Security Intelligence investigations

Security intelligence investigations sit at the heart of what we do and have two distinct phases:

• Lead inquiries
• Full investigation.

All our work happens under legislation and robust oversight.

All our investigations being with a lead. A lead is the initial piece of information that  indicates a potential threat to New Zealand’s national security. Our leads come from a range of sources, including:

• Our own threat discovery work to proactively identify threats to security, such as through our use of known indicators of violent extremism
• Existing NZSIS investigations
• Overseas security and intelligence partners
• Domestic New Zealand government partners, for example the Government Communication Security Bureau, New Zealand Police, New Zealand Customs
• Tips from members of the public who share concerns with us in confidence.

The key objectives of our lead inquiries are to judge the credibility of any threat information and determine if there is any link to national security. Our investigators carry out targeted inquiries to triage the information and work out whether the lead needs to progress to a full investigation, be passed to other agencies, or be closed.

The diagram below shows how we investigate national security threats with lead information:

Credible leads with a link to national security may need to be progressed to a full investigation. It is at this stage that our investigators are seeking to really understand the nature of the threat posed by an individual, group or organisation.

Investigations are often seeking to establish the intentions, plans and capabilities of those who pose the potential national security threat. Investigations define the key questions NZSIS needs to answer, which we try to do through our intelligence collection work.