The spotlight in the Treasury Budget-leak saga now appears to be turning to the Government Communications Security Bureau.

The Bureau is responsible through the National Cyber Security Centre for the security of Government IT systems, particularly sensitive ones like Treasury.

From answers by the Prime Minister to questions at her weekly press conference yesterday it appears that when both Treasury Secretary Gabriel Makhlouf and Finance Minister Grant Robertson issued their press statements last Tuesday night saying Treasury had been hacked, they didn’t actually know how National had been able to acquire its budget documents.

Their use of the phrase “systematic and deliberate hack” appears to have been guesswork.

“At the time that the statements were made  (between 8.02 and 8.19 p.m.m) by the Secretary of Treasury, Gabriel Makhlouf,  and the Minister of Finance, Grant Robertson, no Minister had received any advice at all about what might have happened from the GCSB,” Jacinda Ardern said.

She said that her statement included Andrew Little, the Minister in Charge of the GCSB.

It was only after those statements were made, and a consequent mild panic that seems to have gone through the intelligence community in Wellington,  that the Government Communications Security Bureau told Little that Treasury had not been hacked.

“ Later on in the evening later in the evening by several hours,  GCSB disputed some of the language that was used,” said Ardern.

That appears to have been in a call or meeting with Little.

“The State Services Commission, of course, have outlined that they will be looking into the advice and information that was provided to ministers and the reliability of that advice and information.


Asked what GCSB Director  Andrew Hampton actually said to Little, Ardern said: ” This is where I want to allow the State Services Commission to get into some of that detail.

” It is fair to say that no minister received any advice from the GCSB  at the time that the (Secretary of the) Treasury put out these statements and at the time the Minister of Finance put out his.

“It is fair to say to say that while there were different views on the language; there was no clarity around what in fact had happened.

“Of course that information was not received until Wednesday evening.”

 “We did change the language at that point.

“But if you’re asking me whether or not there was a full picture at that point of what exactly happened, no that didn’t come in to later on Wednesday.”

Ardern indicated that Little had spoken directly to Robertson with the “it’s not a hack” advice from the GCSB.

Whether the “dispute” over language involved Little is not clear.

“But all of it was after the fact that statements were put out,” Ardern said.

 “Ministers were receiving different information from different sources over the course of that evening.

“We all found out generally or later in the evening around similar timeframes. All of it was after the fact. “

Ardern repeatedly emphasised that “we” did not know what happened until Wednesday evening.

But there are claims, from within National, that Treasury did know by Monday afternoon how they had obtained the information and by 4.00 p.m..had fixed the security lapse which had left Budget material on the Treasury website open to anybody who did a Google search.

POLITIK understands that is the basis for National’s questioning of Treasury Secretary  Gabriel Makhlouf’s use of the “systematic hack” phraseology in the 8.02 p.m. press statement.

That is why they have called for his resignation, and it is why National MPs are boycotting his official farewell at Parliament on Wednesday.

But the situation appears now to be less precise than leaks out of National might suggest.

There are questions about why the GCSB kept the information about what had happened at Treasury to itself and did not see fit to advise its own Minister about what had happened even though the issue was dominating news headlines all through Tuesday.

If it was a straightforward human error, as National sources are saying, then why wasn’t the GCSB able to say so?

Not surprisingly;y their actions are now going to be included in the State Services Commission inquiry into the whole affair.

“And that, of course, is why it’s so important that we have that independent view of the State Services Commissioner.

“You understand why I’m very keen to allow them to do their job. “

The Government’s rhetoric has now subtly shifted over the whole affair away from initially implying that Robertson made his statement about hacking on the advice of Makhlouf — in other words, alleging that Makhlouf has misled his Minister.

But yesterday, Ardern was saying that BOTH Makhlouf and Robertson had “no clarity” about what happened when they made their statements.

That would seem to remove some pressure from Makhlouf.

And a Stuff report from last Friday suggests that the contact between Treasury and the GCSB was remarkably casual.

Stuff said a  spokeswoman for the GCSB said that on Tuesday evening Treasury had asked the National Cyber Security Centre for its advice in response to possible unauthorised activity involving its web server.

“A Treasury staff member described the incident to an NCSC responder and asked if it was a matter for the NCSC or police, the spokeswoman said.

“Given the incident did not involve a compromise of the Treasury computer network and was therefore not the type of incident the NCSC would normally respond to it was recommended that the matter be referred to police for their assessment.”

It is, however, the timeline that lies at the heart of this issue.

National has an opportunity to challenge the Prime Minister about the facts in Parliament during Question Time tomorrow.

They might expect some challenges in return over why they waited for 48 hours before they offered up the details of how they had obtained the Budget information.

However, National appears to have its mind made up, and National MPs will boycott the farewell function in Parliament on Wednesday for Makhlouf as a protest against his supposed role in the whole affair.

A week ago they might have found themselves getting some quiet support from Labour, but now the Government’s management of this affair has changed.  Now the GCSB appears also to be a target.

And after today, National will find the going a little more difficult in Parliament.

POLITIK understands the Prime Minister will be in Hamilton at the Field Days on Wednesday and the deputy Prime Minister, Winston Peters will substitute for her.

That is unlikely to make anything any clearer.