ASIO's 2024 review of past terror cases didn't extend to prior flag on Bondi attackers

The head of Australia's domestic intelligence agency has revealed that ASIO reviewed past terrorism investigations after raising the threat level in 2024, but a resourcing decision meant it did not extend to a re-examination of the men soon to be the Bondi gunmen.

Called as the first witness in the latest phase of hearings at the royal commission investigating the massacre, ASIO director-general Mike Burgess also defended a significant decline in the share of funding devoted to counterterrorism.

Mr Burgess told the royal commission the raising of the terrorism threat level in August 2024 to "probable" was due to a deteriorating security environment in the wake of the October 7, 2023, attacks on Israel.

It sparked a decision to review the past 12 months of investigations into terrorism suspects.

ASIO's decision to limit the review of its counterterrorism caseload to just the past year meant the agency did not re-examine Bondi gunmen Naveed and Sajid Akram, who the agency had investigated five years earlier in 2019.

That investigation into the Akrams' links to an Islamic State (IS) cell concluded the father and son did not pose a terrorism threat or support IS.

It is an assessment that has since been questioned by the commission's former special adviser, ex-ASIO boss Dennis Richardson.

Today's revelation raises the possibility that ASIO could have learned that the Akrams had travelled around 2022 to Uzbekistan.

Uzbekistan is a gateway to Afghanistan and an active area for the influential Islamic State Khorasan Province branch.

ASIO could have also learned that Sajid Akram had obtained a firearms licence from NSW Police and was legally acquiring guns.

Counsel assisting the commission, Richard Lancaster SC, asked Mr Burgess why the review of previous terrorism suspects was limited to 12 months.

Mr Burgess said that was a resourcing decision, despite his insistence that ASIO's counterterrorism resourcing was adequate.

"That's a judgement made by our organisation in terms of where we've got our resources, what we need to do at that point in time," he said.

"We've got our immediate caseload that we have underfoot that needs resources applied.

"We made a judgement to go back 12 months just to satisfy ourselves those individuals and their circumstances haven't changed, and to make sure our assessment is still valid."

ASIO decided to limit the caseload under review despite warnings in the National Counter-Terrorism Plan that terrorism suspects from years earlier could pose a threat.

The commission did not draw attention to the fact in today's hearing.

The plan, which guides the policies and practices of ASIO and other agencies, says:

"Experience in Australia and overseas has shown the potential for … former subjects of counterterrorism investigations (known entities) to re-engage in violent extremist activity, including planning for or undertaking terrorist attacks.

"Some have undertaken attacks or attack planning years after a point-in-time assessment."

Mr Burgess told the hearing ASIO also reviewed the cases of young people involved in deradicalisation programs dating back to 2023 as a result of the raising of the threat level.

Burgess says no serious matters 'uninvestigated'

The ABC revealed last week that ASIO had reduced counterterrorism resourcing to its lowest funding share this century before the Bondi attack.

Mr Burgess told the hearing today that while resourcing was "stretched" it was sufficient and no serious leads were left uninvestigated in the years before the Bondi attack.

He was questioned extensively on ASIO's priorities in the years leading up to December 2025, particularly decisions in the early 2020s to shift resources towards escalating espionage and foreign interference threats and away from counterterrorism.

ASIO had reduced the terrorism threat level in 2022 but increased it back to "probable", meaning an attack was assessed as more than 50 per cent likely.

Mr Burgess said while the terrorism risk grew, threats from foreign states were not diminishing and the agency was left managing both challenges at once.

"It certainly stretches us, and stretched us at the time," he said.

"But we have a very effective identification and prioritisation process by which we're looking at what we have.

"I'm confident as director-general that even during that time, when my officers were working really hard, we were not leaving serious matters untreated or uninvestigated.

"That's the matters [we had] before us, of course. We are not all-seeing and all-knowing."

Burgess acknowledges flaws in holiday threat assessment

Mr Burgess also acknowledged that a holiday season threat assessment — issued to police and government agencies less than two weeks before the Bondi attack — did not specifically address the terrorism threat to Hanukkah, as revealed by the ABC on Saturday.

He said that with the benefit of hindsight the document could have included ASIO's concerns about antisemitic terrorism.

Police relied on the holiday season threat assessment to plan for events in December and January.

NSW Police only assigned four officers to periodically patrol the Chanukah by the Sea event where the Akrams killed 15 people.

ASIO had issued an earlier threat assessment that warned of possible attacks against Jewish Australians in October 2025 on the day after a fatal IS-inspired attack on a synagogue in Manchester on the holy day of Yom Kippur.

That threat assessment warned of "the enduring threat to Jewish interests … in Australia", particularly at crowded places and on holy days "leading up to Hanukkah".

Mr Burgess told the commission that police should not read ASIO threat assessments, released at various times through the year, in isolation.

He warned that Australia's terrorism threat level was continuing to escalate and was now at "the upper level of probable", with a high risk extremists could "go to violence with little or no warning".

"We're flagging the environment is a lot hotter, and that concerns me and my agency," he said.

Today's hearings avoided specific questions around ASIO's intelligence on the Bondi gunmen.

Mr Burgess will return to a closed session during the current three-week block of hearings, which are focused on intelligence and security decisions in the lead-up to the attack.

Most of the next three weeks of hearings will be closed because they deal with information deemed classified or potentially prejudicial to the surviving gunman's criminal case.

Jewish community 'uneasy' about limited policing presence at Bondi event

The commission also heard NSW Police did no risk assessment of the Chanukah by the Sea event and rejected requests from a Jewish security group for a permanent police presence.

The chief operating officer of the Community Security Group (CSG) recounted a phone call with an inspector from Eastern Suburbs Police Area Command about the group's request for police to be stationed there throughout the event.

"[I said that] given the threat environment our community was facing, the fact that it was an open-air event, the fact that CSG could not be armed in that environment … and given the number of people expected to attend the event, we requested a static presence," he said.

The CSG witness, whose identity is protected by the commission, was asked how the police inspector replied.

"His response, to my recollection, was that they do not believe a static presence is required based on a risk assessment they would have undertaken internally," he said.

"I said there would be a lot of unease from the community not having a static police presence on the ground."

The commission heard of a remarkable surge in antisemitic hate crime incidents in the wake of the October 7, 2023, terror attack in Israel.

Hate crime incidents recorded by NSW Police leapt from 40 in 2020 to 445 in 2024, and 841 in 2025.

Despite the surge in antisemitism, NSW Police Counterterrorism Commander Leanne McCusker told the commission no threat assessment was prepared ahead of the Hanukkah event.

She was questioned on a decision by NSW Police not to carry out the assessment despite one being completed for the Jewish High Holy Days, a sacred period including Rosh Hashanah and Yom Kippur.

Events during the High Holy Days were classed as tier three while assessing for risks and resources, while Hanukkah was treated as tier one and handled by local police rather than specialist squads, including the counterterrorism command.

Assistant Commissioner McCusker told the commission that with hindsight that could change in future.

"I see no reason why a threat assessment could not be completed for that [Hanukkah] event," she said.

Ten people killed in 29 seconds

At the start of today's hearings Mr Lancaster gave a timeline of the mass shooting, telling the commission 11 people were shot, 10 of them fatally, within the first 29 seconds.

He said three police officers received gunshot wounds.

There were 11 officers on scene within five minutes.

Gunman Sajid Akram was shot dead, while Naveed Akram was shot and apprehended about 7 minutes and 41 seconds after the shooting began.

Mr Lancaster said there was no evidence that any intelligence or policing agency had any specific information prior to the shooting about the planning of an armed attack.

"In that sense it was a surprise attack," he said.

Former AFP counterterrorism commander Stephen Nutt also gave evidence and, like Mr Burgess and Assistant Commissioner McCusker, will return for closed hearings.