Why did it take 9 days to declare the Perth bombing attempt a terrorist attack?

Nine days after it happened, police have declared an alleged attempted bombing at an Invasion Day rally in Perth an act of terrorism.

A 31-year-old man is accused of throwing a homemade fragment bomb, filled with ball bearings and screws, into a crowd protesting on Australia Day. The bomb failed to detonate.

He has been charged with engaging in a terrorist act: the first time such charges, which carry a maximum sentence of life in prison, have been laid in Western Australia. This is in addition to previously laid harm and explosives charges.

Law enforcement and the media have been criticised for not calling the incident a terrorist attack sooner. But terrorism isn’t always cut and dry, and it’s crucial authorities get the necessary proof to have the best chance of successful prosecution.

What do we know about the attack?

WA Police, ASIO and the Australian Federal Police have been working together on the investigation, under the Joint Counter Terrorism Team arrangements.

They allege the man, who can’t be named for legal reasons, engaged in an “attack on Aboriginal people and other peaceful protesters”. They allege it was “motivated by hateful, racist ideology”.

He is accused of disguising the bomb in a child’s sock. It was allegedly intended to detonate on impact.

Authorities say they have evidence the man was accessing “pro-white male, pro-white material online”.

Why did it take 9 days?

When intelligence and law enforcement authorities investigate incidents like these, they must pursue every relevant line of inquiry.

In the immediate aftermath, it wasn’t clear whether the man police had taken into custody had any ideological motivation: a key distinguishing factor for terrorism as opposed to other (equally serious) offences, such as hate crimes.

Under the Australian Criminal Code, terrorism is violence and conduct done for the purpose of advancing a “political, religious or ideological cause”.

In an event such as the Bondi terror attack, the ideological motivations were relatively clear. Authorities found two Islamic State flags in the car that belonged to the accused gunmen.

In Perth, however, police had no such immediate evidence. They would have had to investigate every other conceivable possibility.

The man could have been having a severe psychotic episode, as in the tragic Bondi Junction stabbings. He could have been acting out of hate for Indigenous people that didn’t have an organising ideological framework behind it.

Police are clearly confident they’ve found enough evidence to meet the criteria for a terrorist act. While nine days may seem a long time, given the likely breadth of the investigation, the time frame is quite efficient.

Was he acting alone?

Part of what authorities would have had to establish was whether the alleged attacker was linked to other people or terrorist groups.

WA Police Commissioner Col Blanch said “we understand he’s accessing and participating in the ideology, but not having conversations about what was going to happen on January 26”. He said the man was engaging with ideology on Facebook.

So while he wasn’t formally linked to a specific terrorist group, police allege he was on the periphery.

Academic evidence shows this is quite common. Terrorism, especially in Western nations, is generally less centrally organised and far more fragmented.

On the far-right, they call this approach “leaderless resistance”. For Islamic extremists, it’s often referred to as “lone Jihad”.

Terrorists actively encourage this sort of decentralised structure because it helps them avoid detection by intelligence organisations. If a person is planning an attack, no leader need know about it. Both in Jihadist and extreme right-wing contexts, encouraging lone actor methodology is, in part, to maintain operational security.

We also know people on the edges of an ideology are more likely to act than key leaders and organisers. Often, lone-wolf actors see themselves as avoiding getting bogged down in a movement’s politics and bureaucracy. In their eyes, they’re the ones getting the job done.

Read more: What is extremism, and how do we decide?

These movements, however different in their politics, are less formal groups and more social movements. People believe in the cause, the aesthetic and the social scene, but there’s no formalised membership structure, at least for those operating in Western nations.

This makes it harder for counter terrorism operations to track key people and prevent incidents. It can also make investigations after an event longer and more complicated.

But conversely, while not always the case, it also can mean a perpetrator’s capacity for harm is smaller. Someone who has been radicalised online and is acting with whatever they can get their hands on is often less likely to pull off a mass-casualty event than an organised, trained fighting force.

The path ahead

It should be noted, however, that even if this hadn’t been designated as terrorism, it wouldn’t have lessened its severity. This could have been a mass casualty event, as was highlighted by WA Police. People rightly feel unsafe and emotional, and want to see the threat taken seriously.

Indeed, it was taken very seriously. The Joint Counter Terrorism Team was involved almost immediately.

But the job of law enforcement is to find the evidence to successfully prosecute. Nobody would want to see someone escape harsh punishment because of a flimsy police case, nor would they want to citizens detained on terrorism charges without a thorough investigation.

There’s still a lot we don’t know about this terror attack, the man allegedly behind it, and what his precise beliefs are. As the matter is proceeding through the courts, a lot of these details will come to light in the weeks and months ahead.

Levi West is employed under a National Intelligence and Security Discovery Grant, administered by the Office of National Intelligence.