When Victorians hear the phrase “counter-terrorism”, most picture armed police in tactical gear. The reality is far more bureaucratic — and, in many ways, more consequential. Behind every public-facing response sits a layered architecture of agencies, intelligence feeds, legal powers and coordination protocols that operate largely out of public view. This is how that system works.
The centre of gravity: The Joint Counter-Terrorism Team #
The operational heart of Victoria’s counter-terrorism effort is the Joint Counter-Terrorism Team (JCTT), a multi-agency unit that embeds investigators from Victoria Police alongside officers from the Australian Federal Police (AFP) and intelligence officers from the Australian Security Intelligence Organisation (ASIO). The JCTT model is replicated in every Australian state, but each is calibrated to its local threat environment. Victoria’s team, operating under the broader National Counter-Terrorism Arrangements agreed by Commonwealth, state and territory governments, handles the full spectrum of terrorism-related investigations — from early-stage threat assessment through to arrest and prosecution support.
Victoria Police is responsible for day-to-day operational command of JCTT activity within the state. The AFP contributes federal investigative powers and Commonwealth prosecution pathways, which are significant given that terrorism offences are predominantly charged under the Commonwealth Criminal Code Act 1995. ASIO’s liaison role is intelligence-focused: the domestic spy agency does not have arrest powers but provides threat assessments, foreign intelligence context and, where relevant, advice on whether public action might compromise an ongoing intelligence collection operation.
Where Victoria Police sits in the structure #
Within Victoria Police, counter-terrorism sits under the Specialist Operations portfolio. The Counter Terrorism Command (CTC) — not to be confused with the whole-of-government coordination body — is the internal Victoria Police unit responsible for investigation, disruption and tactical response capability. The CTC includes the Critical Incident Response Team (CIRT), which handles tactical operations, and dedicated intelligence analysts who feed into both the JCTT and broader state-level coordination mechanisms.
Victoria Police also plays a significant community-engagement role through its Countering Violent Extremism (CVE) program, which works with communities, schools and local government to identify and support individuals showing early indicators of radicalisation. Law enforcement agencies are careful to note that engagement and referral is not the same as investigation — a distinction that matters both legally and for community trust.
The whole-of-government layer: DPC’s CT branch #
Sitting above and alongside the law enforcement machinery is a civilian coordination structure anchored in the Department of Premier and Cabinet (DPC). DPC’s counter-terrorism branch is responsible for policy, legislative coordination and — critically — ensuring that Victoria’s CT posture aligns with national frameworks agreed through the Australia–New Zealand Counter-Terrorism Committee (ANZCTC), the ministerial body that sets national policy direction.
DPC’s branch works across government to ensure that agencies well outside law enforcement — health, transport, energy, education — have current and tested plans for responding to a terrorist incident or to the disruption that follows one. This function is sometimes called “consequence management” planning: the work of ensuring that if the worst happens, Victoria’s hospitals, public transport network and critical infrastructure can absorb and recover from the shock. DPC coordinates those plans but does not own them; each portfolio agency is expected to maintain its own Business Continuity and Incident Management capability, with DPC playing a quality-assurance and cross-agency integration role.
Emergency Management Victoria and the consequence layer #
Emergency Management Victoria (EMV) is the state’s lead agency for coordinating emergency response and recovery across all hazards — natural disasters, industrial accidents, and yes, terrorism. In a terrorist incident, the EMV framework activates alongside the law enforcement response. The State Emergency Management Team (SEMT) can be convened to coordinate cross-agency consequence management, with the Emergency Management Commissioner playing a coordinating role distinct from — but dependent on — Victoria Police’s tactical and investigative lead.
The interface between EMV’s consequence-management function and Victoria Police’s law enforcement function is one of the most carefully managed relationships in the architecture. In the immediate aftermath of an incident, Victoria Police will typically declare a crime scene and maintain command. EMV structures activate in parallel to manage affected communities, public communications, resource deployment and the eventual transition to recovery. Victoria Police and EMV have jointly exercised this interface through major simulation exercises, the details of which are not publicly released for operational security reasons.
Intelligence fusion: How information becomes action #
Perhaps the least understood part of the architecture is what happens to raw intelligence — a tip-off, an intercepted communication, a referral from a community worker — before it becomes an investigative action or a public warning. That processing happens across several nodes.
ASIO is the primary custodian of domestic security intelligence and maintains its own assessment processes. But at the operational level, the JCTT functions as an intelligence-fusion point where federal and state streams are reconciled and prioritised. Victoria Police’s own intelligence branch feeds state-generated information — from informants, from the CVE program, from criminal intelligence that touches on extremist networks — into that shared environment.
The National Threat Assessment Centre (NTAC), an ASIO-led body, sets the national terrorism threat level, which is currently assessed as “Probable” — the middle tier of the five-level scale. That assessment is published by ASIO and informs resourcing decisions and public-venue security guidance across the country. Victoria’s agencies use that national baseline but also maintain state-level threat picture documents that are classified and not publicly released.
Legislative powers and the Victorian framework #
Counter-terrorism powers in Victoria draw from both Commonwealth and state law. The Commonwealth provides the primary terrorism offence framework, and federal agencies hold the primary coercive intelligence powers. But Victoria has its own legislation relevant to prevention and response, including the Terrorism (Community Protection) Act 2003 (Vic), which provides for preventative detention in limited, time-bound circumstances and grants certain search and seizure powers to Victoria Police. The legislation has been amended multiple times since its introduction and is subject to ongoing parliamentary scrutiny.
Victoria’s Independent Broad-based Anti-corruption Commission (IBAC) and the Parliamentary Joint Committee on Intelligence and Security both play oversight roles — though the latter is Commonwealth-focused. At the state level, the Victorian Inspectorate and parliamentary committee mechanisms provide accountability for how Victoria Police and other agencies use their CT-related powers.
What coordination actually looks like day to day #
In practice, the coordination machinery runs continuously rather than switching on only when something happens. Weekly intelligence-sharing meetings, joint exercises, formal liaison arrangements and shared communication platforms mean that agencies are, in theory, speaking with each other before a threat escalates. The system has been stress-tested by real incidents — the 2018 Bourke Street stabbing, the 2021 Brighton siege — and each event has generated internal reviews that have quietly reshaped aspects of the architecture.
What those reviews have consistently reinforced, according to publicly available government statements, is that speed of information-sharing between agencies and clarity about who commands what function in the critical first minutes of an incident are the most consequential variables. Those are not technological problems. They are human and institutional ones — and the ongoing work of the coordination machinery is largely the unglamorous effort of keeping the relationships, protocols and trust that enable them in good repair.
Understanding that architecture does not require security clearance. It requires only a willingness to look past the tactical imagery and into the machinery underneath it.
If you have information about a suspected terrorism-related matter, contact the National Security Hotline on 1800 123 400. Reports can be made anonymously.
For 24/7 crisis support: Lifeline 13 11 14 | Beyond Blue 1300 22 4636 | 13YARN 13 92 76 | Crime Stoppers 1800 333 000.
