was CR1 words to the effect of “[w]hat [do] we know?” and not receiving answers. He said: I remember being immensely frustrated, being my key focus was to, to understand what was happening. I hadn’t known any, any information other than the last call, as I mentioned that Rahim had called through. And it was frustrating for me, because without that information, I, I wouldn’t be able to continue to do what’s expected of myself. 1651 7.864 I have already made findings in relation the Triple 0 call made by CR1.
Submissions 7.865 Counsel Assisting submitted that there is no dispute that the absence of CR1 at the time of the initial attack and the content of GLA2’s alert impacted on the timeliness of the response that followed. Counsel Assisting submit that coupled with CR1’s known issues (about which I have already made findings above in Section E), it meant she was unable to discharge the important role that CCTV Control Operators play in responding to incidents, particularly with respect to developing situational awareness and knowledge.
1646 Exhibit 1, Expert Volume, Tab 21A, Supplementary Report of Scott Wilson at [10]; Transcript, D14 (Wilson):T1237.30-42 (19 May 2025). See also, Transcript, D14 (Wilson): T1226.47-T1227.7 (19 May 2025).
1647 Exhibit 1, Expert Volume, Tab 21A, Supplementary Report of Scott Wilson at [3].
1648 Transcript, D14 (Wilson): T1289.31-43 (19 May 2025) 1649 Transcript, D14 (Wilson): T1286.33-34 (19 May 2025).
1650 Transcript, D15 (Yates): T1317.28-44 (20 May 2025).
1651 Transcript, D7 (Gaerlan): T498.22-26 (7 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.866 Counsel Assisting submit that it was agreed that the impact of these lost opportunities was unquantifiable.
7.867 In relation to Mr Gaerlan’s evidence, Counsel Assisting submit that, whilst it is understandable that people will respond differently when placed under pressure, given the important role of the CCTV Control Room Operator, this was but another reason why she should not have been left unsupervised in the CCTV Control Room on 13 April 2024.
7.868 Counsel for Scentre accept that CR1’s initial absence from the CCTV Control Room affected the timeliness of the response; however, this does not show that she was unable to discharge the important role that CCTV Control Room Operators play in responding to incidents, particularly with respect to developing situational awareness and knowledge.
7.869 The submissions of Counsel for Scentre on this issue are lengthy, and I have read them carefully. I have summarised them as follows:
(a) CR1 can be seen to pull up the cameras at Zara twice after receiving calls from Mr Nikolovski, and each time did so within seconds. This illustrates the necessity for guards to relay information to the CCTV Operator before the Operator can commence locating the offender. Similar behaviour occurred in response to a call from Mr Rogers.
(b) CR2 said that CR1 told him correctly, soon after entering the CCTV Control Room, that the incident had started on Level 4, indicating she was gaining situational awareness despite not having heard the initial radio broadcast. The gaining of situational awareness is an inherently cumulative process.
(c) Ms Fatima gave evidence that the most important task for a CCTV Control Room Operator when responding to an incident that involves locating a person is to prioritise identifying their position in the Centre on CCTV before attending to related tasks. However, opening the CCTV to the precise location of the person cannot occur without this information having being communicated to the operator.
(d) There is no evidence to contradict Mr Yates’ experience of the time it can take for a Control Room Operator to track a person from a location (even if a location is known to the Operator). Mr Yates relayed his experience of observing CR2, that in a routine scenario, it took over two minutes, 45 seconds to track three females, whose appearance was known to him, from the start point of Rebel Sport.
(e) Under the Red Book protocols, the Chief Warden previously had to authorise activation of the CMEO. Mr Wilson’s criticism of CR1 for not pressing it at an earlier point in time does not acknowledge this.
(f) Mr Wilson gave extraordinary evidence suggesting it would have been preferable to expel CR1 from the CCTV Control Room midway through the incident when CR2 entered while she was undertaking tasks. This evidence was based on an inaccurate premise that CR1 was not responding at all appropriately to the incident. The distraction and loss of capacity that would have been caused is selfevident.
(g) Mr Wilson’s complaint that CR1 did not perform her task adequately because she did not multitask is contradicted by the objective CCTV evidence.
(h) Mr Yates pointed out that the reason the Red Book states that a second Operator should go to the CCTV Control Room is because the circumstances of an AAO are “really, really difficult”. The extremely difficult circumstances that confronted CR1 on 13 April 2024 exemplify why the Red Book calls for a second Operator. On 13 April 2024, there was more than one person in the CCTV Control Room at least 70% of the time, and there are now two Operators present at all times during core trading hours on a trial basis.
(i) Mr Wilson said that as a CCTV Control Room Operator, “you need to know your full responsibility is to ring 000, CMEO, PA announcements and EWIS and then wait for the Chief Warden to take over”. Later he changed this sequencing and added tracking the offender.
7.870 In light of the above, it is submitted that Mr Wilson’s evidence that CR1 was not competent on 13 April 2024 should not be accepted. The submission that she was unable to discharge her important role in responding to the incident is contradicted by the CCTV footage of the various actions taken by CR1 under the pressure of this unprecedented event.
7.871 In oral submissions, Counsel Assisting addressed the written submissions of Scentre.
The following is submitted:
(a) That the suggested account of what CR1 was doing in the CCTV Control Room after the alert from GLA2 is, in effect, based on opinions or submissions following ‘reviews’ of CCTV footage by persons unknown;1652 and
(b) There are many examples where Scentre seeks to portray CR1 in an unduly positive light, for example, suggesting that CR1 called Triple 0 “of her own initiative” and, in so doing, ignoring that Mr Zaidi had made a call for “blue lights” at 3:35:30pm (before CR1 contacted Triple 0).1653 1652 Transcript, Closing Submissions D2:T1929.34-40 (28 November 2025).
1653 Transcript, Closing Submissions D2:T1972.32-45 (28 November 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.872 Putting these matters to one side, the fact remains that the response in the Control Room on 13 April 2024 demonstrates a lack of sufficient competence on the part of CR1.
She was neither adequately trained nor equipped with the appropriate skills on the day to respond to an AAO, a scenario contemplated by the Red Book and a possibility that CCTV Control Room Operators must be capable of responding to. Counsel Assisting submit that this is demonstrated by the evidence before the Court, including that:
(a) Mr Zaidi had sent CR2 to the Control Room, despite being aware there was already a controller in the CCTV Control Room, as he was “confident in [CR2]'s ability to respond to an emergency, with the Chief Warden's direction”;1654
(b) Mr Zaidi was unable to contact the Control Room after the radio broadcast from
GLA2: I continued to try to call the [C]ontrol [R]oom again to understand what was happening. I tried to radio the [C]ontrol [R]oom a number of times during the incident although I cannot now say how many times. I would have been asking for the [C]ontrol [R]oom to review the CCTV. I do not recall receiving a response from the [C]ontrol [R]oom at this stage.1655
(c) Likewise, Mr Helg attempted to contact the CCTV Control Room and received no response;
(d) CR1 was unable to locate Mr Cauchi and was not aware he had been shot when she spoke to Triple 0 at 3:42pm, nearly four minutes after Mr Cauchi had been neutralised by Insp Scott;
(e) Mr Gaerlan explained that he was frustrated with the information CR1 provided upon his attendance at the CCTV Control Room;
(f) The comparison of the response of CR1 to CR2 in the CCTV Control Room. He immediately took control and, within approximately 90 seconds of entering the CCTV Control Room, was able to locate Mr Cauchi on CCTV; and
(g) As outlined above, Mr Goldberg accepted that CR1 should not have been left in the room alone.
7.873 Counsel Assisting submitted that the evidence of Mr Wilson should be preferred, and it cannot sensibly be accepted that CR1 was competent to be left alone in the CCTV Control Room as at 13 April 2024 or that “she stepped up when under pressure”. 1656 1654 Exhibit 1, Vol 42, Tab 1597, Statement of Rahim Zaidi at [35].
1655 Exhibit 1, Vol 42, Tab 1597, Statement of Rahim Zaidi at [37].
1656 Transcript, Closing Submissions D1:T1930.42-44 (28 November 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.874 In oral submissions, Counsel for Scentre submitted that “for the most part, CR1 adequately discharged her functions as the [C]ontrol [R]oom [O]perator on 13 April 2024, and that her actions that day did not demonstrate incompetence.”1657 It was submitted that many of the criticisms proposed are harsh, and appear to derive from an unduly exacting hindsight analysis.
7.875 In response to the oral submissions of Counsel Assisting as to the timeline drawn by Scentre of the actions taken by CLR1 in the Control Room on 13 April 2024, it was submitted on behalf of Scentre that this timeline is drawn from the detailed analysis of the CCTV footage set out in the third statement of Mr Yates and further analysis conducted by the legal team for Scentre. It was further submitted that, based on his analysis of the CCTV, Mr Yates maintained that Mr Wilson’s criticism of CR1 was very harsh.
7.876 Further, it is clear that the first time Mr Cauchi’s location was accurately called in real time to the Control Room was by Mr Rogers when Mr Cauchi was already on Level 5, very shortly before he was shot.
7.877 Finally, the criticisms of CR1 based on a comparison with CR2 are misplaced as explained fully in the written submissions.
Findings 7.878 The fact that CR1 was not in the CCTV Control Room at the time Mr Cauchi commenced his attacks adversely impacted the timeliness of the response. This was accepted by Mr Yates and Mr Iloski. However, as previously discussed there was no requirement at that time for the CCTV Control Room to be staffed at all times, and it is to be expected that the CCTV Operator will from time-to-time need to depart the Control Room to use the bathroom.
7.879 I accept that it is not entirely fair to criticise CR1’s performance on the day by comparing her actions to those of CR2. CR2 was able to quickly locate Mr Cauchi on the CCTV, however, he did so with the benefit of information which had not been available to CR1.
I accept also that much of the criticism of CR1’s performance on the day is made with the benefit of hindsight.
7.880 Nevertheless, with respect to how CR1 performed on 13 April 2024, there were shortcomings. In this respect I note Scentre’s submission that “for the most part, CR1 adequately discharged her functions as a control room operator on 13 April 2024” (emphasis added).
7.881 I have already made findings in relation to the call to Triple 0 about which concessions were made. Mr Gaerlan gave evidence about his frustration with CR1 and her inability to provide him with information he needed to coordinate the response. Concerns about 1657 Transcript, Closing Submissions D2: T1968.45-48 (28 November 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 CR1 that had previously been identified, for example, that she was “too slow” as noted in the entry in the Minutes on 10 April 2024, and that there were difficulties with her communication, did appear to manifest on 13 April 2024.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 J. The nature and timings of alerts/alarms 7.882 As set out in the chronology in Section F, the evidence establishes that:
(a) The CMEO was activated at approximately 3:39:45pm by CR2 with “EVAC ALL” option selected.
(b) The EWIS system was activated at 3:40:38pm.
(c) PA announcements commenced at 3:51:14pm.
7.883 Each of the above alarms and alerts (which comprise three of the five Red Book AAO assignments) occurred after Mr Cauchi had been shot by Insp Scott.
7.884 In relation to the timing of these events, Mr Wilson gave evidence that:
(a) The CMEO should have been activated immediately after Mr Gaerlan communicated this direction;
(b) The first sounding of the EWIS alarm was too slow, and that, rather than sounding from the Fire Control Room, it could have been activated from the CCTV Control Room; and
(c) The PA announcements could have been made from the CCTV Control Room rather than the Fire Control Room, and they are the best way to inform people of an AAO.
7.885 Each of the above was accepted by Mr Yates and Mr Iloski. 1658 7.886 In addition to this evidence, Mr Wilson opined that whilst there is a specific button on the CMEO to notify for an AAO, it was the Evacuation button (referred to as “EVAC ALL” above) that was pressed.
7.887 Counsel Assisting questioned Mr Yates about the volume of the alarms (on 20 May 2025, T1319:49-T1312:2), as outlined in submissions on behalf of the Tahir Family: Q. You’re aware of the evidence that indicates that the volume of the alarms impeded, in particular, the emergency response communications?
A. I’m aware of that evidence, yes.
1658 Transcript, D15 (Yates): T1311.11-T1311.36, T1311.43-T1312.10, T1312.15-T1312.26 (20 May 2025); Transcript, D18 (Iloski): T1654.3-16 (26 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Q. And it’s right that the wrong alarm was activated in the sense that it should in fact have been under the AAO guidelines the three beep alert followed by a PA announcement, is that right?
A. Yes, yes.
7.888 It was submitted on behalf of Counsel for the Good, Young and Singleton families that Mr Yates acknowledged that the wrong alarm was activated.
Findings 7.889 I accept Mr Wilson’s evidence regarding the timing of the alarms and the alerts outlined above.
7.890 I also accept that the evidence demonstrates that the wrong button was pressed on the CMEO on 13 April 2024. This was accepted and acknowledged by Mr Yates.
7.891 The consequence of the pressing of the incorrect button on the CMEO was that the wrong alarm was activated, namely an alarm designed to accompany an evacuation of WBJ, as opposed to an AAO event. That alarm, and its impact on first responders, is considered elsewhere in these findings.
7.892 The evidence regarding the nature and timings of alerts on 13 April 2024 has given rise to the question of whether the AAO alerts could have been deployed earlier, and, if so, whether that may have resulted in a different outcome for any of the victims.
Evidence on the issue of a possible different outcome for the deceased victims 7.893 It was accepted by Counsel Assisting and all the parties that the earliest possible time at which there could have been identification that an AAO was occurring was the time of GLA2’s initial radio broadcast.
7.894 GLA2 made her radio broadcast at 3:33:33pm, and Pikria, the last victim to have passed away, was stabbed at 3:34:50pm. Accordingly, for the AAO alerts to have possibly altered the outcome for Pikria (in accordance with the procedure outlined in the Red Book), those alerts would have needed to have been activated within that 77 second window.
7.895 If there was no possible alternative outcome possible for Pikria there would necessarily be no possible alternative outcome for any other of the deceased victims. No party has suggested a greater window of opportunity existed for a possibly alternative outcome.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Fulcrum Report 7.896 Fulcrum Risk Services (Fulcrum) is an independent Australian consulting company focused exclusively on business continuity, crisis management and emergency management services.
7.897 Prior to the events of 13 April 2024, Fulcrum had provided training services at WBJ, including preparing and conducting exercises pertaining to emergency responses.
7.898 Fulcrum was also engaged following the events of 13 April 2024 to complete a comprehensive review of the Scentre emergency plans, which I will refer to further in Section K.
7.899 Grahame White, a Senior Consultant with Fulcrum, was engaged by Scentre and provided a report dated 28 April 2025 (the Fulcrum Report) regarding the “optimal and most timely communications and steps to be taken by [Scentre staff] and their contracted security guards… to respond to the [AAO attack that occurred on 13 April 2024].” 1659 The communications and steps were comprised of: notification to NSWPF and NSWA; activation of the appropriate alerts; and appropriate PA announcements.
7.900 Mr White is a former police officer who performed a variety of roles in the NSWPF between 1979 and 2004. Between 1993 and 2004, he trained as a National Counter Terrorism Negotiator and Negotiation Team Leader under the auspices of the Standing Advisory Committee on Commonwealth/State Cooperation for Protection Against Violence (SACCPAV) where he completed several national courses and participated in six National Counter Terrorism Exercises. 1660 7.901 Since 2004, Mr White has been employed by Fulcrum as part of a team providing emergency management training to locations, including Retail Shopping Centres, and during that time, he estimates that he would have conducted Emergency Management Training Workshops to between 40 and 60 retail shopping centres per year.
7.902 The purpose of obtaining the Fulcrum Report was to enable Scentre to investigate what was the time period in which the most efficient of Operators could have activated the CMEO and commenced PA announcements in WBJ. This was conducted utilising the systems that existed at the time, and without regard to issues and delay that would otherwise normally be expected to arise from impaired human responses under the stress of a life threatening AAO attack.1661 7.903 In addition to the written report, there was a video produced by Fulcrum (the Fulcrum enactment video) which involved a recorded enactment of a script prepared by Mr White being read out, which, subject to several assumptions, detailed the “optimal and 1659 Exhibit 1, Vol 33, Tab 1052A, Report of Fulcrum Risk Services at p.1.
1660 Exhibit 1, Vol 33, Tab 1052A, Report of Fulcrum Risk Services at pp. 23-24.
1661 Written submissions on behalf of Scentre at [283].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 most timely chronological communications and steps to be implemented after notification of an [AAO] event.” 1662 7.904 The reading of the script was recorded and timed several times by Mr White, including “in each stage of the Script [his] opinion of appropriate timings that provide a sense of pace/cadence when making the recording of the Script.” 1663 7.905 Scentre are the only party in this Inquest to have engaged an expert to test the timing of the most optimal scenario for the activation of the AAO alerts/announcements.
7.906 Testing undertaken for the purposes of the Fulcrum Report produced two possible timeframes (between the initial radio broadcast and the completion of the first PA announcement).
(a) 2 minutes and 21 seconds: where Mr White read the script he prepared (with the CMEO activated at 1 minute and 41 seconds); and
(b) 2 minutes and 32 seconds: a Scentre reenactment of Mr White’s script including physical activation of all alerts and tones and commencement of PA announcements (with the CMEO activated at 1 minute and 45 seconds). 1664 Evidence of Mr Wilson 7.907 Mr Wilson did not do any formal testing of any scenarios, but in oral evidence he opined that “[y]ou could probably do it in 1 minute and 32 seconds if you’d used a generic PA message [because] you’re only pressing a button”. 1665 I note that there were no prerecorded PA announcements available at WBJ on 13 April 2024.
7.908 Those assisting me did not undertake, or seek to have undertaken, any relevant testing of timing scenarios.
Submissions 7.909 In written submissions, Counsel Assisting submitted that there is “at least the possibility that had alerts been deployed earlier, this may have resulted in a different outcome for … Ms Darchia”. 1666 7.910 Counsel Assisting state that the evidence demonstrates that Pikria returned towards the scene of the initial incident at the Sourdough Bakery and Café, evidently unaware that she was walking back towards the danger. Her actions before and after that time (including occasions on which she stopped to pick up items she had dropped) suggest 1662 Exhibit 1, Vol 33, Tab 1052A, Report of Fulcrum Risk Services at p.1.
1663 Exhibit 1, Vol 33, Tab 1052A, Report of Fulcrum Risk Services at p.2.
1664 Exhibit 1, Vol 33, Tab 1052A, Report of Fulcrum Risk Services at pp. 16-22.
1665 Transcript, D14 (Wilson): T1241.30-33 (19 May 2025).
1666 Written submissions of Counsel Assisting at [1595].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 she was not aware she was in the midst of an AAO event, nor was she aware of the associated dangers.1667 7.911 Counsel Assisting submit that (emphasis added): Had an alarm been sounded at an earlier time (for instance, shortly after an appropriate alert having been made by GLA2 at 3:33:33pm), Ms Darchia may have responded differently … as it happened 77 seconds elapsed between GLA2’s initial alert and Ms Darchia being fatally stabbed. Ultimately, it is not possible to predict or prove the counterfactual. But the potential for a different outcome … cannot be excluded. 1668 7.912 Counsel for Pikria’s family submits that, given no alarm was sounded, Pikria did not know and would have had no way of knowing what was occurring and that any suggestion otherwise is beyond the evidence, outside reasonable inference, and classifiable as conjecture.
7.913 It is submitted that unlike Pikria, who was a solitary shopper, unplugged, and going about her business, the security staff of both Scentre and Glad were tasked with monitoring WBJ, gaining situational awareness with the tools available to them, and reacting to incidents accordingly in the interests of patrons. 1669 7.914 Counsel for Pikria’s family submit that an analysis of the points in time at which victims were attacked establishes that there was a substantial enough duration of time to have afforded Pikria an opportunity to protect herself had an announcement been activated earlier. 1670 7.915 It is submitted on behalf of Scentre that it was not realistically possible to activate alerts and alarms within the 77 second timeframe. The basis for this submission is the Fulcrum Report and related video enactment, which it is submitted were not challenged.1671 7.916 Further, it was submitted that while Mr Wilson gave evidence that with a recorded PA announcement “you could probably do it in one minute 32 seconds”, it was clear that Mr Wilson had not reached this determination by any particular processes of reasoning or science. It was submitted that, in any event, there was no button to press because PA announcements were not automated as at 13 April 2024, and applying Mr Wilson’s estimate, the first PA announcement would not be completed until 3:35:05pm.
7.917 It was similarly submitted on behalf of Glad that the Fulcrum Report establishes that it was not realistically possible to have activated the CMEO or made a PA announcement before the fatal attack on Pikria at 3.34.50pm. 1672 1667 Written submissions of Counsel Assisting at [1596].
1668 Written submissions of Counsel Assisting at [1596].
1669 Written submissions on behalf of Darchia Family at [7.d] 1670 Written submissions on behalf of the Darchia Family at [7.e].
1671 Written submissions on behalf of Scentre at [293].
1672 Written submissions on behalf of Glad at [77].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.918 In oral submissions, Counsel Assisting made a number of criticisms of the Fulcrum Report. First, that it was a re-creation, a hypothetical exercise prepared in a vacuum that assumes policy will be followed to the letter. Secondly, Counsel Assisting question whether Mr White had the appropriate expertise “to opine on all the matters [that] he does” within the report. Thirdly, Counsel Assisting submitted that Mr White’s scripts were, as acknowledged by Mr White within the report, overly long and involved unnecessary steps. 1673 7.919 Counsel Assisting submitted that “[f]or all those reasons the report should be put to one side. It would be wrong for the Court to accept the opinions in that report as the ideal counterfactual being representative of what would in fact occur”. 1674 7.920 In oral submissions, Counsel for Scentre submitted that Mr White’s report demonstrates that at least 2 minutes and 21 seconds is needed, if not 2 minutes and 32 seconds, to activate the AAO alerts and commence PA announcements. It was reiterated that the Fulcrum Report was not the only evidence available to me as to the timing of this response, as Mr Wilson stated it could be done in 92 seconds, which was also outside the 77-second window. 1675 7.921 Counsel for Scentre further submitted that I must have regard to the timing and nature of the adverse submissions of Counsel Assisting regarding the Fulcrum Report. The first occasion on which Scentre received notice of any potential criticism of the Fulcrum Report was on the first day of oral submissions (25 November 2025), which raised procedural fairness concerns. 1676 7.922 Counsel for Scentre submitted that the Fulcrum Report is to be “fairly and properly taken into account because it is clear and cogent evidence that is a relevant consideration informing … central coronial findings on manner and cause of death.”1677 7.923 In reply, Counsel Assisting submitted that their submissions concerning the Fulcrum Report go to the issue of the weight to be given to it. Further any procedural fairness issues had now been cured as Scentre had now had the opportunity to respond to the criticisms.1678 7.924 Counsel Assisting submitted that Mr Wilson’s evidence regarding timing should be considered in the context of the question he was asked to answer. 1679 1673 Transcript, Closing Submissions D2:T1933.10-T1934.5 (28 November 2025).
1674 Transcript, Closing Submissions D2: T1934.10-13 (28 November 2025).
1675 Transcript, Closing Submissions D2:T1974.11-13, T1975.11-19 (28 November 2025).
1676 Transcript, Closing Submissions D2:T1974.45-T1975.1 (28 November 2025).
1677 Transcript, Closing Submissions D2:T1975.6-8 (28 November 2025).
1678 Transcript, Closing Submissions D2:T2016.31-43 (28 November 2025).
1679 Transcript, Closing Submissions D2:T2016.44-T2017.22 (28 November 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.925 Counsel for Scentre asked for, and was granted time to review the transcript, and if necessary, provide a note setting out outstanding concerns.
7.926 Scentre’s legal representatives subsequently advised they had no further submissions they wished to make on the matter but maintained the procedural fairness concerns raised in oral submissions on 27 November 2025.
Findings 7.927 The only relevant testing of the scenario was carried out by Mr White in the Fulcrum Report.
7.928 Mr White’s report provided for two possible timeframes (between the initial radio broadcast of GLA2 and completion of the first PA announcement).
(a) 2 minutes and 21 seconds: where Mr White read the script he prepared (with the CMEO activated after 1 minute and 41 seconds).
(b) 2 minutes and 32 seconds: a Scentre reenactment of Mr White’s script including physical activation of all alerts and tones and commencement of PA announcements (with the CMEO activated at 1 minute and 45 seconds). 1680 7.929 However, the Fulcrum Report was not the only evidence on this point. Mr Wilson did not do any formal testing of any scenarios, but he said in oral evidence that “You could probably do it in 1 min 32 seconds (92 seconds) if you’d used a generic PA message cause you’re only pushing a button.” 1681 7.930 I note that there were no pre-recorded PA announcements available at WBJ prior to, or on, 13 April 2024. Even on Mr Wilson’s estimate of 92 seconds, this is outside the 77second window. I note also that Mr Wilson’s evidence was in answer to a question about the role of the CCTV Operator and he offered an opinion about the timing of making a public alert from the CCTV Control Room.
7.931 Accordingly, I find that it was not realistically possible to inform the public of an active armed offender event by making a PA announcement or activating the CMEO before Mr Cauchi had completed the fatal attacks.
1680 Exhibit 1, Vol 33, Tab 1052A, Report of Fulcrum Risk Services at pp. 16-22.
1681 Transcript, D14 (Wilson): T1241.30-32 (19 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 K. Changes made at WBJ since the events of 13 April 2024 and engagement with Standards Australia 7.932 The evidence received at Inquest demonstrated that significant changes have been implemented at WBJ since the tragic events of 13 April 2024. These changes include amendments, by both Scentre and Glad, to policies and procedures underpinning the response to emergencies including AAO incidents.
7.933 In addition, steps have been taken to explore other mechanisms of improvement; some of these, whilst not implemented, demonstrate the commitment of both Scentre and Glad to the safety of patrons, staff and retailers.
Changes implemented at WBJ since 13 April 2024 Physical/Structural changes 7.934 Several changes have been made to the CCTV Control Room at WBJ, including rearrangement of the workstations 1682, and installation of a new automated PA system in the Control Room which, has a preprogrammed AAO warning message. 1683 7.935 There have also been changes to the CMO, including:
(a) Creation of a secondary Control Room in the CMO; 1684 and
(b) Installation of a secondary CMEO panel, EWIS mimic, and PA system in the CMO secondary Control Room, allowing a response to an incident to be directed from the CMO (as required). 1685 7.936 Scentre is undertaking a program of “uplifting” all CCTV cameras across all Westfield centres.1686 This program has already been implemented at WBJ. There are now 1713 camera views at WBJ, across 954 cameras.1687 Improvements have also been made to navigation of cameras from the CCTV Control Room. 1688 Changes to equipment 7.937 There have been changes to the equipment provided to security officers following the events of 13 April 2024, including: 1682 Exhibit 1, Vol 34, Tab 1105, Bondi Junction Control Room Upgrade – Overall Plan for Costing (v5) at p.1.
1683 Transcript, D15 (Yates): T1332.46-T1333.18 (20 May 2025); Exhibit 1, Vol 42, Tab 1599, Statement of John Yates (Director of Security) at [173]-[175].
1684 Exhibit 1, Vol 45, Tab 1600B, Third Statement of Bradley Goldberg at [45].
1685 Transcript, D7 (Gaerlan): T516:9-50 (7 May 2025); Exhibit 1, Vol 44, Tab 1600A, Supplementary Statement of Bradley Goldberg at [40], [44], [47].
1686 Exhibit 1, Vol 42, Tab 1599, Statement of John Yates (Director of Security) at [179].
1687 Transcript, D15 (Yates): T1333.36-38 (20 May 2025).
1688 Transcript, D8 (Fatima): T665.11-15 (8 May 2025).
(a) Stab-resistant vests: by 30 July 2024, Scentre and Glad provided stab-resistant vests to all security officers at Westfield shopping centres, including WBJ. 1689
(b) Team safety cameras: in April 2025, body-worn cameras were introduced for use by security officers, to be activated in certain situations, including emergencies.
A training program has also been implemented in relation to their use.
Changes to policy documents 7.938 In August and September 2024, Scentre engaged Fulcrum Risk Services to complete a review of its emergency plans, including the Red Book, Green Book, and Terrorism Threat Response Plan. 1690 7.939 In November 2024, as a result of the review, Scentre implemented various changes regarding the procedures for responding to an AAO. These include: 1691
(a) Further clarification of responsibilities, particularly for the Chief Warden and the CCTV Control Room Operator;
(b) Updating radio communications procedures - in particular, implementing a protocol to ensure urgent radio communications are heard clearly, including a requirement for the Chief Warden to explicitly announce they are assuming the role of Chief Warden; 1692
(c) Enhancing the steps and considerations of the Chief Warden in managing the response to an AAO event;
(d) Amending the main assignments (with key suggested actions in bullet points) regarding contacting police, getting people to safety, using the PA, activating the CMEO, using CCTV and liaising with responders;
(e) Inserting a new assignment to “get people to safety” to reinforce the primary objectives, and outlining further details of the steps within each assignment; and
(f) Making it a clear requirement that if a security officer observes a weapon, they must state this over the radio.
7.940 Activation requirements for the CMEO have also been amended to permit a Duty Manager, Security Supervisor, or CCTV Control Room Operator to authorise activation if the Chief Warden is not immediately contactable. 1693 The CCTV Control Room Operator can also initiate the main actions in an AAO response (as outlined in Section C).1694 1689 Transcript, D15 (Yates): T1322.40-T1323.16 (20 May 2025).
1690 Exhibit 1, Vol 42, Tab 1599, Statement of John Yates (Director of Security) at [164]-[165].
1691 Exhibit 1, Vol 42, Tab 1599, Statement of John Yates (Director of Security) at [166]-[167].
1692 Exhibit 1, Vol 34, Tab 1117, Red Book (Issue 37) at pp. 20-21.
1693 Exhibit 1, Vol 34, Tab 1117, Red Book (Issue 37) at p. 137; Transcript, D7 (Gaerlan): T516.9-50 (7 May 2025).
1694 Transcript, D15 (Yates): T1327.27-45 (20 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Increased pay 7.941 Difficulties previously faced by Glad in recruitment have been addressed by increasing pay and benefits to security guards. 1695 Training 7.942 Scentre and Glad have introduced additional and updated training following the events of 13 April 2024:
(a) Chief Warden crisis management training and biannual Scenario Training; 1696
(b) Increasing the focus on Scentre and Glad’s induction training and processes to ensure guards have a clear understanding of AAO procedures and counter terrorism scenarios, including emergency management fundamentals; 1697
(c) Enhanced requirement for all security guards to complete Customer Experience Life Safety Induction and Site-Specific Security Induction prior to starting any work; 1698
(d) An online training module on new radio communication for all Scentre and contractors, including core and ad-hoc security officers. 1699The module provides that all staff are to conduct pre-shift radio checks, emphasises the need to differentiate urgent scenarios when using the radios, and orients staff on the use of the phonetic alphabet, standard radio colour codes, and the communication process to be followed in emergency scenarios;1700
(e) Further training in CMEO operation, including how to reset its operation;1701 and
(f) Further training has been implemented in relation to the use of the secondary EWIS panel in the CCTV Control Room.1702 7.943 Scentre has also engaged various third parties to provide training on topics such as emergency management and situational awareness, including Fulcrum Risk Services and Risk2Solutions.1703 7.944 Further evidence was received that the identification and induction process for CCTV Control Room Operators is now more extensive, and that the Control Room Training Checklist has also been reviewed and modified with a view to clarifying the expected 1695 Exhibit 1, Vol 42, Tab 1599B, Third Statement of John Yates (Director of Security) at [65]-[67].
1696 Transcript, D7 (Gaerlan): T516:9-23 (7 May 2025); Exhibit 1, Vol 42, Tab 1599, Statement of John Yates (Director of Security) at [190].
1697 Transcript, D15 (Yates): T1312:36-40 (20 May 2025).
1698 Transcript, D15 (Yates): T1312:42-T1313:22 (20 May 2025).
1699 Transcript, D15 (Yates): T1308:6-20 (20 May 2025); Transcript, D15 (Yates): T1313:18-23 (20 May 2025).
1700 Exhibit 1, Vol 42, Tab 1599B, Third Statement of John Yates (Director of Security) at [40]-[41], pp. 36-64.
1701 Transcript, D15 (Yates): T1334.4-11 (20 May 2025).
1702 Transcript, D15 (Yates): T1312:12-13 (20 May 2025).
1703 Exhibit 1, Vol 42, Tab 1599, Statement of John Yates (Director of Security) at [158]-[190].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 competencies of those Operators. The checklist now expands upon EWIS panel operation, knowledge of CCTV policy and procedures and incident escalation.
7.945 Scentre has also engaged with its retailers at WBJ, including:
(a) Emailing and physically distributing a copy of the existing retailer awareness poster to each retailer, requiring them to sign and acknowledge receipt, in early May 2024. This poster set out information relating to identifying suspicious activity, how to evacuate, the tones to respond to, steps to take if a bomb threat is received, and detailed information regarding how to respond in an AAO scenario;1704
(b) TrimEVAC (an external fire emergency management training provider) undertook additional training at WBJ addressing emergency evacuation, fire equipment and lockdown training procedures on or about 31 July 2024. This training, which is conducted at least twice a year at each Westfield, was attended by a large number of retailers.1705 Retailers are invited to attend this training each time it is conducted;1706 and
(c) Following the national terrorism threat level being raised on 5 August 2024 from “Possible” to “Probable”, Scentre provided an update to all retailers at all Westfield centres. This included a further copy of the retailer awareness poster and a QR code link to an educational video regarding the “Escape. Hide. Tell.” strategy.1707 7.946 Scentre has also increased engagement with its security subcontractor partners following the incident. On 31 October 2024, Scentre wrote to Glad regarding areas identified for further enhancement and assurance, including the following:1708
(a) Ensuring that Glad training programs were appropriate, including regular capability assessments; and review of all training programs;
(b) Ensuring all security personnel were appropriately inducted and trained;
(c) Confirmation that training had been provided on enhanced situational awareness including effective communication and required communication protocols; and
(d) Assurance that CCTV Controllers were trained and competent security officers who were proficient in Scentre’s systems, processes and communication protocols.
1704 Exhibit 1, Vol 42, Tab 1599, Statement of John Yates (Director of Security) at [169]-[170].
1705 Exhibit 1, Vol 42, Tab 1599, Statement of John Yates (Director of Security) at [171].
1706 Exhibit 1, Vol 42, Tab 1599, Statement of John Yates (Director of Security) at [171].
1707 Exhibit 1, Vol 42, Tab 1599, Statement of John Yates (Director of Security) at [172].
1708 Exhibit 1, Vol 42, Tab 1599, Statement of John Yates (Director of Security) at [194].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.947 Scentre and Glad have been in ongoing communication regarding this process.1709 Messaging from Warning Systems 7.948 The Red Book generic AAO PA announcement script has been updated to specify that the nature of the emergency is an AAO.1710The new automated PA announcement now has an automated AAO warning message.1711 7.949 As at February 2025, there were three Westfield centres, including WBJ, in the process of trialling pre-recorded automated PA announcements.1712 Trial of two CCTV Control Room Operators 7.950 In May 2025, Scentre commenced a trial period of having two CCTV Controllers in the WBJ CCTV Control Room during core trading hours. As of 20 May 2025, the trial had no designated end date. 1713 Engagement with Police 7.951 In August 2024, Scentre entered into a paid policing arrangement with the NSWPF for high visibility patrols at certain Westfield centres, including WBJ. This agreement commenced on 15 August 2024 with an initial period ending on 3 November 2024, and was extended to July 2025 following its success. It is expected that this agreement will be further extended. 1714 Changes considered but not implemented at WBJ 7.952 In addition to the changes outline above, Scentre have explored further potential changes that have not been implemented.
McGrath Nicol Review 7.953 In May 2024, Scentre engaged McGrath Nicol to conduct a review of global best practice in relation to security in crowded places.
7.954 Despite the review, there was no technology found that could accurately identify a weapon in a crowded places environment. Security screening systems to prevent weapons from entering Westfield were found to be impractical in a shopping centre.
1709 Exhibit 1, Vol 42, Tab 1599, Statement of John Yates (Director of Security) at [195]-[208].
1710 Transcript, D15 (Yates): T1315:44-49 (20 May 2025); Exhibit 1, Vol 34, Tab 1117, Red Book (Issue 37) at p.37.
1711 Transcript, D15 (Yates): T1332.46-T1333.18 (20 May 2025).
1712 Exhibit 1, Vol 42, Tab 1599, Statement of John Yates (Director of Security) at [173]-[175].
1713 Transcript, D15 (Yates): T1304:27-33 (20 May 2025); Exhibit 1, Vol 42, Tab 1599B, Third Statement of John Yates (Director of Security) at [68]-[69].
1714 Exhibit 1, Vol 42, Tab 1599, Statement of John Yates (Director of Security) at [148], [150].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Visual Cortex Review 7.955 Visual Cortex was engaged by Scentre in September 2024 to use CCTV footage from WBJ to test the use of artificial intelligence (AI) to identify circumstances such as people falling, abnormal crowd movement, and detection of weapons. However, the test revealed practical difficulties with the application of the AI such that its implementation is not currently viable. 1715 7.956 Even if technology such as wanding or other detection devices could be used, evidence before the Inquest suggests that it would not be desirable. Mr Yates gave evidence that it was “not the role of guards to try and, or in their power, to search individuals who may or may not have weapons on them.”1716 Consideration of security officer powers 7.957 During her evidence, Ms Fatima suggested increased legal powers and appropriate safety tools for security officers could assist with responding to critical situations.1717 7.958 Mr Iloski did not agree it was desirable for security officers to be granted more powers, explaining that: … our officers are there to observe, report and escalate. Even SLED have deemed as their whole responsibility. From my perspective, our safety - the safety of our, our people and the public are paramount. I, I want - I don't, I don't think there should be greater powers. I just think that there should be greater training. And an emphasis on training.1718 7.959 Greater powers for security guards was not a topic explored in any great detail during the Inquest.
Expert evidence 7.960 In his evidence, Mr Wilson praised the changes that Scentre had implemented, including to the layout of the Control Room; secondary EWIS and CMEO; pressure testing of staff; as well as the speed at which Scentre implemented changes following 13 April 2024.1719 7.961 Counsel Assisting referred to the new policies implemented by Scentre and Glad so that the Chief Warden is no longer required to give authorisation to the Control Room Operator in AAO scenarios. Mr Wilson stated: Yeah and that - that's, that's all credence to Scentre that brought that in; they've introduced the, the new [C]ontrol [R]oom … which gives you that added piece - if you're 1715 Exhibit 1, Vol 42, Tab 1599, Statement of John Yates (Director of Security) at [176]-[177].
1716 Transcript, D15 (Yates): T1367.10-22 (20 May 2025).
1717 Transcript, D8 (Fatima): T667:32-40 (8 May 2025).
1718 Transcript, D18 (Iloski): T1674.10-20 (26 May 2025).
1719 Transcript, D14 (Wilson): T1256.42-T1257.36 (19 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 the chief warden is in [that room], he can take command much, much quicker because he doesn't need to make [a] three, four minute journey.1720 Regarding the new Control Room, Mr Wilson noted that he questions whether the Chief Warden would “have the same ability as someone like CR2” to pick up things on the CCTV, and there may be some training done on the use of the cameras.
Notwithstanding this, Mr Wilson stated: I would say Scentre are in a much better position today than they were on 13 April because of these new introductions that they've brought about.1721 7.962 To reflect that change, the relevant Red Book section now states: Before the system can be activated, the user must have authorisation from the chief warden. Note, if the chief warden is not immediately contactable, a duty manager, security supervisor or CCTV controller can authorise.1722 7.963 Mr Wilson gave evidence that the expression was not as clear as desired: A. I would think - what I would want there is after confirmation is, is sought, that any of those individuals can press the CMEO. So if the chief warden's upstairs –[in the CMO] they could press it but at the same time - cause you're still with …, a CCTV [O]perator, they're still probably thinking “do I need authorisation to do this or not?” … Whether it's ten seconds or two minutes, it's all about time… [if] any of these people after verification or confirmation … has been sought, they should be able to start pressing those buttons.
Q. And it may be important that the policy document that underlines responses to emergencies to be clear in terms of what people can do?
A. Yeah. Yeah. So there's no hesitation. You don't want CR1 or CR2 hesitating for that minute or two trying to get on the radio to the chief warden… You want them to go ahead and press these buttons and get the activation out. 1723 7.964 As referred to above, Ms Fatima gave evidence about the possibility of security guards having greater legal powers to engage with offenders. Mr Wilson stated “it’s very complex”, but unlike in the US, the role of security guards in Australia (and the UK) is not to “go in and take the offender on, their job is to get people to safety and do that in as safe a way as possible”. He concluded: I think where [Scentre] are, you're now in a good position where guards have got stab proof vests.1724 7.965 Mr Wilson was asked for his views on Scentre’s arrangement with local police for their attendance. He gave evidence that: 1720 Transcript, D14 (Wilson): T1245.34-38 (19 May 2025).
1721Transcript, D14 (Wilson): T1245.45-47 (19 May 2025).
1722 Exhibit 1, Vol 34, Tab 1117, Red Book (Issue 37) at p. 137.
1723 Transcript, D14 (Wilson): T1258.44-T1259.9 (19 May 2025).
1724 Transcript, D14 (Wilson): T1256.14-31 (19 May 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Yeah I think that's a great move forward. Again I was aware that Westfields in Stratford and Westfields in White City in London that has placed teams within - again a lot of that is probably to do with antisocial behaviour and theft offences et cetera, but having that footprint, having that police footprint in one of your biggest crowded placed in the city can only be beneficial. 1725 7.966 Mr Wilson’s report acknowledged that the changes to the Red Book by Scentre are positive. Mr Wilson was asked whether there was anything further he would like to address on the action cards. He stated: Yeah I would just like to see action cards within those control rooms pinned to the wall so again the controller can look at that action card and [see] there's the five initial pieces that they're expected to do, the CMEO, the EWIS, the PA system, the 000, and then tracking the offender. That should be there so clearly if this happens in a year's time or ten years' time, that they've got that aide memoire in that room. 1726 Submissions 7.967 Counsel Assisting submitted that the extent and breadth of changes made by Scentre and Glad are significant, and that, commendably, they are demonstrative of organisations focused on continual improvement, to ensure the safety and well-being - not only of staff, but attendees of the “crowded places” which they operate.
7.968 Written submissions made on behalf of Glad included the following:1727
(a) That Glad conducted: Daily debriefs of the incident from 14 April 2024 until 23 April 2024.1728 These discussed a range of issues including welfare checks on the operations team, training records, internal communications, rostering, site visits, EAP, victims of crime provisions, workers compensation and funeral arrangements. These debriefs ensured that Glad’s staff had financial aid, counselling services and importantly their health and welfare were being supported.
(b) Glad conducted a number of meetings with Scentre following 13 April 2024, these considered new practices and trainings and have continued on a monthly basis. Monthly meetings are also held between Glad and its subcontractors to discuss operational compliance, training and risk concerns.
(c) Glad investigated the best available stab/slash-resistant vests on the market and procured vests for all its security team members for usage from Friday, 19 April
1725 Transcript, D14 (Wilson): T1256.36-40 (19 May 2025).
1726 Transcript, D14 (Wilson): T1258.12-17 (19 May 2025).
1727 Written submissions on behalf of Glad at [82]-[103].
1728 Exhibit 1, Vol 30, Tab 995C, Third statement of Steve Iloski at [42].
(d) Rod Moolman (National Security & Counter Terrorism Manager) was tasked to support the induction and training of all security officers who were new to Scentre sites. Mr Moolman was also tasked with ensuring all existing security officers were refreshed on specific training topics. These topics were determined on a site-by-site basis in consultation with each Scentre site Risk & Security Manager (RSM).
(e) Existing security training is being transitioned to online modules to enable security officers’ compliance and understanding with all training to be completed. Each module includes an assessment to ensure capability and comprehension are measured. Officers are also put through a pressure test that considers their response under a timed approach.
(f) Seven new modules were developed and now form part of the mandatory induction training for all Glad security officers, including both direct employees and subcontractors, which is completed through “Glad Academy” – Glad Group’s Learning Management System (LMS). The new modules include: i. Security Induction ii. Radio Usage iii. Situational Awareness iv. Active Armed Offender (consisting of two, more comprehensive modules) v. Conflict Management and Use of Force vi. Hostile Reconnaissance
(g) During induction sites, the officers would be buddied up with another experienced officer. The training was completed with a security supervisor, and they are reviewed and assessed by the security supervisor, site manager and then Mr Moolman will complete the pressure test.
(h) Glad is in the process of enhancing its rehearsal style training, which involves a full play-by-play scenario. This training is delivered in collaboration with Scentre as part of ongoing efforts to continually improve performance and preparedness.
It also includes coordinating law enforcement and ambulance services. Two rehearsal-style trainings have been conducted since 13 April 2024.
(i) Glad is in the process of updating its policy in relation to escalation of security concerns by the security officers. Glad has created a committee with the security officers, the Risk Department and People and Culture. This forum allows security officers to raise issues and concerns, which will be dealt with on a national basis
(j) The modules on Situational Awareness and Active Armed Offender are aligned with ANZCTC standards
(k) Following the incident on 13 April 2024, Glad engaged Risk Factors Australia, work health and safety consultants, to provide a WHS system review and WHS Advisory services. To date, Risk Factors Australia have supported the review of the Risk Management policy and procedure, review of the Security Risk Assessment and completion of an updated Security Risk Assessment for WBJ.
(l) Together with Scentre, Glad have commenced rollouts of body-worn cameras for its officers.
(m) Glad has also developed and enhanced its security training program and updated all of its relevant policies and procedures, including, relevantly: i. Situational Awareness Policy ii. Active Armed Offender Procedures iii. Radio Communication Procedures iv. Conflict Resolution Procedures v. Hostile Reconnaissance Procedures vi. Use of Force Policy vii. Crowded Places Policy viii. New Induction Procedures ix. Terrorism Awareness Package
(n) During induction, there are multiple steps each officer must undergo regarding Scentre policies. All new security officers must have completed the Scentre policies and procedures, emergency procedures and terrorism awareness training with the RSM. The security officers must then complete the Scentre Site specific induction prior to commencement of duties, and personnel must be briefed prior to each assignment.
(o) The security officer must also have been shown the Centre Specific High-Risk Locations, the Fire Control Room, the Centre Emergency Evacuation Plan and the First Aid Facility locations. They must also have undertaken the Scentre induction program, the Incident Management System Reporting & Investigation Requirements and be shown how to use the Fire Panel.
(p) Officers must also have completed training with Scentre’s RSM prior to commencing. In addition, prior to commencing duties all security personnel
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 must complete the Beakon Induction (CX Life), Beakon Induction (Site Specific) and Terrorism Awareness training.
(q) In December 2024, Scentre introduced an updated CCTV Controller Induction and Checklist. This has the new requirement for a competent and approved CCTV Operator to be in the Control Room at all times. Glad, in consultation with Scentre, have developed and implemented a ‘Control Room Coverage Procedure’ together with a supporting toolbox talk. This new procedure ensures that Glad can comply with the updated Scentre Group requirements.
(r) Glad have developed a Control Room Pressure Test which assesses a trainee Control Room Operator’s ability to recall the Red Book Responsibilities for Control Room Operators in the event of an Active Armed Offender scenario. A potential CCTV Operator must pass this assessment before Glad can put forward to the RSM for final approval.
(s) Standard process for a new employee who wishes to work in the Control Room is that they must go through onboarding induction, centre awareness and critical infrastructure for a period of three months before they are brought into the Control Room environment. Beyond this the officer is trained and supervised prior to being signed off by the RSM.
(t) Glad has redefined the Control Room Operator training to make it more relevant to Control Room Operators specifically. The new policy and procedures have been created in conjunction with Scentre and approved for implementation.
There is also a new selection process and training package for team members identified as suitable for CCTV and Control Room duties, where both Glad and Scentre are involved in the selection process of prospective candidates.
(u) Glad has adopted a proactive role in supporting client responsibilities under the Australian Government's “National Security Crowded Places” strategy. Whilst not an owner nor operator, Glad has created its own Crowded Places Policy in support of the owners and operators of Crowded Places it operates within. This includes the introduction of training systems tailored to its role as a service provider in crowded places. Glad has implemented immediate changes in line with the “National Security Crowded Places” strategy, its security officers receive training in terrorism awareness on their first day and prior to being placed on the floor.
7.969 In oral submissions, Counsel for Glad iterated that Glad procured stab-resistant vests following the incident, that body-worn video cameras are being rolled out, that Mr Moolman was appointed to improve Glad’s systems in relation to training through Glad Academy, including via pressure testing scenarios. In addition, Counsel for Glad again drew the Court’s attention to further changes made by Glad, including the revised criteria and assessments for selection of staff as Control Room Operators, the monthly meeting with its subcontractors and with Scentre, implementation of a crowded places
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 policy, active involvement and participation with industry associations in relation to AAO policies (such as SHIELD), the establishment of a comprehensive security training matrix and standard operating procedure for Scentre sites (which aligns Glad and Scentre’s training requirements and ensures a seamless induction of security officers), and the use of scenario-based pressure testing.1729 7.970 Counsel for Glad, in oral submissions, also emphasised that Glad has developed and enhanced its security training programme and updated all of its relevant policies and procedures, including its situation awareness policy, active armed offender procedures, radio communication procedures, conflict resolution procedures, hostile reconnaissance procedures, use of force policy, crowded places policy, and terrorism awareness packages. The requirement for the CCTV Control Room to be monitored or staffed at all times, and that there be two Control Room Operators present was also iterated.1730 7.971 Counsel for Scentre made the following written submissions:
(a) Regarding an updated AAO module: The training modules developed by Scentre subsequently to 13 April 2024 include a module on Emergency Management Fundamentals, which covers generic response procedures. The recently implemented AAO module confirms that the AAO guideline is to be read in conjunction with the generic response guideline.
Staff continue to be trained that the generic response guideline should be followed in all emergencies. 1731
(b) In respect of the requirement for verification of an AAO event: Nonetheless, to the extent that there is ambiguity in the terminology where it is used in the AAO guideline, Scentre through Mr Yates is committed to reviewing and resolving any uncertainty in that respect in the Red Book. 1732
(c) Regarding engagement with smaller retailers: Scentre takes on board the suggestion of greater engagement with smaller retailers (CA 1153), and since 13 April 2024 has maintained the provision of TrimEvac emergency evacuation training twice a year, to which retailers are invited. 1733
(d) Regarding the lack of written policy that the CCTV Control Room must be staffed at all times: Scentre agrees that a written policy or procedure is appropriate, and one has been implemented, to specify that the Control Room is not to be left unoccupied so that 1729 Transcript, D22 (Casselden): T77.35-T78.36 (25 November 2025).
1730 Transcript, D22 (Casselden): T77.35-T78.36 (25 November 2025).
1731 Written submissions on behalf of Scentre at [42].
1732 Written submissions on behalf of Scentre at [73].
1733 Written submissions on behalf of Scentre at [82].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 the unfortunate coincidence of the timing of CR1’s bathroom break cannot occur again . 1734
(e) Regarding the issues that arose in relation to high traffic volumes of radio usage: To expand upon and explain the recent policy and training that have been implemented, the enhanced program was rolled out, Scentre-wide, on 19 May
The Radio Communication Policy is purposed to directly address the experience of 13 April 2024, that in fast moving catastrophic incidents, radio channels can very quickly become overwhelmed. It explains the ways in which clear and effective two-way radio communications are to be maintained to facilitate effective incident responses, and lays down essential radio protocols in emergency responses. This includes when radio traffic must stop, and what must be communicated if there is a threat involving a weapon.
The Radio Communication Module is one of a suite of training modules in Beakon that is under development. At the time of Mr Yates’ evidence, four other modules had been implemented: emergency management; terrorism awareness; AAO and armed intruder. The content of the module is annexed to Mr Yates’ third statement.
It uses clear language and logical flow so that security officers understand how to employ clarity, precision and succinctness in radio communications, and specifically in an emergency. 1735 7.972 Counsel for Scentre made the following oral submissions: In summary, Scentre’s improvements include mandatory stab-resistant vests were implemented within weeks after the incident for all security officers. Team safety cameras have been deployed for all security officers with an accompanying training program and policies.
Your Honour has heard evidence of the clear policy and signage in the Westfield Bondi [C]ontrol [R]oom directing that the [C]ontrol [R]oom must not be left unoccupied during core trading hours. There is also the continuing trial of an additional security officer in the [C]ontrol [R]oom at all times during core training hours. Scentre has engaged a paid police presence at Westfield Bondi Junction and continues to liaise with New South Wales Police as to future arrangements. Metal detection wanding has been conducted by police in shopping centres including at Westfield Bondi Junction since May 2025.
Pre-recorded PA announcements have been rolled out in an ongoing trial with the new operational panel that your Honour has seen in photographs. There is ongoing investigation of developing artificial intelligence technology to assist in the visual 1734 Written submissions on behalf of Scentre at [98].
1735 Written submissions on behalf of Scentre at [106]-[108].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 detection of incidents. There was an ergonomic upgrade of the Westfield Bondi Junction [C]ontrol [R]oom, and creation of a secondary [C]ontrol [R]oom in the centre management office. The [C]ontrol [O]perator checklist has been revised. With the comprehensive external review of the red book in 2024 and more improvements in August of this year, there has been revision of chief warden responsibilities, radio protocols, PA scripts, the terms verification and confirmation, and the [C]ontrol [O]perator can now authorise activation of emergency systems.
Chief warden training has been enhanced with focus on self-regulation under pressure.
New online training modules have been introduced, including an active armed offender, and emergency fundamentals, and radio communications, and protocols which require a 100% pass mark to proceed. There is also enhanced mandatory pre-commencement training for ad hoc guards. Additional rehearsal training has been rolled out in all Westfield centres, involving simulated scenario exercises conducted after hours, and extending to more staff, including cleaners, concierge, and car park. 1736 7.973 Counsel for the Tahir family made the following submissions: Given the stark and tragic lessons learnt from 13 April 2024, Mr Yates’ evidence about why Scentre Group had not, by the time of the Inquest, implemented two [O]perators in the [C]ontrol [R]oom was entirely unsatisfactory (20 May 2025, T 1347 L 42 – T 1348 L 24):
FERNANDEZ Q. I’ll just give you a moment to look at that yourself. You will recall that’s part of your statement where you address this issue about a sole security officer. Is that correct?
A. That’s correct. Yes sir.
Q. At the end of this paragraph, you state that: “However, requiring two experienced [O]perators to be in the [C]ontrol [R]oom at all times would divert an experienced and skilled security guard from other important functions, including additional visible presence on the floor of the centre.” Can that not be addressed by increasing the amount of staff to take into account that there's two people in the [C]ontrol [R]oom?
A. It can be.
Q. Is that something that you’ll take into account then?
A. It certainly will.
Q. What do you say about that opinion that you’ve expressed there at paragraph 64 in the last sentence? Would you like to amend it, vary it or withdraw it— A. I would say I - I would say I’d refreshed my opinion on it.
1736 Transcript, D23 (Jordan): T6.37-T7.22 (28 November 2025).
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Q. You can see the benefit of— A. Okay, well the trial is underway Mr Fernandez.
Q. Indeed. Because there are commercial realities, that’s right, isn’t it, in running the security part of the business which you’re involved in?
A. Yes.
Mr Yates could not explain why there was a delay in Scentre Group implementing two [C]ontrol [R]oom [O]perators (20 May 2025, T 1344:18 – 1345:9):
FERNANDEZ Q. And Scentre engaged, I think you said, almost immediately with looking at Scentre security, is that right?
A. Yes, yes.
Q. And looking at what processes may have not worked well, do you agree?
A. Yes.
Q. And what processes needed to be improved, is that right?
A. That’s right. It has been an iterative process across a range of issues where we have considered what - as I have said in my evidence earlier around technology, people, training, pressure testing and the like. So it’s, it’s - you can just go, everything is going to be fixed in a day. We’re trying to really understand what is the requirement, what do we need to do to further enhance our security posture.
Q. That understanding for Scentre Group began on day one?
A. It did.
Q. Is that right?
A. Absolutely.
Q. So did you need to wait for the learnings of this Inquest to determine that there was a real issue about the number of people in the [C]ontrol [R]oom?
A. Prior to October 7, 2023, we didn’t have any staff in [C]ontrol [R]ooms in the majority of our centres. It’s a very new process to us. And the addition of a permanent person in the [C]ontrol [R]oom post October 7, we’ve seen it as a real advantage in terms of situational awareness, staff safety and, and the like. So, there’s a whole range of other staff, as you know. We’ve been, we’ve been managing and making the improvements just as soon as we can. This is just another one and we agree it may well be a good idea.
Q. I’m going to ask you my question again. Did you need this Inquest to be aware of the learnings in relation to the issue of problems with having only one person in the security [C]ontrol [R]oom?
A. No, we probably didn’t.
Q. Did or did not?
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 A. Did not.
Q. It was open to Scentre Group to action this particular issue at any earlier time, is that correct?
A. It was, yes.
The Tahir family expresses disappointment and frustration with the delay and lack of attention given by Scentre Group to this simple and obvious improvement which could have been made. The Tahir family (and all the families of those who were killed) supports a permanent implementation of two [O]perators in the [C]ontrol [R]oom at all times. 1737 7.974 Counsel for the Good, Singleton and Young families support the submissions made by the Tahir Family, and in particular: A system whereby there are two [C]ontrol [R]oom [O]perators in the [C]ontrol [R]oom at all times should be made permanent. 1738 7.975 Counsel for the Darchia family made the following submissions: Those who run the security aspects of Westfield Bondi Junction have a wide-ranging set of responsibilities, for which there is a substantial staff, although perhaps not enough.
It may be that it is difficult to employ a Control Room Operator or security staff generally, even more so in particular locations. This raises a few issues, including remuneration and broader concerns about infrastructure, housing, and other social circumstances.
The skills and training required in order to become a competent Control Room Operator, or security guard generally, might also be contributing to these issues and require a wholistic examination.
It appears, however, that there are multi-layered corporate subcontracting arrangements, which may not be able to be shown to have a direct causal connection to these issues or be the cause of any of the failures or mistakes of the team on the day, but the fact this occurs and might serve to obscure or hinder appropriate operations, must surely come in for some scrutiny. 1739 7.976 Glad accepted the submission that two Operators should be in the CCTV Control Room at all times, and noted that this change has since been implemented.1740 7.977 I note however, that the evidence before me is that having two Operators in the CCTV Control Room at WBJ is not yet, at least, a permanent change.
1737 Written submissions on behalf of the Tahir family at [115]-[117].
1738 Written submissions on behalf of the Good, Singleton and Young families at [9.3].
1739 Written submissions on behalf of the Darchia family at [7a]-[7b].
1740 Written submissions on behalf of Glad at [64].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.978 As noted above, Scentre have commenced a trial of having two Control Room Operators in the CCTV Control Room during core trading hours. There is, however, no evidence before me about when that trial will end or whether the change will be made permanent.
Findings 7.979 The extent and breadth of changes made by Scentre and Glad are significant and are demonstrative of organisations focused on continual improvement. I commend both Scentre and Glad for their proactivity and commitment to the safety of their staff and patrons.
7.980 In relation to a requirement for there to be two people in the CCTV Control Room during core business hours that is presently being trialled at WBJ, it is not clear how long it is intended that the trial remain ongoing, 7.981 Having regard to the evidence before me in relation to the demand on CCTV Control Room Operators during an event such as an AAO, I would encourage Scentre to give serious consideration to mandating that the CCTV Control Room be staffed with two CCTV Control Room Operators on a permanent basis.
Engagement with Standards Australia Volume of alarms 7.982 An issue to emerge during the Inquest was the impact of the alarm that was activated inside WBJ on 13 April 2024, with the evidence revealing that the volume of this alarm significantly impacted those within the centre, particularly first responders.
7.983 As noted earlier in this Part, evidence before the Inquest indicated that the alarms had been set by Scentre in accordance with Australian Standards (set by Standards Australia) and operated as intended on 13 April 2024.
Submissions Written submissions 7.984 Counsel Assisting submitted that the fact that Scentre had set the alarm in accordance with Australian Standards was entirely appropriate and could not be criticised in the circumstances.1741 7.985 Counsel Assisting submitted that it was acknowledged that a fire can itself generate significant noise and may therefore necessitate an alarm at a louder volume than an “AAO” alarm.
1741 Written submissions of Counsel Assisting at [1257]-[1258].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.986 Given the issues which arose on 13 April 2024 due to the volume of the alarms, a recommendation was proposed by Counsel Assisting to Standards Australia, in the following terms: Having regard to the evidence of the volume of alarms and consequent impact on first responders, Standards Australia to undertake a review of the requirements of the relevant standards (without limitation AS 1670.4-2018 and AS2220.2-1989) including as those standards relate to the minimum volume of alarms.
7.987 Standards Australia were notified of the proposed recommendation.
7.988 It was submitted on behalf of Standards Australia that, as a result of the notification of the issue that emerged on 13 April 2024, a technical committee has been convened to give consideration to the relevant standard.
7.989 Counsel for Standards Australia made the following submissions: Respectfully, the evidence does not support the specific finding that “the alarms at Westfield Bondi Junction were programmed to sound at a volume set by the Australian Standard 1670.1:2024” (Counsel Assisting written submissions at [1229]). Rather, the evidence indicates that the alarms complied with the capability requirements for the volume of this type of alarm. That capability requirement has been developed for alarms that are used in the evacuation of building occupants in the event of a fire or other type of emergency. They necessarily need to be able to sound at a volume that can be heard over the noise that may be expected during such an emergency, like a fire when smoke exhaust and other noisy plant are operating. There could be fatal consequences if an alarm cannot sound loudly enough to be heard in those conditions.
AS 1670.4:2024 provides the capability requirements for the volume of the EWIS system, and a different standard (AS 3745:2010) provides a generic framework for emergency planning, including developing procedures for how an EWIS should be operated. This framework is intentionally general, as it is intended to be adapted to suit most facilities. The Scentre Red Book was developed in accordance with the latter Standard.
Your Honour would be satisfied from the evidence that on 13 April the EWIS was not operated in accordance with the Red Book AAO procedure, as it should have been, and the wrong alarm was activated.
Notwithstanding that the EWIS was not operated as it should have been, after the [Counsel Assisting] team notified Standards Australia about the evidence your Honour had received about the volume of the alarms, the relevant technical committee was asked to consider whether changes are needed. While those experts have indicated that the capability requirements in AS 1670.4:2024 should remain the same (for reasons including those set out in our written submissions), consideration is being given by the relevant committee to whether any changes could be made to AS 3745:2010 in
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 relation to the guidance the Standard provides about the utilisation of an EWIS in emergency conditions. 1742 7.990 Counsel for Scentre made the following submissions: As to the volume of alarms, for clarity, Scentre engages ARA Indigenous Services Pty Ltd to conduct testing. In the twelve months prior to 13 April 2024 they were tested between 14 June and 11 July 2023, and between 9 and 17 October 2023. Evidence was clear that Australian Standards publishes comprehensive requirements for the volumes of alarms. Notably, in both tests over the relevant 12 months, the alert volumes were below the maximum stipulated by the Australian Standards.
It is not uncommon in an inquest for issues to be identified in evidence and for a party to take steps to appropriately respond before findings are delivered. However, it is one thing for an organisation to take on board evidence and, in response to learnings, improve its own processes during the coronial process. It would be quite another to take actions pre-empting the findings and recommendations of the coroner’s inquiry as it concerns third parties or regulators, as appears to be suggested by some (FT 123, 125127; GYS 9.2(d)). The practical problems are obvious and, besides, issues of sub-judice may arise. It was appropriate that Mr Yates did not purport to give evidence on a topic about which he does not have expertise, nor to hold himself out as a professional in fire alarms or appropriate alarm levels (cf FT 123;cf GYS 9.2(d)).
Finally, it is not appropriate to make a recommendation that would only arise on a speculative contingency (if Standards Australia requests material from Scentre at some point in the future) as is suggested in FT 129 (cf also GYS 9.2(d)). 1743 7.991 Regarding the proposed recommendation by Counsel Assisting, it was submitted on behalf of Glad that: Glad also agrees with proposed Recommendation 7 of CA's submissions, that having regard to the evidence of the volume of alarms and consequent impact on first responders, Standards Australia ought to undertake a review of the requirements of the relevant standards (without limitation AS 1670.4-2018 and AS2220.2-1989) including as those standards relate to the minimum volume of alarms.1744 7.992 Counsel for the family of Tahir made the following submission: It was unnecessary for Scentre Group to wait for the Inquest to be told he needed to do something about the volume of the alarms. This is an urgent matter and Scentre Group was aware of how debilitating the volume of the alarms were to efforts on the date of the incident. It was open to Scentre Group to bring this to the attention of the regulator and to bodies like ANZCTC in the year before the Inquest. 1745 1742 Written submissions on behalf of Standards Australia at [7]-[10].
1743 Written submissions on behalf of Scentre at [102]-[103].
1744 Written submissions on behalf of Glad at [11].
1745 Written submissions on behalf of the Tahir family at [126].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 7.993 Counsel for the family of Tahir supported the draft recommendation that Counsel Assisting intended to make: The Tahir family supports this recommendation and proposes that recommendations be made to NSW Police and Scentre Group, to provide all information available to them regarding the volume of the alarms at all Scentre Group shopping centres to assist Standards Australia in their review set out in recommendation 7. 1746 Oral submissions 7.994 On 25 November 2025, Counsel Assisting referred to the volume of the alarms and proposed Recommendation 7 addressed to Standards Australia, noting that since that evidence was received, Standards Australia had been notified and engaged with the team assisting.
7.995 Counsel Assisting noted that Standards Australia had advised that a technical committee was convened to consider the relevant standard and, on that basis, it was submitted that Standards Australia had already done what would have been asked of them had proposed Recommendation 7 been made, and therefore, the recommendation was no longer pressed by Counsel Assisting. 1747 7.996 In oral submissions, Counsel for the family of Faraz Tahir, in noting that the family supported the proposed recommendations of Counsel Assisting, identified that Recommendation 7 (to Standards Australia) no longer applied for the reasons explained by Counsel Assisting and noting the evidence received from Standards Australia.1748 Findings 7.997 Having regard to the steps taken by Standards Australia since being made aware of this issue, and the present position of the parties and Counsel Assisting, I do not consider it necessary to make the proposed recommendation. I am grateful to Standards Australia for their engagement.
Submission on behalf of SafeWork NSW regarding radio codes 7.998 Following the Inquest, SafeWork NSW (SWNSW) made submissions in relation to the use of radio colour codes by security staff during the response at WBJ on 13 April 2024.
7.999 SWNSW endorsed Counsel Assisting’s submission that GLA2’s initial radio was insufficient.1749 SWNSW referred to the factual findings proposed by Counsel Assisting in relation to the varying accounts of GLA2’s initial radio message, such as Mr Gaerlan 1746 Written submissions on behalf of the Tahir family at [129].
1747 Transcript, Closing Submissions D1: T1936.4-22 (25 November 2025).
1748 Transcript, Closing Submissions D2: T2007.16-21 (28 November 2025).
1749 Written submissions on behalf of SafeWork NSW at [6].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 providing three accounts of the initial radio alert made by GLA2, all of which used the expression “code black” and “code black alpha”.1750 7.1000 SWNSW submits that the emergency colour codes in the Red Book are wholly consistent with Australian Standard AS 3745-2010. The expression “code black”, SWNSW submits, could connote any of the four scenarios:
(a) An armed persons threatening injury to others.;
(b) An armed persons threatening injury to themselves;
(c) An unarmed persons threatening injury to others; or
(d) An unarmed persons threatening injury to others.
7.1001 SWNSW therefore proposed that a recommendation be made to clarify whether a “personal threat” situation involves whether a person is using a weapon. They proposed: Having regard to the evidence of the confusion regarding the use of radio colour codes during the events of 13 April 2024, Standards Australia to undertake a review of the requirements of the relevant standards (without limitation AS 3745.2010 – Planning for emergencies in facilities and AS 4093-2010 – Planning for emergencies – Health care facilities) including as those standards relate to the use of emergency colour codes. 1751 7.1002 In response, Standards Australia made the following submission:1752 … while the notification from GLA2 was not sufficient, the evidence does not support a finding that the deficiencies in GLA2’s initial notification were the result of any inadequacy in the emergency colour codes contained in the relevant Standards. Those colour codes are intended to be generic codes, which can be supplemented with additional information relevant to the individual facility, such as the modifier “Alpha” contained in the Red Book.
Notwithstanding this, since being provided with SafeWork NSW’s written submissions, Standards Australia has asked the responsible Technical Committee to consider whether changes could be made to the emergency colour codes, as set out in our written submissions.
Standards Australia is grateful for the early opportunity to ask the technical committees to consider these issues prior to delivery of Findings. Respectfully, as those processes have already commenced, the proposed recommendations to Standards Australia are neither necessary nor desirable, and we understand that the recommendation sought by Counsel Assisting is no longer sought by Counsel Assisting, or any of the families. 1753 1750 Written submissions on behalf of SafeWork NSW at [5].
1751 Written submissions on behalf of SafeWork NSW at [4b].
1752 Outline of oral submissions on behalf of Standards Australia at [11]-[13].
1753 Outline of oral submissions on behalf of Standards Australia at [11]-[13].
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 Findings 7.1003 Having regard to the steps taken by Standards Australia, and their consideration of the proposal raised by SafeWork NSW, I do not consider that it is necessary or desirable to make the proposed recommendation.
PART 7 THE RESPONSE OF SECURITY TO THE EVENTS OF 13 APRIL 2024 INQUEST INTO THE DEATHS AT WESTFIELD BONDI JUNCTION ON 13 APRIL 2024 507
A 28-year-old man with a history of depression, anxiety, and previous self-harm died by hanging during a police response to a domestic violence incident. Police attended after his sister reported he had breached an ADVO …
Jesse Riley, a 31-year-old with undiagnosed cerebral cavernoma, experienced status epilepticus triggered by an unknown cause (possibly nicotine from recent vaping). While in post-ictal delirium, he was perceived as aggre…
Phillip Walton, a 48-year-old with schizophrenia well-managed on clozapine for nearly 20 years, suffered an acute psychotic episode likely precipitated by cannabis use at a circus. After aggressive behaviour requiring po…
Source and disclaimer
This page reproduces or summarises information from publicly available findings published by Australian coroners' courts. Coronial is an independent educational resource and is not affiliated with, endorsed by, or acting on behalf of any coronial court or government body.
Content may be incomplete, reformatted, or summarised. Some material may have been redacted or restricted by court order or privacy requirements. Always refer to the original court publication for the authoritative record.
Copyright in original materials remains with the relevant government jurisdiction. AI-generated summaries are for educational purposes only and must not be treated as legal documents. Report an inaccuracy.