Chapter 1 Introduction with conclusions

With this report, the 22 July Commission's concludes its review of the terrorist attacks on the Government Complex and on the Labour Party Youth camp on Utøya Island. Every day for a whole year, we have worked together to find the answers to three key questions: What happened on 22 July? Why did it happen? And more fundamentally: How could our society have let this happen?

The answers to all these questions are important in order to gain knowledge.

The tragedy of 22 July seems a paradox: On the one hand, the terrorist attacks may be the most shocking and incomprehensible acts ever experienced in Norway. Few had envisaged that anything so unreal could become a reality: 77 people were killed. Many more were seriously injured. Thousands suffered terrible human losses, and the material damages are hard to comprehend. All because of one man.

On the other hand, we were prepared for several aspects of 22 July. A car bomb scenario at the Government Complex and several coordinated attacks have been recurring scenarios in threat assessments, as well as for safety analyses and exercise scenarios for many years. Hardly anyone could have imagined that a secondary attack would have been made on the youth camp on Utøya Island. Sadly, however, after repeated school massacres in other countries, an armed desperado who shoots adolescents is indeed conceivable – also in Norway. This is the type of mission that every Police District drills today, and is expected to be able to deal with.

With a view to the attacks, the contrast between the inconceivable and the conceivable presents a challenge for a commission appointed to gain knowledge from 22 July. Hindsight was not a viable option, and no one wants a terrorist to be able to change what is unique, transparent and worthwhile about this 'little country of ours'. Meanwhile, it is a fact that through public reports, white papers and legislative work, the Storting (Norway’s parliament) and the Government have had security and emergency preparedness high on their agendas for the past 15 years. New directorates and oversight bodies are in place, and clearer expectations have been posed to the authorities. Thus the Commission's role is to compare the actual efforts of society and the authorities on 22 July against this, Norway’s adopted level of security and emergency preparedness. Have the expectations been absorbed sufficiently, and been implemented? Did the system and the human resources function as expected?

In the course of the Commission's work, we have been told stories that are impossible to forget: Of the tremendous shock when the bomb exploded. Of adolescents running for fear of their lives and feeling forsaken. Of children who have seen their friends killed and injured. Of spouses, fathers, mothers, children and siblings waiting in the hope of getting a phone call saying "hi, I'm alive", but who were told instead that their loved one was gone. About individuals whose lives have been turned upside down, but who are nonetheless able to look forward to the future.

We have also seen moving examples of heroism, selflessness and caring. Young people were killed while trying to save friends and younger people. Many set aside their own fears to engage in dangerous rescue work – both at the Government Complex and on Utøya Island. During the days that followed, the whole country was marked by selflessness and sorrow. The compassion and solidarity on the part of a whole nation during the days after the evil deeds were unique. At the international level, the episode first evoked shock, then loathing, followed by reflection.                                                          

The thought of the victims, those involved and all those who gave their help unstintingly when they were needed most, has been a driving force behind our work.

That being said, this report will devote limited space to the individual stories. The Commission's focus has been on society's overall handling of the matter. We were given a far-reaching mandate. The deadline was 12 months. Priorities and delimitations have been necessary. We believe that we have chosen the most important areas: the efforts to detect and protect, the efforts to combat the threat and, finally, the efforts to deal with the attacks and their consequences.

The Commission has had access to a vast, comprehensive body of material, which also dates back in time. We were granted access to everything we asked for. All that we reviewed has not been included in the report. Even though we have interviewed and met hundreds of individuals, we have not been able to talk to all those who have knowledge of the topic or stories to tell. Nor have we been able to obtain and read all documents of relevance. Nonetheless, we are of the opinion that the Commission has formed a good picture of what happened, even though further interesting information will no doubt surface over time.

We have had access to a very extensive body of classified material. For obvious reasons, we cannot discuss all the contents of such documents in the report, but in our opinion, the report draws an adequate and accurate picture of the Commission's findings and observations, including the classified aspects of the authorities' efforts related to 22 July. In this connection, the various proprietors of the information have declassified everything the Commission has asked for.

The Commission's mandate has prevented us from delving into the investigation's sphere of operations, so we have not made an independent survey of the slayings on 22 July. For the sake of order, we would also emphasise that the Commission has not taken a position on the question of the accused's guilt in the criminal sense, even though we refer to him as the perpetrator.

In keeping with our mandate, and in the light of the time available, we have concentrated on investigating the attacks of 22 July, the reasons why the tragedy could take place, and how it was handled. Thus we have only to a limited extent looked at other terrorism scenarios or types of serious attacks. We have not looked at the protection of Norwegian interests or nationals abroad. We have foregone issues related to the perpetrator's motive, childhood and state of health, and we have not explored the measures society puts in place for the early prevention of radicalisation. The limitations do not imply that these questions are not important. Quite to the contrary. They are important and they deserve more attention than what this Commission could manage to devote to them.

We have seen our task as being to document the determining events prior to 22 July and the events that day, in as much detail and as transparently as possible. At the same time, we have not hesitated to ask: Would the outcome have been significantly different under marginally different circumstances? This question sheds light on how much of the result can be ascribed to coincidence, good luck and bad luck, and thus speaks to the robustness of society's systems and the decisions that were taken. This is an important source of learning.

Crises are characterised by unpredictability. Misjudgements and actions that turn out to be detrimental are unavoidable. Existing plans and experience will never be an exact fit for a scenario. When time is short and many things are taking place simultaneously, it is difficult to learn anything new. Accordingly, the very essence of crisis management lies in the preparations: plans, drills, exercises, interaction and ways of thinking. Crisis management per se is a test of how well prepared one is. From that perspective, the 22 July Commission is one step in the efforts to improve society's ability to manage the next crisis – even though it will probably put society to entirely different tests.

The main challenge in all the investigative work is not to let one's perception to be overly coloured by knowledge of the actual outcome, but rather to try to reconstruct both the situation and the scope of information as it appeared at the time to those involved. As time passes and facts emerge, the course of events becomes clearer. After events, it is easier to distinguish between what was important, and what was less important, but in the throes of the crisis, this was far less clear for most people. It is naive to believe that one can avoid all hindsight, but our ambition has been to try to familiarise ourselves with the uncertainty facing those involved at the time when they took their decisions. What did they know? What were their options then and there? Which alternatives were rejected, and why?

Coincidence determined which individuals suddenly found themselves the focus of the Commission's work in the aftermath of the perpetrator's evil acts. Some people will find our descriptions overly personal in respect of people who have done their best in demanding and to some extent impossible situations, on a day that turned out to be one of the most extraordinary days in Norway’s history. Individuals' actions are influenced by the extent to which the leadership has paved the way for their duties to actually be performed in a satisfactory manner. In society's quest for scapegoats, it is easy to forget that imperfect systems can help put individuals in a position to make fatal mistakes.

Meanwhile, it is essential to understand the details. A system is by and large the sum of the individuals who take decisions and perform actions. In the view of the Commission, a straightforward, unveiled picture of what went well, and what failed 'in the field', is a prerequisite for society to learn lessons from the important leadership-related, strategic and political challenges ensuing from the events. Although it is demanding to be confronted with failures and vulnerabilities, it is necessary in order to learn lessons and ensure a safer society.

The Commission's Report

By way of introduction, we give a comprehensive, simplified presentation of the 22 July, presenting the Commission's mandate and work. Part II provides a backdrop. First, we describe the threat situation in Norway, as it has evolved in recent decades in the run up to 22 July. We then briefly review attacks in other countries over the past 20 years and point out some experiences gained from them. Finally, in this part we provide an introduction to the way in which the Norwegian authorities are organised and their spheres of responsibility with a view to emergency preparedness and terrorism.

Part III describes the attacks on 22 July and how the emergency services and the country's administration responded to the challenge. By far the lengthiest part is about the police operations and the efforts to assess and deal with the danger of further attacks. The rescue operation, the public health service's handling of the injured, and the central authorities' and Hole Municipality's psycho-social follow up are described in relative detail, while, due to capacity constraints, we have to a lesser extent examined each individual municipalities' handling of those who returned home. This part also sheds light on the national crisis management, the work of securing the continued operation of the Government and the authorities' communication with the general public. At the end of Part III, we describe experiences as the many who have been directly affected by the tragedy have recounted them to the Commission, not least through our questionnaire surveys.

Part IV examines important aspects of emergency preparedness, including the role of helicopters and the communications solutions on 22 July. This part also includes a broad review of national and local police forces' qualifications for responding to attacks, as well as the command and leadership-related challenges in 'Police Norway' in that context.

Part V examines the ability to prevent and protect against attacks. We compare the perpetrator's preparations with the central barriers that society has set up to prevent attacks. Here we discuss the work of the Police Security Service (PST) to detect preparations for terrorism. Could the perpetrator's plans have been thwarted? We look at society's weapons and explosives controls, before we address the security work at the Government Complex.

Part VI contains the Commission's final observations and recommendations.

Observations Our review points out a number of circumstances worthy of criticism and a serious need for change. The deficiencies that we unveiled put society in a less than optimal position to detect and avert plans, and do not enable it to protect against threats as effectively as possible. This led to 22 July not being handled well enough in important areas. It gives particular cause for concern that several of the deficiencies had been pointed out in previous reports from oversight and auditing bodies, without them having been redressed. Many of the needs for change that we identify as necessary for improving the ability to handle a terrorist attack will also improve the ability to deal with less demanding and more frequently occurring situations. The attack on 22 July was exceptional, and a day unlike any other day, yet the lessons learned are of far broader relevance.

The reader must be prepared for great richness of detail. Against the backdrop of this in-depth overall picture, the Commission has concluded the following:

* The attack on the Government Complex on 22 July could have been prevented through effective implementation of already adopted security measures.

* The authorities' ability to protect the people on Utøya Island failed. A more rapid police operation was a realistic possibility. The perpetrator could have been stopped earlier on 22 July.

* More security and emergency preparedness measures to impede new attacks and mitigate the adverse effects should have been implemented on 22 July.

* The health and rescue services managed to take care of the injured people and next-of-kin during the acute phase in a satisfactory manner.

* The Government's communication with the general public was good. The ministries managed to continue their work despite the devastation.

* With better ways of working and a broader focus, the Police Security Service could have become aware of the perpetrator prior to 22 July. Notwithstanding, the Commission has no grounds for contending that the Police Security Service could and should have averted the attacks.

The tragedy of 22 July reveals the need for many kinds of changes: in planning work and rules, in the deployment of expertise and resources, in organisational culture, priorities and focus, and yes, even in the attitudes of society. Some of these changes can be adopted by a government authority. They are the easiest changes to make, as long as there is political will to do so. Other, more fundamental changes – in attitudes, leadership and culture – must be developed over time. For precisely that reason, these might be what deserve attention first.       There is no one single reason that can explain the response – neither what failed, nor what worked. The Commission is nonetheless of the opinion that it has observed that certain basic prerequisites are decisive for the agencies' performances. Any failures were primarily due to:

* The ability to acknowledge risk and learn from exercises has not been sufficient.

* The ability to implement decisions that have been made, and to use the plans that have been developed, has been ineffectual.

* The ability to coordinate and interact has been deficient.

* The potential inherent in information and communications technology has not been exploited well enough.

* Leadership's willingness and ability to clarify responsibility, set goals and adopt measures to achieve results have been insufficient.

In the opinion of the Commission, these lessons learned are to a greater extent applicable to leadership, interaction, culture and attitudes, than to a lack of resources, a need for new legislation, organisation or important value choices.   Last, but not least: 22 July showed with the utmost clarity how individuals can make a huge difference. The Commission believes that the measures recommended will put society and individuals in a better position to face future challenges. They are inevitable. Accordingly, it is crucial to address the basic challenges. This is urgent.

. . . .

Chapter 19 The Commission's concluding observations and recommendations

Once again, it is necessary to repeat that it is the perpetrator and no one else who is to blame for the loss of 77 precious human lives, for physical and mental harm and for great material devastation. The Commission's remit has been to assess whether society's ability to avert, protect itself against and deal with the attacks was good enough, and to pave the way for society to gain knowledge in the wake of the tragedy.

Although a great deal worked well on 22 July, there were failures in important areas. We must strive to retain all the things that worked well, and develop these things further. Where things failed, it is our common responsibility to learn from the failures and make changes.

A year of living with 22 July has left strong impressions: The Commission has talked to people who lost their immediate family members. We have listened to people who must live with serious injuries, and to young people who experienced inconceivable cruelty. We have also met a large number of those who were involved in the dramatic hunt for the perpetrator, and in the far-reaching, demanding work to save lives and preserve health and to face the other serious challenges perpetrated on society. Thousands were deeply impacted and affected. Many will carry 22 July with them for the rest of their lives.

In connection with its work, the Commission has posed some simple, but fundamental questions on an ongoing basis. First of all: "What happened?" By analysing documents, making inspections, reading reports, having meetings, examining photos, films, technical data and hearing the explanations of the many involved, the Commission gradually gained a detailed understanding of the course of events.

The Commission has chosen to include many details in the report. Occasionally, such a complex presentation can entail that salient elements and less important details appear side by side. It can be difficult to absorb all the details, while maintaining a critical distance and gaining a clear overall picture. Out of consideration for the many who have strong, legitimate needs for answers, and to get to the bottom of the issues, we have nevertheless deemed it necessary to provide a high level of detail. What might seem trivial to some, are observations of key importance to others.

This in-depth review has resulted in the Commission concluding the following:

*The attack on the Government Complex on 22 July could have been prevented through effective implementation of already adopted security measures.

* The authorities' ability to protect the people on Utøya Island failed. A more rapid police operation was a realistic possibility. The perpetrator could have been stopped earlier on 22 July.

* More security and emergency preparedness measures to impede new attacks and mitigate the adverse effects should have been implemented on 22 July.

* The health and rescue services managed to take care of the injured people and next-of-kin during the acute phase in a satisfactory manner.  The Government's communication with the general public was good. The ministries managed to continue their work despite the devastation.

* With better ways of working and a broader focus, the Police Security Service could have become aware of the perpetrator prior to 22 July. Notwithstanding, the Commission has no grounds for contending that the Police Security Service could and should have averted the attacks.

In the opinion of the Commission, a comprehensive general presentation of what happened on 22 July has great intrinsic value. It can contribute to a common understanding of how society dealt with the situation and eliminate grounds for unnecessary speculation.

All the same, the most important source of learning lies in the Commission's second main question: Why was the situation handled the way that it was? In reviewing the attack on the Government Complex, we asked the following questions, among others: Why was it possible to park a car outside the H-block? What were the underlying reasons that Grubbegata was not blocked off? Why were more temporary security measures not put into place?

The same applies to the massacre on Utøya Island: Why was the perpetrator not stopped before he got to the island? What prevented the police from arriving earlier, and why was that the case?

It has been pointed out that organisations are often unwilling to learn from crises; that they fail to make in-depth evaluations, and that in any case they do not share negative experiences with their surroundings. While the motives may be myriad, one reason might be that embarrassing weaknesses will be uncovered. We perceive the establishment of the 22 July Commission as a sign that the Government and the Storting (Norway's parliament) seek the opposite, i.e. to learn by understanding the events and the causalities involved. We consider it positive that most of the organisations that were involved in 22 July have gone through their own evaluation processes, shared them with the Commission and made them available to the public. This has made our work easier, but more importantly: We see that the evaluations, despite any weaknesses, have already contributed to a great deal of learning in many government agencies.

Most of the important situations in which decisions have to be made are complex, ambiguous and dynamic. This opens the door to different interpretations. The interpretations that meet with success depend on the facts as well as the distribution of power. In the Commission's assessment of the authorities' handling of 22 July, we have sought to analyse the underlying reasons for the response being what it was. We have examined the importance of five dimensions in particular: (1) the distribution of responsibility and the formal parameters; (2) resources; (3) knowledge, expertise and attitudes; (4) technology and (5) the ability to lead and to learn from all this.

At the outset of our work, we expected that the Commission's discussions would largely revolve around dilemmas associated with society's values; about the balance between transparency and security, between trust and control, and between the needs of society-at-large for surveillance and individuals' freedom and the rights of the individual. These are basic elements to be weighed in a democracy. Dilemmas exist. They are real, and they must invariably be taken into account when society takes a position on new legislation and measures to strengthen civil protection and emergency preparedness. The Commission realises, among other things, that the democratic costs related to systems intended to eliminate every risk of terrorist attacks are too high. We have to live with a certain level of risk.

In several areas, we see that value choices of great importance had been made with respect to the assessment of the authorities' efforts: The Government had already made a choice between the values security and transparency when it was decided that the H-block was to be secured against car bombs at the same time as the general public was still to have access by foot. The Police Security Service’s regulations already reflected the balance struck by the Storting between surveillance and the rights of the individual, and this afforded them the opportunity to register the tip about the perpetrator's procurements. Our review of 22 July shows that these considerations made sense. We can also ascertain that fundamental value choices were not crucial to the outcome since the response was weak.

There is no one single reason in isolation that can explain society's response – neither for what failed nor for what worked. The Commission is nonetheless of the opinion that it has observed that certain basic assumptions were decisive to the authorities' performance. Our analysis of 22 July shows that the failures were mainly due to:

* The ability to acknowledge risk and learn from exercises has not been sufficient.

* The ability to implement decisions that have been made, and to use the plans that have been developed, has been ineffectual.

* The ability to coordinate and work together has been deficient.

* The potential inherent in information and communications technology has not been exploited well enough.

* Leadership's willingness and ability to clarify responsibility, set goals and adopt measures to achieve results have been insufficient.

All in all, 22 July revealed serious shortfalls in society's emergency preparedness and ability to avert threats and to protect itself from threats. Before discussing these five observations in more details, we will comment briefly on resources.

19.1 Resources count, but their use decides

A natural first question in the assessment of 22 July is whether weak crisis management is first and foremost a result of a lack of resources and funding. The simple answer is that during the acute phase, resources will almost always be experienced as being in short supply. There are several examples of shortages of resources in our review: Both in Oslo and in the Nordre Buskerud Police District, the operations centres were understaffed. That limited their ability to manage and coordinate the police operations. Staffing in Oslo was insufficient to ensure that critical infrastructure protection could be implemented quickly and according to plan using proprietary resources. The availability of helicopters was limited.

Conversely, there are examples of scarce resources not playing a decisive part. The long-standing efforts to secure the Government Complex were never limited for budgetary reasons. Yet despite the fact that the emergency rooms were filled to capacity when the explosion took place, the public health service managed to make room. The police managed to mobilise a large, well-trained and well-equipped police force to Utøya Island. The challenges turned out to be ascribable to leadership and communication to a far greater extent than to the lack of response personnel.

We find it overly simple to just point out the need for more resources and more staffing per se.

22 July alone should not be a dimensioning factor for the police force, but the experience should be an important part of a broader foundation of knowledge to achieve improvement. The Commission has therefore obtained large volumes of data from the police force, and we have sought to incorporate our recommendations into a larger analytical context.

Several of the Commission's recommendations will require investments and entail costs. By the same token, we also point out areas that offer possibilities for savings and quality dividends.

One example is linked to the leadership and governance of police resources. Our investigations indicate that society's need for police operational services, statistically speaking, is quite predictable, but that the police force has not to any great extent taken advantage of this knowledge to plan and manage personnel's working hours. It is only when the police force and the individual chief of police focus more on the analysis of the scope of responsibilities and the allocation of resources, taking advantage of this to provide leadership, that it will make sense to discuss whether the human resource situation is currently insufficient.

Another example is the capacity of the Police Security Service to do its job, and what society expects from the service. Intelligence and security services will always have limited resources. Our review indicates, however, that the Police Security Service per se, through stronger leadership and better working processes, has the potential for greater efficiency.

On that account, before taking a more detailed position on human resources and the general resource situation, the Ministry of Justice and Public Security, the police force and the Police Security Service can,

to a far greater extent than they have done thus far, rank priorities, set goals for security and preparedness tasks, allocate the significant human resources they actually possess, and follow up to ensure that results are achieved. This calls for leadership.

Deciding to increase allocations is the simplest improvement to make, provided that the political will is present. Other, more fundamental changes – in attitudes, leadership and culture – must be developed over time. For precisely that reason, it is the Commission's view that these deserve attention first. Where a need for increased allocations has been identified, it must also be possible to ensure that the resources are managed better than what has been the case so far, so that emergency preparedness is actually improved.

19.2 The ability to acknowledge risk and learn from exercises

Preventing and managing serious incidents in a professional manner assumes that those in charge gain knowledge about the risks they face, and actively adapt their behaviour accordingly. Risk awareness helps determine which initiatives are taken and helps determine the dimensions of the security and emergency preparedness that society chooses to have. Accurate awareness of risk is developed over time by compiling knowledge about the likelihood that various scenarios will arise, and the consequences of different outcomes. It is not easy to be fully cognisant of and implement measures designed to prevent worst case scenarios, and to plan constructive responses to rather unlikely events. Basic security must be in place, and in working with risk, one must not only be cognisant of historical experiences, but also be able to accommodate surprises and uncertainties.

In the view of the Commission, Norway has established security and emergency preparedness legislation in recent years that is generally up-to-date, and it has a government administration with a reasonably clear distribution of responsibility for the prevention, aversion and management of terrorist attacks. The Commission nevertheless sees that the ability to bear and follow up this responsibility varies from one agency or player to the next, both in the preparatory phase and in the crisis management on 22 July. Different understandings – or, more accurately: different acknowledgement of risk and vulnerability – stand out as one important explanation.

Our review has revealed a number of circumstances where the acknowledgement of risk was not sufficient. Some examples may illustrate this:

* It was underestimated that solo terrorism – where just one person was operating alone – could cause so much devastation.

* The police's emergency preparedness, also in major crises, is based on the local police district, regardless of size, handling the situation. The operations centres have limited human resources. Despite the fact that experience and repeated exercises have pointed out that this translates into vulnerability, the situation has not changed. The notification and mobilisation of personnel are based more on coincidence than on emergency preparedness schemes. This vulnerability has been recognised and accepted, but that has hardly been the case with the risk.

* Despite the fact that Norway is a country with a large number of weapons, including high-capacity weapons, the registration of weapons is inadequate, and the weapons control regulations for ownership are not systematically enforced. This means that weapons control is weaker, and the risk level is higher than assumed.

* Despite the fact that international experience indicated a danger of further attacks after the explosion, it took too long to put into place comprehensive security measures or measures to increase the capacity and ability of the police to respond quickly. Helicopters and the Armed Forces' other resources were requested so late that they did not provide much help for the police operation. Many hours passed before military troops were called out to secure civilian objects. The perpetrator's contention after his arrest that new terrorist actions had been planned by two other cells, was dramatic. The police sounded a nationwide alarm about this, which few received. The Commission cannot see that any more detailed technical analysis or general discussion were undertaken to determine whether this alleged threat necessitated the implementation of more comprehensive security measures. Instead, people gradually accepted that the probability of new attacks was small.

However, during its review, the Commission has also seen positive examples of how satisfactory awareness of risk paved the way for good decisions.

* The Ministry of Health and Care Services, the Directorate of Health and the health trusts have drilled measures that take account of the lessons learned from the terrorist attacks in Madrid and London; that attacks with many victims at several sites would call for rapid coordination and high capacity. Immediately after the explosion, the public health service therefore made preparations for several subsequent attacks with a significantly higher number of casualties than what turned out to be the case. The personnel had also engaged in exercises that addressed what they should do in the event the communications systems were overloaded. This was invaluable on 22 July, when parts of the system failed.

* At an early point in time, the Ministry of Defence made it clear that requests for assistance from the police would be granted. On their own initiative, several Armed Forces units began to mobilise and make ready resources to support the police.

22 July was chaotic, dramatic and confusing, and great uncertainty prevailed. Crisis management implies demanding decision-making situations. When time is of the essence and many things are happening at the same time, one is rarely better than one's preparations. Well-prepared exercises can serve as a dynamic form of oversight. After the exercise, the players have practical experience that gives them deeper insight into challenges and the need for changes. Consequently, the foundation for the ability to manage crises lies in the preparations: plans, drills, exercises, interaction and ways of thinking. The awareness of risk determines whether exercises are conducted, what is drilled, and what is learned from exercises. Crisis management per se is an indication of how well prepared one is.

In the Commission's opinion, there has been a lack of exercises in many places, or insufficient lessons have been learned from experience with exercises:

* The Police Security Service has not organised enough exercises with a view to its role during a terrorist attack, and this was reflected in its crisis management.

* Exercises have shown that the police’s information-sharing is subject to formidable weaknesses. All the same, no significant improvements have been made.

Other examples showed that realistic exercises paved the way for a more effective response:

* Hole Municipality's crisis team had conducted several exercises regarding how to deal with serious accidents. Based on experience and planning work, they managed to mobilise, improvise and assume the technical leadership of a large corps of their own employees and volunteers when a tragedy that far exceeded what would have been natural to envisage in advance struck the little municipality.

* Long before 22 July, both the Crisis Support Unit and the Office of the Prime Minister had drawn up plans for and drilled the evacuation of the Government Complex in a crisis situation, which prepared them well for dealing with the situation on 22 July.

* The police's training on ‘shooting in progress’ situations paved the way for an effective operation once the police arrived on the island.

Society-at-large must bear its share of the blame for the lack of risk awareness and thus the deprioritisations we have documented. In the light of 22 July, the Commission urges the general public to be more vigilant and to take a more nuanced view of and interest in questions related to risk and to what constitute good, but balanced measures to protect society's values.

19.3 The ability to follow through on plans, and to use the plans that have been developed

22 July exposed formidable vulnerabilities that were a result of inadequate or slow implementation of already adopted measures and of plans that were to some extent highly germane, not being used.

Decisions adopted many years ago have turned out to be relevant for the Commission's efforts to determine how the terrorist attacks could happen. We have inter alia seen the following:

* In 2004, the Government Security Council decided to implement a number of specific measures to secure the H-Block and the Government Complex against attacks. The work was to have high priority. Nonetheless, seven years later, it was possible to detonate a car bomb close to the entrance of the HBlock. No professional routines had been established to ensure that the project was implemented with the intended speed and quality. Adequate and relevant provisional measures were not implemented.

* The Security Act was adopted in 1998, and it set standards for the securing of objects on the basis of "vital national security interests". Many had views on questions related to the Act, and one took the liberty of using 13 years to develop regulations that were to provide clarifications. During this period, there was no oversight that could have identified significant shortcomings with a view to security.

* Following the NOKAS robbery in 2004, the National Police Directorate decided to set up a system for swift, secure and efficient notification between police districts in connection with major events. The system became operational only in 2010, six years later. The National Police Directorate was warned about weaknesses in the chosen solution, the system was never tested systematically, and although experience indicated a number of problems, no improvements were made. The system failed on 22 July.

This failure generally involves the practical implementation of adopted and for the most part uncontroversial measures. There are good reasons why the implementation of measures takes time: The administration must make preparations for political governance and democratic control. This leads to requirements that things must be done in writing, the right to lodge complaints and other time-consuming administrative principles. To ensure equal treatment and the prudent use of society's funds, the public sector also has rules for procurements and project implementation that can seem time consuming.

However, there are also reasons that are not acceptable: We have seen examples of weak project management and inadequate project follow up. Identified obstacles to implementation were not addressed early on. In several projects, more attention was devoted to the process itself than to ensuring that one was able to deliver the desired result. Further, we saw demonstrated a lack of ability to inform and involve those affected so that they fully understood the distribution of responsibility and the importance of quality and speed. In addition, there is the fundamental challenge inherent in the fact that the implementation and follow up of measures often get less attention from the Storting, the political leadership and the media than new initiatives and plans.

The use of and compliance with plans and procedures are especially important in relation to extraordinary events. In several areas, this failed on 22 July. The Commission would point out in particular that:

* The police have developed a special set of plans for use in the event of terrorism and sabotage. The measures in the set of plans appear to be relevant after a large bomb has been detonated in the Government Complex. There were plans linked to roadblocks to prevent terrorists from getting away and initiatives for the immediate mobilisation of police personnel to reduce the response time for any further attacks. Such sets of plans are developed so that in a chaotic situation, one can implement measures experienced as being good. The set of plans was not used on 22 July.

In other areas, the sets of plans were used more actively.

* Oslo University Hospital's detailed set of plans was followed. The hospital was put on the highest alert. Operating theatres were cleared, personnel were called in, and other hospitals were put on standby alert for use if needed. Helicopters were mobilised in case there was a need to evacuate patients. Coherent plans freed up capacity so that the leadership could spend time evaluating the reports on the situation. It was discovered that certain routines could lead to the danger that things would get backed up if there were to be a very large number of patients. Decisions to change these routines were taken rapidly and responsibly.

19.4 Coordination and interaction

Both civil protection and emergency preparedness require that the country's aggregate resources be utilised efficiently. This calls for coordination and interaction. Here are some examples of the coordination problems prior to 22 July and during the crisis:

* The police operation on Utøya Island was poorly coordinated so it took longer than necessary. The understaffed Operations Centre, which was designated in the plan to lead and coordinate, was overwhelmed by telephone calls. Communication problems causes resources to miss each other. Informal language usage and non-compliance with basic requirements for accurate communication in a crisis helped make a poor communication situation even more challenging.

* From summer 2010, the Office of the Prime Minister and the Ministry of Justice and Public Security were informed that the National Police Directorate was of the opinion that the progress in the Ministry of Government Administration, Reform and Church Affairs' work to secure the Government Complex gave cause for concern because several measures of great importance for security had not yet been implemented. However, this concern never reached the leadership of the Ministry of Government Administration, Reform and Church Affairs.

* A tip that the Directorate of Customs and Excise sent to the Police Security Service in connection with the Global Shield Action also contained concerns expressed by the Directorate for Civil Protection and Emergency Planning and Norway Post. The Police Security Service has weak routines for dealing with tips and did not recognise any link between these concerns. Prior to 22 July, the Police Security Service did not take much advantage of the information and capacity inherent in the postal and customs systems.

* Confusion about the interpretation of the confidentiality provisions in the Health Personnel Act meant that it took a long time for the hospitals to give the police access to information about the identities of those who were admitted. This complicated the rescue operation and caused undue distress for families and friends.

In other areas, coordination was smoother.

* The job of finding new premises and ensuring continued operations for the Government and the ministries in the aftermath of the crisis was handled in a satisfactory manner under the joint leadership of the Ministry of Government Administration, Reform and Church Affairs/Directorate of Public Construction and Property.

In the opinion of the Commission, several public agencies should get involved in and take advantage of their expertise in the efforts to detect terrorism. Good interaction and information sharing among the players is required for good preventative security and effective intelligence against new threats, including solo terrorists. Our review indicates that legislative imbalances can present an obstacle to such collaboration. The confidentiality provisions in the general legislation – and in the context of 22 July, in particular the Customs Act – have not to any great extent taken into account the regulations developed for the Police Security Service’s work: In 2005, the Storting adopted new statutory provisions that gave the Police Security Service broad authority to use radical methods in relatively early stages of suspicion; where "there is reason to investigate whether someone is preparing a [terrorist] act". At the same time, we see that it takes a higher level of suspicion for civil servants in other government agencies to submit a report to the Police Security Service when they make observations that give cause for concern while on duty. For example, the requirements for suspicion are lower for the Police Security Service to use listening devices with a view to prevention, than for a customs agent to let the Police Security Service know if disturbing items are found in a person's luggage. Similarly, it takes a higher degree of suspicion for the Police Security Service to procure information from customs records, than it takes for them to initiate a clandestine search. The Commission finds this to be inconsistent.

Given the value that interaction between public agencies has for the Police Security Service’s work to uncover and follow up hypotheses regarding terrorist intent, we believe it to be necessary for general legislation to be reviewed with this in mind, and taking account of the established rules which state that the Police Security Service must delete the personal information if their hypotheses cannot be corroborated.

The White Paper on Civil Protection put forward in June 2012 proposes that a principle of cooperation be added to the established principles regarding responsibility, similarity and proximity. In the Commission's opinion, this is a good initiative.

19.5 Recognise and take advantage of the potential in ICT systems

The development of information and communications technology over the past 15 years has had a dramatic impact on how organisations, working life and society work and approach their duties. Having good ICT solutions for communications, information sharing and analysis has become a prerequisite for ensuring good interaction and knowledge-based leadership. The use of social media in the throes of the crisis give 22 July a unique simultaneity. Mobile phones, social media and swift news broadcasting meant that knowledge of the attack spread quickly from the crime sites to large parts of the population. Never before have the members of government personally received information by text messages, telephone calls and social media directly from victims, at the same time as they were supposed to be dealing with a national crisis.

Electronic solutions for retrieving and sharing information present a challenge for the authorities. The Commission has noted that:

* The police had to rely on telephone calls to notify and mobilise personnel. Valuable time was lost that could have been spent working with situational analysis and management of the operations. Oslo Municipality's Emergency Planning Agency had set up a system for notifications by text messages that required little effort and elicited a strong response rapidly.

* Weak local communications and a lack of coverage by the Norwegian Public Safety Radio played a part in how there was a misunderstanding about where the mustering place was to be. The police did not have access to even the simplest technology for transmitting written mustering information to personnel and official vehicles. Most of Delta force's cars did not have electronic map systems.

Through nearly a decade of self-evaluations, audits and consultancy reports, the formidable weaknesses of the police force's ICT solutions are well known to the leadership of the police and the Ministry of Justice and Public Security. Our review has also revealed that the police have not to any great extent taken advantage of ICT to help improve their work processes and to lead and follow up the agency’s work:

* Police officers spend a lot of time filling out the same information manually in different records.

* The control of the operational service, on active missions as well as on duty rosters, is contingent on information. Customised ICT solutions have been requested in connection with the police's budget processes for several years. The Commission observes that the ministry and the directorate agree that the police's ICT situation is "deplorable". Regardless of whether or not the cause of the situation is the lack of willingness to assign priority to the issue or too weakly grounded budget proposals, the situation ought to be corrected.

A lack of information is a handicap for the ability to exercise control. Information is a prerequisite for being able to understand results and for the police force's real resource and expertise needs. It is also necessary to be able to optimise the use of human resources to the scope of a mission and to be able to understand the practical consequences of new regulations and collective wage agreements. The Commission has found that it is possible, despite cumbersome ICT solutions, to acquire a great deal of valuable leadership information from the systems that already exist. For example, we analysed the Oslo Police District's operations log for the past five years, and we found that July is actually the month with the most operational assignments, and not the opposite. It is our understanding that there has not been much demand for such information. The expertise linked to ICT and analysis must, in our opinion, be strengthened at the leadership, case officer and technical support personnel levels in the ministry and the directorate alike.

ICT is also crucial for intelligence purposes. Our investigations have shown that:

* The Police Security Service has only to a modest degree exploited ICT opportunities to increase the capacity and quality of its work processes. Tips about unknown subjects are usually only checked against the service's own working register and police records before a decision is taken on whether the case will be given priority. Systems and work processes for knowledge management and advanced intelligence using open sources and public records appear to be rather crude.

* Despite the fact that it has been known for years that terrorists operate on electronic platforms, Norway has not yet established any regulations for when the Police Security Service is allowed to monitor potential terrorists' PCs and closed forums on the Internet.

The Police Security Service must deal with the combination of working with classified and sensitive information about individuals and being subject to restrictions on the personal information it is allowed to record. All the same, it appears that the attention of leadership being directed towards what it is possible to achieve using new ICT tools, along with an upgrading of ICT skills in the Police Security Service are necessary to increase the efficiency of the agency's work. More sophisticated use of ICT has a substantial potential for improving efficiency and quality throughout the full range of the work done by the justice sector, thereby making man-years of labour available for operational tasks. This is a key to better emergency preparedness in future.

19.6 Leadership's ability and willingness to clarify responsibility, set goals and take initiatives

Finally, the Commission's review has pointed out a number of examples of failure in the ability of the leadership of different agencies and ministries to clarify responsibilities, set goals and implement measures to equip society to deal with emergency situations as well as possible. It is the leadership that is responsible for ensuring that co-workers have satisfactory general conditions for performing their duties, by setting standards, offering training and ensuring the necessary expertise. The leadership is also responsible for ensuring that resources are used effectively and in a coordinated manner.

Some examples of leadership-related challenges noted by the Commission are:

* Reports filed by the Directorate for Civil Protection and Emergency Planning and the Norwegian National Security Authority after inspecting the Ministry of Government Administration, Reform and Church Affairs' broad portfolio of security and emergency preparedness-related tasks have for several years pointed out factors that are indicative of little awareness of risk and weak implementation capacity. This was first addressed as from 2010.

* When the Armed Forces' emergency helicopter services were reassigned to Afghanistan in 2009, the police's access to helicopter support was reduced. The police's own helicopter service experienced reduced availability during the same period of time. While the consequences of this aggregate shortfall of capacity, not least to transport the Delta force, were acknowledged, they did not trigger any measures to compensate for the shortfall.

* The National Police Directorate was established to ensure strong technical leadership of the agency, and to introduce a clearer distinction between for the technical and political leadership of the police. In the course of our work, we have, however, seen a number of examples to indicate that this distinction has not been very clear. The Commission asks whether the political leadership of the Ministry of Justice and Public Security has got overly involved in the details of its activities at the expense of looking at the long lines. Correspondingly, the leadership of the National Police Directorate has not taken sufficient technical control by drawing up strategies, setting goals and establishing systems for continuous improvement of the police's ongoing preventative and emergency duties. Our investigations have focused on a number of fundamental issues: There is a lack of correspondence between goals, priorities, resources and duties. There is an exceptional number of goals, but few are linked to the police's operational activities. We have seen that the workforce is lowest when the number of assignments is greatest. The Commission has met a police force that has identified challenges itself, but which has not done enough to take control of what they can control at their own organisational level.

The Ministry of Justice and Public Security has sectoral responsibility for many of the agencies that faced challenges on 22 July. The ministry is in charge of the police, the Police Security Service, the Norwegian National Security Authority and the Directorate for Civil Protection and Emergency Planning, and it is also responsible for coordinating the ministries' work with civil protection and emergency preparedness. Our investigations indicate that a lack of overall control of the police force, and a culture of being overly cautious in the Police Security Service, as well as formidable weaknesses in the area of ICT are important underlying reasons for a great deal of what went wrong. The ministry must shoulder its share of the responsibility for these weaknesses. In the view of the Commission, the main challenges after 22 July are related to attitudes, culture and leadership. Leadership has to start at the top. We are therefore of the opinion that the country's leadership, represented by the Government Security Council and the Government's Emergency Council, must spend more time on awareness of threat and risk levels and on ensuring good interaction and responses in the light of the challenges arise.

In addition, the Commission has considered whether there is also a need for a change in the division of work in the community of ministries, not least as recommended by the Committee on the Vulnerability of Society.

We have considered recommending that the coordination of security and emergency tasks be assigned to the Office of the Prime Minister, in order to put sufficient power behind the task, as is the model in Great Britain. However, civil protection is merely one of several important tasks that the Government must resolve jointly, and it is difficult to see that one area should be brought to the fore in such a manner. There are close links between police duties and society's general security and emergency preparedness, a factor that speaks in favour of the police and coordination of security being organised together.

During the years that have passed since the Committee on the Vulnerability of Society suggested the creation of a separate Ministry of Security, the Ministry of Justice and Public Security has been assigned a great many of the duties that were proposed to be brought together. The Commission sees that the ministry already has a broad area of responsibility and large portfolio of duties. In future, when the Ministry of Justice and Public Security tries to strengthen its role as coordinator at the same time as it has to get far more involved in the leadership of its subordinate agencies, we see that this may entail capacity problems. The Commission is not qualified to determine whether this capacity challenge can be resolved within the ministry, or whether it is necessary to transfer considerable responsibilities to another ministry, but this is an issue that merits attention. Notwithstanding, the Commission's view is that the structural organisational challenges are less important than the challenges related to attitudes, culture and leadership. We have seen few examples of formal organisation being a limiting factor. We have seen many examples of leadership not utilising the potential in its own organisation.

19.7 The role of coincidence

The outcome of the authorities' management of 22 July is a result of the actions of individuals and factors related to organisation, resources and systems. However, coincidence – good luck and bad – also played a part in the course of events. That will inevitably be the case in a crisis: Unanticipated events and coincidences will to some extent influence how events play out. Had the bombs at the Government Complex detonated just a few hours earlier, as the perpetrator had planned, many more people would probably have been killed and injured. More than 600 people had been at work in the Government Complex earlier in the day, but almost half had left the area at 3.25 p.m. Had a bomb exploded any other time but during the summer holiday, many of the roughly 3100 people who worked in the Government Complex would have been in danger. It is far too easy to envisage the consequences of such an attack, and the challenges that rescue workers would then have faced.

The fact that the two attacks took place consecutively also affected the police's response time. The call-out response for Utøya Island took place more quickly and with a larger operational force than what is normally available on a Friday afternoon. Delta force was already mobilised at the Government Complex and responded as the first police patrol when the alert was received. Under normal circumstances, they would have needed more mobilisation time and had a smaller force available. Had the massacre on Utøya Island taken place as an isolated incident later the same evening, fewer, less well-trained forces would have been at work at the police station at Hønefoss.

Some coincidences had a positive effect on the police operation. Highly seasoned officers from the Nordre Buskerud County police district were at home and could be called. The operation forces arrived at the new mustering site on Storøya Island minutes before the police boat. Those on board still believed that the mustering site was on the land side of Utøya Island pier, and they were on their way there when they were hailed.

For many, the mobile phone network was the only well-functioning mode of communication that day, but a few weeks earlier there had been a serious outage in large parts of the mobile phone network in eastern Norway.

Society needs to know that it is important to realise that under marginally different circumstances, the consequences of the attacks could have been even more dramatic than the nightmare of 22 July.

At the same time, the police operation on Utøya Island came close to being faster. Large police contingents were deployed from several districts, but they did not manage to coordinate the resources – officers, boats and mustering sites – to achieve the most rapid response operation possible. Certain coincidences also had unfortunate effects. For example, the Delta force did not come across the caller who offered his boat exactly when they were down at Utvika Camping. There are several examples to indicate that the outcome could have been different with a little luck.

We mention these circumstances because they give pause for thought about both the vulnerability and the robustness of emergency preparedness. But let it be said: Professional security work and good attitudes contribute significantly to mitigating the effects of good and bad luck, and the Commission's opinion is that most of the observations we have made about the tragedy on 22/7 are not ascribable to coincidence.

19.8 The decisive role of the individual

Just as certainly as crises are characterised by uncertainty and unpredictability, is the fact that there will be bad calls and actions that turn out to be unfortunate. The judgment of the future will always be coloured by the knowledge of the actual outcome. In the throes of the crisis, choices and their consequences are far less clear. The Commission has nevertheless opted to also describe the actions of individuals, also at the civil servant level, as this has been necessary to provide an accurate impression of the course of events. We understand that this can be difficult for those involved, because it is the fickle finger of fate that has determined which civil servants were put to brutal tests on 22 July and thereby ended up being in the spotlight of the Commission's work. We respect the fact that it is not easy for police officers to live up to society's expectations that they will, in the worst case, have to place their own lives on the line to protect others.

The lessons learned from what failed must be to point out how leadership and organisations can enable individuals to make the right decisions despite uncertainty. Individuals’ actions are largely influenced by how the way has been paved for them to actually perform their duties in a satisfactory manner. In society's quest for a scapegoat, it is easy to forget that imperfect systems can help put individuals in a position to make fatal mistakes. Attention must be devoted to training, practicing, exercises and guidance – and to the choice of good leaders.

By way of conclusion, we would mention two factors that may give pause for both thought and inspiration.

The first refers to the importance of speaking up. It is widely known that many crises could have been averted or handled better if only individuals had expressed their concerns or got involved when they discovered shortcomings or faults. Instead of speaking up, they become passive bystanders, even though they often have valuable information and valuable perspectives that would improve the ability to prevent or manage a crisis. 22 July is, in fact, also a story about the many who knew that critical systems were not working the way they were supposed to, and that measures had not been implemented as planned. It is often the case that in situations in which many observe the same phenomenon, we fail to speak up. Where experts and authorities are involved, there is an extra tendency for many to become passive bystanders. The Commission is of the opinion that reporting risks in one's surroundings is an important part of an individual's responsibility to society. 22 July taught us with the utmost clarity that vigilance and engagement can be of the essence, and that it is important that apparently small and perhaps insignificant details or weak signals are given enough attention soon enough.

The second factor refers to personal initiative and engagement. Volunteer organisations are a mainstay of Norway's emergency preparedness work. Rarely has the value of voluntary involvement and individuals' initiatives been demonstrated more clearly than in the moments after the explosion at the Government Complex and on, and on the banks of, the Tyri Fjord on 22 July. Random passers-by, camping tourists and the residents of Utøya Island were absolutely crucial to one of the most extensive rescue operations ever staged in Norway that afternoon. Ordinary people stepped up and made decisions to act. Their efforts were absolutely crucial for the police operation. Without the efforts of the volunteers that day, more lives would have been lost, and the scope of the devastation would have been even greater. Many of these heroes acted with impressive, altruistic effort, putting their own lives in danger. The humanity and zeal they demonstrated, along with what ultimately swelled into thousands of people who, in organised or nonorganised form, helped in dealing with the tragedy, should serve as an inspiration as we face the future.

19.9 The Commission's main conclusion and recommendations

The Commission's opinion is that the difference between what went well and what went poorly on 22 July was mainly related to attitudes, culture and leadership, and to how people and organisations exercised the authority invested in them. In our view, through White Papers and central legislation in the area of civil protection, the Storting and the Government have struck a reasonable balance between transparency and security and, in most areas, set sensible ambitions for the level of security in society. The challenge lies in engendering better correspondence words and actions.

Measures at the national level

1. The Commission's most important recommendation is that leaders at all levels of the administration work systematically to strengthen their own and their organisations' fundamental attitudes and culture in respect of

              * the acknowledgement of risk,

               * implementation capacity,

               * interaction,

               * ICT utilisation, and

               * result-oriented leadership.

To support these changes of attitude, we also recommend a number of more specific measures. These must be seen connection with the previous chapters, where most are justified and explained in more detail:

2. Both the Government Security Council and the Government's Emergency Council ought to organise regular meetings to keep up with developments in the overall threat and risk situation and to ensure satisfactory interaction and response in the light of the challenges taking shape. The leaders of the Police Security Service, the Intelligence Service, the Norwegian National Security Authority and the Directorate for Civil Protection and Emergency Planning, as well as the chief of defence, the national police commissioner and the chief of police in Oslo should participate.
3. A modern set of plans that identifies and links society's measures in the face of the threat of terrorism and any future acts of terrorism must be established. This can be done by revising the Civil emergency preparedness system or by replacing it.
4. In connection with any future attacks and serious threats, the plans must be followed at every level. The use of plans must be drilled regularly at national and local levels alike. The exercises should include realistic rescue operations and deal with evacuees and their families and friends.
5. Classified communications and routines to ensure a rapid flow of information must be established to, from and between the ministries and their subordinate agencies, also during crises.
6. The provisions of the Security Act that require measures for protecting objects must be implemented in a proactive manner. The Norwegian National Security Authority must have oversight of critical infrastructure protection. A national critical infrastructure protection plan should be drawn up, dimensioning the responsibilities and dividing them between the police, the Armed Forces and the owner of the object. There must be opportunities to conduct realistic exercises on the selected objects.
7. The Ministry of Justice and Public Security must move result-oriented security and emergency preparedness higher on its agenda, set up a systematic way of dealing with its coordinating responsibility and improve the strategic management and follow up of the police, the Police Security Service, the Norwegian National Security Authority and the Directorate for Civil Protection and Emergency Planning.

Amendments to penal provisions

8. Section 161 of the current Penal Code should be continued in the new Penal Code of 2005, which has not yet entered into force, so that also the build-up of firepower will be illegal when carried out with the intent to commit a felony.
9. It should be made punishable to receive terrorist training.
10. Semi-automatic weapons should be banned. Weapons and chemicals control must be improved.

Measures in the police

11. The National Police Directorate must develop a clear system of management by objectives that covers the full range of the agency's responsibilities, and ensure that there is a correlation between goals, priorities, resource and manpower planning, the use of resources and reporting. Operational activities must be fortified. Clear standards must be set for response time, response quality and correspondence between responsibilities and manpower.
12. The National Police Directorate must take more responsibility for coordination, efficiency and more uniform solutions in ‘Police Norway’ and for ensuring that the organisation of the police at the district and local levels is sufficiently robust with a view to response time, operational leadership capacity, experience and equipment.
13. The National Police Directorate must quickly devise a clear and comprehensive ICT strategy for the police to facilitate interaction at the operative and tactical levels, and to be able to analyse, control and develop the agency strategically. Funding must be set aside to ensure rapid, efficient implementation.
14. The operations centres must be equipped and staffed in order to be able to perform their important role. Uniform solutions for effective notification between districts and rapid notification and mobilisation of their own human resources must be established.
15. The individual patrol must be given access to technology for written and visual information sharing and get training in systems that enable them to do their jobs better, act in a concerted manner and exchange information throughout all levels within the police.
16. The police force's expertise for dealing with duties involving the firing of live ammunition must be enhanced. Relevant parts of what is currently training for category three tactical response personnel should also be given to category four tactical response personnel.
17. A national police operation centre should be set up as a scalable part of the operation centre in Oslo to facilitate coordinated interaction when dealing with an event that takes place in several districts or exceeds the capacity of an individual district.
18. The plans for a centre for the police's national emergency preparedness resources should be implemented.
19. A robust police helicopter service must be set up in the Oslo Police District and cooperation schemes must be established to ensure the police's transport capacity in other parts of the country. The capacity and role of the police helicopter in situations involving live fire must be clarified.

Measures in the Armed Forces

20. Rapid, effective helicopter support for the police in connection with efforts to combat terrorism on Norwegian territory ought to be a dimensioning task for the Armed Forces. Consideration should be given to whether the Armed Forces should be charged with further support tasks for the police in the event of a terrorist attack.

Measures in the public health service

21. The public health service ought to maintain its capacity and flexibility for crisis management, including securing the resources needed to conduct exercises.
22. The confidentiality provisions in the Health Personnel Act should be reviewed to ensure that the police and next-of-kin can get the information they need in catastrophic situations.

Measures related to the rescue agencies

23. Personnel in all the emergency services must be trained to be able to take advantage of the potential inherent in the Norwegian Public Safety Radio. Until the system has been fully established all over the country, temporary solutions must be ensured to meet the need for satisfactory communications.
24. An updated set of regulations and plans that will clarify roles and responsibilities must be drawn up for the rescue service, including rules for working in unsecured areas.

Measures related to the security and intelligence services

25. The Police Security Service must develop leadership, organisational culture, work processes and objectives that are better adapted to the service's tasks, at the same time as parameters set out of consideration for democracy and the protection of privacy must continue to be respected. It is especially important to demonstrate more persistence, creativity and determination when it comes to identifying new threats.
26. The Police Security Service must quickly put into place an ICT strategy that can ensure effective information processing and information sharing within the organisation.
27. The Police Security Service must take more initiatives and show more willingness to cooperate and share information with other agencies, including the ordinary police and the Intelligence Service. The confidentiality provisions in legislation should be harmonised with the established regulations for the Police Security Service’s work, so that the Police Security Service can gain access to relevant information from other agencies in cases in which they are allowed to record information or create a case. Further, the confidentiality provisions should not be an impediment that would prevent other government agencies from providing tips to the Police Security Service when the agencies believe that there is reason to examine whether terrorist acts are being planned.
28. In other cases, when the Police Security Service is allowed to use clandestine methods in Norway, it must be clarified that the legislation also allows the Police Security Service to ask the Intelligence Service for help with retrieving information about Norwegian and foreign nationals abroad. Similarly, the Ministry of Justice and Public Security must clarify that the legislation allows the Police Security Service to disclose information from communications control and other retrieval methods to the Intelligence Service where this is required to support the two services' legitimate work.
29. The existing regulations for when radical methods such as ransacking and wiretapping are allowed should have their parallel counterpart in regulations for the Police Security Service’s counter-terrorist activities in cyberspace.
30. In the event of terrorist attacks or threats of terrorism against Norwegian interests, the Police Security Service must be aware of its special responsibility for pro-actively informing national authorities and relevant government agencies of its assessment of the level of threat so that measures can be implemented in time. In addition, the Police Security Service must take more independent initiatives to detect and avert further attacks.
31. To ensure the prudent use of resources and the optimal use of expertise and capacity to prevent, detect and fight terrorist acts, a review should be made of the way in which the national security and intelligence services are coordinated and interact when it comes to facing an uncertain future level of threat.