Online threats to MPs and Commonwealth officials.

The news, in summary.

On 23 June 2026, the Australian Federal Police National Security Investigations team executed a search warrant in Mayfield and charged a 35-year-old man with threatening to cause serious harm to a Commonwealth public official, contrary to section 147.2 of the Criminal Code Act 1995 (Cth), and with the possession of a prohibited weapon, contrary to section 7(1) of the Weapons Prohibition Act 1998 (NSW). Police allege a black replica pistol, clothing and face coverings recovered at the address were used while filming an online video that included threats directed at a federal Member of Parliament between October 2025 and June 2026. The accused was granted conditional bail to appear at Newcastle Local Court on 30 July 2026.

A day later, on 24 June 2026, a separate NSW man was charged in connection with allegedly abusive emails directed at another Commonwealth official. The AFP did not name the recipient. Both matters fall within the same Part 7.8 division of the Criminal Code that prohibits violence and threats against Commonwealth public officials.

Threats made online are charged in the same way as threats made by letter or in person. The medium does not change the offence. What changes is the evidence trail. Phones, hosting accounts, and the platform itself produce records that an investigator can compel under a section 3LA notice or a foreign-jurisdiction request, and those records often prove the offence well before any conversation is had with the accused. That is the first practical fact a person facing one of these charges needs to understand.

What does section 147.1 of the Criminal Code cover?

Section 147.1 is the lower of the two threat offences directed at the protection of Commonwealth public officials. A Commonwealth public official is defined broadly in section 5 of the Dictionary at the back of the Criminal Code, and the definition picks up Members of Parliament, their staff, employees of Commonwealth agencies, and a long list of judges, magistrates, and contractors performing functions on behalf of the Commonwealth.

Section 147.1(1) makes it an offence to cause harm to a Commonwealth public official, with the harm being caused because of the official’s status or duties. The maximum penalty is 10 years’ imprisonment. Section 147.1(2) makes it an offence to threaten to cause serious harm with the intent that the official fear the threat will be carried out. The maximum here is 7 years.

The element that does most of the work is the connection between the harm or threat and the official’s status. The Crown does not need to prove the accused targeted a particular individual. It is sufficient that the threat was made because the person was a Commonwealth official, or because of something done in that capacity.

What does section 147.2 add?

Section 147.2 raises the bar to a threat directed specifically at causing death, and to threats that are made by people not yet charged but who have means to act. The maximum penalty for a threat to kill is 9 years, and for a threat to cause serious harm it is 7 years. A direct threat to kill is more easily proved as a section 147.2 offence than as the broader 147.1, and the AFP will charge what the evidence will support.

The Mayfield charge is brought as a section 147.2 matter. The reference to the recovered replica pistol and the clothing allegedly worn in the online video is not incidental. It speaks to the appearance of capability, which is a factor that often informs whether the Crown chooses the more serious section.

What does the prosecution have to prove?

The Crown must prove four things beyond reasonable doubt. First, that a threat was made by the accused. Second, that the threat was directed at causing the relevant harm — death or serious harm depending on the section. Third, that the recipient was a Commonwealth public official, or someone the accused believed to be one. Fourth, that the accused either intended the official to fear the threat would be carried out or was reckless to that fear.

Fault is the most contested element in these matters. A threat made in anger, made to a person the accused did not know was a Commonwealth official, or made in a context that no reasonable observer could read as serious, may not be made out. The defence has to be careful with this argument; the threshold for recklessness is not high.

A threat does not need to be communicated directly to the official to be charged. A video posted online, an email sent to a publicly available address, or a message to a third party who is likely to convey it, are all sufficient. The case authorities consistently treat the audience question as secondary to the content question.

What does the AFP look at first?

A National Security Investigations team will move on three things at once. The first is the device or account that produced the material. The second is the home address, where a section 3E search warrant is the usual instrument. The third is the social-media platform or email provider, which is served a notice that compels the production of subscriber, login, and content data.

A search will recover devices, removable media, and anything visible that connects to the online conduct. In the Mayfield matter the AFP recovered the replica pistol, clothing, and face coverings that police allege were used in the recorded video. The mere presence of the items does not prove the offence; what proves the offence is a chain of evidence that connects them to the accused and to the published content.

In the second matter the AFP charged the accused over allegedly abusive emails. The header data on email is now the easier evidentiary item. Where the email was sent from, when, and on what device, are recoverable from the provider in days.

Bail considerations.

Section 147.1 and section 147.2 are Commonwealth offences. The Bail Act 2013 (NSW) governs the bail decision at the state-court level for Commonwealth matters heard in the NSW Local Court, by force of section 68 of the Judiciary Act 1903 (Cth). The threshold tests under sections 17 and 19 of the Bail Act are not displaced.

A bail application in a Commonwealth threat matter turns on three things. First, the seriousness of the alleged conduct, including whether it discloses an ongoing threat. Second, the strength of the prosecution case, which in these matters is usually anchored in seized digital material. Third, what conditions can be imposed that address the unacceptable risk identified by the prosecution. Conditions commonly proposed include surrender of devices, prohibitions on social-media use, residence conditions, and curfews. The Mayfield accused was granted conditional bail. The conditions are not on the public record.

Common defences.

There are three lines that defence counsel test in every one of these matters.

• No threat was made: the words or images relied on by the prosecution, taken in context, do not amount to a threat. This is a question of meaning. Sarcasm, parody, or political commentary can be charged but should not be charged.
• No fault: the accused did not intend that the official fear the threat would be carried out and was not reckless to that risk. This will turn on the broader pattern of communication.
• Mistaken identity: the digital trail does not connect the accused to the post or the email. This defence depends on what was recovered from the device and what the provider supplied to the AFP. It is rarely available where the search has produced a connecting item.

Where the digital evidence is strong, the realistic question becomes the appropriate disposition. A guilty plea at the earliest available point attracts the section 16A early-plea discount in the District Court if the matter is committed. In the Local Court, the Commonwealth sentencing principles in section 16A of the Crimes Act 1914 (Cth) apply.

What we tell people in this position.

The first thing is not to talk. Section 23 of the Crimes Act 1914 (Cth) is the right-to-silence section for Commonwealth offences. A no-comment interview is not held against an accused at trial in any meaningful sense, and it preserves every defence option.

The second thing is to preserve the device and any cloud account. Deleting a message, wiping an app, or factory-resetting a phone after charge is the surest way to add a charge under section 39 of the Crimes Act 1914 (Cth) — destroying or concealing evidence. The AFP will already have a forensic copy of the device taken at the search.

The third thing is to take legal advice before the first court date. The Commonwealth list at any Local Court will move quickly. A solicitor who has read the brief at the first mention is in a better position to negotiate a bail variation, identify a representation issue, or signal to the prosecution that the matter is going to be defended.

Frequently asked.

Is a threat sent online treated the same as a written threat?

Yes. The medium does not change the offence. What changes is the evidence trail. A post on social media or an email is an admissible record once the platform has been compelled to produce the data behind it. The Crown will usually have that material before the first mention.

Can a threat that is sarcastic or made in anger still be charged?

It can. The line is whether a reasonable observer in the position of the recipient would treat the words as a threat. Sarcasm and political commentary are protected if the content cannot reasonably be read as a threat. Anger does not protect the speaker.

Will I be granted bail on a section 147.2 charge?

In most cases yes, but the bail conditions are heavy. Expect a surrender of devices, prohibitions on social-media use, residence conditions, and a curfew. Bail is decided under the Bail Act 2013 (NSW) in the Local Court even though the offence is a Commonwealth one.

What is the maximum penalty?

Seven years’ imprisonment for a section 147.2 threat to cause serious harm. Nine years for a threat to kill. Section 147.1 carries 7 years for a threat to cause serious harm and 10 years if actual harm is caused.

Can the AFP read my private messages?

They can compel the platform to produce them. The Telecommunications (Interception and Access) Act 1979 (Cth) and the production powers under the Surveillance Devices Act 2004 (Cth) cover most of the data routes. Encrypted messaging makes it harder, but the device itself is rarely encrypted past a forensic copy.

To speak to a criminal defence lawyer, call Aaron Kernaghan on 0421 717 019.

This article is written by Aaron Kernaghan, criminal defence lawyer at Good Legal Lawyers, as at 25 June 2026. It is commentary and reflects the personal opinion of the author only. It is not legal advice, it is not a substitute for advice on your own matter, and it does not purport to be accurate or complete. Any matter referred to may be before the court and any person charged is presumed innocent. For advice on a specific matter, contact Aaron Kernaghan on 0421 717 019 or contact the firm.

More criminal-law commentary by Aaron Kernaghan.

← Back to all news