Deceased
Sestilio Malaspina; Hassan Khalif Shire Ali
Demographics
74; 30y, male; male
Coroner
State Coroner Judge John Cain
Date of death
2018-11-09
Finding date
2021-06-28
Cause of death
Sestilio Malaspina: stab wound to the chest; Hassan Khalif Shire Ali: gunshot wound to the chest
AI-generated summary
A 74-year-old Italian-Australian, Sisto Malaspina, was fatally stabbed during a terrorist attack in Melbourne's CBD on 9 November 2018. Hassan Khalif Shire Ali, aged 30, detonated an improvised explosive device in his vehicle, then attacked multiple people with a knife, fatally injuring Sisto. Police shot Hassan, who died from his gunshot wound. The coronal investigation examined whether security and intelligence agencies could have prevented the attack. Key findings identified deficient SIU procedures between 2015-2018, including delayed CVE referral processes, incomplete ANZCTC threat assessments, and premature downgrading of Hassan's risk profile despite significant intelligence gaps. While opportunities to improve management existed, the evidence does not establish that Hassan's trajectory toward the attack would have been averted by timely intervention. The incident was classified as a premeditated ISIS-inspired terrorist act.
AI-generated summary — refer to original finding for legal purposes. Report an inaccuracy.
Specialties
Error types
Drugs involved
IN THE CORONERS COURT Court Reference: COR 2018 5661
OF VICTORIA COR 2018 5663 AT MELBOURNE FINDINGS INTO DEATH WITH INQUEST Form 37 Rule 63(1) Section 67 of the Coroners Act 2008 Inquest into the deaths of Sestilio Malaspina and Hassan Khalif Shire Ali Findings of: Judge John Cain, State Coroner Delivered on: 28 June 2021 Coroners Court of Victoria Delivered At: 65 Kavanagh Street, Southbank Hearing Dates: 23 November 2020 to 4 December 2020 Counsel Assisting the Coroner: Ms Catherine Fitzgerald of counsel Representation: Ms Grace Morgan of counsel, on behalf of the family of Hassan Khalif Shire Ali Mr Ron Gipp of counsel, on behalf of the Chief Commissioner of Police Mr Richard Maidment QC of counsel, on behalf of the Australian Federal Police and the Australian Security Intelligence Organisation
I, Judge John Cain, State Coroner, having investigated the deaths of Sestilio Malaspina and Hassan Khalif Shire Ali and having held an inquest in relation to these deaths at Melbourne from Monday 23 November 2020 to Friday 4 December 2020 find that:
(a) the identity of the deceased was Sestilio Malaspina, born on 29 June 1944; and
(b) the death occurred on 9 November 2018, at Bourke Street, Melbourne, Victoria, from a stab wound to the chest; and
(c) the death occurred in the circumstances described below.
and I also find that:
(a) the identity of the deceased was Hassan Khalif Shire Ali, born on 16 May 1988; and
(b) the death occurred on 9 November 2018, at Royal Melbourne Hospital, 300 Grattan Street, Parkville, Victoria, from a gunshot wound to the chest; and
(c) the death occurred in the circumstances described below.
Sestilio Malaspina (Sisto)2 was 74 years of age when he died on 9 November 2018 at Bourke Street in Melbourne of a stab wound to the chest; his fatal injury was inflicted by Hassan Khalif Shire Ali.
Hassan Khalif Shire Ali (Hassan)3 was 30 years of age when he died on 9 November 2018 at Royal Melbourne Hospital of a gunshot wound to the chest. Hassan was shot by a Victoria Police member during an armed confrontation on Bourke Street in Melbourne, after Hassan had caused his vehicle to explode and assaulted three people with a knife, fatally injuring Sisto.
1 This section is a summary of facts that were uncontentious and provide a context for those circumstances that were contentious and will be discussed in some detail below.
2 Throughout this finding I have referred to Mr Sestilio Malaspina as ‘Sisto’ in accordance with his family’s wishes.
3 Throughout this finding I have referred to Mr Hassan Khalif Shire Ali as ‘Hassan’ in accordance with his family’s wishes.
The Coroners Court of Victoria is a specialist inquisitorial court.4 The purpose of a coronial investigation of a ‘reportable’ death is to ascertain, if possible, the identity of the deceased person, the cause of death and the circumstances in which death occurred.5
The ‘cause’ of death refers to the medical cause of death, incorporating where possible the mode or mechanism of death.
The ‘circumstances’ in which death occurred refers to the context or background and surrounding circumstances of the death. It is confined to those circumstances sufficiently proximate and causally relevant to the death, and not merely all circumstances which might form part of a narrative culminating in death.6
The broader purpose of any coronial investigation is to contribute to the reduction of the number of preventable deaths through the findings of the investigation and the making of recommendations by coroners, generally referred to as the ‘prevention’ role.7
Coroners are also empowered to report to the Attorney-General in relation to a death;8 to comment on any matter connected with the death they have investigated, including matters of public health or safety and the administration of justice;9 and to make recommendations to any Minister or public statutory authority on any matter connected with the death, including 4 Coroners Act 2008 (Vic) (the Act), ss. 1(d) and 89(4). All references which follow are to the provisions of this Act, unless otherwise stipulated.
5 The Act, section 67(1).
6 This is the effect of the authorities – see for example Harmsworth v The State Coroner [1989] VR 989; Clancy v West (Unreported 17/08/1994, Supreme Court of Victoria, Harper J.) 7 The ‘prevention’ role is now explicitly articulated in the Preamble and purposes of the Act, cf: the Coroners Act 1985 where this role was generally accepted as ‘implicit’.
8 The Act, section 72.
9 The Act, section 67(3).
public health or safety or the administration of justice.10 These are effectively the vehicles by which the prevention role may be advanced.11
Coroners are not empowered to determine civil or criminal liability arising from the investigation of a reportable death, and are specifically prohibited from including in a finding or comment any statement that a person is, or may be, guilty of an offence.12 However, a coroner may include a statement relating to a notification to the Director of Public Prosecutions if the coroner believes an indictable offence may have been committed in connection with the death.13
A coroner must hold an inquest if it is suspected that the death was the result of homicide,14 unless a person has been charged with an indictable offence in respect of the death.15 In all other circumstances, a coroner’s power to hold an inquest is a broad, discretionary one16 that should be exercised in a manner consistent with the preamble and purposes of the Act.
The coronial system should operate in a fair and efficient manner17 and when exercising a function under the Act, a person should have regard to the factors set out in section 8, including the desirability of promoting public health and safety and the administration of justice.
In determining whether a matter is proven to that standard, coroners should give effect to the principles enunciated in Briginshaw v Briginshaw.18 These principles state that when deciding whether a matter is proven on the balance of probabilities, in considering the weight of the evidence, the decision-maker should bear in mind:
• the nature and consequence of the facts to be proved; 10 The Act, section 72(2).
11 See also the Act sections 73(1) and 72(5) which require publication of coronial findings, comments and recommendations and responses respectively; section 72(3) and (4) which oblige the recipient of a coronial recommendation to respond within three months, specifying a statement of action which has or will be taken in relation to the recommendation.
12 The Act, section 69(1).
13 The Act, sections 69 (2) and 49(1).
14 The Act, section 52(2)(a).
15 The Act, section 52(3)(b).
16 The Act, section 52(1).
17 The Act, section 9.
• the seriousness of any allegations made;
• the inherent unlikelihood of the occurrence alleged;
• the gravity of the consequences flowing from an adverse finding; and
• if the allegation involves conduct of a criminal nature, weight must be given to the presumption of innocence, and the court should not be satisfied by inexact proofs, indefinite testimony, or indirect inferences.19
This finding draws on the totality of the material obtained in the coronial investigation of Sisto and Hassan’s deaths. That is, the court file, the Coronial Brief prepared by Detective Senior Constable Michael Drew of the Homicide Squad and further material obtained by the Court, together with the transcript of the evidence adduced at Inquest and the closing submissions of counsel.20
In writing this finding, I do not purport to summarise all the material evidence but refer to it only in such detail as appears warranted by its forensic significance and the interests of narrative clarity. It should not be inferred from the absence of reference to any aspect of the evidence that it has not been considered.
BACKGROUND AND PERSONAL CIRCUMSTANCES Sestilio Malaspina
19 Briginshaw v Briginshaw (1938) 60 C.L.R. 336.
20 From the commencement of the Act, that is 1 November 2009, access to documents held by the Coroners Court of Victoria is governed by section 115.
Initially working in the meatworks industry, Sisto later moved into catering, an enterprise more suited to his ‘larger than life personality’.21
In 1972, Sisto married Vicky, with whom he had two children – David and Lisa Marie.22
In 1974, Sisto founded Pellegrini’s, an espresso bar in Bourke Street, Melbourne, with his friend and business partner Nino Pangrazio. He worked six days a week at Pellegrini’s and had a daily ritual of going for a walk between his long shifts. On the day of his death, Sisto was celebrating the recent birth of his first grandchild.23
Sisto is remembered by his son David as a ‘great dad; he was hard working but loving and dedicated to his wife, children and family. He set a great example to those who knew him and those around him. He was dependable and reliable and loved by all who knew him.’24
Sisto was a Melbourne icon, whose loss is deeply mourned by the Victorian community.
Hassan Khalif Shire Ali Family history
Hassan was born on 16 May 1988 in Qardho, Somalia. He migrated with his family to Australia as a refugee in 199325 and he acquired Australian citizenship in 1996.26
In 2005, Hassan returned to Somalia for a period of approximately four years. Whilst in Somalia he married and had a child. His marriage subsequently broke down, and Hassan returned to Australia in 2009, leaving the child in the care of his ex-wife.27 He later returned to Somalia for approximately six weeks in 2011.28
In about 2014, Hassan met and commenced a relationship with Beyza Eren,29 whom he later married.30 They initially lived together with their respective families, before settling at Hassan’s family home in Werribee in early to mid-2015.31 Over the following three years, 21 CB, Statement of David Malaspina dated 19 December 2018, p 98-100.
22 CB, Statement of David Malaspina dated 19 December 2018, p 98-100.
23 CB, Statement of David Malaspina dated 19 December 2018, p 101.
24 CB, Statement of David Malaspina dated 19 December 2018, p 102.
25 CB, Sentencing Remarks, R v Ali [2020] VSC 316, p 2825.
26 CB, Statement of Elizabeth Denny dated 26 April 2019, p 366; 27 AM 10, Statement of Khalif Ali dated 23 November 2020, p 1.
28 CB, Department of Immigration and Border Protection Records, Information Report dated 10 July 2015, p 1426.
29 Ms Eren gave evidence under the protection of a certificate pursuant to section 57 of the Coroners Act 2008 (Vic).
The effect of this certificate means that in any proceeding in a court, or before any person or body authorised by law to hear, receive or examine evidence, the evidence given and any information, document or other thing obtained as a direct result or indirect result of Ms Eren having given evidence cannot be used against her. T780.
30 T780, 817 (Beyza Eren).
31 T780-1 (Beyza Eren).
they lived together at various addresses in Roxburgh Park, Meadow Heights and Werribee, including at one stage with Ms Eren’s brother, Evrem Eren.32
There were many stressors upon their relationship including financial pressures33 and disagreements regarding Hassan’s drug use, religious adherence and alleged infidelities.34 There were several periods of separation and reconciliation,35 and on one occasion in about 2016, at the instigation of Ms Eren, they met with Khoder Soueid36 for religious guidance on their marriage.37
Hassan and Ms Eren had their first child together in 2017.38 Following the birth of their child, Ms Eren observed that Hassan became secretive, was frequently absent from the house and would sleep through the morning prayers. She noticed that her scissors would go missing, and she could smell marijuana when she checked his car. She also discovered that Hassan had been searching through female escorts on his phone.39
By early 2018, their relationship had fractured, and they again separated, with Ms Eren moving with their child into a granny flat at the rear of a property in Meadow Heights in May 2018.40 They reconciled in about July or September 2018, and Hassan moved in with Ms Eren in the granny flat.41 Hassan did not update his address details on his licence. However, it is accepted that Hassan continued to reside at this address until his death.
Ms Eren testified that at the time of their final reconciliation Hassan told her he would be ‘better in his religion,’ which meant praying more, being more active as a Muslim and reading more of the Quran. He also told her that he either had, or was going to, cease smoking marijuana.42 32 T764 (Evrem Eren); T785-7 (Beyza Eren).
33 T819 (Beyza Eren).
34 T822 (Beyza Eren).
35 T820 (Beyza Eren).
36 Ms Eren confirmed that Mr Soueid was not an Imam but considered that he was more easily accessible and regarded him as someone who was knowledgeable in terms of religious matters. T834-5. Ms Eren gave evidence that she messaged Mr Soueid from time to time to ask religious questions about day to day practice. T804. Ms Eren has since married and had a child with Mr Soueid. T805.
37 T793-4 (Beyza Eren).
38 T785 (Beyza Eren).
39 T786-7 (Beyza Eren).
40 T787 (Beyza Eren). The residence was owned by Muammer Yavuz’s mother, who lived in the house at the front of the property with her daughter.
41 There is some disagreement as to when Hassan and Ms Eren reconciled for the last time. Mr Yavuz recalled speaking with Ms Eren’s father about her getting back together with her partner in July. Exhibit 40, Statement of Muammer Yavuz dated 13 November 2018, p 356. However, Ms Eren gave evidence that they reconciled in spring 2018, most likely in September. T821, 823 (Beyza Eren).
42 T788-9; T821 (Beyza Eren).
Contact with security agencies and law enforcement
Hassan first came to the attention of law enforcement and security agencies in July 2015 as part of Taskforce Pax46 when he and Ms Eren attempted to travel overseas on one way tickets, purportedly to travel to Somalia to visit Hassan’s son and to explore employment opportunities. Hassan’s younger brother Ali Khalif Shire Ali was also due to travel with them but did not ultimately do so.47
During person/baggage examination, authorities found open source digital imagery related to the Islamic State of Iraq and Syria (ISIS) on a mobile phone in Hassan’s possession.48 Due to concerns that Hassan was attempting to travel to conflict zones and engage in hostilities overseas, he was refused travel and his passport was subsequently cancelled on security grounds.49
Hassan remained a person of interest to national security and intelligence agencies until his death. The management and assessment of information about Hassan by Victoria Police and its intelligence partners are discussed in some detail below. Hassan was considered a person of 43 AM 13, Statement of Hassan’s sister dated 27 November 2020, p 2; AM 12, Statement of Asha Ali dated 27 November 2020, p 2-3; AM 10, Statement of Khalif Ali dated 23 November 2020, p 1.
44 T789-90 (Beyza Eren); AM13, Statement of Hassan’s sister dated 27 November 2020, p AM13-1-2.
45 T791-2 (Beyza Eren); T771 (Evrem Eren); AM10, Statement of Khalif Ali dated 23 November 2020, p AM10-1-2.
46 Taskforce Pax was an operation conducted by the Security and Organised Crime Intelligence Unit (now the SIU) investigating persons of interest with varying extremist views. Exhibit 15, Statement of Assistant Commissioner Peter Guenther dated 2 March 2020, p 3127.
47 Exhibit 24, First Statement of JCTT Officer B dated 5 July 2019, p 636; Exhibit 15, Statement of Assistant Commissioner Peter Guenther dated 2 March 2020, pp 3127-8; CB, Department of Immigration and Border Protection Records, Information Report dated 10 July 2015, pp 1415, 1425, 1429; CB, Department of Immigration and Border Protection Records, Pasla Air Travel Itinerary issued 6 July 2015, p 1406.
48 CB, Department of Immigration and Border Protection Records, Information Report dated 10 July 2015, p 1429.
49 ASIO’s Director-General of Security furnished an adverse security assessment in respect of Hassan on 21 July 2015, having assessed that Hassan was likely to engage in politically motivated violence (PMV), or activities in support of PMV if he were to continue to hold an Australian passport. His passport was cancelled by the Minister for Foreign Affairs on 23 July 2015. Ms Eren’s passport suspension did not result in a passport cancellation. Exhibit 24, First Statement of JCTT Officer B dated 5 July 2019, p 636; Exhibit 15, Statement of Assistant Commissioner Peter Guenther dated 2 March 2020, pp 3127-8.
interest both in his own right and as the brother of Ali Khalif Shire Ali who was subject of a criminal investigation (codenamed Operation San Jose)50 by the Joint Counter Terrorism Team (JCTT) between late 2016 and 2017, and ultimately charged with terrorism offences.51
Hassan’s family reported that his character changed following his passport cancellation, and particularly after the arrest of his brother in November 2017.52 In contrast, Ms Eren testified that Ali Khalif Shire Ali’s arrest did not appear to have any real effect on Hassan; he never discussed his brother’s offending with her and ignored her encouragement to visit him in prison.53 Escalation of criminal behaviour
Hassan’s criminal history prior to 2018 involved intermittent, non-violent relatively minor offending. His most recent court appearance was in May 2013, when he was found to have breached a community corrections order imposed in 2012 for burglary and receiving stolen goods.54
Hassan was not charged with any further offences until 2016, when it was alleged he had driven whilst suspended (on several occasions) and exceeded the speed limit. Although he was required to attend court, he failed to appear on multiple occasions and warrants were issued for his arrest. The warrants were executed on 9 September 2017 and Hassan was bailed to appear at Werribee Magistrates’ Court on 5 February 2018 in relation to the outstanding matters. In the interim, Hassan was charged with another driving offence, and failed to attend court when the matter was listed. Upon failing to appear at court in February 2018, there were a total of five arrest warrants for outstanding matters;55 these warrants were the subject of a roadside bail hearing on 12 October 2018, detailed further below.56 50 On 27 November 2017, Ali was arrested, and subsequently charged in relation to terrorism offences, namely engaging in acts done in preparation for, or planning terrorist acts, and collecting or making documents likely to facilitate terrorist acts. He was in custody at the time of the Bourke Street attack, and later pleaded guilty to a single charge of doing an act in preparation for or planning a terrorist act. Ali was found to have an allegiance to ISIS and planned to carry out a terrorist attack in the City of Melbourne at the end of 2017 in pursuit of his ideological and religious objective to wage violent jihad. CB, Statement of Facts, p 4209 and Sentencing Remarks, R v Ali Khalif Shire Ali [2020] VSC 316, p 2801-3.
51 Exhibit 15, First Statement of Assistant Commissioner Peter Guenther dated 2 March 2020.
52 AM 13, Statement of Hassan’s sister dated 27 November 2020; AM 12, Statement of Asha Ali dated 27 November 2020; AM 10, Statement of Khalif dated 23 November 2020.
53 T827 (Beyza Eren).
54 CB, LEAP – Victoria Police Criminal Record, p 1313.
55 CB, Email Correspondence from Warrants Unit dated 9 September 2017, p 3284.
56 CB, Magistrates’ Court Records, pp 1682-1697.
In August 2018, he was alleged to have assaulted an acquaintance and damaged the acquaintance’s front door several days later.57 In September 2018, in separate incidents, Hassan made threats to kill and damaged a vehicle with a sledgehammer58 and assaulted someone with a hammer.59 On 12 October 2018, Hassan was involved in a hit and run collision60 and on 3 November 2018 he allegedly kicked the front passenger side of a vehicle after a verbal altercation with a stranger.61
However, for various reasons including ongoing investigations to identify the alleged offender,62 a Whereabouts63 was not submitted to the Law Enforcement Assistance Program (LEAP)64 for Hassan’s vehicle until 16 October 201865 nor for Hassan himself until 22 October 2018.66 These alleged offences involving apparently unprovoked attacks against acquaintances and strangers represent a significant departure from Hassan’s previous offending behaviours.
57 CB, Statement of First Constable Alec MacLachlan dated 15 October 2020, p 3913-4.
58 CB, Statement of Senior Constable Gavin Williams dated 14 October 2020, p 3907-8.
59 CB, Statement of First Constable Olivia Caso dated 30 September 2020, p 3886.
60 CB, Statement of Senior Constable John O’Hara dated 15 October 2020, p 3920.
61 CB, Statement of First Constable Samuel Barty dated 2 October 2020, p 3900.
62 It appears that all of the police officers involved in investigating these alleged offences were undertaking various avenues of enquiry to (where necessary) ascertain the identity of the Offender, and then utilise other means available to them to locate Hassan, such as attending addresses and phone numbers linked with Hassan. See for example CB, pp 3908, 3914, 3921. FC MacLachlan, who was investigating the first assault from August 2018 compiled a “whereabouts package” for the arrest and interview of Hassan in early September 2018 and faxed to the Central Data Entry Bureau (CDEB) for entry on to the LEAP system. However, for reasons unknown, it appears that this was not received by CDEB and was not followed up. CB, Statement of First Constable Alec MacLachlan dated 15 October 2020, p 3914.
63 The Victoria Police Manual policy, ‘Tagging of records to locate suspects or offenders,’ guides police members’ use of a range of alerts used to tag records, locate suspects or vehicles using LEAP and other law enforcement communications platforms. Relevantly, the policy outlines when a person or vehicle whereabouts should be used.
Broadly, a ‘Whereabouts’ will be placed on LEAP in respect of a person (or vehicle) if the person (or vehicle) is wanted by police in connection with an offence and, after enquiries have been made to locate the person (or vehicle) s/he (or it) cannot be found. The Whereabouts will be added to LEAP, with the approval of the members’ supervisor, and contain instructions about what action should be taken in respect of the person (or vehicle) if any member has incidental contact in the field. For instance, a person whereabouts would be evident to a police member conducting a name search and could indicate the nature of the offence in relation to which s/he is wanted and whether s/he should be arrested, interviewed or otherwise.
64 The Law Enforcement Assistance Program (LEAP) is a dynamic, online database used to record information about criminal incidents reported to police for use operational policing purposes.
65 CB, Statement of Senior Constable Gavin Williams dated 14 October 2020, p 3908; CB, Vehicle Whereabouts Desired dated 16 October 2018, p 3910.
66 CB, Statement of First Constable Olivia Caso dated 30 September 2020, p 3887; CB, Person Whereabouts Desired, submitted 22 October 2018, p 3889. A further “person whereabout desired” was submitted by Senior Constable O’Hara on 25 October 2018. CB, Statement of Senior Constable John O’Hara dated 15 October 2020, p 3922; CB, Person Whereabouts Desired submitted 25 October 2018, p 3927.
At about 4.12pm on 9 November 2018, Hassan parked his blue Holden Rodeo Utility vehicle (ute) outside the City Duty Free outlet located at 255 Bourke Street, between Russell and Swanston Streets, in Melbourne’s central business district (CBD). Hassan had missed a phone call from his wife. He returned the call, which lasted for one minute and seven seconds.67
Inside the ute’s cabin were three liquid petroleum gas (LPG) bottles and a propane cannister68 Hassan had bought at a hardware store on 5 November 2018.69 Hassan opened the tap on each of the LPG bottles, causing the cabin to fill with gas.70
Hassan sent Ms Eren two text messages at 4.17pm, and one at 4.18pm.71
At about 4.20pm, an explosion occurred inside the ute, engulfing it in flames, and causing the vehicle to roll slowly across Bourke Street.72 Pedestrians who witnessed the explosion approached to render assistance.73 Darren Allen saw Hassan trying to get out of the driver seat and yelling something difficult to decipher.74 As he alighted from the ute, Hassan made multiple attempts to get something out of the driver-side door.75
Rodney Patterson approached the ute and, not finding anyone inside, stepped back to look beneath it when he saw a figure – Hassan – lunge at him.76 Mr Patterson heard a lot of shouting and felt a heavy strike to the left side of his head; the injury he sustained immediately began to bleed.77 Both Mr Patterson and Hassan took a few steps backwards, which allowed Mr Patterson to see the ‘big knife’78 in Hassan’s hand.79
Hassan moved quickly towards Mr Allen still holding the knife. He said something ‘loud’ and ‘aggressive’ that ‘included a reference to Allah’80 as he pursued Mr Allen over a distance of about five metres before abandoning the chase.81 67 Exhibit 24, Statement of JCTT Officer B dated 5 July 2019.
68 Exhibit 39, Statement of Laura Noonan dated 13 December 2018.
69 Exhibit 24, Statement of JCTT Officer B dated 5 July 2019.
70 Exhibit 39, Statement of Laura Noonan dated 13 December 2018.
71 Exhibit 24, Statement of JCTT Officer B dated 5 July 2019.
72 Exhibit 41, Coronial Brief of Evidence (CB), Statement of Darren Allen dated 9 November 2018.
73 Exhibit 41, CB, Statements of Darren Allen and Rodney Patterson both dated 9 November 2018.
74 Exhibit 41, CB, Statement of Darren Allen dated 9 November 2018.
75 Exhibit 41, CB, Statement of Darren Allen dated 9 November 2018.
76 Exhibit 41, CB, Statement of Rodney Patterson dated 9 November 2018.
77 Exhibit 41, CB, Statement of Rodney Patterson dated 9 November 2018.
78 Exhibit 41, CB, Statement of Darren Allen dated 9 November 2018.
79 Exhibit 41, CB, Statement of Rodney Patterson dated 9 November 2018.
80 Exhibit 41, CB, Statement of Darren Allen dated 9 November 2018.
81 Exhibit 41, CB, Statement of Darren Allen dated 9 November 2018. I note that Hassan also chased Jack Sinclair; see Jack Sinclair’s statement dated 10 November 2018.
Sisto, who had been taking his customary walk between shifts at Pellegrini’s,82 was on Bourke Street’s southern footpath near Russell Place.83 Hassan ran straight at him, raised the knife and struck Sisto with it twice.84 Sisto fell to the ground, fatally injured.85
Hassan ‘turned around as if he was looking for people’ and then saw security guard Shadi Helal.86 Mr Helal had just stepped outside the City Duty Free outlet to ascertain the cause of the explosion87 when Hassan rushed at him.88 Hassan stabbed Mr Helal at least twice,89 causing a laceration and the blade of the knife to break, reducing its size from approximately 22 to six centimetres.90 Hassan pursued Mr Helal into Russell Place before returning to Bourke Street.
There is no evidence that Hassan knew or had previously met any of the victims of his attack.
As witnesses assisted the injured,91 Hassan ran towards his ute,92 which had come to rest on the northern footpath of Bourke Street.93 Nineteen seconds had elapsed since the explosion.94
Transit 315 comprising of Police Officers A1 and B2,95 were patrolling the CBD in a marked divisional van (van) and were near the intersection of Bourke and Elizabeth Streets when they heard the explosion.96 Passenger Police Officer A1 saw a moving ‘car on fire’ about 100 metres ahead on Bourke Street.97 Driver Police Officer B2 radioed into police communications to report his observations of the vehicle and its location.98
Police Officer B2 drove east on Bourke Street towards the ute, which was stopped against a metal bench on the footpath. As the van approached, the police members observed several 82 Exhibit 41, CB, Statement of David Malaspina 19 December 2018.
83 Exhibit 41, CB, Statement of Christopher Couwenberg dated 13 November 2018.
84 Exhibit 41, CB, Statement of Christopher Couwenberg dated 13 November 2018.
85 Exhibit 41, CB, Statements of Maria Tutomontoya dated 8 November 2018 and Christopher Couwenberg dated 13 November 2018.
86 Exhibit 41, CB, Statement of Christopher Couwenberg dated 13 November 2018.
87 Exhibit 41, CB, Exhibit 18 – Transcript of Audio Recording of a witness interview of Shadi Helal on 9 November 2018 and Statement of Shadi Helal dated 17 February 2019.
88 Exhibit 41, CB, Statement of Ian Anderson dated 9 November 2018.
89 Exhibit 41 CB, Statement of Christopher Couwenberg 13 November 2018.
90 Exhibit 41, CB, Exhibit 27 Series of Photographs depicting the ballistic examination of scene in on 9 November 2018, Photograph 59.
91 Exhibit 41, CB: Lei Zhang, Maria Tutolomontoya, John Raygor and Christopher Couwenberg assisted Sisto, while Vittorio Padovan helped Mr Patterson and (off-duty) Sergeant Christy Walsh and SC Adam Sekoa assisted Mr Helal.
92 Exhibit 41, CB, Statement of Christopher Couwenberg 13 November 2018.
93Exhibit 41, CB, Statement of Christopher Couwenberg 13 November 2018.
94Exhibit 41, CB, Exhibit 45 – CCTV Compilation and Exhibit 46 – Aide Memoir to JSU CCTV Compilation.
95 A Pseudonym Order was made to protect the identities Police Officers A1 and B2 on 10 November 2018.
96 Exhibits 35 and 34, Statements of Police Officer A1 and Police Officer B2, respectively, both dated 9 November
97 Exhibit 34, Statement of Police Officer B2 dated 9 November 2018.
98 Exhibit 35, Statement of Police Officer A1 dated 9 November 2018.
pedestrians running west, away from the ute, with some ‘gesturing frantically’ in the direction of the explosion.99
Police Officer B2 stopped the van about 15 metres from the burning ute, on the same side of Bourke Street, and activated its emergency lights:100 31 seconds had elapsed since the explosion.101
As Police Officer A1 alighted from the van, his partner was using the police radio.102 As Police Officer A1 reached the front of the van, he saw Hassan ‘right up on’ Police Officer B2’s car door as he was opening it.103 Hassan reached through the open window and ‘punched’ Police Officer B2 about three times.104 Police Officer B2 alighted from the van and attempted to restrain Hassan in a headlock, but Hassan slipped from his grasp and backed away towards the rear of the van.105
The police members saw something in one of Hassan’s hands but could not see it clearly.106 Hassan was pacing in different directions and appeared angry.107
Police Officers A1 and B2, about an arm’s length from each other followed Hassan to cordon him while maintaining a safe distance,108 in a rolling stand-off across Bourke Street and onto its northern footpath.109 From about four metres, Police Officer B2 deployed oleoresin capsicum (OC) spray at Hassan’s face.110 As Hassan rubbed his eyes, Police Officer B2 moved in to take Hassan to the ground111 but Hassan evaded apprehension and walked back out onto the road.112 99 Exhibit 35, Statement of Police Officer A1 dated 9 November 2018.
100 Exhibit 34, Statement of Police Officer B2 dated 9 November 2018.
101 Exhibit 41, CB, Exhibit 45 – CCTV Compilation and Exhibit 46 – Aide Memoir to JSU CCTV Compilation.
102 Exhibit 35, Statements of Police Officer A1 and Police Officer B2 both dated 9 November 2018.
103 Exhibit 35, Statement of Police Officer A1 dated 9 November 2018.
104 Exhibits 35 and 34, Statements of Police Officer A1 and Police Officer B2, respectively, both dated 9 November 2018; Exhibit 41, CB, Statements of Aakash Verma dated 9 November 2018 and Jack Sinclair dated 10 November 2018.
105 Exhibit 34, Statement of Police Officer B2 dated 9 November 2018.
106 Exhibit 34, Statement of Police Officer B2 dated 9 November 2018.
107 Exhibit 35, Statement of Police Officer A1 dated 9 November 2018.
108 Transcript of the Inquest (T) page 651 (Police Officer B2), 611 (Sgt Walsh) and 622 (SC Hefferman); Exhibit 41, CB, Statements of Chunua Xue and Michael Turner both dated 9 November 2018.
109 Exhibit 41, CB, Statement of Michael Turner dated 9 November 2018.
110 Exhibit 34 and 31, Statements of Police Officer B2 and Sgt Christy Walsh, respectively, both dated 9 November 2018; Exhibit 41 CB, Statements of Jacob Zanatta, Aakash Verma, and Michael Turner each dated 9 November 2018.
111 Exhibit 34, Statement of Police Officer B2 dated 9 November 2018.
112 Exhibit 34, Statement of Police Officer B2 dated 9 November 2018.
Police Officer A1 then saw that Hassan was armed with a knife; almost simultaneously, Police Officer B2 shouted, ‘knife’.113 Both police members removed their extendible batons from their equipment belts; using their batons to create distance between themselves and Hassan, they renewed their attempt to cordon him on the northern footpath.114
Police Officer A1 directed Hassan to drop the knife, but he failed to do so.115 Hassan repeatedly approached the police members making slashing motions with the knife while the police members tried to knock the weapon from Hassan’s hand with their batons as the rolling confrontation continued across Bourke Street.116
Two off-duty police members117 and two members of the public118 intervened to assist Police Officers A1 and B2 to contain Hassan, shielding themselves with café chairs and a shopping trolley. The off-duty members urged Police Officers A1 and B2 to draw their firearms.119
Having been manoeuvred back towards the northern footpath, Hassan approached Police Officer B2, and with an overarm motion attempted to strike him with the knife.120 Retreating south, Police Office B2 deflected the blow with his baton.121 Hassan was quickly behind Police Officer B2, who observed him rushing at Police Officer A1 with his arm raised, and thrusting the knife downwards.122
Police Officer A1 unholstered his firearm, pointed it at Hassan’s abdomen and discharged the firearm once.123 Hassan ‘stopped on the spot’ and then fell to his knees on Bourke Street’s 113 Exhibit 35, Statement of Police Officer A1 dated 9 November 2018.
114 Exhibits 35 and 34, Statements of Police Officer A1 and Police Officer B2, respectively, both dated 9 November 2018; Exhibit 41, CB, Statement of Michael Shelton dated 9 November 2018.
115 Exhibit 35, Statement of Police Officer A1 darted 9 November 2018; Exhibit 41, CB, Statement of Denise Previti dated 9 November 2018.
116 Exhibit 41, CB, Statements of Katy-Jane Reid-Payne, Chunua Xue, Aakash Verma, Michael Turner, Denise Previti, Michael Shelton, Jack Agg and Martin Zdunczyk-Galasiinski each dated 9 November 2018; Exhibit 32, Statement of SC Lachlan Hefferman dated 12 November 2018.
117 Exhibit 31, Statement of Sgt Christy Walsh dated 9 November 2018; Exhibit 32, Statement of SC Lachlan Hefferman dated 12 November 2018.
118 Exhibit 41, CB, Statements of Jeferey Reid-Payne dated 9 November 2018 and Michael Rogers dated 21 November 2018.
119 Exhibit 31, Statement of Sgt Christy Walsh dated 9 November 2018; Exhibit 32, Statement of SC Lachlan Hefferman dated 12 November 2018.
120 Exhibit 35, Statement of Police Officer A1 dated 9 November 2018.
121 Exhibit 35, Statement of Police Officer A1 dated 9 November 2018.
122 Exhibit 34, Statement of Police Officer B2 dated 9 November 2018 123 Exhibit 35, Statements of Police Officer A1 and Police Officer B2 both dated 9 November 2018.
southern footpath near Royal Lane, but the knife remained in his hand.124 Two minutes had elapsed since the explosion.125
Critical Incident Response Team (CIRT) 383 comprising of Senior Constables (SC) Adam Sekoa, Longli Loei and Jesse Mahoney were patrolling the CBD near Federation Square in an unmarked vehicle when they heard Police Officer B2’s police radio transmission about a ‘vehicle on fire’.126 SC Sekoa directed driver SC Mahoney to activate the vehicle’s emergency lights and siren and attend the scene.127 As CIRT 383 were travelling along Swanston Street, they heard over the police radio that ‘someone had been stabbed’.128
As the CIRT 383 vehicle turned into Bourke Street, the burning ute was visible along with the police van;129 two uniformed members and about three people in plain clothes, one holding a chair, were all watching a man – Hassan – lying on the ground about five metres from them.130 At about 4.22pm, SC Mahoney parked the CIRT vehicle in the road between Hassan and the ute, from which explosions continued intermittently.131
The CIRT members alighted from their vehicle and adopted the ‘scratch taskings’132 previously agreed: SCs Loei and Mahoney unholstered their tasers and took up positions on the left and right of Hassan respectively while SC Sekoa drew his firearm and stood at Hassan’s feet.133 SC Sekoa demanded that Hassan drop the knife but he declined to do so and attempted to stand.134 SC Sekoa holstered his firearm, withdrew his taser, and again directed Hassan to drop the knife.135 SC Loei holstered his taser and withdrew his firearm to ensure lethal cover was maintained.136 124 Exhibit 35, Statement of Police Officer A1 dated 9 November 2018; Exhibit 41, Statement of Denise Previti dated 9 November 2018.
125 Exhibit 41, CB, Statement of DSC Michael Drew dated 15 September 2019 and Exhibit 45 – CCTV Compilation and Exhibit 46 – Aide Memoir to JSU CCTV Compilation.
126 Exhibit 38, Statement of SC Adam Sekoa dated 9 November 2018.
127 Exhibit 38, Statement of SC Adam Sekoa dated 9 November 2018.
128 Exhibit 38, Statement of SC Adam Sekoa dated 9 November 2018.
129 Exhibits 38, 36 and 37, Statements of SCs Adam Sekoa, Longli Loei and Jesse Mahoney, respectively, each dated 9 November 2018.
130 Exhibit 37, Statement of SC Jesse Mahoney dated 9 November 2018.
131 Exhibit 37, Statement of SC Jesse Mahoney dated 9 November 2018.
132 Exhibit 36, Statement of SC Longli Loei dated 9 November 2018.
133 Exhibit 37, Statement of SC Jesse Mahoney dated 9 November 2018.
134 Exhibit 38, Statement of SC Adam Sekoa dated 9 November 2018; Exhibit 41, Statements of Jeferey Reid-Payne and Michael Turner both dated 9 November 2018.
135 Exhibit 38, Statement of SC Adam Sekoa dated 9 November 2018.
136 Exhibit 36, Statement of SC Longli Loei dated 9 November 2018.
When Hassan failed to comply with the second demand to drop the knife, SCs Sekoa and Mahoney discharged their tasers at Hassan’s chest, with apparently good effect.137 However, Hassan did not drop the knife and so SC Sekoa deployed a second cartridge and Hassan then relinquished his weapon.138 When Hassan did not roll onto his stomach as directed, SC Sekoa ‘arced the taser’,139 sending an additional electrical current into Hassan’s body. SC Loei holstered his firearm, and with SC Mahoney, moved in to arrest Hassan.140 They rolled Hassan into a prone position and applied flexible restraints to his wrists.141
Off-duty police members, Sergeant (Sgt) Christy Walsh and SC Lachlan Hefferman, dragged Hassan into a laneway to provide shelter from debris discharged by explosions within the burning ute.142 SC Hefferman and Sgt Walsh, who knew Hassan had been shot, provided first aid; SC Hefferman applying pressure to Hassan’s chest wound while Sgt Walsh held his legs as he continued to struggle and repeat the phrase ‘Allahu Akhbar.’143
Additional Victoria Police units, and Ambulance Victoria and Metropolitan Fire Brigade (MFB) crews arrived at the scene. The MFB extinguished the ute fire, removed the LPG cylinders and cooled them to preserve evidence.144
Several witnesses had approached to provide first aid and comfort to Sisto before Hassan was arrested, among them intensive care nurse Lei Zhang, Maria Tutolomontoya, Aemon Davie, John Raygor and Christopher Couwenberg. Despite their efforts when paramedics assessed Sisto they found him deceased.145
Mssrs Patterson and Helal were taken by ambulance to the Alfred146 and Royal Melbourne147 hospitals respectively for treatment of their injuries.
After being treated at the scene by paramedics, Hassan was transported to the Royal Melbourne Hospital under police guard.148 He died during surgery that evening.149 137 Exhibit 38, Statement of SC Adam Sekoa dated 9 November 2018.
138 Exhibit 38, Statement of SC Adam Sekoa dated 9 November 2018.
139 Exhibit 38, Statement of SC Adam Sekoa dated 9 November 2018.
140 Exhibit 36, Statement of SC Longli Loei dated 9 November 2018.
141 Exhibits 36 and 36, Statements of SCs Longli Loei and Jesse Mahoney, respectively, each dated 9 November 2018 142 Exhibit 36, Statement of SC Longli Loei dated 9 November 2018.
143 Exhibit 32, Statement of SC Lachlan Hefferman dated 12 November 2018; Exhibit 33, Transcript of Interview with SC Lachlan Hefferman dated 9 November 2018. Translated, the phrase means ‘God is Greatest.’ 144 Exhibit 41, CB, Exhibit 49 – Metropolitan Fire Bridge (MFB) – Attendees and Duties.
145 Exhibit 41, CB, Statements of Paramedics Samantha Davis and Luke Sutter dated 5 and 15 March 2019 respectively.
146 Exhibit 41, CB, Statement of Dr Michael Weymouth dated 21 August 2019.
147 Exhibit 41, CB, Statement of Dr Sally Shepherd undated.
148 Exhibit 32, Statement of SC Lachlan Hefferman dated 12 November 2018; Exhibit 41, CB, Statement of SC Yasemin Dincer dated 1 December 2018.
On 10 November 2018, David Malaspina visually identified his father, Sestilio Malaspina, born 29 June 1944.
On 13 November 2018, Hassan Khalif Shire Ali, born 16 May 1988, was identified by fingerprint identification report and circumstantial evidence, including his Australian Passport, Victorian Drivers licence, Kenyan Drivers licence, and Victoria Police Report of Death Form No 83.
The identities of Sisto and Hassan were not in dispute and required no further investigation.
MEDICAL CAUSE OF DEATH Sestilio Malaspina
On 10 November 2018, Dr Heinrich Bouwer, a Forensic Pathologist practising at the Victorian Institute of Forensic Medicine, performed an external examination of Sisto’s body and reviewed the post-mortem computed tomography (CT) scans, Victoria Police Report of Death Form No 83 and Request for Autopsy to be Conducted.
The external examination showed a stab wound to the upper chest which had penetrated the chest cavity, injuring the vital internal organs. There was also a through-and-through stab wound on the left upper arm with the wound track extending from the tip of the shoulder to halfway down the arm. There were also some minor abrasions present on the left elbow.150
The post-mortem CT scans showed a right sided haemopneumothorax with haemorrhage in the mediastinal soft tissue, haemorrhage in the soft tissues of the neck, especially on the left, and blood in the large airways. 151
Toxicological analysis of post-mortem specimens did not detect alcohol, common drugs or poisons.152 149 Exhibit 41, CB, Statement of Dr Calvin Peng dated 8 April 2019.
150 Exhibit 41, CB, Medical Investigation Report of Dr Heinrich Bouwer dated 4 January 2019.
151 Incidental findings of bilateral kidney cysts and an intact abdominal aortic aneurysm were also made: Exhibit 41, CB, Medical Investigation Report of Dr Heinrich Bouwer dated 4 January 2019.
152 Exhibit 41, CB, Medical Investigation Report of Dr Heinrich Bouwer dated 4 January 2019.
Dr Bouwer provided a written report, dated 4 January 2019, which concluded that a reasonable medical cause of death was ‘1(a) Stab wound to the chest’. I accept Dr Bouwer’s opinion.153 Hassan Khalif Shire Ali
On 10 November 2018, Dr Heinrich Bouwer performed an autopsy on Hassan’s body and reviewed the post-mortem computed tomography (CT) scans, Victoria Police Report of Death Form No 83, Request for Autopsy to be Conducted, e-Medical Deposition, Ambulance Victoria report and medical records from Royal Melbourne Hospital.
The autopsy revealed a single gunshot entry wound on the right chest with the wound track extending slightly inwards and downwards towards the back where a metallic projectile was retrieved from the subcutaneous tissue. There was no exit wound. Along the path of the projectile, the anterior sixth rib was fractured, the lung, diaphragm and inferior vena cava were perforated and there was a significant laceration to the liver. There were associated haemopneumothoraces and a minor haemoperitoneum. There was also evidence of emergency medical thoracotomy and laparotomy procedures. In addition, there were partial thickness burns involving the head, hands and arms and four relatively round puncture marks on the left and right upper chest and left abdominal wall, consistent with being caused by a conducted electrical device (such as a taser or similar weapon).154
Toxicological analysis of ante-mortem specimens identified the presence of ketamine and lignocaine, consistent with medical treatment. No other common drugs, poisons or alcohol were detected.155
Dr Bouwer commented that the mechanism of death was cardiorespiratory collapse due to significant blood loss.156
Dr Bouwer provided a written report dated 25 June 2019, which concluded that a reasonable medical cause of death was ‘1(a) Gunshot wound to the chest’. I accept Dr Bouwer’s opinion.157 153 Exhibit 41, CB, Medical Investigation Report of Dr Heinrich Bouwer dated 4 January 2019.
154 Exhibit 41, CB, Medical Investigation Report of Dr Heinrich Bouwer dated 25 June 2019.
155 Exhibit 41, CB, Medical Investigation Report of Dr Heinrich Bouwer dated 25 June 2019.
156 Exhibit 41, CB, Medical Investigation Report of Dr Heinrich Bouwer dated 25 June 2019.
157 Exhibit 41, CB, Medical Investigation Report of Dr Heinrich Bouwer dated 25 June 2019.
Coronial Investigation
DSC Drew was appointed my Coronial Investigator and compiled a brief of evidence which, after incorporation of the products of further requisitions made at my direction, comprised of more than 100 witness statements, over 50 documentary exhibits and hours of multimedia exhibits. I acknowledge the work of DSC Drew and thank him for his assistance in this investigation.
With an investigation of this magnitude, it is appropriate that I acknowledge the significant work of all who were involved in assisting me.
I thank Counsel Assisting, Ms Catherine Fitzgerald, and the counsel and solicitors who represented the interested parties, for their work and comprehensive submissions.
I also acknowledge and thank Ms Samantha Brown, Principal Inhouse Solicitor and Ms Elizabeth Morris, Senior Coroners Solicitor, who have worked tirelessly and provided me with invaluable assistance in this investigation.
Other Investigations
As Hassan’s death resulted from a police shooting, investigators from the Victoria Police Professional Standards Command conducted oversight of the police investigation of his death.
Victoria Police’s operational response to the incident in Bourke Street on 9 November 2018 was the subject of an internal review by the Operational Safety Committee. I was provided with a copy of the Committee’s final report known as the Operational Safety Critical Incident Review (OSCIR).158
The Joint Counter Terrorism Team (JCTT), through its Operation Crabbenburg, also investigated the incident. The aim of Operation Crabbenberg was to identify the trigger for the attack in Bourke Street and to identify if anyone else had knowledge of it or had assisted 158 Exhibit 41, CB, Operational Safety Critical Incident Review.
Hassan. The JCTT operation sought to support that undertaken by Victoria Police (Operation Hom-Avant 2018) and ascertain the nature of any residual risk to the public. JCTT Officer B provided an overview of Operation Crabbenberg, which also involved a review of all JCTT holdings relating to Hassan from the Operation San Jose investigation of his brother.159
Neither the JCTT nor the Australian Federal Police undertook any internal review in relation to Hassan.160
Victoria Police did not undertake any formal review of the Security Intelligence Unit’s management of Hassan following the incident in Bourke Street on 9 November 2018. Though I was informed by Deputy Commissioner (DC) Peter Guenther that operating processes across counter terrorism command had been reviewed and ‘some different processes have been adopted’,161 DC Guenther intimated a review would ‘most likely’ occur at the conclusion of the coronial process.162 National Security and other matters
Some of the evidence relevant to my investigation of the circumstances of Sisto and Hassan’s deaths was sensitive. Broadly, these sensitivities arose when evidence related to national security, law enforcement methodology or because some law enforcement witnesses hold roles requiring a degree of confidentiality.
Accordingly, a number of applications were made to keep certain information confidential, suppress some evidence pursuant to section 18(2) of the Open Courts Act 2013 and protect the identity of some witnesses by the use of pseudonyms. After consideration of open and confidential affidavits and written and oral submissions in respect of many of those applications, the coronial brief was distributed with redactions, I determined claims of public interest immunity, made proceeding suppression orders163 in relation to some evidence and 159 Exhibits 24, 25, 26, 27 and 28, Statements of JCTT Officer B dated 5 July 2019, 13 July 2020 and 16 October 2020 and annexures.
160 Exhibit 28, Statement of JCTT Officer B dated 16 October 2020.
161 T359 (DC Guenther); Exhibits 17 and 18, Statement of DC Guenther dated 5 November 2020 and annexures.
162 T359 (DC Guenther).
163 A proceeding Suppression Order was made pursuant to s 18(2) of the Open Courts Act 2013 (Vic) on 23 November 2020 (and amended on 27 November 2020). Some national security classified information was provided to me pursuant to a Confidentiality and Non-Publication Order dated 23 November 2020 (and amended on 3 December 2020). An Interim Suppression Order had been in place in similar terms from 26 August 2020.
issued pseudonym orders to protect some witnesses.164 It was also necessary to hear some testimony in closed court.165
Pursuant to section 52(2) of the Act, I was required to hold an inquest into the deaths of Sisto and Hassan. The manner of each death was homicide and no indictable charge connected with either death was laid.
The events immediately proximate to the deaths of Sisto and Hassan were uncontroversial, having been captured in closed circuit television, security and mobile phone footage and described in the uncontested statements of tens of eyewitnesses. Nonetheless, in common with many other coronial investigations, the focus of the coronial investigation and inquest into their deaths was the circumstances in which each man died.
Although occurring on the same day and arising from the same incident, the circumstances of Sisto and Hassan’s deaths were very different. My investigation necessarily focused on events leading up to the incident on 9 November 2018 in an effort to elucidate how and why Hassan came to commit the attack on members of the public, the nature of the attack, what was known of Hassan by law enforcement and intelligence agencies, and what was done in response. The purpose of these inquiries was to determine what, if any, prevention opportunities arise so that others will not lose their life in circumstances similar to those in which Sisto’s death occurred and, indeed, to identify whether opportunities to prevent Hassan’s death existed.
The scope of the inquest included: a. the assessment and management of information about Hassan that was known to the Victoria Police, Australian Federal Police and Australian Security Intelligence Organisation (ASIO) including: i. adverse security assessment and cancellation of his passport in July 2015; 164 Pseudonym Orders were made to protect the identities of certain SIU, CVE Unit and JCTT personnel on 18 August 2020, and in respect of Sheikh A and Police Officers A1 and B2 in separate orders dated 10 November 2018.
165 Closed Court Orders were made pursuant to s 30 of the Open Courts Act 2013 (Vic) on 24, 25 and 27 November and 4 and 5 December 2018 in respect of some parts of the evidence heard on those days.
ii. communication of key information between agencies; iii. interactions between Hassan and Victoria Police in the months leading up to the incident on 9 November 2018 including:
traffic stop on 16 July 2017; and
traffic stop and roadside bail hearing on 12 October 2018; b. relevance of the ‘National Security’ flag on LEAP and Victoria Police policies, processes and training in relation to this flag; c. whether intelligence and security agencies adequately assessed the risk to public safety posed by Hassan; d. availability of de-radicalisation opportunities; e. decision not to refer Hassan to the Countering Violent Extremism Program during the period between the adverse security assessment and the incident on 9 November 2018; f. the response by Victoria Police to the incident on 9 November 2018 including: i. the adequacy of tactical options available to responding police members, including:
the efficacy of baton and OC spray in response to assault with a knife; and
deployment and training of tasers (CEDs) to operational General Duties members; and ii. use of emergency radio code and emergency distress buttons; g. whether the incident was a terrorist incident including: i. whether Hassan suffered from any diagnosed mental illness or personality disorder proximate to the incident and, if so, whether this played any causal role; ii. Hassan’s apparent intent or motivation; and iii. if, when and how Hassan became radicalised; and h. identification of prevention opportunities.
The evidence in relation to the issues within the scope of the inquest will be canvassed in the sections that follow, namely, management of Hassan and assessment of intelligence about him, the Victoria Police response to the incident on 9 November 2018 and whether the incident was a ‘terrorist incident’.
MANAGEMENT OF HASSAN AND ASSESSMENT OF INTELLIGENCE ABOUT HIM Counter Terrorism Law Enforcement Framework
Counter Terrorism Command Overview
The Victoria Police Counter Terrorism Command (CTC) is responsible for protecting the State of Victoria against terrorism, threats of terrorism, managing risks to infrastructure, and collecting, assessing and disseminating counter terrorism intelligence.166
The CTC focuses on prevention, protection, disruption and response, namely: a. stopping individuals becoming terrorists or supporting violent extremism; b. reducing Victoria’s vulnerability to acts of terrorism and violent extremism; c. identifying and disrupting specific threats of terrorism and other forms of violent extremism; and d. managing the short- and long-term consequences of acts of terrorism or violent extremism.167
The CTC comprises three divisions; Operations, Capability and Business Services.168
The Operations Division consists of the Joint Counter Terrorism Team and the Security Intelligence Unit. It is responsible for providing operational and intelligence management of counter terrorism investigations and incidents. 169 166 Exhibit 15, First Statement of Assistant Commissioner Peter Guenther dated 2 March 2020; Exhibit 19, Counter Terrorism Command Security Intelligence Unit National Security Persons of Interest (NSPOI) Management Standard Operating Procedures (SIU SOPs).
167 Exhibit 16, Victoria Police Counter Terrorism Strategy 2018 – 2021.
168 Exhibit 15, First Statement of Assistant Commissioner Peter Guenther dated 2 March 2020.
The Capability Division consists of the Specialist Intelligence Team, Capability Unit, Counter Terrorism Coordination Unit, the Countering Violent Extremism Unit and the Victorian Fixated Threat Assessment Centre. The Capability Division is responsible for ensuring highly coordinated prevention, preparedness and response arrangements for any threat or act of terrorism in Victoria.170
The Business Services Division provides business support services to all employees of the CTC.171 Joint Counter Terrorism Team
The Joint Counter Terrorism Team (JCTT) is a multi-agency taskforce comprising the Australian Federal Police, Australian Security Intelligence Organisation (ASIO) and the state police for the relevant state, in this case, Victoria Police. The agencies collaborate to investigate and disrupt potential domestic terrorist threats or attacks.172 The JCTT is charged with investigating criminal offences, amongst other matters, looking beyond extreme ideology to a desire and capability to carry out a terrorism offence.173
The JCTT Operations Coordination Group (OCG) is representative of the agencies operating in the national security space, and determines if a matter or an individual should become an investigative subject of the JCTT.174 The OCG makes recommendations to the Joint Management Committee, comprising of representatives from the three agencies, which in turn decides what action will be taken by the JCTT.175
The JCTT is not based within the Victoria Police Centre with the rest of the CTC, but operates from the Australian Federal Police building.176 JCTT does not proactively disclose information gleaned from its investigations to other agencies such as the SIU as a matter of course but will provide information upon request from its partners.177 Information sharing 169 Exhibit 15, First Statement of Assistant Commissioner Peter Guenther dated 2 March 2020.
170 Exhibit 15, First Statement of Assistant Commissioner Peter Guenther dated 2 March 2020.
171 Exhibit 15, First Statement of Assistant Commissioner Peter Guenther dated 2 March 2020.
172 Exhibit 24, First Statement of JCTT Officer B dated 8 March 2019.
173 T535 (JCTT Officer B).
174 T282 (SIU Officer E).
175 T384 (DC Guenther).
176 T412 (DC Guenther).
177 T536-8 (JCTT Officer B).
does not extend to conducting a comprehensive review of holdings of investigations, such as that undertaken by the JCTT following the incident in Bourke Street on 9 November 2018.178 Security Intelligence Unit
The Security Intelligence Unit (SIU) monitors, assesses and manages individuals who, due to exhibiting behaviours consistent with an extremist ideology, pose a national security risk.179 The SIU is the main collector of counter terrorism intelligence within Victoria Police.180 It gathers and disseminates intelligence and advice to Victoria Police decision makers about security-related matters in order to prevent acts or threats of terrorism.181
National security classified information is communicated to and from ASIO and its federal and state law enforcement partners, including the SIU, through the Australian Secret Network (ASNET), an Australian Commonwealth Government information technology communications platform governed by (among other things) the Information Systems – Security Practices and Procedures policy of the Department of Home Affairs. Access to classified information on ASNET is limited to individuals who ‘need-to-know’ or use it to perform their work; arrangements for the handling and use of ASNET information are designed to prevent unauthorised extraction, copying and alteration of that material.
In practice, permanent members of the SIU with appropriate security clearance have access to ASNET,182 the terminal for which is housed in a secure location. Each day, an analyst is tasked to check ASNET for fresh information about National Security Persons of Interest (NSPOI) managed by the SIU. The analyst provides an update via email indicating the existence (but not the content) of such intelligence.183 The NSPOI’s dossier on ASNET is subsequently updated, with the intelligence remaining on that secure system.184 The NSPOI’s Interpose record185 is updated to reflect that there is information held on ASNET.186 178 T537 (JCTT Officer B).
179 Exhibit 19, SIU SOPs.
180 T182 (SIU Officer A).
181 Exhibit 9, First Statement of SIU Officer A dated 9 August 2019; Exhibit 15, First Statement of Assistant Commissioner Peter Guenther dated 2 March 2020; Exhibit 19, SIU SOPs.
182 T236 (SIU Officer A).
183 T236, 238-9 (SIU Officer A).
184 T237 (SIU Officer A).
185 Interpose is a secure database designed to record information and details of specific police investigations or operations and contains intelligence briefs and target profiles; in practice, Interpose is where the SIU record (nonclassified) information about each NSPOI it manages: Exhibits 15 and 16, First Statement of Assistant Commissioner Peter Guenther dated 2 March 2020 and its annexures.
SIU’s primary role is intelligence investigation to detect individuals on a radicalisation trajectory, rather than to conduct criminal investigations. Where the SIU has identified a person of interest who appears to be planning or preparing to commit a terrorism offence, it will refer the matter to the JCTT for criminal investigation.187
SIU investigations target individuals who have been assessed as a NSPOI.188 A NSPOI includes an individual who displays traits equivalent to indicators described in the Australia New Zealand Counter Terrorism Command Committee Person of Interest Security Prioritisation Tool (ANZCTC tool), or who have been referred to Victoria Police by ASIO but have not yet undergone such an assessment.189
The SIU uses the ANZCTC tool to aid decision making about investigation, management, and prioritisation of NSPOIs. The ANZCTC tool assists the SIU to determine a NSPOI’s threat profile (that is, an evaluation of the national security risk posed by the individual) and so his or her priority as a NSPOI.190 Whilst the tool does not mandate specific case management activities, it was designed to provide a standardised and consistent model for the preinvestigation of persons of interest relevant to counter terrorism.191 Countering Violent Extremism Unit
The Countering Violent Extremism Unit (CVE or CVE Unit) identifies individuals at risk of radicalisation to violent extremism and provides intervention services.192 It works with police, the community and government to deliver intervention programs and services to individuals who hold an extremist ideology, are radicalised, or are at risk of being radicalised.
CVE intervention is designed to connect at-risk individuals with diversionary programs and initiatives to disengage them from violent extremism and suppress the radicalisation process.
The CVE Unit triages individuals referred to its programs to determine their suitability for CVE intervention. In some instances, the CVE Unit may require further information or 186 T237-8 (SIU Officer A).
187 T535 (JCTT Officer B).
188 Exhibit 15, First Statement of Assistant Commissioner Peter Guenther dated 2 March 2020; Exhibit 19, SIU SOPs.
189 Exhibit 15, First Statement of Assistant Commissioner Peter Guenther dated 2 March 2020; Exhibit 19, SIU SOPs.
190 Exhibit 19, SIU SOPs.
191 Exhibit 19, SIU SOPs.
192 Exhibit 19, SIU SOPs.
intelligence to better-assess whether the individual should be considered for CVE intervention.193
CISP provides intervention services to individuals at risk of radicalisation to Islamist forms of violent extremism. It was initially established as a prison-based terrorist disengagement program but was expanded in October 2015 to include a community-based disengagement program.194 Participation in the CISP is voluntary. However, prisoners convicted of terrorism offences must undertake the program to be eligible for parole.195
The CVE Unit also provides linkages to other intervention services such as those offering vocational training, counselling, mentoring and community support.196 Primacy of investigations
In certain cases, one counter terrorism entity may have investigative primacy, or take the ‘lead role’ in an investigation of a NSPOI.197 This ensures that investigations are not hindered by the actions of other security or investigative agencies – a process known as deconfliction.198
The agency with primacy will have the ‘first say’ on what actions are to occur with a person of interest.199 This does not mean that there is an all-time prohibition on other agencies conducting investigations, rather that there is a need to consult and discuss proposed activities with the lead investigating agency.200 In the case of investigations by the JCTT, approval must be obtained via the OCG before action can be taken by other agencies.201 193 Exhibit 15, First Statement of Assistant Commissioner Peter Guenther dated 2 March 2020.
194 Exhibit 15, First Statement of Assistant Commissioner Peter Guenther dated 2 March 2020.
195 Exhibit 15, First Statement of Assistant Commissioner Peter Guenther dated 2 March 2020.
196 Exhibit 15, First Statement of Assistant Commissioner Peter Guenther dated 2 March 2020.
197 T247 (SIU Officer A).
198 T275 (SIU Officer E).
199 T100 (SIU Officer 23).
200 T275, 291 (SIU Officer E); T248-9 (SIU Officer A); T409-10 (DC Guenther).
201 T85 (SIU Officer 23); T282-3, 333 (SIU Officer E).
The SIU’s Operating Procedures
As mentioned above, the SIU’s role in the CTC is the collection and dissemination of ‘timely and accurate’ intelligence about security-related matters in Victoria to prevent threats or acts of terrorism.202 The officer in charge of the SIU is a Detective Inspector responsible for the day to day activities of the unit,203 with three Detective Senior Sergeants (DSS), and in the case of the analyst team, a Manager Analyst, overseeing the activities of a number of teams or ‘crews’ managing NSPOIs. Each crew comprises of a Detective Sergeant, several investigators of the rank of Detective Senior Constable and an analyst.204 The roles of crew analyst and investigators are intended to be complementary, with investigators performing investigative functions associated with monitoring and managing NSPOIs – usually fieldwork and proactive intelligence gathering – and analysts developing intelligence and generating intelligence products to support investigators.205 Crews also have the benefit of the expertise of two SIU psychologists to provide a psychological perspective on NSPOI management.206
At the relevant time, the SIU’s operations were governed by the Victoria Police Manual – particularly those parts relating to Person of Interest and Person Warning Flags, Intelligence, Reporting Contact and Intelligence and Tasking and Coordination (T&C)207 – and Standard Operating Procedures (SOPs) first issued on 18 June 2018.208
The SIU’s SOPs acknowledge there is ‘no possibility’ of eliminating the risk of terrorism and so allocation of resources to individuals or groups that represent a ‘greater relative risk’ is ‘essential.’209 The objective of the SOPs is therefore to provide a standardised process for assessing and prioritising NSPOIs such that there is a coordinated and consistent approach with intelligence partners that minimises duplication of effort and enhances accountability and transparency of NSPOI management activities.210 In short, the SOPs aim to achieve the SIU’s 202 Exhibit 15, First Statement of Assistant Commissioner Peter Guenther dated 2 March 2020.
203 Exhibit 9, First Statement of SIU Officer A dated 9 September 2019.
204 Victoria Police Counter Terrorism Command Organisational Chart (not formally tendered but provided during the inquest).
205 Exhibit 19, SIU SOPs.
206 Exhibit 19, SIU SOPs.
207 Exhibit 15, First Statement of Assistant Commissioner Peter Guenther dated 2 March 2020.
208 Exhibit 19, SIU SOPs.
209 Exhibit 19, SIU SOPs. I note that although the SOPs speak in terms of ‘risk’ the ANZCTC tool is described as contributing to the development of a ‘threat profile’ and so I have adopted that terminology instead.
210 Exhibit 19, SIU SOPs.
objective and minimise risk to the Victorian community by adherence to process, diligent analysis and investigation, and application of professional judgement.211
The SOPs describe the processes involved within SIU from activation/triage of a NSPOI and initial investigation through assessment and management/treatment (including escalation and de-escalation), and deactivation. Active investigations – those in which activities are undertaken to manage a NSPOI’s risk – involve varying levels of activity and resource allocation commensurate with the threat profile identified. Broadly, the levels of activity (also known as ‘treatment options’) are monitoring, intelligence investigation and criminal investigation.212
Assessment of the NSPOI’s threat profile is, therefore, central to determining the appropriate treatment and, in turn, the allocation of resources to manage the threat. The SOPs describe an assessment process that involves three interrelated steps undertaken by the ‘crew analyst’ involving use of a ‘highly structured’ tool, ‘professional judgement’ and ‘interpretation’.213 First, the analyst uses the ANZCTC tool to generate a staged assessment of the NSPOI’s radicalisation which will be used as a ‘guide’ to identify the ‘initial treatment’ option; generally the initial treatment should correspond to the highest indicator stage identified.214 Next, the analyst categorises the NSPOI’s dominant risk type: the SOPs note that there are very few indicators in the ANZCTC tool to assist this process and that some risks are more concerning than others; a ‘judgement call’ based on the analyst’s knowledge, experience and available intelligence is encouraged.215 Finally, the analyst will make an ‘assessment/recommendation’ about a ‘final treatment’ option, which is forwarded to the crew sergeant for review and validation before being entered into the NSPOI’s ANZCTC tool assessment.216
‘Final validation’ of recommendations arising from NSPOI assessment, including the final treatment recommendation, occurs at a NSPOI Allocation Meeting convened on an ‘as needs’ basis and attended by analyst and detective senior sergeants, though other units and agencies may be represented.217 The outcomes of such meetings are: determination that the NSPOI 211 Exhibit 19, SIU SOPs.
212 Exhibit 19, SIU SOPs.
213 Exhibit 19, SIU SOPs.
214 Exhibit 19, SIU SOPs.
215 Exhibit 19, SIU SOPs.
216 Exhibit 19, SIU SOPs.
217 Exhibit 19, SIU SOPs.
‘does not meet the threshold for investigative attention, or intelligence gaps remain’218 whereupon the matter is referred to the crew sergeant with ‘appropriate instructions’ or the final treatment option recommended is approved whereupon the matter is allocated to an investigative crew for management. Where a criminal/intelligence investigation treatment option is approved, the NSPOI is referred to T&C Meetings given the resource implications.
Deactivation and de-escalation of current NSPOIs may also be considered at NSPOI Allocation Meetings.219 Neither of these meeting types were in operation between July and November 2018 or used in relation to Hassan’s management.220
The SOPs identify the responsibilities of crew analysts, investigators, crew sergeants and senior sergeants and require that key decisions are ‘validated’ by supervisors – sergeants, senior sergeants or managers.221 That said, the SOPs establish no expectations about timeliness of task completion, follow-up or review nor any guidance about how the SIU should interface with the CVE Unit.
Notwithstanding the implementation of the SOPs in June 2018, the impression left by witnesses from the SIU (except SIU Officer A) was that there was not much in the way of formal procedure at the SIU at the time.222 There was no automated reminder system223 to ensure timely completion of tasks or periodic review,224 particularly after T&C Meetings were suspended,225 such that managing individual NSPOI files ‘largely fell to the person with primary responsibility for it.’226 It was not easy to divine who had primary responsibility for files. According to SIU Officer A, it was a team’s Detective Sergeant who was responsible for management of the NSPOIs allocated to her/his team.227 Both SIU Officer E and SIU Officer 23 – both Detective Senior Sergeants – referred to having management or oversight of 218 Exhibit 19, SIU SOPs. It seems to me that while these outcomes are both ‘non-approval’ of a final treatment option, the implications of each are quite different – the latter (intelligence gaps remain) suggestive of a need to return to a NSPOI Allocation Meeting at some unspecified future point.
219 Exhibit 19, SIU SOPs.
220 I note that the evidence of SIU Officer A appears to conflict with the SIU SOPs: she indicated that ‘NSPOI Management Meetings’ were reconvened in July 2018 but because their purpose was adding or removing individuals to/from the NSPOI List’ they weren’t relevant to Hassan’s management: he remained an NSPOI until his death – Exhibit 10, Second Statement of SIU Officer A dated 26 October 2020.
221 Exhibit 19, SIU SOPs.
222 T76 (SIU Officer 23). Indeed, SIU Officer 23 testified that he was unaware there were SOPs while he was working in the SIU: T46.
223 T81 (SIU Officer 23).
224 T110 & T79 (SIU Officer 23).
225 T110 (SIU Officer 23).
226 T79 (SIU Officer 23).
227 T228 (SIU Officer A); DC Guenther said that SIU Officer E was the responsible member – T381 (DC Guenther).
investigative teams228 and made ‘Investigation Manager Comments’ in Hassan’s Interpose record. That said, SIU Officer 23 conceded that for the period he had oversight he had no sense of what actions, if any, the team was undertaking about Hassan’s file.229 Hassan’s management by the SIU
Passive monitoring & Investigative Primacy
229 T75 & 78 (SIU Officer 23).
230 Exhibit 24, First Statement of JCTT Officer B dated 5 July 2019.
231 A NSPOI Warning Flag is one of the Person of Interest flags that can be applied to an individual recorded in LEAP; it will be evident when a police member performs a LEAP name check. The applicable Victoria Police Manual procedure – Person of Interest and person warning flag – indicates that NSPOI flags are set and managed by the SIU.
The NSPOI flag is used to alert police members (1) that the individual is a national security person of interest; (2) that police should be vigilant about their safety when interacting with a NSPOI; (3) to submit an Information Report (IR) to report intelligence arising from the interaction and police are trained not to alert the NSPOI that they are flagged as a
232 PAMS: Proactive Alert Monitors.
233 PACE: Passenger Analysis and Clearance Evaluation.
234 Exhibit 16, Bundle of Attachments to First Statement of Assistant Commissioner Peter Ross Guenther.
235 Exhibit 16, Bundle of Attachments to First Statement of Assistant Commissioner Peter Ross Guenther. The Target Profile was last updated in about September 2017 at which point ‘significant intelligence gaps’ were noted in relation to Hassan’s views on violent extremism.
236 Exhibit 15, First Statement of Assistant Commissioner Peter Ross Guenther dated 2 March 2020 and T247 ‘investigations that can be performed from a desk’ (SIU Officer E); T244-5 ‘most activities’ were restricted by the requirement to passively monitor, the parameters of which were ‘dictated by ASIO’ (SIU Officer A).
237 Exhibit 15, First Statement of Assistant Commissioner Peter Ross Guenther dated 2 March 2020.
238 Exhibit 41, CB, page 3248.
Hassan. Activities that were not restricted included monitoring Hassan’s social media activity and maintenance of Interpose and LEAP alerts so that if general duty police had incidental contact with Hassan, the SIU could liaise with them to obtain intelligence.239
ASIO/JCTT had investigative primacy over Hassan even though he was never a target of the operation.241
Notwithstanding the constraints on SIU activities due to JCTT/ASIO’s investigative primacy and the request for passive monitoring of Hassan, it was understood within the SIU that neither would prevent it from consulting its intelligence partners about whether a direct approach or particular investigation could proceed if there were a legitimate reason to do so.242 Indeed, Interpose reveals a few occasions in September and October 2016 and September 2017 when consultations occurred between the SIU and its intelligence partners about engaging in more active forms of investigation – all of which were ultimately discouraged.243
During Operation San Jose, the SIU was involved in analysis of Hassan’s mobile phone data, relaying relevant information to the JCTT and ASIO.244 The SIU also continued to passively monitor Hassan throughout Operation San Jose, which revealed that Hassan had had contact with general duty police eight times between June 2016 and October 2017 for driving offences and possession of illicit drugs.245
Interpose notes for a T&C Update dated 5 September 2017 document that there were three outstanding warrants for Hassan’s arrest246 following his failure to attend court (several times) 239 Exhibit 15, First Statement of Assistant Commissioner Peter Ross Guenther dated 2 March 2020. If general duty members perform a LEAP check on a person with a NSPOI Warning Flag, s/he is directed to submit an Information Report (IR).
240 Exhibit 27, Third Statement of JCTT Officer B dated 16 October 2020.
241 Exhibit 25, Second Statement of JCTT Officer B dated 13 July 2020.
242 T247 (SIU Officer A); T275 (SIU Officer E); and T54 (SIU Officer 23).
243 Exhibit 41, CB, pages 3477, 3480 and 3481 (Hassan’s Interpose file): see for instance Interpose entries for 12 and 19 January 2016, 7 September 2016 and 13 October 2018.
244 Exhibit 15, First Statement of Assistant Commissioner Peter Ross Guenther dated 2 March 2020.
245 Exhibit 15, First Statement of Assistant Commissioner Peter Ross Guenther dated 2 March 2020.
246 Exhibit, 41, CB, page 3491 (Hassan’s Interpose file).
in relation to driving offences alleged to have been committed in June and August 2016.247 Included in the note is that ‘notification [is] attached to warrants on LEAP, to contact SIU upon executing same.’248 The note of the T&C Meeting on 7 September 2017 indicates that ‘warrant execution [was] to be discussed at OCG,’ with the matter to be followed up by SIU Officer 36.249 The Interpose record is silent as to whether the matter was ever discussed by the OCG, and if so, what occurred; it may be that an OCG referral was overtaken by events.
On 9 September 2017, Hassan was intercepted by general duty police while driving north of Melbourne.250 Upon ascertaining his identity and that there were outstanding warrants for his arrest, Hassan was taken to Epping police station251 where (at least one) warrant252 was executed and he was released on bail to appear at Werribee Magistrates’ Court on 5 February 2018.253 The SIU Interpose record shows this information was added as a T&C Update on 4 October 2017 along with information about the recent birth of Hassan’s child, and additional contacts with police.254 Information Report 16 September 2017
Following a field contact between Victoria Police’s Operations Response Team (ORT) and Hassan, on 16 September 2017, an Information Report (IR) was submitted.255 The ORT had intercepted Hassan in his vehicle which was parked under an overpass near the Maribyrnong River. A search of the vehicle revealed a small amount of green vegetable matter (in relation to possession of which Hassan was cautioned) and a sheaf of papers ‘quoting Islamic teachings … with references to … divine destinies and slaughtering within the text’ which were photographed surreptitiously and attached to the IR.256 Hassan was ‘co-operative’, 247 Exhibit 41, CB, pages 3382-3442 (Additional CCP documents) relating to the outstanding matters where the Informants are Gilman, Gribble and Sandhu).
248 Exhibit, 41, CB, page 3491 (Hassan’s Interpose file).
249 Exhibit, 41, CB, page 3491 (Hassan’s Interpose file).
250 Exhibit, 41, CB, page 3492 (Hassan’s Interpose file) information noted in a pre-T&C Meeting entry dated 4 October 2017.
251 Exhibit 41, CB, page 3800 (Additional LEAP records relating to Hassan).
252 Exhibit, 41, CB, page 3492 (Hassan’s Interpose file).
253 Exhibit 41, CB, page 3382 (Additional CCP documents) relating to the outstanding matter where the Informant is Gilman.
254 Exhibit, 41, CB, page 3492 (Hassan’s Interpose file), the Interpose note refers to the police contacts with Hassan on 9, 10 and 16 September 2017.
255 Exhibit 29, Statement of SC Melissa Mark dated 12 March 2019.
256 Exhibit 18, Bundle of Attachment to Second Statement of Assistant Commissioner Peter Ross Guenther (PRG-8,
confirming address and phone details already on LEAP, employment involving ‘large trucks’ and that he was ‘struggling with’ his faith.257
SIU Officer 36 reviewed the IR on 11 October 2017, noting a partner agency’s request for a copy at a T&C Meeting the previous week, and obtaining SIU Officer D’s approval to disseminate the IR.258 SIU Officer 49 updated Hassan’s profile and made inquiries to identify an Imam Hassan had mentioned to the ORT.259 The Imam was presumptively identified as Sheikh A by JCTT Officer 77 on 17 October 2017.260
On 19 October 2017, CVE Officer 78 sought SIU advice about whether Hassan ‘could be engaged by CISP.’261
On 25 November 2017, SIU Officer 36 reviewed CVE Officer 78’s note and commented that before any CVE referral was made the decision ‘may be one that needs to be made at the OCG’ because Operation San Jose would enter its resolution phase the following week, during which it was anticipated Hassan would be arrested.262
The same day, the query was forwarded to SIU Officer D for ‘consideration to brief SIU Officer A to raise this matter at the OCG’.263 SIU Officer D concurred that there be ‘nil further CVE action until the matter is taken before OCG’ and tasked SIU Officer 36 to update the CVE Unit.264 The Interpose record is silent as to whether the matter was ever discussed by the OCG or indeed if SIU Officer 36 updated the CVE Unit.265 257 Exhibit 18, Bundle of Attachment to Second Statement of Assistant Commissioner Peter Ross Guenther (PRG-8,
PRG-9, PRG-10) 258 Exhibit 18, Bundle of Attachment to Second Statement of Assistant Commissioner Peter Ross Guenther (PRG-8,
259 Exhibit 18, Bundle of Attachment to Second Statement of Assistant Commissioner Peter Ross Guenther (PRG-8,
260 Exhibit 18, Bundle of Attachment to Second Statement of Assistant Commissioner Peter Ross Guenther (PRG-8,
261 Exhibit 18, Bundle of Attachment to Second Statement of Assistant Commissioner Peter Ross Guenther (PRG-8,
262 Exhibit 18, Bundle of Attachment to Second Statement of Assistant Commissioner Peter Ross Guenther (PRG-8,
263 Exhibit 18, Bundle of Attachment to Second Statement of Assistant Commissioner Peter Ross Guenther (PRG-8,
264 Exhibit 18, Bundle of Attachment to Second Statement of Assistant Commissioner Peter Ross Guenther (PRG-8,
265 T86 (SIU Officer 23).
It was common ground at the inquest that a possible CVE referral was never considered by the OCG; DC Guenther was unable to offer any explanation266 but refused to characterise it as an oversight,267 while SIU Officer A testified that the OCG was not designed to consider issues of this type, only deconfliction between the SIU, JCTT and ASIO.268
On 27 November 2017, the SIU was involved in execution of a search warrant at Hassan’s home during the resolution phase of Operation San Jose.269
T&C Meetings relating to Hassan’s management were documented monthly in Interpose between 3 June 2016 and 18 January 2018.270 T&C Meetings between June and October 2016 were only attended by SIU personnel271 and neither ASIO nor JCTT were represented at any documented T&C Meeting after 30 November 2017272 when resolution of Operation San Jose was discussed.273 The action items generated by the T&C Meetings were few and primarily related to the relay of intelligence received by the SIU about Hassan via general duty police to its counter terrorism partners.274
T&C Meetings were suspended in February 2018,275 due to attendees having to refer to ‘two different lots of terminology’ because some NSPOIs continued to be prioritised using the SPT while others had been transitioned to the ANZCTC tool.276 SIU Officer A testified that suspension of the T&C Meetings ‘did not involve a suspension of the management of NSPOIs or of tasking and co-ordination duties for the work unit.’277
On 13 February 2018, SIU Officer 49 noted that the result of raising the issue of Hassan’s referral to the CVE Unit at the OCG was ‘pending.’278 The 16 September 2017 IR therefore remained open/active on Interpose.
266 Exhibit 17, Second Statement of Assistant Commissioner Peter Ross Guenther, dated 5 November 2020.
267 T394-5 (DC Guenther).
268 T229-230 (SIU Officer A).
269 Exhibit 15, Statement of Assistant Commissioner Peter Ross Guenther, dated 2 March 2020.
270 Exhibit 41, CB, see generally pages 3478-3496 (Hassan’s Interpose file).
271 Exhibit 41, CB, see generally pages 3478-3481 (Hassan’s Interpose file).
272 Exhibit 41, CB, see generally pages 3494-3496 (Hassan’s Interpose file).
273 Exhibit 41, CB, page 3494 (Hassan’s Interpose file).
274 Exhibit 41, CB, see generally pages 3478-3496 (Hassan’s Interpose file).
275 Exhibit 41, CB, page 3496 (Hassan’s Interpose file); Exhibit 10, Second Statement of SIU Officer A dated 26 October 2020.
276 T224 (SIU Officer A).
277 Exhibit 10, Second Statement of SIU Officer A dated 26 October 2020; T463 (SIU Officer A).
278 Exhibit 18, Bundle of Attachment to Second Statement of Assistant Commissioner Peter Ross Guenther (PRG-8,
On 16 February 2018, SIU Officer 48 noted that no T&C Meeting occurred as scheduled in accordance with SIU Officer A’s unit-wide directive. The next Interpose comment, documenting a change of investigator by SIU Officer E, was dated 12 June 2018.279
In this intervening period, two DSSs stationed at the SIU – SIU Officer E280 and SIU Officer 23281 – each undertook a review of all NSPOI files allocated to him for management or supervision.282 SIU Officer E conducted the review of his own initiative to familiarise himself with each investigation managed by his team, Team 1, including Hassan’s, and ‘identify any opportunities that … hadn’t been explored [to] that point.’283 The purpose of SIU Officer 23’s management audit was to determine if each file was active, inactive or complete.284 SIU Officer 23 reviewed Hassan’s file in early July 2018 at about the time the ANZCTC tool assessment of him was available to investigators.285 Transition from SPT to ANZCTC tool
Between January and about June 2018, the SIU transitioned from use of the SPT to the ANZCTC tool to prioritise NSPOIs. The SPT was regarded as using ‘language that … could be misinterpreted,’ namely the categorisation of individuals as ‘low, medium, [or] high’286 risk of engaging in politically motivated violence, and because it mandated specific responses for each category, it was considered ill-suited to a counter terrorism environment with an increased operational tempo inclusive of a large number of NSPOIs.287
The ANZCTC tool is described as a ‘nationally consistent prioritisation tool’288 but Victoria is the only jurisdiction to use the tool ‘in its entirety’.289 It is regarded as a more nuanced290 and accurate291 assessment tool that enables agencies to use ‘collective intelligence to assess the 279 Exhibit 41, CB, see generally pages 3496 (Hassan’s Interpose file).
280 February to June 2018: Exhibit 13, Statement of SIU Officer E dated 2 October 2020.
281 4 June to 29 August 2018: Exhibit 1, Statement of SIU Officer 23, dated 30 September 2020.
282 Exhibit 13, Statement of SIU Officer E dated 2 October 2020. Another management audit of files including Hassan’s was conducted in July 2018 by SIU Officer 23: Exhibit 1, Statement of SIU Officer 23 dated 30 September 2020.
283 T267 (SIU Officer E).
284 Exhibit 1, Statement of SIU Officer 23 dated 30 September 2020 285 Exhibit 1, Statement of SIU Officer 23 dated 30 September 2020 286 SIU Analyst Manager T24. The SIU Analyst’s evidence was provided in closed court but part of his evidence, and so the transcript, can be referred to publicly. Transcript references to the SIU Analyst Manager’s evidence will be referenced in the format, “SIU Analyst Manager Tpp” to differentiate it from the rest of the open court transcript.
287 SIU Analyst Manager T24; Exhibit 15, First Statement of Assistant Commissioner Peter Ross Guenther dated 2 March 2020 and T386 (DC Guenther).
288 Exhibit 15, First Statement of Assistant Commissioner Peter Ross Guenther dated 2 March 2020.
289 SIU Analyst Manager T39.
290 T373 & T427 (DC Guenther).
291 T373 (DC Guenther).
behaviour of individuals in order to make an inference regarding their progression along a radicalisation pathway.’292 In other words, ‘objective behaviours’ are plotted in time series293 as ‘indicators’ (or contra-indicators) of the individual’s ‘acceptance of an ideology that promotes violence in its cause’294 – potentially graphically indicating an upwards or downwards radicalisation trajectory.295
SIU analysts are the only staff trained to use the ANZCTC tool. They are primarily responsible for the collation of information for ANZCTC tool assessments, though there are review and conferencing processes to ‘turn up anything they may have missed.’296 Intelligence holdings are the raw materials analysts use to identify behavioural indicators relevant to the domains of the ANZCTC tool; inclusion or exclusion of intelligence is based on their experience, training, and consultation297 with the investigation team. Contraindicators are not defined by the tool: they are pieces of intelligence that seem to ‘blunt’ the effect of an indicator or suggest the absence of an indicator.298 Whether or not an analyst has accessed all material relevant to the ANZCTC tool assessment ‘just comes down to their professional capability.’299 The analyst’s conclusion – the content of the ‘assessment’ portion of the tool – is reviewed by a supervising analyst ‘to confirm that it is coherent with the material presented.’ 300 However, I note that one cannot determine with any precision by looking at the ANZCTC tool what information an analyst has used in the assessment301 nor identify what information was relied upon to establish an indicator without revisiting a source document where one is referenced.302
From the foregoing it is clear that the analyst’s professional judgement is relevant to the inclusion/exclusion of intelligence, interpretation of intelligence as an indicator or contraindicator (or an intelligence gap), and to the overall assessment of a NSPOI using the 292 Exhibit 15, First Statement of Assistant Commissioner Peter Ross Guenther dated 2 March 2020.
293 SIU Analyst Manager T22.
294 SIU Analyst Manager T4.
295 SIU Analyst Manager T44.
296 SIU Analyst Manager T9-12.
297 SIU Analyst Manager T30.
298 SIU Analyst Manager T26.
299 SIU Analyst Manager T10.
300 SIU Analyst Manager T12.
301 SIU Analyst Manager T11.
302 SIU Analyst Manager T19 and T37.
ANZCTC tool. It is also a matter for professional judgement as to when a fresh assessment is undertaken as there is no fixed review period.303
The ANZCTC tool is not a ‘risk assessment’304 tool but seeks to generate a ‘threat profile’305 to allow allocation of investigative resources to the management of a NSPOI where the level of threat determines prioritisation of resources.306 That said, it was characterised as an ‘aid’ to decision-making designed to ‘guide not mandate’ case management activities – known within the SIU as treatment options307 – so that there is a more flexible approach than existed under the SPT.308 Analysts do not determine the level of threat posed by a NSPOI – their input into the threat profile is the ANZCTC tool assessment – nor do analysts determine treatment options or resource allocation.309 Hassan’s ANZCTC tool assessment
In May 2018, a SIU Analyst commenced the ANZCTC tool assessment of Hassan.310 The assessment was endorsed by Analyst Sergeant, SIU Officer 38, on 3 June 2018, with the prioritisation assessment made available to the investigative team on 4 July 2018.311
A and a indicator (along with other indicators) were plotted on Hassan’s ANZCTC tool in time series, as were a number of behaviours identified as contraindicators.312 The Analyst’s assessment was: At present it appears that [Hassan] does not maintain a lifestyle consistent with his extremist Islamic ideology. His use of cannabis suggests that he does not adhere to a strict interpretation of Islam.
Recent police involvements such as 9-Sep-2017 indicate that his behaviour is consistent with actions displayed by active criminals.
Most of the POIs risk indicators relate to intelligence held at a higher classification; refer ASNET for context. Given his drug taking and criminal behaviours, his and indicators probably overemphasise his potential harm/risk to the Victorian community relating to domestic PMV [politically motivated violence]. Moreover, the 303 SIU Analyst Manager T21. The SIU Analyst Manager considered that any requirement for fixed term periodic reassessments using the ANZCTC tool would ‘overwhelm resources’: SIU Analyst Manager T53.
304 SIU Analyst Manager T4.
305 SIU Analyst Manager T7.
306 SIU Analyst Manager T23.
307 Exhibit 19, SIU SOPs and T293 (SIU Officer E).
308 T373 (DC Guenther) & T461 (SIU Officer A).
309 SIU Analyst Manager T8.
310 Exhibit 13, Statement of SIU Officer E dated 2 October 2020.
311 Exhibit 13, Statement of SIU Officer E dated 2 October 2020.
312 Exhibit 14, Bundle of Attachments to Statement of SIU Officer E.
POI’s risk of offshore travel is mitigated by an active pace [sic] alert and cancelled passport.313
He conceded that as a matter of record keeping, accountability and transparency it was ‘problematic’ that it is difficult to ascertain what intelligence has been used or not used in an assessment.315 The SIU Analyst Manager indicated that some improvements to record-keeping had been introduced since 2018.316
While it was common ground that the more accurate and detailed the information fed into the tool, the more useful the ANZCTC tool assessment will be,317 during the inquest it was evident that four pieces of intelligence that were available to the security services – but not all available to the SIU in July 2018 – had not been considered in Hassan’s assessment.318 The SIU Analyst Manager testified that it was ‘possible but not certain’ that inclusion of those four pieces of intelligence would have resulted in some other assessment of Hassan being made.319
SIU Analyst Manager observed that the visual representation of the ‘historic’ and indicators present in Hassan’s assessment in time series – that they occurred some distance from the assessment … and there was no [similar] indicators at that time – ‘suggests a diminishing trajectory of radicalisation’.320 However, he noted that a ‘common sense approach’ would be to seek information to fill the intelligence gap and so determine whether a behaviour had dissipated or endured.321 He agreed that the assessment of an intelligence partner – such as the JCTT which appeared to view Hassan as having an enduring adherence 313 Exhibit 14, Bundle of Attachments to Statement of SIU Officer E.
314 SIU Analyst Manager T41.
315 SIU Analyst Manager T33. He observed that identification of intelligence on which an analyst had relied in an assessment is more readily achieved these days.
316 SIU Analyst Manager T33-34.
317 SIU Analyst Manager T38; T418 (DC Guenther).
318 SIU Analyst Manager T31-40.
319 SIU Analyst Manager T40.
320 SIU Analyst Manager T44.
321 SIU Analyst Manager T45.
to Islamic extremism (in the absence of evidence to the contrary) – about an intelligence gap ‘may be’ relevant to an assessment by the SIU.322 The SIU Analyst Manager commented that ‘there would probably be informal consultation’ between partners at regular ‘high level meetings;’323 although such consultation is ‘standard practice,’324 whether any occurred in this context in respect of Hassan is unknown.
Hassan’s July 2018 ANZCTC tool assessment identified his cannabis possession (in September 2017 and earlier) and ‘criminal behaviours’ (traffic offences in 2016 and early 2018, a 2017 bail offence; criminal/dishonesty offending dated to 2012)325 as contraindicators of radicalisation.326 These contra-indicators appeared to have been accorded prominence in the SIU’s assessment of Hassan. The SIU Analyst Manager explained that the research available to the SIU at the time suggested that radicalisation – especially radical Islam – required the individual to live a particularly pious life and behaviour like cannabis use was regarded as indicating a lack of piety.327 Traditional (as opposed to politically motivated) criminal offending was assessed similarly.328 In short, drug use and criminality were considered incompatible with Islamic extremism.
The SIU Analyst Manager testified that the ANZCTC tool is ‘evolving’, with research informing its development, and results of an ‘initial review’ imminent in December 2020.329 However, even since the tool was used to assess Hassan’s radicalisation trajectory in July 2018, ‘more nuanced’ descriptions of indicators and their interpretation were in use by the SIU.330 The SIU Analyst Manager referred to ‘emerging research’ which suggested that behaviours like drug use and criminality would no longer be regarded as ‘blanket contraindicators;’331 rather, these behaviours would be regarded as ‘idiosyncratic and dependent on the context.’332 That is, interpretation of these behaviours, and so Hassan’s ‘assessment[,] would be different today.’333 322 SIU Analyst Manager T45.
323 SIU Analyst Manager T46.
324 SIU Analyst Manager T47.
325 Exhibit 41, CB, pages 3382-3442 (outstanding police matters) and 1313-1318 (Hassan’s criminal antecedents).
326 Exhibit 14, Bundle of Attachments to Statement of SIU Officer E.
327 SIU Analyst Manager T27.
328 SIU Analyst Manager T30.
329 SIU Analyst Manager T25.
330 SIU Analyst Manager T22.
331 SIU Analyst Manager T26.
332 SIU Analyst Manager T26.
333 SIU Analyst Manager T30.
The SIU Analyst Manager opined that the ANZCTC tool assessment of Hassan was ‘a proper analysis.’334 Given ‘the thinking at the time and the information available to the analyst’ the national security threat presented by Hassan appeared to be low.335 Implications of Hassan’s ANZCTC tool assessment for his management by SIU
SIU Officer A testified that Hassan had been managed as an ‘active investigation file’ by the SIU from his NSPOI designation in 2015 until the Bourke Street incident on 9 November 2018.336 She stated that NSPOIs were ‘ranked’ or prioritised according to the level of concern they posed,337 with more attention to resourcing, filling intelligence gaps and mitigating risks for NSPOIs ranked as posing the highest level of concern.338
SIU Officer A agreed that the ANZCTC tool ranked Hassan as ‘the highest level of concern’339 due to the presence of a indicator. ‘Advisory actions’ attach to ANZCTC stage indicators, SIU Officer A providing the example that a indicator ‘generally means it’s a criminal activity with potential for a terrorist attack.’340
However, SIU Officer A testified that the ANZCTC tool – specifically the indicator – was ‘an aid to the investigators and the analytical team who look at it.’341 She stated that the appropriate investigative actions are therefore not determined solely by reference to the indicator stage shown on the tool, rather by a holistic analysis of the intelligence holdings in order to determine the true level of risk, which in turn, determines what actions are taken.342
In an (additional) exercise of professional judgment, all SIU members and the analyst who reviewed Hassan’s file regarded him as a low risk NSPOI, despite the and indicators and a dearth of contemporary intelligence.343 It was decided that the ANZCTC over-emphasised Hassan’s threat profile and the conduct of the SIU investigation was directed towards managing what was regarded as ‘residual risk,’344 including by way of referral to the 334 SIU Analyst Manager T12.
335 SIU Analyst Manager T48-49.
336 Exhibit 24, First Statement of JCTT Officer B dated 5 July 2019.
337 T186 (SIU Officer A).
338 T197 (SIU Officer A).
339 T189 (SIU Officer A).
340 T192 (SIU Officer A).
341 T199 (SIU Officer A).
342 T193-4 (SIU Officer A).
343 T107 (SIU Officer 23); T298 (SIU Officer E); T192 (SIU Officer A); and Exhibit 14, Bundle of Attachments to Statement of SIU Officer E.
344 T107 (SIU Officer 23).
CVE Unit and filling intelligence gaps. Indeed, SIU Officer E observed that although the ANZCTC tool rated Hassan as a , within the SIU he was effectively treated as a , with some treatments such as interrogation of phone records and drive overs of possible addresses.345
Nonetheless, SIU Officer A testified that Hassan remained ranked as a NSPOI: ‘the fact we hadn’t spoken to him, engaged with him, meant that it was prudent that we sought the opportunity through the outstanding Whereabouts to try to get a contemporary picture of where he was at so we could understand.’346 Hassan’s post-ANZCTC tool assessment management
In June 2018, it appears that the SIU was considering a direct approach to Hassan, ostensibly in relation to outstanding arrest warrants (he had failed to appear at court in February and April 2018 for driving offences alleged to have occurred in June 2016347 and January 2018348 respectively). An email was sent by SIU Officer G to JCTT Officer 11 on 15 June 2018 asking if ‘due to Op San Jose, there are any concerns if we attempt to locate/approach’ Hassan.349 The email contained two addresses associated with Hassan: one in Werribee and another in Meadow Heights each recorded in 2017, and both known to be out of date in April 2018.350 JCTT Officer 11 directed SIU Officer G to ‘standby for a response,’ noting that it ‘may be poor timing’ because Ali Khalif Shire Ali’s committal was due to commence the following week.351
According to SIU Officer E,352 no response was received by SIU Officer G about ‘potential conflicts’ with any JCTT operation and so he authorised covert enquiries – SIU members driving past the Meadow Heights address on 15 June 2018353 – to assist general duty police to locate Hassan and execute the arrest warrants.354 It was anticipated that interaction with 345 T298 (SIU Officer E).
346 T201 (SIU Officer A).
347 A matter where the Informant is Gillman in relation to which Hassan was re-bailed in September 2017.
348 A matter where the Informant is Wilding in relation to which Hassan was due to appear at court on 26 April 2018.
349 Exhibit 14, Bundle of Attachments to Statement of SIU Officer E.
350 Exhibit 41, CB, pages 3810-3819 (Additional LEAP records relating to Hassan).
351 Exhibit 14, Bundle of Attachments to Statement of SIU Officer E.
352 I note the conflicting evidence of JCTT Officer B, who stated that in a conversation JCTT Officer 11 had advised SIU Officer G that no attempt to locate or approach Hassan should occur until after Ali Khalif Shire Ali’s committal hearing on 18-20 June 2018: Exhibit 23, Third Statement of JCTT Officer B, dated 16 October 2020.
353 Exhibit 14, Bundle of Attachments to Statement of SIU Officer E.
354 Exhibit 14, Bundle of Attachments to Statement of SIU Officer E.
Hassan during execution of the warrants would inform the SIU’s assessment of Hassan’s progression along a radicalisation pathway.355
The Interpose record reflects discovery on or about 26 June 2018 of the outstanding 16 September 2017 IR, and that it had not been raised at the OCG.356 The IR was referred to SIU Officer E, with a recommendation for CVE Unit referral, which was reviewed by him on 8 July 2018 and then forwarded to SIU Officer 23.357
On 9 July 2018, SIU Officer 23, noting that the OCG referral related to resolution of Operation San Jose (the implication being that the IR was redundant), filed the IR as complete.358 Having reviewed Hassan’s ANZCTC tool assessment, notwithstanding the general perception within the SIU that Hassan was ‘very low risk,’359 ‘residual concern’360 about his possible radicalisation and a lack of management options,361 SIU Officer 23 made a referral to the CVE Unit for consideration of his suitability for CISP.
Nine months elapsed between CVE Officer 78’s query about Hassan’s referral to CISP on 19 October 2017 and when a referral was actually made on 9 July 2018; for eight of those months, the IR lay dormant while consideration by OCG – which on one view was not even necessary – was notionally pending. Determination of Hassan’s referral to the CVE Unit was still three months away. While SIU Officer 23 conceded the delay was ‘not ideal,’362 SIU Officer A had ‘no issue’363 with the SIU’s handling of the relevant IR.
Referral to CVE Unit to assess Hassan’s suitability for CISP
356 Exhibit 3, Attachment SIU23-2 from Statement of SIU Officer 23 dated 30 September 2020.
357 Exhibit 14, Bundle of Attachments to Statement of SIU Officer E.
358 Exhibit 14, Bundle of Attachments to Statement of SIU Officer E.
359 T107 (SIU Officer 23).
360 T97 (SIU Officer 23).
361 T51, T90 & T98 (SIU Officer 23).
362 T93 (SIU Officer 23).
363 T235 (SIU Officer A).
364 Exhibit 6, Statement of CVE Officer 25 dated 1 October 2020.
365 T71 (SIU Officer 23).
CVE Officer 25 was allocated the referral and tasked to perform a preliminary review of Hassan’s suitability for CISP.366 He was assigned the task because there was no fully qualified intelligence analyst367 in the CVE Unit at the time368 and he was the only person assessing referrals;369 indeed, Hassan’s was CVE Officer 25’s first assessment of a CVE referral.370
On 10 July 2018, Hassan’s referral was discussed at a CVE Unit T&C Meeting but as the usual minute-taker was on leave, there is no record of what transpired.371
Assessment of an individual’s suitability for CVE intervention appears to have three parts: preliminary assessment, in-depth risk assessment and, in practice, the individual’s willingness to engage in the voluntary program.372 A couple of months before Hassan’s preliminary assessment, a standardised form designed to prompt the user to capture ‘a great deal more detail’ about the NSPOI was introduced.373 No training about use of the ‘Preliminary Review of CVE Referral’ form was delivered ‘but there was a discussion;’374 otherwise, the information included (or not) in the proforma was a matter of ‘personal judgement’.375
Aside from the introduction of the standardised form, according to CVE Officer 25 there were no procedures in place concerning the CVE referral process at that time, nor any fixed expectations about how quickly a referral should be determined.376 Generally, referrals were processed within ‘a month or more,’377 however, there was ‘unusual delay’ in the determination of Hassan’s referral (from July to October 2018).378 The delay was due to CVE Officer 25’s position not being backfilled nor the referral reallocated (in part because there was no-one to whom it could be reallocated) when he took a period of personal leave.379 The 366 Exhibit 6, Statement of CVE Officer 25 dated 1 October 2020.
367 According to CVE Officer 25, the main difference between a fully qualified analyst and himself, was that the former would possibly have a ‘better way of writing a document’: T121. Although he was not a fully qualified analyst at the time, CVE 25 had undergone training in RADAR and Islamic awareness behavioural indicator training and use of the ANZCTC Tool: T117-119 (CVE Officer 25).
368 T116-7 (CVE Officer 25).
369 T117 (CVE Officer 25). In 2020, the CVE Unit had two staff assessing CISP referrals.
370 T119 (CVE Officer 25).
371 Exhibit 6, Statement of CVE Officer 25 dated 1 October 2020. CVE Officer 25 was present but no made no notes himself and had no independent recollection of what occurred at the time of making a statement for the inquest.
372 Exhibit 15, Statement of Assistant Commissioner Peter Ross Guenther dated 2 March 2020; Exhibit 6, Statement of CVE Officer 25 dated 1 October 2020; CVE Officer 25 and T98 & T146 (CVE Officer 25).
373 T121 (CVE Officer 25).
374 T121 (CVE Officer 25).
375 T137 (CVE Officer 25).
376 T124-125 (CVE Officer 25).
377 T125 (CVE Officer 25).
378 T124 (CVE Officer 25).
379 T123 (CVE Officer 25).
likelihood of delay in determining Hassan’s CVE referral was not communicated to the
CVE Officer 25 reviewed the entirety of the Interpose investigation shell and Hassan’s ANZCTC tool assessment.381 By 18 July 2018, he had formed a preliminary view that Hassan’s referral was unlikely to progress, in particular due to the ‘contrary indicators.’382 In a chance meeting with SIU Officer 23 that day, CVE Officer 25 communicated this preliminary view,383 and may have also commented that the reason the referral would be declined was due to the ‘historic’ nature of the available intelligence.384 There is no record of the conversation (a situation that reportedly would not occur now)385 and SIU Officer 23 had no recollection of a conversation occurring.386
When SIU Officer 23 left the SIU at the end of August 2018, Hassan’s referral to CVE had not been completed. SIU Officer 23 did not follow-up the referral before he left387 nor did he notify anyone that it remained outstanding, which he stated was indicative of his view that Hassan was a low priority NSPOI.388 Cessation of passive monitoring & ASIO/JCTT investigative primacy
On 15 August 2018, the SIU was informed by ASIO that while it and the JCTT would continue to liaise and disseminate information as appropriate, there were no longer any restrictions on the SIU in respect of its investigation of Hassan.389 The SIU does not appear to have appreciated the import of this information for some time, making enquiries in late September 2018390 about whether ASIO had any concerns about it making a direct approach to Hassan. It was not until ASIO responded to that enquiry, on 2 October 2018,391 that the SIU ‘understood that [ASIO] no longer had any interest in’ Hassan.392 380 T123 (CVE Officer 25).
381 Exhibit 6, Statement of CVE Officer 25 dated 1 October 2020.
382 T122 (CVE Officer 25).
383 T123 (CVE Officer 25).
384 Exhibit 6, Statement of CVE Officer 25 dated 1 October 2020.
385 T123 (CVE Officer 25).
386 T74 (SIU Officer 23).
387 T72 (SIU Officer 23).
388 T73 (SIU Officer 23).
389 Exhibit 17, Second Statement of Assistant Commissioner Peter Ross Guenther, dated 5 November 2020.
390 Exhibit 17, Second Statement of Assistant Commissioner Peter Ross Guenther, dated 5 November 2020.
391 Exhibit 18, Bundle of Attachment to Second Statement of Assistant Commissioner Peter Ross Guenther (PRG-8,
392 Exhibit 13, Statement of SIU Officer E, dated 2 October 2020.
The SIU’s ongoing monitoring of LEAP and Interpose alerts relating to Hassan revealed his suspected involvement in violent offending with increasing frequency.
On 2 August 2018, Hassan was suspected of producing a baseball bat during an altercation in Flemington.393
On 12 September 2018, an IR was submitted about Hassan engaging in ‘stalking and paranoid’ behaviours, pursuing a woman to her home believing that she was following him.394 The SIU considered this incident ‘indicative of drug use and/or mental health issues’ and as presenting an opportunity to engage with Hassan after consulting with the CVE Unit.395 There is no evidence the SIU liaised with the CVE Unit about this IR.
On 13 September 2018, Hassan was suspected of producing a sledgehammer during an alleged assault in Craigieburn.396
On 21 September 2018, Hassan allegedly produced a hammer during an altercation in Broadmeadows. This incident was not added to LEAP until 22 October 2018 at which point it was accompanied by a Whereabouts alert, indicating to police members that Hassan was wanted for arrest and questioning but could not be located.397 Assessment of Hassan’s CVE Referral
On 3 October 2018, SIU Officer 31 sought an update on progress of Hassan’s CVE referral and was advised that it was ‘still in the assessment phase’ and that CVE Officer 25 was returning from leave the following week.398
CVE Officer 25 attended to the assessment of Hassan’s referral upon his return to work. The Preliminary Review of CVE Referral form prompted him to identify and record information relevant to Hassan’s ANZCTC tool assessment, ideology, use of violence, substance use, mental state and ‘additional considerations,’ namely, matters that might compromise delivery of a CVE intervention.399 393 Exhibit 15, First Statement of Assistant Commissioner Peter Ross Guenther dated 2 March 2020.
394 Exhibit 15, First Statement of Assistant Commissioner Peter Ross Guenther dated 2 March 2020.
395 Exhibit 15, First Statement of Assistant Commissioner Peter Ross Guenther dated 2 March 2020.
396 Exhibit 15, First Statement of Assistant Commissioner Peter Ross Guenther dated 2 March 2020.
397 Exhibit 15, First Statement of Assistant Commissioner Peter Ross Guenther dated 2 March 2020.
398 Exhibit 14, Bundle of Attachments to Statement of SIU Officer E.
399 Exhibit 8, Attachment CVE25-2 on Statement of CVE Officer 25 dated 30 September 2020; T126 (CVE Officer 25).
The criteria used by the CVE Unit to assess referrals are drawn from an analytic tool known as RADAR.400 An individual’s risks (and needs) are assessed across several domains including ideology, social relations, action orientation, identity and coping.401 Like the ANZCTC tool, behavioural indicators are assessed and relevance and ‘severity’ of an indicator is a ‘matter for the assessor, based on [his or her] knowledge of radicalisation and experience in CVE.’402 Assessment of indicators is ‘complex and requires structured professional judgement:’ no one indicator or set of indicators in combination results in a particular preliminary assessment outcome.403
Hassan’s ANZCTC tool and indicators were characterised by CVE Officer 25 as ‘historic’ and though they would have been more significant, had they been more proximate in time to his assessment in July/October 2018, he was unable to say why their staleness was significant to his assessment.404 He agreed there was nothing in his training to suggest an indicator should be given less weight because it is old.405
Conversely, while CVE Officer 25 agreed that the most recent evidence that Hassan used illicit drugs dated to September 2017 and was also ‘historic,’ the age of this information did not have any significance in his assessment.406 This was because he understood drug use was ‘not looked upon favourably’407 in Islam and so confirmed his view that Hassan did not hold a radical interpretation of the religion. CVE Officer 25 testified that he had considered the possibility that between September 2017 and July/October 2018 Hassan’s religious adherence had changed.408
Although the assessment referred to Hassan’s recent use of weapons in confrontations on 21 September and 10 October 2018, CVE Officer 25 was not aware of two further incidents of violence, on 12 and 13 September 2018. However, because it was unclear if Hassan’s use of 400 RADAR is not a publicly available tool. It is a combination of two tools used to understand how individuals join extremist groups and/or engage in political violence and aims to aid development of intervention goals to assist disengagement from extremism: Exhibit 15, First Statement of Assistant Commissioner Peter Ross Guenther dated 2 March 2020.
401 Exhibit 15, First Statement of Assistant Commissioner Peter Ross Guenther dated 2 March 2020.
402 Exhibit 15, First Statement of Assistant Commissioner Peter Ross Guenther dated 2 March 2020.
403 Exhibit 15, First Statement of Assistant Commissioner Peter Ross Guenther dated 2 March 2020.
404 T130 (CVE Officer 25).
405 T130 (CVE Officer 25).
406 T135-6 (CVE Officer 25).
407 T135 (CVE Officer 25).
408 T136 (CVE Officer 25).
violence was ideologically or racially motivated409 even if he had known of the two other incidents, CVE Officer 25’s assessment of Hassan would not have changed.410
During CVE Officer 25’s testimony at inquest, it became clear that there was information relevant to the assessment that was not available to him at the time; it was also apparent that inaccurate information that was taken into account was not corrected by the SIU.411 In open and closed court sessions, he was taken to pieces of information (unavailable and corrected) that he confirmed would have influenced his assessment to some degree.412 Two of those pieces of information had been provided to the SIU via ASNET. CVE Officer 25 testified that had the SIU referral materials contained all of the further information communicated to him in open and closed court they ‘would have had more weight than when it was originally submitted’413 and so there would have been an ‘increased likelihood’ that Hassan’s referral would have progressed to the next stage of the assessment.414
As it was, on 11 October 2018 CVE Officer 25’s ‘summary of preliminary view’ was: Hassan … has displayed the intention to travel overseas and possibly not return. He has spent previous time in Somalia for multiple lengthy durations which indicates a familiarity with the location. His attempt to travel overseas in July 2015 was denied due to “possible” ISIS related social media comments, however, this is not entirely substantiated. Since this incident, there has been little to indicate that he has a radical interpretation of Islam or intends to commit an act of violence on a specific group. However, it must be noted that there is [sic] currently many intelligence gaps which do not provide valuable information that would inform a complete assessment for CVE interaction. At this current stage and with the available information, I would suggest that intervention via the CVE unit is not applicable.415
Information about many of the matters usually considered by the CVE Unit when assessing referrals – particularly those with potential to provide insight about the individual’s religious 409 Exhibit 8, Attachment CVE25-2 on Statement of CVE Officer 25, dated 30 September 2020; T133 (CVE Officer 25).
410 T135 (CVE Officer 25).
411 CVE Officer 25 erroneously believed that Hassan’s possible ISIS-related social media comments were ‘not entirely substantiated’ when they had been substantiated. Exhibit 8, Attachment CVE25-2 on Statement of CVE Officer 25, dated 30 September 2020.
412 T169 (CVE Officer 25).
413 T145-6 (CVE Officer 25).
414 T162 (CVE Officer 25).
415 Exhibit 8, Attachment CVE25-2 on Statement of CVE Officer 25, dated 30 September 2020.
adherence, affiliations and ideology – were unavailable in relation to Hassan.416 Evidence heard at inquest was that intelligence gaps are an ‘expected part’ of any intelligence process rather than being suggestive of investigative omission or oversight.417 That said, it appears to have been clear to both the SIU and CVE Unit in early July 2018 that significant intelligence gaps about Hassan existed: it is arguable the treatment of these gaps by each at that time led to omissions. A referral for CVE intervention was submitted by the SIU in circumstances where there was risk to mitigate but the referrer had no knowledge of the criteria for inclusion in CISP418 or the likelihood of acceptance;419 and, the CVE Unit determined the referral in circumstances where intelligence gaps were the reason for it to be declined and did so before communicating with the SIU about the gaps.420
By 2020, ‘very detailed’ standard operating procedures had been implemented within the CVE Unit.421 In addition to introducing an expectation that CVE referrals will be assessed within about two weeks422 and improved systems to detect delay, there are processes for peer review of assessments within CVE Unit T&C Meetings which enable intelligence gaps to be identified.423 CVE Officer 25 suggested that it might now be possible for intelligence gaps to be communicated to the referrer before a CVE referral is determined;424 whether gaps will be filled before the assessment is complete is less clear.425
On 16 October 2018, SIU Officer E spoke to CVE Officer 24 about the outstanding CVE referral and was advised that Hassan had not been recommended for CVE intervention. SIU Officer E asked that reasoning for the decision be added to Interpose.426 416 Exhibit 15, First Statement of Assistant Commissioner Peter Ross Guenther dated 2 March 2020. Also see the long and non-exhaustive list of subjects about which no (or no contemporary) intelligence existed in respect of Hassan in paragraph 68 of AC Guenther’s statement dated 2 March 2020.
417 SIU Analyst Manager T56.
418 T62 (SIU Officer 23).
419 T64 (SIU Officer 23).
420 T128 (CVE Officer 25).
421 T124 (CVE Officer 25).
422 T124 (CVE Officer 25).
423 T128 (CVE Officer 25).
424 T128 (CVE Officer 25).
425 T127-128 (CVE Officer 25).
426 Exhibit 13, Statement of SIU Officer E, dated 2 October 2020.
The same day, CVE Officer 24 added to Interpose the text of his endorsement of CVE Officer 25’s ‘summary of preliminary view’ as it appears in the ‘final outcome’ section of the Preliminary Review of CVE Referral proforma: Appears that 3 years have passed since intention to travel to overseas and since this time there have been no signs of radicalization or indicators that he has a radical interpretation of Islam or desire to act on his ideological beliefs. Considering intelligence and time gaps that exist, CVE recommendation is not to be progressed for any intervention. If intelligence gaps filled and/or further investigation is completed by investigators, then future referral for CVE will be considered.427 Hassan’s post-CVE Unit referral management
The SIU erroneously believed until about 2 October 2018 that its activities were constrained by ASIO’s request that it engage in passive monitoring only; no-one was able to explain why this was the case.428 After that date, the SIU considered it was ‘free to undertake investigative enquires as required.’429 Its primary enquiry was to ascertain Hassan’s whereabouts given that the Werribee and Meadow Heights addresses that had been on file since 2017 were both known to be out of date by April 2018.430 SIU Officer E conceded that the efforts made to locate Hassan after 2 October 2018 could have commenced on 15 August 2018 had he been aware the passive monitoring restriction had been lifted then.431
On 11 and 27 October and 2 November 2018, the SIU submitted Integrated Public Number Database (IPND) requests to identify Hassan’s mobile phone number(s).
On 12 October 2018, Corrections Victoria advised the SIU that Hassan was not on any prisoner contact list and provided phone numbers he had previously used; IPND requests in relation to those numbers were submitted by the SIU but ultimately showed that each number was disconnected.432
At about 5pm the same day, Hassan was allegedly involved in a hit and run in Roxburgh Park.
This incident was not added to LEAP until 22 October 2018 at which point it was 427 Exhibit 14, Bundle of Attachment to Statement of SIU Officer E.
428 See generally the evidence of SIU Officer A, SIU Officer E and DC Guenther.
429 Exhibit 15, First Statement of Assistant Commissioner Peter Ross Guenther dated 2 March 2020.
430 Exhibit 41, CB, pages 3819 and 3818 (Additional LEAP records relating to Hassan).
431 T276 (SIU Officer E).
432 Exhibit 13, Statement of SIU Officer E, dated 2 October 2020.
accompanied by a Whereabouts alert, indicating to police members that Hassan was wanted for arrest and questioning about the matter and could not be located.433 Hassan’s roadside bail hearing
Just before 11pm on 12 October 2018, Fawkner Highway Patrol members Leading Senior Constable (LSC) Jason Bolitho and Constable Jackson Brice intercepted an unregistered ute travelling north on Aitken Boulevard in Craigieburn which was travelling in excess of the posted speed limit.434 Hassan was the driver and sole occupant of the ute.435 LSC Bolitho activated a digital voice recorder as he approached the ute.436
On request, Hassan produced his driver’s licence and stated that he lived at the Werribee address recorded on it.437 Hassan was not, in fact, living at that address but was living in Meadow Heights with Ms Eren and their child. However, the Highway Patrol members had no information to indicate that the Werribee address was no longer current.438
Preliminary breath and oral fluid tests were administered with the results negative for the presence of alcohol and illicit drugs.439 Hassan was informed that infringement notices for speeding and using an unregistered vehicle would be issued.440
Hassan waited while LSC Bolitho returned to the police vehicle to perform licence and name checks via the onboard Mobile Data Terminal (MDT). Checks of the LEAP database confirmed Hassan’s driver’s licence was current. The name check defaulted to a master name, ‘Mohamed Farah’. While there were five outstanding arrest warrants relating to failures 433 Exhibit 41, CB, page 3927 (Whereabouts relating to the hit and run in Roxborough Park on 12 October 2018).
434 Exhibit 20, Statement of Leading Senior Constable Jason Bolitho dated 26 November 2018.
435 Exhibit 20, Statement of Leading Senior Constable Jason Bolitho dated 26 November 2018.
436 Exhibit 23, Digital Recording by SC Jason Bolitho on 26 November 2018; T482 (LSC Bolitho). Hassan remained calm and cooperative throughout the duration of the 15-minute digital recording.
437 Exhibit 20, Statement of Leading Senior Constable Jason Bolitho dated 26 November 2018; T482 (LSC Bolitho).
438 T499-500 (LSC Bolitho). Hassan’s LEAP record contains a number of entries in February and April 2018 where investigating members recorded that Hassan was no longer living at either the Werribee or Meadow Heights addresses and his current whereabouts was unknown – see Exhibit 41, CB, pages 3818-9, LEAP records. LSC Bolitho confirmed that he did not have access to the complete LEAP record on the MDT. This was available to Sgt Free. However, the front page of LEAP did not state that the address was unknown, and the LEAP entries did not always specify the address referred to, beyond stating that Hassan was not living at the ‘home address’. Sgt Free confirmed that with entries of this kind, if a matter was of particular concern it would be best placed as an alert or whereabouts on the system, as close to the front page as possible for interested persons to be able to see it and make a note of it. – see T5957 (Sgt Free).
439 Exhibit 20, Statement of Leading Senior Constable Jason Bolitho dated 26 November 2018.
440 Exhibit 20, Statement of Leading Senior Constable Jason Bolitho dated 26 November 2018.
to appear at court for driving offences under the name ‘Hassan Khalif Shire’, 441 there was a NSPOI warning flag attached to ‘Mohamed Farah.’442
According to LSC Bolitho, he had never received any training about the NSPOI flag, beyond being told not to alert the subject to the fact that a NSPOI flag existed.443 It is apparently common for general duty members to not be able to find any information about a NSPOI beyond the flag itself.444
At the time of these events, the Highway Patrol unit had access to limited information from police databases via the MDT.445 Accordingly, LSC Bolitho telephoned Highway Patrol Sergeant Michael Free at Fawkner police station so that a more thorough check of Hassan could be performed.446 However, Hassan’s NSPOI flag contained no further information or annotations to guide to the police members interacting with him, as might have been the case with a Whereabouts alert.447 Sgt Free testified that had there been a note on the system asking members to contact the SIU if they encountered Hassan, it would have been done. However, once the arrest warrants were executed and Hassan bailed, police had no power to hold him regardless of the SIU’s wish to speak with him.448
Similarly, had the general duty members known that the address Hassan provided was believed to be incorrect, the uncontroverted evidence of Sgt Free and LSC Bolitho was that they would have challenged him about it.449 Although the SIU was aware Hassan’s address details were out of date in April 2018, had sought to be involved in the execution of outstanding warrants in June 2018450 as part of a disruption strategy, and knew on 2 October 2018 (at the latest) the passive monitoring restriction had been lifted, it did nothing – such as annotating the NSPOI flag451 – to alert uniform members that Hassan’s current address was 441 Exhibit 41, CB, pages 3320-1, Charge Sheet and Warrant to Arrest executed 12 October 2018; and CB pages 3344, 3374, 3411, 3475, Warrants to Arrest executed 13 October 2018.
442 Exhibit 20, Statement of Leading Senior Constable Jason Bolitho dated 26 November 2018; T482-4; 443 T489 (LSC Bolitho).
444 T590 (Sgt Free).
445 T485 (LSC Bolitho); T590 (Sgt Free).
446 Exhibit 20, Statement of Leading Senior Constable Jason Bolitho dated 26 November 2018; T485-6.
447 T485 (LSC Bolitho); T590 (Sgt Free).
448 T599-600 (Sgt Free).
449 T491-2 (LSC Bolitho); T592-4 (Sgt Free).
450 Exhibit 14, Attachment SIUE-1, Email chain between SIU Officer G and SIU Officer D 15 June 2018.
451 T407 (DC Guenther); T213 (SIU Officer A).
not known. SIU Officer A conceded that this was something that ‘possibly ... should have occurred.’452
Sgt Free and LSC Bolitho testified that a known discrepancy about Hassan’s address had a real prospect of affecting the bail process and decision.453 It may have led to Hassan’s transport to a police station and a denial of bail until a satisfactory address was confirmed.454
However, the checks conducted by Sgt Free revealed no further information or concerns.455 A Whereabouts linking Hassan as a suspect in the violence offences committed between August and September 2018 had not yet been entered on LEAP456 and, while the hit and run in Roxburgh Park a few hours earlier had been entered into the Traffic Incident System (TIS), as it is separate to the LEAP system, the information was not available to police at the time.457 Sgt Free and LSC Bolitho both testified that had the assault matters been brought to their attention, Hassan would likely have been taken to a police station, interviewed, and then subsequently bailed or remanded in custody.458
None of the five outstanding arrest warrants were endorsed with any restriction preventing Hassan from being bailed by a police sergeant. Sgt Free understood all of the warrants were issued on the same court date and related to driving matters.459 On balance, it appeared to Sgt Free that Hassan should be granted bail but he testified that he had not formed a concluded view, rather, it would depend on what Hassan said when he spoke with him.460
At inquest, there was conflicting evidence as to whether it was LSC Bolitho or Sgt Free who suggested Hassan be bailed roadside, rather than be transported to a police station.461 Sgt 452 T217-8 (SIU Officer A). I note that DC Guenther conceded that annotating a flag was an investigative opportunity (T406) but refused to concede that is was an opportunity that was missed (T405).
453 T491-2 (LSC Bolitho); T592-4 (Sgt Free).
454 T491-2 (LSC Bolitho); T592-4 (Sgt Free).
455 Exhibit 30, Statement of Sergeant Michael Free dated 29 November 2018; Exhibit 20, Statement of Leading Senior Constable Jason Bolitho dated 26 November 2018.
456 T498 (LSC Bolitho).
457 T499 (LSC Bolitho).
458 T498-9 (LSC Bolitho); T603-4 (Sgt Free). I acknowledge however, that the evidence indicates that in relation to the ‘hit and run’ incident at Roxburgh Park shopping centre, no one was injured and the only authority police officers would have had to deal with that investigation at the time would be to ask who was the driver of the car at that particular time. Police officers did not have the power to arrest him for the particular incident but were entitled to ask him who was driving the car at the time. See T500-1 (LSC Bolitho).
459 Exhibit 30, Statement of Sergeant Michael Free dated 29 November 2018.
460 Exhibit 30, Statement of Sergeant Michael Free dated 29 November 2018.
461 T486 (LSC Bolitho) and T587 (Sgt Free), each police member testified that it was the other’s suggestion.
Free testified that the request to bail someone on the roadside is not unusual462 and both police members knew that from the interception location, Hassan would have to be transported – by a divisional van deployed for the purpose – to Broadmeadows or Moonee Ponds police station to be bailed if Sgt Free did not attend the scene.463 They both considered it is expedient – where there is nothing unusual about the charges or circumstances464 – to conduct a bail hearing roadside: the accused person is not inconvenienced or in police custody longer than necessary465 and police resources are optimised by, among other things,466 not diverting a divisional van from other duties.467 It is not necessary for me to resolve the point save to say a decision to attend was ultimately made by Sgt Free and it was not unreasonable to do so in the circumstances.
After concluding his telephone conversation with Sgt Free, LSC Bolitho returned to Hassan, informed him of the outstanding warrants and placed him under arrest. Hassan’s demeanour did not change.468
Having printed the warrants and bail paperwork and obtained a court date from the Magistrates’ Court Electronic Diary, Sgt Free attended the interception location, arriving just before midnight.469 The five warrants were executed, and Hassan was bailed unconditionally in his own undertaking to attend Werribee Magistrates’ Court on 14 January 2019.470 Each undertaking of bail identified Hassan by the name and address that appeared on his driver’s license.471 Sgt Free was satisfied that the Werribee address was where Hassan was living because there was no information to indicate the contrary.472 462 Exhibit 30, Statement of Sergeant Michael Free dated 29 November 2018; T587.
463 T487-8 (LSC Bolitho).
464 T588 (Sgt Free).
465 T600 (Sgt Free).
466 Roadside bail hearings also eliminate delay associated with taking an individual into custody at a police station such as conducting searches, entering the person in the attendance register, or waiting for a sergeant to become available to consider bail: T486-7 (LSC Bolitho); T586 & 602 (Sgt Free).
467 T603 (Sgt Free).
468 Exhibit 20, Statement of Leading Senior Constable Jason Bolitho dated 26 November 2018. On questioning about the name ‘Mohamed Farah’, Hassan denied ever being known by that name and said he had never used it. He told LSC Bolitho that he had been intercepted previously and told of the warrants, but after conversation over the Farah name, he was not arrested, and the warrants were not executed. LSC Bolitho took a photograph of Hassan for identification purposes. This matched the likeness of a photo printed by Sgt Free of ‘Mohamed Farah’: both police members were satisfied that Mohamed Farah and Hassan Khalif Shire Ali were the same person.
469 T592 and Exhibit 30, Statement of Sergeant Michael Free dated 29 November 2018.
470 See for example Exhibit 41, CB, pages 3345-6.
471 See for example Exhibit 41, CB, pages 3345-6.
472 Exhibit 30, Statement of Sergeant Michael Free dated 29 November 2018; T593-4, 597-8.
Hassan was cooperative throughout and was advised not to drive the ute as it was unregistered; he said he would walk to a friend’s house nearby.473
On 15 October 2018, an IR was submitted by Fawkner Highway Patrol about its interception of Hassan three days earlier.474 The IR noted that a search was not conducted of Hassan’s vehicle as there were no grounds to do so475 and was forwarded to the SIU.476
On 18 October 2018, SIU Officer G reviewed the IR, observing intelligence gaps in the report, including a description of the vehicle and Hassan’s clothing and demeanour, any comments made by him during the interaction, and whether his address and mobile numbers had been confirmed.477 He returned the IR requesting that further information be provided; both LSC Bolitho and Constable Brice were on leave and so SIU Officer G did not receive a substantive response until 15 November 2018. 478 Continued efforts by SIU to identify Hassan’s current address
On 27 October 2018, the SIU initiated an inquiry to identify Hassan’s current address via the Residential Tenancy Board Authority.479
On 28 October 2018, SIU members performed drive overs of an address associated with Hassan which failed to produce useful information; a request for Airwing deployment was submitted.480
On 29 October 2018, the SIU sought information about Hassan’s address and phone number via Centrelink.481
On 30 October 2018, Victoria Police Airwing was deployed to flyover three addresses associated with Hassan; no intelligence tending to confirm his residence at any of these addresses was revealed.482 473 Exhibit 20, Statement of Leading Senior Constable Jason Bolitho dated 26 November 2018; Exhibit 30, Statement of Sergeant Michael Free dated 29 November 2018.
474 Exhibit 22, Information Report INT18IR1788507 submitted 15 October 2018.
475 Exhibit 22, Information Report INT18IR1788507 submitted 15 October 2018.
476 Exhibit 22, Information Report INT18IR1788507 submitted 15 October 2018.
477 Exhibit 22, Information Report INT18IR1788507 submitted 15 October 2018.
478 Exhibit 22, Information Report INT18IR1788507 submitted 15 October 2018; CB 3459-61, Email correspondence between SIU and Fawkner Highway Patrol re Incident Report.
479 Exhibit 15, First Statement of Assistant Commissioner Peter Ross Guenther dated 2 March 2020.
480 Exhibit 14, Bundle of Attachments to Statement of SIU Officer E.
481 Exhibit 15, First Statement of Assistant Commissioner Peter Ross Guenther dated 2 March 2020.
On 1 November 2018, a partner agency advised SIU Officer G of Hassan’s residential address in Meadow Heights.483 The address was confirmed as current by the SIU the same day when, during a drive over, two vehicles used by Hassan were observed outside it.484
During the inquest, a number of witnesses were asked about the efficiency of the extensive but fruitless enquiries made to ascertain Hassan’s address before an intelligence partner was asked.485 Much was made of the ‘process’ the SIU was ‘required’ to follow – establishing that an address could not be identified – before seeking assistance.486 One witness likened it to checking one’s own cupboards before asking someone if the item is in their cupboard,487 which appeared to be something of a false analogy: the SIU appeared to be asking if Hassan’s address were in everyone else’s cupboard before checking the intelligence partner cupboard.
SIU Officer A testified that her ‘members were working incredibly hard’488 to find Hassan’s address; working hard, but perhaps not efficiently.
Plan to Arrest Hassan in connection with outstanding criminal matters
On 2 November 2018, the SIU added LEAP warning flags to Hassan’s profile to alert members that he may be violent and carry a weapon.489 On the same date, SIU Officer G emailed the Broadmeadows, Craigieburn and Flemington general duty police members who had identified, or sought to arrest and interview, Hassan in relation to offences alleged to have occurred between August and October 2018.490 He advised the members of Hassan’s new address and asked them to coordinate the arrest and interview with the SIU so that the SIU could discuss national security matters with Hassan afterwards.491
On 3 November 2018, Hassan is alleged to have been involved in a verbal altercation with two strangers in Roxborough Park during which it is alleged he damaged a bystander’s vehicle by kicking it.
482 Exhibit 13, Statement of SIU Officer E dated 2 October 2020.
483 Exhibit 14, Bundle of Attachments to Statement of SIU Officer E.
484 Exhibit 15, First Statement of Assistant Commissioner Peter Ross Guenther dated 2 March 2020.
485 T207 (SIU Officer A); T415 (DC Guenther) and T301 (SIU Officer E).
486 T301 (SIU Officer E).
487 T301 (SIU Officer E).
488 T218 (SIU Officer A).
489 Exhibit 14, Bundle of Attachments to Statement of SIU Officer E.
490 Exhibit 14, Bundle of Attachments to Statement of SIU Officer E.
491 Exhibit 14, Bundle of Attachments to Statement of SIU Officer E.
On 5 November 2018, the SIU initiated a Webtrace inquiry, which would provide access to phone data relating to incoming and out calls and messages for a nominated number; depending on the carrier, cell tower location information may also be available.492
On 7 November 2018, Broadmeadows police developed a plan for Senior Constable John O’Hara to arrest Hassan on 10 November 2018. SC O’Hara did not intend to contact SIU Officer G until Hassan was arrested.493 The arrest plan did not come to fruition due to the events of 9 November 2018.
VICTORIA POLICE RESPONSE TO THE INCIDENT ON 9 NOVEMBER 2018 The use of force by members of Victoria Police
Within 31 seconds of Hassan’s ute being engulfed in flames, Police Officers A1 and B2 had engaged Hassan and were attempting to disarm him and bring the incident to a peaceful resolution. Superintendent (Supt) Peter Seiz, testifying on behalf of the Chief Commissioner of Police,494 stated that the uniform members had exercised ‘a fair amount of restraint’ by initially attempting to defuse the situation with use of OC spray and then their batons. He considered escalation to the use of a firearm appropriate given the circumstances, namely, the way Hassan acting and that he was armed with a knife.495
Indeed, the consensus of opinion among senior police members was that the use of lethal force against Hassan was appropriate and justified in the circumstances, and that it accorded with Operational Safety Tactics (OST) training and instruction provided to Victoria Police members.496
I agree with this assessment and acknowledge the difficult circumstances faced by Police Officers A1 and B2, who, after attending what they thought was a car fire,497 were faced with an armed and determined assailant. I commend their presence of mind, restraint and effective collaboration in a volatile and dangerous situation, noting in particular that Police Officer A1 492 Exhibit 13, Statement of SIU Officer E dated 2 October 2020.
493 Exhibit 41, CB, page 3920, Statement of SC John O’Hara dated 15 October 2020.
494 Superintendent Seiz was nominated by Victoria Police as he was considered the most qualified and experienced police officer able to provide evidence on the issues relevant to my investigation. At the time of the incident, Supt Seiz was at the People Development Command of Victoria Police, responsible for the operational safety unit that trains recruits and operational members on tactics and trainings for firearms and defensive tactics. T708 (Superintendent Seiz).
495 T710, 713 (Superintendent Seiz).
496 T709, 713 (Superintendent Seiz); CB, Operational Safety Committee Incident Review dated 2 April 2019, p 1733.
497 Exhibit 35, Statement of Police Officer A1 dated 9 November 2018; Exhibit 34, Statement of Police Officer B2 dated 9 November 2018.
had only graduated from the police academy five months earlier498 and that neither man had worked with the other before that day.499
After Hassan was shot, he refused to relinquish the knife despite repeated demands from CIRT members to do so. The CIRT members’ use of tasers to cause Hassan to relinquish his weapon and enable his safe arrest was considered appropriate action, in line with OST training and instruction.500
Immediately after Hassan was restrained, he was moved to a safe area and provided first aid treatment501 until the arrival of paramedics and his transfer to hospital for emergency surgery.502 Police members acted promptly and appropriately in the provision of first aid and emergency care.
Use of emergency code
The OSCIR found that Police Officers A1 and B2 did not transmit the emergency radio code ‘Code 9’ (Police in trouble) or depress the Emergency Distress button on their police radios.503
However, Supt Seiz testified that he was not critical of the police members for not calling a Code 9, because they were focused on the task at hand, observing Hassan and evaluating their tactical options. He also noted that the nature of the incident the members thought they were attending – a car accident or car fire – is not one that would ordinarily require a Code 9 transmission. By the time they realised that they were ‘in trouble,’ they were already engaging with the offender and this, appropriately, was their focus and priority.504
Notably, Police Officer B2’s transmission about a ‘vehicle on fire’ prompted the CIRT members to respond immediately, arriving at the scene within a few minutes. Given the promptness of this response by specialist units to assist the uniform members, there is no evidence that transmitting ‘Code 9’ could or would have altered the events as they unfolded.
498 Exhibit 35, Statement of Police Officer A1 dated 9 November 2018.
499 Exhibit 34, Statement of Police Officer B2 dated 9 November 2018.
500 T710 (Superintendent Seiz); CB, Operational Safety Committee Incident Review dated 2 April 2019, p 1733.
501 Exhibit 36, Statement of Senior Constable Longli Loei dated 9 November 2018; Statement of Senior Constable Jesse Mahoney dated 9 November 2018; Statement of Sergeant Christy Walsh dated 9 November 2018.
502 CB, Statement of Senior Constable Yasemin Dincer dated 1 December 2018, p 499; CB, Statement of Dr Calvin Peng dated 8 April 2019, p 391-2.
503 CB, Operational Safety Committee Incident Review dated 2 April 2019, p 1733.
504 T716-7 (Superintendent Seiz).
Supt Seiz explained that the Emergency Distress button is used to clear the air on police radio during a critical incident so that a member can provide a comment. He was not critical of Police Officers A1 or B2 for not using this button because their focus was on containing Hassan. Supt Seiz observed that ‘taking their eyes off’ Hassan to locate and activate the distress button could have produced adverse consequences for them given the task at hand.505
I find that it was reasonable in the circumstances for the Police Officers A1 and B2 to focus on engaging with Hassan to ensure the safety of themselves and members of the public and so make no criticism of them for not transmitting ‘Code 9’ or activating their emergency distress buttons.
The adequacy of tactical options and OST equipment
At the time of this incident, tasers were issued to all CIRT members and to uniform members in some regional areas, but not to metropolitan general duty members.506 Police Officer B2 observed, shortly after the incident, that ‘At some point I wished I had a taser’ as he ‘felt I needed a little bit more.’507 Indeed, the OSCIR found that the use of batons and OC spray was relatively ineffective, and the ‘only truly effective OSTT equipment’ employed by the members, other than the firearm, was the taser deployed by CIRT.
Supt Seiz qualified the findings of the OSCIR: whilst he agreed that the taser was effective, by the time it was deployed, Hassan had already been shot and was on the ground. He opined that the use of a taser may not always be an effective non-lethal option in response to a knife attack – its utility can be overstated – and that could, in turn, endanger police members.508
Supt Seiz’s views were confirmed by CIRT officers SC Loei and SC Mahoney, who gave evidence that the firearm was an appropriate and effective tactical option to utilise in circumstances where an offender is armed with an edged weapon and ‘more aggressive in approach.’509 I accept that even if a taser had been available to Police Officers A1 and B2, it may not have made any difference to the outcome of the confrontation given the threat posed by Hassan.
505 T717 (Superintendent Seiz).
506 T711 (Superintendent Seiz).
507 Exhibit 34, Statement of Police Officer B2 dated 9 November 2018.
508 T709-13 (Superintendent Seiz).
509 T681 (Senior Constable Loei); T693-4 (Senior Constable Mahoney).
The Australian definition of a ‘terrorist act’ was inserted into Part 5.3 of the Australian Criminal Code Act 1995 (Cth) as one of a number of legislative responses immediately following the terrorist attacks in the United States of America on 11 September 2001. The Commonwealth’s definition is largely replicated in the laws of other Australian jurisdictions, including Victoria. Broadly therefore, an act of terrorism is one that causes serious harm, or that seriously endangers or causes the death of a person, with the intention of advancing a political, ideological or religious cause and that is undertaken with the intention of coercing or intimidating the Commonwealth or State government, or intimidating the public.513 Accordingly, it is the political, religious or ideological motivation and the intention to intimidate governments or the public which distinguishes ‘terrorist’ acts from acts in pursuit of private ends that fall within established offences against the person or property, or those relating to weapons or explosives.514
JCTT Officer B observed that to determine if an event is a terrorist act it is necessary to consider all of the available information – both personal to the perpetrator and peculiar to the act itself – due to the presence of an often ‘complex interplay of factors.’515 In considering what is and was known about Hassan’s ideology, religious adherence and his conduct leading up to the incident in Bourke Street and the incident itself, I am mindful that although some of 510 CB, Operational Safety Committee Incident Review dated 2 April 2019, p 1748.
511 T713-4 (Superintendent Seiz).
512 T713-4 (Superintendent Seiz).
513 See generally s 100.1 Australian Criminal Code Act 1995 (Cth) and s 4 of the Terrorism (Community Protection) Act 2003 (Vic).
514 Thomas v Mowbray (2007) 233 CLR 307 at 364.
515 T551 (JCTT Officer B).
this information was known contemporaneously – if by disparate individuals – much has been reconstructed after events and that what emerges from the evidence before me remains fragmentary.
Ideology and religious adherence
Hassan’s sister Asha was aware he had viewed ISIS videos, but was not concerned because he was ‘always a very curious person’518 and there was nothing about Hassan’s behaviour that caused her to think he was supportive of ISIS.519 Hassan’s father denied ever seeing Hassan watch ISIS material,520 and both parents considered that ISIS was ‘completely wrong, and that there was no justification for the group’s actions.’521
Ms Eren reported never having ‘an open discussion’ with Hassan about the situation in Syria or ISIS specifically.522 She explained that in 2015, she understood a caliphate in Islam to be a good thing523 and while she was aware of news reports of violence perpetrated by or on behalf 516 Exhibit 15, First Statement of Assistant Commissioner Peter Guenther dated 2 March 2020.
517 Exhibit 15, First Statement of Assistant Commissioner Peter Guenther dated 2 March 2020; CB, Sentencing Remarks, R v Ali Khalif Shire Ali [2020] VSC 316, p 2829. Ms Eren was reportedly unaware of Hassan’s interest in viewing ISIS videos with Ali. T828 (Beyza Eren).
518 AM12, Statement of Asha Ali dated 27 November 2020.
519 AM 12, Statement of Asha Ali dated 27 November 2020.
520 AM 10, Statement of Khalif Ali dated 23 November 2020.
521 AM 12, Statement of Asha Ali dated 27 November 2020; AM 10, Statement of Khalif Ali dated 23 November 2020.
522 T796 (Beyza Eren).
523 T796-7 (Beyza Eren).
of Islamic State, she did not know what to believe.524 Ms Eren admitted being curious about ISIS and that she ‘might’ have researched it online.525
Ms Eren was non-committal about whether Hassan was also curious about the ISIS, saying only that it was ‘probably’ something that Hassan had considered but that they did not discuss the Islamic State and the role they were playing in Syria and Iraq.526 Moreover, Hassan was ‘not really open’ with her about these kinds of things, and that she did ‘not really’ have a lot of conversations about religion with Hassan.527
Overall, the available evidence suggests that Hassan’s adherence to his religion was far from consistent and there were times when he was less devout with periods of missing prayers and engaging in haram528 behaviours including drug use.529
Ms Eren initially could not recall if Hassan was interested in any particular religious leaders or preachers.530 However, when her memory was refreshed with the products of electronic devices seized and analysed during Operation Crabbenburg, she admitted that she and Hassan had watched Anwar Al-Awlaki and exchanged files containing his sermons.531 Anwar AlAwlaki is considered an extremist preacher,532 who was affiliated with ISIS towards the end of his life. Ms Eren denied knowing about any affiliation between Mr Al-Awlaki and ISIS;533 none of the sermons exchanged by Hassan and Ms Eren were found to contain any promotional or instructional material on engaging in politically motivated violence or terrorist acts.534
In addition, in the week before the Bourke Street incident, Ms Eren shared with Hassan a number of YouTube links to sermons on various religious topics made by Islamic preachers 524 T797 (Beyza Eren). Ms Eren testified that her assessment of ISIS activities had since shifted; she considered the activities ISIS was reported to be involved in during 2015 is unacceptable.
525 T797 (Beyza Eren).
526 T798 (Beyza Eren).
527 T802 (Beyza Eren).
528 In Islamic jurisprudence, haram refers to any act that is forbidden by Allah.
529 T822-3 (Beyza Eren); T771 (Evrem Eren); T280 (SIU Officer E); AM 12, Statement of Asha Ali dated 27 November 2020.
530 T798 (Beyza Eren).
531 T798-9 (Beyza Eren). Analysis of electronic items seized after the Bourke Street attack revealed that Hassan and Ms Eren were exchanging files of sermons from radical preachers known to hold extremist ideologies in the days before the Bourke Street incident, including from Mr Al-Awlaki. See Exhibit 24, First Statement of JCTT Officer B dated 5 July 2019; T544 (JCTT Officer B).
532 CB, Sentencing Remarks, R v Ali Khalif Shire Ali [2020] VSC 316, p 2807. In discussions with undercover operatives, Ali Khalif Shire Ali referred to Mr Al-Awlaki as his ‘main lecturer’.
533 T798 (Beyza Eren).
534 T558-560 (JCTT Officer B).
the JCTT considered radical, or whose sermons terrorism offenders had downloaded.535 The videos shared with Hassan were of a conservative, non-instructional nature.536 Ms Eren was unable to provide a convincing explanation for sharing these links with Hassan and had little recollection of their content, frequently responding, ‘I don’t know,’ ‘I can’t remember’ or ‘I don’t recall.’537 She was also noncommittal when asked whether it was common for her to send Hassan religious articles, stating ‘Um, yeah, probably,’ explaining only that it was done ‘to try and, I guess, get him into the religion a bit more.’538
According to Ms Eren, when she started wearing the Niqab539 this became a point of contention in her relationship with Hassan. She thought ‘he felt like I was better than him or something and that would [make] him down a lot. He wouldn’t really feel good about himself religiously.’540 Ms Eren said that she attempted to give Hassan instruction and assist him as much as he would allow her to, but that he was not particularly receptive.541 Mental Health
According to his family, Hassan experienced many stressors in the six months prior to his death, with unstable work, financial difficulties, and a strained relationship with his wife. He was unable to afford to pay his rent, and so his mother paid it for him. Hassan also appeared to be increasingly paranoid.542
In February 2018, Hassan met his sister Asha by chance. She encouraged him to visit their brother in prison and reminded him that his family loved him; he had been vague and distant with them.543 Asha observed that Hassan ‘looked like he needed help’ and that he was ‘struggling’ and believed he might have had some relationship issues at the time.544 535 T518 (JCTT Officer B), Exhibit 27, Third Statement of JCTT Officer B dated 16 October 2020.
536 Exhibit 24, First Statement of JCTT Officer B dated 5 July 2019 537 T801-2 (Beyza Eren).
538 T801 (Beyza Eren).
539 The niqab is a veil for the face that leaves the area around the eyes clear. Ms Eren commenced wearing the Niqab in 2016: T783 (Beyza Eren).
540 T823 (Beyza Eren).
541 T823 (Beyza Eren).
542 AM 13, Statement of Hassan’s sister dated 27 November 2020, p 2; AM 12, Statement of Asha Ali dated 27 November 2020, p 2-3; AM 10, Statement of Khalif Ali dated 23 November 2020, p 1.
543 AM 12, Statement of Asha Ali dated 27 November 2020, p 2-3.
544 AM 12, Statement of Asha Ali dated 27 November 2020, p 2.
At the time of his reconciliation with Ms Eren in July or September 2018, Hassan reportedly told her that he thought his marijuana was spiked with another drug because he was starting to hallucinate and have a different type of high.545
In about August 2018, Hassan went with Ms Eren to his parents’ home. According to Asha, Hassan was visibly upset, with his voice shaking and his eyes twitching. He told his family that when he had attended Hume Islamic Youth Centre (HIYC), he was treated differently, and a friend told him that the police had been asking a lot of questions about him and his family. According to Asha, Hassan said ‘he finally was in a good space, with his wife, his child, praying often and close to his community and that he felt really hurt that his safe space was being infiltrated by authorities.’546 He also reported that two people had tried to take photos of him when he was at the mosque. He stopped attending the HIYC following this incident.547
In mid-to-late August 2018, Muammer Yavuz, the son of Ms Eren’s landlord, recalled speaking with Hassan in the driveway of Ms Eren’s home and noticing that Hassan appeared ‘agitated,’ ‘paranoid’ and ‘jumpy.’548 Hassan had asked if police had been there looking for him and that if they had, it was because ‘they are trying to get me in trouble’ and ‘blaming me for stuff but I’m not like that.’549
When Hassan visited his family again in early October 2018, his paranoia had increased.
Already convinced that his father and older brother were informers, on this occasion he accused Asha of ‘working with them’.550 She tried to reassure him because Hassan appeared distressed.551 He also told Asha that he was thinking of moving to Sydney.
546 AM 12, Statement of Asha Ali dated 27 November 2020.
547 AM 12, Statement of Asha Ali dated 27 November 2020.
548 T755 (Muammer Yavuz).
549 Exhibit 40, Statement of Muammer Yavuz dated 13 November 2018, p 356; T755 (Muammer Yavuz).
550 AM 12, Statement of Asha Ali dated 27 November 2020.
551 AM 12, Statement of Asha Ali dated 27 November 2020.
552 AM 12, Statement of Asha Ali dated 27 November 2020.
Ms Eren and Hassan’s mother also encouraged Hassan to seek professional help. Ms Eren was unable to remember the content of her conversations with Hassan about his paranoia but remembered trying to research mental illness to try to explain it to him. Hassan reportedly had no insight into his paranoia, refused to acknowledge he was behaving strangely and was unwilling to go to the doctor.553
Eventually, Hassan was persuaded by Ms Eren to see a doctor, ‘probably’ to keep her happy.554 They attended the appointment with Dr Afanasyev at the Barry Road Medical Centre together on 5 October 2018.555 Hassan reported that he had felt ‘stressful for a long time,’ had recently ceased smoking weed (cannabis), was suffering from headaches and initial insomnia. He experienced anhedonia,556 low mood for days with anxiousness, poor memory and concentration and was sometimes hypomanic.557 Hassan denied any previous history of anxiety or depression.558
Dr Afanasyev administered a Kessler Psychological Distress Scale questionnaire (K10).
Hassan recorded a score of 35/50 during this assessment indicating a very high level of psychological distress.559 Dr Afanasyev prepared a GP Mental Health Treatment Plan and referred Hassan to psychologist Tony Pirotta at the Hart Centre for an opinion regarding Hassan’s anxiety and depression with possible personality disorder. Dr Afanasyev did not identify any suicidal risk and planned to review Hassan in three months’ time.560
553 T829, 833 (Beyza Eren).
554 T833 (Beyza Eren).
555 CB, Medical Records of Barry Road Medical Centre, p 1284.
556 An inability to feel pleasure in normally pleasurable activities.
557 CB, Medical Records of Barry Road Medical Centre, p 1284.
558 CB, Medical Records of Barry Road Medical Centre, p 1284.
559 CB, Medical Records of Barry Road Medical Centre, pp 1286, 1289.
560 CB, Medical Records of Barry Road Medical Centre, pp 1284, 1287.
561 CB, Report of Tony Pirotta dated 15 November 2018; T833-4 (Beyza Eren).
562 CB, Report of Tony Pirotta dated 15 November 2018.
Hassan’s conduct in the days leading up to the Bourke Street incident
On 5 November 2018, Hassan purchased four propane gas cannisters and three empty 4kg LPG bottles from a hardware store in Broadmeadows, along with other barbeque equipment.563 According to Ms Eren, she and Hassan were not big barbeque people564 and attributed the purchase – notwithstanding that their financial resources were limited – to a planned holiday.565 Although she saw the barbeque and a spatula at their home, Ms Eren denied seeing any of the gas bottles or cannisters.566
Around 7 November 2018, there is evidence of Hassan and Ms Eren exchanging text messages about booking a cabin for a family holiday.567 Ms Eren testified that they discussed a holiday to ‘get away in nature’ and though she had made online enquiries no accommodation had been booked.568 Ms Eren was unable to recall where they were going to go and stated that Hassan had not previously taken her away.569
On about the same day, Hassan visited his family. According to his sister, he was ‘smiling, laughing…it was almost like the ‘paranoid day’ hadn’t happened.’570
At midday on 8 November 2018, Mr Yavuz observed Hassan’s ute on a jack in the driveway with a flat tyre.571 The ute had been there for some time, but it was gone when he next visited at lunchtime the following day.572 Hassan bought a VicRoads vehicle registration permit for his ute that day.
On 9 November 2018, at 12.44am, Hassan attended the BP Service Station in Coolaroo, driving Ms Eren’s car, where he purchased a $10 Optus recharge card.573
At 1.29pm, Hassan stopped at the BP Service Station in Coolaroo, where he inflated the right rear tyre and filled his ute with $10 of fuel. 574 563 Exhibit 24, Statement of JCTT Officer B dated 5 July 2019.
564 T809 (Beyza Eren).
565 T840 (Beyza Eren).
566 T809 and 838 (Beyza Eren).
567 Exhibit 24, Statement of JCTT Officer B dated 5 July 2019.
568 T808 (Beyza Eren).
569 T808 (Beyza Eren).
570 AM 12, Statement of Asha Ali dated 27 November 2020.
571 T756 (Muammer Yavuz).
572 T756 (Muammer Yavuz).
573 Exhibit 24, Statement of JCTT Officer B dated 5 July 2019.
574 Exhibit 24, Statement of JCTT Officer B dated 5 July 2019.
CCTV footage and cell phone data show that Hassan travelled to the vicinity of the AlMuntada Mosque in Coolaroo, where he was suspected to have attended between 1.43pm and 2.13pm.575 However, this was not confirmed until Ms Eren gave evidence at the inquest.576
Ms Eren testified that she and Hassan went to the mosque for lunchtime prayers, as was their custom.577 They travelled in separate cars,578 with Hassan driving his ute because he said he wanted to sell it.579 She did not observe anything – such as three LPG bottles – in the ute and stated that Hassan did not return home after prayers.580 Ms Eren did not see Hassan speaking to anyone at the mosque; he walked her to her car after prayers, told her that he would sell his car, and they then went their separate ways, Ms Eren returning to their home.581
At approximately 2.33pm, Hassan placed a call to Frankie’s A1 Car Sales in Werribee.
At approximately 3.07pm, Hassan entered the Gozleme Café in Docklands, where he is believed to have distributed Islamic pamphlets.582 At inquest, Ms Eren explained that she had encouraged Hassan for some time to go out, speak to people and hand out pamphlets for Da’wah583 to teach people about Islam.584 She could not recall the content of the pamphlets, whether she had suggested Hassan distribute them that morning or if it was something he did of his own volition.585 Ms Eren did not consider it odd for Hassan to decide to hand out pamphlets on that particular day because he was a ‘very random person.’586
Between 3.40pm and 3.58pm, Hassan drove around the Melbourne CBD, where his movements were captured comprehensively on CCTV. He then left the CBD and appears to 575 Exhibit 24, Statement of JCTT Officer B dated 5 July 2019.
576 T811 (Beyza Eren).
577 Ms Eren estimated being at the mosque around 12-1pm, however, given the CCTV and cell phone data, it is likely they in fact attended between 1.43 and 2.13pm.
578 T810-1 (Beyza Eren).
579 T841 (Beyza Eren).
580 T841 (Beyza Eren).
581 T811-2 (Beyza Eren). Ms Eren gave evidence that she and Hassan intended to move out of their Meadow Heights residence together. She stated she was looking at rentals at the time, but was not inspecting any properties and had not yet found anything. According to Ms Eren, Hassan told her that he would sell his car to assist with funding the move, but that the funding for the move would mainly come from her. T808 (Beyza Eren).
582 Exhibit 24, Statement of JCTT Officer B dated 5 July 2019.
583 Da’wah is the act of inviting or calling people to embrace Islam.
584 T810-1, 841 (Beyza Eren).
585 T841 (Beyza Eren).
586 T841-2 (Beyza Eren).
have driven to Richmond, based on cell phone data, before returning to the CBD and parking his ute in Bourke Street a little after 4pm.587
Ms Eren confirmed she phoned Hassan at about 4.00pm.588 She did not think he answered but recalled speaking to him around that time. She testified that the conversation was about what they would have for dinner and what time Hassan would be home.589 She believed that she asked him what he was up to and he told her he was in the city trying to find a place to hand out the pamphlets. Ms Eren thought Hassan sounded anxious and ‘a bit like in a rush to get off the phone.’590 She did not think much of it at the time, and thought he was anxious about the pamphlets.591 Although Ms Eren was extensively cross-examined about her apparent inability to remember the content of this call, she maintained that she could remember nothing else about it.592 Forensic and Operation Crabbenburg findings
Examination of Hassan’s ute by forensic officers after the Bourke Street incident revealed three LPG gas bottles with taps that had all been opened to some degree,593 a green propane gas bottle of the kind typically used for camping appliances, and a melted red plastic container which appeared to have been used to store and transport petrol.594 There was evidence of petrol having been poured throughout the vehicle, particularly on the rear passenger seats.595 A cigarette lighter was found in the central console, along with a 15cm knife under the 587 Exhibit 24, Statement of JCTT Officer B dated 5 July 2019.
588 The JCTT investigators obtained a warrant to seize Ms Eren’s phone, but it was unable to be located and was suspected to have been deliberately disposed of. Telephone intercepts of the phone indicated it was switched on for a short period of time on three occasions between December 2018 and January 2019 within the Roxburgh Park, Somerton, Flemington and Werribee areas (Exhibit 24). At inquest, Ms Eren gave evidence that she was aware that police wanted to look at the phone, but had thrown the phone down the drain shortly after the Bourke Street incident and believed she had separately thrown away the SIM card as the phone contained intimate personal photographs of her and she ‘was in a panic and…just really wanted to be left alone.’ Her evidence was that she had already disposed of the phone by December 2018, and was unable to explain why the phone had pinged in December 2018 and January 2019 (T815-6). Counsel Assisting submitted that the explanation for disposing of the phone was ‘convenient and unconvincing,’ and Ms Eren had not given a reasonable or satisfactory explanation for the three ‘pings’ of the phone at cell tower locations near where she was living after she had disposed of the phone (Closing Submissions by Counsel Assisting). However, the review of all other electronic communications between Ms Eren and Hassan did not identify any evidence that she had any prior knowledge of Hassan’s intention to conduct the incident, and there were text messages between Ms Eren and Hassan two days prior to the incident about booking a cabin for a holiday indicating they were making plans beyond the incident (Exhibit 24).
589 T813 (Beyza Eren).
590 T813 (Beyza Eren).
591 T812-3, 845 (Beyza Eren).
592 T844 (Beyza Eren).
593 Exhibit 39, Statement of Forensic Officer Laura Noonan dated 13 December 2018; T721 (Forensic Officer Noonan).
594 Exhibit 39, Statement of Forensic Officer Laura Noonan dated 13 December 2018; T721 (Forensic Officer Noonan).
595 Exhibit 39, Statement of Forensic Officer Laura Noonan dated 13 December 2018; T721 (Forensic Officer Noonan).
driver’s seat and religious papers with the headings, ‘ISLAM THE WAY OF GOD’ and ‘KUFR
Forensic Officer Laura Noonan, of the Victoria Police Forensic Services Centre, concluded that the cause of the fuel-air explosion and subsequent fire was the ignition of flammable LPG and petrol vapours present in the passenger compartment of the ute. She considered that the cigarette lighter in the central console was the most likely source of ignition.596 Ms Noonan explained that the evidence ‘tended … to lean more towards a deliberate act of at least causing a fire, if not an explosion.’597
The JCTT’s Operation Crabbenburg involved interrogation of electronic devices seized598 soon after the Bourke Street incident during the execution of search warrants at premises connected with Hassan as well as review of its Operation San Jose (2016-7) holdings. Its purpose was to identify the trigger for the incident and whether any other person had advanced knowledge of it or had assisted Hassan.
The JCTT established that there were a number of strains on Hassan’s life, including drug use, marital issues and infidelity, a new-born child, isolation from others including his family, and financial strain, as well as a prior interest in watching ISIS material with his brother.599
Operation Crabbenburg did not identify any evidence that Hassan adhered to a certain set of ideas or action, nor was there any contemporaneous escalation in social media posts, communication with radicalised individuals or access to extremist literature in the lead up to the incident.600 In short, the JCTT was unable to identify any evidence of Hassan planning for or preparing to commit an act of politically motivated violence.601
The JCTT considered that Hassan’s actions at Bourke Street on 9 November 2018 bore the hallmarks of an act of terrorism,602 given the nature of the multi-modal attack in which he used a vehicle-borne improvised explosive device and then a knife to attack members of the 596 Exhibit 39, Statement of Forensic Officer Laura Noonan dated 13 December 2018; T721 (Forensic Officer Noonan).
597 T746 (Forensic Officer Noonan).
598 Exhibit 24, First Statement of JCTT Officer B dated 5 July 2019; Exhibit 25, Second Statement of JCTT Officer B dated 13 July 2020.
599 Exhibit 24, First Statement of JCTT Officer B dated 5 July 2019.
600 T568-9 (JCTT Officer B).
601 T513 (JCTT Officer B); Exhibit 24, First Statement of JCTT Officer B dated 5 July 2019; Exhibit 25, Second Statement of JCTT Officer B dated 13 July 2020.
602 Exhibit 24, First Statement of JCTT Officer B dated 5 July 2019.
public, along with the words603 he was reported to have uttered.604 The attack aligned with actions – in preparation and execution – encouraged by extremist publications, particularly instructions and methodology detailed in ‘The Lone Mujahid Pocketbook’605
The JCTT assessed that Hassan adhered to an extremist interpretation of Islam606 and carried out a pre-meditated attack inspired, rather than directed, by ISIS607 in furtherance of that ideology. However, in the absence of any definitive statement from Hassan to clarify his intentions or motive, it was not possible for JCTT to ascertain with any certainty an impetus or precipitating factor for the attack.608
Operation Crabbenburg did not uncover any evidence that any other person had advance knowledge of, influenced or otherwise supported Hassan’s actions in Bourke Street;609 he appeared to be a ‘lone wolf actor.’610
Broadly, I accept the conclusions reached by the JCTT’s Operation Crabbenburg.
603 Witnesses Sergeant Christy Walsh and Senior Constable Lachlan Hefferman gave evidence that they heard Hassan repeating the words “Allahu akbar” (God is Great) after he had been shot and was on the ground. See Exhibit 31, Statement of Sergeant Christy Walsh dated 9 November 2018, Exhibit 33, Transcript of Interview with Senior Constable Lachlan Hefferman on 9 November 2018. JCTT Officer B gave evidence that these words have been uttered many times before within JCTT investigations, particularly around terrorism attacks.
604 Exhibit 24, First Statement of JCTT Officer B dated 5 July 2019.
605 The Lone Mujahid Pocketbook is an Islamic extremist publication, first published in 2013, which provides instructional methodology on executing acts of politically motivated violence. Whilst subsequent investigations were unable to confirm whether Hassan had been in possession of, or had been provided with access to such instructional materials, JCTT Officer B considered it was highly likely that Hassan had accessed the Pocket Book or similar publications through unknown means, given his actions on 9 November 2018 seemed to replicate what was encouraged in the document and similar publications (T531, 560, 564). The Pocketbook had been downloaded by Hassan’s brother Ali in June 2017 (CB 2803, 2812) but there is no evidence that Ali had shared the Pocketbook with his brother, or whether Ali had accessed or been informed of the contents of the Pocketbook via other unidentified persons or unknown means (T564). Exhibit 24, First Statement of JCTT Officer B dated 5 July 2019.
606 The evidence before me indicated that Hassan struggled with his religion at times and was not always devout.
However, this is not a factor that precludes politically motivated violence in support of an extremist religious ideology.
JCTT Officer B gave evidence that it is not necessary for someone to be a practising Muslim in order for them to commit a terrorism offence. He explained that there is a spectrum, and that he had observed persons who would appear to be devout, and others who he had observed to be quite “loose” with their commitment to faith. T518 (JCTT Officer
607 T513 (JCTT Officer B); Exhibit 24, First Statement of JCTT Officer B dated 5 July 2019.
608 Exhibit 24, First Statement of JCTT Officer B dated 5 July 2019.
609 Exhibit 24, First Statement of JCTT Officer B dated 5 July 2019; Exhibit 25, Second Statement of JCTT Officer B dated 13 July 2020.
610 T568 (JCTT Officer B).
The standard of proof for coronial findings of fact is the civil standard of proof, on the balance of probabilities, with the Briginshaw gloss or explication.611 The effect of the authorities is that Coroners should not make adverse findings against or comments about individuals, unless the evidence provides a comfortable level of satisfaction that they caused or contributed to the death.
Having applied the applicable standard to the available evidence, I find that: a. the absence of intelligence since 2015 indicating Hassan remained sympathetic to Islamic extremism (and/or ISIS) was not indicative that he no longer held such views, yet it was regarded as having that effect by members of the SIU and CVE Unit; b. the decision within SIU to effectively manage Hassan as a low risk NSPOI was premature considering the clear intelligence gaps identified during the ANZCTC tool assessment process and the SIU’s intention to fill those gaps to ascertain whether and to what extent Hassan was radicalised; c. deficient procedures within the SIU, particularly apparent between January and October 2018, led to: i. delayed completion of tasks; ii. assessments made on the basis of incomplete and/or inaccurate information; iii. an erroneous perception of the need to continue passive monitoring after 15 August 2018; iv. missed opportunities for timely CVE Unit referral; and v. missed investigative opportunities, including opportunities to fill intelligence gaps itself or with the assistance of intelligence partners and general duty police; d. Fawkner Highway Patrol acted reasonably and appropriately in executing the outstanding arrest warrants and bailing Hassan from the roadside on 12 October 611 Briginshaw v Briginshaw (1938) 60 C.L.R. 336 esp at 362-363. “The seriousness of an allegation made, the inherent unlikelihood of an occurrence of a given description, or the gravity of the consequences flowing from a particular finding, are considerations which must affect the answer to the question whether the issues had been proved to the reasonable satisfaction of the tribunal. In such matters “reasonable satisfaction” should not be produced by inexact proofs, indefinite testimony, or indirect inferences…”
It was reasonable for the general duty police members to accept the address Hassan provided, which was corroborated by his driver’s license, in the absence of any other information to indicate this address was no longer current; e. opportunities to prevent the incident in Bourke Street on 9 November 2018 may have been missed, however I am unable to conclude that Hassan’s trajectory towards it would have been averted if, singly or in combination: i. the tasks and intelligence gaps had been filled in a timely manner by the SIU or otherwise; ii. different threat assessment had been made or management options used; iii. the referral to the CVE Unit had been accepted; or iv. Hassan had been remanded in custody rather than bailed on 12 October 2018; f. the information known to Victoria Police, Joint Counter Terrorism Team and the Australian Security Intelligence Organisation provides no indication that Hassan was planning or preparing for a terrorist attack. Nor is there evidence that any other person was involved in the incident, had advance knowledge or was supportive of it; g. Hassan’s actions in the Melbourne CBD on the afternoon of 9 November 2018 were deliberate and premeditated, with planning commencing no later than 5 November
The planning and execution of the incident was consistent with instructions in ISIS publications, though it is not possible to determine with certainty when or where Hassan obtained these instructions; h. while there is insufficient evidence to quantify to what degree, if any, mental health issues contributed to Hassan’s actions, it is not possible to exclude the possibility that he had a psychiatric illness at the time of the 9 November 2018 incident; i. the weight of the available evidence supports a finding that Hassan’s actions in the Melbourne CBD on the afternoon of 9 November 2018 constituted a premeditated act of terrorism, an ISIS-inspired attack attributable to his adherence to an extremist interpretation of Islam; j. Sisto died in Bourke Street, Melbourne on 9 November 2018 of a stab wound to the chest; k. Hassan caused Sisto’s death by inflicting a stab wound to his chest;
l. Hassan died at the Royal Melbourne Hospital on 9 November 2018 of a gunshot wound to the chest; m. Hassan’s death occurred because Police Officer A1 discharged his firearm once and shot Hassan in the chest. The shooting was an appropriate and justified use of force in the circumstances and accorded with the Operational Safety Tactics training provided to Victoria Police members; n. the conduct and use of force by all other on-duty police members involved in the confrontation and apprehension of Hassan was appropriate and in accordance with Victoria Police training; and o. having regard to the totality of the evidence, the Operational Safety Tactics equipment available to the metropolitan general duty Victoria Police members was adequate.
COMMENTS Pursuant to section 67(3) of the Coroners Act 2008, I make the following comment connected with the death:
The effects of violence – whether perpetrated in public or in private, between intimates or strangers – reverberate. Politically motivated violence, though, unlike other forms of violence is intended to instil fear within a community and disrupt its social and other functions.
There is no doubt that the terrorist attack perpetrated by Hassan in Bourke Street, Melbourne, on 9 November 2018 has had significant and lasting effects on many people.
Two families are grieving the loss of a loved one, several individuals faced the very real prospect of physical injury – civilians and first responders alike – and two men sustained physical injuries. The psychological impacts of these events on those who intervened to protect, assist, and comfort as well as those who witnessed them unfold cannot be overestimated.
the Victorian community. I acknowledge those individuals for their selfless actions, including: a. Rodney Patterson and Darren Allen, members of the public, who, upon seeing the ute explode, went to render assistance; b. the Victoria Police uniform and CIRT members who acted to restore community safety by stopping Hassan’s determined attack; c. Jeferey Reid-Payne and Michael Rogers, members of the public, who assisted Police Officers A1 and B2 to contain Hassan using café chairs and a shopping trolley; d. off duty Victoria Police members Sgt Christy Walsh and Senior Constable Lachlan Hefferman, who intervened to assist and support Police Officers A1 and B2 despite not having the benefit of OST equipment; and e. Lei Zhang, Maria Tutolomontoya, Aemon Davie, John Raygor, Christopher Couwenberg and others who provided aid and comfort to the injured and dying.
Notwithstanding that politically motivated violence is a numerically rare occurrence and acknowledging the inherent challenges of predicting offending of this type, the tragic outcome of the terrorist attack perpetrated by Hassan, shows that any potential for improvement should be identified, considered and pursued.
Although the lessons learned from the evidence adduced in the investigation and inquest into Sisto and Hassan’s deaths were identified largely with the benefit of hindsight, the need for vigilance in processes and timely action has been highlighted: even NSPOIs apparently indicating a minimal threat profile should be the subject of rigorous assessment and fulsome intelligence so that informed decisions can be made by those tasked with making them.
Moreover, given the very serious threat posed to society by terrorism incidents, any potential for de-radicalisation and deterrence from a trajectory toward extremism should be given the best chance to succeed, even where the chances of succeed appear to be remote. The importance de-radicalisation programs can play in the prevention of terrorist incidents has been noted in other coronial findings.612 612 See Coroner John Olle’s Finding into the death of Ahmad Numan Haider COR 2014 4917.
RECOMMENDATIONS Pursuant to section 72(2) of the Coroners Act 2008, I make the following recommendations connected with the death:
That Victoria Police review and, if necessary, amend any SIU Standard Operating Procedures (SOPs) to ensure they provide specific guidance about all aspects of its management of NSPOIs including: a. prescription of timeframes for the completion of tasks as well as procedures to ensure that outstanding tasks on a NSPOI file come to the attention of the relevant Team Manager to action and follow up; b. mechanisms to ensure that the SIU reviews all active files at regular intervals irrespective of an absence of evidence of escalating behaviours or the NSPOI’s determined threat/risk level; c. when a fresh ANZCTC assessment should occur in response to new intelligence received about a NSPOI; d. procedures relating to access and circulation of information received via ASNET to ensure that ASNET information relating to a NSPOI comes to the attention of the relevant Team Manager, and any other decision-maker (including CVE Unit member), in an accurate and detailed form; e. a process for the documentation on ASNET of classified security information communicated to the SIU verbally; f. a process for the referral of NSPOIs to the CVE Unit for de-radicalisation intervention(s); g. a process involving senior SIU management to consider the appropriateness of managing a NSPOI as though s/he poses a lower level of risk in circumstances where the ANZCTC tool is regarded as having overemphasised the NSPOI’s threat profile before the final treatment option is validated by (or as part of an enhanced process within) the NSPOI Allocation Meeting; and h. expectations about consultation with partner agencies.
That Victoria Police deliver training to all (temporary and permanent) SIU staff about the SIU’s SOPs and raise awareness among them about the procedures used by its CTC partners, particularly the CVE Unit.
That Victoria Police develop and deliver training and/or a policy to ensure that information regarding disputed address details is recorded on LEAP by the member who makes that assessment and that such information is easily accessible to any police members verifying identification details via LEAP.
That Victoria Police review, and if necessary amend, any policy relating to the use of annotations on NSPOI and other LEAP warning flags, including the circumstances in which flags should be annotated, by whom and how they may be tailored to address specific information/intelligence gaps identified by SIU where general duties members may be able to provide assistance.
That Victoria Police develop and implement a review where an actual or attempted terrorist incident has occurred to identify any opportunities for improvement in national security intelligence collation, analysis and assessment, and NSPOI management.
That Victoria Police and its national security intelligence partners consider developing a joint review process where an actual or attempted terrorist incident has occurred to identify any opportunities for improvement.
ORDERS AND DIRECTIONS I order that this finding be published on the Coroners Court of Victoria website in accordance with the rules.
I direct that a copy of this finding be provided to: The family of Sestilio Malaspina The family of Hassan Khalif Shire Ali, C/- Stary Norton Halphen Criminal Lawyers Chief Commissioner of Victoria Police, C/- Victorian Government Solicitors Office Australian Federal Police, C/- Australian Government Solicitor Australian Security Intelligence Organisation, C/- Australian Government Solicitor Detective Senior Constable Mick Drew, Coronial Investigator Signature: _________________________________
JUDGE JOHN CAIN State Coroner Date: 28 June 2021
Natasha Stojkoski, a 38-year-old sales assistant at The Good Guys, sustained a workplace injury in October 2018 involving a Work Assisted Vehicle incident affecting her back, shoulders and neck. Subsequently, she reporte…
Harrison William Ladd, 25, died from combined drug toxicity involving clonazepam, dexamphetamine, codeine, diazepam and pholcodine. He had complex mental health and substance use disorder requiring specialist addiction c…
Simon Gaskill, aged 50, was found deceased in sand dunes at Ocean Grove Beach in April 2022 after sleeping rough for months. He had been discharged from hospital in December 2021 following treatment for severe alcohol wi…
Source and disclaimer
This page reproduces or summarises information from publicly available findings published by Australian coroners' courts. Coronial is an independent educational resource and is not affiliated with, endorsed by, or acting on behalf of any coronial court or government body.
Content may be incomplete, reformatted, or summarised. Some material may have been redacted or restricted by court order or privacy requirements. Always refer to the original court publication for the authoritative record.
Copyright in original materials remains with the relevant government jurisdiction. AI-generated summaries are for educational purposes only and must not be treated as legal documents. Report an inaccuracy.