Security experts are calling for investigations into the protests at Parliament to examine how prepared the police were for the 23-day occupation.
It was revealed last week the Combined Threat Assessment Group raised the spectre of a protest turning violent back in November.
A security expert and the Police Association say there are questions to be asked about whether authorities should have been more prepared for those who descended on the capital in early February, and what, if anything, could they have done to prevent the ugly riots which marked the end of the 23-day occupation.
"Threatening online rhetoric is likely to continue to increase as the Covid-19 mitigation programme continues to evolve in New Zealand. While it is unlikely to result in a terrorist attack in the short term, we cannot discount the possibility of violent protest or sabotage targeting testing or vaccination facilities or other targets perceived to represent the mitigation programme," the Combined Threat Assessment Group's threat insight said, on 23 November 2021.
So should police and other security forces had been better prepared for the convoy which descended on Wellington on 6 February and were opportunities missed to prevent the violence which followed on 2 March?
Centre for Defence and Security Studies director Dr Wil Hoverd, from Massey University, said to some extent everyone was caught off guard.
"We have a long history of protest and uncomfortable protest in New Zealand, and occupation. But I don't think anyone was prepared for the longevity of this protest," he said.
If police had taken a heavy-handed approach to clamping down on the protest early or before it formed on Parliament's lawn, it would have raised questions about whether police were being authoritarian in their actions.
"What we see happening in Wellington in the first week of the protest is all sorts of extremist statements, some really legitimate statements mixed in and that really complicates things as well because there was a lot of legitimate protest. People have really suffered."
That complicated the environment police found themselves making decisions in.
"The real kind of key question is when does extremist rhetoric - which is ok and part of our democratic rights - when does that become threatening and closer to hate speech - and that's a murky space. And when does that become violent and that's the really tricky space."
The broad risk of violent protest had been identified following protesters storming the US Capitol on 6 January 2021, he said.
Police Association president Chris Cahill said ultimately that was what police officers were confronted by.
"New Zealand is not immune to all the risks we've seen in other parts of society and this was not that much unlike the events in Washington that shocked the world. Who would've thought it could happen in New Zealand? And it did. So we have to prepared to understand that."
As a country we also had to try to understand what drove the protesters to take part in 23-day occupation, he said.
The Independent Police Conduct Authority (IPCA) is carrying out a broad review of the protests, but the government has so far rejected calls for an inquiry beyond the IPCA's purview. The Parliamentary Service indicated it had also begun to reflect on the protest, but also would not comment on other reviews of the grounds and security.
Considering the clear risks that now exist in New Zealand, it was important to find out whether police got the response right and had the right intelligence, Cahill said.
"We have to acknowledge those reports did say they had low confidence in that assessment due to the limited understanding of the motivations of the protesters, but the wider question is still fair. What intel did police have? Were there gaps in that intel? Or did they fail to act correctly on the intel? That has to form part of the formal debrief."
Police needed to be transparent about the findings of that review and the details that informed it, he said.
Mark Mitchell. Photo: RNZ / Dan Cook
National Party MP Mark Mitchell, himself a former police officer, agreed.
"Good intelligence is always going to drive good decisions and that's fundamentally, in terms of the occupation of parliament, is where they are going to go back to and say 'What intelligence did we have, how did we analyse it and how did we respond to it?' and I'm going to be interested to see what the findings are," Mitchell said.
A police spokesperson said their investigation into the protest and the operational debrief into their own actions were ongoing.
"In due course police will work with any relevant agencies, including the IPCA, to examine police's response to the protest on parliament grounds. This will include looking at what intelligence was available ahead of the protest and the decisions that were made throughout.
"As this was a significant and complex operation, and the investigation is ongoing, this process will take some time and we are unable to respond to specific questions at this stage.
"As with all major operations, police is conducting an operational debrief. This debrief is continuing and we will implement any learnings going forward."