The alleged attack on independent MP Helen Haines on 19 October 2026 is a confronting reminder of the security risks facing people of high profile and public office holders and, importantly, that those risks do not necessarily begin at the point of physical confrontation. The threat is not new. Australian politicians and their electorate offices have long faced threatening behaviour, vandalism and other security incidents. What has changed is the environment in which those threats can develop.

Politicians now operate in a world where grievances can emerge publicly, communities can mobilise online and hostile rhetoric can spread rapidly across social-media platforms. Grievances or frustrations relating to broader issues, policies and institutions are increasingly being directed towards individuals online, with discourse extending beyond legitimate policy criticism to include personal attacks and targeted hostility.

From a protective intelligence perspective, this makes the digital environment increasingly difficult to separate from the physical one. When an incident occurs, the assessment should extend beyond simply asking ‘What happened?’. It is ‘What was happening around this person beforehand?’. What was being said about them online? Was negative sentiment increasing? Were particular issues generating hostility? Were there individuals repeatedly engaging with or mentioning them? Had anyone moved from political disagreement to a personal grievance? Had online behaviour begun intersecting with the physical world?

Those questions are where Protective Intelligence and the analysis of big data, becomes valuable.

What can the online environment tell us?

Protective security should be much broader than searching social media for direct threats against a politician. In fact, sometimes there will be no identifiable threats at all. That does not necessarily mean there is nothing useful to understand!

When we are examining the broader conversation surrounding a public figure, we ask ourselves: What is the overall sentiment towards them? What actors are driving hostility or anger? Are particular narratives being repeated across different online communities? Is criticism directed towards the politician's policies, or is it becoming increasingly personal? Are people discussing their family, home, electorate office, public appearances or movements? Are users encouraging others to confront them or attend locations associated with them? And importantly, are specific individuals appearing repeatedly within those conversations?

None of these indicators necessarily means someone intends to cause harm.

Collectively, however they can help us establish an understanding of the environment in which that public figure is operating and identify changes that may warrant closer attention.

Not everyone criticising an MP is a threat. And there is not necessarily a threat because there is a lot of negative commentary about an that person.

Following the alleged attack on Haines, SPG examined the publicly available online footprint associated with the alleged perpetrator.

From an intelligence perspective, SPG identified a history of publicly available interactions relating to Haines from the attacker between 2019 to 2021. Those interactions, however, were not assessed as overtly threatening or particularly hostile.

That point is important because the analysis of open-source intelligence (OSINT) is not about treating every person who criticises, contacts or interacts with a politician as a potential threat. Political figures naturally attract significant volumes of disagreement, criticism, anger and highly emotive commentary. Most of that activity will never translate into physical behaviour. The role of intelligence is therefore not simply to identify negativity. It is to understand context, patterns and change.

online and physical behaviour should not be assessed in isolation

Connecting the dots is where intelligence becomes valuable!

For high profile individuals, and for anyone responsible for their security, the key principle is clear: online and physical behaviour should not be assessed in isolation. That is where protective intelligence becomes valuable: connecting information that might otherwise sit in separate systems, with separate people, and be assessed in isolation.

At SPG, our approach is to use open-source intelligence and its analysis as one component leading broader protective-security framework. And importantly, protective security does not always have to begin with the full suite of security measures! It can begin with understanding the online environment surrounding an individual and understanding what people are saying about you.

This intelligence analysis should inform physical security, but be careful, it cannot predict every act of violence. But it can provide is context and early warning.

The circumstances surrounding the alleged attack on Helen Haines remain under investigation, and it would be inappropriate to suggest retrospectively that the incident could necessarily have been predicted through publicly available information. The broader lesson remains important: it highlights the ongoing trend that the online and physical threat environments surrounding public figures cannot be treated as separate worlds.