The Watchlist Paradox—and the Jurisdictional Shield - Bondi Terror Attack

 

In the days after the Bondi terror attack, Australia’s familiar cycle of grief gave way to a more corrosive emotion: doubt. Not doubt about whether the violence happened, but doubt about whether the State’s counterterrorism machinery—sold to the public as alert, integrated and pre-emptive—worked as advertised.

That doubt has a pattern. It emerges when a government confirms what citizens dread hearing after an atrocity: the alleged perpetrator wasn’t unknown. He had been on the radar.

Prime Minister Anthony Albanese has said that Naveed Akram first came to ASIO’s attention in 2019, was assessed for a period, and was later judged to pose no ongoing threat. After the attack, he also acknowledged that something was missed in the years that followed. Those two statements, taken together, create what many Australians now experience as the central contradiction of modern counterterrorism: the same closure decision that reads as rational before an attack reads as indefensible after it.

Call it the watchlist paradox. Before the event, “no ongoing threat” is an administrative conclusion reached under uncertainty, resource constraints, and legal thresholds. After the event, it becomes post-attack evidence—proof, in the public mind, that the system was either asleep at the wheel, hiding behind process, or protecting itself.

The details that swirl around Bondi add oxygen to the paradox. There is the reported overseas travel close to the attack. There is the question of household firearms access when someone in a household has previously drawn counterterror attention. There is the broader context—a rise in antisemitic threats, heightened concern around public Jewish gatherings, and a political argument over whether the attack is best understood primarily as antisemitic targeting, ISIS-inspired ideology, or both. Each element is ambiguous on its own. Together, they form the kind of constellation that causes citizens to say, instinctively, “Surely that should have set off alarms.”

Security agencies have a familiar response, and it is not necessarily disingenuous. They point to the math. Intelligence work is triage. Thousands of leads are assessed. Many are closed because they fail thresholds, lose traction, or do not justify continued intrusion into a person’s life. The overwhelming majority of those assessed never commit violence. If the system treated every prior lead as permanent suspicion, it would become a machine for endless surveillance and permanent error.

All true. But it misses the legitimacy problem. The public does not triage the way agencies triage. Agencies triage for probability under constraints; citizens triage for catastrophe. In low-frequency, high-consequence events, the public expects governance to behave differently—not to be omniscient, but to be structurally hardened against the worst-case outcome.

That expectation becomes politically explosive precisely because the public can’t see the decision chain. It can’t see what was known, what was shared, what thresholds applied, what was requested, what was resourced, and why. So it fills the vacuum with inference.

International precedent intensifies the problem. In multiple democracies, major attacks have been followed by revelations that perpetrators had previously been investigated, deprioritised, or closed. The common lesson from those cases is not that intelligence agencies “let it happen.” The more plausible lesson is more institutional, and more troubling in its own way: closure is too often treated as an administrative endpoint rather than as a risk decision with continuing accountability. Once a file is closed, it tends to fall out of the system’s decision ecology unless a clear trigger forces reassessment.

Real-world radicalisation rarely provides that clarity. It can be nonlinear and opportunistic. People can sit in low-visibility ideological space for years and then accelerate rapidly in response to networks, travel, personal crises, or shifting global events. A closure regime built like a filing cabinet—open, close, archive—will always be vulnerable to that acceleration.

This is why Bondi can’t be reduced to a simple question—“Did ASIO fail?”—because the real issue is governance design: How does the system decide closure? How does it decide reopening? What counts as a trigger? Who sees those triggers? And what happens when a trigger appears in a different silo—policing, licensing, borders, or community security channels?

These are governance questions, not press-conference questions. They can’t be answered with reassurance, because reassurance is not evidence.

Which brings the debate to the second, quieter phenomenon shaping public trust after Bondi: not just what government says about the attack, but which process it chooses to examine itself.

Mr. Albanese has doubled down on refusing a federal Royal Commission, opting instead for a Commonwealth review while NSW pursues its own state Royal Commission. On paper, it looks like a division of labour: NSW interrogates what happened on the ground; the Commonwealth examines national security settings. In legitimacy terms, it functions as something else: a partition.

A NSW Royal Commission is at its strongest when it examines NSW institutions—police operational planning, event resourcing, state briefings, and the handling of community warnings inside NSW government channels. But the hardest questions Bondi raises—watchlist governance, intelligence triage, closure discipline, and federal-state information sharing—run directly into Commonwealth agencies, particularly ASIO and the AFP.

In a federation, that matters. Jurisdiction is not just a legal boundary; it is a scrutiny boundary. It determines which agencies are unambiguously inside the coercive perimeter of an inquiry and which are merely “cooperating” from the outside.

This is the jurisdictional shield effect. By channeling the most coercive fact-finding mechanism—a Royal Commission—into the state lane, while placing Commonwealth intelligence and federal law enforcement inside a review lane, the government reduces the probability of the kind of public, adversarial scrutiny that restores legitimacy after a trust collapse.

The difference between a Royal Commission and a review is not performative. It is structural.

First, reviews are typically less public. Even when led by credible figures, they often operate behind closed doors because their evidentiary substrate is classified. They may see material the public never sees. They may reach conclusions that can’t be fully explained. The public is then asked to accept a summary. In a trust deficit environment, summaries are precisely what people reject.

Second, reviews rarely deliver adversarial testing. Royal Commissions, through compelled documents and sworn testimony, can force precision. They can expose contradictions. They can test whether a warning was received, who read it, what was done, and why. Reviews can consult and recommend, but they are not built to litigate competing accounts in public view. That changes incentives. In adversarial settings, institutions are forced into clarity. In consultative settings, institutions can frame decisions as reasonable trade-offs without being forced to answer the sharpest questions under oath.

Third, partitioning invites accountability displacement. When failures span multiple agencies, each can point to the other: police lacked intelligence; intelligence lacked actionable threshold; licensing isn’t an intelligence function; ministers weren’t briefed; agencies weren’t asked. A single coercive inquiry with cross-jurisdiction reach is designed to defeat this by compelling an integrated chronology. A split model risks reproducing the very silo structure that critics say enabled the failure.

None of this proves motive. It doesn’t prove that Mr. Albanese is “protecting” ASIO or the AFP in any deliberate sense. But it does establish something that matters more in politics than motive: effect. The effect of the “NSW Royal Commission + federal review” route is to reduce the intensity and visibility of scrutiny applied to Commonwealth agencies compared with what would occur under a federal or genuinely joint Royal Commission.

In politics, effects matter because effects shape perception. If the most powerful agencies are insulated from the most coercive public process, citizens will infer that institutional protection is part of the calculus—even if that inference cannot be proven without access to cabinet deliberations.

And this is where the watchlist paradox and the jurisdictional shield converge. When the public learns that an alleged perpetrator was previously known to intelligence, closure is asserted, risk indicators appear to have accumulated, and the government then rejects the strongest public truth-finding mechanism available, trust does not merely erode. It metastasises. Every future assurance sounds thinner. Every refusal to disclose “operational details” reads as evasion. The legitimacy crisis becomes self-sustaining.

The remedy is not to demand omniscience from agencies or to treat every closure decision as scandal. The remedy is to accept the democratic logic that exists precisely for moments like this: where warning indicators and chains of responsibility are contested, the State must submit to a process that can compel records, compel sworn testimony, and reconstruct the full chronology—what was known, what was shared, what was requested, what was decided, what was resourced, and why.

Without that, Bondi risks becoming another entry in a well-worn international pattern: prior interest, closure, catastrophe—followed by official conclusions that may be technically correct yet politically inadequate, because they arrive without the one thing a traumatised public requires to believe again: proof.

By Charlie Armstrong Adams